@aihq/harness 0.2.0-rc.0 → 0.3.0

package/dist/{chunk-S7XFTZJW.js → chunk-7GVBGS5N.js}

@@ -83,15 +83,33 @@ function retryTransient(op) {
 }
 var FsTransaction = class {
   staged = [];
+  stagedRemovals = [];
   stage(path, contents, mode) {
     this.staged.push({ path, contents, mode });
   }
+  /**
+   * Stage a file REMOVAL as a reversible move to `legacyPath` (under gitignored
+   * `.aih/legacy/`). The move IS the backup: rollback (and the user) restore by
+   * moving it back. Symlinks are refused at commit (moving a link then restoring it
+   * would recreate a regular file). No-op if the source is already gone.
+   */
+  stageRemoval(path, legacyPath) {
+    this.stagedRemovals.push({ path, legacyPath });
+  }
   preview() {
     return [...this.staged];
   }
   commit() {
     const applied = [];
+    const removed = [];
     const staged = dedupeByPath(this.staged);
+    const removals = dedupeRemovals(this.stagedRemovals);
+    const writePaths = new Set(staged.map((w) => w.path));
+    for (const r of removals) {
+      if (writePaths.has(r.path)) {
+        throw new FsTxnError(`transaction both writes and removes the same path: ${r.path}`);
+      }
+    }
     try {
       for (const w of staged) {
         mkdirSync(dirname(w.path), { recursive: true });
@@ -114,16 +132,59 @@ var FsTransaction = class {
         retryTransient(() => renameSync(tmpPath, w.path));
         applied.push({ path: w.path, backup, created: !existed });
       }
+      for (const r of removals) {
+        const info = lstatSafe(r.path);
+        if (info === void 0) continue;
+        if (info.isSymbolicLink()) {
+          throw new Error(`refusing to remove a symlink: ${r.path}`);
+        }
+        mkdirSync(dirname(r.legacyPath), { recursive: true });
+        const dest = freeLegacyDest(r.legacyPath);
+        retryTransient(() => renameSync(r.path, dest));
+        removed.push({ path: r.path, legacyPath: dest });
+      }
       return {
         written: applied.map((a) => a.path),
-        backups: applied.flatMap((a) => a.backup ? [a.backup] : [])
+        backups: applied.flatMap((a) => a.backup ? [a.backup] : []),
+        removed
       };
     } catch (err) {
+      rollbackRemovals(removed);
       rollback(applied);
       throw new FsTxnError(`transaction failed and was rolled back: ${err.message}`);
     }
   }
 };
+function dedupeRemovals(staged) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const r of staged) byPath.set(r.path, r);
+  return [...byPath.values()];
+}
+function freeLegacyDest(base) {
+  const check2 = (p) => {
+    const st = lstatSafe(p);
+    if (st === void 0) return "free";
+    if (st.isSymbolicLink()) throw new Error(`refusing to move onto a symlinked legacy path: ${p}`);
+    return "file";
+  };
+  if (check2(base) === "free") return base;
+  for (let n = 1; n < 1e5; n++) {
+    const cand = `${base}.${n}`;
+    if (check2(cand) === "free") return cand;
+  }
+  throw new Error(`too many prior rescues at ${base}`);
+}
+function rollbackRemovals(removed) {
+  for (const r of [...removed].reverse()) {
+    try {
+      if (existsSync(r.legacyPath) && !existsSync(r.path)) {
+        mkdirSync(dirname(r.path), { recursive: true });
+        renameSync(r.legacyPath, r.path);
+      }
+    } catch {
+    }
+  }
+}
 function dedupeByPath(staged) {
   const byPath = /* @__PURE__ */ new Map();
   for (const w of staged) byPath.set(w.path, w);
@@ -242,6 +303,9 @@ function exec(describe, argv, opts = {}) {
 function envBlock(path, scope, shell, vars, describe) {
   return { kind: "envblock", path, scope, shell, vars, describe };
 }
+function remove(path, describe) {
+  return { kind: "remove", path, describe };
+}
 function plan(capability, ...actions) {
   return { capability, actions };
 }
@@ -427,7 +491,7 @@ var VerificationReport = class {
 };
 
 // src/internals/execute.ts
-import { existsSync as existsSync2, realpathSync } from "fs";
+import { existsSync as existsSync2, lstatSync as lstatSync2, realpathSync } from "fs";
 import { dirname as dirname2, isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2 } from "path";
 
 // src/guardrails/gitleaks.ts
@@ -537,11 +601,30 @@ async function dirtyWriteTargets(plan2, ctx) {
   const dirty = await dirtyPaths(ctx);
   return targets.filter((t) => dirty.has(t));
 }
+async function dirtyRemoveTargets(plan2, ctx) {
+  const targets = [];
+  for (const a of plan2.actions) {
+    if (a.kind !== "remove") continue;
+    const rel = relative(ctx.root, resolve(ctx.root, a.path));
+    if (rel.length > 0 && !rel.startsWith("..") && !isAbsolute(rel))
+      targets.push(normalizeRel(rel));
+  }
+  if (targets.length === 0) return [];
+  const dirty = await dirtyPaths(ctx);
+  return targets.filter((t) => dirty.has(t));
+}
 
 // src/internals/execute.ts
 function resolvePath(ctx, p) {
   return resolve2(ctx.root, p);
 }
+function lstatKind(p) {
+  try {
+    return { isSymlink: lstatSync2(p).isSymbolicLink() };
+  } catch {
+    return void 0;
+  }
+}
 function realpathSafe(p) {
   try {
     return realpathSync(p);
@@ -605,10 +688,12 @@ async function executePlan(plan2, ctx, opts = {}) {
   if (ctx.apply && opts.skipWorktreeGate !== true && ctx.options.force !== true) {
     const dirtyTargets = new Set(await dirtyWriteTargets(plan2, ctx));
     const clobbered = dirtyTargets.size === 0 ? [] : changedDirtyTargets(plan2, ctx, dirtyTargets);
-    if (clobbered.length > 0) {
-      const list = clobbered.join(", ");
+    const removedDirty = await dirtyRemoveTargets(plan2, ctx);
+    const blocked = [...clobbered, ...removedDirty];
+    if (blocked.length > 0) {
+      const list = blocked.join(", ");
       throw new DirtyWorktreeError(
-        `Refusing to overwrite uncommitted changes in: ${list}. Commit or stash ${clobbered.length > 1 ? "them" : "it"} first, or pass --force.`
+        `Refusing to overwrite uncommitted changes in: ${list}. Commit or stash ${blocked.length > 1 ? "them" : "it"} first, or pass --force.`
       );
     }
   }
@@ -617,6 +702,7 @@ async function executePlan(plan2, ctx, opts = {}) {
   const docs = [];
   const probes = [];
   const digests = [];
+  const removes = [];
   const digestActions = [];
   const execActions = [];
   const envBlockActions = [];
@@ -659,6 +745,29 @@ async function executePlan(plan2, ctx, opts = {}) {
       envBlockActions.push(action);
     } else if (action.kind === "digest") {
       digestActions.push(action);
+    } else if (action.kind === "remove") {
+      const absPath = resolvePath(ctx, action.path);
+      assertContained(ctx.root, absPath);
+      const info = lstatKind(absPath);
+      if (info?.isSymlink) {
+        throw new PathContainmentError(
+          `refusing to remove a symlink: ${action.path} (aih only removes files it wrote)`
+        );
+      }
+      if (info === void 0) {
+        removes.push({ path: action.path, describe: action.describe, effect: "absent" });
+      } else {
+        const legacyRel = `.aih/legacy/${normalizeRel(action.path)}`;
+        const legacyAbs = resolvePath(ctx, legacyRel);
+        assertContained(ctx.root, legacyAbs);
+        if (ctx.apply) txn.stageRemoval(absPath, legacyAbs);
+        removes.push({
+          path: action.path,
+          describe: action.describe,
+          effect: "remove",
+          to: legacyRel
+        });
+      }
     } else {
       probes.push({ describe: action.describe });
     }
@@ -748,15 +857,23 @@ async function executePlan(plan2, ctx, opts = {}) {
     execs,
     digests,
     backups,
+    removed: removes,
     report
   };
 }
 function summarizeResult(result) {
-  const head = result.applied ? `Applied ${result.capability}` : `Plan for ${result.capability} (dry-run \u2014 nothing written; pass --apply to execute)`;
+  const removedAny = result.removed.some((r) => r.effect === "remove");
+  const mutated = result.writes.length > 0 || result.execs.some((e) => e.ran) || result.backups.length > 0 || removedAny;
+  const head = result.applied ? mutated ? `Applied ${result.capability}` : `${result.capability}: nothing to apply \u2014 the plan produced no writes or execs` : `Plan for ${result.capability} (dry-run \u2014 nothing written; pass --apply to execute)`;
   const out = [head];
   for (const w of result.writes) {
     out.push(`  [${w.effect}] ${w.path} \u2014 ${w.describe}`);
   }
+  for (const r of result.removed) {
+    out.push(
+      r.effect === "remove" ? `  [remove] ${r.path} \u2014 ${r.describe} (\u2192 ${r.to})` : `  [absent] ${r.path} \u2014 ${r.describe}`
+    );
+  }
   for (const d of result.docs) {
     out.push(`  [doc]${d.path ? ` ${d.path}` : ""} \u2014 ${d.describe}`);
   }
@@ -2387,6 +2504,17 @@ ${rendered}
   if (!next.endsWith("\n")) next += "\n";
   return usesCrlf ? next.replace(/\n/g, "\r\n") : next;
 }
+function stripManagedBlock(existing, marker) {
+  const normalized = existing.replace(/\r\n/g, "\n");
+  const pattern = new RegExp(
+    `\\n*<!-- BEGIN ${escapeRegExp2(marker)}[\\s\\S]*?${escapeRegExp2(endLine(marker))}\\n*`
+  );
+  if (!pattern.test(normalized)) return existing;
+  const stripped = normalized.replace(pattern, "\n\n").replace(/^\n+/, "").replace(/\n+$/, "");
+  const next = stripped.length > 0 ? `${stripped}
+` : "";
+  return /\r\n/.test(existing) ? next.replace(/\n/g, "\r\n") : next;
+}
 function extractManagedBlock(text, marker) {
   const normalized = text.replace(/\r\n/g, "\n");
   const pattern = new RegExp(
@@ -5263,7 +5391,7 @@ var command5 = {
 };
 
 // src/vdi/index.ts
-import { lstatSync as lstatSync2, readlinkSync } from "fs";
+import { lstatSync as lstatSync3, readlinkSync } from "fs";
 import { join as join17, resolve as resolve4 } from "path";
 
 // src/internals/shell-safety.ts
@@ -5314,7 +5442,7 @@ function samePath(a, b) {
 function linkState(linkPath, target) {
   let st;
   try {
-    st = lstatSync2(linkPath);
+    st = lstatSync3(linkPath);
   } catch {
     return "absent";
   }
@@ -6968,8 +7096,8 @@ var command10 = {
 };
 
 // src/doctor.ts
-import { existsSync as existsSync17 } from "fs";
-import { join as join32 } from "path";
+import { existsSync as existsSync18 } from "fs";
+import { join as join33 } from "path";
 
 // src/org-policy/drift.ts
 import { resolve as resolve7 } from "path";
@@ -6979,8 +7107,8 @@ import { join as join24 } from "path";
 function stdioCommand(server) {
   return [server.command, ...server.args];
 }
-function commandKey(command28) {
-  return JSON.stringify([...command28]);
+function commandKey(command30) {
+  return JSON.stringify([...command30]);
 }
 function sortedCommands(commands) {
   return [...commands].sort((a, b) => commandKey(a).localeCompare(commandKey(b)));
@@ -7021,7 +7149,7 @@ function managedCommands(root) {
       (entry2) => entry2 && typeof entry2 === "object" && Array.isArray(entry2.serverCommand) ? entry2.serverCommand.filter(
         (arg) => typeof arg === "string"
       ) : []
-    ).filter((command28) => command28.length > 0)
+    ).filter((command30) => command30.length > 0)
   );
 }
 function mcpManagedAllowlistCheck(ctx) {
@@ -7804,8 +7932,8 @@ function cloneRules(rules) {
   return rules.map((rule) => ({ ...rule }));
 }
 function applyCommandDelta(base, delta) {
-  const remove = new Set(delta?.remove ?? []);
-  const kept = base.filter((rule) => !remove.has(rule.pattern)).map((rule) => ({ ...rule }));
+  const remove2 = new Set(delta?.remove ?? []);
+  const kept = base.filter((rule) => !remove2.has(rule.pattern)).map((rule) => ({ ...rule }));
   const seen = new Set(kept.map((rule) => rule.pattern));
   for (const rule of delta?.add ?? []) {
     if (seen.has(rule.pattern)) continue;
@@ -8156,8 +8284,8 @@ async function contractTruthCheck(ctx) {
 }
 
 // src/report/cli-coverage.ts
-import { existsSync as existsSync14 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync15 } from "fs";
+import { join as join28 } from "path";
 
 // src/mcp/render.ts
 import { isAbsolute as isAbsolute5, join as join25 } from "path";
@@ -8235,9 +8363,118 @@ function existingMcpTomlNames(existing, scope) {
   return names;
 }
 
-// src/report/cli-loadability.ts
-import { existsSync as existsSync13 } from "fs";
+// src/prune/detect.ts
+import { existsSync as existsSync13, readdirSync as readdirSync7 } from "fs";
 import { join as join26 } from "path";
+var VALID2 = new Set(SUPPORTED_CLIS);
+var isCli = (s) => VALID2.has(s);
+function keptTargets(ctx) {
+  const marker = (readAihConfig(ctx.root)?.targets ?? []).filter(isCli);
+  if (marker.length > 0) return { targeted: marker, source: "marker" };
+  if (ctx.targets && ctx.targets.length > 0) return { targeted: [...ctx.targets], source: "ctx" };
+  return { targeted: [], source: "none" };
+}
+function onDiskClis(ctx) {
+  return SUPPORTED_CLIS.filter(
+    (c) => existsSync13(join26(ctx.root, ctx.contextDir, "adapters", `${c}.md`))
+  );
+}
+function repoMcpPath(cli) {
+  const m = entry(cli).mcp;
+  if (!m.configPath || isExternalMcp(m.configPath)) return void 0;
+  return m.configPath;
+}
+var settingsPath = (cli) => entry(cli).settings?.configPath;
+function keptPaths(targeted) {
+  const kept = new Set(bootloadersFor(targeted));
+  for (const c of targeted) {
+    const mcp = repoMcpPath(c);
+    if (mcp) kept.add(mcp);
+    const set = settingsPath(c);
+    if (set) kept.add(set);
+  }
+  return kept;
+}
+function kiroHookFiles(root) {
+  try {
+    return readdirSync7(join26(root, ".kiro", "hooks")).filter((n) => n.startsWith("aih-") && n.endsWith(".kiro.hook")).sort().map((n) => `.kiro/hooks/${n}`);
+  } catch {
+    return [];
+  }
+}
+function stalePruneSet(ctx) {
+  const { targeted, source } = keptTargets(ctx);
+  if (source === "none") return { targeted, source, dropped: [], artifacts: [] };
+  const keptSet = new Set(targeted);
+  const dropped = onDiskClis(ctx).filter((c) => !keptSet.has(c));
+  if (dropped.length === 0) return { targeted, source, dropped, artifacts: [] };
+  const kept = keptPaths(targeted);
+  const onDisk = (rel) => existsSync13(join26(ctx.root, rel));
+  const artifacts = [];
+  for (const cli of dropped) {
+    artifacts.push({
+      kind: "adapter",
+      path: `${ctx.contextDir}/adapters/${cli}.md`,
+      disposition: "file",
+      clis: [cli]
+    });
+  }
+  for (const rel of bootloadersFor(dropped)) {
+    if (kept.has(rel) || !onDisk(rel)) continue;
+    artifacts.push({
+      kind: "bootloader",
+      path: rel,
+      disposition: "block",
+      clis: dropped.filter((c) => entry(c).bootloaders.includes(rel))
+    });
+  }
+  for (const rel of [...new Set(dropped.map(repoMcpPath).filter((p) => !!p))]) {
+    if (kept.has(rel) || !onDisk(rel)) continue;
+    artifacts.push({
+      kind: "mcp",
+      path: rel,
+      disposition: "advisory",
+      clis: dropped.filter((c) => repoMcpPath(c) === rel)
+    });
+  }
+  for (const rel of [...new Set(dropped.map(settingsPath).filter((p) => !!p))]) {
+    if (kept.has(rel) || !onDisk(rel)) continue;
+    artifacts.push({
+      kind: "settings",
+      path: rel,
+      disposition: "advisory",
+      clis: dropped.filter((c) => settingsPath(c) === rel)
+    });
+  }
+  if (dropped.includes("kiro")) {
+    const steering = ".kiro/steering/agent-tools.md";
+    if (onDisk(steering)) {
+      artifacts.push({
+        kind: "kiro-steering",
+        path: steering,
+        disposition: "file",
+        clis: ["kiro"]
+      });
+    }
+    for (const hook of kiroHookFiles(ctx.root)) {
+      artifacts.push({ kind: "kiro-hook", path: hook, disposition: "file", clis: ["kiro"] });
+    }
+  }
+  return { targeted, source, dropped, artifacts };
+}
+function staleAdvisory(set) {
+  if (set.artifacts.length === 0) return void 0;
+  const n = set.artifacts.length;
+  return lines(
+    "",
+    `  STALE \u2014 ${n} artifact${n === 1 ? "" : "s"} for ${set.dropped.length} dropped CLI(s) (${set.dropped.join(", ")}) no longer targeted.`,
+    "  Preview what aih would prune:  aih prune   (aih leaves these untouched until you apply)"
+  );
+}
+
+// src/report/cli-loadability.ts
+import { existsSync as existsSync14 } from "fs";
+import { join as join27 } from "path";
 function frontmatterOf(text) {
   const t = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
   const m = t.match(/^---\n([\s\S]*?)\n---/);
@@ -8260,7 +8497,7 @@ function activationCheck(ctx, cli, present) {
   }
   const bad = [];
   for (const rel of present) {
-    const fm = frontmatterOf(readIfExists(join26(ctx.root, rel)) ?? "");
+    const fm = frontmatterOf(readIfExists(join27(ctx.root, rel)) ?? "");
     if (!fm || fm[act.key] !== act.value) bad.push(rel);
   }
   return bad.length === 0 ? { name: "activation", ok: true, detail: `${act.key}: ${act.value} set` } : {
@@ -8272,7 +8509,7 @@ function activationCheck(ctx, cli, present) {
 function hygieneCheck(ctx, present) {
   const bad = [];
   for (const rel of present) {
-    const text = readIfExists(join26(ctx.root, rel)) ?? "";
+    const text = readIfExists(join27(ctx.root, rel)) ?? "";
     if (text.charCodeAt(0) === 65279) bad.push(`${rel} (BOM before content)`);
     else if (/^---\n/.test(text) && frontmatterOf(text) === void 0) {
       bad.push(`${rel} (unterminated frontmatter)`);
@@ -8285,11 +8522,11 @@ function hygieneCheck(ctx, present) {
   };
 }
 function targetChainCheck(targets, okDetail, missingPrefix) {
-  const missing = targets.filter(([, p]) => !existsSync13(p)).map(([label]) => label);
+  const missing = targets.filter(([, p]) => !existsSync14(p)).map(([label]) => label);
   return missing.length === 0 ? { name: "router-chain", ok: true, detail: okDetail } : { name: "router-chain", ok: false, detail: `${missingPrefix}: ${missing.join(", ")}` };
 }
 function isWorkspaceRoot(ctx) {
-  const raw = readIfExists(join26(ctx.root, ".aih-workspace.json"));
+  const raw = readIfExists(join27(ctx.root, ".aih-workspace.json"));
   if (raw === void 0) return false;
   try {
     const parsed = JSON.parse(raw);
@@ -8301,10 +8538,10 @@ function isWorkspaceRoot(ctx) {
 function repoRouterChainCheck(ctx) {
   return targetChainCheck(
     [
-      [`${ctx.contextDir}/RULE_ROUTER.md`, join26(ctx.root, ctx.contextDir, "RULE_ROUTER.md")],
+      [`${ctx.contextDir}/RULE_ROUTER.md`, join27(ctx.root, ctx.contextDir, "RULE_ROUTER.md")],
       [
         `${ctx.contextDir}/rules/agent-behavior-core.md`,
-        join26(ctx.root, ctx.contextDir, "rules", "agent-behavior-core.md")
+        join27(ctx.root, ctx.contextDir, "rules", "agent-behavior-core.md")
       ]
     ],
     "router + behavior core reachable",
@@ -8316,11 +8553,11 @@ function workspaceRouterChainCheck(ctx) {
     [
       [
         `${ctx.contextDir}/cross-repo-architecture.md`,
-        join26(ctx.root, ctx.contextDir, "cross-repo-architecture.md")
+        join27(ctx.root, ctx.contextDir, "cross-repo-architecture.md")
       ],
       [
         `${ctx.contextDir}/repo-discipline.md`,
-        join26(ctx.root, ctx.contextDir, "repo-discipline.md")
+        join27(ctx.root, ctx.contextDir, "repo-discipline.md")
       ]
     ],
     "workspace canon docs reachable",
@@ -8336,7 +8573,7 @@ function contextCapCheck(ctx, cli, present) {
   if (cap === void 0) {
     return { name: "context-cap", ok: void 0, detail: "no documented per-bootloader cap" };
   }
-  const chars = present.reduce((n, rel) => n + (readIfExists(join26(ctx.root, rel))?.length ?? 0), 0);
+  const chars = present.reduce((n, rel) => n + (readIfExists(join27(ctx.root, rel))?.length ?? 0), 0);
   return chars <= cap ? { name: "context-cap", ok: true, detail: `${chars} \u2264 ${cap} char cap` } : {
     name: "context-cap",
     ok: false,
@@ -8344,7 +8581,7 @@ function contextCapCheck(ctx, cli, present) {
   };
 }
 function loadabilityFor(ctx, cli) {
-  const present = entry(cli).bootloaders.filter((p) => existsSync13(join26(ctx.root, p)));
+  const present = entry(cli).bootloaders.filter((p) => existsSync14(join27(ctx.root, p)));
   if (present.length === 0) {
     return {
       cli,
@@ -8447,9 +8684,9 @@ function loadGroupDigest(model) {
 }
 
 // src/report/cli-coverage.ts
-var VALID2 = new Set(SUPPORTED_CLIS);
+var VALID3 = new Set(SUPPORTED_CLIS);
 function isWorkspaceRoot2(ctx) {
-  const raw = readIfExists(join27(ctx.root, ".aih-workspace.json"));
+  const raw = readIfExists(join28(ctx.root, ".aih-workspace.json"));
   if (raw === void 0) return false;
   try {
     const parsed = JSON.parse(raw);
@@ -8459,7 +8696,7 @@ function isWorkspaceRoot2(ctx) {
   }
 }
 function resolveTargetSet(ctx) {
-  const marker = (readAihConfig(ctx.root)?.targets ?? []).filter((t) => VALID2.has(t));
+  const marker = (readAihConfig(ctx.root)?.targets ?? []).filter((t) => VALID3.has(t));
   if (marker.length > 0) return { targeted: marker, source: "marker" };
   if (ctx.targets && ctx.targets.length > 0) return { targeted: ctx.targets, source: "ctx" };
   const cli = ctx.options.cli;
@@ -8471,7 +8708,7 @@ function resolveTargetSet(ctx) {
     if (present.length > 0) return { targeted: present, source: "detect" };
   }
   const wired = SUPPORTED_CLIS.filter(
-    (c) => existsSync14(join27(ctx.root, ctx.contextDir, "adapters", `${c}.md`))
+    (c) => existsSync15(join28(ctx.root, ctx.contextDir, "adapters", `${c}.md`))
   );
   if (wired.length > 0) return { targeted: wired, source: "wired" };
   return { targeted: ["claude"], source: "default-claude" };
@@ -8479,7 +8716,7 @@ function resolveTargetSet(ctx) {
 function workspaceBootloaderCell(ctx, cli) {
   const paths = entry(cli).bootloaders;
   const label = paths.join(" + ");
-  const missing = paths.filter((rel) => readIfExists(join27(ctx.root, rel)) === void 0);
+  const missing = paths.filter((rel) => readIfExists(join28(ctx.root, rel)) === void 0);
   if (missing.length > 0) {
     return {
       state: "missing",
@@ -8492,7 +8729,7 @@ function workspaceBootloaderCell(ctx, cli) {
     `${ctx.contextDir}/cross-repo-architecture.md`,
     `${ctx.contextDir}/repo-discipline.md`
   ];
-  const missingTargets = workspaceDocs.filter((rel) => !existsSync14(join27(ctx.root, rel)));
+  const missingTargets = workspaceDocs.filter((rel) => !existsSync15(join28(ctx.root, rel)));
   if (missingTargets.length > 0) {
     return {
       state: "missing",
@@ -8502,7 +8739,7 @@ function workspaceBootloaderCell(ctx, cli) {
     };
   }
   const missingPointers = paths.flatMap((rel) => {
-    const text = readIfExists(join27(ctx.root, rel)) ?? "";
+    const text = readIfExists(join28(ctx.root, rel)) ?? "";
     return workspaceDocs.filter((docPath) => !text.includes(docPath)).map((docPath) => `${rel} -> ${docPath}`);
   });
   if (missingPointers.length > 0) {
@@ -8528,7 +8765,7 @@ function bootloaderCell(ctx, cli) {
   const drifted = [];
   const noRouter = [];
   for (const rel of paths) {
-    const text = readIfExists(join27(ctx.root, rel));
+    const text = readIfExists(join28(ctx.root, rel));
     if (text === void 0) {
       missing.push(rel);
       continue;
@@ -8565,7 +8802,7 @@ function mcpCell(ctx, cli) {
   }
   if (m.support !== "native") {
     const repoRelative = !isExternalMcp(m.configPath);
-    const annot = repoRelative ? existsSync14(join27(ctx.root, m.configPath)) ? `${m.configPath} present` : `${m.configPath} not found` : `global ${m.configPath}`;
+    const annot = repoRelative ? existsSync15(join28(ctx.root, m.configPath)) ? `${m.configPath} present` : `${m.configPath} not found` : `global ${m.configPath}`;
     return {
       state: "manual",
       path: m.configPath,
@@ -8574,7 +8811,7 @@ function mcpCell(ctx, cli) {
     };
   }
   const external = isExternalMcp(m.configPath);
-  const abs = external ? mcpConfigAbs(homeDir(ctx), m.configPath) : join27(ctx.root, m.configPath);
+  const abs = external ? mcpConfigAbs(homeDir(ctx), m.configPath) : join28(ctx.root, m.configPath);
   const scopeNote = external ? " (global)" : "";
   const scope = external ? "global" : "repo";
   const raw = readIfExists(abs);
@@ -8618,7 +8855,7 @@ function settingsCell(ctx, cli) {
   if (!s.writable) {
     return { state: "manual", path: s.configPath, detail: `manual \u2014 ${s.configPath}` };
   }
-  return existsSync14(join27(ctx.root, s.configPath)) ? { state: "wired", path: s.configPath, detail: `${s.configPath} present` } : {
+  return existsSync15(join28(ctx.root, s.configPath)) ? { state: "wired", path: s.configPath, detail: `${s.configPath} present` } : {
     state: "missing",
     path: s.configPath,
     detail: `${s.configPath} not found`,
@@ -8715,31 +8952,35 @@ function renderCliCoverage(model) {
 }
 function cliCoverageDigest(ctx) {
   const model = scanCliCoverage(ctx);
+  const stale = stalePruneSet(ctx);
+  const advisory = staleAdvisory(stale);
+  const body = advisory ? `${renderCliCoverage(model)}
+${advisory}` : renderCliCoverage(model);
   return digest(
     `AI CLI wiring \u2014 ${model.structurallyConfigured} of ${model.totalTargeted} configured, ${model.provenLoadable} loadable`,
-    renderCliCoverage(model),
-    model
+    body,
+    { ...model, stale }
   );
 }
 
 // src/trust/commands.ts
-import { existsSync as existsSync16 } from "fs";
-import { basename as basename6, join as join30 } from "path";
+import { existsSync as existsSync17 } from "fs";
+import { basename as basename6, join as join31 } from "path";
 
 // src/trust/fetch.ts
 import { createHash as createHash2 } from "crypto";
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync15,
-  lstatSync as lstatSync3,
+  existsSync as existsSync16,
+  lstatSync as lstatSync4,
   mkdtempSync,
-  readdirSync as readdirSync7,
+  readdirSync as readdirSync8,
   readFileSync as readFileSync5,
   realpathSync as realpathSync2,
   rmSync as rmSync2
 } from "fs";
 import { tmpdir } from "os";
-import { basename as basename5, isAbsolute as isAbsolute6, join as join28, relative as relative4, resolve as resolve8 } from "path";
+import { basename as basename5, isAbsolute as isAbsolute6, join as join29, relative as relative4, resolve as resolve8 } from "path";
 import process2 from "process";
 var GITHUB_SOURCE = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/;
 var SAFE_ENV_KEYS = /* @__PURE__ */ new Set([
@@ -8778,7 +9019,7 @@ function sourceIdForGitHub(owner, repo) {
   return slugify(`${owner}-${repo}`);
 }
 function quarantineRoot() {
-  const root = mkdtempSync(join28(tmpdir(), "aih-quarantine-"));
+  const root = mkdtempSync(join29(tmpdir(), "aih-quarantine-"));
   try {
     chmodSync2(root, 448);
   } catch {
@@ -8827,7 +9068,7 @@ function resolveTrustSource(raw, opts = {
   const trimmed = raw.trim();
   if (trimmed.length === 0) throw new AihError("workspace add requires a source", "AIH_TRUST");
   const local = isAbsolute6(trimmed) ? trimmed : resolve8(opts.root, trimmed);
-  if (existsSync15(local)) {
+  if (existsSync16(local)) {
     const root2 = assertTrustTreeSafe(local, { skipDirs: opts.skipDirs });
     return {
       kind: "local",
@@ -8869,14 +9110,14 @@ function resolveTrustSource(raw, opts = {
     ref,
     pin: opts.pin,
     quarantineRoot: root,
-    treePath: join28(root, "tree"),
-    metadataPath: join28(root, "metadata.json"),
+    treePath: join29(root, "tree"),
+    metadataPath: join29(root, "metadata.json"),
     display: `${owner}/${repo}@${ref}`
   };
 }
 function statSafe(path) {
   try {
-    return lstatSync3(path);
+    return lstatSync4(path);
   } catch {
     return void 0;
   }
@@ -8902,7 +9143,7 @@ function assertTrustTreeSafe(root, opts = {}) {
   const realRoot = realpathSync2(absRoot);
   const visit = (abs) => {
     if (abs !== realRoot && opts.skipDirs?.has(basename5(abs))) return;
-    const st = lstatSync3(abs);
+    const st = lstatSync4(abs);
     if (st.isSymbolicLink()) {
       throw new AihError(`refusing symlink inside trust source: ${abs}`, "AIH_TRUST");
     }
@@ -8911,7 +9152,7 @@ function assertTrustTreeSafe(root, opts = {}) {
     }
     assertContained2(realRoot, realpathSync2(abs));
     if (!st.isDirectory()) return;
-    for (const entry2 of readdirSync7(abs)) visit(join28(abs, entry2));
+    for (const entry2 of readdirSync8(abs)) visit(join29(abs, entry2));
   };
   visit(realRoot);
   return realRoot;
@@ -9186,7 +9427,7 @@ function gradeTrustCheck(check2, posture) {
 }
 
 // src/trust/lock.ts
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 var LOWER_FULL_SHA = /^[0-9a-f]{40}$/;
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -9257,7 +9498,7 @@ function parseTrustLockSource(value) {
   };
 }
 function readTrustLock(root) {
-  const raw = readIfExists(join29(root, ".aih", "trust-lock.json"));
+  const raw = readIfExists(join30(root, ".aih", "trust-lock.json"));
   if (raw === void 0) return { schemaVersion: 1, sources: [] };
   try {
     const parsed = JSON.parse(raw);
@@ -9378,7 +9619,7 @@ function artifactTarget(ctx, source, artifactPath2) {
   for (const skill of sortedSkills) {
     for (const prefix of [`skills/${skill}/`, `${skill}/`]) {
       if (normalized.startsWith(prefix)) {
-        return join30(
+        return join31(
           ctx.root,
           ctx.contextDir,
           "skills",
@@ -9390,12 +9631,12 @@ function artifactTarget(ctx, source, artifactPath2) {
     }
   }
   const fallbackSkill = sortedSkills[0] ?? basename6(source.id);
-  return join30(ctx.root, ctx.contextDir, "skills", source.id, fallbackSkill, normalized);
+  return join31(ctx.root, ctx.contextDir, "skills", source.id, fallbackSkill, normalized);
 }
 function localDriftChecks(ctx, source) {
   return source.artifactHashes.map((artifact) => {
     const target = artifactTarget(ctx, source, artifact.path);
-    if (!existsSync16(target)) {
+    if (!existsSync17(target)) {
       return {
         name: "trust local drift",
         verdict: "fail",
@@ -9424,8 +9665,8 @@ function localDriftChecks(ctx, source) {
   });
 }
 function trustLockLocalDriftChecks(ctx) {
-  const lockPath = join30(ctx.root, ".aih", "trust-lock.json");
-  if (!existsSync16(lockPath)) {
+  const lockPath = join31(ctx.root, ".aih", "trust-lock.json");
+  if (!existsSync17(lockPath)) {
     return [
       {
         name: "trust local drift",
@@ -9714,7 +9955,7 @@ function workspaceGitignoreMissing(repos, gitignore) {
 }
 
 // src/workspace/manifest.ts
-import { join as join31, posix as posix6 } from "path";
+import { join as join32, posix as posix6 } from "path";
 var ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 function cleanPrintable(value, label) {
   if (/[\r\n\t|]/.test(value)) {
@@ -9884,7 +10125,7 @@ function parseWorkspaceManifest(raw, defaultContextDir = "ai-coding") {
   };
 }
 function readWorkspaceManifest(root, defaultContextDir = "ai-coding") {
-  const raw = readIfExists(join31(root, ".aih-workspace.json"));
+  const raw = readIfExists(join32(root, ".aih-workspace.json"));
   if (raw === void 0) return void 0;
   try {
     return parseWorkspaceManifest(parseJsoncText(raw), defaultContextDir);
@@ -9893,7 +10134,7 @@ function readWorkspaceManifest(root, defaultContextDir = "ai-coding") {
   }
 }
 function workspaceManifestExists(root) {
-  return readIfExists(join31(root, ".aih-workspace.json")) !== void 0;
+  return readIfExists(join32(root, ".aih-workspace.json")) !== void 0;
 }
 function workspaceReposFromPaths(paths, router = defaultRouter()) {
   return paths.map((raw) => {
@@ -9941,8 +10182,8 @@ var command11 = {
         detail: ctx.host.verified ? `${ctx.host.platform} (verified)` : `${ctx.host.platform} (unverified path) \u2014 proceeding on the generic path; file an issue if a step misbehaves`
       })),
       probe("canonical context dir", () => {
-        const dir = join32(ctx.root, contextDir);
-        return existsSync17(dir) ? { name: "context-dir", verdict: "pass", detail: dir } : {
+        const dir = join33(ctx.root, contextDir);
+        return existsSync18(dir) ? { name: "context-dir", verdict: "pass", detail: dir } : {
           name: "context-dir",
           verdict: "skip",
           detail: `${contextDir} not scaffolded \u2014 run: aih scaffold --apply`,
@@ -10071,7 +10312,7 @@ var command11 = {
       probe("workspace child repos gitignored", () => {
         const missing = workspaceGitignoreMissing(
           repoPaths,
-          readIfExists(join32(ctx.root, ".gitignore"))
+          readIfExists(join33(ctx.root, ".gitignore"))
         );
         return missing.length === 0 ? {
           name: "workspace-child-gitignore",
@@ -10086,7 +10327,7 @@ var command11 = {
     ] : [];
     const wsProbes = repos.map(
       (repo) => probe(`workspace child ${repo.id} scaffolded`, () => {
-        const present = existsSync17(join32(ctx.root, repo.path, repo.router));
+        const present = existsSync18(join33(ctx.root, repo.path, repo.router));
         return present ? {
           name: `child:${repo.id}`,
           verdict: "pass",
@@ -10104,9 +10345,9 @@ var command11 = {
 };
 
 // src/ecc/index.ts
-import { existsSync as existsSync18 } from "fs";
+import { existsSync as existsSync19 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 
 // src/ecc/install.ts
 var ECC_INSTALL_TARGETS = [
@@ -10255,7 +10496,7 @@ function eccLanguages(stack) {
 var ECC_REPO_URL = "https://github.com/affaan-m/ECC.git";
 function eccCacheDir(ctx) {
   const home = ctx.env.USERPROFILE || ctx.env.HOME || homedir2();
-  return join33(home, ".claude", "ecc");
+  return join34(home, ".claude", "ecc");
 }
 function kiroEccActions(ctx) {
   const explicit = typeof ctx.options.eccPath === "string" ? ctx.options.eccPath.trim() : "";
@@ -10263,7 +10504,7 @@ function kiroEccActions(ctx) {
   const posix13 = dir.replace(/\\/g, "/");
   const installExec = exec(
     `Install ECC for Kiro \u2014 run ${posix13}/.kiro/install.sh into ${ctx.root}/.kiro/ (under --apply)`,
-    ["bash", join33(dir, ".kiro", "install.sh"), ctx.root]
+    ["bash", join34(dir, ".kiro", "install.sh"), ctx.root]
   );
   if (explicit) {
     return [
@@ -10278,7 +10519,7 @@ function kiroEccActions(ctx) {
       )
     ];
   }
-  const hasCache = existsSync18(join33(dir, ".git"));
+  const hasCache = existsSync19(join34(dir, ".git"));
   const ref = (ctx.env.AIH_ECC_REF ?? "").trim();
   const fetchExecs = [];
   if (ref) {
@@ -10409,7 +10650,7 @@ var command12 = {
 };
 
 // src/guardrails/index.ts
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 
 // src/guardrails/taxonomy.ts
 function taxonomyDoc() {
@@ -10506,7 +10747,7 @@ function ciNote() {
   ].join("\n");
 }
 function preCommitActions(ctx, stack) {
-  const existing = readIfExists(join34(ctx.root, PRECOMMIT_PATH));
+  const existing = readIfExists(join35(ctx.root, PRECOMMIT_PATH));
   const userAuthored = existing !== void 0 && !existing.includes(PRECOMMIT_MARKER);
   if (!userAuthored) {
     return [
@@ -10633,7 +10874,7 @@ var command13 = {
 };
 
 // src/heal/index.ts
-import { join as join37 } from "path";
+import { join as join38 } from "path";
 
 // src/heal/common.ts
 var HEAL_SCOPES = ["certs", "npm", "path", "mcp"];
@@ -10675,7 +10916,7 @@ function classifyTool(res, isWindows) {
 }
 
 // src/heal/cert-verify.ts
-import { existsSync as existsSync19 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 
 // src/heal/templates.ts
 var NPM_HEAL_SCRIPT = "heal-npm.mjs";
@@ -10789,10 +11030,10 @@ var ENV_KEY = "NODE_EXTRA_CA_CERTS";
 var CHECK = "cert: NODE_EXTRA_CA_CERTS";
 function caCheck(env, tlsOk, tlsFailed) {
   const p = env[ENV_KEY];
-  if (p && existsSync19(p) && readIfExists(p)?.includes("BEGIN CERTIFICATE")) {
+  if (p && existsSync20(p) && readIfExists(p)?.includes("BEGIN CERTIFICATE")) {
     return { name: CHECK, verdict: "pass", detail: `${p} (valid PEM)` };
   }
-  if (p && !existsSync19(p)) {
+  if (p && !existsSync20(p)) {
     return {
       name: CHECK,
       verdict: "fail",
@@ -10851,10 +11092,10 @@ var certStep = {
 };
 
 // src/heal/mcp-probe.ts
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 var CHECK2 = "mcp: npx launcher";
 function mcpNeedsNpx(ctx) {
-  const raw = readIfExists(join35(ctx.root, ".mcp.json"));
+  const raw = readIfExists(join36(ctx.root, ".mcp.json"));
   if (raw === void 0) return { configured: false, usesNpx: false };
   return { configured: true, usesNpx: raw.includes("npx") };
 }
@@ -10975,11 +11216,11 @@ var npmStep = {
 };
 
 // src/heal/path-heal.ts
-import { existsSync as existsSync20 } from "fs";
-import { join as join36 } from "path";
+import { existsSync as existsSync21 } from "fs";
+import { join as join37 } from "path";
 function userBinDir(ctx) {
   const home = ctx.env.HOME ?? ctx.env.USERPROFILE ?? ctx.root;
-  return join36(home, ".local", "bin");
+  return join37(home, ".local", "bin");
 }
 function onPath2(ctx, dir) {
   const raw = ctx.env.PATH ?? ctx.env.Path ?? "";
@@ -10990,7 +11231,7 @@ function onPath2(ctx, dir) {
 }
 async function planPathHeal(ctx) {
   const dir = userBinDir(ctx);
-  const exists = existsSync20(dir);
+  const exists = existsSync21(dir);
   const present = exists && onPath2(ctx, dir);
   let check2;
   if (!exists) {
@@ -11054,7 +11295,7 @@ async function healPlan(ctx) {
   }
   actions.push(
     writeText(
-      join37(".aih", "heal-last.json"),
+      join38(".aih", "heal-last.json"),
       `${JSON.stringify({ scopes: [...scopes].sort() })}
 `,
       "record heal scope set \u2192 .aih/heal-last.json"
@@ -11083,7 +11324,7 @@ var command14 = {
 };
 
 // src/mcp/index.ts
-import { join as join38, posix as posix7 } from "path";
+import { join as join39, posix as posix7 } from "path";
 
 // src/mcp/gateway.ts
 var OAUTH_SCOPE = "api://agentgateway/mcp_access";
@@ -11516,7 +11757,7 @@ async function planMcp(ctx) {
     const where = external ? ` ${p.configPath} (global \u2014 affects all your projects)` : ` ${p.configPath}`;
     const describe = p.configPath === ".mcp.json" ? scope === "remote" ? "Configure project-aware servers + the opt-in hosted enterprise toolset (remote scope), merged into any existing .mcp.json" : `Configure project-aware MCP servers (${scope} scope)${tailored ? ` \u2014 ${tailored}` : ""}, merged into any existing .mcp.json` : `${e.label} MCP servers (${scope} scope) \u2192${where}, merged into any existing`;
     if (p.configFormat === "toml") {
-      const abs = external ? writePath : join38(ctx.root, p.configPath);
+      const abs = external ? writePath : join39(ctx.root, p.configPath);
       const existing = readIfExists(abs) ?? "";
       const have = existingMcpTomlNames(existing, MCP_TOML_SCOPE);
       const fresh = Object.fromEntries(Object.entries(servers).filter(([n]) => !have.has(n)));
@@ -11541,7 +11782,7 @@ async function planMcp(ctx) {
   }
   const placeholders = envPlaceholders(servers);
   if (placeholders.length > 0) {
-    const abs = join38(ctx.root, ".env.example");
+    const abs = join39(ctx.root, ".env.example");
     const body = [
       "# Secrets referenced by MCP servers (.mcp.json). Copy to .env (untracked) and fill",
       "# in real values \u2014 never commit them. aih manages only the block below.",
@@ -11985,14 +12226,14 @@ var command17 = {
 import { posix as posix8 } from "path";
 
 // src/internals/git-hooks.ts
-import { existsSync as existsSync21 } from "fs";
-import { join as join39 } from "path";
+import { existsSync as existsSync22 } from "fs";
+import { join as join40 } from "path";
 var GITHOOKS_PATH_COMMAND = "git config core.hooksPath .githooks";
 function normalizeHooksPath(value) {
   return value.trim().replace(/^["']|["']$/g, "").replace(/\\/g, "/").replace(/^\.\//, "");
 }
 function usesManagedHooksPath(root) {
-  const text = readIfExists(join39(root, ".git", "config"));
+  const text = readIfExists(join40(root, ".git", "config"));
   if (text === void 0) return false;
   let inCore = false;
   for (const line of text.replace(/\r\n/g, "\n").split("\n")) {
@@ -12009,8 +12250,8 @@ function usesManagedHooksPath(root) {
   return false;
 }
 function preCommitHookActive(root) {
-  if (existsSync21(join39(root, ".git", "hooks", "pre-commit"))) return true;
-  return existsSync21(join39(root, ".githooks", "pre-commit")) && usesManagedHooksPath(root);
+  if (existsSync22(join40(root, ".git", "hooks", "pre-commit"))) return true;
+  return existsSync22(join40(root, ".githooks", "pre-commit")) && usesManagedHooksPath(root);
 }
 
 // src/scaffold/hooks.ts
@@ -12869,7 +13110,7 @@ var command20 = {
 };
 
 // src/usage/index.ts
-import { join as join42, resolve as resolve10 } from "path";
+import { join as join43, resolve as resolve10 } from "path";
 
 // src/usage/aggregate.ts
 function top(map, limit = 12) {
@@ -13084,11 +13325,11 @@ function gitPostCommitChainSnippet() {
 }
 
 // src/usage/events.ts
-import { join as join40 } from "path";
-var USAGE_PATH = join40(".aih", "usage.jsonl");
+import { join as join41 } from "path";
+var USAGE_PATH = join41(".aih", "usage.jsonl");
 var KINDS = /* @__PURE__ */ new Set(["commit", "skill", "mcp", "session", "tool"]);
 function readUsage(ctx) {
-  const raw = readIfExists(join40(ctx.root, USAGE_PATH));
+  const raw = readIfExists(join41(ctx.root, USAGE_PATH));
   if (!raw) return [];
   const out = [];
   for (const line of raw.split(/\r?\n/)) {
@@ -13104,7 +13345,7 @@ function readUsage(ctx) {
 }
 
 // src/usage/hooks.ts
-import { join as join41 } from "path";
+import { join as join42 } from "path";
 var USAGE_HOOK_SCOPE = "usage-metering";
 function hookCommand(cli) {
   return `node .aih/usage-record.mjs --from ${cli}`;
@@ -13275,7 +13516,7 @@ function usageHookActions(ctx, clis) {
     actions.push(
       writeText(
         path,
-        kimiToml(readIfExists(join41(ctx.root, path))),
+        kimiToml(readIfExists(join42(ctx.root, path))),
         "Kimi PostToolUse usage hook, merged into an aih-managed TOML block"
       )
     );
@@ -13304,8 +13545,8 @@ function usageHookActions(ctx, clis) {
 }
 
 // src/usage/index.ts
-var RECORDER_PATH = join42(".aih", "usage-record.mjs");
-var GIT_HOOK_PATH = join42(".git", "hooks", "post-commit");
+var RECORDER_PATH = join43(".aih", "usage-record.mjs");
+var GIT_HOOK_PATH = join43(".git", "hooks", "post-commit");
 var TOOL_HOOK = {
   claude: "`.claude/settings.json` hooks \u2192 `PostToolUse` (captures Skill / mcp__ tool calls)",
   codex: "`.codex/hooks.json` \u2192 `PostToolUse`/`Stop`; project `.codex` must be trusted and command hooks reviewed via `/hooks`",
@@ -13395,7 +13636,7 @@ async function usagePlan(ctx) {
     ...usageHookActions(ctx, clis),
     coverageDoc(clis)
   ];
-  const existingHook = readIfExists(join42(ctx.root, GIT_HOOK_PATH));
+  const existingHook = readIfExists(join43(ctx.root, GIT_HOOK_PATH));
   if (existingHook !== void 0 && !existingHook.includes("usage-record.mjs")) {
     actions.push(
       doc(
@@ -13577,112 +13818,779 @@ var command22 = {
   plan: initPlan2
 };
 
-// src/report/index.ts
-import { existsSync as existsSync28, readFileSync as readFileSync6 } from "fs";
-import { basename as basename7, join as join53, resolve as resolve11 } from "path";
+// src/prune/index.ts
+import { join as join44 } from "path";
+var SOURCE_LABEL2 = {
+  marker: ".aih-config.json",
+  ctx: "init orchestrator",
+  none: "none"
+};
+var KIND_LABEL = {
+  adapter: "adapter note",
+  bootloader: "bootloader canon block",
+  mcp: "MCP config",
+  settings: "settings",
+  "kiro-steering": "Kiro steering",
+  "kiro-hook": "Kiro hook"
+};
+function bootloaderMinusBlock(ctx, rel) {
+  const text = readIfExists(join44(ctx.root, rel));
+  if (text === void 0) return void 0;
+  const onDisk = extractManagedBlock(text, SHARED_MARKER);
+  if (onDisk === void 0) return void 0;
+  if (onDisk !== sharedCanonicalBlockBody(ctx.contextDir).trim()) return void 0;
+  const stripped = stripManagedBlock(text, SHARED_MARKER);
+  return stripped === text ? void 0 : stripped;
+}
+function advisoryLines(set) {
+  const advisory = set.artifacts.filter((a) => a.disposition === "advisory");
+  if (advisory.length === 0) return [];
+  return [
+    "",
+    "Manual review \u2014 aih can't safely edit these (its entries carry no on-disk marker,",
+    "and names may collide with yours), so it will NOT touch them:",
+    ...advisory.map(
+      (a) => `  [manual] ${a.path}  \u2014 remove ${a.clis.join(", ")}'s entries by hand if unused`
+    )
+  ];
+}
+function contextBody(set, moved, subtracted) {
+  if (set.source === "none") {
+    return lines(
+      "No committed target set (.aih-config.json) to diff against \u2014 nothing is treated",
+      "as stale. Run `aih bootstrap-ai` to record which CLIs this repo targets, then",
+      "`aih prune` will remove artifacts for any CLI you later drop."
+    );
+  }
+  if (set.dropped.length === 0) {
+    return lines(
+      "No stale per-CLI artifacts \u2014 every CLI wired into this repo is still targeted.",
+      `Kept (${SOURCE_LABEL2[set.source]}): ${set.targeted.join(", ") || "none"}.`
+    );
+  }
+  return lines(
+    `Kept (${SOURCE_LABEL2[set.source]}): ${set.targeted.join(", ")}`,
+    `Dropped: ${set.dropped.join(", ")}`,
+    "",
+    `${moved} file(s) move to .aih/legacy/ (reversible), ${subtracted} bootloader block(s)`,
+    "subtracted in place; the actions above list each. Pass --apply to execute.",
+    ...advisoryLines(set)
+  );
+}
+function actionFor(ctx, a) {
+  const who = `${a.clis.join(", ")} dropped`;
+  if (a.disposition === "file") {
+    return remove(a.path, `stale ${KIND_LABEL[a.kind]} (${who})`);
+  }
+  if (a.disposition === "block") {
+    const stripped = bootloaderMinusBlock(ctx, a.path);
+    return stripped === void 0 ? void 0 : writeText(a.path, stripped, `subtract aih canon block from ${a.path} (${who})`);
+  }
+  return void 0;
+}
+function prunePlan(ctx) {
+  const set = stalePruneSet(ctx);
+  const actions = [];
+  if (set.artifacts.some((a) => a.disposition === "file")) {
+    actions.push(aihIgnoreWrite(ctx.root));
+  }
+  let moved = 0;
+  let subtracted = 0;
+  for (const a of set.artifacts) {
+    const action = actionFor(ctx, a);
+    if (!action) continue;
+    actions.push(action);
+    if (action.kind === "remove") moved += 1;
+    else if (action.kind === "write") subtracted += 1;
+  }
+  const headline = set.dropped.length > 0 ? `Stale artifacts \u2014 ${set.artifacts.length} for ${set.dropped.length} dropped CLI(s)` : "Stale artifacts \u2014 none";
+  actions.push(digest(headline, contextBody(set, moved, subtracted), set));
+  return plan("prune", ...actions);
+}
+var command23 = {
+  name: "prune",
+  summary: "Remove stale per-CLI artifacts left by CLIs this repo no longer targets",
+  plan: prunePlan
+};
 
-// src/support/findings.ts
-var NO_CODE_CHANGES = "No project code changes are required.";
-var CODE_META = {
-  "env.node-runtime": {
-    audience: "internal-it",
-    failSeverity: "blocking",
-    title: "required language runtime missing or unsupported",
-    affectedArea: "local developer tooling",
-    evidence: "The required language runtime (Node.js 20 or newer) is missing or below the supported version on this machine.",
-    action: "Please provision the supported language runtime on this machine via the approved software catalog or installer, then have the developer reopen their shell.",
-    acceptance: [
-      "The supported runtime version is available on this machine.",
-      "Project setup checks pass without further manual steps.",
-      NO_CODE_CHANGES
-    ]
-  },
-  "env.git-missing": {
-    audience: "developer",
-    failSeverity: "degraded",
-    title: "git not found on PATH",
-    action: "Install git (winget/apt/brew or your software catalog) and reopen the shell."
-  },
-  "env.dev-tool-missing": {
-    audience: "developer",
-    failSeverity: "degraded",
-    title: "Dev tools (rg/fd/jq) missing",
-    action: "Install rg/fd/jq (winget/scoop/brew), or on a locked-down VDI add your local bundle to PATH."
-  },
-  "env.tool-install-blocked": {
-    audience: "internal-it",
-    failSeverity: "degraded",
-    title: "required developer tool could not be installed",
-    affectedArea: "local developer tooling / software installation",
-    evidence: "A required command-line tool is not available, and an automated install could not complete on this machine (no supported package manager is present, privileges are insufficient, or the package source is blocked).",
-    action: "Please provision the missing tool via the approved software catalog / package manager, or unblock the package source on this machine so the developer can install it.",
-    acceptance: [
-      "The tool resolves on PATH.",
-      "Project tooling checks pass without further manual steps.",
-      NO_CODE_CHANGES
-    ]
-  },
-  "cert.ca-missing": {
-    audience: "internal-it",
-    failSeverity: "blocking",
-    title: "corporate CA not trusted by development tools",
-    affectedArea: "workstation certificate trust / development toolchain trust",
-    evidence: "TLS verification is failing because the approved corporate CA is not available to the tools running on this machine.\nThe Node CA bundle setting (NODE_EXTRA_CA_CERTS) is not set or does not point to a valid corporate CA bundle.",
-    action: "Please make the approved corporate root certificate authority available on this machine and configure the development tools to trust it. For Node-based tools, this usually means setting NODE_EXTRA_CA_CERTS to the approved corporate CA bundle path, in addition to any required OS trust-store configuration.",
-    acceptance: [
-      "Development tools can complete TLS verification against approved internal and package sources.",
-      "Package access works without disabling TLS checks.",
-      NO_CODE_CHANGES
-    ]
-  },
-  "tls.verify-failed": {
-    audience: "internal-it",
-    failSeverity: "blocking",
-    title: "TLS verification to approved package sources is failing",
-    affectedArea: "workstation certificate trust / development toolchain trust",
-    evidence: "TLS connections to approved package registries are failing on this machine, consistent with an intercepting proxy whose certificate is not trusted by the development tools.",
-    action: "Please ensure the intercepting proxy's certificate is trusted on this machine (OS trust store and the development toolchain) and that the approved package registry endpoints are reachable.",
-    acceptance: [
-      "Development tools can complete TLS verification against approved internal and package sources.",
-      "Package access works without disabling TLS checks.",
-      NO_CODE_CHANGES
-    ]
-  },
-  "npm.runtime-broken": {
-    audience: "internal-it",
-    failSeverity: "blocking",
-    title: "package manager is broken on this machine",
-    affectedArea: "approved package registry access",
-    evidence: "The package manager fails to run or cannot install from approved registries on this machine.",
-    action: "Please repair the package manager installation on this machine so it runs and can install from approved registries; if the registry is unreachable, restore corporate TLS trust first.",
-    acceptance: [
-      "The package manager runs and can install from approved sources.",
-      "No TLS checks are disabled to achieve this.",
-      NO_CODE_CHANGES
-    ]
-  },
-  "path.missing": {
-    audience: "developer",
-    failSeverity: "degraded",
-    title: "Tool directory not on PATH",
-    action: "Add the user tool directory to PATH (see `aih heal`) and reopen the shell."
-  },
-  "mcp.blocked": {
-    audience: "dev-platform",
-    failSeverity: "blocking",
-    title: "package launcher cannot reach the approved registry",
-    affectedArea: "approved package registry access",
-    evidence: "The developer-platform package launcher cannot reach the approved package registry on this machine.",
-    action: "Please restore access from this machine to the approved package registry for the launcher (certificate trust plus endpoint allowlisting), or approve a vendored, locally-installed server set.",
-    acceptance: [
-      "The launcher can reach approved package sources.",
-      "No TLS checks are disabled to achieve this.",
-      NO_CODE_CHANGES
-    ]
-  },
-  "mcp.uv-missing": {
-    audience: "dev-platform",
-    failSeverity: "degraded",
+// src/status.ts
+import { existsSync as existsSync23 } from "fs";
+import { join as join45 } from "path";
+var ARTIFACTS = [
+  ["context-dir", ""],
+  // resolved against ctx.contextDir below
+  ["gitleaks", ".gitleaks.toml"],
+  ["pre-commit", ".pre-commit-config.yaml"],
+  ["devcontainer", ".devcontainer/devcontainer.json"]
+];
+function inventory(root, contextDir) {
+  return ARTIFACTS.map(([name, rel]) => {
+    const relative10 = name === "context-dir" ? contextDir : rel;
+    return { name, relative: relative10, present: existsSync23(join45(root, relative10)) };
+  });
+}
+function enforcementDetail(name, root, relative10) {
+  if (name === "pre-commit") {
+    return preCommitHookActive(root) ? `${relative10} (git hook installed \u2014 active)` : `${relative10} present, but no active git pre-commit hook was found \u2014 run \`${GITHOOKS_PATH_COMMAND}\` after scaffold`;
+  }
+  return relative10;
+}
+var command24 = {
+  name: "status",
+  summary: "Show what the harness has configured for this repo/workstation (read-only)",
+  readOnly: true,
+  options: [],
+  plan: (ctx) => plan(
+    "status",
+    ...inventory(ctx.root, ctx.contextDir).map(
+      (a) => probe(
+        `presence: ${a.name}`,
+        () => a.present ? {
+          name: a.name,
+          verdict: "pass",
+          detail: enforcementDetail(a.name, ctx.root, a.relative)
+        } : { name: a.name, verdict: "skip", detail: `${a.relative} not present` }
+      )
+    )
+  )
+};
+
+// src/report/grade.ts
+var GRADE_BANDS = [
+  { min: 85, grade: "mature" },
+  { min: 70, grade: "solid" },
+  { min: 50, grade: "emerging" },
+  { min: 0, grade: "nascent" }
+];
+function gradeOf(score) {
+  for (const b of GRADE_BANDS) if (score >= b.min) return b.grade;
+  return "nascent";
+}
+function dimScore(checks) {
+  if (checks.length === 0) return 0;
+  const passed = checks.filter((c) => c.passed).length;
+  return Math.round(passed / checks.length * 100);
+}
+function check(id, passed, remediation, source) {
+  return { id, passed, remediation, source };
+}
+function dim(name, weight, checks) {
+  return { name, weight, score: dimScore(checks), checks };
+}
+
+// src/report/readiness.ts
+var SCORE_CAP_WITH_BLOCKER = 69;
+var READY_THRESHOLD = 70;
+async function verdictOf(action, ctx) {
+  if (action?.kind !== "probe") return void 0;
+  return action.run(ctx);
+}
+async function healCheck(step2, ctx, shared, code) {
+  const actions = await step2.plan(ctx, shared);
+  for (const action of actions) {
+    const c = await verdictOf(action, ctx);
+    if (c && c.code === code) return c;
+    if (c && code === void 0) return c;
+  }
+  return void 0;
+}
+async function firstHealCheck(step2, ctx, shared) {
+  const actions = await step2.plan(ctx, shared);
+  for (const action of actions) {
+    const c = await verdictOf(action, ctx);
+    if (c) return c;
+  }
+  return void 0;
+}
+async function nodeVerdict(ctx) {
+  const res = await ctx.run(versionArgv(ctx.host.platform, "node"));
+  if (classifyTool(res, ctx.host.platform === "windows") !== "ok") return "fail";
+  const major = Number(res.stdout.match(/v?(\d+)\./)?.[1] ?? Number.NaN);
+  return Number.isFinite(major) && major >= 20 ? "pass" : "fail";
+}
+async function npmVerdict(ctx, nodeOk) {
+  if (!nodeOk) return "skip";
+  const res = await ctx.run(versionArgv(ctx.host.platform, "npm"));
+  return classifyTool(res, ctx.host.platform === "windows") === "ok" ? "pass" : "fail";
+}
+async function gitVerdict(ctx) {
+  const res = await ctx.run(["git", "--version"]);
+  return res.spawnError ? "fail" : "pass";
+}
+async function coreToolsMissing(ctx) {
+  const missing = [];
+  for (const bin of ["rg", "fd", "jq"]) {
+    const argv = ctx.host.platform === "windows" ? ["where", bin] : ["which", bin];
+    const res = await ctx.run(argv);
+    if (res.spawnError || res.code !== 0 || res.stdout.trim().length === 0) missing.push(bin);
+  }
+  return missing;
+}
+function secretsPresent(root) {
+  return scanSecrets(root).matches.length > 0 || scanConfigSecrets(root).length > 0;
+}
+async function buildChecks(ctx) {
+  const { root, contextDir } = ctx;
+  const posture = postureFromContext(ctx);
+  const out = [];
+  const tlsRegistry = await tlsCheck(ctx, "tls: registry", REGISTRY_URL);
+  const shared = { tlsRegistry, tlsPypi: tlsRegistry };
+  const node = await nodeVerdict(ctx);
+  const nodeOk = node === "pass";
+  out.push({
+    id: "node-runtime",
+    title: "Node.js runtime (>= 20) on PATH",
+    severity: "gate",
+    dimension: "machine",
+    verdict: node,
+    cmd: "install Node 20+ (nvm/winget/brew) and re-open the shell"
+  });
+  out.push({
+    id: "npm-runtime",
+    title: "npm present and runnable",
+    severity: "gate",
+    dimension: "machine",
+    verdict: await npmVerdict(ctx, nodeOk),
+    cmd: "aih heal --scope npm"
+  });
+  const certCode = tlsRegistry.verdict === "fail" ? "tls.verify-failed" : "cert.ca-missing";
+  const cert = await healCheck(certStep, ctx, shared, certCode) ?? await firstHealCheck(certStep, ctx, shared);
+  out.push({
+    id: "tls-ca-trust",
+    title: "Corporate TLS/CA trust intact",
+    severity: "gate",
+    dimension: "machine",
+    verdict: tlsRegistry.verdict === "fail" ? "fail" : cert?.verdict ?? "skip",
+    cmd: "aih heal --scope certs"
+  });
+  const path = await firstHealCheck(pathStep, ctx, shared);
+  out.push({
+    id: "toolbin-on-path",
+    title: "Installed-tool dir on PATH",
+    severity: "gate",
+    dimension: "machine",
+    verdict: path?.verdict ?? "skip",
+    cmd: "aih heal --scope path"
+  });
+  out.push({
+    id: "git-present",
+    title: "git available on PATH",
+    severity: posture === "vibe" ? "warn" : "gate",
+    dimension: "machine",
+    verdict: await gitVerdict(ctx),
+    cmd: "install git (winget/apt/brew) and re-run"
+  });
+  const coreMissing = await coreToolsMissing(ctx);
+  out.push({
+    id: "core-shell-tools",
+    title: "Core shell tools (rg, fd, jq) on PATH",
+    severity: "gate",
+    dimension: "machine",
+    verdict: coreMissing.length === 0 ? "pass" : "fail",
+    cmd: "install rg, fd, jq (winget/scoop/brew) or add your VDI bundle to PATH"
+  });
+  const coverage = scanCliCoverage(ctx);
+  const anyLoadable = coverage.provenLoadable > 0 || coverage.structurallyConfigured > 0;
+  out.push({
+    id: "runnable-ai-cli",
+    title: "A configured AI CLI for this repo",
+    severity: "warn",
+    dimension: "machine",
+    verdict: anyLoadable ? "pass" : "fail",
+    cmd: "install a CLI (claude/codex/\u2026) then: aih bootstrap-ai --apply"
+  });
+  const contract = await contractTruthCheck(ctx);
+  out.push({
+    id: "contract-fresh",
+    title: "Repo contract present, portable, and current",
+    severity: posture === "enterprise" ? "gate" : "warn",
+    dimension: "repo-contract",
+    verdict: contract.verdict,
+    cmd: "aih contract --apply"
+  });
+  const stack = scanRepo(root, { maxDepth: 8, contextDir });
+  const hasRunnable = Boolean(stack.testRunner || stack.buildCommand || stack.startCommand);
+  out.push({
+    id: "declared-commands",
+    title: "Declared build/test/start command",
+    severity: "warn",
+    dimension: "repo-contract",
+    verdict: hasRunnable ? "pass" : "fail",
+    cmd: "add a test/build/start script to package.json"
+  });
+  out.push({
+    id: "no-committed-secret",
+    title: "No plaintext/hardcoded secret committed",
+    severity: posture === "vibe" ? "warn" : "gate",
+    dimension: "repo-contract",
+    verdict: secretsPresent(root) ? "fail" : "pass",
+    cmd: "move secrets to env refs; run: aih secrets --apply"
+  });
+  const targeted = coverage.rows.filter((r) => r.targeted);
+  const wontLoad = targeted.some((r) => r.load.verdict === "wontLoad");
+  const anyLoads = targeted.some((r) => r.load.verdict === "loads");
+  out.push({
+    id: "bootloader-loads",
+    title: "Targeted CLI bootloader actually loads",
+    severity: "gate",
+    dimension: "harness-wiring",
+    verdict: wontLoad ? "fail" : anyLoads ? "pass" : "skip",
+    cmd: "aih bootstrap-ai --apply"
+  });
+  const bootloaderMissing = targeted.some((r) => r.bootloader.state === "missing");
+  const anyTargeted = targeted.length > 0;
+  out.push({
+    id: "bootloader-wired",
+    title: "Targeted CLI bootloader present + in sync",
+    severity: "warn",
+    dimension: "harness-wiring",
+    verdict: !anyTargeted ? "skip" : bootloaderMissing ? "fail" : "pass",
+    cmd: "aih bootstrap-ai --apply"
+  });
+  const inv = inventory(root, contextDir);
+  const preCommitConfig = inv.find((i) => i.name === "pre-commit")?.present ?? false;
+  out.push({
+    id: "pre-commit-active",
+    title: "pre-commit hook active (not just configured)",
+    severity: "warn",
+    dimension: "harness-wiring",
+    verdict: !preCommitConfig ? "skip" : preCommitHookActive(root) ? "pass" : "fail",
+    cmd: "git config core.hooksPath .githooks"
+  });
+  const gitleaks = inv.find((i) => i.name === "gitleaks")?.present ?? false;
+  out.push({
+    id: "guardrail-artifacts",
+    title: "Leak-prevention guardrail configured",
+    severity: "warn",
+    dimension: "harness-wiring",
+    verdict: gitleaks ? "pass" : "fail",
+    cmd: "aih guardrails --apply"
+  });
+  const mcp = await healCheck(mcpStep, ctx, shared, "mcp.blocked") ?? await firstHealCheck(mcpStep, ctx, shared);
+  out.push({
+    id: "mcp-launches",
+    title: "Declared npx MCP servers can launch",
+    severity: "gate",
+    dimension: "harness-wiring",
+    verdict: mcp?.verdict === "fail" ? "fail" : "skip",
+    cmd: "aih heal --scope mcp"
+  });
+  return out;
+}
+function dimensionOf(name, checks) {
+  const warns = checks.filter(
+    (c) => c.dimension === name && c.severity === "warn" && c.verdict !== "skip"
+  );
+  if (warns.length === 0) return { name, weight: 1, score: 100, checks: [] };
+  const results = warns.map(
+    (c) => check(c.id, c.verdict === "pass", c.cmd, c.title)
+  );
+  return dim(name, 1, results);
+}
+async function computeReadiness(ctx) {
+  const checks = await buildChecks(ctx);
+  const blockers = checks.filter((c) => c.severity === "gate" && c.verdict === "fail").map((c) => ({ id: c.id, title: c.title, cmd: c.cmd, dimension: c.dimension }));
+  const warns = checks.filter((c) => c.severity === "warn" && c.verdict === "fail").map((c) => ({ id: c.id, title: c.title, cmd: c.cmd, dimension: c.dimension }));
+  const dims = [
+    dimensionOf("machine", checks),
+    dimensionOf("repo-contract", checks),
+    dimensionOf("harness-wiring", checks)
+  ];
+  const rawScore = Math.round(dims.reduce((n, d) => n + d.score, 0) / dims.length);
+  const hasBlocker = blockers.length > 0;
+  const score = hasBlocker ? Math.min(rawScore, SCORE_CAP_WITH_BLOCKER) : rawScore;
+  const grade = gradeOf(score);
+  const banner = hasBlocker ? "NOT READY" : score >= READY_THRESHOLD ? "READY" : "READY, WITH GAPS";
+  const stack = scanRepo(ctx.root, { maxDepth: 8, contextDir: ctx.contextDir });
+  const firstCommand = stack.startCommand ?? stack.testRunner ?? null;
+  return { banner, blockers, warns, score, rawScore, grade, dims, firstCommand };
+}
+function readinessDigest(ctx) {
+  return {
+    kind: "digest",
+    describe: "Developer readiness",
+    run: async () => {
+      const r = await computeReadiness(ctx);
+      const data = {
+        banner: r.banner,
+        blockers: r.blockers,
+        score: r.score,
+        rawScore: r.rawScore,
+        grade: r.grade,
+        warns: r.warns,
+        firstCommand: r.firstCommand
+      };
+      return { text: renderReadinessBody(r), data };
+    }
+  };
+}
+function renderReadinessBody(r) {
+  const { banner, blockers, warns, dims, score, grade } = r;
+  const mark2 = (s) => s >= READY_THRESHOLD ? "\u2713" : s >= 50 ? "~" : "\xB7";
+  return lines(
+    `${banner} \u2014 ${score}/100 (${grade})`,
+    "",
+    ...blockers.length > 0 ? remediationBlock(
+      `  ${blockers.length} blocker${blockers.length === 1 ? "" : "s"} \u2014 must fix before an agent can work:`,
+      blockers.map((b) => ({ command: b.cmd, label: b.title }))
+    ) : ["  No blockers \u2014 nothing stops an agent from working here."],
+    "",
+    ...dims.map((d) => `  ${mark2(d.score)} ${d.name.padEnd(16)} ${d.score}/100`),
+    "",
+    warns.length > 0 ? `  ${warns.length} warn${warns.length === 1 ? "" : "s"} dinging the score (see the dimension lines above).` : "  No warnings \u2014 every applicable check passes."
+  );
+}
+
+// src/tools/install.ts
+var TOOLS = [
+  {
+    tool: "ripgrep (rg)",
+    bin: "rg",
+    tier: "core",
+    options: [
+      { pm: "winget", argv: ["winget", "install", "-e", "--id", "BurntSushi.ripgrep.MSVC"] },
+      { pm: "scoop", argv: ["scoop", "install", "ripgrep"] },
+      { pm: "brew", argv: ["brew", "install", "ripgrep"] },
+      { pm: "apt", argv: ["sudo", "apt-get", "install", "-y", "ripgrep"] },
+      { pm: "cargo", argv: ["cargo", "install", "ripgrep"] }
+    ],
+    manual: "https://github.com/BurntSushi/ripgrep#installation"
+  },
+  {
+    tool: "fd",
+    bin: "fd",
+    tier: "core",
+    options: [
+      { pm: "winget", argv: ["winget", "install", "-e", "--id", "sharkdp.fd"] },
+      { pm: "scoop", argv: ["scoop", "install", "fd"] },
+      { pm: "brew", argv: ["brew", "install", "fd"] },
+      { pm: "apt", argv: ["sudo", "apt-get", "install", "-y", "fd-find"] },
+      { pm: "cargo", argv: ["cargo", "install", "fd-find"] }
+    ],
+    manual: "https://github.com/sharkdp/fd#installation"
+  },
+  {
+    tool: "jq",
+    bin: "jq",
+    tier: "core",
+    options: [
+      { pm: "winget", argv: ["winget", "install", "-e", "--id", "jqlang.jq"] },
+      { pm: "scoop", argv: ["scoop", "install", "jq"] },
+      { pm: "brew", argv: ["brew", "install", "jq"] },
+      { pm: "apt", argv: ["sudo", "apt-get", "install", "-y", "jq"] }
+    ],
+    manual: "https://jqlang.github.io/jq/download/"
+  },
+  {
+    tool: "ast-grep (sg)",
+    bin: "sg",
+    tier: "optional",
+    options: [
+      { pm: "brew", argv: ["brew", "install", "ast-grep"] },
+      { pm: "cargo", argv: ["cargo", "install", "ast-grep", "--locked"] },
+      { pm: "npm", argv: ["npm", "install", "-g", "@ast-grep/cli"] }
+    ],
+    manual: "https://ast-grep.github.io/guide/quick-start.html"
+  },
+  {
+    tool: "comby",
+    bin: "comby",
+    tier: "optional",
+    options: [{ pm: "brew", argv: ["brew", "install", "comby"] }],
+    manual: "https://comby.dev/docs/get-started"
+  },
+  {
+    tool: "tree",
+    bin: "tree",
+    tier: "optional",
+    options: [
+      { pm: "scoop", argv: ["scoop", "install", "tree"] },
+      { pm: "brew", argv: ["brew", "install", "tree"] },
+      { pm: "apt", argv: ["sudo", "apt-get", "install", "-y", "tree"] }
+    ],
+    manual: "install `tree` from your OS package manager"
+  },
+  {
+    tool: "GitHub CLI (gh)",
+    bin: "gh",
+    tier: "optional",
+    options: [
+      { pm: "winget", argv: ["winget", "install", "-e", "--id", "GitHub.cli"] },
+      { pm: "scoop", argv: ["scoop", "install", "gh"] },
+      { pm: "brew", argv: ["brew", "install", "gh"] },
+      { pm: "apt", argv: ["sudo", "apt-get", "install", "-y", "gh"] }
+    ],
+    manual: "https://cli.github.com"
+  },
+  {
+    tool: "code-review-graph",
+    bin: "code-review-graph",
+    tier: "optional",
+    // Pinned to match the uvx MCP runners (src/mcp/servers.ts + src/workspace/templates.ts);
+    // bump in lockstep. PEP 508 `==` form — pip/uv reject the uvx `@2.3.6` shorthand.
+    options: [
+      { pm: "uv", argv: ["uv", "tool", "install", "code-review-graph==2.3.6"] },
+      { pm: "pip", argv: ["pip", "install", "code-review-graph==2.3.6"] }
+    ],
+    manual: "pip install code-review-graph==2.3.6"
+  }
+];
+var PM_BINARIES = [
+  ["winget", "winget"],
+  ["scoop", "scoop"],
+  ["brew", "brew"],
+  ["apt-get", "apt"],
+  ["cargo", "cargo"],
+  ["npm", "npm"],
+  ["uv", "uv"],
+  ["pip", "pip"]
+];
+async function onPath3(ctx, bin) {
+  const argv = ctx.host.platform === "windows" ? ["where", bin] : ["which", bin];
+  const res = await ctx.run(argv);
+  return !res.spawnError && res.code === 0 && res.stdout.trim().length > 0;
+}
+async function detectPms(ctx) {
+  const found = /* @__PURE__ */ new Set();
+  await Promise.all(
+    PM_BINARIES.map(async ([bin, key]) => {
+      if (await onPath3(ctx, bin)) found.add(key);
+    })
+  );
+  return found;
+}
+async function missingTools(ctx) {
+  const checked = await Promise.all(
+    TOOLS.map(async (t) => ({ t, present: await onPath3(ctx, t.bin) }))
+  );
+  return checked.filter((c) => !c.present).map((c) => c.t);
+}
+function chooseOption(t, pms) {
+  return t.options.find((o) => pms.has(o.pm));
+}
+var WIN_CMD_SHIMS = /* @__PURE__ */ new Set(["npm", "npx", "pnpm", "scoop", "yarn"]);
+function execArgv(platform, argv) {
+  return platform === "windows" && argv[0] !== void 0 && WIN_CMD_SHIMS.has(argv[0]) ? ["cmd", "/c", ...argv] : argv;
+}
+function installActionsFor(ctx, tools, pms) {
+  const actions = [];
+  for (const t of tools) {
+    const opt = chooseOption(t, pms);
+    if (opt) {
+      actions.push(
+        exec(`install ${t.tool} (${opt.pm})`, execArgv(ctx.host.platform, opt.argv), {
+          allowFailure: true
+        })
+      );
+    } else {
+      actions.push(
+        doc(
+          `install ${t.tool} manually (no supported package manager found)`,
+          `No detected package manager can install ${t.tool}. Install it manually: ${t.manual}`
+        )
+      );
+    }
+  }
+  return actions;
+}
+function howToInstall(t, pms) {
+  const opt = chooseOption(t, pms);
+  return opt ? `\`${opt.argv.join(" ")}\`` : `manually \u2014 ${t.manual}`;
+}
+async function verifyTool(ctx, t, pms) {
+  if (await onPath3(ctx, t.bin)) {
+    return { name: t.tool, verdict: "pass", detail: `${t.bin} on PATH` };
+  }
+  return {
+    name: t.tool,
+    verdict: t.tier === "core" ? "fail" : "skip",
+    detail: `${t.bin} not on PATH \u2014 install: ${howToInstall(t, pms)}`,
+    code: "env.tool-install-blocked"
+  };
+}
+
+// src/ready/index.ts
+function handoffLine(firstCommand) {
+  return firstCommand ? `Your first command:  ${firstCommand}   (declared in the repo \u2014 this runs the real work; aih stops here)` : "No runnable command declared \u2014 see setup.md before starting.";
+}
+function gateCheck(r) {
+  const name = "readiness \u2014 no blockers";
+  if (r.blockers.length > 0) {
+    return {
+      name,
+      verdict: "fail",
+      detail: `${r.blockers.length} blocker(s): ${r.blockers.map((b) => b.id).join(", ")}`,
+      code: "ready.blocked"
+    };
+  }
+  return { name, verdict: "pass", detail: "no blockers \u2014 an agent can start here" };
+}
+function specsForMissing(missingBins) {
+  const want = new Set(missingBins);
+  return TOOLS.filter((t) => want.has(t.bin));
+}
+async function shouldInstall(ctx, bins) {
+  if (ctx.apply) return true;
+  if (!ctx.prompter) return false;
+  const answer = await ctx.prompter.ask(`Install ${bins.join(", ")} now? [y/N]: `);
+  const yes = answer.trim().toLowerCase();
+  return yes === "y" || yes === "yes";
+}
+async function coreToolInstallActions(ctx, specs) {
+  const pms = await detectPms(ctx);
+  const actions = installActionsFor(ctx, specs, pms);
+  for (const t of specs) {
+    actions.push(probe(`${t.tool} installed`, (c) => verifyTool(c, t, pms)));
+  }
+  actions.push(
+    doc(
+      "core tools \u2014 re-run to confirm",
+      "Installed the missing core shell tools. Re-run `aih ready` to confirm the readiness gate now passes."
+    )
+  );
+  return actions;
+}
+async function readyPlan(ctx) {
+  const r = await computeReadiness(ctx);
+  const body = `${renderReadinessBody(r)}
+${handoffLine(r.firstCommand)}
+`;
+  const data = {
+    banner: r.banner,
+    blockers: r.blockers,
+    warns: r.warns,
+    score: r.score,
+    rawScore: r.rawScore,
+    grade: r.grade,
+    firstCommand: r.firstCommand
+  };
+  const actions = [
+    digest("Developer readiness", body, data),
+    probe("readiness \u2014 no blockers", () => gateCheck(r))
+  ];
+  const missingCore = await coreToolsMissing(ctx);
+  if (missingCore.length > 0 && await shouldInstall(ctx, missingCore)) {
+    ctx.apply = true;
+    actions.push(...await coreToolInstallActions(ctx, specsForMissing(missingCore)));
+  }
+  return plan("ready", ...actions);
+}
+var command25 = {
+  name: "ready",
+  summary: "Readiness gate \u2014 can a developer start work with an AI agent here? (graded, blocker-aware)",
+  alwaysVerify: true,
+  // Offer the "Install rg, fd, jq now? [y/N]" confirmation on a bare `aih ready` in a
+  // TTY (not just under `--detect`) — the install is what a first-time repo opener wants.
+  wantsInstallPrompt: true,
+  plan: readyPlan
+};
+
+// src/report/index.ts
+import { existsSync as existsSync29, readFileSync as readFileSync6 } from "fs";
+import { basename as basename7, join as join55, resolve as resolve11 } from "path";
+
+// src/support/findings.ts
+var NO_CODE_CHANGES = "No project code changes are required.";
+var CODE_META = {
+  "env.node-runtime": {
+    audience: "internal-it",
+    failSeverity: "blocking",
+    title: "required language runtime missing or unsupported",
+    affectedArea: "local developer tooling",
+    evidence: "The required language runtime (Node.js 20 or newer) is missing or below the supported version on this machine.",
+    action: "Please provision the supported language runtime on this machine via the approved software catalog or installer, then have the developer reopen their shell.",
+    acceptance: [
+      "The supported runtime version is available on this machine.",
+      "Project setup checks pass without further manual steps.",
+      NO_CODE_CHANGES
+    ]
+  },
+  "env.git-missing": {
+    audience: "developer",
+    failSeverity: "degraded",
+    title: "git not found on PATH",
+    action: "Install git (winget/apt/brew or your software catalog) and reopen the shell."
+  },
+  "env.dev-tool-missing": {
+    audience: "developer",
+    failSeverity: "degraded",
+    title: "Dev tools (rg/fd/jq) missing",
+    action: "Install rg/fd/jq (winget/scoop/brew), or on a locked-down VDI add your local bundle to PATH."
+  },
+  "env.tool-install-blocked": {
+    audience: "internal-it",
+    failSeverity: "degraded",
+    title: "required developer tool could not be installed",
+    affectedArea: "local developer tooling / software installation",
+    evidence: "A required command-line tool is not available, and an automated install could not complete on this machine (no supported package manager is present, privileges are insufficient, or the package source is blocked).",
+    action: "Please provision the missing tool via the approved software catalog / package manager, or unblock the package source on this machine so the developer can install it.",
+    acceptance: [
+      "The tool resolves on PATH.",
+      "Project tooling checks pass without further manual steps.",
+      NO_CODE_CHANGES
+    ]
+  },
+  "cert.ca-missing": {
+    audience: "internal-it",
+    failSeverity: "blocking",
+    title: "corporate CA not trusted by development tools",
+    affectedArea: "workstation certificate trust / development toolchain trust",
+    evidence: "TLS verification is failing because the approved corporate CA is not available to the tools running on this machine.\nThe Node CA bundle setting (NODE_EXTRA_CA_CERTS) is not set or does not point to a valid corporate CA bundle.",
+    action: "Please make the approved corporate root certificate authority available on this machine and configure the development tools to trust it. For Node-based tools, this usually means setting NODE_EXTRA_CA_CERTS to the approved corporate CA bundle path, in addition to any required OS trust-store configuration.",
+    acceptance: [
+      "Development tools can complete TLS verification against approved internal and package sources.",
+      "Package access works without disabling TLS checks.",
+      NO_CODE_CHANGES
+    ]
+  },
+  "tls.verify-failed": {
+    audience: "internal-it",
+    failSeverity: "blocking",
+    title: "TLS verification to approved package sources is failing",
+    affectedArea: "workstation certificate trust / development toolchain trust",
+    evidence: "TLS connections to approved package registries are failing on this machine, consistent with an intercepting proxy whose certificate is not trusted by the development tools.",
+    action: "Please ensure the intercepting proxy's certificate is trusted on this machine (OS trust store and the development toolchain) and that the approved package registry endpoints are reachable.",
+    acceptance: [
+      "Development tools can complete TLS verification against approved internal and package sources.",
+      "Package access works without disabling TLS checks.",
+      NO_CODE_CHANGES
+    ]
+  },
+  "npm.runtime-broken": {
+    audience: "internal-it",
+    failSeverity: "blocking",
+    title: "package manager is broken on this machine",
+    affectedArea: "approved package registry access",
+    evidence: "The package manager fails to run or cannot install from approved registries on this machine.",
+    action: "Please repair the package manager installation on this machine so it runs and can install from approved registries; if the registry is unreachable, restore corporate TLS trust first.",
+    acceptance: [
+      "The package manager runs and can install from approved sources.",
+      "No TLS checks are disabled to achieve this.",
+      NO_CODE_CHANGES
+    ]
+  },
+  "path.missing": {
+    audience: "developer",
+    failSeverity: "degraded",
+    title: "Tool directory not on PATH",
+    action: "Add the user tool directory to PATH (see `aih heal`) and reopen the shell."
+  },
+  "mcp.blocked": {
+    audience: "dev-platform",
+    failSeverity: "blocking",
+    title: "package launcher cannot reach the approved registry",
+    affectedArea: "approved package registry access",
+    evidence: "The developer-platform package launcher cannot reach the approved package registry on this machine.",
+    action: "Please restore access from this machine to the approved package registry for the launcher (certificate trust plus endpoint allowlisting), or approve a vendored, locally-installed server set.",
+    acceptance: [
+      "The launcher can reach approved package sources.",
+      "No TLS checks are disabled to achieve this.",
+      NO_CODE_CHANGES
+    ]
+  },
+  "mcp.uv-missing": {
+    audience: "dev-platform",
+    failSeverity: "degraded",
     title: "required package launcher not available",
     affectedArea: "MCP / developer platform configuration",
     evidence: "A required package launcher (uv) is not available on this machine.",
@@ -13859,6 +14767,12 @@ var CODE_META = {
     title: "repo contract reports a non-portable path",
     action: "`aih report` found a non-portable path in the committed `project.json`. Re-run `aih contract --apply` to regenerate it from the live tree; verify with `aih doctor` (the `contract truth` probe)."
   },
+  "ready.blocked": {
+    audience: "developer",
+    failSeverity: "blocking",
+    title: "developer readiness is blocked",
+    action: "`aih ready` found one or more blockers that stop an agent from starting here. Clear each named blocker with its own fix (see the readiness digest \u2014 e.g. `aih heal`, `aih contract --apply`, `aih secrets --apply`, `aih bootstrap-ai --apply`), then re-run `aih ready`."
+  },
   "trust.hidden-unicode": {
     audience: "developer",
     failSeverity: "blocking",
@@ -14602,7 +15516,7 @@ var TOOL_HINTS = {
   comby: "comby \u2014 brew install comby \xB7 bash <(curl -sL get.comby.dev)",
   jq: "jq \u2014 brew install jq \xB7 apt install jq \xB7 scoop install jq",
   gh: "GitHub CLI \u2014 brew install gh \xB7 winget install GitHub.cli \xB7 cli.github.com",
-  "code-review-graph": "pip install code-review-graph (or uvx code-review-graph serve)",
+  "code-review-graph": "pip install code-review-graph==2.3.6 (or uvx code-review-graph@2.3.6 serve)",
   claude: "Claude Code \u2014 npm i -g @anthropic-ai/claude-code",
   codex: "Codex CLI \u2014 npm i -g @openai/codex",
   cursor: "Cursor editor \u2014 cursor.com",
@@ -15107,14 +16021,14 @@ function buildHero(digests) {
   return `<section class="hero">${adoptionPct !== void 0 ? `<div class="ring-card">${ring(adoptionPct)}<span class="ring-label">adoption</span></div>` : ""}<div class="kpis">${tiles.join("")}</div></section>`;
 }
 var BRAND = "Enterprise AI Bootstrapping Harness Report";
-var KIND_LABEL = {
+var KIND_LABEL2 = {
   escalation: "Escalation",
   improvement: "Improvement",
   "self-fix": "Self-fix"
 };
 function ticketCard(t) {
   const isSelf = t.kind === "self-fix";
-  const kindLabel = KIND_LABEL[t.kind] ?? t.kind;
+  const kindLabel = KIND_LABEL2[t.kind] ?? t.kind;
   const copyLabel = isSelf ? "Copy note" : "Copy email";
   const full = `${t.subject}
 
@@ -15182,8 +16096,8 @@ function reportHtml(title, digests, opts = {}) {
 }
 
 // src/report/bloat.ts
-import { readdirSync as readdirSync8, statSync as statSync4 } from "fs";
-import { join as join43 } from "path";
+import { readdirSync as readdirSync9, statSync as statSync4 } from "fs";
+import { join as join46 } from "path";
 var CHARS_PER_TOKEN = 4;
 var DEFAULT_CONTEXT_BUDGET_TOKENS = 4e4;
 var ROOT_CONTEXT_FILES = [
@@ -15196,7 +16110,7 @@ var ROOT_CONTEXT_FILES = [
 var EXTRA_CONTEXT_DIRS = [".cursor/rules"];
 function safeReadDir2(dir) {
   try {
-    return readdirSync8(dir).sort();
+    return readdirSync9(dir).sort();
   } catch {
     return [];
   }
@@ -15217,10 +16131,10 @@ function isDir2(path) {
   }
 }
 function walk2(root, relDir, out) {
-  const absDir = join43(root, relDir);
+  const absDir = join46(root, relDir);
   for (const entry2 of safeReadDir2(absDir)) {
     const rel = `${relDir}/${entry2}`;
-    if (isDir2(join43(absDir, entry2))) walk2(root, rel, out);
+    if (isDir2(join46(absDir, entry2))) walk2(root, rel, out);
     else out.push(rel);
   }
 }
@@ -15228,14 +16142,14 @@ function estimateTokens(bytes) {
   return Math.ceil(bytes / CHARS_PER_TOKEN);
 }
 function fileFootprint(root, rel) {
-  const bytes = fileSize(join43(root, rel));
+  const bytes = fileSize(join46(root, rel));
   return bytes === void 0 ? void 0 : { path: rel, bytes, tokens: estimateTokens(bytes) };
 }
 function scanContextBloat(root, contextDir, budgetTokens = DEFAULT_CONTEXT_BUDGET_TOKENS, opts = {}) {
   const accept = opts.accept ?? (() => true);
   const rels = new Set(ROOT_CONTEXT_FILES);
   for (const dir of [contextDir, ...EXTRA_CONTEXT_DIRS]) {
-    if (!isDir2(join43(root, dir))) continue;
+    if (!isDir2(join46(root, dir))) continue;
     const found = [];
     walk2(root, dir, found);
     for (const rel of found) rels.add(rel);
@@ -15351,53 +16265,11 @@ function scanLoadGroups(root, contextDir, budgetTokens, opts = {}) {
     worst,
     worstTokens,
     budgetTokens,
-    overBudget: worstTokens > budgetTokens,
-    onDemandFiles,
-    onDemandTokens: onDemandFiles.reduce((n, f) => n + f.tokens, 0)
-  };
-}
-
-// src/status.ts
-import { existsSync as existsSync22 } from "fs";
-import { join as join44 } from "path";
-var ARTIFACTS = [
-  ["context-dir", ""],
-  // resolved against ctx.contextDir below
-  ["gitleaks", ".gitleaks.toml"],
-  ["pre-commit", ".pre-commit-config.yaml"],
-  ["devcontainer", ".devcontainer/devcontainer.json"]
-];
-function inventory(root, contextDir) {
-  return ARTIFACTS.map(([name, rel]) => {
-    const relative10 = name === "context-dir" ? contextDir : rel;
-    return { name, relative: relative10, present: existsSync22(join44(root, relative10)) };
-  });
-}
-function enforcementDetail(name, root, relative10) {
-  if (name === "pre-commit") {
-    return preCommitHookActive(root) ? `${relative10} (git hook installed \u2014 active)` : `${relative10} present, but no active git pre-commit hook was found \u2014 run \`${GITHOOKS_PATH_COMMAND}\` after scaffold`;
-  }
-  return relative10;
+    overBudget: worstTokens > budgetTokens,
+    onDemandFiles,
+    onDemandTokens: onDemandFiles.reduce((n, f) => n + f.tokens, 0)
+  };
 }
-var command23 = {
-  name: "status",
-  summary: "Show what the harness has configured for this repo/workstation (read-only)",
-  readOnly: true,
-  options: [],
-  plan: (ctx) => plan(
-    "status",
-    ...inventory(ctx.root, ctx.contextDir).map(
-      (a) => probe(
-        `presence: ${a.name}`,
-        () => a.present ? {
-          name: a.name,
-          verdict: "pass",
-          detail: enforcementDetail(a.name, ctx.root, a.relative)
-        } : { name: a.name, verdict: "skip", detail: `${a.relative} not present` }
-      )
-    )
-  )
-};
 
 // src/report/events.ts
 var SHOWN = 50;
@@ -15605,7 +16477,7 @@ function governanceRollupDigest(ctx) {
 }
 
 // src/report/graph.ts
-import { join as join45 } from "path";
+import { join as join47 } from "path";
 function parseStats(text) {
   try {
     const v = JSON.parse(text);
@@ -15623,7 +16495,7 @@ function parseStats(text) {
   }
 }
 function readGraph(ctx) {
-  const file = readIfExists(join45(ctx.root, ".aih", "graph.json"));
+  const file = readIfExists(join47(ctx.root, ".aih", "graph.json"));
   return file ? parseStats(file) : void 0;
 }
 async function graphDigests(ctx) {
@@ -15658,7 +16530,7 @@ async function graphDigests(ctx) {
 }
 
 // src/report/guardrail.ts
-import { join as join46 } from "path";
+import { join as join48 } from "path";
 function parseCounts(text) {
   try {
     const v = JSON.parse(text);
@@ -15673,7 +16545,7 @@ function parseCounts(text) {
   }
 }
 function guardrailDigest(ctx) {
-  const file = readIfExists(join46(ctx.root, ".aih", "guardrail-scan.json"));
+  const file = readIfExists(join48(ctx.root, ".aih", "guardrail-scan.json"));
   if (!file) return void 0;
   const c = parseCounts(file);
   if (!c) return void 0;
@@ -15692,37 +16564,16 @@ function guardrailDigest(ctx) {
 }
 
 // src/report/history.ts
-import { existsSync as existsSync24 } from "fs";
-import { join as join48 } from "path";
+import { existsSync as existsSync25 } from "fs";
+import { join as join50 } from "path";
 
 // src/report/scorecard.ts
-import { existsSync as existsSync23, readdirSync as readdirSync9 } from "fs";
-import { join as join47 } from "path";
+import { existsSync as existsSync24, readdirSync as readdirSync10 } from "fs";
+import { join as join49 } from "path";
 var ADAPTER_MAX_LINES = 75;
-var GRADE_BANDS = [
-  { min: 85, grade: "mature" },
-  { min: 70, grade: "solid" },
-  { min: 50, grade: "emerging" },
-  { min: 0, grade: "nascent" }
-];
-function gradeOf(score) {
-  for (const b of GRADE_BANDS) if (score >= b.min) return b.grade;
-  return "nascent";
-}
-function dimScore(checks) {
-  if (checks.length === 0) return 0;
-  const passed = checks.filter((c) => c.passed).length;
-  return Math.round(passed / checks.length * 100);
-}
-function check(id, passed, remediation, source) {
-  return { id, passed, remediation, source };
-}
-function dim(name, weight, checks) {
-  return { name, weight, score: dimScore(checks), checks };
-}
 function bootloadersInSync(root, present, sharedBody) {
   for (const rel of present) {
-    const text = readIfExists(join47(root, rel));
+    const text = readIfExists(join49(root, rel));
     if (text === void 0) continue;
     if (extractManagedBlock(text, SHARED_MARKER) !== sharedBody) return false;
   }
@@ -15730,23 +16581,23 @@ function bootloadersInSync(root, present, sharedBody) {
 }
 function bootloadersPointToRouter(root, present) {
   for (const rel of present) {
-    const text = readIfExists(join47(root, rel));
+    const text = readIfExists(join49(root, rel));
     if (text === void 0) continue;
     if (!text.includes("RULE_ROUTER.md")) return false;
   }
   return true;
 }
 function adaptersThin(root, dir) {
-  const adaptersDir = join47(root, dir, "adapters");
+  const adaptersDir = join49(root, dir, "adapters");
   let entries;
   try {
-    entries = readdirSync9(adaptersDir);
+    entries = readdirSync10(adaptersDir);
   } catch {
     return true;
   }
   for (const name of entries) {
     if (!name.endsWith(".md")) continue;
-    const text = readIfExists(join47(adaptersDir, name));
+    const text = readIfExists(join49(adaptersDir, name));
     if (text === void 0) continue;
     const count = text.replace(/\r\n/g, "\n").split("\n").length;
     if (count > ADAPTER_MAX_LINES) return false;
@@ -15802,20 +16653,20 @@ function buildDimensions(ctx) {
   const { root, contextDir: dir } = ctx;
   const inv = inventory(root, dir);
   const has = (name) => inv.find((i) => i.name === name)?.present ?? false;
-  const present = bootloaderPaths(SUPPORTED_CLIS).filter((rel) => existsSync23(join47(root, rel)));
+  const present = bootloaderPaths(SUPPORTED_CLIS).filter((rel) => existsSync24(join49(root, rel)));
   const sharedBody = sharedCanonicalBlockBody(dir).trim();
   const preCommitHook2 = preCommitHookActive(root);
   return [
     dim("layering", 1, [
       check(
         "router-present",
-        existsSync23(join47(root, dir, "RULE_ROUTER.md")),
+        existsSync24(join49(root, dir, "RULE_ROUTER.md")),
         "run: aih scaffold --apply",
         `${dir}/RULE_ROUTER.md`
       ),
       check(
         "core-rules-doc",
-        existsSync23(join47(root, dir, "rules", "agent-behavior-core.md")),
+        existsSync24(join49(root, dir, "rules", "agent-behavior-core.md")),
         "run: aih scaffold --apply",
         `${dir}/rules/agent-behavior-core.md`
       )
@@ -15823,7 +16674,7 @@ function buildDimensions(ctx) {
     dim("sharing", 1, [
       check(
         "shared-block-source",
-        existsSync23(join47(root, dir, "adapters", "_shared-canonical-block.md")),
+        existsSync24(join49(root, dir, "adapters", "_shared-canonical-block.md")),
         "run: aih scaffold --apply",
         `${dir}/adapters/_shared-canonical-block.md`
       ),
@@ -15865,7 +16716,7 @@ function buildDimensions(ctx) {
     dim("discoverability", 0.5, [
       check(
         "regeneration-doc",
-        existsSync23(join47(root, dir, "REGENERATION.md")),
+        existsSync24(join49(root, dir, "REGENERATION.md")),
         "run: aih scaffold --apply",
         `${dir}/REGENERATION.md`
       ),
@@ -15889,7 +16740,7 @@ function buildDimensions(ctx) {
 }
 var mark = (score) => score >= 70 ? "\u2713" : score >= 50 ? "~" : "\xB7";
 function scorecardDigest(ctx) {
-  if (!existsSync23(join47(ctx.root, ctx.contextDir, "RULE_ROUTER.md"))) return void 0;
+  if (!existsSync24(join49(ctx.root, ctx.contextDir, "RULE_ROUTER.md"))) return void 0;
   const dims = buildDimensions(ctx);
   const totalWeight = dims.reduce((n, d) => n + d.weight, 0);
   const overall = Math.round(dims.reduce((n, d) => n + d.score * d.weight, 0) / totalWeight);
@@ -15921,7 +16772,7 @@ function scorecardDigest(ctx) {
 }
 
 // src/report/history.ts
-var HISTORY_PATH = join48(".aih", "history.jsonl");
+var HISTORY_PATH = join50(".aih", "history.jsonl");
 var TREND_WINDOW = 14;
 var SPARK = "\u2581\u2582\u2583\u2584\u2585\u2586\u2587\u2588";
 async function locDelta(ctx) {
@@ -15936,11 +16787,11 @@ async function locDelta(ctx) {
   return { added, removed, net: added - removed };
 }
 function countDrift(ctx) {
-  if (!existsSync24(join48(ctx.root, ctx.contextDir, "RULE_ROUTER.md"))) return 0;
+  if (!existsSync25(join50(ctx.root, ctx.contextDir, "RULE_ROUTER.md"))) return 0;
   const sharedBody = sharedCanonicalBlockBody(ctx.contextDir).trim();
   let n = 0;
   for (const rel of bootloaderPaths(SUPPORTED_CLIS)) {
-    const text = readIfExists(join48(ctx.root, rel));
+    const text = readIfExists(join50(ctx.root, rel));
     if (text === void 0) continue;
     const block = extractManagedBlock(text, SHARED_MARKER);
     if (block !== void 0 && block.trim() !== sharedBody) n++;
@@ -15987,7 +16838,7 @@ async function collectSnapshot(ctx) {
   };
 }
 function readHistory(ctx) {
-  const raw = readIfExists(join48(ctx.root, HISTORY_PATH));
+  const raw = readIfExists(join50(ctx.root, HISTORY_PATH));
   if (!raw) return [];
   const rows = [];
   for (const line of raw.split(/\r?\n/)) {
@@ -16313,13 +17164,13 @@ function leakPreventionsDigest(ctx) {
 // src/report/tools.ts
 var CORE_TOOLS = ["rg", "fd", "jq"];
 var OPTIONAL_TOOLS = ["sg", "comby", "tree", "gh", "code-review-graph"];
-async function onPath3(ctx, bin) {
+async function onPath4(ctx, bin) {
   const argv = ctx.host.platform === "windows" ? ["where", bin] : ["which", bin];
   const res = await ctx.run(argv);
   return !res.spawnError && res.code === 0 && res.stdout.trim().length > 0;
 }
 async function toolsInstalledDigest(ctx) {
-  const check2 = (name) => onPath3(ctx, name).then((present) => ({ name, present }));
+  const check2 = (name) => onPath4(ctx, name).then((present) => ({ name, present }));
   const core = await Promise.all(CORE_TOOLS.map(check2));
   const optional = await Promise.all(OPTIONAL_TOOLS.map(check2));
   const corePresent = core.filter((r) => r.present);
@@ -16353,13 +17204,13 @@ async function toolsInstalledDigest(ctx) {
 }
 
 // src/report/usage.ts
-import { existsSync as existsSync25 } from "fs";
-import { join as join49 } from "path";
-var RECORDER_PATH2 = join49(".aih", "usage-record.mjs");
-var GIT_POST_COMMIT_PATH = join49(".git", "hooks", "post-commit");
+import { existsSync as existsSync26 } from "fs";
+import { join as join51 } from "path";
+var RECORDER_PATH2 = join51(".aih", "usage-record.mjs");
+var GIT_POST_COMMIT_PATH = join51(".git", "hooks", "post-commit");
 function usageCaptureInstalled(ctx) {
-  if (!existsSync25(join49(ctx.root, RECORDER_PATH2))) return false;
-  return readIfExists(join49(ctx.root, GIT_POST_COMMIT_PATH))?.includes("usage-record.mjs") === true;
+  if (!existsSync26(join51(ctx.root, RECORDER_PATH2))) return false;
+  return readIfExists(join51(ctx.root, GIT_POST_COMMIT_PATH))?.includes("usage-record.mjs") === true;
 }
 var bar = (items, label) => {
   if (items.length === 0) return [`  ${label}: (none captured yet)`];
@@ -19007,6 +19858,14 @@ var V9_DEMO = {
     deltas: ["\u25B2 +4 vs last run", "per-turn \u22123%", "drift 1\u21921", "5 open actions"],
     usageThisWeek: { actions: 1204, wowPct: 18 }
   },
+  // Coherent with the rest of the demo: the host blockers `wins` shows were all healed,
+  // so an agent can start (READY, WITH GAPS) — the guardrails gap is a warn, not a gate.
+  ready: {
+    banner: "READY, WITH GAPS",
+    score: 88,
+    grade: "solid",
+    blockers: []
+  },
   actions: [
     {
       sev: "high",
@@ -19030,7 +19889,7 @@ var V9_DEMO = {
       sev: "low",
       title: "Vet context7 MCP egress",
       body: "context7 is third-party egress \u2014 confirm approved.",
-      cmd: "aih mcp --review"
+      cmd: "aih mcp --verify"
     },
     {
       sev: "low",
@@ -19217,6 +20076,7 @@ var V9_DEMO = {
   },
   gates: {
     "sec-hero": "live",
+    "sec-ready": "live",
     "sec-actions": "live",
     "sec-wins": "live",
     "sec-context": "live",
@@ -19298,6 +20158,36 @@ function renderHero(h) {
   const worstSvg = '<svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" style="color:var(--warn)"><path d="M12 9v4M12 17h.01M10.3 3.9 1.8 18a2 2 0 0 0 1.7 3h17a2 2 0 0 0 1.7-3L13.7 3.9a2 2 0 0 0-3.4 0z"/></svg>';
   return `<span class="hero-eyebrow">Harness wiring \xB7 developer console</span><h2 class="hero-headline">${headline}</h2><p class="hero-sub">${sub}</p><div class="hero-score-row"><span class="hero-score-big">${h.wiringScore}<span class="of">/100</span></span><span class="hero-score-tier">${escHtml2(h.scoreLabel)}</span></div><div class="deltarow">${deltas}</div>${usage}<div class="worst">${worstSvg}<span>Weakest axis: <b>${escHtml2(h.worstAxis.name)} ${h.worstAxis.value}</b> \u2014 closing it moves the score most.</span></div><p class="hero-sub" style="font-size:.74rem;color:var(--dim);margin-top:.3rem">Score = harness <b>wiring present + in sync</b>, not rule quality.</p>`;
 }
+var ICON_READY = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M20 6 9 17l-5-5"/></svg>';
+var ICON_NOT_READY = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><path d="m15 9-6 6M9 9l6 6"/></svg>';
+var ICON_GAPS = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M10.3 3.9 1.8 18a2 2 0 0 0 1.7 3h17a2 2 0 0 0 1.7-3L13.7 3.9a2 2 0 0 0-3.4 0z"/><path d="M12 9v4M12 17h.01"/></svg>';
+function readyStyle(banner) {
+  if (banner === "READY") return { cls: "ok", icon: ICON_READY };
+  if (banner === "NOT READY") return { cls: "bad", icon: ICON_NOT_READY };
+  return { cls: "warn", icon: ICON_GAPS };
+}
+function renderReady(r) {
+  const { cls, icon } = readyStyle(r.banner);
+  const softVar = `var(--${cls}-soft)`;
+  const strongVar = `var(--${cls})`;
+  const sub = r.banner === "READY" ? "an agent can make a correct first change here" : r.banner === "NOT READY" ? "a blocker below stops an agent from working" : "an agent can work, but with gaps in the gears";
+  const badge = `<span class="badge ${cls}">${r.score}/100 \xB7 ${escHtml2(r.grade)}</span>`;
+  const statusBox = `<div class="drift-status" style="background:${softVar};border-color:color-mix(in oklab,${strongVar} 22%,transparent)"><div class="dicon" style="background:${strongVar}">${icon}</div><div class="dtext"><b style="color:${strongVar}">${escHtml2(r.banner)}</b><span>${sub}</span></div></div>`;
+  const scoreRow = `<div class="donut-meta" style="margin-top:.6rem"><div class="row"><span class="k">Readiness score</span><span class="v">${r.score}/100 (${escHtml2(r.grade)})</span></div><div class="row"><span class="k">Blockers</span><span class="v" style="color:${r.blockers.length > 0 ? "var(--bad)" : "var(--ok)"}">${r.blockers.length === 0 ? "none" : `${r.blockers.length} \u2014 must fix`}</span></div></div>`;
+  const verdict = `<div class="card span-5"><div class="card-head"><h3>Can I start?</h3>${badge}</div><div class="card-body">${statusBox}${scoreRow}<div class="method" style="margin-top:.6rem">Same gate as <code>aih ready</code> \u2014 machine \xB7 repo-contract \xB7 harness-wiring, over aih's read-only probes.</div></div></div>`;
+  let blockersBody;
+  if (r.blockers.length === 0) {
+    blockersBody = `<div class="drift-status"><div class="dicon">${ICON_READY}</div><div class="dtext"><b>No blockers</b><span>nothing stops an agent from working here</span></div></div>`;
+  } else {
+    const rows = r.blockers.map(
+      (b) => `<div class="drift-file"><span class="fd" style="background:var(--bad)"></span><span class="fn">${escHtml2(b.title)}</span><span class="fs"><code style="${CODE_STYLE}">${escHtml2(b.cmd)}</code></span><span class="ft bad">blocker</span></div>`
+    ).join("");
+    blockersBody = `<div class="drift-files">${rows}</div><div class="method" style="margin-top:.6rem">${r.blockers.length} blocker${r.blockers.length === 1 ? "" : "s"} above; see <b>What to fix first</b> for the full ranked list.</div>`;
+  }
+  const blockerBadge = r.blockers.length > 0 ? `<span class="badge bad">${r.blockers.length} blocker${r.blockers.length === 1 ? "" : "s"}</span>` : '<span class="badge ok">clear</span>';
+  const blockers = `<div class="card span-7"><div class="card-head"><h3>Blockers \xB7 must fix before an agent can work</h3>${blockerBadge}</div><div class="card-body">${blockersBody}</div></div>`;
+  return verdict + blockers;
+}
 var SEV_CARD = {
   high: {
     cls: "bad",
@@ -20147,7 +21037,7 @@ body[data-demo="on"] .demo-banner{display:flex}
     <div class="worst"><svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" style="color:var(--warn)"><path d="M12 9v4M12 17h.01M10.3 3.9 1.8 18a2 2 0 0 0 1.7 3h17a2 2 0 0 0 1.7-3L13.7 3.9a2 2 0 0 0-3.4 0z"/></svg><span>Weakest axis: <b>Guardrails 40</b> \u2014 closing it moves the score most.</span></div>
     <p class="hero-sub" style="font-size:.74rem;color:var(--dim);margin-top:.3rem">Score = harness <b>wiring present + in sync</b>, not rule quality.</p>
   </div>
-</section><section class="section" id="sec-actions"><div class="sec-head"><div class="sec-eyebrow"><span class="sec-no">\u2605</span><span class="sec-rule"></span><span class="sec-count">1 high \xB7 2 med \xB7 2 low</span></div><h2 class="sec-title">What to fix first \u2014 5 ranked actions</h2><p class="sec-insight">The spine of this report: every finding below, triaged by leverage, each with the exact command. When this list is empty, the harness is clean \u2014 nothing else here needs your attention.</p></div><div class="anom-strip"><div class="anom-card bad"><div class="anom-head"><div class="anom-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M10.3 3.9 1.8 18a2 2 0 0 0 1.7 3h17a2 2 0 0 0 1.7-3L13.7 3.9a2 2 0 0 0-3.4 0z"/><path d="M12 9v4M12 17h.01"/></svg></div><h4>Wire guardrails</h4><span class="sev">high</span></div><p class="anom-body">Guardrails at <b>40/100</b> \u2014 gitleaks config present but the pre-commit hook is <b>not installed</b> (present \u2260 enforced). Highest leverage + closes a real security gap.</p><div class="anom-evidence"><code style="font-family:var(--mono);font-size:.7rem;background:var(--surface-3);border:1px solid var(--border-2);padding:.2rem .5rem;border-radius:5px;color:var(--fg-2);white-space:nowrap;overflow:auto;flex:1">aih bootstrap-ai --scope guardrails --apply</code></div></div><div class="anom-card warn"><div class="anom-head"><div class="anom-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><path d="M12 8v4M12 16h.01"/></svg></div><h4>Add AGENTS.md</h4><span class="sev">med</span></div><p class="anom-body">Missing bootloader \u2014 <b>codex, opencode, zed</b> cannot load canon here. Only failing adoption check.</p><div class="anom-evidence"><code style="font-family:var(--mono);font-size:.7rem;background:var(--surface-3);border:1px solid var(--border-2);padding:.2rem .5rem;border-radius:5px;color:var(--fg-2);white-space:nowrap;overflow:auto;flex:1">aih scaffold --cli codex --apply</code></div></div><div class="anom-card warn"><div class="anom-head"><div class="anom-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><path d="M12 8v4M12 16h.01"/></svg></div><h4>Realign drifted canon</h4><span class="sev">med</span></div><p class="anom-body"><code>RULE_ROUTER.md</code> is <b>+42 tok</b> out of sync (2h). Realign before it reaches the other CLIs.</p><div class="anom-evidence"><code style="font-family:var(--mono);font-size:.7rem;background:var(--surface-3);border:1px solid var(--border-2);padding:.2rem .5rem;border-radius:5px;color:var(--fg-2);white-space:nowrap;overflow:auto;flex:1">aih bootstrap-ai --apply</code></div></div><div class="anom-card ok"><div class="anom-head"><div class="anom-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="m9 18 6-6-6-6"/></svg></div><h4>Vet context7 MCP egress</h4><span class="sev">low</span></div><p class="anom-body">context7 is a <b>third-party</b> MCP server (sends queries off-box). Confirm it is approved for this repo.</p><div class="anom-evidence"><code style="font-family:var(--mono);font-size:.7rem;background:var(--surface-3);border:1px solid var(--border-2);padding:.2rem .5rem;border-radius:5px;color:var(--fg-2);white-space:nowrap;overflow:auto;flex:1">aih mcp --review</code></div></div><div class="anom-card ok"><div class="anom-head"><div class="anom-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="m9 18 6-6-6-6"/></svg></div><h4>Wire usage + track hooks</h4><span class="sev">low</span></div><p class="anom-body">Activity, trends and time-to-green need the recorder + per-commit snapshots wired.</p><div class="anom-evidence"><code style="font-family:var(--mono);font-size:.7rem;background:var(--surface-3);border:1px solid var(--border-2);padding:.2rem .5rem;border-radius:5px;color:var(--fg-2);white-space:nowrap;overflow:auto;flex:1">aih usage --apply &amp;&amp; aih track --apply</code></div></div></div></section><section class="section" id="sec-wins"><div class="sec-head"><div class="sec-eyebrow"><span class="sec-no">\u2713</span><span class="sec-rule"></span><span class="sec-count">quick wins \xB7 since Jun 1</span></div><h2 class="sec-title">aih cleared 4 blockers to get you running</h2><p class="sec-insight">This is why aih exists. The runtime your AI tools assume \u2014 <b>corporate TLS trust, npm, PATH, MCP launch</b> \u2014 was broken on this host; aih diagnosed and repaired it, and has kept it green across <b>12 runs</b>. The cumulative payoff over the period, not just today.</p></div><div class="grid">
+</section><section class="section" id="sec-ready"><div class="sec-head"><div class="sec-eyebrow"><span class="sec-no">\u25C6</span><span class="sec-rule"></span><span class="sec-count">88/100 \xB7 solid</span></div><h2 class="sec-title">READY, WITH GAPS \u2014 an agent can start here</h2><p class="sec-insight">The single "can I start?" gate: the maturity score above rates harness <i>wiring</i>; this rates whether an agent can make a correct first change on THIS machine right now. A blocker is a hard stop \u2014 the full remediation list is in <b>What to fix first</b> below.</p></div><div class="grid"><div class="card span-5"><div class="card-head"><h3>Can I start?</h3><span class="badge warn">88/100 \xB7 solid</span></div><div class="card-body"><div class="drift-status" style="background:var(--warn-soft);border-color:color-mix(in oklab,var(--warn) 22%,transparent)"><div class="dicon" style="background:var(--warn)"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M10.3 3.9 1.8 18a2 2 0 0 0 1.7 3h17a2 2 0 0 0 1.7-3L13.7 3.9a2 2 0 0 0-3.4 0z"/><path d="M12 9v4M12 17h.01"/></svg></div><div class="dtext"><b style="color:var(--warn)">READY, WITH GAPS</b><span>an agent can work, but with gaps in the gears</span></div></div><div class="donut-meta" style="margin-top:.6rem"><div class="row"><span class="k">Readiness score</span><span class="v">88/100 (solid)</span></div><div class="row"><span class="k">Blockers</span><span class="v" style="color:var(--ok)">none</span></div></div><div class="method" style="margin-top:.6rem">Same gate as <code>aih ready</code> \u2014 machine \xB7 repo-contract \xB7 harness-wiring, over aih's read-only probes.</div></div></div><div class="card span-7"><div class="card-head"><h3>Blockers \xB7 must fix before an agent can work</h3><span class="badge ok">clear</span></div><div class="card-body"><div class="drift-status"><div class="dicon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M20 6 9 17l-5-5"/></svg></div><div class="dtext"><b>No blockers</b><span>nothing stops an agent from working here</span></div></div></div></div></div></section><section class="section" id="sec-actions"><div class="sec-head"><div class="sec-eyebrow"><span class="sec-no">\u2605</span><span class="sec-rule"></span><span class="sec-count">1 high \xB7 2 med \xB7 2 low</span></div><h2 class="sec-title">What to fix first \u2014 5 ranked actions</h2><p class="sec-insight">The spine of this report: every finding below, triaged by leverage, each with the exact command. When this list is empty, the harness is clean \u2014 nothing else here needs your attention.</p></div><div class="anom-strip"><div class="anom-card bad"><div class="anom-head"><div class="anom-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M10.3 3.9 1.8 18a2 2 0 0 0 1.7 3h17a2 2 0 0 0 1.7-3L13.7 3.9a2 2 0 0 0-3.4 0z"/><path d="M12 9v4M12 17h.01"/></svg></div><h4>Wire guardrails</h4><span class="sev">high</span></div><p class="anom-body">Guardrails at <b>40/100</b> \u2014 gitleaks config present but the pre-commit hook is <b>not installed</b> (present \u2260 enforced). Highest leverage + closes a real security gap.</p><div class="anom-evidence"><code style="font-family:var(--mono);font-size:.7rem;background:var(--surface-3);border:1px solid var(--border-2);padding:.2rem .5rem;border-radius:5px;color:var(--fg-2);white-space:nowrap;overflow:auto;flex:1">aih bootstrap-ai --scope guardrails --apply</code></div></div><div class="anom-card warn"><div class="anom-head"><div class="anom-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><path d="M12 8v4M12 16h.01"/></svg></div><h4>Add AGENTS.md</h4><span class="sev">med</span></div><p class="anom-body">Missing bootloader \u2014 <b>codex, opencode, zed</b> cannot load canon here. Only failing adoption check.</p><div class="anom-evidence"><code style="font-family:var(--mono);font-size:.7rem;background:var(--surface-3);border:1px solid var(--border-2);padding:.2rem .5rem;border-radius:5px;color:var(--fg-2);white-space:nowrap;overflow:auto;flex:1">aih scaffold --cli codex --apply</code></div></div><div class="anom-card warn"><div class="anom-head"><div class="anom-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><path d="M12 8v4M12 16h.01"/></svg></div><h4>Realign drifted canon</h4><span class="sev">med</span></div><p class="anom-body"><code>RULE_ROUTER.md</code> is <b>+42 tok</b> out of sync (2h). Realign before it reaches the other CLIs.</p><div class="anom-evidence"><code style="font-family:var(--mono);font-size:.7rem;background:var(--surface-3);border:1px solid var(--border-2);padding:.2rem .5rem;border-radius:5px;color:var(--fg-2);white-space:nowrap;overflow:auto;flex:1">aih bootstrap-ai --apply</code></div></div><div class="anom-card ok"><div class="anom-head"><div class="anom-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="m9 18 6-6-6-6"/></svg></div><h4>Vet context7 MCP egress</h4><span class="sev">low</span></div><p class="anom-body">context7 is a <b>third-party</b> MCP server (sends queries off-box). Confirm it is approved for this repo.</p><div class="anom-evidence"><code style="font-family:var(--mono);font-size:.7rem;background:var(--surface-3);border:1px solid var(--border-2);padding:.2rem .5rem;border-radius:5px;color:var(--fg-2);white-space:nowrap;overflow:auto;flex:1">aih mcp --verify</code></div></div><div class="anom-card ok"><div class="anom-head"><div class="anom-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="m9 18 6-6-6-6"/></svg></div><h4>Wire usage + track hooks</h4><span class="sev">low</span></div><p class="anom-body">Activity, trends and time-to-green need the recorder + per-commit snapshots wired.</p><div class="anom-evidence"><code style="font-family:var(--mono);font-size:.7rem;background:var(--surface-3);border:1px solid var(--border-2);padding:.2rem .5rem;border-radius:5px;color:var(--fg-2);white-space:nowrap;overflow:auto;flex:1">aih usage --apply &amp;&amp; aih track --apply</code></div></div></div></section><section class="section" id="sec-wins"><div class="sec-head"><div class="sec-eyebrow"><span class="sec-no">\u2713</span><span class="sec-rule"></span><span class="sec-count">quick wins \xB7 since Jun 1</span></div><h2 class="sec-title">aih cleared 4 blockers to get you running</h2><p class="sec-insight">This is why aih exists. The runtime your AI tools assume \u2014 <b>corporate TLS trust, npm, PATH, MCP launch</b> \u2014 was broken on this host; aih diagnosed and repaired it, and has kept it green across <b>12 runs</b>. The cumulative payoff over the period, not just today.</p></div><div class="grid">
    <div class="card span-8"><div class="card-head"><h3>Remediation ledger \xB7 what aih fixed</h3><span class="badge ok">runtime green</span></div><div class="card-body"><div class="drift-status"><div class="dicon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M20 6 9 17l-5-5"/></svg></div><div class="dtext"><b>Runtime is green \u2014 4 blockers cleared</b><span>the environment certs / npm / PATH / MCP assume now works</span></div></div><div class="drift-files"><div class="drift-file"><span class="fd"></span><span class="fn">Certificate trust chain</span><span class="fs">corporate CA \u2192 trusted (registry)</span><span class="ft ok">fixed \xB7 3d</span></div><div class="drift-file"><span class="fd"></span><span class="fn">npm runtime</span><span class="fs">self-signed cert in chain \u2192 healed</span><span class="ft ok">fixed \xB7 3d</span></div><div class="drift-file"><span class="fd"></span><span class="fn">PATH resolution</span><span class="fs">rg / fd / jq now resolve</span><span class="ft ok">fixed \xB7 3d</span></div><div class="drift-file"><span class="fd"></span><span class="fn">MCP pre-flight</span><span class="fs">npx can launch MCP servers</span><span class="ft ok">fixed \xB7 2h</span></div></div><div class="method" style="margin-top:.5rem">Re-run anytime \u2014 <code>aih heal --scope all</code> diagnoses and repairs.</div></div></div>
    <div class="card span-4"><div class="card-head"><h3>Over the period</h3><span class="badge muted">run ledger</span></div><div class="card-body"><div style="display:flex;gap:1.2rem;flex-wrap:wrap;margin-bottom:.6rem"><div class="heatmap-stat"><b>4</b><span>blockers cleared</span></div><div class="heatmap-stat"><b>12</b><span>aih runs</span></div></div><div style="font-size:.66rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted);font-weight:600;margin-bottom:.2rem">Open blockers over time</div><svg viewBox="0 0 200 40" preserveAspectRatio="none" style="width:100%;height:40px"><path d="M0,40 L0.0,4.0 L28.6,10.4 L57.1,10.4 L85.7,23.2 L114.3,29.6 L142.9,29.6 L171.4,36.0 L200.0,36.0 L200,40 Z" fill="url(#sparkArea)"/><polyline points="0.0,4.0 28.6,10.4 57.1,10.4 85.7,23.2 114.3,29.6 142.9,29.6 171.4,36.0 200.0,36.0" fill="none" stroke="var(--ok)" stroke-width="2"/></svg><div style="margin-top:.4rem;font-size:.72rem;color:var(--dim)">5 \u2192 0 since first run \xB7 Jun 1</div></div></div>
   </div></section><section class="section" id="sec-context"><div class="sec-head"><div class="sec-eyebrow"><span class="sec-no">01</span><span class="sec-rule"></span><span class="sec-count">context</span></div><h2 class="sec-title">Per-turn context is lean \u2014 62% headroom</h2><p class="sec-insight">The cost that matters is what a CLI loads <b>per turn</b>: <b class="ok">12,200 of 32,000 tokens</b> (claude, the heaviest), down 3% since last run. The full on-disk corpus is larger (18,400 tok / 42 files) but never loaded at once.</p></div><div class="grid">
@@ -20193,7 +21083,7 @@ var RADAR={"labels":["Layering","Sharing","Wiring","Guardrails","Discover"],"val
 function buildRadar(el,values,labels){var cx=150,cy=150,r=105,n=values.length,max=100,ang=[];for(var i=0;i<n;i++)ang.push(-Math.PI/2+i*2*Math.PI/n);var g='';[25,50,75,100].forEach(function(l){var p=[];for(var i=0;i<n;i++){var rr=r*l/max;p.push((cx+rr*Math.cos(ang[i])).toFixed(1)+','+(cy+rr*Math.sin(ang[i])).toFixed(1));}g+='<polygon points="'+p.join(' ')+'" fill="none" stroke="var(--border)" stroke-width="1" opacity="'+(0.4+l/200)+'"/>';});for(var i=0;i<n;i++)g+='<line x1="'+cx+'" y1="'+cy+'" x2="'+(cx+r*Math.cos(ang[i])).toFixed(1)+'" y2="'+(cy+r*Math.sin(ang[i])).toFixed(1)+'" stroke="var(--border)" stroke-width="1" opacity="0.5"/>';var dp=[];for(var i=0;i<n;i++){var rr=r*Math.max(0,Math.min(values[i],max))/max;dp.push((cx+rr*Math.cos(ang[i])).toFixed(1)+','+(cy+rr*Math.sin(ang[i])).toFixed(1));}g+='<polygon points="'+dp.join(' ')+'" fill="url(#radarGrad)" stroke="var(--accent)" stroke-width="2" stroke-linejoin="round"/>';for(var i=0;i<n;i++){var rr=r*values[i]/max,px=(cx+rr*Math.cos(ang[i])).toFixed(1),py=(cy+rr*Math.sin(ang[i])).toFixed(1),low=values[i]<70;g+='<circle cx="'+px+'" cy="'+py+'" r="4" fill="'+(low?'var(--warn)':'var(--accent)')+'" stroke="var(--surface)" stroke-width="2"/>';}for(var i=0;i<n;i++){var lr=r+22,lx=cx+lr*Math.cos(ang[i]),ly=cy+lr*Math.sin(ang[i]),a='middle';if(Math.abs(lx-cx)>10)a=lx>cx?'start':'end';var low=values[i]<70;g+='<text x="'+lx.toFixed(1)+'" y="'+(ly+3).toFixed(1)+'" text-anchor="'+a+'" font-size="10" font-weight="600" fill="var(--fg-2)">'+labels[i]+'</text><text x="'+lx.toFixed(1)+'" y="'+(ly+16).toFixed(1)+'" text-anchor="'+a+'" font-family="var(--mono)" font-size="9" fill="'+(low?'var(--warn)':'var(--muted)')+'">'+values[i]+'</text>';}el.innerHTML=g;}
 function buildLegend(el,v,l){var h='';for(var i=0;i<v.length;i++){h+='<span class="radar-leg'+(v[i]<70?' warn':'')+'"><span class="dot"></span>'+l[i]+' <b>'+v[i]+'</b></span>';}el.innerHTML=h;}
 function buildHeat(el){var h='';for(var i=0;i<105;i++){var v=(Math.sin(i*0.6)*0.5+0.5)*0.7+Math.min(1,i/60)*0.4;if(i%7===5||i%7===6)v*=0.35;if(i>90)v*=1.4;v=Math.max(0,Math.min(1,v));var c='';if(v>0.15)c='l1';if(v>0.35)c='l2';if(v>0.55)c='l3';if(v>0.75)c='l4';h+='<span class="cell '+c+'"></span>';}el.innerHTML=h;}
-var PI=[["\u2605","What to fix first","sec-actions"],["\u2713","What aih unblocked","sec-wins"],["01","Context","sec-context"],["02","Activity","sec-activity"],["03","Guardrails + ECC","sec-quality"],["04","Drift + integrity","sec-drift"],["05","MCP plumbing","sec-mcp"],["06","Setup + tooling","sec-adoption"],["07","Enterprise support","sec-support"],["08","Over the period","sec-period"],["09","Skill investment","sec-skills"],["\u2191","Hero","sec-hero"]];
+var PI=[["\u25C6","Developer readiness","sec-ready"],["\u2605","What to fix first","sec-actions"],["\u2713","What aih unblocked","sec-wins"],["01","Context","sec-context"],["02","Activity","sec-activity"],["03","Guardrails + ECC","sec-quality"],["04","Drift + integrity","sec-drift"],["05","MCP plumbing","sec-mcp"],["06","Setup + tooling","sec-adoption"],["07","Enterprise support","sec-support"],["08","Over the period","sec-period"],["09","Skill investment","sec-skills"],["\u2191","Hero","sec-hero"]];
 var pOpen=false;
 function aihPalette(){var p=document.getElementById('palette');pOpen=!pOpen;p.classList.toggle('open',pOpen);if(pOpen){var i=document.getElementById('palette-input');i.value='';i.focus();renderP('');}}
 function renderP(q){q=(q||'').toLowerCase();var f=PI.filter(function(it){return !q||it[1].toLowerCase().indexOf(q)>=0;});document.getElementById('palette-list').innerHTML=f.length?f.map(function(it){return '<div class="palette-item" onclick="jumpP(\\''+it[2]+'\\')"><span class="pn">'+it[0]+'</span><span class="pt">'+it[1]+'</span><span class="pc">section</span></div>';}).join(''):'<div class="palette-empty">No matches</div>';}
@@ -20274,8 +21164,36 @@ function buildHero2(digests, actionCount, driftCount) {
     // usageThisWeek omitted in LIVE until the usage recorder + a w/w baseline exist.
   };
 }
+function buildReady(digests) {
+  const r = bag2(digests, "Developer readiness");
+  if (!r || typeof r.banner !== "string") return void 0;
+  const banner = r.banner === "READY" || r.banner === "NOT READY" || r.banner === "READY, WITH GAPS" ? r.banner : "READY, WITH GAPS";
+  const blockers = (Array.isArray(r.blockers) ? r.blockers : []).map((b) => ({
+    id: String(b.id ?? ""),
+    title: String(b.title ?? ""),
+    cmd: String(b.cmd ?? "")
+  }));
+  return {
+    banner,
+    score: numOr2(r.score, 0),
+    grade: typeof r.grade === "string" ? r.grade : "",
+    blockers
+  };
+}
 function deriveActions(digests) {
   const out = [];
+  const ready = bag2(digests, "Developer readiness");
+  const blockers = ready && Array.isArray(ready.blockers) ? ready.blockers : [];
+  for (const b of blockers) {
+    const title = String(b.title ?? "");
+    if (!title) continue;
+    out.push({
+      sev: "high",
+      title: `Fix: ${title}`,
+      body: "Hard readiness blocker \u2014 an agent cannot make a correct first change until this clears.",
+      cmd: String(b.cmd ?? "")
+    });
+  }
   const sc = bag2(digests, "Harness maturity");
   if (sc) {
     const dims = Array.isArray(sc.dimensions) ? sc.dimensions : [];
@@ -20320,7 +21238,7 @@ function deriveActions(digests) {
         sev: "low",
         title: `Vet ${name} MCP egress`,
         body: `${name} is a third-party MCP server (queries leave the box) \u2014 confirm it is approved for this repo.`,
-        cmd: "aih mcp --review"
+        cmd: "aih mcp --verify"
       });
     }
   }
@@ -20637,6 +21555,7 @@ function emptyGates() {
   const g = {};
   for (const id of [
     "sec-hero",
+    "sec-ready",
     "sec-actions",
     "sec-wins",
     "sec-context",
@@ -20663,6 +21582,7 @@ function buildAihDataV9(digests) {
   const actions = deriveActions(digests);
   let drift = buildDrift(digests);
   const hero = buildHero2(digests, actions.length, drift?.drifted.length);
+  const ready = buildReady(digests);
   const context = buildContext(digests);
   const usage = buildUsage(digests);
   const baseActivity = buildActivity(digests);
@@ -20698,6 +21618,7 @@ function buildAihDataV9(digests) {
     ...outcome ? { outcomeDeltas: outcome } : {}
   } : void 0;
   if (hero) gates["sec-hero"] = "live";
+  if (ready) gates["sec-ready"] = "live";
   gates["sec-actions"] = "live";
   gates["sec-wins"] = wins ? "live" : "empty";
   if (context) gates["sec-context"] = "live";
@@ -20716,6 +21637,7 @@ function buildAihDataV9(digests) {
   gates["cap-usage"] = usage ? "live" : "preview";
   return {
     ...hero ? { hero } : {},
+    ...ready ? { ready } : {},
     actions,
     ...wins ? { wins } : {},
     ...context ? { context } : {},
@@ -20761,6 +21683,26 @@ function assembleViewV9(data, demo) {
   } else {
     sections["sec-hero"] = { state: "empty", container: ".hero-narrative", html: heroStub() };
   }
+  if (data.ready) {
+    const r = data.ready;
+    const clean = r.blockers.length === 0;
+    sections["sec-ready"] = {
+      state: "live",
+      container: ".grid",
+      title: clean ? `${r.banner} \u2014 an agent can start here` : `${r.banner} \u2014 ${r.blockers.length} blocker${r.blockers.length === 1 ? "" : "s"} before an agent can work`,
+      insight: 'The single "can I start?" gate: the maturity score above rates harness <i>wiring</i>; this rates whether an agent can make a correct first change on THIS machine right now. A blocker is a hard stop \u2014 the full remediation list is in <b>What to fix first</b> below.',
+      count: `${r.score}/100 \xB7 ${escHtml2(r.grade)}`,
+      html: renderReady(r)
+    };
+  } else {
+    sections["sec-ready"] = emptySection(
+      "Developer readiness \u2014 not measured here",
+      "Readiness is computed on the local report path only.",
+      "readiness",
+      "Developer readiness",
+      "Readiness is only measured on a local <code>aih report</code> run."
+    );
+  }
   {
     const actions = data.actions ?? [];
     const high = actions.filter((a) => a.sev === "high").length;
@@ -21083,20 +22025,20 @@ var RADAR=(window.AIH_DATA&&AIH_DATA.radar)?AIH_DATA.radar:${RADAR_FALLBACK};`
 }
 
 // src/report/v9-panels.ts
-import { existsSync as existsSync26, readdirSync as readdirSync10 } from "fs";
-import { join as join50 } from "path";
+import { existsSync as existsSync27, readdirSync as readdirSync11 } from "fs";
+import { join as join52 } from "path";
 function estTokens(s) {
   return Math.round(s.length / 4);
 }
 function driftDigest(ctx) {
   const dir = ctx.contextDir;
-  if (!existsSync26(join50(ctx.root, dir, "RULE_ROUTER.md"))) return void 0;
+  if (!existsSync27(join52(ctx.root, dir, "RULE_ROUTER.md"))) return void 0;
   const sharedBody = sharedCanonicalBlockBody(dir).trim();
-  const present = bootloaderPaths(SUPPORTED_CLIS).filter((rel) => existsSync26(join50(ctx.root, rel)));
+  const present = bootloaderPaths(SUPPORTED_CLIS).filter((rel) => existsSync27(join52(ctx.root, rel)));
   const drifted = [];
   const synced = [];
   for (const rel of present) {
-    const text = readIfExists(join50(ctx.root, rel));
+    const text = readIfExists(join52(ctx.root, rel));
     if (text === void 0) continue;
     const block = extractManagedBlock(text, SHARED_MARKER);
     if (block === void 0) continue;
@@ -21133,7 +22075,7 @@ function egressLabel(egress) {
   return "unknown";
 }
 function configuredServerNames(root) {
-  const text = readIfExists(join50(root, ".mcp.json"));
+  const text = readIfExists(join52(root, ".mcp.json"));
   if (text === void 0) return void 0;
   try {
     const parsed = JSON.parse(text);
@@ -21192,7 +22134,7 @@ ${t.body}`;
 }
 function countEntries(abs, opts) {
   try {
-    return readdirSync10(abs, { withFileTypes: true }).filter((d) => {
+    return readdirSync11(abs, { withFileTypes: true }).filter((d) => {
       if (opts.dirsOnly) return d.isDirectory();
       if (opts.ext) return d.isFile() && d.name.endsWith(opts.ext);
       return true;
@@ -21221,7 +22163,7 @@ function countHooks(abs) {
 }
 function listNames(abs, opts) {
   try {
-    return readdirSync10(abs, { withFileTypes: true }).filter(
+    return readdirSync11(abs, { withFileTypes: true }).filter(
       (d) => opts.dirsOnly ? d.isDirectory() : opts.ext ? d.isFile() && d.name.endsWith(opts.ext) : true
     ).map((d) => opts.ext ? d.name.slice(0, -opts.ext.length) : d.name);
   } catch {
@@ -21231,19 +22173,19 @@ function listNames(abs, opts) {
 function countMdRecursive(abs) {
   let dirents;
   try {
-    dirents = readdirSync10(abs, { withFileTypes: true });
+    dirents = readdirSync11(abs, { withFileTypes: true });
   } catch {
     return 0;
   }
   let n = 0;
   for (const e of dirents) {
-    if (e.isDirectory()) n += countMdRecursive(join50(abs, e.name));
+    if (e.isDirectory()) n += countMdRecursive(join52(abs, e.name));
     else if (e.isFile() && e.name.endsWith(".md")) n++;
   }
   return n;
 }
 function readEccMeta(home) {
-  const text = readIfExists(join50(home, ".claude", "ecc", "install-state.json"));
+  const text = readIfExists(join52(home, ".claude", "ecc", "install-state.json"));
   if (text === void 0) return void 0;
   try {
     const s = JSON.parse(text);
@@ -21257,34 +22199,34 @@ function readEccMeta(home) {
   }
 }
 function eccNamespaced(base, opts) {
-  const ns = join50(base, "ecc");
-  return existsSync26(ns) ? listNames(ns, opts) : listNames(base, opts);
+  const ns = join52(base, "ecc");
+  return existsSync27(ns) ? listNames(ns, opts) : listNames(base, opts);
 }
 function eccInventoryDigest(ctx) {
   const r = ctx.root;
-  const mClaude = join50(homeDir(ctx), ".claude");
+  const mClaude = join52(homeDir(ctx), ".claude");
   const meta = readEccMeta(homeDir(ctx));
-  const eccAgentNames = eccNamespaced(join50(mClaude, "agents"), { ext: ".md" });
-  const eccSkillNames = eccNamespaced(join50(mClaude, "skills"), { dirsOnly: true });
-  const rulesBase = join50(mClaude, "rules");
+  const eccAgentNames = eccNamespaced(join52(mClaude, "agents"), { ext: ".md" });
+  const eccSkillNames = eccNamespaced(join52(mClaude, "skills"), { dirsOnly: true });
+  const rulesBase = join52(mClaude, "rules");
   const machine = {
     agents: eccAgentNames.length,
     skills: eccSkillNames.length,
-    rules: existsSync26(join50(rulesBase, "ecc")) ? countMdRecursive(join50(rulesBase, "ecc")) : countMdRecursive(rulesBase)
+    rules: existsSync27(join52(rulesBase, "ecc")) ? countMdRecursive(join52(rulesBase, "ecc")) : countMdRecursive(rulesBase)
   };
   const repoAgents = [
-    ...listNames(join50(r, ".claude", "agents"), { ext: ".md" }),
-    ...listNames(join50(r, ".kiro", "agents"), { ext: ".md" })
+    ...listNames(join52(r, ".claude", "agents"), { ext: ".md" }),
+    ...listNames(join52(r, ".kiro", "agents"), { ext: ".md" })
   ];
   const repoSkills = [
-    ...listNames(join50(r, ".claude", "skills"), { dirsOnly: true }),
-    ...listNames(join50(r, ".kiro", "skills"), { dirsOnly: true })
+    ...listNames(join52(r, ".claude", "skills"), { dirsOnly: true }),
+    ...listNames(join52(r, ".kiro", "skills"), { dirsOnly: true })
   ];
   const repo = {
     agents: repoAgents.length,
     skills: repoSkills.length,
-    rules: countEntries(join50(r, ".claude", "rules"), { ext: ".md" }) + countEntries(join50(r, ".kiro", "steering"), { ext: ".md" }),
-    hooks: countHooks(join50(r, ".claude", "settings.json"))
+    rules: countEntries(join52(r, ".claude", "rules"), { ext: ".md" }) + countEntries(join52(r, ".kiro", "steering"), { ext: ".md" }),
+    hooks: countHooks(join52(r, ".claude", "settings.json"))
   };
   if (machine.agents + machine.skills + machine.rules + repo.agents + repo.skills + repo.rules + repo.hooks === 0) {
     return void 0;
@@ -21319,7 +22261,7 @@ function eccInventoryDigest(ctx) {
 }
 function coherenceDigest(ctx) {
   const dir = ctx.contextDir;
-  if (!existsSync26(join50(ctx.root, dir, "RULE_ROUTER.md"))) return void 0;
+  if (!existsSync27(join52(ctx.root, dir, "RULE_ROUTER.md"))) return void 0;
   const targeted = scanCliCoverage(ctx).rows.filter((row) => row.targeted);
   if (targeted.length < 2) return void 0;
   const sharedBody = sharedCanonicalBlockBody(dir).trim();
@@ -21328,7 +22270,7 @@ function coherenceDigest(ctx) {
   for (const row of targeted) {
     let text;
     for (const p of CLI_BOOTLOADERS[row.cli] ?? []) {
-      const t = readIfExists(join50(ctx.root, p));
+      const t = readIfExists(join52(ctx.root, p));
       if (t !== void 0) {
         text = t;
         break;
@@ -21360,16 +22302,16 @@ function coherenceDigest(ctx) {
 }
 var MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
 function readLedger(root) {
-  const dirAbs = join50(root, ".aih", "runs");
+  const dirAbs = join52(root, ".aih", "runs");
   let files;
   try {
-    files = readdirSync10(dirAbs).filter((f) => f.endsWith(".jsonl")).sort();
+    files = readdirSync11(dirAbs).filter((f) => f.endsWith(".jsonl")).sort();
   } catch {
     return [];
   }
   const out = [];
   for (const f of files) {
-    const text = readIfExists(join50(dirAbs, f));
+    const text = readIfExists(join52(dirAbs, f));
     if (text === void 0) continue;
     for (const line of text.split("\n")) {
       const t = line.trim();
@@ -21466,7 +22408,7 @@ function winsDigest(ctx) {
   const last = heal[heal.length - 1];
   const allGreen = last?.status === "success" && (last?.verification?.fail ?? 0) === 0;
   const probed = (() => {
-    const text = readIfExists(join50(ctx.root, ".aih", "heal-last.json"));
+    const text = readIfExists(join52(ctx.root, ".aih", "heal-last.json"));
     if (text === void 0) return void 0;
     try {
       const p = JSON.parse(text);
@@ -21505,6 +22447,9 @@ function winsDigest(ctx) {
 }
 async function v9ExtraDigests(ctx) {
   return [
+    // Readiness ALWAYS renders (even a harness-less repo earns a verdict), so its
+    // `sec-ready` panel is always LIVE on the local report path.
+    readinessDigest(ctx),
     driftDigest(ctx),
     mcpServersDigest(ctx),
     eccInventoryDigest(ctx),
@@ -21515,14 +22460,14 @@ async function v9ExtraDigests(ctx) {
 }
 
 // src/report/workspace.ts
-import { existsSync as existsSync27, readdirSync as readdirSync12, statSync as statSync5 } from "fs";
-import { join as join52, relative as relative5 } from "path";
+import { existsSync as existsSync28, readdirSync as readdirSync13, statSync as statSync5 } from "fs";
+import { join as join54, relative as relative5 } from "path";
 
 // src/workspace/state.ts
-import { readdirSync as readdirSync11 } from "fs";
-import { join as join51 } from "path";
+import { readdirSync as readdirSync12 } from "fs";
+import { join as join53 } from "path";
 async function gitChildRead(ctx, repo, args) {
-  const res = await ctx.run(["git", "-C", join51(ctx.root, repo.path), ...args]);
+  const res = await ctx.run(["git", "-C", join53(ctx.root, repo.path), ...args]);
   if (res.spawnError || res.code !== 0) return void 0;
   return res.stdout.replace(/\s+$/, "");
 }
@@ -21565,15 +22510,15 @@ async function collectWorkspaceSnapshot(ctx, manifest2, opts = {}) {
   };
 }
 function latestWorkspaceSnapshotPath(root) {
-  const dir = join51(root, ".aih", "workspace-snapshots");
+  const dir = join53(root, ".aih", "workspace-snapshots");
   let files;
   try {
-    files = readdirSync11(dir).filter((f) => f.endsWith(".json")).sort();
+    files = readdirSync12(dir).filter((f) => f.endsWith(".json")).sort();
   } catch {
     return void 0;
   }
   const latest = files.at(-1);
-  return latest ? join51(dir, latest) : void 0;
+  return latest ? join53(dir, latest) : void 0;
 }
 
 // src/report/workspace.ts
@@ -21584,17 +22529,17 @@ function daysSince(iso) {
   return Math.max(0, Math.floor((Date.now() - ms) / 864e5));
 }
 function newestReport(root, repo) {
-  const dir = join52(root, repo.path, ".aih", "reports");
+  const dir = join54(root, repo.path, ".aih", "reports");
   let files;
   try {
-    files = readdirSync12(dir).filter((name) => /\.(html|md|json)$/i.test(name)).sort();
+    files = readdirSync13(dir).filter((name) => /\.(html|md|json)$/i.test(name)).sort();
   } catch {
     return {};
   }
   let chosen;
   for (const name of files) {
     try {
-      const mtimeMs = statSync5(join52(dir, name)).mtimeMs;
+      const mtimeMs = statSync5(join54(dir, name)).mtimeMs;
       if (!chosen || mtimeMs > chosen.mtimeMs) chosen = { name, mtimeMs };
     } catch {
     }
@@ -21606,7 +22551,7 @@ function newestReport(root, repo) {
   };
 }
 function latestHistory(root, repo) {
-  const text = readIfExists(join52(root, repo.path, ".aih", "history.jsonl"));
+  const text = readIfExists(join54(root, repo.path, ".aih", "history.jsonl"));
   if (text === void 0) return {};
   let latest;
   for (const line of text.split(/\r?\n/)) {
@@ -21626,7 +22571,7 @@ function lineCount(text) {
   return text.split(/\r?\n/).filter((line) => line.trim().length > 0).length;
 }
 function workspaceMcpStatus(root) {
-  const text = readIfExists(join52(root, ".mcp.json"));
+  const text = readIfExists(join54(root, ".mcp.json"));
   if (text === void 0) return { status: "UNKNOWN", detail: "no parent .mcp.json" };
   try {
     const parsed = JSON.parse(text);
@@ -21654,7 +22599,7 @@ function workspaceMcpStatus(root) {
   }
 }
 function readConfigStatus(root, repo, manifest2) {
-  const text = readIfExists(join52(root, repo.path, ".aih-config.json"));
+  const text = readIfExists(join54(root, repo.path, ".aih-config.json"));
   if (text === void 0) return { status: "MISSING", detail: "no child .aih-config.json" };
   try {
     const parsed = JSON.parse(text);
@@ -21690,18 +22635,18 @@ function aggregateStatus(row) {
   return "OK";
 }
 async function childRow(ctx, manifest2, repo, missingIgnores) {
-  const abs = join52(ctx.root, repo.path);
-  const exists = existsSync27(abs);
+  const abs = join54(ctx.root, repo.path);
+  const exists = existsSync28(abs);
   const gitState = exists ? await readWorkspaceRepoState(ctx, repo) : void 0;
   const git = gitState?.git === true ? { status: "OK", ...gitState } : {
     status: exists ? "MISSING" : "MISSING",
     detail: exists ? "not a git repo" : "path missing"
   };
-  const routerAbs = join52(ctx.root, repo.path, repo.router);
-  const canon = existsSync27(routerAbs) ? { status: "OK" } : { status: "NOT_ONBOARDED", detail: `${repo.path}/${repo.router} missing` };
+  const routerAbs = join54(ctx.root, repo.path, repo.router);
+  const canon = existsSync28(routerAbs) ? { status: "OK" } : { status: "NOT_ONBOARDED", detail: `${repo.path}/${repo.router} missing` };
   const config = exists ? readConfigStatus(ctx.root, repo, manifest2) : { status: "MISSING" };
   const parentIgnored = manifest2.git && missingIgnores.includes(repo.path) ? { status: "WARN", detail: "parent git does not ignore child repo path" } : { status: "OK" };
-  const historyPath = join52(ctx.root, repo.path, ".aih", "history.jsonl");
+  const historyPath = join54(ctx.root, repo.path, ".aih", "history.jsonl");
   const historyText = readIfExists(historyPath);
   const latest = historyText === void 0 ? {} : latestHistory(ctx.root, repo);
   const ageDays = latest.ts ? daysSince(latest.ts) : void 0;
@@ -21710,7 +22655,7 @@ async function childRow(ctx, manifest2, repo, missingIgnores) {
     ...latest.ts ? { latestSample: latest.ts } : {},
     ...ageDays !== void 0 ? { ageDays } : {}
   };
-  const usageText = readIfExists(join52(ctx.root, repo.path, ".aih", "usage.jsonl"));
+  const usageText = readIfExists(join54(ctx.root, repo.path, ".aih", "usage.jsonl"));
   const usageEvents = lineCount(usageText);
   const usage = usageText === void 0 ? { status: "NOT_COLLECTED", detail: "no .aih/usage.jsonl" } : { status: "OK", events: usageEvents };
   const reportInfo = newestReport(ctx.root, repo);
@@ -21738,8 +22683,8 @@ function contractStatus(root, edge) {
   if (!edge.contractPath) {
     return { ...edge, status: "UNKNOWN", detail: "no contractPath declared" };
   }
-  const contractExists = existsSync27(join52(root, edge.contractPath));
-  const consumerExists = edge.consumerPath ? existsSync27(join52(root, edge.consumerPath)) : true;
+  const contractExists = existsSync28(join54(root, edge.contractPath));
+  const consumerExists = edge.consumerPath ? existsSync28(join54(root, edge.consumerPath)) : true;
   const status = !contractExists ? edge.consumerPath && consumerExists ? "PARTIAL" : "MISSING" : consumerExists ? "OK" : "PARTIAL";
   const detail = status === "OK" ? "declared contract evidence exists" : [
     contractExists ? void 0 : `missing ${edge.contractPath}`,
@@ -21778,7 +22723,7 @@ function snapshotTime(snapshot) {
 function workspaceSnapshot(root, manifest2, rows) {
   const candidates = [
     latestWorkspaceSnapshotPath(root),
-    join52(root, manifest2.contextDir, "workspace-lock.json")
+    join54(root, manifest2.contextDir, "workspace-lock.json")
   ].filter((path) => path !== void 0);
   const loaded = candidates.map((path) => ({ path, snapshot: readSnapshot(path) })).filter(
     (entry2) => entry2.snapshot !== void 0
@@ -21903,7 +22848,7 @@ async function workspaceReportDigest(ctx) {
   if (!manifest2) return void 0;
   const missingIgnores = manifest2.git === true ? workspaceGitignoreMissing(
     manifest2.repos.map((repo) => repo.path),
-    readIfExists(join52(ctx.root, ".gitignore"))
+    readIfExists(join54(ctx.root, ".gitignore"))
   ) : [];
   const rows = [];
   for (const repo of manifest2.repos) rows.push(await childRow(ctx, manifest2, repo, missingIgnores));
@@ -21967,7 +22912,7 @@ function loadGroupHeadline(model) {
 }
 function readOrgExport(ctx, file) {
   const path = resolve11(ctx.root, file);
-  if (!existsSync28(path)) throw new AihError(`--org export not found: ${file}`, "AIH_REPORT");
+  if (!existsSync29(path)) throw new AihError(`--org export not found: ${file}`, "AIH_REPORT");
   let text;
   try {
     text = readFileSync6(path, "utf8");
@@ -21999,9 +22944,9 @@ function artifactPath(ctx, scope, format) {
   const out = ctx.options.out;
   if (typeof out === "string" && out.length > 0) return out;
   if (scope === "workspace") {
-    return join53(".aih", `workspace-report.${format === "html" ? "html" : "md"}`);
+    return join55(".aih", `workspace-report.${format === "html" ? "html" : "md"}`);
   }
-  return join53(".aih", "reports", `${scope}-report.${format === "html" ? "html" : "md"}`);
+  return join55(".aih", "reports", `${scope}-report.${format === "html" ? "html" : "md"}`);
 }
 function adoptionFrom(digests) {
   const d = digests.find((x) => x.describe.startsWith("Configuration"));
@@ -22065,7 +23010,7 @@ async function buildReport(ctx) {
     usageEvents: usageEventsFrom(panels),
     // Telemetry is "wired" once `aih usage --apply` wrote its recorder — even before
     // an event lands. Drives dropping the "wire telemetry" step after it's done.
-    telemetryWired: existsSync28(join53(ctx.root, ".aih", "usage-record.mjs")),
+    telemetryWired: existsSync29(join55(ctx.root, ".aih", "usage-record.mjs")),
     toolsMissing: toolsMissingFrom(panels),
     scaleGraphMissing: scaleGraphMissingFrom(panels),
     // Runnable AI CLIs on this machine (Machine tooling `present`) that this repo
@@ -22160,7 +23105,7 @@ async function reportPlan(ctx) {
   }
   return plan("report", ...actions);
 }
-var command24 = {
+var command26 = {
   name: "report",
   // alwaysVerify so the `--gate` probe runs and drives the exit code. A bare
   // `aih report` has no probes, so this is a no-op there (empty report → exit 0).
@@ -22237,152 +23182,7 @@ var command24 = {
   plan: reportPlan
 };
 
-// src/tools/install.ts
-var TOOLS = [
-  {
-    tool: "ripgrep (rg)",
-    bin: "rg",
-    tier: "core",
-    options: [
-      { pm: "winget", argv: ["winget", "install", "-e", "--id", "BurntSushi.ripgrep.MSVC"] },
-      { pm: "scoop", argv: ["scoop", "install", "ripgrep"] },
-      { pm: "brew", argv: ["brew", "install", "ripgrep"] },
-      { pm: "apt", argv: ["sudo", "apt-get", "install", "-y", "ripgrep"] },
-      { pm: "cargo", argv: ["cargo", "install", "ripgrep"] }
-    ],
-    manual: "https://github.com/BurntSushi/ripgrep#installation"
-  },
-  {
-    tool: "fd",
-    bin: "fd",
-    tier: "core",
-    options: [
-      { pm: "winget", argv: ["winget", "install", "-e", "--id", "sharkdp.fd"] },
-      { pm: "scoop", argv: ["scoop", "install", "fd"] },
-      { pm: "brew", argv: ["brew", "install", "fd"] },
-      { pm: "apt", argv: ["sudo", "apt-get", "install", "-y", "fd-find"] },
-      { pm: "cargo", argv: ["cargo", "install", "fd-find"] }
-    ],
-    manual: "https://github.com/sharkdp/fd#installation"
-  },
-  {
-    tool: "jq",
-    bin: "jq",
-    tier: "core",
-    options: [
-      { pm: "winget", argv: ["winget", "install", "-e", "--id", "jqlang.jq"] },
-      { pm: "scoop", argv: ["scoop", "install", "jq"] },
-      { pm: "brew", argv: ["brew", "install", "jq"] },
-      { pm: "apt", argv: ["sudo", "apt-get", "install", "-y", "jq"] }
-    ],
-    manual: "https://jqlang.github.io/jq/download/"
-  },
-  {
-    tool: "ast-grep (sg)",
-    bin: "sg",
-    tier: "optional",
-    options: [
-      { pm: "brew", argv: ["brew", "install", "ast-grep"] },
-      { pm: "cargo", argv: ["cargo", "install", "ast-grep", "--locked"] },
-      { pm: "npm", argv: ["npm", "install", "-g", "@ast-grep/cli"] }
-    ],
-    manual: "https://ast-grep.github.io/guide/quick-start.html"
-  },
-  {
-    tool: "comby",
-    bin: "comby",
-    tier: "optional",
-    options: [{ pm: "brew", argv: ["brew", "install", "comby"] }],
-    manual: "https://comby.dev/docs/get-started"
-  },
-  {
-    tool: "tree",
-    bin: "tree",
-    tier: "optional",
-    options: [
-      { pm: "scoop", argv: ["scoop", "install", "tree"] },
-      { pm: "brew", argv: ["brew", "install", "tree"] },
-      { pm: "apt", argv: ["sudo", "apt-get", "install", "-y", "tree"] }
-    ],
-    manual: "install `tree` from your OS package manager"
-  },
-  {
-    tool: "GitHub CLI (gh)",
-    bin: "gh",
-    tier: "optional",
-    options: [
-      { pm: "winget", argv: ["winget", "install", "-e", "--id", "GitHub.cli"] },
-      { pm: "scoop", argv: ["scoop", "install", "gh"] },
-      { pm: "brew", argv: ["brew", "install", "gh"] },
-      { pm: "apt", argv: ["sudo", "apt-get", "install", "-y", "gh"] }
-    ],
-    manual: "https://cli.github.com"
-  },
-  {
-    tool: "code-review-graph",
-    bin: "code-review-graph",
-    tier: "optional",
-    options: [
-      { pm: "uv", argv: ["uv", "tool", "install", "code-review-graph"] },
-      { pm: "pip", argv: ["pip", "install", "code-review-graph"] }
-    ],
-    manual: "pip install code-review-graph"
-  }
-];
-var PM_BINARIES = [
-  ["winget", "winget"],
-  ["scoop", "scoop"],
-  ["brew", "brew"],
-  ["apt-get", "apt"],
-  ["cargo", "cargo"],
-  ["npm", "npm"],
-  ["uv", "uv"],
-  ["pip", "pip"]
-];
-async function onPath4(ctx, bin) {
-  const argv = ctx.host.platform === "windows" ? ["where", bin] : ["which", bin];
-  const res = await ctx.run(argv);
-  return !res.spawnError && res.code === 0 && res.stdout.trim().length > 0;
-}
-async function detectPms(ctx) {
-  const found = /* @__PURE__ */ new Set();
-  await Promise.all(
-    PM_BINARIES.map(async ([bin, key]) => {
-      if (await onPath4(ctx, bin)) found.add(key);
-    })
-  );
-  return found;
-}
-async function missingTools(ctx) {
-  const checked = await Promise.all(
-    TOOLS.map(async (t) => ({ t, present: await onPath4(ctx, t.bin) }))
-  );
-  return checked.filter((c) => !c.present).map((c) => c.t);
-}
-function chooseOption(t, pms) {
-  return t.options.find((o) => pms.has(o.pm));
-}
-var WIN_CMD_SHIMS = /* @__PURE__ */ new Set(["npm", "npx", "pnpm", "scoop", "yarn"]);
-function execArgv(platform, argv) {
-  return platform === "windows" && argv[0] !== void 0 && WIN_CMD_SHIMS.has(argv[0]) ? ["cmd", "/c", ...argv] : argv;
-}
-
 // src/tools/index.ts
-function howToInstall(t, pms) {
-  const opt = chooseOption(t, pms);
-  return opt ? `\`${opt.argv.join(" ")}\`` : `manually \u2014 ${t.manual}`;
-}
-async function verifyTool(ctx, t, pms) {
-  if (await onPath4(ctx, t.bin)) {
-    return { name: t.tool, verdict: "pass", detail: `${t.bin} on PATH` };
-  }
-  return {
-    name: t.tool,
-    verdict: t.tier === "core" ? "fail" : "skip",
-    detail: `${t.bin} not on PATH \u2014 install: ${howToInstall(t, pms)}`,
-    code: "env.tool-install-blocked"
-  };
-}
 function summaryText2(missing, pms) {
   const pmList = pms.size > 0 ? [...pms].sort().join(", ") : "none detected";
   return lines(
@@ -22403,31 +23203,14 @@ async function toolsPlan(ctx) {
       doc("tools \u2014 all present", "All agent shell tools are on PATH. Nothing to install.")
     );
   }
-  const actions = [];
-  for (const t of missing) {
-    const opt = chooseOption(t, pms);
-    if (opt) {
-      actions.push(
-        exec(`install ${t.tool} (${opt.pm})`, execArgv(ctx.host.platform, opt.argv), {
-          allowFailure: true
-        })
-      );
-    } else {
-      actions.push(
-        doc(
-          `install ${t.tool} manually (no supported package manager found)`,
-          `No detected package manager can install ${t.tool}. Install it manually: ${t.manual}`
-        )
-      );
-    }
-  }
+  const actions = installActionsFor(ctx, missing, pms);
   for (const t of missing) {
     actions.push(probe(`${t.tool} installed`, (c) => verifyTool(c, t, pms)));
   }
   actions.push(doc("tools summary", summaryText2(missing, pms)));
   return plan("tools", ...actions);
 }
-var command25 = {
+var command27 = {
   name: "tools",
   summary: "Install the agent shell tools the harness leans on (rg/fd/jq + ast-grep/comby/tree/gh/code-review-graph); escalates a blocked install as a ticket",
   // Diagnose by default so a bare `aih tools` surfaces what's missing + how to get it,
@@ -22466,7 +23249,7 @@ async function trackPlan(ctx) {
     aihIgnoreWrite(ctx.root)
   );
 }
-var command26 = {
+var command28 = {
   name: "track",
   summary: "Record a metrics sample (git + repo state) to .aih/history.jsonl \u2014 powers `aih report` trends",
   plan: trackPlan
@@ -22474,8 +23257,8 @@ var command26 = {
 
 // src/trust/scan.ts
 import { createHash as createHash7 } from "crypto";
-import { lstatSync as lstatSync6, readdirSync as readdirSync14, readFileSync as readFileSync10 } from "fs";
-import { basename as basename11, extname as extname3, isAbsolute as isAbsolute8, join as join56, relative as relative9, resolve as resolve12 } from "path";
+import { lstatSync as lstatSync7, readdirSync as readdirSync15, readFileSync as readFileSync10 } from "fs";
+import { basename as basename11, extname as extname3, isAbsolute as isAbsolute8, join as join58, relative as relative9, resolve as resolve12 } from "path";
 
 // src/trust/acknowledge.ts
 var TRUST_DANGER_CODES = /* @__PURE__ */ new Set([
@@ -22564,10 +23347,10 @@ function applyTrustAcknowledgements(checks, ctx) {
 function quoteArg(value) {
   return /^[A-Za-z0-9_./:@-]+$/.test(value) ? value : `"${value.replace(/(["\\])/g, "\\$1")}"`;
 }
-function acknowledgeCommandHint(command28, source, checks) {
+function acknowledgeCommandHint(command30, source, checks) {
   const fingerprints2 = checks.filter((check2) => check2.verdict === "fail" && check2.fingerprint !== void 0).filter((check2) => !isDanger(check2) && isAcknowledgeableOrigin(check2)).map((check2) => check2.fingerprint);
   if (fingerprints2.length === 0) return void 0;
-  return `To acknowledge the current trust-origin finding(s), rerun: aih ${command28} ${quoteArg(
+  return `To acknowledge the current trust-origin finding(s), rerun: aih ${command30} ${quoteArg(
     source
   )} --acknowledge ${quoteArg(fingerprints2.join(","))} --reason ${quoteArg("<reason>")}`;
 }
@@ -22865,8 +23648,8 @@ function scanTrustDependencyNames(root, internalScopes, posture = "vibe") {
 
 // src/trust/detectors.ts
 import { createHash as createHash4 } from "crypto";
-import { lstatSync as lstatSync4, readFileSync as readFileSync8 } from "fs";
-import { basename as basename9, extname, isAbsolute as isAbsolute7, join as join54, relative as relative7 } from "path";
+import { lstatSync as lstatSync5, readFileSync as readFileSync8 } from "fs";
+import { basename as basename9, extname, isAbsolute as isAbsolute7, join as join56, relative as relative7 } from "path";
 var SKILLSPECTOR_ANALYZER = "skillspector@docker";
 var DETECTOR_UNAVAILABLE = "trust.detector-unavailable";
 var MAX_SCRIPT_SCAN_BYTES = 512 * 1024;
@@ -22999,7 +23782,7 @@ function scanNativeMaliciousCode(root) {
     root,
     (abs) => {
       const rel = toPosix2(relative7(root, abs));
-      return isScriptLike(rel) && lstatSync4(abs).size <= MAX_SCRIPT_SCAN_BYTES;
+      return isScriptLike(rel) && lstatSync5(abs).size <= MAX_SCRIPT_SCAN_BYTES;
     },
     TRUST_SKIP_DIRS
   );
@@ -23088,7 +23871,7 @@ function sarifLocation(result) {
 }
 function sarifFingerprint(code, root, location, detail) {
   const line = location.startLine ?? 1;
-  const sourceLine = fileLine(join54(root, location.uri), line) ?? detail;
+  const sourceLine = fileLine(join56(root, location.uri), line) ?? detail;
   return `${code.replace(/\./g, "-")}:skillspector:${location.uri}:${line}:${sha8(sourceLine)}`;
 }
 function sarifChecks(stdout, root, posture) {
@@ -23379,8 +24162,8 @@ function scanTrustDocument(path, source) {
 
 // src/trust/manifest.ts
 import { createHash as createHash6 } from "crypto";
-import { lstatSync as lstatSync5, readdirSync as readdirSync13, readFileSync as readFileSync9 } from "fs";
-import { basename as basename10, extname as extname2, join as join55, relative as relative8 } from "path";
+import { lstatSync as lstatSync6, readdirSync as readdirSync14, readFileSync as readFileSync9 } from "fs";
+import { basename as basename10, extname as extname2, join as join57, relative as relative8 } from "path";
 import { parseDocument } from "yaml";
 var AUTO_EXEC_CODE = "trust.auto-exec-hook";
 var LIFECYCLE_SCRIPTS = /* @__PURE__ */ new Set([
@@ -23594,7 +24377,7 @@ function isClaudeHooksDir(rel) {
 function scanHookDirs(root) {
   const checks = [];
   const visit = (abs) => {
-    const st = lstatSync5(abs);
+    const st = lstatSync6(abs);
     if (!st.isDirectory()) return;
     const rel = toPosix3(relative8(root, abs));
     if (abs !== root && TRUST_SKIP_DIRS.has(basename10(abs)) && !isClaudeHooksDir(rel)) return;
@@ -23604,7 +24387,7 @@ function scanHookDirs(root) {
       );
       return;
     }
-    for (const entry2 of readdirSync13(abs)) visit(join55(abs, entry2));
+    for (const entry2 of readdirSync14(abs)) visit(join57(abs, entry2));
   };
   visit(root);
   return checks;
@@ -23652,8 +24435,8 @@ function stringValue(value) {
 function stringArray(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
-function commandName(command28) {
-  const last = command28.split(/[\\/]/).at(-1) ?? command28;
+function commandName(command30) {
+  const last = command30.split(/[\\/]/).at(-1) ?? command30;
   return last.replace(/\.(?:cmd|exe)$/i, "").toLowerCase();
 }
 function isPlaceholderOrEmpty2(value) {
@@ -23689,8 +24472,8 @@ function hasLiteralCredential(raw, args) {
 function hasExactPackage(args) {
   return args.some((arg) => EXACT_PACKAGE_RE.test(arg.trim()));
 }
-function hasFloatingLaunch(command28, args) {
-  const cmd = command28 === void 0 ? "" : commandName(command28);
+function hasFloatingLaunch(command30, args) {
+  const cmd = command30 === void 0 ? "" : commandName(command30);
   return cmd === "npx" || cmd === "uvx" || args.some((arg) => arg === "-y" || arg === "--yes" || /@latest(?:$|\b)/i.test(arg));
 }
 function hosted(url, description, credentials) {
@@ -23718,7 +24501,7 @@ function flagged(description, credentials) {
 }
 function classifyIncomingMcp(rawServer) {
   const raw = isRecord6(rawServer) ? rawServer : void 0;
-  const command28 = raw ? stringValue(raw.command) : void 0;
+  const command30 = raw ? stringValue(raw.command) : void 0;
   const args = raw ? stringArray(raw.args) : [];
   const url = raw ? stringValue(raw.url) : void 0;
   const description = raw ? stringValue(raw.description) ?? "" : "";
@@ -23727,19 +24510,19 @@ function classifyIncomingMcp(rawServer) {
   if (url !== void 0 && /^https?:\/\//i.test(url.trim())) {
     return hosted(url.trim(), description, credentials);
   }
-  if (command28 === void 0 || command28.trim().length === 0) {
+  if (command30 === void 0 || command30.trim().length === 0) {
     return flagged(description, credentials);
   }
   return {
     type: "stdio",
-    command: command28,
+    command: command30,
     args,
     description,
     env,
     classification: "local",
     egress: "local-only",
     credentials,
-    supplyChain: hasFloatingLaunch(command28, args) ? "unpinned" : hasExactPackage(args) ? "pinned" : "unpinned"
+    supplyChain: hasFloatingLaunch(command30, args) ? "unpinned" : hasExactPackage(args) ? "pinned" : "unpinned"
   };
 }
 
@@ -23765,10 +24548,10 @@ function toPosix4(path) {
 function collectFilesUnder(root, accept, skipDirs = TRUST_SKIP_DIRS) {
   const out = [];
   const visit = (abs) => {
-    const st = lstatSync6(abs);
+    const st = lstatSync7(abs);
     if (st.isDirectory()) {
       if (abs !== root && skipDirs.has(basename11(abs))) return;
-      for (const entry2 of readdirSync14(abs)) visit(join56(abs, entry2));
+      for (const entry2 of readdirSync15(abs)) visit(join58(abs, entry2));
       return;
     }
     if (st.isFile() && accept(abs)) out.push(abs);
@@ -23859,12 +24642,12 @@ function openCodeServer(server) {
   if (server.type === "remote") {
     return { ...server, url: stringValue2(server.url) };
   }
-  const command28 = Array.isArray(server.command) ? server.command : [];
-  const executable = command28[0];
+  const command30 = Array.isArray(server.command) ? server.command : [];
+  const executable = command30[0];
   return {
     ...server,
     command: typeof executable === "string" ? executable : void 0,
-    args: command28.slice(1).filter((item) => typeof item === "string"),
+    args: command30.slice(1).filter((item) => typeof item === "string"),
     env: server.environment ?? server.env
   };
 }
@@ -23916,7 +24699,7 @@ function incomingMcpChecks(root, mcpConfigFiles, posture) {
   for (const rel of mcpConfigFiles) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync10(join56(root, rel), "utf8"));
+      parsed = JSON.parse(readFileSync10(join58(root, rel), "utf8"));
     } catch {
       checks.push(malformedMcpConfigCheck(rel));
       continue;
@@ -24221,12 +25004,12 @@ var trustScanCommand = {
 
 // src/workspace/acquire.ts
 import { randomUUID } from "crypto";
-import { existsSync as existsSync29, lstatSync as lstatSync7, readdirSync as readdirSync15, readFileSync as readFileSync11 } from "fs";
-import { basename as basename12, extname as extname4, join as join57, posix as posix9 } from "path";
+import { existsSync as existsSync30, lstatSync as lstatSync8, readdirSync as readdirSync16, readFileSync as readFileSync11 } from "fs";
+import { basename as basename12, extname as extname4, join as join59, posix as posix9 } from "path";
 
 // src/internals/commander-options.ts
-function optionSource(command28, key) {
-  return command28.getOptionValueSourceWithGlobals?.(key) ?? command28.getOptionValueSource?.(key);
+function optionSource(command30, key) {
+  return command30.getOptionValueSourceWithGlobals?.(key) ?? command30.getOptionValueSource?.(key);
 }
 
 // src/support/setup.ts
@@ -24359,11 +25142,11 @@ async function workspaceAddPhase1Plan(ctx, resolvedSource) {
 function collectSkillDirs(root) {
   const out = [];
   const visit = (abs) => {
-    const st = lstatSync7(abs);
+    const st = lstatSync8(abs);
     if (!st.isDirectory()) return;
     if (abs !== root && SKIP_DIRS.has(basename12(abs))) return;
-    if (existsSync29(join57(abs, "SKILL.md"))) out.push(abs);
-    for (const entry2 of readdirSync15(abs)) visit(join57(abs, entry2));
+    if (existsSync30(join59(abs, "SKILL.md"))) out.push(abs);
+    for (const entry2 of readdirSync16(abs)) visit(join59(abs, entry2));
   };
   visit(root);
   return out.sort((a, b) => sourceDirSortKey(root, a).localeCompare(sourceDirSortKey(root, b)));
@@ -24371,10 +25154,10 @@ function collectSkillDirs(root) {
 function collectFiles(root) {
   const out = [];
   const visit = (abs) => {
-    const st = lstatSync7(abs);
+    const st = lstatSync8(abs);
     if (st.isDirectory()) {
       if (abs !== root && SKIP_DIRS.has(basename12(abs))) return;
-      for (const entry2 of readdirSync15(abs)) visit(join57(abs, entry2));
+      for (const entry2 of readdirSync16(abs)) visit(join59(abs, entry2));
       return;
     }
     if (st.isFile()) out.push(abs);
@@ -24597,7 +25380,7 @@ function hasFailedExec(result) {
 }
 function readSetupText(root) {
   for (const rel of ["SETUP.md", "docs/SETUP.md", ".aih/SETUP.md"]) {
-    const text = readIfExists(join57(root, rel));
+    const text = readIfExists(join59(root, rel));
     if (text !== void 0) return text;
   }
   return void 0;
@@ -24632,16 +25415,16 @@ ${template.body}`);
   }
   write(supportSummary(support, saved));
 }
-function contextFromCommand(command28, deps) {
+function contextFromCommand(command30, deps) {
   const env = deps.env ?? process.env;
   const run = deps.run ?? defaultRunner;
-  const opts = command28.optsWithGlobals();
+  const opts = command30.optsWithGlobals();
   const resolvedRoot = opts.root ?? env.AIH_ROOT ?? process.cwd();
   const marker = readAihConfig(resolvedRoot);
-  const contextDirSource = optionSource(command28, "contextDir");
+  const contextDirSource = optionSource(command30, "contextDir");
   const contextDirFromFlag = contextDirSource === "cli" ? opts.contextDir : void 0;
   const contextDirFromMarker = contextDirFromFlag === void 0 ? marker?.contextDir : void 0;
-  const postureFlagSource = optionSource(command28, "posture") === "cli" ? "cli" : void 0;
+  const postureFlagSource = optionSource(command30, "posture") === "cli" ? "cli" : void 0;
   const resolvedPosture = resolvePosture({
     root: resolvedRoot,
     env,
@@ -24669,7 +25452,7 @@ function contextFromCommand(command28, deps) {
     host,
     env,
     options: {
-      source: command28.processedArgs[0],
+      source: command30.processedArgs[0],
       pin: opts.pin,
       ref: opts.ref,
       force: opts.force,
@@ -24679,16 +25462,16 @@ function contextFromCommand(command28, deps) {
     }
   };
 }
-async function runWorkspaceAdd(command28, deps = {}) {
+async function runWorkspaceAdd(command30, deps = {}) {
   const write = deps.write ?? ((text) => process.stdout.write(text));
   const env = deps.env ?? process.env;
-  const opts = command28.optsWithGlobals();
+  const opts = command30.optsWithGlobals();
   const runId = (deps.newRunId ?? (() => `run_${randomUUID().slice(0, 8)}`))();
   const startedAt = (deps.now ?? (() => /* @__PURE__ */ new Date()))();
   let json = false;
   let source;
   try {
-    const ctx = contextFromCommand(command28, deps);
+    const ctx = contextFromCommand(command30, deps);
     json = ctx.json;
     source = sourceFromContext(ctx);
     const phase1 = await workspaceAddPhase1Plan(ctx, source);
@@ -24750,12 +25533,12 @@ ${summarizeResult(phase2Result)}
 }
 
 // src/workspace/index.ts
-import { existsSync as existsSync31 } from "fs";
-import { basename as basename13, join as join59, posix as posix12 } from "path";
+import { existsSync as existsSync32 } from "fs";
+import { basename as basename13, join as join61, posix as posix12 } from "path";
 
 // src/workspace/detect.ts
-import { existsSync as existsSync30, readdirSync as readdirSync16, statSync as statSync6 } from "fs";
-import { join as join58 } from "path";
+import { existsSync as existsSync31, readdirSync as readdirSync17, statSync as statSync6 } from "fs";
+import { join as join60 } from "path";
 function normalizeRepoPath(raw) {
   const value = raw.trim().replace(/\\/g, "/");
   if (value.length === 0) return "";
@@ -24772,9 +25555,9 @@ function normalizeRepoPath(raw) {
   return parts.join("/");
 }
 function isGitRepo(parent, repo) {
-  const dir = join58(parent, repo);
+  const dir = join60(parent, repo);
   try {
-    return statSync6(dir).isDirectory() && existsSync30(join58(dir, ".git"));
+    return statSync6(dir).isDirectory() && existsSync31(join60(dir, ".git"));
   } catch {
     return false;
   }
@@ -24782,7 +25565,7 @@ function isGitRepo(parent, repo) {
 function detectChildRepos(parent, explicit = []) {
   if (explicit.length > 0) {
     const repos = [...new Set(explicit.map(normalizeRepoPath).filter((r) => r.length > 0))];
-    const missing = repos.filter((r) => !existsSync30(join58(parent, r)));
+    const missing = repos.filter((r) => !existsSync31(join60(parent, r)));
     if (missing.length > 0) {
       throw new AihError(
         `workspace --repos entries do not exist under the parent: ${missing.join(", ")}`,
@@ -24800,14 +25583,14 @@ function detectChildRepos(parent, explicit = []) {
   }
   let entries;
   try {
-    entries = readdirSync16(parent);
+    entries = readdirSync17(parent);
   } catch {
     return [];
   }
   return entries.filter((name) => !name.startsWith(".")).filter((name) => {
-    const dir = join58(parent, name);
+    const dir = join60(parent, name);
     try {
-      return statSync6(dir).isDirectory() && existsSync30(join58(dir, ".git"));
+      return statSync6(dir).isDirectory() && existsSync31(join60(dir, ".git"));
     } catch {
       return false;
     }
@@ -25174,7 +25957,7 @@ function hasObjectRepos(raw) {
 function childScaffoldedProbe(repo, dir) {
   return probe(`child ${repo} scaffolded`, (ctx) => {
     const name = `child ${repo} scaffolded`;
-    const present = existsSync31(join59(ctx.root, repo, dir, "RULE_ROUTER.md"));
+    const present = existsSync32(join61(ctx.root, repo, dir, "RULE_ROUTER.md"));
     return present ? { name, verdict: "pass", detail: `${repo}/${dir}/ canon present` } : { name, verdict: "skip", detail: `not scaffolded \u2014 run \`aih init ./${repo} --apply\`` };
   });
 }
@@ -25246,7 +26029,7 @@ async function workspacePlan(ctx) {
   for (const repo of repos) actions.push(childScaffoldedProbe(repo, dir));
   return plan("workspace", ...actions);
 }
-var command27 = {
+var command29 = {
   name: "workspace",
   summary: "Scaffold a multi-repo workspace: cross-repo map, combined graph/filesystem MCP, .code-workspace (parent-only)",
   options: [
@@ -25264,7 +26047,7 @@ var command27 = {
 
 // src/commands/run.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { basename as basename14, join as join61 } from "path";
+import { basename as basename14, join as join63 } from "path";
 
 // src/internals/prompt.ts
 import { createInterface } from "readline";
@@ -25291,7 +26074,7 @@ import { isAbsolute as isAbsolute9 } from "path";
 
 // src/program.ts
 import { Command } from "commander";
-var VERSION = "0.1.0";
+var VERSION = "0.3.0";
 function buildProgram() {
   const program = new Command();
   program.name("aih").description("Enterprise AI Bootstrapping Harness \u2014 governed, proxy-safe AI coding setup").version(VERSION).showHelpAfterError("(add --help for usage)");
@@ -25363,8 +26146,8 @@ function reportToSarif(report, toolName = "aih") {
 
 // src/logging/run-log.ts
 import { appendFileSync, mkdirSync as mkdirSync2 } from "fs";
-import { join as join60 } from "path";
-var RUNS_DIR = join60(".aih", "runs");
+import { join as join62 } from "path";
+var RUNS_DIR = join62(".aih", "runs");
 function statusFor(verifyFailed, execFailed) {
   if (verifyFailed) return "failed";
   if (execFailed) return "partial";
@@ -25413,9 +26196,9 @@ function monthFile(date) {
 }
 function appendRunLog(root, entry2, date) {
   try {
-    const dir = join60(root, RUNS_DIR);
+    const dir = join62(root, RUNS_DIR);
     mkdirSync2(dir, { recursive: true });
-    appendFileSync(join60(dir, monthFile(date)), `${JSON.stringify(entry2)}
+    appendFileSync(join62(dir, monthFile(date)), `${JSON.stringify(entry2)}
 `);
   } catch {
   }
@@ -25426,7 +26209,7 @@ var delay = (ms) => new Promise((r) => setTimeout(r, ms));
 var SETUP_FILES = ["SETUP.md", "docs/SETUP.md", ".aih/SETUP.md"];
 function readSetupText2(root) {
   for (const rel of SETUP_FILES) {
-    const text = readIfExists(join61(root, rel));
+    const text = readIfExists(join63(root, rel));
     if (text !== void 0) return text;
   }
   return void 0;
@@ -25448,12 +26231,12 @@ function extractOptions(spec, opts) {
   }
   return picked;
 }
-async function runCapability(spec, command28, deps = {}) {
+async function runCapability(spec, command30, deps = {}) {
   const env = deps.env ?? process.env;
   const write = deps.write ?? ((t) => process.stdout.write(t));
   const run = deps.run ?? defaultRunner;
-  const opts = command28.optsWithGlobals();
-  const defaultPositionalRoot = Array.isArray(command28.processedArgs) ? command28.processedArgs[0] : void 0;
+  const opts = command30.optsWithGlobals();
+  const defaultPositionalRoot = Array.isArray(command30.processedArgs) ? command30.processedArgs[0] : void 0;
   const positionalRoot = deps.positionalRoot === false ? void 0 : deps.positionalRoot ?? defaultPositionalRoot;
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
   const startedAt = now();
@@ -25469,10 +26252,10 @@ async function runCapability(spec, command28, deps = {}) {
   try {
     const resolvedRoot = positionalRoot ?? opts.root ?? env.AIH_ROOT ?? process.cwd();
     const marker = readAihConfig(resolvedRoot);
-    const contextDirSource = optionSource(command28, "contextDir");
+    const contextDirSource = optionSource(command30, "contextDir");
     const contextDirFromFlag = contextDirSource === "cli" ? opts.contextDir : void 0;
     const contextDirFromMarker = contextDirFromFlag === void 0 ? marker?.contextDir : void 0;
-    const postureFlagSource = optionSource(command28, "posture") === "cli" ? "cli" : void 0;
+    const postureFlagSource = optionSource(command30, "posture") === "cli" ? "cli" : void 0;
     const resolvedPosture = resolvePosture({
       root: resolvedRoot,
       env,
@@ -25490,7 +26273,7 @@ async function runCapability(spec, command28, deps = {}) {
     });
     json = settings.json;
     const host = makeHostAdapter({ run, env });
-    const wantConfirm = opts.detect === true && opts.yes !== true && !settings.json;
+    const wantConfirm = (opts.detect === true || spec.wantsInstallPrompt === true) && opts.yes !== true && !settings.json;
     const prompter = deps.prompter ?? (wantConfirm && isInteractive(env) ? makeReadlinePrompter() : void 0);
     const watchSec = positiveInt(opts.refresh);
     const liveOpen = opts.open === true || opts.demo === true || watchSec !== void 0;
@@ -25670,18 +26453,20 @@ var CAPABILITIES = [
   command17,
   command5,
   command8,
-  command24,
   command26,
-  command21,
   command25,
+  command28,
+  command21,
+  command27,
   command10,
   command7,
   command,
-  command27,
+  command29,
   command2,
+  command23,
   command22
 ];
-var READONLY = [command11, command23, verifyCommand];
+var READONLY = [command11, command24, verifyCommand];
 var ALL_COMMANDS = [...CAPABILITIES, ...READONLY];
 function addSharedFlags(cmd) {
   return cmd.option("--apply", "execute the plan (default: dry-run; nothing is written)").option(
@@ -25707,8 +26492,8 @@ function registerCommands(program) {
       else cmd.option(o.flags, o.description);
     }
     cmd.action(
-      async (_rootArg, _options, command28) => {
-        process.exitCode = await runCapability(spec, command28);
+      async (_rootArg, _options, command30) => {
+        process.exitCode = await runCapability(spec, command30);
       }
     );
     if (spec.name === "workspace") {
@@ -25718,8 +26503,8 @@ function registerCommands(program) {
         if (o.default !== void 0) add.option(o.flags, o.description, o.default);
         else add.option(o.flags, o.description);
       }
-      add.action(async (_source, _options, command28) => {
-        process.exitCode = await runWorkspaceAdd(command28);
+      add.action(async (_source, _options, command30) => {
+        process.exitCode = await runWorkspaceAdd(command30);
       });
       const snap = cmd.command(snapshotCommand.name).description(snapshotCommand.summary).argument("[root]", "target workspace root (defaults to --root or cwd)");
       addSharedFlags(snap);
@@ -25728,8 +26513,8 @@ function registerCommands(program) {
         else snap.option(o.flags, o.description);
       }
       snap.action(
-        async (_rootArg, _options, command28) => {
-          process.exitCode = await runCapability(snapshotCommand, command28);
+        async (_rootArg, _options, command30) => {
+          process.exitCode = await runCapability(snapshotCommand, command30);
         }
       );
       const task = cmd.command(taskPlanCommand.name).description(taskPlanCommand.summary).argument("<task>", "workspace task description");
@@ -25738,8 +26523,8 @@ function registerCommands(program) {
         if (o.default !== void 0) task.option(o.flags, o.description, o.default);
         else task.option(o.flags, o.description);
       }
-      task.action(async (taskText, _options, command28) => {
-        process.exitCode = await runCapability(taskPlanCommand, command28, {
+      task.action(async (taskText, _options, command30) => {
+        process.exitCode = await runCapability(taskPlanCommand, command30, {
           positionalRoot: false,
           optionOverrides: { task: taskText }
         });
@@ -25753,8 +26538,8 @@ function registerCommands(program) {
     if (o.default !== void 0) allow.option(o.flags, o.description, o.default);
     else allow.option(o.flags, o.description);
   }
-  allow.action(async (source, _options, command28) => {
-    process.exitCode = await runCapability(trustAllowCommand, command28, {
+  allow.action(async (source, _options, command30) => {
+    process.exitCode = await runCapability(trustAllowCommand, command30, {
       positionalRoot: false,
       optionOverrides: { source }
     });
@@ -25765,8 +26550,8 @@ function registerCommands(program) {
     if (o.default !== void 0) list.option(o.flags, o.description, o.default);
     else list.option(o.flags, o.description);
   }
-  list.action(async (_options, command28) => {
-    process.exitCode = await runCapability(trustListCommand, command28, { positionalRoot: false });
+  list.action(async (_options, command30) => {
+    process.exitCode = await runCapability(trustListCommand, command30, { positionalRoot: false });
   });
   const pin = trust.command(trustPinCommand.name).description(trustPinCommand.summary).argument("<source>", "GitHub owner/repo trust source");
   addSharedFlags(pin);
@@ -25774,8 +26559,8 @@ function registerCommands(program) {
     if (o.default !== void 0) pin.option(o.flags, o.description, o.default);
     else pin.option(o.flags, o.description);
   }
-  pin.action(async (source, _options, command28) => {
-    process.exitCode = await runCapability(trustPinCommand, command28, {
+  pin.action(async (source, _options, command30) => {
+    process.exitCode = await runCapability(trustPinCommand, command30, {
       positionalRoot: false,
       optionOverrides: { source }
     });
@@ -25786,8 +26571,8 @@ function registerCommands(program) {
     if (o.default !== void 0) scan.option(o.flags, o.description, o.default);
     else scan.option(o.flags, o.description);
   }
-  scan.action(async (target, _options, command28) => {
-    process.exitCode = await runCapability(trustScanCommand, command28, {
+  scan.action(async (target, _options, command30) => {
+    process.exitCode = await runCapability(trustScanCommand, command30, {
       positionalRoot: false,
       optionOverrides: { target }
     });
@@ -25799,8 +26584,8 @@ function registerCommands(program) {
     else verify.option(o.flags, o.description);
   }
   verify.action(
-    async (id, _options, command28) => {
-      process.exitCode = await runCapability(trustVerifyCommand, command28, {
+    async (id, _options, command30) => {
+      process.exitCode = await runCapability(trustVerifyCommand, command30, {
         positionalRoot: false,
         optionOverrides: { id }
       });
@@ -25832,6 +26617,7 @@ export {
   probeMany,
   exec,
   envBlock,
+  remove,
   plan,
   stripTrailingNewlines,
   lines,
@@ -25873,4 +26659,4 @@ export {
   VERSION,
   buildProgram
 };
-//# sourceMappingURL=chunk-S7XFTZJW.js.map
+//# sourceMappingURL=chunk-7GVBGS5N.js.map