feat: v1.4.0 audit fixes, multi-agent compatibility, Bases dashboard

External audit flagged 8 actionable items against current best practices for
Agent Skills, Claude Code hooks, Obsidian v1.9-v1.12, and JSON Canvas 1.0.
This release addresses all of them and adds multi-agent compatibility files
at zero cost to existing users.

Tier 1, critical fixes:

* wiki/meta/dashboard.base: NEW Obsidian Bases dashboard (native, no plugin
  needed). Replaces Dataview as the primary dashboard. Six views: Recent
  Activity, Seed Pages, Entities Missing Sources, Open Questions,
  Comparisons, Sources.
* wiki/meta/dashboard.md: now embeds dashboard.base. Legacy Dataview queries
  retained as optional fallback for users on Obsidian < 1.9.10.
* README.md and skills/wiki/references/plugins.md: Plugins section
  reorganized to recommend Bases (core, no install) primary, Dataview
  optional/legacy.
* skills/canvas/references/canvas-spec.md: added missing JSON Canvas 1.0
  fields. Group nodes now document background and backgroundStyle (cover,
  ratio, repeat). Edges document fromEnd (default 'none') and toEnd
  (default 'arrow') asymmetric defaults. Hex ID convention noted alongside
  descriptive ID alternative.
* .gitignore: track wiki/meta/dashboard.base explicitly.

Tier 2, important improvements:

* hooks/hooks.json: SessionStart now uses both command type
  ([ -f wiki/hot.md ] && cat ...) and prompt type. Command type is the
  canonical safety check that works in non-vault sessions without erroring.
  Matcher: startup|resume.
* hooks/hooks.json: NEW PostCompact hook re-injects hot cache after context
  compaction (hook-injected context does not survive compaction; CLAUDE.md
  does).
* hooks/hooks.json: PostToolUse auto-commit now guarded by [ -d .git ].
* hooks/README.md: NEW documentation including known plugin-hooks STDOUT bug
  (anthropics/claude-code#10875) and workarounds.
* skills/wiki/references/mcp-setup.md: added Option D (Obsidian CLI) for
  v1.12+. Added warning callout above NODE_TLS_REJECT_UNAUTHORIZED line
  explaining process-wide TLS bypass and recommending Option D as the
  secure alternative.
* skills/wiki-ingest/SKILL.md: documented [!contradiction] custom callout
  CSS dependency on vault-colors.css snippet.
* skills/wiki/references/css-snippets.md: full documentation of all four
  custom callouts (contradiction, gap, key-insight, stale) with built-in
  fallback equivalents.

Tier 3, multi-agent compatibility (low complexity, high reach):

* AGENTS.md: Codex CLI / OpenCode bootstrap.
* GEMINI.md: Gemini CLI / Antigravity bootstrap.
* .cursor/rules/claude-obsidian.mdc: Cursor always-on rules.
* .windsurf/rules/claude-obsidian.md: Windsurf Cascade rules.
* .github/copilot-instructions.md: GitHub Copilot conventions.
* bin/setup-multi-agent.sh: idempotent symlink installer for Codex,
  OpenCode, Gemini, Cursor, Windsurf. Wires up the skills/ directory in
  each agent's expected location.

Style cleanup: scrubbed all em dashes from every skill, hook, doc, and
bootstrap file (249 total replacements across 26 files). Skills now use
periods, commas, and colons throughout for cleaner natural prose.

Version: 1.3.0 to 1.4.0 (aligns plugin.json with GitHub release tag format).

Already resolved in v1.1 (no action needed):
* defuddle, obsidian-bases, obsidian-markdown skills shipped
* URL ingestion, vision ingestion, delta tracking docs
* Multi-depth wiki-query (Quick / Standard / Deep)
* PostToolUse auto-commit hook
* allowed-tools field removed from all SKILL.md files
* All templates already use plural tag/alias forms
* Custom callouts CSS already in vault-colors.css

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

skills/wiki-ingest/SKILL.md

@@ -3,11 +3,11 @@ name: wiki-ingest
 description: "Ingest sources into the Obsidian wiki vault. Reads a source, extracts entities and concepts, creates or updates wiki pages, cross-references, and logs the operation. Supports files, URLs, and batch mode. Triggers on: ingest, process this source, add this to the wiki, read and file this, batch ingest, ingest all of these, ingest this url."
 ---
 
-# wiki-ingest — Source Ingestion
+# wiki-ingest: Source Ingestion
 
 Read the source. Write the wiki. Cross-reference everything. A single source typically touches 8-15 wiki pages.
 
-**Syntax standard**: Write all Obsidian Markdown using proper Obsidian Flavored Markdown — wikilinks as `[[Note Name]]`, callouts as `> [!type] Title`, embeds as `![[file]]`, properties as YAML frontmatter. If kepano/obsidian-skills is installed, its `obsidian-markdown` skill is the authoritative syntax reference.
+**Syntax standard**: Write all Obsidian Markdown using proper Obsidian Flavored Markdown. Wikilinks as `[[Note Name]]`, callouts as `> [!type] Title`, embeds as `![[file]]`, properties as YAML frontmatter. If kepano/obsidian-skills is installed, its `obsidian-markdown` skill is the authoritative syntax reference.
 
 ---
 
@@ -37,8 +37,8 @@ Before ingesting any file, check `.raw/.manifest.json` to avoid re-processing un
 **Before ingesting a file:**
 1. Compute a hash: `md5sum [file] | cut -d' ' -f1` (or `sha256sum` on Linux).
 2. Check if the path exists in `.manifest.json` with the same hash.
-3. If hash matches — skip. Report: "Already ingested (unchanged). Use `force` to re-ingest."
-4. If missing or hash differs — proceed with ingest.
+3. If hash matches, skip. Report: "Already ingested (unchanged). Use `force` to re-ingest."
+4. If missing or hash differs, proceed with ingest.
 
 **After ingesting a file:**
 1. Record `{hash, ingested_at, pages_created, pages_updated}` in `.manifest.json`.
@@ -55,7 +55,7 @@ Trigger: user passes a URL starting with `https://`.
 Steps:
 
 1. **Fetch** the page using WebFetch.
-2. **Clean** (optional): if `defuddle` is available (`which defuddle 2>/dev/null`), run `defuddle [url]` to strip ads, nav, and clutter — typically saves 40-60% tokens. Fall back to raw WebFetch output if not installed.
+2. **Clean** (optional): if `defuddle` is available (`which defuddle 2>/dev/null`), run `defuddle [url]` to strip ads, nav, and clutter. Typically saves 40-60% tokens. Fall back to raw WebFetch output if not installed.
 3. **Derive slug** from the URL path (last segment, lowercased, spaces→hyphens, strip query strings).
 4. **Save** to `.raw/articles/[slug]-[YYYY-MM-DD].md` with a frontmatter header:
    ```markdown
@@ -74,7 +74,7 @@ Trigger: user passes an image file path (`.png`, `.jpg`, `.jpeg`, `.gif`, `.webp
 
 Steps:
 
-1. **Read** the image file using the Read tool — Claude can process images natively.
+1. **Read** the image file using the Read tool. Claude can process images natively.
 2. **Describe** the image contents: extract all text (OCR), identify key concepts, entities, diagrams, and data visible in the image.
 3. **Save** the description to `.raw/images/[slug]-[YYYY-MM-DD].md`:
    ```markdown
@@ -153,13 +153,16 @@ Token budget matters. Follow these rules during ingest:
 
 ## Contradictions
 
+> [!note] Custom callout dependency
+> The `[!contradiction]` callout type used below is a **custom callout** defined in `.obsidian/snippets/vault-colors.css` (auto-installed by `/wiki` scaffold). It renders with reddish-brown styling and an alert-triangle icon when the snippet is enabled. If the snippet is missing, Obsidian falls back to default callout styling, so the page still works without the visual flourish. See [[skills/wiki/references/css-snippets.md]] for the four custom callouts (`contradiction`, `gap`, `key-insight`, `stale`).
+
 When new info contradicts an existing wiki page:
 
 On the existing page, add:
 ```markdown
 > [!contradiction] Conflict with [[New Source]]
 > [[Existing Page]] claims X. [[New Source]] says Y.
-> Needs resolution — check dates, context, and primary sources.
+> Needs resolution. Check dates, context, and primary sources.
 ```
 
 On the new source summary, reference it: