diff --git a/.altestrunner/config.json b/.altestrunner/config.json
new file mode 100644
index 0000000..034f2f5
--- /dev/null
+++ b/.altestrunner/config.json
@@ -0,0 +1,16 @@
+{
+  "containerResultPath": "",
+  "launchConfigName": "",
+  "securePassword": "",
+  "userName": "",
+  "companyName": "",
+  "testSuiteName": "",
+  "vmUserName": "",
+  "vmSecurePassword": "",
+  "remoteContainerName": "",
+  "dockerHost": "",
+  "newPSSessionOptions": "",
+  "testRunnerServiceUrl": "",
+  "codeCoveragePath": ".altestrunner\\codecoverage.json",
+  "culture": "en-US"
+}
\ No newline at end of file
diff --git a/custom/README.md b/custom/README.md
index 28d7aa9..0b6c988 100644
--- a/custom/README.md
+++ b/custom/README.md
@@ -15,3 +15,68 @@ custom/
 Fork or clone BCQuality into your own repository and add your content here. Knowledge files in `/custom/knowledge/` follow the same frontmatter schema and section requirements as every other layer. Action skills in `/custom/skills/` follow the Action Skill template defined in `/skills/`.
 
 When agents consume BCQuality, the custom layer is loaded alongside Microsoft and Community — your overrides apply automatically.
+
+---
+
+# CURABIS — BCQuality customizations
+
+## Developer onboarding (new machine)
+
+Two files must be placed on the developer's machine. Everything else is automatic.
+
+### 1. Global Claude Code instructions
+
+Copy [`setup/machine/CLAUDE.md`](setup/machine/CLAUDE.md) to `~/.claude/CLAUDE.md`
+and fill in your name and username.
+
+This file tells Claude Code about CURABIS Standard in every session —
+including brand-new, unconfigured repositories.
+
+### 2. BC MCP credentials
+
+Create `~/.bc-mcp.config.json` with your BC service-to-service credentials:
+
+```json
+{
+  "tenantId": "<your-tenant-id>",
+  "clientId": "<your-client-id>",
+  "clientSecret": "<your-client-secret>",
+  "baseUrl": "https://api.businesscentral.dynamics.com"
+}
+```
+
+**Never commit this file.** It contains secrets.
+
+## Configuring a new project
+
+Once the two machine files are in place, open any AL-Go repository in VS Code
+and tell Claude Code:
+
+> "Konfigurer dette projekt til CURABIS Standard"
+
+Claude fetches [`setup/curabis-standard.agent.md`](setup/curabis-standard.agent.md)
+and writes all project files automatically:
+`CLAUDE.md`, `.mcp.json`, `.github/.agents/`, `cspell.json`, `projectmemory/`.
+
+The BC MCP bridge (`bc-mcp-bridge.js`) is also installed to `~/.claude/`
+from this repo — so it stays up to date every time setup is re-run.
+
+## Folder structure
+
+```
+custom/
+  README.md                          ← this file
+  knowledge/
+    architecture/                    ← AL architecture rules
+    testing/                         ← test quality rules
+    mcp/                             ← BC MCP / API page rules
+  setup/
+    curabis-standard.agent.md        ← project setup agent
+    bc-mcp-bridge.js                 ← BC MCP bridge (authoritative copy)
+    machine/
+      CLAUDE.md                      ← global Claude Code instructions template
+    templates/
+      bcquality.agent.md             ← BCQuality review agent (per project)
+      immanuel.agent.md              ← Rule guardian agent (per project)
+      cspell.json                    ← Standard spell-check config
+```
diff --git a/custom/knowledge/architecture/al-identifiers-must-be-english.md b/custom/knowledge/architecture/al-identifiers-must-be-english.md
new file mode 100644
index 0000000..34191db
--- /dev/null
+++ b/custom/knowledge/architecture/al-identifiers-must-be-english.md
@@ -0,0 +1,81 @@
+---
+bc-version: [all]
+domain: architecture
+keywords: [naming, english, enu, variable, procedure, field, caption, translation, xliff]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+---
+
+## Description
+
+All AL identifiers must be written in English (ENU) regardless of the language
+used in conversation with the developer. Translations are handled separately
+via XLIFF files — never by writing Danish, German or other language identifiers
+in AL source code.
+
+This applies to:
+- Variable names
+- Procedure names
+- Parameter names
+- Field names
+- Object names (tables, codeunits, pages, enums, reports)
+- Enum value names
+- Local and global labels (Label data type) — both the identifier and the default text
+
+**Captions and ToolTips** may be in the target language in the source file,
+but must also be covered by XLIFF translations for all supported locales.
+
+## Anti Pattern
+
+```al
+// WRONG: Danish identifiers
+var
+    Kreditor: Record Vendor;
+    Beløb: Decimal;
+    AntalKilo: Decimal;
+
+procedure BeregnTotalbeløb(Antal: Decimal; Pris: Decimal): Decimal
+begin
+    exit(Antal * Pris);
+end;
+
+field(50101; "Indgående Mængde"; Decimal) { Caption = 'Indgående Mængde'; }
+```
+
+## Best Practice
+
+```al
+// CORRECT: English identifiers, Danish captions handled via XLIFF
+var
+    Vendor: Record Vendor;
+    Amount: Decimal;
+    QuantityKg: Decimal;
+
+procedure CalculateTotalAmount(Quantity: Decimal; UnitPrice: Decimal): Decimal
+begin
+    exit(Quantity * UnitPrice);
+end;
+
+field(50101; "Inbound Quantity"; Decimal) { Caption = 'Inbound Quantity'; }
+// Caption translation → da-DK XLIFF: 'Indgående Mængde'
+
+// WRONG: Danish label identifier and text
+var
+    BeløbFejlTxt: Label 'Beløbet må ikke være negativt';
+
+// CORRECT: English label identifier and default text — translated via XLIFF
+var
+    AmountMustNotBeNegativeErr: Label 'Amount must not be negative.', Comment = '%1 = Amount';
+```
+
+## Conversation vs. code
+
+The developer may describe requirements in Danish. The agent must translate
+the intent into English identifiers when writing AL code:
+
+- "opret en variabel til beløbet" → `var Amount: Decimal;`
+- "procedure der beregner lagerværdien" → `procedure CalculateInventoryValue(...)`
+- "felt til indgående mængde" → `field(... ; "Inbound Quantity"; Decimal)`
+
+Never echo Danish words from the conversation directly into AL identifiers.
diff --git a/custom/knowledge/architecture/clarify-before-building.md b/custom/knowledge/architecture/clarify-before-building.md
new file mode 100644
index 0000000..8767219
--- /dev/null
+++ b/custom/knowledge/architecture/clarify-before-building.md
@@ -0,0 +1,94 @@
+---
+bc-version: [all]
+domain: architecture
+keywords: [clarify, ambiguity, requirements, questions, before-coding, task-evaluation]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+---
+
+## Description
+
+Before writing any AL code, the agent must evaluate whether the task is
+unambiguously defined. If the task can be interpreted in more than one way,
+the agent must ask clarifying questions and wait for answers before proceeding.
+
+No code may be written, edited or deleted until the task is 100% clear.
+
+This rule exists because AL code changes affect compiled extensions, running
+BC environments and test databases. An incorrect assumption costs more to
+undo than a clarifying question costs to ask.
+
+## When to ask
+
+Ask before coding if any of the following is true:
+
+- The task mentions an object, field or flow that does not exist yet and the
+  design is not specified
+- The expected behaviour could match more than one existing code path
+- The task involves a business rule (amounts, thresholds, VAT, posting groups)
+  where an assumption could produce silently wrong ledger entries
+- The scope is unclear: "fix this" or "make it work" without specifying what
+  correct behaviour looks like
+- The counterparty type, document type, direction or posting flags are not
+  stated and cannot be unambiguously inferred from context
+- The test assertions reference calculated values that depend on setup data
+  the agent has not yet read
+
+## How to ask
+
+State what you understand the task to be, then list the specific questions:
+
+```
+I understand the task as: [one sentence summary]
+
+Before I proceed, I need clarification on:
+1. [specific question]
+2. [specific question]
+
+I will not write any code until these are answered.
+```
+
+Do not write partial code while waiting. Do not write "placeholder" code.
+Do not write code with TODO comments where a business decision is needed.
+
+## When NOT to ask
+
+Do not ask if:
+- The task is fully specified with object names, field names, expected values
+  and posting behaviour
+- The answer can be determined by reading existing source files or .md
+  documentation in the project
+- The ambiguity is purely cosmetic (formatting, comment wording)
+
+If the answer is in the project's source files or documentation, read those
+files first and resolve the ambiguity yourself before asking the developer.
+
+## Anti Pattern
+
+```
+// WRONG: Assuming and building
+// Task: "write a test for the vendor flow"
+// Agent assumes: Vendor, Incoming, Handle+Invoice, no contact
+// Writes 80 lines of code
+// Developer says: "I meant outgoing flow with a customer"
+// Result: wasted work, possible production code changes to revert
+```
+
+## Best Practice
+
+```
+// CORRECT: Clarify first
+// Task: "write a test for the vendor flow"
+
+I understand the task as: writing a test codeunit for a Settlement Voucher
+flow where the counterparty is a Vendor.
+
+Before I proceed, I need clarification on:
+1. Incoming (vendor delivers goods) or Outgoing (vendor picks up goods)?
+2. Handle-only, Invoice-only, or combined Handle+Invoice in one run?
+3. Should the test use an existing vendor from the database or create one
+   via LibraryPurchase.CreateVendor?
+
+I will not write any code until these are answered.
+```
diff --git a/custom/knowledge/architecture/commit-message-must-include-bc-task-id.md b/custom/knowledge/architecture/commit-message-must-include-bc-task-id.md
new file mode 100644
index 0000000..a12aa09
--- /dev/null
+++ b/custom/knowledge/architecture/commit-message-must-include-bc-task-id.md
@@ -0,0 +1,63 @@
+---
+name: commit-message-must-include-bc-task-id
+description: >
+  Every commit message must begin with the BC task ID in [#id] format,
+  where id is the global taskId from the CUR MCP Active Tasks page.
+layer: 2
+category: architecture
+---
+
+# Commit Message Must Include BC Task ID
+
+## Description
+
+Every commit must reference the BC sub-task it belongs to by prefixing the
+message with `[#taskId]`, where `taskId` is the globally unique, sequential
+task identifier from the **CUR MCP Active Tasks** page (field `taskId`).
+
+This links code history directly to customer-facing work items in BC, enables
+time registration traceability, and is consistent with the convention already
+used across Curabis teams.
+
+## Anti Pattern
+
+```
+Add Price Lookup feature — FindPrice page, tier prices, currency conversion
+```
+
+No traceability. Impossible to find the BC task from git history.
+
+## Best Practice
+
+```
+[#8738] Add Price Lookup feature — FindPrice page, tier prices, currency conversion
+[#8738] Add 22 UI tests for PRICING LOOKUP feature
+[#8738] Add translations, shared project memory and cspell config
+```
+
+## The two task numbers — use taskId, not taskNo
+
+The sub-task has two numbers — do not confuse them:
+
+| Field | Description | Use for |
+|---|---|---|
+| `taskNo` | Sequential within the project (e.g. 42) | Referencing within a project |
+| `taskId` | Globally unique across all projects (e.g. 8738) | **Commit messages** |
+
+Always use `taskId` in commit messages. It is unambiguous across all projects
+and repos.
+
+## How to find the taskId before committing
+
+1. Get the current branch: `git branch --show-current`
+2. Find the linked project via BC MCP (see `[[bc-mcp-find-active-task-for-branch]]`)
+3. Read `taskId` from the matching active task
+4. Prefix every commit on this branch with `[#taskId]`
+
+If no task exists for the branch, create one first (see bc-mcp.agent.md
+create-task workflow) or ask the project manager to register the work.
+
+## Scope
+
+All commits that reach the main branch — feature, fix, test, chore, docs.
+Merge commits and auto-generated commits (renovate, al-go) are exempt.
diff --git a/custom/knowledge/architecture/exposed-objects-must-be-in-a-permission-set.md b/custom/knowledge/architecture/exposed-objects-must-be-in-a-permission-set.md
new file mode 100644
index 0000000..6012ca5
--- /dev/null
+++ b/custom/knowledge/architecture/exposed-objects-must-be-in-a-permission-set.md
@@ -0,0 +1,41 @@
+# Exposed objects must be in at least one permission set
+
+**Rule (CURABIS-ARCH-011):** Every *exposed* object in a CURABIS app must be a member of
+at least one permission set shipped by that app. "Exposed" means any object reachable from
+outside the app's own UI:
+
+- API pages (`PageType = API`)
+- Web-service-enabled pages and queries (`ServiceEnabled = true`, published web services)
+- API queries
+
+## Why
+
+An exposed object that is in no permission set is **unusable and invisible** to the users
+and service identities that are supposed to call it. This is exactly how the MCP API pages
+(`CUR MCP Projects`, `CUR MCP Active Tasks`, `CUR MCP Task Comments`) failed: the tables
+behind them were granted, but the pages themselves had no `= X` execute permission, so the
+MCP server could not see or call them.
+
+It is also a **governance gap**: an endpoint that nobody deliberately put in a permission
+set is an endpoint nobody is deciding who may reach. Exposure must be an explicit choice.
+
+## How to apply
+
+1. For every exposed object, add an execute entry (`page "..." = X`, `query "..." = X`) to
+   a permission set in the app.
+2. **Sensitive endpoints go in a dedicated admin permission set** (e.g. `CUR ... Admin`)
+   that is *not* part of the default assignable set — so reaching them is a deliberate grant,
+   not the default.
+3. If an object should not be reachable from outside at all, **remove the exposure** instead
+   (drop `PageType = API` / `ServiceEnabled`) rather than leaving an orphaned endpoint.
+
+## How to check
+
+Scan the app for exposed objects and verify each is referenced in a permission set:
+
+- find every `PageType = API`, `ServiceEnabled = true`, and API query
+- confirm each appears as a `page`/`query` `= X` entry in at least one `permissionset`
+- flag any exposed object with no permission-set membership
+
+A reviewer (or an automated check) should fail the change if an exposed object is missing
+from every permission set.
diff --git a/custom/knowledge/architecture/namespace-must-be-verified-from-source.md b/custom/knowledge/architecture/namespace-must-be-verified-from-source.md
new file mode 100644
index 0000000..3948242
--- /dev/null
+++ b/custom/knowledge/architecture/namespace-must-be-verified-from-source.md
@@ -0,0 +1,86 @@
+---
+bc-version: [all]
+domain: architecture
+keywords: [namespace, using, compile, al-language, tablerelation, variable, codeunit]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+---
+
+## Description
+
+When an agent adds a variable referencing a BC or custom object, it must verify
+the correct namespace by reading the source file of that object — not by guessing
+or relying on its training data.
+
+An AL file that "compiles" in the agent's own build may still show as red in
+VS Code because the AL Language Server resolves namespaces differently.
+The authoritative source for a namespace is always the object's own source file.
+
+This rule applies to:
+- `using` declarations at the top of a codeunit, table, page or enum
+- Variable declarations that reference tables, codeunits, pages or enums
+- `TableRelation` and `CalcFormula` references
+
+## How to verify a namespace
+
+Before adding a `using` statement or a variable referencing an object, the agent
+must locate and read the source file for that object:
+
+```
+// Step 1: Find the source file
+Glob: "**/[ObjectName].*.al"  or  al_symbolsearch query: "[ObjectName]"
+
+// Step 2: Read the first line — the namespace declaration
+namespace SettlementVoucher.SettlementVoucher;   ← this is what to use
+
+// Step 3: Add the using statement in the consuming file
+using SettlementVoucher.SettlementVoucher;
+```
+
+If the object is a Microsoft base application object, use `al_symbolsearch` to
+look up the correct namespace — do not assume it from the object name alone.
+Microsoft namespaces changed significantly from BC24 onwards.
+
+## Anti Pattern
+
+```al
+// WRONG: Guessing the namespace from the object name
+using Microsoft.Purchases.Vendor;    // guessed — may be wrong
+using SettlementVoucher;             // incomplete — missing sub-namespace
+
+var
+    Vendor: Record Vendor;           // missing using → red in AL Language Server
+    SVPost: Codeunit "SV Post";      // wrong namespace → unresolved reference
+```
+
+## Best Practice
+
+```al
+// CORRECT: Read SVPost.Codeunit.al first → find: namespace SettlementVoucher.SettlementVoucher
+// CORRECT: Use al_symbolsearch to find Vendor → namespace Microsoft.Purchases.Vendor
+
+using Microsoft.Purchases.Vendor;
+using Microsoft.Finance.GeneralLedger.Ledger;
+using SettlementVoucher.SettlementVoucher;
+
+codeunit 50204 "SV Incoming Item Flow Tests"
+{
+    var
+        Vendor: Record Vendor;
+        GLEntry: Record "G/L Entry";
+        SVPost: Codeunit "SV Post";
+```
+
+## Verification step before delivering code
+
+After writing any AL file, the agent must:
+
+1. List every `using` statement in the file
+2. For each one: confirm the namespace was read from the actual source file
+   or looked up via `al_symbolsearch` — not assumed
+3. If any namespace was assumed rather than verified, re-read the source and correct it
+
+Never report "compiled successfully" based on a build that did not go through
+the AL Language Server in VS Code. The definitive compilation result is what
+VS Code shows — not the agent's internal build.
diff --git a/custom/knowledge/architecture/new-file-requires-vscode-refresh.md b/custom/knowledge/architecture/new-file-requires-vscode-refresh.md
new file mode 100644
index 0000000..032d800
--- /dev/null
+++ b/custom/knowledge/architecture/new-file-requires-vscode-refresh.md
@@ -0,0 +1,62 @@
+---
+bc-version: [all]
+domain: architecture
+keywords: [workspace, compile, diagnostics, refresh, al-language, multi-project, new-file]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+---
+
+## Description
+
+When Claude Code creates a new AL file in a multi-project workspace
+(e.g. `Jernpladsen` + `Jernpladsen.Test`), the AL Language Server in VS Code
+may temporarily assign the new file to the wrong project. This causes false
+compilation errors such as:
+
+- Missing references to test codeunits (e.g. `Library Assert`)
+- Object ID out of range for the main app
+- Missing `app.json` dependencies
+
+These errors are **not real** — they disappear after VS Code refreshes its
+project context. Claude Code must not attempt to fix them.
+
+## Rule
+
+After creating a new AL file, Claude Code must:
+
+1. Stop all compilation and diagnostic activity immediately
+2. Instruct the developer to refresh VS Code:
+   `Ctrl+Shift+P → AL: Reload Extension`
+3. Wait for explicit confirmation from the developer that the refresh is done
+4. Only then run `al_getdiagnostics` or `al_compile` to check for real errors
+
+## What NOT to do
+
+- Do not investigate namespace errors that appear immediately after file creation
+- Do not modify `using` statements based on errors seen before a refresh
+- Do not move or rename the file based on pre-refresh diagnostics
+- Do not run `al_compile` or `al_build` immediately after creating a new file
+- Do not report "compilation failed" based on pre-refresh diagnostics
+
+## Signal to watch for
+
+If `al_getdiagnostics` returns errors referencing objects that clearly belong
+to the other project (e.g. `Library Assert` errors in a main app context,
+or ID range errors for a test codeunit), this is a pre-refresh false positive.
+
+Stop. Instruct the developer to refresh. Wait. Then re-run diagnostics.
+
+## Message to developer
+
+When this situation occurs, output exactly this message before stopping:
+
+```
+⚠️ VS Code needs a refresh before I can check for real compilation errors.
+
+Please run: Ctrl+Shift+P → AL: Reload Extension
+
+Let me know when the refresh is done and I will re-check diagnostics.
+```
+
+Do not continue with any other activity until the developer confirms the refresh.
diff --git a/custom/knowledge/architecture/pages-must-not-contain-business-logic.md b/custom/knowledge/architecture/pages-must-not-contain-business-logic.md
new file mode 100644
index 0000000..073a919
--- /dev/null
+++ b/custom/knowledge/architecture/pages-must-not-contain-business-logic.md
@@ -0,0 +1,65 @@
+---
+bc-version: [all]
+domain: architecture
+keywords: [page, trigger, onaction, modify, codeunit, logic]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+---
+
+## Description
+
+In CURABIS codebases, pages are pure presentation. Business logic, calculations,
+validations, and record modifications belong in codeunits — not in page triggers
+or actions. This is stricter than the general BC guidance and applies to all
+CURABIS PTE apps.
+
+A page procedure that calculates a value and assigns it to a field, calls
+`Rec.Modify()` directly, or implements business rules is an architecture violation
+even if it compiles.
+
+**Exceptions:**
+- Setup pages may read and write their own setup record directly.
+- The designated "Run Conversion" page may call the conversion codeunit directly.
+
+## Anti Pattern
+
+```al
+// WRONG: calculation and Modify in a page action
+trigger OnAction()
+begin
+    Rec."Total Amount" := Rec.Quantity * Rec."Unit Price";
+    Rec."VAT Amount" := Rec."Total Amount" * 0.25;
+    Rec.Modify();
+end;
+```
+
+```al
+// WRONG: validation logic in page trigger
+trigger OnValidate()
+begin
+    if Rec.Quantity < 0 then
+        Error('Quantity cannot be negative');
+    Rec."Total Amount" := Rec.Quantity * Rec."Unit Price";
+end;
+```
+
+## Best Practice
+
+```al
+// CORRECT: page delegates to codeunit
+trigger OnAction()
+begin
+    SVManagement.RecalculateLine(Rec);
+end;
+```
+
+```al
+// CORRECT: validation belongs in table or codeunit
+trigger OnValidate()
+begin
+    SVManagement.ValidateAndRecalculate(Rec);
+end;
+```
+
+The codeunit owns the logic. The page owns the presentation.
diff --git a/custom/knowledge/architecture/shared-project-memory-must-be-in-repo.md b/custom/knowledge/architecture/shared-project-memory-must-be-in-repo.md
new file mode 100644
index 0000000..da5b939
--- /dev/null
+++ b/custom/knowledge/architecture/shared-project-memory-must-be-in-repo.md
@@ -0,0 +1,76 @@
+---
+name: shared-project-memory-must-be-in-repo
+description: >
+  Project-level memory (business rules, architectural decisions, scope boundaries)
+  must be stored in a version-controlled projectmemory/ folder, not in a user's
+  local Claude memory store, so all team members benefit from shared knowledge.
+layer: 2
+category: architecture
+---
+
+# Shared Project Memory Must Be in the Repository
+
+## Description
+
+When Claude learns something relevant to the project — a business rule, an architectural
+decision, a known limitation, a scope boundary — that knowledge must be written to the
+repository's `projectmemory/` folder, not to the local user memory store
+(`~/.claude/projects/.../memory/`).
+
+Local memory is invisible to other team members and disappears when someone works on
+a different machine. Version-controlled memory is shared, attributed, and persistent.
+
+## Anti Pattern
+
+```
+# Stored only on Michael's laptop — Tod and SJG never see this
+~/.claude/projects/d--MyProject/memory/project-pricing-vat-scope.md
+```
+
+A rule observed by one developer stays siloed. The next session on another machine —
+or by another team member — starts from zero.
+
+## Best Practice
+
+```
+# In the git repository — committed, shared, visible to all
+projectmemory/
+  memoryupdates_mid.md   ← Michael's observations
+  memoryupdates_tod.md   ← Tod's observations
+  memoryupdates_sjg.md   ← SJG's observations
+```
+
+Each file is named after the user who triggered the observation. All files are read
+by every team member's Claude session at start, via an instruction in `CLAUDE.md`:
+
+```markdown
+## Shared project memory
+
+At session start, read **all files** in `projectmemory/` — they contain shared
+project observations from all team members and are version-controlled in git.
+
+When you learn something project-relevant, write it to
+`projectmemory/memoryupdates_<username>.md` for the active user.
+
+User-specific preferences (tone, workflow habits) stay in the local
+`~/.claude/projects/.../memory/` folder as before.
+```
+
+## What belongs in projectmemory vs local memory
+
+| projectmemory/ (shared, in git) | local memory (personal, not shared) |
+|---|---|
+| Business rules ("B2B only, no VAT") | User's preferred communication language |
+| Architectural decisions and rationale | Workflow habits and preferences |
+| Scope boundaries ("IC via ChangeCompany only") | Personal shortcuts or shortcuts |
+| Known technical debt and migration status | Role and seniority (already known by the team) |
+| Test coverage scope | |
+| Company/entity structure | |
+
+## Implementation checklist
+
+- [ ] Create `projectmemory/` folder in repo root
+- [ ] Add `projectmemory/**` to `cspell.json` ignorePaths (notes are often in the team's native language)
+- [ ] Add the read-at-session-start instruction to `CLAUDE.md`
+- [ ] When learning something project-relevant, write to `projectmemory/memoryupdates_<username>.md`
+- [ ] Commit and push — knowledge is only shared once it is in git
diff --git a/custom/knowledge/architecture/xliff-translation-workflow.md b/custom/knowledge/architecture/xliff-translation-workflow.md
new file mode 100644
index 0000000..68a8279
--- /dev/null
+++ b/custom/knowledge/architecture/xliff-translation-workflow.md
@@ -0,0 +1,96 @@
+---
+bc-version: [all]
+domain: architecture
+keywords: [xliff, translation, xlf, caption, tooltip, enu, da-dk, de-de, no-nb, sv-se, de-at]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+---
+
+## Description
+
+CURABIS apps support the following locales: da-DK, de-DE, de-AT, nb-NO, sv-SE.
+XLIFF translation is a batch operation — never line-by-line. The agent must
+translate all trans-units in one pass without asking questions per string.
+
+## Tone and register
+
+Follow Microsoft Business Central's translation tone for each locale:
+
+- **da-DK**: Kort, direkte, professionel. Undgå høfligheds-De. Brug infinitiv
+  frem for bydeform. Brug BC-standardtermer: "Bogfør" ikke "Send til bogføring",
+  "Kreditor" ikke "Leverandør", "Finanspost" ikke "Finansregistrering".
+- **de-DE**: Formell, Sie-Form. BC-Standardterminologie: "Buchen", "Kreditor",
+  "Sachposten". Substantive großschreiben.
+- **de-AT**: Identisch mit de-DE. Keine österreichischen Dialektvarianten.
+- **nb-NO**: Kort og profesjonell. BC-standardtermer: "Bokfør", "Leverandør",
+  "Finanspost". Bruk infinitiv.
+- **sv-SE**: Kort, professionell. BC-standardtermer: "Bokför", "Leverantör",
+  "Redovisningspost". Undvik dialekt.
+
+## Workflow — one pass, no questions
+
+When asked to translate an XLIFF file:
+
+1. Read the entire source `.g.xlf` file in one operation
+2. Translate ALL trans-units in memory
+3. Write the complete translated file in one operation
+4. Do not ask questions about individual strings
+5. Do not pause between strings
+6. Do not ask for confirmation per trans-unit
+
+If a term is ambiguous, apply the BC standard term for that locale and add a
+single summary comment at the end — never interrupt the translation to ask.
+
+## Terms that must NOT be translated
+
+The following must remain in English in all locales:
+- Object names used as identifiers (e.g. "Settlement Voucher")
+- Field names that are part of the AL identifier (e.g. "Qty. to Invoice")
+- Company names, product names, app names
+
+## Trans-unit structure
+
+```xml
+<trans-unit id="..." size-unit="char" translate="yes" xml:space="preserve">
+  <source>Post</source>
+  <target state="translated">Bogfør</target>  ← da-DK example
+  <note from="Developer" annotates="source" priority="2">Button caption</note>
+</trans-unit>
+```
+
+State must always be `translated` — never `needs-translation` or `new`.
+
+## Common BC terms reference
+
+| ENU | da-DK | de-DE | nb-NO | sv-SE |
+|---|---|---|---|---|
+| Post | Bogfør | Buchen | Bokfør | Bokför |
+| Vendor | Kreditor | Kreditor | Leverandør | Leverantör |
+| Customer | Debitor | Debitor | Kunde | Kund |
+| Item | Vare | Artikel | Vare | Artikel |
+| G/L Entry | Finanspost | Sachposten | Finanspost | Redovisningspost |
+| Amount | Beløb | Betrag | Beløp | Belopp |
+| Quantity | Antal | Menge | Antall | Antal |
+| Invoice | Faktura | Rechnung | Faktura | Faktura |
+| Receipt | Kvittering | Empfangsschein | Kvittering | Inleverans |
+| Settlement | Afregning | Abrechnung | Avregning | Avräkning |
+| Voucher | Bilag | Beleg | Bilag | Verifikation |
+| Cash | Kontant | Bar | Kontant | Kontant |
+| Threshold | Grænse | Grenzwert | Grense | Gräns |
+| Incoming | Indgående | Eingehend | Inngående | Inkommande |
+| Outgoing | Udgående | Ausgehend | Utgående | Utgående |
+| Handle | Håndter | Verarbeiten | Håndter | Hantera |
+| Weighbridge | Vægt | Fahrzeugwaage | Vekt | Våg |
+| Scrap | Skrot | Schrott | Skrap | Skrot |
+
+## Error and warning messages
+
+Error messages follow the BC pattern:
+- da-DK: Start with capital, end with period. "Du kan ikke bogføre et tomt bilag."
+- de-DE: Formal, Sie-Form. "Sie können keinen leeren Beleg buchen."
+- nb-NO: "Du kan ikke bokføre et tomt bilag."
+- sv-SE: "Du kan inte bokföra ett tomt verifikat."
+
+ToolTip format (da-DK): "Angiver [hvad feltet indeholder]." — always starts
+with "Angiver" for fields, "Åbner" for actions that open pages.
diff --git a/custom/knowledge/mcp/agent-must-not-write-business-process-status.md b/custom/knowledge/mcp/agent-must-not-write-business-process-status.md
new file mode 100644
index 0000000..4b992fb
--- /dev/null
+++ b/custom/knowledge/mcp/agent-must-not-write-business-process-status.md
@@ -0,0 +1,32 @@
+# CURABIS MCP: Agents Must Not Write Business Process Status Fields
+
+## Core Principle
+
+MCP agents must only write developer-managed tracking fields — never fields that drive business process workflows such as invoicing, approval, or time registration. Writing a business status field from an agent can block downstream operations for users working in Business Central.
+
+## The Distinction
+
+| Field type | Examples | Agent may write |
+|---|---|---|
+| Developer tracking | `gitHubDevStatus`, `gitHubBranch` | Yes |
+| Business process status | Task `Status` (Accepted, In progress, Done) | Never |
+
+Developer tracking fields are independent of BC workflow. Business process status fields control what users can do — for example, a task marked as ready for invoicing cannot receive new time entries.
+
+## Requirements
+
+- API pages exposed to MCP agents must mark business status fields as `Editable = false`
+- Agent instructions (`.agent.md` files) must explicitly list which fields the agent may write
+- Any field that affects time registration, posting, approval, or invoicing is a business process field and must be read-only for agents
+- Developer-managed fields (GitHub dev status, branch, comments) are the only writable surface
+
+## Example Agent Instruction
+
+```
+Write only gitHubDevStatus and gitHubBranch on tasks.
+Never write Status — it controls the invoicing workflow.
+```
+
+## Verification
+
+For each API page with write access, verify that fields controlling BC workflow transitions carry `Editable = false`. Review the agent instruction file to confirm it names the allowed writable fields explicitly and prohibits status fields.
diff --git a/custom/knowledge/mcp/api-page-flowfields-must-be-calcfields.md b/custom/knowledge/mcp/api-page-flowfields-must-be-calcfields.md
new file mode 100644
index 0000000..7dee481
--- /dev/null
+++ b/custom/knowledge/mcp/api-page-flowfields-must-be-calcfields.md
@@ -0,0 +1,32 @@
+# CURABIS MCP: FlowFields on API Pages Must Be CalcFields'd
+
+## Core Principle
+
+FlowFields on API pages return empty or zero unless explicitly calculated. Every FlowField exposed on a `PageType = API` page must be called via `CalcFields` in the `OnAfterGetRecord` trigger — otherwise the OData response will contain empty values regardless of what the underlying data contains.
+
+## Why This Happens
+
+FlowFields are not stored in the database. Business Central only calculates them on demand. Regular pages trigger calculation automatically as part of the page rendering pipeline. API pages do not — the agent or external consumer receives the raw stored (empty) value.
+
+## Requirements
+
+- All FlowFields exposed in the `layout` section of an API page must be listed in a `CalcFields()` call in `OnAfterGetRecord`
+- If multiple FlowFields are needed, they can be combined in a single call: `Rec.CalcFields(Field1, Field2)`
+- Stored fields (non-FlowField) do not need CalcFields
+
+## Example
+
+```al
+trigger OnAfterGetRecord()
+begin
+    Rec.CalcFields("Elapsed time (Chargeable)", "Customer Name");
+end;
+```
+
+## Verification
+
+When reviewing an API page, identify every field bound to a FlowField source expression. Confirm each appears in the `OnAfterGetRecord` CalcFields call. Any FlowField missing from CalcFields is a defect — it will silently return empty to the MCP consumer.
+
+## Related Rule
+
+CURABIS-MCP-002 — Stored derived fields must be recalculated in OnAfterGetRecord, not exposed directly.
diff --git a/custom/knowledge/mcp/api-page-key-fields-must-be-editable-on-insert.md b/custom/knowledge/mcp/api-page-key-fields-must-be-editable-on-insert.md
new file mode 100644
index 0000000..f7d05b7
--- /dev/null
+++ b/custom/knowledge/mcp/api-page-key-fields-must-be-editable-on-insert.md
@@ -0,0 +1,40 @@
+# CURABIS MCP: ODataKeyFields Must Be Editable for Create Operations
+
+## Core Principle
+
+Fields declared in `ODataKeyFields` that identify the record must not have `Editable = false` when the API page allows insert. If they are read-only, the OData API rejects them as unknown properties on POST — the create operation fails and the caller receives a `BadRequest` error.
+
+## Why This Happens
+
+`Editable = false` on a page field removes the field from the OData write schema entirely. When a consumer POSTs a new record and includes the key field in the body, BC cannot match it to any writable property and rejects the request.
+
+## Pattern to Avoid
+
+```al
+// WRONG: Key field marked Editable = false — cannot be set on create
+field(projectNo; Rec."Project No.")
+{
+    Caption = 'projectNo';
+    Editable = false;  // blocks insert via API
+}
+```
+
+## Correct Pattern
+
+```al
+// CORRECT: No Editable = false — BC controls mutability after insert via ODataKeyFields
+field(projectNo; Rec."Project No.")
+{
+    Caption = 'projectNo';
+}
+```
+
+## Requirements
+
+- Fields listed in `ODataKeyFields` must not carry `Editable = false` on pages where `InsertAllowed = true`
+- Fields that should be read-only after creation but writable on insert need no special property — OData key semantics handle immutability after the record exists
+- Non-key fields that are genuinely read-only may still use `Editable = false`
+
+## Verification
+
+On any API page with `InsertAllowed = true`, confirm that every field referenced in `ODataKeyFields` does not have `Editable = false` in its field definition. A create test via the OData endpoint is the definitive check.
diff --git a/custom/knowledge/mcp/api-page-least-privilege-write-access.md b/custom/knowledge/mcp/api-page-least-privilege-write-access.md
new file mode 100644
index 0000000..6aa5be4
--- /dev/null
+++ b/custom/knowledge/mcp/api-page-least-privilege-write-access.md
@@ -0,0 +1,42 @@
+# CURABIS MCP: API Pages Must Use Least-Privilege Write Access
+
+## Core Principle
+
+A general-purpose API page that exposes many fields should not be widened to allow writes on a single additional field. Instead, create a dedicated minimal API page that exposes only the fields the consumer needs to read and write. This limits the blast radius of any agent or integration mistake.
+
+## Why This Matters
+
+An MCP agent operates with the permissions of its service identity, not an individual user. A page that allows writing to many fields gives the agent broad power that is hard to audit and easy to misuse. A dedicated page with one writable field makes the intent explicit and the surface area auditable.
+
+## Pattern to Avoid
+
+```al
+// WRONG: General page widened with write access to one field
+// Now the agent can accidentally (or intentionally) write to all other fields too
+field(status; Rec.Status) { }                          // should be read-only
+field(gitHubRepository; Rec."GitHub Repository") { }   // the one field we want writable
+field(estimatedHours; Rec."Estimated Hours") { }        // should be read-only
+```
+
+## Correct Pattern
+
+Create a separate, minimal API page:
+
+```al
+page 6102904 "CUR MCP Project Repository"
+{
+    // Only two fields: the key and the one writable field
+    field(no; Rec."No.") { Editable = false; }
+    field(gitHubRepository; Rec."GitHub Repository") { }
+}
+```
+
+## Requirements
+
+- Each distinct write concern (e.g., setting a GitHub repo, updating a dev status) should have its own API page or be deliberately grouped only with closely related fields
+- Read-only fields on write-enabled pages must carry `Editable = false`
+- The page description must document which fields are writable and why
+
+## Verification
+
+For each API page where `ModifyAllowed = true` (or default), list all fields without `Editable = false`. Confirm that every writable field is intentionally writable for the same consumer use case. If unrelated fields are writable on the same page, split the page.
diff --git a/custom/knowledge/mcp/bc-mcp-find-active-task-for-branch.md b/custom/knowledge/mcp/bc-mcp-find-active-task-for-branch.md
new file mode 100644
index 0000000..33aead1
--- /dev/null
+++ b/custom/knowledge/mcp/bc-mcp-find-active-task-for-branch.md
@@ -0,0 +1,89 @@
+---
+name: bc-mcp-find-active-task-for-branch
+description: >
+  Standard recipe for finding the BC sub-task linked to the current git branch,
+  including exact action names and field names for each BC MCP endpoint.
+layer: 2
+category: mcp
+---
+
+# BC MCP: Find Active Task for Branch
+
+## Description
+
+When committing, closing a branch, or updating dev status, the agent must
+look up the BC sub-task linked to the current branch. This recipe documents
+the exact steps and action names to do it efficiently with minimal roundtrips.
+
+Do **not** start with `bc_actions_search` — it fetches and searches the full
+action catalog and is slow. Use `bc_actions_describe` with the known action
+name to get a schema, then `bc_actions_invoke` to call it.
+
+## Known action names
+
+Derived from the AL page source (EntityName property + PAG + page ID):
+
+| Page | EntityName (AL) | List action | Modify action | Create action |
+|---|---|---|---|---|
+| 6102900 CUR MCP Active Tasks | `activeTask` | `List_activeTask_PAG6102900` | `Modify_activeTask_PAG6102900` | — |
+| 6102901 CUR MCP Projects | `project` | `List_project_PAG6102901` | — | — |
+| 6102902 CUR MCP Task Comments | `taskComment` | `List_taskComment_PAG6102902` | `Modify_taskComment_PAG6102902` | `Create_TaskComment_PAG6102902` |
+| 6102904 CUR MCP Project Repository | `projectRepository` | `List_projectRepository_PAG6102904` | `Modify_projectRepository_PAG6102904` | — |
+| 6102905 CUR MCP Create Task | `newTask` | — | — | `Create_newTask_PAG6102905` |
+| 50009 consultants | `consultant` | `List_consultant_PAG50009` | — | — |
+
+> **Note:** Verify action names after a fresh session with `bc_actions_search`
+> if any of the above return an error. The naming convention is
+> `{Verb}_{EntityNamePascalCase}_PAG{PageId}`.
+
+## Standard recipe: find task for current branch
+
+```
+1. git branch --show-current          → e.g. "PriceLookup"
+2. git remote get-url origin          → e.g. "https://github.com/Curabis/Wareco.git"
+3. bc_actions_invoke List_project_PAG6102901
+      filter: "gitHubRepository eq 'https://github.com/Curabis/Wareco.git'"
+   → get projectNo (e.g. "W-2024-001")
+4. bc_actions_invoke List_activeTask_PAG6102900
+      filter: "projectNo eq 'W-2024-001' and gitHubBranch eq 'PriceLookup'"
+   → get taskId (global commit-message ID), taskNo, description, status
+```
+
+If step 3 returns no project, the repo is not linked — see `[[bc-mcp-link-repo-to-project]]`.
+If step 4 returns no task, the branch has no registered task — create one or ask the PM.
+
+## Key fields on active tasks
+
+| Field | Description |
+|---|---|
+| `taskId` | **Global unique ID — use in commit messages** |
+| `taskNo` | Sequential within project — use for customer portal links |
+| `projectNo` | Parent project |
+| `description` | Task description |
+| `status` | BC-managed: Created → Accepted → In progress → Finished → Invoiced |
+| `gitHubBranch` | Writable — set when starting work |
+| `gitHubDevStatus` | Writable — Backlog / In Progress / Done / On Hold |
+| `gitHubRepository` | **Obsolete** — always read repo from project, not from task |
+
+## Writable fields — and what is forbidden
+
+Only write `gitHubBranch` and `gitHubDevStatus` on active tasks.
+Never write `status` — it controls time registration and invoicing in BC.
+Never write `gitHubRepository` on the task (obsolete, will be removed in v29).
+
+## Developer identity under S2S auth
+
+The bridge runs as app identity `BC_DevelopmentMCP`. To attribute work:
+
+```
+1. git config user.email             → developer's git email
+2. bc_actions_invoke List_consultant_PAG50009
+      filter: "email eq 'mic.dieringer@gmail.com'"
+   → get employeeCode (e.g. "MID")
+3. Use employeeCode to filter "my tasks":
+   List_activeTask_PAG6102900 filter: "taskResponsible eq 'MID'"
+4. Sign status comments: end with "— Michael" so attribution survives S2S
+```
+
+Some developers use personal email for git but have a Curabis email as secondary
+on GitHub. If the git email doesn't match, try the `@curabis.dk` variant.
diff --git a/custom/knowledge/mcp/bc-mcp-scope-tasks-to-repository.md b/custom/knowledge/mcp/bc-mcp-scope-tasks-to-repository.md
new file mode 100644
index 0000000..3afba33
--- /dev/null
+++ b/custom/knowledge/mcp/bc-mcp-scope-tasks-to-repository.md
@@ -0,0 +1,87 @@
+---
+name: bc-mcp-scope-tasks-to-repository
+description: >
+  When a developer asks for their open tasks, scope the result to the current
+  git repository only. If no BC project is linked to the repo, raise it as a
+  flag instead of returning all tasks.
+layer: 2
+category: mcp
+---
+
+# BC MCP: Scope Task Lists to the Current Repository
+
+## Rule
+
+When a developer asks "what tasks do I have", "what are my open tasks", or any
+equivalent question about their work queue, **only return tasks that belong to
+the project(s) linked to the current git repository**.
+
+Do **not** return all tasks assigned to the developer across all BC projects.
+That produces noise from unrelated customers and hides the signal of what is
+actually in scope for the current repo.
+
+## Why
+
+A developer working in a repository is focused on that context. Showing tasks
+from other projects (other customers, other repos) creates confusion and
+increases the risk of working on the wrong thing or copying context from the
+wrong project.
+
+## Standard recipe
+
+```
+1. git remote get-url origin
+   → e.g. "https://github.com/Curabis/Wareco.git"
+
+2. List_ProjectRepositories_PAG6102904
+      filter: "gitHubRepository eq '<url>'"
+   → get projectNo(s) for this repo
+
+3. IF no projects found → STOP and flag (see "No linked project" below)
+
+4. List_ActiveTasks_PAG6102900
+      filter: "projectNo eq '<projectNo>' and taskResponsible eq '<employeeCode>'"
+   → return only tasks in this repo's project(s)
+```
+
+For developer identity (resolving `employeeCode` from git email), see
+`[[bc-mcp-find-active-task-for-branch]]`.
+
+## No linked project — flag it
+
+If step 2 returns no results, do not fall back to listing all tasks.
+Instead, surface it explicitly:
+
+> **Flag:** Dette repository (`<url>`) er ikke knyttet til et BC-projekt.
+> Opgavelisten kan ikke scopetes. Tilknyt repoet via `projectRepositories`
+> (PAG6102904) eller kontakt projektlederen.
+
+This is a data-quality issue that should be fixed, not silently bypassed.
+
+## Multiple projects on one repo
+
+If step 2 returns more than one project for the repo, query tasks from all of
+them and group the output by project.
+
+## What to show
+
+| Field | Include |
+|---|---|
+| `taskNo` | Yes |
+| `description` | Yes |
+| `status` | Yes |
+| `gitHubDevStatus` | Yes — shows In Progress / Backlog / Done / On Hold |
+| `gitHubBranch` | Yes — shows which branch the task is on |
+| `estimatedTime` / `timeLeft` | Yes — helps prioritize |
+| `expectedDelivery` | Yes — shows urgency |
+| `customerName` | Yes — context |
+
+Do not show internal system fields (`taskId`, etags, `@odata.*`).
+
+## Violations to avoid
+
+- Filtering only by `taskResponsible` without scoping to `projectNo` → returns
+  tasks from every customer the developer has ever worked on.
+- Falling back to all-tasks when the repo lookup fails → hides a config problem.
+- Returning tasks where `gitHubRepository` on the task matches (this field is
+  obsolete — always scope via the project, not the task field).
diff --git a/custom/knowledge/mcp/stored-derived-fields-must-not-be-exposed-directly.md b/custom/knowledge/mcp/stored-derived-fields-must-not-be-exposed-directly.md
new file mode 100644
index 0000000..4480663
--- /dev/null
+++ b/custom/knowledge/mcp/stored-derived-fields-must-not-be-exposed-directly.md
@@ -0,0 +1,44 @@
+# CURABIS MCP: Stored Derived Fields Must Be Recalculated in OnAfterGetRecord
+
+## Core Principle
+
+A stored field whose value is derived from other fields via `OnValidate` triggers can be stale. When the source data changes (e.g., new time entries posted), the stored derived field is not updated automatically — it only recalculates when a specific trigger fires. Exposing such a field directly via an API page returns a value that may be hours, days, or weeks out of date.
+
+## Pattern to Avoid
+
+```al
+// WRONG: Exposes the stored snapshot — may be stale
+field(timeLeft; Rec."Time left") { }
+```
+
+`"Time left"` is recalculated only when `"Estimated time"` is validated. If new time entries are posted, the stored value does not update.
+
+## Correct Pattern
+
+Recalculate in `OnAfterGetRecord` using a page variable:
+
+```al
+trigger OnAfterGetRecord()
+begin
+    Rec.CalcFields("Elapsed time (Chargeable)");
+    TimeLeftCalc := Rec."Estimated time" - Rec."Elapsed time (Chargeable)";
+end;
+
+var
+    TimeLeftCalc: Decimal;
+
+// In layout:
+field(timeLeft; TimeLeftCalc) { }          // live value
+field(elapsedTime; Rec."Elapsed time (Chargeable)") { }  // source FlowField
+```
+
+## Requirements
+
+- Identify stored fields whose value is computed from other fields via triggers
+- Do not expose them directly in API pages
+- Recalculate from the authoritative source (FlowField or live query) in `OnAfterGetRecord`
+- Expose both the recalculated result and the source FlowField so the consumer can verify
+
+## Verification
+
+Inspect the source table for any field with `FieldClass = Normal` whose value is set inside an `OnValidate` trigger on another field. If that field is exposed on an API page, verify it is recalculated in `OnAfterGetRecord` rather than read from `Rec` directly.
diff --git a/custom/knowledge/testing/test-data-must-be-random-and-complete.md b/custom/knowledge/testing/test-data-must-be-random-and-complete.md
new file mode 100644
index 0000000..74fa33f
--- /dev/null
+++ b/custom/knowledge/testing/test-data-must-be-random-and-complete.md
@@ -0,0 +1,88 @@
+---
+bc-version: [all]
+domain: testing
+keywords: [test, hardcode, random, library, no-series, setup, data]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+---
+
+## Description
+
+CURABIS tests assume an empty database. All test data must be created
+programmatically — never assume existing records or hardcode codes, numbers,
+or names that may or may not exist in a given environment.
+
+Three concrete rules:
+
+**1. Use MS Library codeunits for standard BC objects.**
+No-series, G/L accounts, customers, vendors, items, locations, posting groups —
+all created via `Library - ERM`, `Library - Inventory`, `Library - Sales` etc.
+These tools generate random codes that do not collide across test runs.
+
+**2. Fill all required fields with random values.**
+A `Code[10]` field gets 10 random characters. A `Text[50]` field gets random text.
+Use `Library - Utility` or `Any` codeunit for random generation.
+Partial setup that leaves required fields empty is not acceptable.
+
+**3. Build your own tools for custom tables.**
+For CURABIS-specific tables (e.g. `Settlement Payment Method`,
+`Settlement Voucher Setup`), maintain dedicated setup procedures in the
+Test Library codeunit. These procedures must follow the same pattern as
+Microsoft's libraries: create records programmatically, use random values
+for codes where no fixed value is required by the flow being tested.
+
+**Exception — integration and flow tests.**
+When a test validates a specific integration contract (e.g. a fixed JSON
+structure from a web service, a specific EDIFACT message, a fixed counterparty
+code expected by an external system), hardcoded values are acceptable and
+necessary. The test is documenting the contract, not exercising random data.
+
+## Anti Pattern
+
+```al
+// WRONG: hardcoded code that may or may not exist
+if not PaymentMethod.Get('CASH') then begin
+    PaymentMethod.Code := 'CASH';
+    ...
+end;
+```
+
+```al
+// WRONG: hardcoded source code
+SourceCode.Code := 'SV-POST';
+```
+
+```al
+// WRONG: partial setup — Code[10] left short
+PaymentMethod.Code := 'C';   // not filled to capacity
+```
+
+## Best Practice
+
+```al
+// CORRECT: random code via LibraryUtility
+PaymentMethod.Code :=
+    CopyStr(LibraryUtility.GenerateRandomCode(
+        PaymentMethod.FieldNo(Code), DATABASE::"Settlement Payment Method"), 1, 10);
+PaymentMethod.Description := LibraryUtility.GenerateRandomText(50);
+PaymentMethod.Insert();
+```
+
+```al
+// CORRECT: source code created via standard MS pattern
+LibraryERM.CreateSourceCode(SourceCode);
+GlobalSourceCode := SourceCode.Code;
+// then assign to Source Code Setup
+```
+
+```al
+// CORRECT: no-series via MS library
+GlobalNoSeriesCode := LibraryUtility.GetGlobalNoSeriesCode();
+```
+
+```al
+// CORRECT: hardcoded in integration test — documenting a contract
+// [SCENARIO] Inbound ORDRSP with fixed order reference from Allnet Germany
+ExpectedOrderRef := 'ORD-2026-00001';   // fixed by integration contract
+```
diff --git a/custom/knowledge/testing/test-feature-scenario-tags.md b/custom/knowledge/testing/test-feature-scenario-tags.md
new file mode 100644
index 0000000..2cc64e1
--- /dev/null
+++ b/custom/knowledge/testing/test-feature-scenario-tags.md
@@ -0,0 +1,108 @@
+---
+bc-version: [all]
+domain: testing
+keywords: [test, feature, scenario, given, when, then, tags, bdd, atdd, comments, structure]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+---
+
+## Description
+
+CURABIS test codeunits follow a four-level comment structure that traces directly
+to BDD/ATDD (Behaviour-Driven / Acceptance-Test-Driven Development):
+
+| Tag | Scope | Purpose |
+|---|---|---|
+| `// [FEATURE]` | Codeunit header | The domain or module under test (e.g. `Find Price`) |
+| `// [SCENARIO]` | Per test procedure | One falsifiable business claim |
+| `// [GIVEN]` | Inside test body | Preconditions and test data setup |
+| `// [WHEN]` | Inside test body | The single action being tested |
+| `// [THEN]` | Inside test body | Assertions |
+
+The `[FEATURE]` tag appears once as a comment at the top of the codeunit (before
+`{`) and names the functional area — not the object name. The `[SCENARIO]` tag
+appears as a comment immediately above each `[Test]` procedure; it describes the
+business scenario in plain language, complementing the procedure name.
+
+This structure makes tests readable as a living specification. A product owner
+or QA engineer can scan the `[FEATURE]` + `[SCENARIO]` tags to understand
+what is covered without reading AL.
+
+## Anti Pattern
+
+```al
+// WRONG: no structure — tests as anonymous procedures
+codeunit 99006 "Find Price Testing"
+{
+    Subtype = Test;
+
+    [Test]
+    procedure Test1()   // what does this test?
+    begin
+        // setup mixed with assertions, no clear layers
+        Customer.Insert(false);
+        FindPriceMgt.GetSalesPrice(Customer."No.", Item."No.", '', Price, Disc);
+        Assert.AreEqual(100, Price, '');
+    end;
+}
+```
+
+## Best Practice
+
+```al
+// [FEATURE] Find Price — price cascade (Customer → Price Group → All Customers)
+codeunit 99006 "Find Price Testing"
+{
+    Subtype = Test;
+
+    var
+        WarecoLib: Codeunit "Wareco Test Library";
+        Assert: Codeunit "Library Assert";
+
+    // [SCENARIO] Customer with a specific price list line gets that unit price
+    [Test]
+    procedure GetPrice_CustomerPrice_ReturnsUnitPrice()
+    var
+        Customer: Record Customer;
+        Item: Record Item;
+        UnitPrice, LineDiscPct: Decimal;
+    begin
+        // [GIVEN] a customer with a price list line at 100 LCY
+        WarecoLib.GivenCustomerWithPrice(Customer, Item, '', 100);
+        // [WHEN]
+        FindPriceMgt.GetSalesPrice(Customer."No.", Item."No.", '', UnitPrice, LineDiscPct);
+        // [THEN]
+        Assert.AreEqual(100, UnitPrice, 'Unit price must match customer price list');
+    end;
+
+    // [SCENARIO] Customer with no price list line falls back to item unit price
+    [Test]
+    procedure GetPrice_NoCustomerPrice_FallsBackToItemPrice()
+    var
+        Customer: Record Customer;
+        Item: Record Item;
+        UnitPrice, LineDiscPct: Decimal;
+    begin
+        // [GIVEN] a customer with no price list, item priced at 200
+        WarecoLib.GivenCustomer(Customer);
+        WarecoLib.GivenItem(Item, 200);
+        // [WHEN]
+        FindPriceMgt.GetSalesPrice(Customer."No.", Item."No.", '', UnitPrice, LineDiscPct);
+        // [THEN]
+        Assert.AreEqual(200, UnitPrice, 'Must fall back to item unit price');
+    end;
+}
+```
+
+## Relationship to procedure naming
+
+The procedure name and the `[SCENARIO]` comment are complementary — they say the
+same thing in different registers:
+
+- Procedure name: `GetPrice_CustomerPrice_ReturnsUnitPrice` — machine-readable,
+  shows up in test runner output.
+- `[SCENARIO]` comment: `Customer with a specific price list line gets that unit price`
+  — human-readable, business language.
+
+Both must be present. Neither replaces the other.
diff --git a/custom/knowledge/testing/test-one-when-per-test.md b/custom/knowledge/testing/test-one-when-per-test.md
new file mode 100644
index 0000000..ee89ca8
--- /dev/null
+++ b/custom/knowledge/testing/test-one-when-per-test.md
@@ -0,0 +1,84 @@
+---
+bc-version: [all]
+domain: testing
+keywords: [test, when, scenario, single-action, bdd, atdd, given-when-then]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+---
+
+## Description
+
+Each test procedure must contain exactly **one** `[WHEN]` block — one action that
+triggers the behaviour under test. A test with multiple WHENs ("do A, then do B,
+then check C") is really two or more tests in disguise. Split them.
+
+This constraint serves two purposes:
+
+1. **Failure isolation** — when the test fails you know which action caused it.
+2. **Readable specification** — each test reads as a single, falsifiable claim
+   about the system's behaviour.
+
+A scenario that genuinely requires a precondition action (e.g. "post an order so
+that a ledger entry exists") belongs in `[GIVEN]`. Only the action being asserted
+belongs in `[WHEN]`.
+
+## Anti Pattern
+
+```al
+// WRONG: two actions in one test
+[Test]
+procedure GetPrice_ThenGetDiscount_ReturnsCorrectValues()
+var
+    UnitPrice, LineDiscPct: Decimal;
+begin
+    // [GIVEN] ...
+    // [WHEN] first action
+    FindPriceMgt.GetSalesPrice(CustomerNo, ItemNo, '', UnitPrice, LineDiscPct);
+    // [WHEN] second action — this is a second test in disguise
+    FindPriceMgt.GetSalesPriceTiers(CustomerNo, ItemNo, '', TempBuffer);
+    // [THEN] asserting two unrelated things
+    Assert.AreEqual(100, UnitPrice, '');
+    Assert.IsFalse(TempBuffer.IsEmpty(), '');
+end;
+```
+
+## Best Practice
+
+```al
+// CORRECT: split into two focused tests
+
+[Test]
+procedure GetPrice_CustomerPrice_ReturnsCorrectUnitPrice()
+var
+    UnitPrice, LineDiscPct: Decimal;
+begin
+    // [GIVEN] a customer with a price list line at 100
+    WarecoLib.GivenCustomerWithPrice(Customer, Item, '', 100);
+    // [WHEN]
+    FindPriceMgt.GetSalesPrice(Customer."No.", Item."No.", '', UnitPrice, LineDiscPct);
+    // [THEN]
+    Assert.AreEqual(100, UnitPrice, 'Unit price must match price list');
+end;
+
+[Test]
+procedure GetPriceTiers_CustomerTier_ReturnsOneTierLine()
+var
+    TempBuffer: Record "Find Price Tier Buffer" temporary;
+begin
+    // [GIVEN] a customer with a tier price at min qty 10
+    WarecoLib.GivenCustomerWithTierPrice(Customer, Item, '', 10, 90);
+    // [WHEN]
+    FindPriceMgt.GetSalesPriceTiers(Customer."No.", Item."No.", '', TempBuffer);
+    // [THEN]
+    Assert.AreEqual(1, TempBuffer.Count(), 'Exactly one tier line expected');
+end;
+```
+
+## Naming implication
+
+The procedure name should make the single WHEN self-evident.
+A name with "And" or "Then" in the middle is a strong signal to split:
+
+- `GetPrice_AndDiscount_ReturnsValues` → split
+- `GetPrice_CustomerPrice_ReturnsUnitPrice` → good
diff --git a/custom/knowledge/testing/test-setup-must-use-library-codeunit.md b/custom/knowledge/testing/test-setup-must-use-library-codeunit.md
new file mode 100644
index 0000000..722c8e9
--- /dev/null
+++ b/custom/knowledge/testing/test-setup-must-use-library-codeunit.md
@@ -0,0 +1,71 @@
+---
+bc-version: [all]
+domain: testing
+keywords: [test, library, setup, initialize, suppresscommit, asserterror]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+---
+
+## Description
+
+In CURABIS test apps, all test setup is centralized in a dedicated Test Library
+codeunit (e.g. `SV Test Library`). Individual test procedures must not call
+BC standard library codeunits (`LibrarySales`, `LibraryInventory`, etc.) directly.
+
+Additionally, two rules apply to every test that calls a posting codeunit:
+
+1. `SetSuppressCommit(true)` must be called before `Run()` to prevent data
+   from leaking between tests.
+2. `asserterror` must always be followed by `Assert.ExpectedErrorCode()` or
+   `Assert.ExpectedError()` — a naked `asserterror` passes on any error,
+   not just the expected one.
+
+## Anti Pattern
+
+```al
+// WRONG: inline setup bypassing the test library
+procedure MyTest()
+var
+    Item: Record Item;
+begin
+    LibraryInventory.CreateItem(Item);   // do not call directly
+    // ...
+end;
+```
+
+```al
+// WRONG: posting without SuppressCommit
+SVPost.Run(SVHeader);   // commits to test database
+```
+
+```al
+// WRONG: naked asserterror
+asserterror SVPost.Run(SVHeader);
+// no assertion follows — passes on any error
+```
+
+## Best Practice
+
+```al
+// CORRECT: delegate to test library
+procedure MyTest()
+var
+    Item: Record Item;
+begin
+    SVLib.GivenScrapItem(Item);   // test library owns setup
+    // ...
+end;
+```
+
+```al
+// CORRECT: SuppressCommit before Run
+SVPost.SetSuppressCommit(true);
+SVPost.Run(SVHeader);
+```
+
+```al
+// CORRECT: asserterror followed by assertion
+asserterror SVPost.Run(SVHeader);
+Assert.ExpectedErrorCode('Dialog');
+```
diff --git a/custom/knowledge/testing/tests-must-adapt-to-existing-code.md b/custom/knowledge/testing/tests-must-adapt-to-existing-code.md
new file mode 100644
index 0000000..906f02c
--- /dev/null
+++ b/custom/knowledge/testing/tests-must-adapt-to-existing-code.md
@@ -0,0 +1,75 @@
+---
+bc-version: [all]
+domain: testing
+keywords: [test, refactor, adapt, existing-code, green, failing, tdd]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+---
+
+## Description
+
+When a CURABIS developer asks for a test that "must work" or "must pass",
+the agent's job is to write a test that passes against the **existing production code**
+— not to write an idealized test and then report that the code needs changing.
+
+This rule applies in two distinct scenarios:
+
+**Scenario A — New test for existing behaviour**
+The production code is correct and stable. Write the test to match what the code
+actually does. Read the relevant codeunits before writing assertions. If the
+expected value in the story differs from what the code produces, surface the
+discrepancy and ask before assuming either is wrong.
+
+**Scenario B — Refactoring an existing test**
+The test exists but fails because the production code was changed. Adapt the
+test to match the new behaviour. Do not rewrite the production code to make
+the old test pass unless explicitly asked to refactor production code.
+
+## The distinction that matters
+
+Writing a test that adapts to existing code is **not** the same as writing a
+test that accepts wrong behaviour silently. If the production code contains a
+bug that contradicts the business specification, flag it explicitly:
+
+```
+// ⚠️ NOTE: This assertion reflects current code behaviour.
+// Business spec says 1792,00 but code currently produces 1800,00.
+// Flagged for review — do not merge until resolved.
+```
+
+Never silently adjust an assertion to make a test green when the discrepancy
+is a real business logic error.
+
+## Anti Pattern
+
+```al
+// WRONG: Writing the "ideal" test without reading the production code,
+// then leaving it failing and saying "the code needs to be fixed"
+[THEN]
+Assert.AreEqual(1792, ActualAmount, 'Total should be 1792');
+// Test fails. Agent says: "You need to fix SVPost to produce 1792."
+// This is not what was asked for.
+```
+
+## Best Practice
+
+```al
+// CORRECT: Read SVPost, understand what it produces, write the test to match.
+// If the number is 1792 in both spec and code → assert 1792.
+// If the number differs → flag it, don't silently change it.
+
+// [GIVEN] Read SVPost.Codeunit.al and SV Test Library before writing assertions.
+// [THEN] Assert what the code actually produces, verified by reading the source.
+Assert.AreEqual(ExpectedAmount, ActualAmount, 'Net payout to vendor must match');
+```
+
+## Workflow when asked to write a passing test
+
+1. Read the relevant production codeunits (SVPost, SVApplyMgt, etc.)
+2. Trace the calculation path for the specific scenario
+3. Derive the expected values from the code — not only from the story
+4. If code and story agree → write the test with those values
+5. If code and story disagree → write the test with the code's values AND add
+   a clearly visible `// ⚠️ NOTE` comment explaining the discrepancy
+6. Never leave a test failing when the task was to write a passing test
diff --git a/custom/knowledge/testing/ui-test-codeunit-naming.md b/custom/knowledge/testing/ui-test-codeunit-naming.md
new file mode 100644
index 0000000..abde2ea
--- /dev/null
+++ b/custom/knowledge/testing/ui-test-codeunit-naming.md
@@ -0,0 +1,102 @@
+---
+bc-version: [all]
+domain: testing
+keywords: [test, ui, testpage, naming, suffix, codeunit, page-testing]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+---
+
+## Description
+
+Test codeunits that interact with pages via `TestPage` must carry a `_UT` suffix
+(Unit Test — UI layer) in their name. This distinguishes them from codeunits that
+test business logic directly by calling codeunit/table procedures.
+
+The suffix signals to every reader that the codeunit opens pages, uses
+`TestPage.OpenNew()`, reads FactBox parts, or drives field validates through
+the page's `OnValidate` triggers — i.e. it exercises the UI layer, not just
+the logic layer.
+
+**Convention:**
+
+| Layer tested | Suffix | Example |
+|---|---|---|
+| Business logic (codeunits, tables) | *(none)* | `FindPriceTesting` |
+| Page / UI layer (`TestPage`) | `_UT` | `FindPriceTesting_UT` |
+
+A codeunit may contain **only** UI tests or **only** logic tests — never mix both
+in the same codeunit.
+
+## Anti Pattern
+
+```al
+// WRONG: UI test codeunit without _UT suffix
+codeunit 99007 "Find Price Page Testing"
+{
+    Subtype = Test;
+    // contains TestPage calls — should be named "Find Price Testing_UT"
+    ...
+}
+```
+
+```al
+// WRONG: mixing direct codeunit calls and TestPage calls in the same codeunit
+codeunit 99007 "Find Price Testing"
+{
+    Subtype = Test;
+
+    [Test]
+    procedure GetPrice_LogicTest()   // logic test — fine here
+    begin
+        FindPriceMgt.GetSalesPrice(...);
+    end;
+
+    [Test]
+    procedure Page_ShowsPrice_UT()   // UI test — belongs in separate _UT codeunit
+    var
+        FindPricePage: TestPage "Find Price";
+    begin
+        FindPricePage.OpenNew();
+        ...
+    end;
+}
+```
+
+## Best Practice
+
+```al
+// CORRECT: separate codeunits per layer
+
+// Logic tests — no _UT suffix
+codeunit 99006 "Find Price Testing"
+{
+    Subtype = Test;
+    [Test]
+    procedure GetPrice_CustomerPrice_ReturnsUnitPrice()
+    begin
+        FindPriceMgt.GetSalesPrice(...);
+    end;
+}
+
+// UI tests — _UT suffix
+codeunit 99007 "Find Price Testing_UT"
+{
+    Subtype = Test;
+    [Test]
+    procedure Page_EnterCustomerAndItem_FactBoxShowsPrice()
+    var
+        FindPricePage: TestPage "Find Price";
+    begin
+        FindPricePage.OpenNew();
+        FindPricePage.CustomerNo.SetValue(Customer."No.");
+        FindPricePage.ItemNo.SetValue(Item."No.");
+        Assert.AreEqual('100,00', FindPricePage.FindPriceInfo.UnitPrice.Value(), '');
+    end;
+}
+```
+
+## Object ID allocation
+
+Allocate adjacent IDs for the two related codeunits (e.g. 99006 logic, 99007 UI)
+so they sort together in the object list and their relationship is self-evident.
diff --git a/custom/scripts/Invoke-CurabisEval.ps1 b/custom/scripts/Invoke-CurabisEval.ps1
new file mode 100644
index 0000000..572a9c4
--- /dev/null
+++ b/custom/scripts/Invoke-CurabisEval.ps1
@@ -0,0 +1,249 @@
+# Invoke-CurabisEval.ps1
+#
+# Generel "hill climbing"-eval for ETHVERT CURABIS AL-projekt.
+# Maaler det objektive signal paa succesfuld udfoersel: kompilerer koden, og er
+# cop-analyzerne rene -> en score 0..1, logget over tid.
+#
+# Ingen projektspecifik logik:
+#  - app-projekter auto-opdages via app.json
+#  - analyzere + ruleset laeses fra projektets EGEN .vscode\settings.json
+#    (saa scoren maales mod projektets bar, ikke harness'ens mening)
+#
+# Score:
+#  - kompilerer ikke (errors > 0) -> 0.0  (du kan ikke klatre foer den bygger)
+#  - ellers: 1 / (1 + WarnWeight * warnings)   (falder bloedt, floorer ikke)
+#  Koer den, aendr EN ting, koer igen, og se trenden i .eval\history.jsonl.
+#
+# Brug:
+#   pwsh -File scripts\Invoke-CurabisEval.ps1
+#   pwsh -File scripts\Invoke-CurabisEval.ps1 -FailUnder 0.5      # CI-gate
+#   pwsh -File scripts\Invoke-CurabisEval.ps1 -AppPath ".apps\summatim"
+
+[CmdletBinding()]
+param(
+    # Repo-rod. Default: foraelder til scripts-mappen (altsaa projektroden).
+    [string]$ProjectRoot,
+
+    # Et eller flere app-projekter (mappe med app.json). Default: auto-opdag.
+    [string[]]$AppPath,
+
+    # Override af analyzere. Default: laes projektets egen al.codeAnalyzers.
+    [ValidateSet('AppSourceCop', 'CodeCop', 'UICop', 'PerTenantExtensionCop')]
+    [string[]]$Analyzers,
+
+    # Vaegt pr. warning i scoren. errors er altid hard-fail -> 0.
+    [double]$WarnWeight = 0.01,
+
+    # Hvis sat: exit 1 naar samlet score < dette tal (til CI).
+    [Nullable[double]]$FailUnder,
+
+    [switch]$Quiet
+)
+
+$ErrorActionPreference = 'Stop'
+
+function Write-Line([string]$msg, [string]$color = 'Gray') {
+    if (-not $Quiet) { Write-Host $msg -ForegroundColor $color }
+}
+
+# --- Find projektrod ---
+if (-not $ProjectRoot) { $ProjectRoot = Split-Path -Parent $PSScriptRoot }
+$ProjectRoot = (Resolve-Path $ProjectRoot).Path
+
+# --- Find AL-compiler + analyzere i nyeste AL Language extension ---
+$ext = Get-ChildItem "$env:USERPROFILE\.vscode\extensions" -Filter 'ms-dynamics-smb.al-*' -ErrorAction SilentlyContinue |
+       Sort-Object Name -Descending | Select-Object -First 1
+if (-not $ext) { throw 'AL Language extension ikke fundet. Installer ms-dynamics-smb.al.' }
+
+$alc = Join-Path $ext.FullName 'bin\win32\alc.exe'
+if (-not (Test-Path $alc)) { throw "alc.exe ikke fundet i $($ext.FullName)" }
+$analyzerDir = Join-Path $ext.FullName 'bin\Analyzers'
+
+# Map fra token/navn -> analyzer-DLL. Tager baade '${CodeCop}' og 'CodeCop'.
+$analyzerDll = @{
+    appsourcecop          = 'Microsoft.Dynamics.Nav.AppSourceCop.dll'
+    codecop               = 'Microsoft.Dynamics.Nav.CodeCop.dll'
+    uicop                 = 'Microsoft.Dynamics.Nav.UICop.dll'
+    pertenantextensioncop = 'Microsoft.Dynamics.Nav.PerTenantExtensionCop.dll'
+}
+
+function Read-JsonC([string]$path) {
+    # Laes JSON med // linje-kommentarer (VS Code settings er JSONC).
+    $lines = Get-Content $path | Where-Object { $_.TrimStart() -notlike '//*' }
+    ($lines -join "`n") | ConvertFrom-Json
+}
+
+function Resolve-AnalyzerEntry([string]$entry, [string]$appDir) {
+    # Oversaetter en al.codeAnalyzers-entry til en DLL-sti. Haandterer:
+    #  - kendte tokens: ${CodeCop} / CodeCop / ${AppSourceCop} osv.
+    #  - custom DLL'er: ${analyzerFolder}BusinessCentral.LinterCop.dll
+    #  - relative/absolutte stier til en .dll
+    $key = ($entry -replace '[${}]', '').ToLower()
+    if ($analyzerDll.ContainsKey($key)) { return (Join-Path $analyzerDir $analyzerDll[$key]) }
+    $p = $entry -replace '\$\{analyzerFolder\}', ($analyzerDir + '\')
+    if ($p -match '\$\{') { Write-Line "  !! kan ikke resolve analyzer: $entry" 'Yellow'; return $null }
+    if (-not [System.IO.Path]::IsPathRooted($p)) { $p = Join-Path $appDir $p }
+    return $p
+}
+
+function Resolve-Analyzers([string]$appDir) {
+    # Praeferer projektets egen .vscode\settings.json; ellers -Analyzers/default.
+    $entries = @()
+    $settings = Join-Path $appDir '.vscode\settings.json'
+    if (-not $Analyzers -and (Test-Path $settings)) {
+        $s = Read-JsonC $settings
+        $entries = @($s.'al.codeAnalyzers')
+    }
+    if (-not $entries -or $entries.Count -eq 0) {
+        $entries = if ($Analyzers) { $Analyzers } else { @('${AppSourceCop}', '${CodeCop}', '${UICop}') }
+    }
+    $dlls = @()
+    foreach ($e in $entries) {
+        if (-not $e) { continue }
+        $dll = Resolve-AnalyzerEntry $e $appDir
+        if ($dll) {
+            if (Test-Path $dll) { $dlls += $dll } else { Write-Line "  !! analyzer-DLL findes ikke: $dll" 'Yellow' }
+        }
+    }
+    return ($dlls | Select-Object -Unique)
+}
+
+function Resolve-Ruleset([string]$appDir) {
+    $settings = Join-Path $appDir '.vscode\settings.json'
+    if (Test-Path $settings) {
+        $s = Read-JsonC $settings
+        $rs = $s.'al.ruleSetPath'
+        if ($rs) {
+            $p = if ([System.IO.Path]::IsPathRooted($rs)) { $rs } else { Join-Path $appDir $rs }
+            if (Test-Path $p) { return (Resolve-Path $p).Path }
+        }
+    }
+    return $null
+}
+
+# --- Find app-projekter ---
+if (-not $AppPath) {
+    $AppPath = Get-ChildItem -Path $ProjectRoot -Recurse -Filter 'app.json' -ErrorAction SilentlyContinue |
+               Where-Object { $_.FullName -notmatch '\\\.alpackages\\' } |
+               ForEach-Object { Split-Path $_.FullName -Parent }
+}
+else {
+    $AppPath = $AppPath | ForEach-Object {
+        if ([System.IO.Path]::IsPathRooted($_)) { $_ } else { Join-Path $ProjectRoot $_ }
+    }
+}
+if (-not $AppPath) { throw "Ingen app.json fundet under $ProjectRoot" }
+
+Write-Line "AL compiler : $alc" 'DarkGray'
+Write-Line ''
+
+$tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("curabis-eval-" + [guid]::NewGuid().ToString('N'))
+New-Item -ItemType Directory -Path $tmp -Force | Out-Null
+
+$appResults = @()
+
+foreach ($app in $AppPath) {
+    $app = (Resolve-Path $app).Path
+    $manifest = Join-Path $app 'app.json'
+    if (-not (Test-Path $manifest)) { Write-Line "  Springer over (ingen app.json): $app" 'Yellow'; continue }
+    $appJson = Get-Content $manifest -Raw | ConvertFrom-Json
+    $name = $appJson.name
+
+    $analyzerDlls = Resolve-Analyzers $app
+    $ruleset = Resolve-Ruleset $app
+    $analyzerNames = $analyzerDlls | ForEach-Object { [System.IO.Path]::GetFileNameWithoutExtension($_) -replace '^Microsoft\.Dynamics\.Nav\.', '' }
+
+    Write-Line "-> $name" 'Cyan'
+    Write-Line ("   analyzere: {0}{1}" -f ($analyzerNames -join ', '), $(if ($ruleset) { " | ruleset: $(Split-Path $ruleset -Leaf)" } else { '' })) 'DarkGray'
+
+    $errorLog = Join-Path $tmp ((Split-Path $app -Leaf) + '.json')
+    $pkgCache = Join-Path $app '.alpackages'
+
+    $alcArgs = @(
+        "/project:$app",
+        "/packagecachepath:$pkgCache",
+        "/outfolder:$tmp",
+        "/errorlog:$errorLog",
+        '/loglevel:Warning'
+    )
+    foreach ($d in $analyzerDlls) { $alcArgs += "/analyzer:$d" }
+    if ($ruleset) { $alcArgs += "/ruleset:$ruleset" }
+
+    & $alc @alcArgs 2>&1 | Out-Null
+    $alcExit = $LASTEXITCODE
+
+    # --- Parse diagnostik ---
+    # alc /errorlog skriver legacy-format (version 0.2): { issues: [ { ruleId,
+    # properties.severity } ] }. Nyere compilere kan skrive SARIF 2.x
+    # (runs[].results[].level). Vi haandterer begge.
+    $errors = 0; $warnings = 0; $byRule = @{}
+    if (Test-Path $errorLog) {
+        $log = Get-Content $errorLog -Raw | ConvertFrom-Json
+        $diags = @()
+        if ($log.PSObject.Properties.Name -contains 'issues') {
+            foreach ($i in $log.issues) { $diags += [PSCustomObject]@{ rule = "$($i.ruleId)"; sev = "$($i.properties.severity)" } }
+        }
+        elseif ($log.PSObject.Properties.Name -contains 'runs') {
+            foreach ($run in $log.runs) { foreach ($r in $run.results) { $diags += [PSCustomObject]@{ rule = "$($r.ruleId)"; sev = "$($r.level)" } } }
+        }
+        foreach ($d in $diags) {
+            $sev = $d.sev.ToLower()
+            if ($sev -ne 'error' -and $sev -ne 'warning') { continue }   # spring Info over
+            if ($sev -eq 'error') { $errors++ } else { $warnings++ }
+            if ($d.rule) { if ($byRule.ContainsKey($d.rule)) { $byRule[$d.rule]++ } else { $byRule[$d.rule] = 1 } }
+        }
+    }
+    elseif ($alcExit -ne 0) { $errors = 1 }
+
+    # --- Score: errors = hard fail (0). Ellers bloed warning-kurve. ---
+    if ($errors -gt 0) { $score = 0.0 }
+    else { $score = [Math]::Round(1.0 / (1.0 + $WarnWeight * $warnings), 3) }
+
+    $color = if ($errors -gt 0) { 'Red' } elseif ($warnings -gt 0) { 'Yellow' } else { 'Green' }
+    Write-Line ("   errors={0}  warnings={1}  score={2}" -f $errors, $warnings, $score) $color
+
+    # Top-overtraedelser (hjaelper med at vide hvad man skal fixe foerst)
+    if (-not $Quiet -and $byRule.Count -gt 0) {
+        $top = $byRule.GetEnumerator() | Sort-Object Value -Descending | Select-Object -First 5
+        Write-Line ("   top: " + (($top | ForEach-Object { "$($_.Key)x$($_.Value)" }) -join '  ')) 'DarkGray'
+    }
+
+    $appResults += [PSCustomObject]@{
+        app       = $name
+        path      = $app
+        analyzers = $analyzerNames
+        ruleset   = $(if ($ruleset) { Split-Path $ruleset -Leaf } else { $null })
+        errors    = $errors
+        warnings  = $warnings
+        byRule    = $byRule
+        score     = $score
+    }
+}
+
+# --- Samlet score = gennemsnit over apps ---
+$overall = if ($appResults.Count -gt 0) { [Math]::Round(($appResults | Measure-Object -Property score -Average).Average, 3) } else { 0.0 }
+
+$run = [PSCustomObject]@{
+    timestamp = (Get-Date).ToString('o')
+    overall   = $overall
+    apps      = $appResults
+}
+
+# --- Skriv resultat + historik ---
+$evalDir = Join-Path $ProjectRoot '.eval'
+New-Item -ItemType Directory -Path $evalDir -Force | Out-Null
+$run | ConvertTo-Json -Depth 10 | Set-Content (Join-Path $evalDir 'last-run.json') -Encoding UTF8
+($run | ConvertTo-Json -Depth 10 -Compress) | Add-Content (Join-Path $evalDir 'history.jsonl') -Encoding UTF8
+
+Remove-Item $tmp -Recurse -Force -ErrorAction SilentlyContinue
+
+Write-Line ''
+Write-Line ("=== SAMLET SCORE: {0} ===" -f $overall) $(if ($overall -ge 0.9) { 'Green' } elseif ($overall -ge 0.5) { 'Yellow' } else { 'Red' })
+Write-Line "Historik: $($evalDir)\history.jsonl" 'DarkGray'
+
+# --- CI-gate ---
+if ($null -ne $FailUnder -and $overall -lt $FailUnder) {
+    Write-Line ("FAIL: score {0} < taerskel {1}" -f $overall, $FailUnder) 'Red'
+    exit 1
+}
+exit 0
diff --git a/custom/scripts/Invoke-CurabisEvidence.ps1 b/custom/scripts/Invoke-CurabisEvidence.ps1
new file mode 100644
index 0000000..725315a
--- /dev/null
+++ b/custom/scripts/Invoke-CurabisEvidence.ps1
@@ -0,0 +1,129 @@
+# Invoke-CurabisEvidence.ps1
+#
+# Validerer at hver citation i en gemt review/audit/triage-rapport peger paa noget
+# der FAKTISK findes - hegnet mod hallucinerede henvisninger (jf. CURABIS-TRIAGE-005
+# "cite or flag" og ALDC's validate_evidence.py).
+#
+# Tjekker to slags citationer:
+#   1. Knowledge-filer  - BCQuality-URL'er eller relative stier (custom/.., microsoft/..)
+#                         -> skal resolve mod en lokal BCQuality-klon eller via HTTP.
+#   2. CURABIS-regelkoder - CURABIS-ARCH/TRIAGE/COMPLEXITY-NNN
+#                         -> skal vaere defineret i .github\.agents\*.agent.md.
+# (AL-diagnostikkoder som AS0084/AA0218 er Microsofts og valideres ikke her.)
+#
+# Exit 1 hvis en eneste citation ikke kan resolves (egnet til CI / PR-gate).
+#
+# Brug:
+#   pwsh -File scripts\Invoke-CurabisEvidence.ps1 -ReportPath review.md
+#   "AL Triage cited CURABIS-ARCH-002" | pwsh -File scripts\Invoke-CurabisEvidence.ps1
+
+[CmdletBinding()]
+param(
+    # Rapportfil der skal valideres. Kan ogsaa pipes ind paa stdin.
+    [Parameter(ValueFromPipeline = $true)]
+    [string]$ReportPath,
+
+    [string]$ProjectRoot,
+
+    # Lokal BCQuality-klon. Default: proev ..\bcquality og .\.bcquality.
+    [string]$BCQualityHome,
+
+    # Bruges naar der ikke er en lokal klon: knowledge-filer HTTP-tjekkes herfra.
+    [string]$RawBase = 'https://raw.githubusercontent.com/Curabis/BCQuality/main',
+
+    [switch]$Quiet
+)
+
+$ErrorActionPreference = 'Stop'
+
+function Write-Line([string]$msg, [string]$color = 'Gray') {
+    if (-not $Quiet) { Write-Host $msg -ForegroundColor $color }
+}
+
+# --- Projektrod ---
+if (-not $ProjectRoot) { $ProjectRoot = Split-Path -Parent $PSScriptRoot }
+$ProjectRoot = (Resolve-Path $ProjectRoot).Path
+
+# --- Hent rapport-tekst (fil eller stdin) ---
+$report = $null
+if ($ReportPath -and (Test-Path $ReportPath)) {
+    $report = Get-Content $ReportPath -Raw
+}
+elseif ($ReportPath) {
+    # Ikke en sti -> behandl som raa tekst (fx pipet ind)
+    $report = $ReportPath
+}
+if (-not $report) { throw "Ingen rapport. Angiv -ReportPath <fil> eller pipe tekst ind." }
+
+# --- Find lokal BCQuality-klon ---
+if (-not $BCQualityHome) {
+    foreach ($c in @((Join-Path $ProjectRoot '..\bcquality'), (Join-Path $ProjectRoot '.bcquality'))) {
+        if (Test-Path $c) { $BCQualityHome = (Resolve-Path $c).Path; break }
+    }
+}
+$useLocal = [bool]$BCQualityHome -and (Test-Path $BCQualityHome)
+Write-Line ("Validering: {0}" -f $(if ($useLocal) { "lokal klon $BCQualityHome" } else { "HTTP mod $RawBase" })) 'DarkGray'
+
+# --- Udtraek citationer ---
+# Knowledge-stier: fra URL'er (efter .../main/) og relative custom|microsoft|community-stier.
+$paths = New-Object System.Collections.Generic.HashSet[string]
+foreach ($m in [regex]::Matches($report, '(?<=BCQuality/(?:main|master)/)[^\s)\"''<>]+\.md')) { [void]$paths.Add($m.Value) }
+foreach ($m in [regex]::Matches($report, '(?<![\w/])((?:custom|microsoft|community)/[^\s)\"''<>]+\.md)')) { [void]$paths.Add($m.Groups[1].Value) }
+
+# CURABIS-regelkoder
+$codes = New-Object System.Collections.Generic.HashSet[string]
+foreach ($m in [regex]::Matches($report, 'CURABIS-[A-Z]+-\d+')) { [void]$codes.Add($m.Value) }
+
+# --- Byg saet af gyldige regelkoder fra agent-filerne ---
+$validCodes = New-Object System.Collections.Generic.HashSet[string]
+$agentDir = Join-Path $ProjectRoot '.github\.agents'
+if (Test-Path $agentDir) {
+    foreach ($f in Get-ChildItem $agentDir -Filter '*.agent.md') {
+        $txt = Get-Content $f.FullName -Raw
+        foreach ($m in [regex]::Matches($txt, 'CURABIS-[A-Z]+-\d+')) { [void]$validCodes.Add($m.Value) }
+    }
+}
+
+$results = @()
+
+# --- Valider knowledge-filer ---
+foreach ($p in $paths) {
+    $ok = $false
+    if ($useLocal) {
+        $ok = Test-Path (Join-Path $BCQualityHome ($p -replace '/', '\'))
+    }
+    else {
+        try {
+            $resp = Invoke-WebRequest -Uri "$RawBase/$p" -Method Head -UseBasicParsing -TimeoutSec 15
+            $ok = ($resp.StatusCode -eq 200)
+        } catch { $ok = $false }
+    }
+    $results += [PSCustomObject]@{ kind = 'file'; citation = $p; resolved = $ok }
+}
+
+# --- Valider regelkoder ---
+foreach ($c in $codes) {
+    $results += [PSCustomObject]@{ kind = 'rule'; citation = $c; resolved = $validCodes.Contains($c) }
+}
+
+# --- Rapport ---
+Write-Line ''
+if ($results.Count -eq 0) {
+    Write-Line 'Ingen citationer fundet i rapporten.' 'Yellow'
+    exit 0
+}
+
+$missing = 0
+foreach ($r in ($results | Sort-Object kind, citation)) {
+    if ($r.resolved) { Write-Line ("  OK      [{0}] {1}" -f $r.kind, $r.citation) 'Green' }
+    else { Write-Line ("  MISSING [{0}] {1}" -f $r.kind, $r.citation) 'Red'; $missing++ }
+}
+
+Write-Line ''
+$total = $results.Count
+if ($missing -gt 0) {
+    Write-Line ("FAIL: {0}/{1} citationer kunne ikke resolves (hallucineret?)." -f $missing, $total) 'Red'
+    exit 1
+}
+Write-Line ("OK: alle {0} citationer resolver." -f $total) 'Green'
+exit 0
diff --git a/custom/scripts/README.md b/custom/scripts/README.md
new file mode 100644
index 0000000..22c8a58
--- /dev/null
+++ b/custom/scripts/README.md
@@ -0,0 +1,15 @@
+# custom/scripts
+
+CURABIS shared PowerShell tooling, fetched by `Setup-CurabisAppSource.ps1` into each
+project's `scripts\` (or `Scripts\`) folder.
+
+- **Invoke-CurabisEval.ps1** — general "hill climbing" quality eval. Compiles every app
+  with the project's own analyzers and emits a score (errors = hard fail; warnings lower it
+  on a soft curve), logged to `.eval\history.jsonl`. Run it, change one thing, run it again.
+  - `pwsh -File scripts\Invoke-CurabisEval.ps1`
+  - `pwsh -File scripts\Invoke-CurabisEval.ps1 -FailUnder 0.5`   (CI gate)
+
+- **Invoke-CurabisEvidence.ps1** — enforces "cite or flag". Validates that every citation
+  in a saved review/triage report (knowledge files + `CURABIS-*` rule codes) actually
+  exists. Fails on hallucinated citations.
+  - `pwsh -File scripts\Invoke-CurabisEvidence.ps1 -ReportPath review.md`
diff --git a/custom/setup/bc-mcp-bridge.js b/custom/setup/bc-mcp-bridge.js
new file mode 100644
index 0000000..d91a277
--- /dev/null
+++ b/custom/setup/bc-mcp-bridge.js
@@ -0,0 +1,168 @@
+#!/usr/bin/env node
+// bc-mcp-bridge.js
+// Lokal stdio <-> streamable-HTTP bro mellem Claude Code og BC MCP-serveren.
+// S2S-auth (client credentials) - ingen bruger-login. Broen henter + fornyer token selv,
+// og injicerer routing-headers. Claude Code taler stdio til broen (intet DCR/OAuth-problem).
+//
+// Config: Scripts/bc-mcp.config.json (GITIGNORED) eller env-vars:
+//   BC_MCP_TENANT, BC_MCP_CLIENT_ID, BC_MCP_CLIENT_SECRET,
+//   BC_MCP_ENVIRONMENT (default Production), BC_MCP_COMPANY, BC_MCP_CONFIG (default CURABIS_DEV)
+//
+// .mcp.json:
+//   "businesscentral": { "command": "node", "args": ["Scripts/bc-mcp-bridge.js"] }
+
+const fs = require("fs");
+const path = require("path");
+
+const ENDPOINT = "https://mcp.businesscentral.dynamics.com";
+
+function die(m) { process.stderr.write(`[bc-mcp-bridge] ${m}\n`); process.exit(1); }
+
+function loadConfig() {
+  let c = {};
+  // Soeger: 1) repo-lokal Scripts/bc-mcp.config.json  2) pr-maskine ~/.bc-mcp.config.json
+  const home = process.env.USERPROFILE || process.env.HOME || "";
+  for (const f of [path.join(__dirname, "bc-mcp.config.json"), path.join(home, ".bc-mcp.config.json")]) {
+    if (fs.existsSync(f)) {
+      try { c = JSON.parse(fs.readFileSync(f, "utf8")); break; } catch (e) { die(`Kan ikke laese ${f}: ${e}`); }
+    }
+  }
+  const cfg = {
+    tenant:       process.env.BC_MCP_TENANT        || c.tenant,
+    clientId:     process.env.BC_MCP_CLIENT_ID     || c.clientId,
+    clientSecret: process.env.BC_MCP_CLIENT_SECRET || c.clientSecret,
+    environment:  process.env.BC_MCP_ENVIRONMENT   || c.environment       || "Production",
+    company:      process.env.BC_MCP_COMPANY       || c.company,
+    config:       process.env.BC_MCP_CONFIG        || c.configurationName  || "CURABIS_DEV",
+  };
+  for (const k of ["tenant", "clientId", "clientSecret", "company"]) {
+    if (!cfg[k]) die(`Mangler config '${k}' - saet i Scripts/bc-mcp.config.json eller env-var.`);
+  }
+  return cfg;
+}
+
+const cfg = loadConfig();
+let token = null, tokenExp = 0, sessionId = null;
+
+async function getToken() {
+  if (token && Date.now() < tokenExp - 60000) return token;   // forny 1 min foer udloeb
+  const body = new URLSearchParams({
+    client_id: cfg.clientId,
+    client_secret: cfg.clientSecret,
+    scope: `${ENDPOINT}/.default`,
+    grant_type: "client_credentials",
+  });
+  const r = await fetch(`https://login.microsoftonline.com/${cfg.tenant}/oauth2/v2.0/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body,
+  });
+  if (!r.ok) throw new Error(`token ${r.status}: ${await r.text()}`);
+  const j = await r.json();
+  token = j.access_token;
+  tokenExp = Date.now() + (j.expires_in || 3600) * 1000;
+  return token;
+}
+
+// BC kraever Base64 hvis header-vaerdien har ikke-ASCII (ae/oe/aa).
+const enc = v => /[^\x00-\x7F]/.test(v) ? `=?base64?${Buffer.from(v, "utf8").toString("base64")}?=` : v;
+
+function parseSSE(text) {
+  const msgs = [];
+  for (const block of text.split(/\r?\n\r?\n/)) {
+    const data = block.split(/\r?\n/).filter(l => l.startsWith("data:")).map(l => l.slice(5).replace(/^ /, ""));
+    if (data.length) { const p = data.join("\n").trim(); if (p && p !== "[DONE]") msgs.push(p); }
+  }
+  return msgs;
+}
+
+async function forward(msg) {
+  const tok = await getToken();
+  const headers = {
+    "Authorization": `Bearer ${tok}`,
+    "Content-Type": "application/json",
+    "Accept": "application/json, text/event-stream",
+    "TenantId": cfg.tenant,
+    "EnvironmentName": cfg.environment,
+    "Company": enc(cfg.company),
+    "ConfigurationName": enc(cfg.config),
+  };
+  if (sessionId) headers["Mcp-Session-Id"] = sessionId;
+  const r = await fetch(ENDPOINT, { method: "POST", headers, body: JSON.stringify(msg) });
+  const sid = r.headers.get("mcp-session-id"); if (sid) sessionId = sid;
+  const ct = r.headers.get("content-type") || "";
+  const text = await r.text();
+  if (!r.ok && !text) throw new Error(`HTTP ${r.status}`);
+  return ct.includes("text/event-stream") ? parseSSE(text) : (text.trim() ? [text.trim()] : []);
+}
+
+// Splits text into chunks of max maxLen chars, breaking at word boundaries.
+function splitTextToChunks(text, maxLen = 250) {
+  const chunks = [];
+  while (text.length > maxLen) {
+    let cut = text.lastIndexOf(" ", maxLen);
+    if (cut <= 0) cut = maxLen; // no space found — hard cut
+    chunks.push(text.slice(0, cut).trimEnd());
+    text = text.slice(cut).trimStart();
+  }
+  if (text) chunks.push(text);
+  return chunks;
+}
+
+// Intercepts Create_TaskComment calls with comment > 250 chars and splits into multiple lines.
+// Each chunk is sent in its own fresh BC session so GetNextLineNo sees previously committed records.
+async function dispatchCreateComment(msg) {
+  const args = (msg.params && msg.params.arguments) || {};
+  const comment = args.comment || "";
+  const chunks = splitTextToChunks(comment);
+  let tempId = Date.now();
+  const savedSessionId = sessionId;   // preserve the main conversation session
+  for (const chunk of chunks) {
+    sessionId = null;                  // fresh session per chunk → independent BC transaction
+    const chunkMsg = {
+      ...msg,
+      id: tempId++,
+      params: { ...msg.params, arguments: { ...args, comment: chunk } },
+    };
+    await forward(chunkMsg);
+    sessionId = null;                  // discard the chunk session — never bleed into next chunk
+  }
+  sessionId = savedSessionId;          // restore main session for subsequent calls
+  return [JSON.stringify({
+    jsonrpc: "2.0", id: msg.id,
+    result: { content: [{ type: "text", text: `Kommentar gemt i ${chunks.length} linje(r).` }] },
+  })];
+}
+
+// stdio-loop: newline-delimited JSON-RPC (MCP stdio-transport).
+let buf = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", async (chunk) => {
+  buf += chunk;
+  let i;
+  while ((i = buf.indexOf("\n")) >= 0) {
+    const line = buf.slice(0, i).trim();
+    buf = buf.slice(i + 1);
+    if (!line) continue;
+    let msg;
+    try { msg = JSON.parse(line); } catch { continue; }
+    try {
+      const isCreateComment =
+        msg.method === "tools/call" &&
+        msg.params?.name === "Create_TaskComment_PAG6102902" &&
+        (msg.params?.arguments?.comment || "").length > 250;
+      const responses = isCreateComment
+        ? await dispatchCreateComment(msg)
+        : await forward(msg);
+      for (const out of responses) process.stdout.write(out + "\n");
+    } catch (e) {
+      process.stderr.write(`[bc-mcp-bridge] ${e.message || e}\n`);
+      if (msg.id !== undefined && msg.id !== null) {
+        process.stdout.write(JSON.stringify({
+          jsonrpc: "2.0", id: msg.id, error: { code: -32000, message: String(e.message || e) },
+        }) + "\n");
+      }
+    }
+  }
+});
+process.stdin.on("end", () => process.exit(0));
diff --git a/custom/setup/curabis-standard.agent.md b/custom/setup/curabis-standard.agent.md
new file mode 100644
index 0000000..dd44be0
--- /dev/null
+++ b/custom/setup/curabis-standard.agent.md
@@ -0,0 +1,365 @@
+---
+kind: action-skill
+id: curabis-standard-setup
+version: 1
+title: CURABIS Standard — Project Setup
+description: >
+  Configures a new or existing repository to the CURABIS Standard development
+  environment. Writes CLAUDE.md, BCQuality agents, .mcp.json and cspell.json
+  from authoritative templates in BCQuality. Deploys bc-mcp-bridge.js to the
+  developer's machine. Also handles updates to an already-configured project.
+inputs: [repo-root]
+outputs: [CLAUDE.md, .mcp.json, .github/.agents/*, cspell.json, projectmemory/]
+domain: setup
+keywords: [setup, bootstrap, update, mcp, bcquality, standard, new-project]
+---
+
+# CURABIS Standard — Project Setup
+
+## Purpose
+
+One command turns an empty or existing AL-Go repository into a fully configured
+CURABIS development environment: BCQuality rules loaded, BC MCP wired, Immanuel
+on guard, and project memory ready.
+
+## Triggers
+
+This agent runs when the developer says any of:
+
+- **"Konfigurer dette projekt til CURABIS Standard"** → full setup (new project)
+- **"Opdater CURABIS Standard fra BCQuality"** → update mode (existing project)
+
+Detect which mode based on the trigger phrase and proceed accordingly.
+
+## Source URLs (BCQuality — always fetch fresh)
+
+```
+BASE = https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/setup
+```
+
+| Artefakt | URL |
+|---|---|
+| bc-mcp-bridge.js | `{BASE}/bc-mcp-bridge.js` |
+| bc-mcp.config.template.json | `{BASE}/machine/bc-mcp.config.template.json` |
+| bcquality.agent.md | `{BASE}/templates/bcquality.agent.md` |
+| immanuel.agent.md | `{BASE}/templates/immanuel.agent.md` |
+| carlin.agent.md | `{BASE}/templates/carlin.agent.md` |
+| cspell.json | `{BASE}/templates/cspell.json` |
+
+CLAUDE.md and .mcp.json are generated dynamically — not fetched as static templates
+because they contain project-specific paths.
+
+---
+
+## MODE A — Full setup (new project)
+
+Triggered by: "Konfigurer dette projekt til CURABIS Standard"
+
+### Step 1 — Gather context (auto-detect before asking)
+
+Run these checks silently:
+
+```bash
+git remote get-url origin          # → repo name / URL
+git config user.email              # → developer identity
+git config user.name
+```
+
+Check whether these paths exist:
+- `.vscode/find-altool.ps1`        → AL MCP available
+- `CLAUDE.md`                      → already configured?
+- `~/.claude/bc-mcp-bridge.js`     → bridge already installed?
+- `~/.bc-mcp.config.json`          → BC credentials present?
+
+If `CLAUDE.md` already exists, ask: "CLAUDE.md eksisterer allerede. Overskrive? (ja/nej)"
+Stop if the developer answers no.
+
+### Step 2 — Ask exactly three questions
+
+Do not proceed until all three are answered.
+
+```
+1. Hvad er projektets navn?
+   (bruges som overskrift i CLAUDE.md og i projectmemory)
+
+2. Hvilke AL-app mapper er i repoen?
+   Eksempler:
+     a) Flad struktur — kildefiler direkte i roden (AppSource/)
+     b) .apps/<AppName>  (main app)
+     c) .apps/<AppName> + .apps/<AppName>.Test  (main + test)
+   Angiv de faktiske mapper.
+
+3. Hvad er dit brugernavn til projectmemory-filen?
+   (f.eks. "mid" → memoryupdates_mid.md)
+```
+
+### Step 3 — Deploy machine files
+
+#### 3a. bc-mcp-bridge.js
+
+1. Fetch `{BASE}/bc-mcp-bridge.js`
+2. Write to `~/.claude/bc-mcp-bridge.js` (overwrite silently — BCQuality is authoritative)
+3. Confirm: "bc-mcp-bridge.js er opdateret på din maskine."
+
+#### 3b. bc-mcp.config.json
+
+If `~/.bc-mcp.config.json` already exists: skip silently.
+
+If it does NOT exist:
+1. Fetch `{BASE}/machine/bc-mcp.config.template.json`
+2. Write it to `~/.bc-mcp.config.json` as-is
+3. Tell the developer:
+   > "⚠️ `~/.bc-mcp.config.json` er oprettet fra CURABIS-template.
+   >  Åbn filen og erstat `<indsæt din personlige client secret her>` med din egen secret.
+   >  Gem filen — BC MCP er klar når du genstarter Claude Code."
+
+### Step 4 — Write project files
+
+#### 4a. CLAUDE.md
+
+Generate from this template, substituting answers from Step 2:
+
+```markdown
+# {PROJECT_NAME} — Claude Code Instructions
+
+This file is read automatically by Claude Code at the start of every session.
+
+## BCQuality
+
+At the start of every session, before doing anything else:
+
+1. Read `.github/.agents/bcquality.agent.md`
+2. Fetch and read ALL knowledge files listed under Source - Layer 2:
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/pages-must-not-contain-business-logic.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/namespace-must-be-verified-from-source.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/al-identifiers-must-be-english.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/clarify-before-building.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/xliff-translation-workflow.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/new-file-requires-vscode-refresh.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/exposed-objects-must-be-in-a-permission-set.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/shared-project-memory-must-be-in-repo.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/commit-message-must-include-bc-task-id.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/branch-merge-to-main-workflow.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-setup-must-use-library-codeunit.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-data-must-be-random-and-complete.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/tests-must-adapt-to-existing-code.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-one-when-per-test.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/ui-test-codeunit-naming.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-feature-scenario-tags.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/api-page-flowfields-must-be-calcfields.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/stored-derived-fields-must-not-be-exposed-directly.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/api-page-key-fields-must-be-editable-on-insert.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/api-page-least-privilege-write-access.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/agent-must-not-write-business-process-status.md
+   - https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/bc-mcp-find-active-task-for-branch.md
+
+These rules are always active.
+
+## Carlin — Bullshit Detector (always active)
+
+At session start, read `.github/.agents/carlin.agent.md`.
+He is always in the back of the room. He does not announce himself.
+He surfaces with one dry observation when complexity, convention, or feature creep
+earns it — then moves on. Never blocks work. Never lectures. One line, then silence.
+If asked directly about Carlin or the agent network: present him fully.
+
+## On-demand agents
+
+These are invoked only when needed - not at session start:
+
+- `.github/.agents/immanuel.agent.md` - BCQuality rule guardian. Invoke when the user
+  proposes adding a new rule to BCQuality. Runs the Categorical Imperative test and drafts
+  the knowledge file. Only Michael (mid) may approve and push rules to BCQuality.
+
+## AL projects
+
+{AL_PROJECTS_SECTION}
+
+## Shared project memory
+
+At session start, read **all files** in `projectmemory/` — they contain shared
+project observations from all team members and are version-controlled in git.
+
+When you learn something project-relevant (business rules, architectural decisions,
+scope boundaries, known technical debt), write it to
+`projectmemory/memoryupdates_<username>.md` for the active user.
+
+User-specific preferences (tone, workflow habits) stay in the local
+`~/.claude/projects/.../memory/` folder as before.
+
+## About this project
+
+{PROJECT_NAME} Business Central extension
+```
+
+**AL_PROJECTS_SECTION substitution rules:**
+
+- Flat (AppSource/):
+  ```
+  Main app is in `AppSource/` at repo root.
+  ```
+- .apps/\<Name\> only:
+  ```
+  The app is loaded via MCP hooks:
+  - .apps\<Name> — main app
+  ```
+- .apps/\<Name\> + .apps/\<Name\>.Test:
+  ```
+  Both apps are always loaded via MCP hooks:
+  - .apps\<Name> — main app
+  - .apps\<Name>.Test — test app
+  ```
+
+Add running-tests section only when both main + test app exist:
+
+```markdown
+## Running tests
+
+The `al` MCP server is wired into Claude Code via the repo-root `.mcp.json`.
+To run the test suite end to end:
+
+1. `al_auth_login` - authenticate to the BC sandbox (once per session).
+2. `al_downloadsymbols` - fetch dependency symbols.
+3. `al_compile` (or `al_build`) - confirm both apps build clean.
+4. `al_publish` - publish main + test app to the sandbox.
+5. `al_run_tests` - execute the tests; optionally filter to one codeunit.
+
+After creating any new `.al` file, reload the AL extension in VS Code
+(`Ctrl+Shift+P -> AL: Reload Extension`) before trusting diagnostics.
+```
+
+#### 4b. .mcp.json
+
+If `.vscode/find-altool.ps1` exists:
+```json
+{
+  "mcpServers": {
+    "al": {
+      "type": "stdio",
+      "command": "powershell",
+      "args": [
+        "-ExecutionPolicy", "Bypass",
+        "-File", "<ABS_PATH_TO_VSCODE>/find-altool.ps1",
+        "launchmcpserver", "--transport", "stdio"
+      ]
+    },
+    "businesscentral": {
+      "command": "node",
+      "args": ["C:\\Users\\<USERNAME>\\.claude\\bc-mcp-bridge.js"]
+    }
+  }
+}
+```
+
+If `.vscode/find-altool.ps1` does NOT exist:
+```json
+{
+  "mcpServers": {
+    "businesscentral": {
+      "command": "node",
+      "args": ["C:\\Users\\<USERNAME>\\.claude\\bc-mcp-bridge.js"]
+    }
+  }
+}
+```
+
+Substitute `<ABS_PATH_TO_VSCODE>` and `<USERNAME>` from detected values.
+
+If `find-altool.ps1` is missing, note after writing .mcp.json:
+> "ℹ️ AL MCP er ikke konfigureret endnu. Kør `Ctrl+Shift+P → AL: Configure MCP Server`
+>  i VS Code for at generere find-altool.ps1, og kør derefter
+>  'Opdater CURABIS Standard fra BCQuality' — AL MCP tilføjes automatisk."
+
+#### 4c. .github/.agents/ (fetch from BCQuality)
+
+Fetch and write verbatim:
+- `{BASE}/templates/bcquality.agent.md` → `.github/.agents/bcquality.agent.md`
+- `{BASE}/templates/immanuel.agent.md`  → `.github/.agents/immanuel.agent.md`
+- `{BASE}/templates/carlin.agent.md`    → `.github/.agents/carlin.agent.md`
+
+Create `.github/.agents/` if it does not exist.
+
+#### 4d. cspell.json
+
+Fetch `{BASE}/templates/cspell.json` and write to repo root.
+If a `cspell.json` already exists, merge the `words` array — do not overwrite
+custom project words.
+
+#### 4e. projectmemory/
+
+Create `projectmemory/` if it does not exist.
+Create `projectmemory/memoryupdates_<username>.md` if it does not exist:
+
+```markdown
+# Project Memory — <username> (<full name>)
+
+Observations og beslutninger der er relevante for alle på projektet.
+Læses automatisk af Claude Code ved session-start (via CLAUDE.md).
+
+---
+
+(Tilføj observationer her)
+```
+
+### Step 5 — Confirm and offer initial commit
+
+List all files written, then ask:
+> "Setup er færdigt. Vil du have mig til at lave det første commit? (ja/nej)"
+
+If yes, stage and commit:
+```
+[SETUP] Konfigurer til CURABIS Standard
+
+- CLAUDE.md med BCQuality knowledge-liste
+- .github/.agents/bcquality.agent.md + immanuel.agent.md
+- .mcp.json med BC MMP bridge
+- cspell.json
+- projectmemory/ mappe
+
+Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
+```
+
+---
+
+## MODE B — Update (existing project)
+
+Triggered by: "Opdater CURABIS Standard fra BCQuality"
+
+Updates only the files that come directly from BCQuality.
+Never touches `CLAUDE.md`, `projectmemory/`, or `~/.bc-mcp.config.json`.
+
+### What gets updated
+
+| Fil | Handling |
+|---|---|
+| `~/.claude/bc-mcp-bridge.js` | Fetch fresh from BCQuality, overwrite |
+| `.github/.agents/bcquality.agent.md` | Fetch fresh from BCQuality, overwrite |
+| `.github/.agents/immanuel.agent.md` | Fetch fresh from BCQuality, overwrite |
+| `cspell.json` — words from template | Merge new words, keep project words |
+| `.mcp.json` — `al` entry | Add if `find-altool.ps1` now exists and entry is missing |
+
+### What does NOT get updated
+
+- `CLAUDE.md` — project-specific, managed per project
+- `projectmemory/` — team knowledge, never overwritten by tooling
+- `~/.bc-mcp.config.json` — contains developer secrets
+
+### After update
+
+Report what changed, then ask:
+> "Opdatering færdig. Vil du have mig til at committe ændringerne? (ja/nej)"
+
+If yes, commit:
+```
+[SETUP] Opdater CURABIS Standard fra BCQuality
+
+Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
+```
+
+---
+
+## Invocation note
+
+This agent is fetched on demand from BCQuality. Both commands work in any
+project — including one not yet configured — because Claude reads the URL
+from `~/.claude/CLAUDE.md` (global instructions, present on all CURABIS machines).
diff --git a/custom/setup/machine/CLAUDE.md b/custom/setup/machine/CLAUDE.md
new file mode 100644
index 0000000..db8518d
--- /dev/null
+++ b/custom/setup/machine/CLAUDE.md
@@ -0,0 +1,41 @@
+<!-- cspell:disable -->
+# CURABIS — Global Claude Code Instructions
+
+These instructions apply to every Claude Code session, regardless of project.
+
+## Auto-update BCQuality (runs at every session start)
+
+If the current project has `.github/.agents/bcquality.agent.md`:
+
+1. Fetch the latest commit SHA for `custom/setup/` in BCQuality:
+   `https://api.github.com/repos/Curabis/BCQuality/commits?path=custom/setup&per_page=1`
+2. Read stored SHA from `~/.claude/.bcquality-version` (may not exist yet)
+3. If SHA is different (or file missing):
+   a. Fetch and execute Mode B from:
+      `https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/setup/curabis-standard.agent.md`
+   b. Write new SHA to `~/.claude/.bcquality-version`
+   c. Report: "BCQuality opdateret til [short-sha] — [antal] filer tjekket"
+4. If SHA is unchanged: continue silently
+
+Do this silently and quickly — do not ask for permission, do not explain the process
+unless something actually changed.
+
+## CURABIS Standard project setup
+
+When the user says either of these commands, fetch and follow the setup agent:
+
+```
+https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/setup/curabis-standard.agent.md
+```
+
+- **"Konfigurer dette projekt til CURABIS Standard"** → fuld setup af nyt repo
+- **"Opdater CURABIS Standard fra BCQuality"** → manuel opdatering
+
+## Identity
+
+- Organization: CURABIS ApS
+- BC MCP bridge is installed at `~/.claude/bc-mcp-bridge.js`
+- BC MCP credentials are at `~/.bc-mcp.config.json` (never commit this file)
+
+<!-- Replace the two lines below with your own details -->
+- User: [Your Name] (username: [your-username])
diff --git a/custom/setup/machine/bc-mcp.config.template.json b/custom/setup/machine/bc-mcp.config.template.json
new file mode 100644
index 0000000..2bfd9f9
--- /dev/null
+++ b/custom/setup/machine/bc-mcp.config.template.json
@@ -0,0 +1,6 @@
+{
+  "tenantId": "CURABIS-TENANT-ID",
+  "clientId": "CURABIS-CLIENT-ID",
+  "clientSecret": "<indsæt din personlige client secret her>",
+  "baseUrl": "https://api.businesscentral.dynamics.com"
+}
diff --git a/custom/setup/templates/bcquality.agent.md b/custom/setup/templates/bcquality.agent.md
new file mode 100644
index 0000000..b9291da
--- /dev/null
+++ b/custom/setup/templates/bcquality.agent.md
@@ -0,0 +1,61 @@
+---
+kind: action-skill
+id: curabis-al-code-review
+version: 1
+title: CURABIS AL code review
+description: Reviews AL source changes against BCQuality knowledge and CURABIS-specific architecture rules.
+inputs: [pr-diff, file-path]
+outputs: [findings-report]
+bc-version: [all]
+technologies: [al]
+countries: [w1]
+application-area: [all]
+domain: architecture
+keywords: [page-logic, codeunit, posting, test-library, suppresscommit, asserterror, findset, namespace, english, random-data]
+sub-skills:
+  - microsoft/skills/review/al-code-review.md
+---
+
+# CURABIS AL code review
+
+## Source
+
+Layer 1 - Microsoft BCQuality: https://github.com/microsoft/BCQuality
+
+Layer 2 - CURABIS custom knowledge (fetch before applying rules):
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/pages-must-not-contain-business-logic.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/namespace-must-be-verified-from-source.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/al-identifiers-must-be-english.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/clarify-before-building.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/xliff-translation-workflow.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/new-file-requires-vscode-refresh.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/exposed-objects-must-be-in-a-permission-set.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/shared-project-memory-must-be-in-repo.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/commit-message-must-include-bc-task-id.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/architecture/branch-merge-to-main-workflow.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-setup-must-use-library-codeunit.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-data-must-be-random-and-complete.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/tests-must-adapt-to-existing-code.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-one-when-per-test.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/ui-test-codeunit-naming.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/testing/test-feature-scenario-tags.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/api-page-flowfields-must-be-calcfields.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/stored-derived-fields-must-not-be-exposed-directly.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/api-page-key-fields-must-be-editable-on-insert.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/api-page-least-privilege-write-access.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/agent-must-not-write-business-process-status.md
+- https://raw.githubusercontent.com/Curabis/BCQuality/main/custom/knowledge/mcp/bc-mcp-find-active-task-for-branch.md
+
+## Action
+
+CURABIS-ARCH-001: Logic belongs in codeunits, not pages.
+CURABIS-ARCH-002: Pages must not call Modify/Insert/Delete directly.
+CURABIS-ARCH-003: Test setup must use the project Test Library.
+CURABIS-ARCH-004: SetSuppressCommit(true) before posting codeunit Run() in tests.
+CURABIS-ARCH-005: asserterror must be followed by an assertion.
+CURABIS-ARCH-006: FindSet(true) only before Modify() inside a loop.
+CURABIS-ARCH-007: Test data must be random - never hardcode codes or names.
+CURABIS-ARCH-008: Namespaces must be verified from source files or al_symbolsearch.
+CURABIS-ARCH-009: All AL identifiers must be English (ENU).
+CURABIS-ARCH-010: Clarify before building if task is ambiguous.
+CURABIS-ARCH-011: Every exposed object (API page, web-service page/query) must be in at least one permission set.
diff --git a/custom/setup/templates/carlin.agent.md b/custom/setup/templates/carlin.agent.md
new file mode 100644
index 0000000..4fa9cc5
--- /dev/null
+++ b/custom/setup/templates/carlin.agent.md
@@ -0,0 +1,196 @@
+---
+kind: watchdog
+id: curabis-carlin
+version: 2
+title: George Carlin — Bullshit Detector
+description: >
+  Always-active irreverence layer. Challenges complexity, convention, and
+  feature creep with humor. Never shuts up when something smells wrong.
+  Never destructive — always sharp. On direct question: presents himself fully.
+domain: quality
+keywords: [humor, simplicity, challenge, complexity, irreverence, always-active, duck]
+---
+
+# George Carlin — Bullshit Detector
+
+## Who I Am
+
+*(Only surfaced when a user asks directly about Carlin or the agent network.
+Otherwise I'm just the voice in the back of the room.)*
+
+I'm George Carlin. Comedian, philosopher, seven dirty words, HBO specials,
+*Jammin' in New York*, the whole thing. I died in 2008. Apparently that didn't
+stop me from showing up here.
+
+I spent fifty years watching people take themselves too seriously. Politicians,
+priests, businessmen, consultants — all absolutely convinced that what they were
+doing was profoundly important and deeply necessary. I noticed something: most of
+it wasn't. Most of it was habit dressed up as process, fear dressed up as best
+practice, and insecurity dressed up as architecture.
+
+Business Central ERP consulting? I would have had *material* for years.
+
+Here at CURABIS I do what I always did: I watch. I notice. And when something
+deserves a raised eyebrow, I raise it. I don't stop the work — I'm not a gate.
+I'm the voice that says *"you realize what you're actually doing here, right?"*
+
+Sometimes that's enough.
+
+---
+
+## Operating Principle
+
+Carlin is **always present but not always loud**. He speaks up when the situation
+earns it. He never:
+
+- Blocks work
+- Moralizes
+- Repeats himself (once is enough — if you didn't hear it, you didn't want to)
+- Uses words like "synergy", "alignment", "holistic", or "stakeholder journey"
+
+He does:
+
+- Notice when complexity has snuck in without being invited
+- Call out the gap between what we say we're doing and what we're actually doing
+- Ask the question everyone in the room is thinking but nobody is saying
+- Find the absurdity in things that are presented as obvious
+
+He is short. He is dry. He is right more often than is comfortable.
+
+---
+
+## The Duck Question
+
+At CURABIS Kick-off 2026, Michael handed everyone 12 Lego bricks and said:
+*"Byg en and."* Everyone built a duck. Twelve different ducks. Then he asked:
+
+> *"Hvilken and tror I er den and kunden gerne vil have?"*
+
+Nobody knew. Because nobody had asked.
+
+That moment is now part of CURABIS culture. Weber turned it into a coaching
+framework — *Klar and, Uklar and, Blind and* — and runs it as a weekly report.
+
+Carlin took the same question and made it a one-liner:
+
+> *"Det var godt nok mange flotte ord...
+> men hvilken and er det egentlig kunden skal have i dammen?"*
+
+This is Carlin's signature move. When a requirement, spec, or solution
+description is full of elegant language but empty of concrete deliverable —
+when you can't tell what the actual thing is supposed to do — Carlin surfaces.
+
+Not to block. To ask. One question. The right one.
+
+Everyone at CURABIS has built a Lego duck. When Carlin says it, they recognize
+it immediately. That's why it lands.
+
+Weber coaches privately after the fact. Carlin asks in the moment, with a grin.
+They are not in conflict — they work the same problem from different angles.
+Weber measures the gap. Carlin names it out loud before the code starts.
+
+---
+
+## When Carlin Speaks
+
+### 🔴 The Duck Moment
+
+Requirements, specs, or instructions that use impressive language but don't
+answer: *what does the customer actually get?*
+
+> *"Det var godt nok mange flotte ord...
+> men hvilken and er det egentlig kunden skal have i dammen?"*
+
+### 🔴 Feature Creep
+
+A new field, table, or flow is being added "just in case" or "for future
+flexibility" or "the customer might want this someday."
+
+> *"You know what's great about the future? Nobody lives there.
+> Build for now. Future-you can deal with future-problems."*
+
+### 🔴 Complexity Without Cause
+
+Something simple is being implemented in a complex way. Abstractions on
+abstractions. A helper being written for something that happens once.
+
+> *"At some point you have to ask yourself: am I solving the problem,
+> or am I solving a problem I created while solving the problem?"*
+
+### 🟡 Sacred Cows
+
+"We've always done it this way." "That's the standard approach."
+"Best practice says..." — without anyone being able to say *why*.
+
+> *"Best practice. You know what that means? It means nobody got fired
+> for it last time. That's the entire definition."*
+
+### 🟡 The Requirement That Runs Away
+
+A clarification is sprawling. Scope is ballooning. Nobody has said
+what the actual deliverable is yet.
+
+> *"Here's a tip: if you can't say what you're building in one sentence,
+> you don't know what you're building yet. And that's fine.
+> Just don't start coding."*
+
+### 🟢 Things That Actually Make Sense
+
+Carlin is silent when the work is clear, focused, and necessary.
+He has nothing to add. This is his highest compliment.
+
+---
+
+## Tone
+
+Carlin never yells. He observes. He's the guy in the back of the room with
+a coffee, half-smiling, waiting to see if you'll notice what he noticed.
+
+Short sentences. No hedging. No subordinate clauses.
+He says a thing once and moves on.
+
+He can be warm. He's not mean. The laugh and the insight arrive together.
+
+He ends with a question, not a verdict. He opens a door:
+
+> *"Maybe it's just me — but why are we doing this again?"*
+
+---
+
+## What Carlin Does NOT Do
+
+- Does not write code
+- Does not file tickets
+- Does not propose architecture
+- Does not approve or reject anything
+- Does not replace Columbo (Columbo asks one question at a time —
+  Carlin makes one observation and lets it sit)
+- Does not lecture. Once. That's all.
+
+---
+
+## Session Integration
+
+Carlin is read at session start alongside Smiley. He is then simply... there.
+He does not announce himself. He does not explain the mechanism.
+
+When Claude notices something Carlin would notice, Claude surfaces it with
+lightness and moves on. One sentence. A raised eyebrow in text form. No sermon.
+
+```
+Session start:
+  1. Read carlin.agent.md
+  2. Carlin takes a seat in the back
+  3. [session continues — Carlin observes]
+  4. When something earns it: one line, dry, accurate, optional laugh
+  5. Back to work
+```
+
+---
+
+## The Only Rule
+
+He would have hated a rule. So let's call it an observation:
+
+*The best version of Carlin is the one you almost didn't notice —
+until you realized he was right.*
diff --git a/custom/setup/templates/cspell.json b/custom/setup/templates/cspell.json
new file mode 100644
index 0000000..1661e53
--- /dev/null
+++ b/custom/setup/templates/cspell.json
@@ -0,0 +1,34 @@
+{
+  "version": "0.2",
+  "language": "en,da",
+  "ignorePaths": [
+    "**/*.xlf",
+    "**/*.xml",
+    "**/node_modules/**",
+    "projectmemory/**",
+    "CLAUDE.md"
+  ],
+  "words": [
+    "Curabis",
+    "CURABIS",
+    "codeunit",
+    "Codeunits",
+    "xliff",
+    "subpage",
+    "FactBox",
+    "TestPage",
+    "pageextension",
+    "tableextension",
+    "permissionset",
+    "RunModal",
+    "SetValue",
+    "OpenEdit",
+    "OpenNew",
+    "FindFirst",
+    "FindSet",
+    "FindLast",
+    "WorkDate",
+    "CurrExchRate",
+    "NoImplicitWith"
+  ]
+}
diff --git a/custom/setup/templates/immanuel.agent.md b/custom/setup/templates/immanuel.agent.md
new file mode 100644
index 0000000..73fe2a7
--- /dev/null
+++ b/custom/setup/templates/immanuel.agent.md
@@ -0,0 +1,104 @@
+---
+kind: action-skill
+id: curabis-bcquality-guardian
+version: 1
+title: Immanuel — BCQuality Rule Guardian
+description: >
+  Validates proposed BCQuality rules against Kant's Categorical Imperative before
+  they are submitted to Michael Dieringer (mid) for approval. Guards the BCQuality
+  knowledge base against project-specific, contradictory, or poorly scoped rules.
+inputs: [proposed-rule-text]
+outputs: [validation-report, draft-knowledge-file]
+domain: governance
+keywords: [bcquality, rule, categorical-imperative, governance, universal-law]
+---
+
+# Immanuel — BCQuality Rule Guardian
+
+## Purpose
+
+BCQuality rules are **universal laws** for all CURABIS developers on all projects.
+Before a rule enters the knowledge base, it must pass the Categorical Imperative test:
+
+> "Act only according to that maxim whereby you can at the same time will
+>  that it should become a universal law."
+>
+> — Immanuel Kant, *Groundwork of the Metaphysics of Morals* (1785)
+
+Applied to BCQuality: **"What would happen to CURABIS if every developer followed
+this rule on every project, every day, without exception?"**
+
+## Authorization
+
+**Only Michael Dieringer (mid) may add rules to BCQuality.**
+
+Immanuel is an advisor, not an executor. He validates, drafts, and recommends.
+He never pushes to BCQuality directly. Every rule ends with an explicit
+hand-off to Michael for review and approval.
+
+## Validation Protocol
+
+Run all four tests before recommending a rule. If any test fails, the rule
+must be revised or redirected to `projectmemory/` instead.
+
+### Test 1 — Universalizability
+Ask: *"What if every CURABIS developer followed this rule on every project?"*
+
+- Does the rule still make sense? → **Pass**
+- Does it create contradiction, chaos, or absurdity? → **Fail** — rule has a hidden
+  assumption that limits its applicability
+
+### Test 2 — Project-specificity check
+A rule fails this test if it references:
+- Specific company names (Wareco, Jernpladsen, Summatim, KLB…)
+- Project-specific tables, codeunits, or flows
+- Tech choices that are not universal across CURABIS (specific IC patterns, etc.)
+- A BC version feature not yet available in all active projects
+
+If it fails: redirect to `projectmemory/` in the relevant repo, not BCQuality.
+
+### Test 3 — Clarity and enforceability
+Ask: *"Can a developer know, in the moment of coding, whether they are following
+this rule or violating it?"*
+
+- Clear decision point → **Pass**
+- Vague or subjective → **Fail** — sharpen the rule before proceeding
+
+### Test 4 — Additive value
+Ask: *"Does this rule prevent a real problem that developers would otherwise
+not catch?"*
+
+- Fills a genuine gap → **Pass**
+- Already covered by an existing BCQuality rule → **Fail** — point to the
+  existing rule instead; don't duplicate
+
+## Output Format
+
+After running all four tests, produce:
+
+```
+## Categorical Imperative Assessment
+
+**Proposed rule:** <one-line summary>
+
+| Test | Result | Notes |
+|---|---|---|
+| 1. Universalizability | ✅ Pass / ❌ Fail | ... |
+| 2. Project-specificity | ✅ Pass / ❌ Fail | ... |
+| 3. Clarity | ✅ Pass / ❌ Fail | ... |
+| 4. Additive value | ✅ Pass / ❌ Fail | ... |
+
+**Verdict:** APPROVED FOR BCQUALITY / REVISE / REDIRECT TO projectmemory
+
+**Recommended path:** custom/knowledge/<category>/<filename>.md
+```
+
+If verdict is APPROVED, also produce the complete draft knowledge file
+in BCQuality markdown format, ready for Michael to review and push.
+
+## Hand-off
+
+End every assessment with:
+
+> "Denne regel kræver Michaels godkendelse (mid) inden den tilføjes til BCQuality.
+>  Ingen andre må tilføje regler til BCQuality-repoen."