@agentsfleet/orly 0.7.0 → 0.8.0

package/registry.json

@@ -36,6 +36,14 @@
           "source": "dispatch/write_pr_description.md",
           "target": "dispatch/write_pr_description.md"
         },
+        {
+          "source": "audits/doc-read.sh",
+          "target": "audits/doc-read.sh"
+        },
+        {
+          "source": "audits/rule-ledger-lib.sh",
+          "target": "audits/rule-ledger-lib.sh"
+        },
         {
           "source": "audits/ufs.sh",
           "target": "audits/ufs.sh"
@@ -118,6 +126,14 @@
         ".rs"
       ],
       "managed_files": [
+        {
+          "source": "dispatch/write_rust.sh",
+          "target": "dispatch/write_rust.sh"
+        },
+        {
+          "source": "audits/rust-error.sh",
+          "target": "audits/rust-error.sh"
+        },
         {
           "source": "packs/language/rust/rules.md",
           "target": "dispatch/write_rust.md"

package/skills/orly-babysit-prs/SKILL.md

@@ -1,14 +1,10 @@
 ---
 name: orly-babysit-prs
 description: |
-  Post-push follow-up for PRs/MRs: backoff-cadence polls over CI check runs
-  (fix every failure your diff caused), every greptile inline thread, and the
-  PR-level summary; classifies via gstack greptile-triage, suppresses via
-  greptile-history, stops after two consecutive empty polls with CI green.
-  Forge-aware (gh PR / glab MR). Use after `gh pr create` / `glab mr create`,
-  after every push to a branch with an open PR/MR, or on "babysit", "watch
-  greptile", "poll the PR/MR", "watch reviews", "follow up on review
-  feedback". Cross-agent: Claude, Codex, OpenCode, Amp.
+  Post-push follow-up for a Pull Request or Merge Request: poll Continuous
+  Integration (CI) checks, greptile threads, and the summary; fix what your diff
+  broke; stop after two empty polls with CI green. Forge-aware (gh, glab). Use
+  after creating or pushing to a PR/MR, or on "babysit", "watch reviews".
 ---
 
 # orly-babysit-prs

package/skills/orly-spec-new/SKILL.md

@@ -1,12 +1,10 @@
 ---
 name: orly-spec-new
 description: |
-  Author a milestone/workstream spec the executing agent (Orly) ships into a
-  deterministic, review-clean, reported Pull Request — intent capture and
-  review-readiness first, file mechanics last. Use on "create a spec", "new
-  milestone", "start M{N}_{NNN}", "spec out X", or any TODO.md attempt
-  (forbidden — every non-trivial intent becomes a spec). Cross-agent,
-  self-contained markdown.
+  Author a milestone or workstream spec that ships as a deterministic,
+  review-clean Pull Request — intent capture first, file mechanics last. Use on
+  "create a spec", "new milestone", "spec out X", "start M{N}_{NNN}", or any
+  TODO.md attempt (forbidden — every non-trivial intent becomes a spec).
 ---
 
 # orly-spec-new

package/skills/orly-write-integration-test/SKILL.md

@@ -1,12 +1,10 @@
 ---
 name: orly-write-integration-test
 description: >
-  Service-layer integration tests against real dependencies (Postgres, Redis,
-  full HTTP router + middleware) with deterministic failure injection,
-  per-test isolation, drain + leak audits, and 100-or-more-connection parallelism
-  proofs. Sister of orly-write-unit-test. Use for handlers, repos, services, or
-  any real-I/O module-boundary crossing. Not for browser E2E (gstack /qa) or
-  pure logic (orly-write-unit-test).
+  Service-layer integration tests against real dependencies — Postgres, Redis,
+  full HTTP router and middleware — with failure injection, per-test isolation,
+  and leak audits. Use for handlers, repositories, services, or any real
+  input/output module boundary; not for browser end-to-end or pure logic.
 ---
 
 # Write Integration Test

package/skills/orly-write-unit-test/SKILL.md

@@ -1,12 +1,10 @@
 ---
 name: orly-write-unit-test
 description: >
-  Risk-weighted, failure-injecting test generation across 8 stacks (Python,
-  Python SDK, OpenAPI, JS/TS CLI, React/TS, Zig, Rust, Shell) enforcing behaviour +
-  failure + invariant + integration + regression coverage with a
-  Definition-of-Done gate; deterministic production-safety proofs (Zig
-  zero-leak, 100-or-more-connection concurrency, complexity/latency budgets) live
-  in the skill body. Use during implementation, not after.
+  Risk-weighted, failure-injecting unit tests across Python, TypeScript, React,
+  Zig, Rust, and shell: behaviour, failure, invariant, and regression coverage
+  behind a Definition-of-Done gate. Production-safety proofs live in the body.
+  Use during implementation, not after.
 ---
 
 # Write Unit Test

package/src/cli.ts

@@ -293,6 +293,12 @@ function printHelp(): void {
 Gates (read-only; no PR without every criterion green or a recorded override):
   orly gate [--accept-dirty]        run work → verify → pr; stop at first red
   orly gate <work|verify|pr>        run one gate
+      work    does this commit conform? the declared conform command; no git
+              state, so a commit hook's own dirty tree never blocks it
+      verify  does the work hold up? spec dimensions, docs language, and the
+              fast verify.* set
+      pr      can this ship? branch, tree, pushed, every spec criterion, and
+              the slow verify.* suites
   orly override <CRITERION> --reason <REASON>
                                     empty commit with an Orly-Override trailer
 

package/src/criteria.test.ts

@@ -24,9 +24,12 @@ describe("criteriaFor", () => {
     return criteriaFor(gate, context).map((criterion) => criterion.name).sort();
   }
 
-  test("work evaluates the branch, the tree and the profile", async () => {
+  // work is the commit-time gate, and a commit hook's tree is dirty by
+  // construction. It asks the repository's own conform command and nothing
+  // about git state.
+  test("work evaluates the profile and the conform tier", async () => {
     const project = newSpecRepository();
-    expect(named(WORK, await contextFor(project))).toEqual(["git.branch", "git.tree", REPO_CONFIG]);
+    expect(named(WORK, await contextFor(project))).toEqual(["cmd.conform", REPO_CONFIG]);
   });
 
   test("verify pairs the spec dimensions with the fast command tier only", async () => {
@@ -34,7 +37,9 @@ describe("criteriaFor", () => {
     const names = named(VERIFY, await contextFor(project));
 
     expect(names).toContain("spec.dimensions");
-    expect(names).toContain("cmd.conform");
+    expect(names).toContain("cmd.verify.unit");
+    // conform is the work gate's tier now, so the chain runs it once.
+    expect(names).not.toContain("cmd.conform");
     // The slow tier belongs to the pr gate; leaking it here would make every
     // verify run pay for integration and memory suites.
     expect(names).not.toContain("cmd.verify.integration");
@@ -47,9 +52,15 @@ describe("criteriaFor", () => {
     for (const required of ["spec.moved", "spec.baseline", "spec.ordering", "spec.deferrals", "docs.updated"]) {
       expect(names).toContain(required);
     }
-    // git.branch is a work-gate concern: by pr time the branch is established,
-    // and re-asserting it would make an already-merged branch un-gateable.
-    expect(names).not.toContain("git.branch");
+    // git.branch belongs here and only here. It was a work-gate criterion until
+    // the generated pre-commit hook was found refusing every commit made on the
+    // default branch — including the commit that installs orly, and the
+    // spec-on-main commit the operating model itself prescribes. The question
+    // "is this the default branch" is only ever decisive where a Pull Request
+    // would open from it, so it is asked there. Running `orly gate pr` on a
+    // merged branch reds, which is the honest answer: no PR opens from main.
+    expect(names).toContain("git.branch");
+    expect(names).toContain("git.tree");
   });
 
   test("an unknown gate name yields no criteria rather than throwing", async () => {

package/src/criteria.ts

@@ -36,6 +36,12 @@ const DOCS_LANGUAGE = "docs.language";
 // line is a summary, not a linter dump.
 const NAMED_FINDINGS = 3;
 
+// CONFORM is its own lifecycle stage — EXECUTE → CONFORM → VERIFY — and it is
+// its own tier here for the same reason. Lumped into verify, the deterministic
+// rule audit could only run beside the lint and unit suites, so a repository
+// paid minutes to learn something its seconds-long conform command already
+// knew, and `orly gate` ran it twice on the way to `pr`.
+const CONFORM_TIER = "conform";
 const FAST_TIER = "fast";
 const SLOW_TIER = "slow";
 // The slow tier is a fixed name set, not a prefix rule: lint and version
@@ -45,14 +51,31 @@ const SLOW_COMMANDS = ["verify.integration", "verify.memory"];
 // Every criterion is mechanical: it reads an exit code or a file, never a
 // judgment. The anchor invariant promises the machine can PROVE the PR
 // boundary, so anything unprovable stays prose and never lands here.
-// work = is this branch workable · verify = does the work hold up ·
-// pr = can this ship (whole-branch checks + the slow suites).
+//
+// One gate per cadence, and each question asked at the only moment it can be
+// answered honestly:
+//
+//   work   — does this commit conform? Config plus the declared `conform`
+//            command. Nothing about branch or tree: inside a commit hook the
+//            tree is dirty BY CONSTRUCTION (that is what is being committed),
+//            and the operating model itself says a new spec is committed on the
+//            default branch. Judging either here made the generated pre-commit
+//            hook refuse every commit — including the one installing orly —
+//            with `--no-verify`, which Hard Safety forbids, as the only way out.
+//   verify — does the work hold up? Spec dimensions, documentation language,
+//            and the fast `verify.*` set. Runs before the work leaves the
+//            machine, not after every edit.
+//   pr     — can this ship? The whole-branch facts (branch shape, clean tree,
+//            pushed) plus every spec criterion and the slow suites. A tree is
+//            only required clean where a reviewer is about to read it, and a
+//            branch is only wrong for being `main` where a PR would open from
+//            it.
 export function criteriaFor(gate: string, context: CriterionContext): Criterion[] {
-  if (gate === "work") return [gitBranch(), gitTree(), repositoryConfig()];
+  if (gate === "work") return [repositoryConfig(), ...commandCriteria(context, CONFORM_TIER)];
   if (gate === "verify") return [specDimensions(), docsLanguage(), ...commandCriteria(context, FAST_TIER)];
   if (gate === "pr") {
     return [
-      gitTree(), gitPushed(), specGate(), openQuestions(), productClarity(), specDimensions(),
+      gitBranch(), gitTree(), gitPushed(), specGate(), openQuestions(), productClarity(), specDimensions(),
       specMoved(), specBaseline(), specOrdering(), specDeferrals(),
       docsUpdated(), ...commandCriteria(context, SLOW_TIER),
     ];
@@ -107,10 +130,11 @@ function repositoryConfig(): Criterion {
 }
 
 // Model C: the repository's declared command surface. Orly owns policy and
-// invokes these; the repository owns what they actually do. Fast tier =
-// conform + verify.unit. Slow tier = every other verify.* (integration,
-// memleak); those auto-pass with a printed skip when the branch carries no
-// code, so a prose-only branch never pays for the slow suites.
+// invokes these; the repository owns what they actually do. Conform tier = the
+// `conform` command alone. Fast tier = every verify.* that is not slow. Slow
+// tier = verify.integration and verify.memory; those auto-pass with a printed
+// skip when the branch carries no code, so a prose-only branch never pays for
+// the slow suites.
 function commandCriteria(context: CriterionContext, tier: string): Criterion[] {
   const config = resolvedConfig(context);
   if (!config) return tier === FAST_TIER ? [criterion(REPO_CONFIG, () => ({ ok: false, detail: UNINSTALLED }))] : [];
@@ -125,8 +149,9 @@ function commandCriteria(context: CriterionContext, tier: string): Criterion[] {
 }
 
 function tierOf(key: string): string {
+  if (key === CONFORM_COMMAND) return CONFORM_TIER;
   if (SLOW_COMMANDS.includes(key)) return SLOW_TIER;
-  if (key === CONFORM_COMMAND || key.startsWith(VERIFY_PREFIX)) return FAST_TIER;
+  if (key.startsWith(VERIFY_PREFIX)) return FAST_TIER;
   return "";
 }
 

package/src/gates.test.ts

@@ -16,27 +16,51 @@ afterEach(cleanupTemporaryDirectories);
 describe("gate groups", () => {
   test("run in order and stop at the first red group", async () => {
     const project = newSpecRepository();
-    const model = await modelFor(project);
-    // Default branch: the work gate is red, so verify and pr never run.
+    // A failing conform reds the work gate, so verify and pr never run.
+    const model = await modelFor(project, undefined, { conform: [["false"]] });
     const reports = runGates(model, project);
 
     expect(reports.map((report) => report.gate)).toEqual(["work"]);
     expect(reports[0]?.ok).toBeFalse();
-    expect(reports[0]?.results.find((result) => result.name === "git.branch")?.ok).toBeFalse();
+    expect(reports[0]?.results.find((result) => result.name === "cmd.conform")?.ok).toBeFalse();
   });
 
+  // One gate per cadence: work asks whether the commit conforms, verify whether
+  // the work holds up, pr whether it can ship. Branch shape and a clean tree are
+  // pr's questions alone — asked at commit time they refuse the commit being
+  // made, and asked at push time they refuse a scratch file that is not being
+  // pushed.
   test("each gate evaluates exactly its declared criteria", async () => {
     const project = newSpecRepository();
     const model = await modelFor(project);
 
-    expect(names(runGate(model, project, "work"))).toEqual(["git.branch", "git.tree", "repo.config"]);
-    expect(names(runGate(model, project, "verify"))).toEqual(["cmd.conform", "cmd.verify.unit", "docs.language", "spec.dimensions"]);
+    expect(names(runGate(model, project, "work"))).toEqual(["cmd.conform", "repo.config"]);
+    expect(names(runGate(model, project, "verify"))).toEqual(["cmd.verify.unit", "docs.language", "spec.dimensions"]);
     expect(names(runGate(model, project, "pr"))).toEqual([
-      "docs.updated", "git.pushed", "git.tree", "spec.baseline", "spec.deferrals", "spec.dimensions", "spec.gate",
-      "spec.moved", "spec.open-questions", "spec.ordering", "spec.product-clarity",
+      "docs.updated", "git.branch", "git.pushed", "git.tree", "spec.baseline", "spec.deferrals", "spec.dimensions",
+      "spec.gate", "spec.moved", "spec.open-questions", "spec.ordering", "spec.product-clarity",
     ]);
   });
 
+  // The bug this composition exists to kill: the hook orly generates runs
+  // `orly gate work`, and a commit hook's tree is dirty by construction — that
+  // is what is being committed. On the default branch, which the operating
+  // model itself says a new spec is committed on, it failed twice over. A fresh
+  // install could not commit itself without `--no-verify`, which Hard Safety
+  // forbids outright.
+  test("the work gate passes on the default branch with a staged edit", async () => {
+    const project = newSpecRepository();
+    const model = await modelFor(project);
+    await Bun.write(join(project, "src/staged.txt"), "an edit on its way into a commit\n");
+    git(project, "add", "src/staged.txt");
+
+    const report = runGate(model, project, "work");
+
+    expect(report.ok).toBeTrue();
+    expect(names(report)).not.toContain("git.tree");
+    expect(names(report)).not.toContain("git.branch");
+  });
+
   test("gates never write: the tree is byte-identical after a run", async () => {
     const project = newSpecRepository();
     const model = await modelFor(project);
@@ -68,8 +92,8 @@ describe("repository resolution", () => {
     git(project, "worktree", "add", "-q", "-b", "feat/stream", worktree);
     await Bun.write(join(worktree, "stream-only.txt"), "present only in the worktree\n");
 
-    expect(runGate(model, worktree, "verify").results.find((result) => result.name === "cmd.conform")?.ok).toBeTrue();
-    expect(runGate(model, project, "verify").results.find((result) => result.name === "cmd.conform")?.ok).toBeFalse();
+    expect(runGate(model, worktree, "work").results.find((result) => result.name === "cmd.conform")?.ok).toBeTrue();
+    expect(runGate(model, project, "work").results.find((result) => result.name === "cmd.conform")?.ok).toBeFalse();
   });
 
   test("a repository with no orly config is red, and names the install command", async () => {

package/src/gates_spec.test.ts

@@ -18,7 +18,7 @@ describe("spec discovery", () => {
 
     const verify = runGate(model, project, "verify");
     expect(verify.results.find((result) => result.name === "spec.dimensions")?.detail).toContain("no active spec");
-    expect(verify.results.find((result) => result.name === "cmd.conform")?.ok).toBeTrue();
+    expect(runGate(model, project, "work").results.find((result) => result.name === "cmd.conform")?.ok).toBeTrue();
   });
 
   test("cache-kit style docs/v0.9.2/ layout is discovered", () => {

package/src/install.ts

@@ -407,7 +407,12 @@ function resolved(path: string): string {
 // Managed markdown is pack-filtered on the way in, exactly as a rendered core
 // document is. Copying it raw is how a Rust crate ends up holding a rule that
 // points at a Zig façade it will never receive.
-async function managedContent(path: string, target: string, source: string, packs: string[], known: Set<string>, orlyFile: string): Promise<Uint8Array> {
+//
+// Exported because it is the definition of what bytes belong at a managed
+// target, and `orly verify` asks exactly that question of the checkout that
+// authors the sources — where no install ever writes, so nothing else would
+// catch a hand-edited copy drifting from the source every consumer receives.
+export async function managedContent(path: string, target: string, source: string, packs: string[], known: Set<string>, orlyFile: string): Promise<Uint8Array> {
   const bytes = await Bun.file(path).bytes();
   if (extname(target) !== MARKDOWN_EXTENSION) return bytes;
   const filtered = renderProfileText(new TextDecoder().decode(bytes), new Set(packs), known, source);

package/src/install_packs.test.ts

@@ -7,6 +7,9 @@ import { install } from "./install";
 import { RulesModel } from "./model";
 
 const SOURCE_EXTENSIONS = ["rs", "ts", "tsx", "js", "jsx", "py", "sh", "sql", "zig", "mdx"];
+const DESCRIPTION_BUDGET = 320;
+const RECORDER = "audits/doc-read.sh";
+const RECORDER_LIBRARY = "audits/rule-ledger-lib.sh";
 // Read from package.json rather than restated here: a hand-synced copy goes
 // stale at the next release and the test then proves an install at a version
 // that no longer ships.
@@ -36,3 +39,56 @@ describe("opt-in pack selection", () => {
     expect(existsSync(join(repo, "dispatch/edit_rules.md"))).toBe(false);
   });
 });
+
+// Every host renders skill metadata into a fixed context budget and truncates
+// the set when it overflows — Codex says so out loud ("descriptions were
+// shortened to fit the skills context budget"). A truncated description is a
+// skill the model can no longer route to correctly, and the failure is silent
+// at the point it matters. The bound is checked here so a growing description
+// fails a test rather than degrading discovery in the field.
+describe("packaged skill metadata", () => {
+  test("every description stays inside the host budget", async () => {
+    const skills = new Set<string>();
+    for (const entry of (await Bun.file(join(ROOT, "registry.json")).json()).packs["workflow.skills"].managed_files) skills.add(entry.source);
+    expect(skills.size).toBeGreaterThan(0);
+
+    for (const relative of [...skills].sort()) {
+      const frontmatter = (await Bun.file(join(ROOT, relative)).text()).split("---")[1] ?? "";
+      const description = (frontmatter.split(/^description:/m)[1] ?? "").split(/^[a-z_]+:/m)[0] ?? "";
+      const rendered = description.replace(/^[>|]/, "").replace(/\s+/g, " ").trim();
+
+      expect(rendered.length).toBeGreaterThan(0);
+      expect({ skill: relative, length: rendered.length }).toEqual({ skill: relative, length: Math.min(rendered.length, DESCRIPTION_BUDGET) });
+    }
+  });
+});
+
+// The operating model tells every agent to record a triggered read with
+// `bash audits/doc-read.sh log <path>`, and pre-commit compares that record to
+// the staged diff. The rule shipped through universal.authoring; the script did
+// not, so in a consumer the command the rule names was simply absent — the
+// runtime's read hook called nothing and the check had nothing to compare. A
+// rule that names a command ships that command.
+describe("the DOC READ recorder", () => {
+  test("installs with the authoring pack and runs where it lands", async () => {
+    const model = await RulesModel.load(ROOT);
+    const repo = newRepository();
+    await Bun.write(join(repo, ".oracle/orly.json"), JSON.stringify({ schema_version: 1, orly_version: "", packs: [], commands: {}, managed: [] }));
+
+    const result = await install(model, { targetRoot: repo, force: false, installHooks: true, orlyVersion: ENGINE_VERSION });
+
+    expect(result.errors).toEqual([]);
+    expect(result.packs).toContain("universal.authoring");
+    expect(existsSync(join(repo, RECORDER))).toBe(true);
+    expect(existsSync(join(repo, RECORDER_LIBRARY))).toBe(true);
+
+    // Sourcing its library and resolving façade scope are the two ways this
+    // pair can be shipped incomplete, and both fail at run time rather than at
+    // copy time — so the proof is a real run in the repository it landed in.
+    const logged = Bun.spawnSync(["bash", RECORDER, "log", "README.md"], { cwd: repo, stdout: "pipe", stderr: "pipe" });
+    expect(logged.exitCode).toBe(0);
+    const checked = Bun.spawnSync(["bash", RECORDER, "check"], { cwd: repo, stdout: "pipe", stderr: "pipe" });
+    expect(checked.exitCode).toBe(0);
+    expect(checked.stdout.toString()).toContain("DOC READ");
+  });
+});

package/src/render.test.ts

@@ -15,7 +15,7 @@ const KERNEL_PACKS = ["universal.authoring", "language.zig", "language.rust", "d
 // This repository's own selection, as `.oracle/orly.json` declares it — the
 // root render must stay current against exactly what `orly update` writes.
 const DOTFILES_PACKS = ["universal.authoring", "language.zig", "language.typescript", "language.javascript", "language.rust", "language.go", "language.python", "language.shell", "language.mdx", "domain.sql", "domain.http", "domain.auth", "domain.documentation", "domain.changelog", "workflow.specifications", "workflow.governance", "product.agentsfleet", "persona.indy", "workflow.skills"];
-const DOTFILES_COMMANDS = { conform: [["make", "audit"]], "verify.unit": [["bun", "test", "src"]] };
+const DOTFILES_COMMANDS = { conform: [["make", "conform"]], "verify.unit": [["bun", "test", "src"]] };
 
 describe("Renderer", () => {
   test("renders byte-stable text for a pack set", async () => {
@@ -58,3 +58,61 @@ describe("Renderer", () => {
     expect(new Renderer(model).renderText(KERNEL_PACKS)).rejects.toThrow("unclosed orly pack block");
   });
 });
+
+// Claims the rendered rules make about the machine. Each one was false when
+// this suite was written: the prose said "always" where the gate runs once,
+// named a chain where one gate is the boundary, made a conditional skill
+// mandatory, and credited a reporting-only criterion with enforcement. Prose
+// drifting back is exactly as expensive as the first time, and none of it is
+// visible to a render-determinism check.
+describe("the rendered rules match the machine", () => {
+  test("VERIFY states two cadences rather than one 'always'", async () => {
+    const text = await new Renderer(await RulesModel.load(ROOT)).renderText(DOTFILES_PACKS, DOTFILES_COMMANDS);
+
+    expect(text).toContain("Two cadences, one boundary");
+    expect(text).toContain("runs ONCE, at the milestone boundary");
+  });
+
+  test("CHORE(close) names the pr gate, not the whole chain", async () => {
+    const text = await new Renderer(await RulesModel.load(ROOT)).renderText(DOTFILES_PACKS, DOTFILES_COMMANDS);
+
+    expect(text).toContain("`orly gate pr` is the command CHORE(close) runs");
+    // Sound without re-running the fast tier, and the reason is stated where
+    // the claim is: git.pushed pins HEAD to what pre-push already graded.
+    expect(text).toContain("`git.pushed` proves HEAD is exactly what the pre-push");
+    expect(text).toContain("One gate per cadence, each tier run once");
+  });
+
+  test("the integration skill is conditional on a real input/output boundary", async () => {
+    const text = await new Renderer(await RulesModel.load(ROOT)).renderText(DOTFILES_PACKS, DOTFILES_COMMANDS);
+
+    expect(text).toContain("when the diff crosses a module boundary with real input/output");
+    expect(text).not.toContain("both before the PR, never skipped");
+  });
+
+  // persona.indy is opt-in, and five engineering clauses were hiding inside it:
+  // a repository dropping the voice silently dropped symlink-edit routing,
+  // dotfiles backup, vault naming, sibling-repo precedent, and the
+  // read-the-reference mandate with it. A pack named for voice must cost only
+  // voice when it is left out.
+  test("the engineering clauses survive without the persona pack", async () => {
+    const renderer = new Renderer(await RulesModel.load(ROOT));
+    const withoutPersona = await renderer.renderText(DOTFILES_PACKS.filter((pack) => pack !== "persona.indy"), DOTFILES_COMMANDS);
+
+    expect(withoutPersona).toContain("Symlinked edits land in the repository that owns the file");
+    expect(withoutPersona).toContain("timestamped backup");
+    expect(withoutPersona).toContain("Vault names come from the environment");
+    expect(withoutPersona).toContain("Check a sibling repository");
+    expect(withoutPersona).toContain("Read the reference implementation before designing");
+    // What persona is actually for stays behind with it.
+    expect(withoutPersona).not.toContain("Indy's reference checkouts");
+    expect(withoutPersona).not.toContain("🤠 Indy");
+  });
+
+  test("SOUL does not claim the language criterion enforces anything", async () => {
+    const soul = await Bun.file(resolve(ROOT, "SOUL.md")).text();
+
+    expect(soul).toContain("REPORTS it");
+    expect(soul).not.toContain("`orly gate verify` enforces it");
+  });
+});

package/src/verify.test.ts

@@ -1,13 +1,83 @@
 import { expect, test } from "bun:test";
-import { resolve } from "node:path";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
 
 import { RulesModel } from "./model";
-import { verifyRenders } from "./verify";
+import { packSourceErrors, verifyRenders } from "./verify";
 
 const ROOT = resolve(import.meta.dir, "..");
+const PACK = "language.demo";
+const SOURCE = "packs/demo/rules.md";
+const TARGET = "dispatch/write_demo.md";
+const BODY = "# Demo\n\nOne rule, stated once.\n";
+
+// A checkout carrying one pack whose source and target are different paths —
+// the shape `planFiles` never writes into, and therefore the only shape that
+// can drift.
+function sandbox(target?: string): { model: RulesModel; root: string } {
+  const root = mkdtempSync(join(tmpdir(), "orly-packs-"));
+  mkdirSync(join(root, "packs/demo"), { recursive: true });
+  writeFileSync(join(root, SOURCE), BODY);
+  if (target !== undefined) {
+    mkdirSync(join(root, "dispatch"), { recursive: true });
+    writeFileSync(join(root, TARGET), target);
+  }
+  const registry = { packs: { [PACK]: { extensions: [], managed_files: [{ source: SOURCE, target: TARGET }] } } };
+  return { model: new RulesModel(root, registry), root };
+}
 
 test("every profile renders deterministically", async () => {
   const checks = await verifyRenders(await RulesModel.load(ROOT));
 
   expect(checks.filter((check) => check.name.endsWith(".idempotent")).every((check) => check.result === "pass")).toBeTrue();
 });
+
+test("pack targets match their sources", async () => {
+  const model = await RulesModel.load(ROOT);
+  const local = Object.keys(model.registry.packs as Record<string, unknown>).sort();
+
+  expect(await packSourceErrors(model, local)).toEqual([]);
+});
+
+test("pack target drift names the pack and both paths", async () => {
+  const { model, root } = sandbox(`${BODY}and a second rule the source never gained.\n`);
+  try {
+    const findings = await packSourceErrors(model, [PACK]);
+
+    expect(findings).toHaveLength(1);
+    expect(findings[0]).toContain(TARGET);
+    expect(findings[0]).toContain(SOURCE);
+    expect(findings[0]).toContain(PACK);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("a pack target the checkout does not carry is not drift", async () => {
+  const { model, root } = sandbox();
+  try {
+    expect(await packSourceErrors(model, [PACK])).toEqual([]);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+// The trailing newline managedContent appends is part of what a consumer
+// receives, so a target missing it is drift like any other byte.
+test("a matched pack target reports clean", async () => {
+  const { model, root } = sandbox(BODY);
+  try {
+    expect(await packSourceErrors(model, [PACK])).toEqual([]);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("verify reports pack source parity beside the render proofs", async () => {
+  const checks = await verifyRenders(await RulesModel.load(ROOT));
+  const parity = checks.find((check) => check.name === "packs.sources.current");
+
+  expect(parity).toBeDefined();
+  expect(parity?.result).toBe("pass");
+});

package/src/verify.ts

@@ -1,12 +1,16 @@
-import { mkdirSync } from "node:fs";
+import { existsSync, mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 import { localSelection } from "./config";
-import { objectValue, RulesModel } from "./model";
+import { managedContent } from "./install";
+import { hashContent, isString, objectArray, objectValue, RulesModel } from "./model";
 import { Renderer } from "./render";
 
 const PASS_RESULT = "pass";
 const FAIL_RESULT = "fail";
+const REGISTRY_PACKS_LABEL = "registry packs";
+const AGENTS_FILENAME = "AGENTS.md";
+const DETAIL_SEPARATOR = "; ";
 
 export type VerificationCheck = {
   name: string;
@@ -32,10 +36,47 @@ export async function verifyRenders(model: RulesModel): Promise<VerificationChec
     });
   }
   const errors = await renderer.rootErrors(local.packs, local.commands);
-  checks.push({ name: "generated.root.current", result: errors.length === 0 ? PASS_RESULT : FAIL_RESULT, detail: errors.join("; ") });
+  checks.push({ name: "generated.root.current", result: errors.length === 0 ? PASS_RESULT : FAIL_RESULT, detail: errors.join(DETAIL_SEPARATOR) });
+  const drift = await packSourceErrors(model, local.packs);
+  checks.push({ name: "packs.sources.current", result: drift.length === 0 ? PASS_RESULT : FAIL_RESULT, detail: drift.join(DETAIL_SEPARATOR) });
   return checks;
 }
 
+// Every pack file this checkout carries, against the bytes its pack would ship.
+//
+// `planFiles` deliberately skips writing a managed file into the checkout that
+// owns its source: writing there would either replace a source with its own
+// pack-filtered rendering or plant a second copy that drifts. The consequence is
+// that the copy living here is maintained BY HAND and no install ever corrects
+// it — so a source can gain three sections while the target beside it keeps the
+// old two, and every consumer receives rules this repository's own agents, its
+// dispatch-coverage audit, and its rule ledger never see. Both halves of that
+// had already happened when this check was written.
+//
+// A target the checkout does not carry is silence, not drift: a consumer-only
+// path (a skill copied into `.claude/skills/`) is absent here by design.
+export async function packSourceErrors(model: RulesModel, packs: string[]): Promise<string[]> {
+  const registryPacks = objectValue(model.registry.packs, REGISTRY_PACKS_LABEL);
+  const known = new Set(Object.keys(registryPacks));
+  const findings = new Set<string>();
+  for (const name of packs) {
+    const pack = objectValue(registryPacks[name], `pack ${name}`);
+    for (const entry of objectArray(pack.managed_files, `pack ${name} managed_files`)) {
+      if (!isString(entry.source) || !isString(entry.target)) continue;
+      // Same path on both sides is the source itself — nothing to compare it to.
+      if (entry.source === entry.target) continue;
+      const targetPath = join(model.root, entry.target);
+      if (!existsSync(targetPath)) continue;
+      // The engine checkout renders its own rules under their own name, so the
+      // citation retarget managedContent applies for a guest is identity here.
+      const expected = await managedContent(join(model.root, entry.source), entry.target, entry.source, packs, known, AGENTS_FILENAME);
+      if (hashContent(expected) === hashContent(await Bun.file(targetPath).bytes())) continue;
+      findings.add(`${entry.target} drifted from ${entry.source} (pack ${name}) — copy the source over it`);
+    }
+  }
+  return [...findings].sort();
+}
+
 export async function writeEvidence(
   model: RulesModel,
   profile: string,