harness: fleet-wide functional-error + correction + friction logging

Add .claude/scripts/log-skill-error.sh — the canonical agent error log helper
(writes errorlog.md in DATE | MACHINE | skill | [type] error format, soft-fails).
Three categories: execution failures (default), user corrections (--correction),
and preventable self-inflicted friction (--friction; cite ref= when it repeats a
documented gotcha). Goal: stop paying tokens twice for the same avoidable mistake.

- CLAUDE.md: make logging mandatory for all skills + corrections + friction.
- skill-creator: new skills must wire in the helper (guidance + checklist).
- Retrofit every skill script's genuine failure branches to call the helper
  (b2/bitdefender/mailprotector/packetdial/coord python CLIs; remediation-tool
  + onboard365 bash; vault, rmm-auth, post-bot-alert, agy, grok, 1password,
  run-onboarding-diagnostic). Handled conditions + self-tests left alone.
- errorlog.md: broaden header to cover skills + harness + corrections; seed this
  session's corrections (INKY, Mail.Send token-audience, omnibox-strictness) and
  friction (git-bash /tmp, env-persistence, argv-limit, PowerShell var-case).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/skills/1password/scripts/env_from_op.sh

@@ -14,6 +14,10 @@
 
 set -euo pipefail
 
+# Functional-error logger (skill name "1password"); 4 levels up to the ClaudeTools repo.
+CLAUDETOOLS_ROOT="${CLAUDETOOLS_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)}"
+_logerr() { bash "$CLAUDETOOLS_ROOT/.claude/scripts/log-skill-error.sh" "1password" "$@" >/dev/null 2>&1 || true; }
+
 VAULT=""
 ITEM=""
 OUTPUT=".env"
@@ -35,6 +39,7 @@ done
 # Check op is available
 if ! command -v op &>/dev/null; then
   echo "❌ 1Password CLI (op) not found. Install: https://developer.1password.com/docs/cli/get-started/"
+  _logerr "op CLI not found on PATH"
   exit 1
 fi
 

.claude/skills/1password/scripts/store-mcp-credentials.sh

@@ -23,6 +23,10 @@
 
 set -euo pipefail
 
+# Functional-error logger (skill name "1password"); 4 levels up to the ClaudeTools repo.
+CLAUDETOOLS_ROOT="${CLAUDETOOLS_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)}"
+_logerr() { bash "$CLAUDETOOLS_ROOT/.claude/scripts/log-skill-error.sh" "1password" "$@" >/dev/null 2>&1 || true; }
+
 VAULT="Dev"
 ITEM=""
 UPDATE=false
@@ -88,14 +92,16 @@ ALL_FIELDS=("${OP_FIELDS[@]+"${OP_FIELDS[@]}"}" "${SECRET_VALUES[@]+"${SECRET_VA
 echo "Saving to 1Password..."
 
 if $UPDATE; then
-  op item edit "$ITEM" --vault "$VAULT" "${ALL_FIELDS[@]}"
+  op item edit "$ITEM" --vault "$VAULT" "${ALL_FIELDS[@]}" \
+    || { rc=$?; _logerr "op item edit failed (update MCP creds)" --context "item=$ITEM vault=$VAULT rc=$rc"; exit $rc; }
   echo ""
   echo "✅ Updated '$ITEM' in vault '$VAULT'"
 else
   # Try create, fall back to update if already exists
   if op item get "$ITEM" --vault "$VAULT" &>/dev/null 2>&1; then
     echo "  Item already exists — updating instead..."
-    op item edit "$ITEM" --vault "$VAULT" "${ALL_FIELDS[@]}"
+    op item edit "$ITEM" --vault "$VAULT" "${ALL_FIELDS[@]}" \
+      || { rc=$?; _logerr "op item edit failed (update MCP creds)" --context "item=$ITEM vault=$VAULT rc=$rc"; exit $rc; }
     echo ""
     echo "✅ Updated '$ITEM' in vault '$VAULT'"
   else
@@ -103,7 +109,8 @@ else
       --category API_CREDENTIAL \
       --title "$ITEM" \
       --vault "$VAULT" \
-      "${ALL_FIELDS[@]}"
+      "${ALL_FIELDS[@]}" \
+      || { rc=$?; _logerr "op item create failed (MCP creds)" --context "item=$ITEM vault=$VAULT rc=$rc"; exit $rc; }
     echo ""
     echo "✅ Created '$ITEM' in vault '$VAULT'"
   fi

.claude/skills/1password/scripts/store_secret.sh

@@ -9,6 +9,10 @@
 
 set -euo pipefail
 
+# Functional-error logger (skill name "1password"); 4 levels up to the ClaudeTools repo.
+CLAUDETOOLS_ROOT="${CLAUDETOOLS_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)}"
+_logerr() { bash "$CLAUDETOOLS_ROOT/.claude/scripts/log-skill-error.sh" "1password" "$@" >/dev/null 2>&1 || true; }
+
 TITLE=""
 FIELD="credential"
 VALUE=""
@@ -67,7 +71,8 @@ VAULT_FLAG=""
 
 if $UPDATE; then
   echo "Updating '${FIELD}' in '${TITLE}'..."
-  op item edit "$TITLE" $VAULT_FLAG "${FIELD}[password]=${VALUE}"
+  op item edit "$TITLE" $VAULT_FLAG "${FIELD}[password]=${VALUE}" \
+    || { rc=$?; _logerr "op item edit failed (update secret)" --context "item=$TITLE field=$FIELD vault=${VAULT:-default} rc=$rc"; exit $rc; }
   echo "✅ Updated '${FIELD}' in '${TITLE}'"
 else
   echo "Creating '${TITLE}' in 1Password..."
@@ -76,7 +81,8 @@ else
     --title "$TITLE" \
     $VAULT_FLAG \
     "${FIELD}[password]=${VALUE}" \
-    --format=json)
+    --format=json) \
+    || { rc=$?; _logerr "op item create failed" --context "item=$TITLE category=$CATEGORY vault=${VAULT:-default} rc=$rc"; exit $rc; }
 
   ITEM_ID=$(echo "$RESULT" | jq -r '.id')
   VAULT_NAME=$(echo "$RESULT" | jq -r '.vault.name')