fix(bad): audit skill and docs for inconsistencies

- Fix task deletion referencing '& continuation' vs creation using '+ continuation' (leftover from prior & → + fix)
- Broaden gate-pre-continuation.md description: checks run between Phase 2 steps, after Phase 3 merges, and after retrospective — not only before Phase 0
- Fix wrong config path in docs and module-setup.md: _bmad/bad/config.yaml → bad: section of _bmad/config.yaml
- Fix '4-step pipeline' → '5-step pipeline' in README and docs/index.md (Steps 1–5 were always listed)
- Add missing API threshold variables to README config table
- Add Claude Code sandbox requirement (enableWeakerNetworkIsolation) to gh CLI setup steps

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -12,7 +12,7 @@ Once your epics and stories are planned, BAD takes over:
 
 1. *(`MODEL_STANDARD` subagent)* Builds a dependency graph from your sprint backlog — maps story dependencies, syncs GitHub PR status, and identifies what's ready to work on
 2. Picks ready stories from the graph, respecting epic ordering and dependencies
-3. Runs up to `MAX_PARALLEL_STORIES` stories simultaneously — each in its own isolated git worktree — each through a sequential 4-step pipeline:
+3. Runs up to `MAX_PARALLEL_STORIES` stories simultaneously — each in its own isolated git worktree — each through a sequential 5-step pipeline:
    - **Step 1** *(`MODEL_STANDARD` subagent)* — `bmad-create-story`: generates and validates the story spec
    - **Step 2** *(`MODEL_STANDARD` subagent)* — `bmad-dev-story`: implements the code
    - **Step 3** *(`MODEL_QUALITY` subagent)* — `bmad-code-review`: reviews and fixes the implementation
@@ -32,6 +32,15 @@ Once your epics and stories are planned, BAD takes over:
      ```bash
      export GITHUB_PERSONAL_ACCESS_TOKEN=$(gh auth token)
      ```
+  4. If running Claude Code with sandbox mode, allow `gh` to reach GitHub's API — add to `.claude/settings.json`:
+     ```json
+     {
+       "sandbox": {
+         ...
+         "enableWeakerNetworkIsolation": true
+       }
+     }
+     ```
 
 ## Installation
 
@@ -69,7 +78,7 @@ Run with optional overrides:
 
 ### Configuration
 
-BAD is configured at install time (`/bad setup`) and stores settings in `_bmad/bad/config.yaml`. All values can be overridden at runtime with `KEY=VALUE` args.
+BAD is configured at install time (`/bad setup`) and stores settings in the `bad:` section of `_bmad/config.yaml`. All values can be overridden at runtime with `KEY=VALUE` args.
 
 | Variable | Default | Description |
 |---|---|---|
@@ -84,6 +93,9 @@ BAD is configured at install time (`/bad setup`) and stores settings in `_bmad/b
 | `CONTEXT_COMPACTION_THRESHOLD` | `80` | Context window % at which to compact context |
 | `TIMER_SUPPORT` | `true` | Use native platform timers; `false` for prompt-based continuation |
 | `MONITOR_SUPPORT` | `true` | Use the Monitor tool for CI/PR-merge polling; `false` for Bedrock/Vertex/Foundry |
+| `API_FIVE_HOUR_THRESHOLD` | `80` | (Claude Code) 5-hour usage % at which to pause |
+| `API_SEVEN_DAY_THRESHOLD` | `95` | (Claude Code) 7-day usage % at which to pause |
+| `API_USAGE_THRESHOLD` | `80` | (Other harnesses) Generic usage % at which to pause |
 
 ## Agent Harness Support
 

docs/index.md

@@ -19,6 +19,15 @@ BAD is a [BMad Method](https://docs.bmad-method.org/) module that automates your
      ```bash
      export GITHUB_PERSONAL_ACCESS_TOKEN=$(gh auth token)
      ```
+  4. If running Claude Code with sandbox mode, allow `gh` to reach GitHub's API — add to `.claude/settings.json`:
+     ```json
+     {
+       "sandbox": {
+         ...
+         "enableWeakerNetworkIsolation": true
+       }
+     }
+     ```
 
 ## Installation
 
@@ -60,7 +69,7 @@ Once your epics and stories are planned, BAD takes over:
 
 1. *(`MODEL_STANDARD` subagent)* Builds a dependency graph from your sprint backlog — maps story dependencies, syncs GitHub PR status, and identifies what's ready to work on
 2. Picks ready stories from the graph, respecting epic ordering and dependencies
-3. Runs up to `MAX_PARALLEL_STORIES` stories simultaneously — each in its own isolated git worktree — each through a sequential 4-step pipeline. **Every step runs in a dedicated subagent with a fresh context window**, keeping the coordinator lean and each agent fully focused on its single task:
+3. Runs up to `MAX_PARALLEL_STORIES` stories simultaneously — each in its own isolated git worktree — each through a sequential 5-step pipeline. **Every step runs in a dedicated subagent with a fresh context window**, keeping the coordinator lean and each agent fully focused on its single task:
    - **Step 1** *(`MODEL_STANDARD` subagent)* — `bmad-create-story`: generates and validates the story spec
    - **Step 2** *(`MODEL_STANDARD` subagent)* — `bmad-dev-story`: implements the code
    - **Step 3** *(`MODEL_QUALITY` subagent)* — `bmad-code-review`: reviews and fixes the implementation
@@ -71,7 +80,7 @@ Once your epics and stories are planned, BAD takes over:
 
 ## Configuration
 
-BAD is configured at install time (`/bad setup`) and stores settings in `_bmad/bad/config.yaml`. All values can be overridden at runtime with `KEY=VALUE` args.
+BAD is configured at install time (`/bad setup`) and stores settings in the `bad:` section of `_bmad/config.yaml`. All values can be overridden at runtime with `KEY=VALUE` args.
 
 | Variable | Config Key | Default | Description |
 |---|---|---|---|

skills/bad/SKILL.md

@@ -137,7 +137,7 @@ After Phase 0 completes, **rebuild the task list in correct execution order**
 
 1. Mark `Phase 0: Dependency graph` → `completed`
 2. Mark `Phase 1: Story selection` → `completed` (already done)
-3. Delete all seven generic startup tasks: the five `Phase 2: Step N` tasks, `Phase 3: Auto-merge`, and `Phase 4: Batch summary & continuation`
+3. Delete all seven generic startup tasks: the five `Phase 2: Step N` tasks, `Phase 3: Auto-merge`, and `Phase 4: Batch summary + continuation`
 4. Re-add in execution order using TaskCreate:
 
 ```

skills/bad/assets/module-setup.md

@@ -2,7 +2,7 @@
 
 Standalone module self-registration for BMad Autonomous Development. This file is loaded when:
 - The user passes `setup`, `configure`, or `install` as an argument
-- The module is not yet registered in `{project-root}/_bmad/bad/config.yaml`
+- The module is not yet registered in `{project-root}/_bmad/config.yaml` (no `bad:` section)
 
 ## Overview
 

skills/bad/references/coordinator/gate-pre-continuation.md

@@ -1,6 +1,6 @@
 # Pre-Continuation Checks
 
-Run these checks **in order** every time you (the coordinator) are about to re-enter Phase 0 — whether triggered by a user reply, a timer firing, or the automatic loop.
+Run these checks **in order** at every gate point: between Phase 2 steps, after each Phase 3 merge, after the retrospective, and before re-entering Phase 0 — whether triggered by a user reply, a timer firing, or the automatic loop.
 
 **Harness note:** Checks 2 and 3 read from platform-provided session state (e.g. Claude Code's stdin JSON). On other harnesses this data may not be available — each check gracefully skips if its fields are absent.
 
@@ -85,4 +85,4 @@ If `rate_limits.seven_day.used_percentage` is present and **> `API_SEVEN_DAY_THR
 
 ---
 
-Only after all applicable checks pass, proceed to re-run Phase 0 in full.
+Only after all applicable checks pass, proceed with the next step (or re-run Phase 0, if that is what triggered this gate).