@akira-tl/forgerelay 0.8.7 → 0.8.9

package/docs/chatgpt-coding-workflow.md

@@ -164,9 +164,6 @@ same safe finalize/integrate/cleanup lifecycle before ForgeRelay deletes its ide
 For an already-closed managed-worktree Workspace, delete removes only ForgeRelay-owned
 state and does not recreate the physical backing.
 
-Legacy `devspace/*` managed branches remain closable when they are already stored
-in workspace metadata; only new managed branches use `forgerelay/*`.
-
 ## Instructions
 
 When a workspace opens, ForgeRelay first loads exactly one global system-instructions
@@ -253,8 +250,6 @@ global config directory plus:
 .forgerelay/agents/*.md
 ```
 
-Rename-era `.devspace/agents` discovery has ended.
-
 The workspace result exposes only compact profile metadata so the host can
 choose a provider/profile without loading full provider launch details. Read the
 ForgeRelay-owned `subagents` capability guide when delegation is actually needed;
@@ -350,10 +345,7 @@ and keeps widget usage focused on workspace/change review.
 
 `FORGERELAY_WIDGETS=off` disables widget UI.
 
-## Legacy configuration
+## Configuration
 
-`FORGERELAY_*` is the canonical environment-variable prefix. Rename-era
-`DEVSPACE_*` fallbacks and automatic `~/.devspace` reuse have ended. Migrate
-older installations explicitly; persisted internal identifiers that would
-otherwise orphan state remain compatible. See
-[Configuration Reference](configuration.md) for the current rules.
+`FORGERELAY_*` is the canonical environment-variable prefix. See
+[Configuration Reference](configuration.md) for the current settings.

package/docs/configuration.md

@@ -18,11 +18,6 @@ Override the directory with:
 FORGERELAY_CONFIG_DIR=/path/to/config npx @akira-tl/forgerelay serve
 ```
 
-The rename-era automatic fallback has ended. `DEVSPACE_CONFIG_DIR` is ignored,
-and the default directory is always `~/.forgerelay`. If an older installation
-still has data in a DevSpace-named directory, migrate it explicitly or point
-`FORGERELAY_CONFIG_DIR` at that directory during the migration.
-
 ## Commands
 
 ```bash
@@ -35,9 +30,7 @@ npx @akira-tl/forgerelay config set publicBaseUrl https://forge.example.com/forg
 
 ## Environment variables
 
-The public prefix is `FORGERELAY_*`. Rename-era `DEVSPACE_*` environment
-variables are no longer read. Migrate automation, service files, shell profiles,
-and CI configuration to the canonical ForgeRelay names.
+The public environment-variable prefix is `FORGERELAY_*`.
 
 ## Core variables
 
@@ -79,11 +72,6 @@ A single persisted string remains fully supported, so existing configs require n
 migration. For environment configuration, use a comma-separated list in
 `FORGERELAY_PUBLIC_BASE_URL`.
 
-ForgeRelay no longer auto-detects DevSpace-named state or worktree directories.
-Persisted `stateDir` and `worktreeRoot` values in `config.json` continue to win
-over defaults, so an explicit configuration may temporarily point at an older
-location while data is migrated.
-
 ## Native artifact download
 
 Native-file download is disabled by default. Enable it with:
@@ -101,7 +89,7 @@ The same settings may be persisted as `artifactsEnabled` and
 `artifactMaxFileBytes` in `config.json`.
 
 The tool currently supports the secure native-file publication path on Linux.
-See [Native File Download](artifact-exchange.md).
+See [Native File Download](reference/artifact-exchange.md).
 
 ## OAuth
 
@@ -111,13 +99,9 @@ ForgeRelay uses a single-user Owner-password OAuth approval flow.
 | --- | --- |
 | `FORGERELAY_OAUTH_ACCESS_TOKEN_TTL_SECONDS` | `3600` |
 | `FORGERELAY_OAUTH_REFRESH_TOKEN_TTL_SECONDS` | `2592000` |
-| `FORGERELAY_OAUTH_SCOPES` | legacy-compatible internal scope `devspace` |
+| `FORGERELAY_OAUTH_SCOPES` | `forgerelay` |
 | `FORGERELAY_OAUTH_ALLOWED_REDIRECT_HOSTS` | `chatgpt.com,localhost,127.0.0.1` |
 
-The default OAuth scope intentionally remains the legacy internal value during
-the rename so existing registrations/state do not need a destructive migration.
-This is a protocol compatibility identifier, not product branding.
-
 MCP clients discover metadata from:
 
 ```text
@@ -136,7 +120,7 @@ MCP clients discover metadata from:
 | `codex` | Experimental Codex-shaped compatibility adapter using `open_workspace`, `close_workspace`, `read`, `rename`, `delete`, `apply_patch`, `exec_command`, `write_stdin`, and `capability`. It does not define the ForgeRelay canonical interface. |
 
 `FORGERELAY_MINIMAL_TOOLS` remains a compatibility-style boolean alias when the
-explicit tool mode is unset. DevSpace-prefixed equivalents are no longer read.
+explicit tool mode is unset.
 
 `minimal` and `full` now resolve to the same regular 9-tool `tools/list`; `full`
 is retained only as a configuration-compatibility value. `codex` selects a
@@ -581,7 +565,7 @@ directories; deeper instruction files are discovered lazily when a workspace pat
 is first accessed. Reads surface newly discovered instructions inline, while
 side-effecting file/shell operations stop before execution and require a retry if
 that access discovers new local instructions. `FORGERELAY_AGENT_DIR` does not
-select a global instruction file; it remains a compatibility path for Agent Skills.
+select a global instruction file; its `skills` child is an additional Agent Skills source.
 
 ## Skills and subagents
 
@@ -589,7 +573,7 @@ select a global instruction file; it remains a compatibility path for Agent Skil
 | --- | --- |
 | `FORGERELAY_SKILLS` | Set to `0` to hide skills. Enabled by default. |
 | `FORGERELAY_SUBAGENTS` | Set to `1` to expose configured subagent profiles. |
-| `FORGERELAY_AGENT_DIR` | Defaults to `~/.codex`; its `skills` child is loaded for compatibility. |
+| `FORGERELAY_AGENT_DIR` | Defaults to `~/.codex`; its `skills` child is included as an additional Skill source. |
 | `FORGERELAY_SKILL_PATHS` | Optional comma-separated additional skill directories. |
 
 Standard Agent Skills are discovered from:
@@ -605,9 +589,12 @@ When subagents are enabled, profiles are discovered from:
 - the active ForgeRelay config directory's `agents/*.md`;
 - project `.forgerelay/agents/*.md`.
 
-DevSpace-named profile directories are no longer discovered automatically. Move
-those profiles or explicitly select their parent with `FORGERELAY_CONFIG_DIR`
-during migration.
+
+ForgeRelay does not install or bundle coding-agent executors. Subagent providers
+are available only when the corresponding user-installed executable can be found
+on the server. The default commands are `codex`, `claude`, `opencode`, `pi`,
+`cursor-agent`, and `copilot`. Override the first four when needed with
+`CODEX_COMMAND`, `CLAUDE_COMMAND`, `OPENCODE_COMMAND`, or `PI_COMMAND`.
 
 The ForgeRelay-owned `subagents` capability guide teaches the current CLI
 workflow on demand:

package/docs/gotchas.md

@@ -28,27 +28,6 @@ npm rebuild better-sqlite3
 npx @akira-tl/forgerelay doctor
 ```
 
-## Existing DevSpace config stopped being used
-
-The automatic rename-era fallback has ended. ForgeRelay now defaults to
-`~/.forgerelay` and ignores `DEVSPACE_*` environment variables.
-
-Check the resolved directory:
-
-```bash
-forgerelay doctor
-```
-
-If an older installation still needs data from a DevSpace-named directory,
-point the canonical setting at it explicitly while migrating:
-
-```bash
-FORGERELAY_CONFIG_DIR="$HOME/.forgerelay" forgerelay init
-```
-
-Do not delete the old directory until you have confirmed which persisted state,
-worktrees, skills, and profiles you still need.
-
 ## Public base URL includes `/mcp`
 
 Store the public base URL *before* the final `/mcp`. A routed deployment keeps
@@ -135,10 +114,6 @@ New installs normally use:
 ~/.forgerelay/auth.json
 ```
 
-ForgeRelay no longer discovers `~/.devspace/auth.json` automatically. Move the
-credential file to the active ForgeRelay config directory or explicitly set
-`FORGERELAY_CONFIG_DIR` while migrating.
-
 Regenerate setup intentionally with:
 
 ```bash
@@ -168,8 +143,6 @@ New managed branches use:
 forgerelay/*
 ```
 
-Legacy persisted `devspace/*` branches remain valid and closable.
-
 Uncommitted source-checkout changes are not automatically copied into a newly
 created worktree.
 
@@ -229,9 +202,6 @@ New profile locations include:
 .forgerelay/agents/*.md
 ```
 
-Legacy `.devspace/agents` paths are no longer scanned automatically. Move
-profiles into one of the canonical locations before upgrading.
-
 `forgerelay agents ls` lists sessions, not profile definitions. The compact
 profile catalog is returned through `open_workspace`.
 

package/docs/roadmap.md

@@ -55,8 +55,7 @@ The initial independent release establishes:
 - branch-backed managed worktrees using `forgerelay/*` branches;
 - safe `close_worktree` fast-forward lifecycle;
 - persisted worktree branch/target metadata;
-- existing local coding-agent profile/provider integration;
-- compatibility with legacy DevSpace configuration/state identifiers.
+- existing local coding-agent profile/provider integration.
 
 ## 0.2 — Hooks v1
 
@@ -358,9 +357,10 @@ Task is a checklist/continuation primitive rather than an execution scheduler:
 Subagent coordination can reference Task content when useful, but ForgeRelay does
 not bind Tasks to Subagent Sessions or infer Task completion from execution facts.
 
-## Compatibility policy
+## Project identity
 
-New public names use ForgeRelay:
+ForgeRelay uses its own package, CLI, configuration, state, project-directory,
+and managed-branch namespaces:
 
 - `@akira-tl/forgerelay`
 - `forgerelay`
@@ -369,9 +369,5 @@ New public names use ForgeRelay:
 - `.forgerelay`
 - `forgerelay/*` managed branches
 
-Rename-era public compatibility adapters have a bounded migration window rather
-than permanent support. `DEVSPACE_*`, automatic `~/.devspace` reuse, legacy
-`.devspace/agents` discovery, and old package-path special cases are retired once
-they are outside that window. Persisted internal identifiers remain compatible
-when removing them would orphan real user state; those are storage/protocol
-migration concerns, not public product aliases.
+Upstream attribution is preserved separately through `LICENSE`, `NOTICE.md`, and
+release provenance checks; it is not a runtime compatibility surface.

package/docs/security.md

@@ -60,10 +60,6 @@ FORGERELAY_OAUTH_OWNER_TOKEN="$(openssl rand -base64 32)"
 
 The token must be at least 16 characters.
 
-Rename-era `DEVSPACE_*` environment-variable and automatic `~/.devspace`
-configuration fallbacks have ended. Use canonical `FORGERELAY_*` settings and
-explicit paths when migrating older installations.
-
 ## Public URL and tunnels
 
 ForgeRelay needs `FORGERELAY_PUBLIC_BASE_URL` when an MCP client reaches it
@@ -186,7 +182,7 @@ not accept arbitrary signed URLs, local paths,
 embedded credentials, or base64 strings as substitutes.
 
 Downloads are streamed, size-limited, created without overwrite, and published
-as owner-only files. See [Native File Download](artifact-exchange.md).
+as owner-only files. See [Native File Download](reference/artifact-exchange.md).
 
 ## Logging
 

package/docs/setup.md

@@ -119,17 +119,6 @@ New installations use:
 
 Keep `auth.json` private.
 
-### Existing DevSpace configuration
-
-Automatic DevSpace directory fallback has ended. ForgeRelay defaults to
-`~/.forgerelay` and ignores `DEVSPACE_CONFIG_DIR`.
-
-Before upgrading an older installation, move or copy the needed configuration
-and credentials into the ForgeRelay directory, or temporarily point
-`FORGERELAY_CONFIG_DIR` at the old directory. If state or managed worktrees live
-under older paths, preserve them with explicit `stateDir` / `worktreeRoot`
-configuration until migration is complete.
-
 ## Check the setup
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akira-tl/forgerelay",
-  "version": "0.8.7",
+  "version": "0.8.9",
   "description": "Local development control plane for MCP coding agents.",
   "type": "module",
   "homepage": "https://github.com/Akira-TL/forgerelay#readme",
@@ -41,9 +41,11 @@
     "debug:serve": "node scripts/debug/serve.mjs",
     "debug:accept": "node scripts/debug/accept.mjs",
     "debug:accept:relay": "node scripts/debug/relay-accept.mjs",
-    "lsp:interop": "node scripts/lsp-interop.mjs",
+    "traffic:audit": "node --import tsx scripts/debug/traffic/traffic-audit.mjs",
+    "lsp:interop": "node scripts/lsp/interop.mjs",
     "wiki:check": "node scripts/wiki/sync.mjs check",
     "wiki:publish": "node scripts/wiki/sync.mjs publish",
+    "architecture:check": "node scripts/ci/architecture.mjs",
     "ci:verify": "node scripts/ci/verify.mjs",
     "release:parity": "node scripts/release-parity.mjs",
     "release:pack": "node scripts/release/pack.mjs",
@@ -51,7 +53,7 @@
     "release:push-ready": "node scripts/release/push-ready.mjs",
     "postinstall": "node scripts/fix-node-pty-permissions.mjs",
     "start": "node dist/cli.js serve",
-    "test": "node --test scripts/debug/runtime.test.mjs scripts/release-proof.test.mjs scripts/release/release-gate.test.mjs scripts/release/push-ready.test.mjs scripts/release/release-version.test.mjs && tsx src/oauth/router.test.ts && tsx src/remote-auth-cli.test.ts && tsx src/remote-ssh-auth-cli.test.ts && tsx src/remote-workspace-relay.test.ts && tsx src/remote-workspace-relay-process.test.ts && tsx src/config.test.ts && tsx src/lsp/language-server-config.test.ts && tsx src/lsp/normalization/hover.test.ts && tsx src/lsp/references.server.test.ts && tsx src/lsp/operations/document-symbols.server.test.ts && tsx src/lsp/operations/workspace-symbols.server.test.ts && tsx src/lsp/operations/diagnostics-push.server.test.ts && tsx src/lsp/operations/diagnostics-pull.server.test.ts && tsx src/lsp/operations/request-hardening.server.test.ts && tsx src/lsp/operations/recovery.server.test.ts && tsx src/lsp/operations/lifecycle.server.test.ts && tsx src/lsp/runtime/semantic-requests.test.ts && tsx src/logger.test.ts && tsx src/proxy-trust.test.ts && tsx src/mcp-app-template.test.ts && tsx src/hooks.test.ts && tsx src/capability-registry.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/request-meta.test.ts && tsx src/incoming-artifacts.test.ts && tsx src/artifact-download.test.ts && tsx src/ui/card-types.test.ts && tsx src/ui/workspace-lifecycle-app.test.ts && tsx src/ui/activity/model.test.ts && tsx src/ui/patch-display.test.ts && tsx src/ui/tool-display.test.ts && tsx src/apply-patch.test.ts && tsx src/process-platform.test.ts && tsx src/process-sessions.test.ts && tsx src/mcp-sessions.test.ts && tsx src/server-shutdown.test.ts && tsx src/subagents/providers/adapters/codex.test.ts && tsx src/subagents/providers/registry.test.ts && tsx src/subagents/providers/availability.test.ts && tsx src/subagents/profiles.test.ts && tsx src/subagents/cli-target.test.ts && tsx src/subagents/sessions/store.test.ts && tsx src/subagents/sessions/manager.test.ts && tsx src/subagents/sessions/mcp/capability.server.test.ts && tsx src/subagents/sessions/mcp/continuation.server.test.ts && tsx src/subagents/sessions/mcp/lifecycle.server.test.ts && tsx src/subagents/sessions/mcp/reconciliation.server.test.ts && tsx src/subagents/sessions/mcp/routing.server.test.ts && tsx src/roots.test.ts && tsx src/file-mutations.test.ts && tsx src/operations/edit-preflight.test.ts && tsx src/skills.test.ts && tsx src/db/migrations.test.ts && tsx src/workspace-store.test.ts && tsx src/workspace-tasks.test.ts && tsx src/workspace-task-reminders.test.ts && tsx src/activity/audit-store.test.ts && tsx src/activity/bash-output-store.test.ts && tsx src/activity/lifecycle.test.ts && tsx src/activity/query-service.test.ts && tsx src/operations/core-operation-executor.test.ts && tsx src/operations/bulk-mutation.test.ts && tsx src/operations/batch/scheduler.test.ts && tsx src/operations/batch/executor-policy.test.ts && tsx src/workspaces.test.ts && tsx src/workspace-conversation.test.ts && tsx src/review-checkpoints.test.ts && tsx src/lsp/code-intelligence.server.test.ts && npm run build:app && tsx src/server.test.ts && tsx src/oauth-store.test.ts && tsx src/cli.test.ts",
+    "test": "node --test scripts/debug/runtime.test.mjs scripts/release-proof.test.mjs scripts/release/release-gate.test.mjs scripts/release/push-ready.test.mjs scripts/release/release-version.test.mjs && tsx src/mcp/oauth/router.test.ts && tsx src/workspaces/relay/auth/remote-auth-cli.test.ts && tsx src/workspaces/relay/auth/remote-ssh-auth-cli.test.ts && tsx src/workspaces/relay/tests/lifecycle.test.ts && tsx src/workspaces/relay/tests/routing.test.ts && tsx src/workspaces/relay/tests/ssh.test.ts && tsx src/workspaces/relay/tests/process.test.ts && tsx src/runtime/config/config.test.ts && tsx src/lsp/language-server-config.test.ts && tsx src/lsp/normalization/hover.test.ts && tsx src/lsp/references.server.test.ts && tsx src/lsp/operations/document-symbols.server.test.ts && tsx src/lsp/operations/workspace-symbols.server.test.ts && tsx src/lsp/operations/diagnostics-push.server.test.ts && tsx src/lsp/operations/diagnostics-pull.server.test.ts && tsx src/lsp/operations/request-hardening.server.test.ts && tsx src/lsp/operations/recovery.server.test.ts && tsx src/lsp/operations/lifecycle.server.test.ts && tsx src/lsp/runtime/semantic-requests.test.ts && tsx src/runtime/logging/logger.test.ts && tsx src/runtime/logging/proxy-trust.test.ts && tsx src/runtime/state/lock/file-lock.test.ts && tsx src/mcp/panel/mcp-app-template.test.ts && tsx src/mcp/hooks/hooks.test.ts && tsx src/mcp/server/core/capability-registry.test.ts && tsx src/mcp/server-instructions.test.ts && tsx src/mcp/request-meta.test.ts && tsx src/mcp/artifacts/incoming-artifacts.test.ts && tsx src/mcp/artifacts/artifact-download.test.ts && tsx src/ui/core/card-types.test.ts && tsx src/ui/activity/model.test.ts && tsx src/ui/activity/detail-card.test.ts && tsx src/ui/review/patch-display.test.ts && tsx src/ui/core/tool-display.test.ts && tsx src/mcp/filesystem/apply-patch.test.ts && tsx src/mcp/process/process-platform.test.ts && tsx src/mcp/process/process-sessions.test.ts && tsx src/mcp/server/transport/mcp-sessions.test.ts && tsx src/mcp/server/transport/server-shutdown.test.ts && tsx src/subagents/providers/adapters/codex.test.ts && tsx src/subagents/providers/adapters/pi.test.ts && tsx src/subagents/providers/registry.test.ts && tsx src/subagents/providers/availability.test.ts && tsx src/subagents/profiles.test.ts && tsx src/subagents/cli-target.test.ts && tsx src/subagents/sessions/store.test.ts && tsx src/subagents/sessions/manager.test.ts && tsx src/subagents/sessions/mcp/capability.server.test.ts && tsx src/subagents/sessions/mcp/continuation.server.test.ts && tsx src/subagents/sessions/mcp/lifecycle.server.test.ts && tsx src/subagents/sessions/mcp/reconciliation.server.test.ts && tsx src/subagents/sessions/mcp/routing.server.test.ts && tsx src/mcp/filesystem/roots.test.ts && tsx src/mcp/filesystem/file-mutations.test.ts && tsx src/mcp/operations/edit-preflight.test.ts && tsx src/workspaces/resources/skills.test.ts && tsx src/runtime/state/db/migrations.test.ts && tsx src/workspaces/state/workspace-store.test.ts && tsx src/workspaces/tasks/workspace-tasks.test.ts && tsx src/workspaces/tasks/workspace-task-reminders.test.ts && tsx src/activity/history/audit-store.test.ts && tsx src/activity/history/bash-output-store.test.ts && tsx src/activity/runtime/lifecycle.test.ts && tsx src/activity/history/query-service.test.ts && tsx src/mcp/operations/core-operation-executor.test.ts && tsx src/mcp/operations/bulk-mutation.test.ts && tsx src/mcp/operations/batch/scheduler.test.ts && tsx src/mcp/operations/batch/executor-policy.test.ts && tsx src/workspaces.test.ts && tsx src/workspaces/conversation-checkout.test.ts && tsx src/workspaces/conversation-worktree.test.ts && tsx src/workspaces/review/review-checkpoints.test.ts && tsx src/lsp/code-intelligence.server.test.ts && npm run build:app && tsx src/mcp/process/server.test.ts && tsx src/mcp/panel/server.test.ts && tsx src/mcp/server/server.test.ts && tsx src/mcp/oauth/oauth-store.test.ts && tsx src/cli/cli.test.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "release:check": "node scripts/release-version.mjs check",
     "release:tag-check": "node scripts/release-version.mjs tag",
@@ -73,15 +75,11 @@
   "license": "MIT",
   "dependencies": {
     "@agentclientprotocol/sdk": "^1.1.0",
-    "@anthropic-ai/claude-agent-sdk": "^0.3.200",
     "@clack/prompts": "^1.5.1",
-    "@earendil-works/pi-coding-agent": "^0.80.3",
     "@modelcontextprotocol/ext-apps": "^1.7.2",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@openai/codex-sdk": "^0.142.5",
-    "@opencode-ai/sdk": "^1.17.13",
     "@pierre/diffs": "^1.2.5",
-    "better-sqlite3": "^12.10.0",
+    "better-sqlite3": "^13.0.3",
     "diff": "^8.0.3",
     "drizzle-orm": "^0.45.2",
     "express": "^5.2.1",

package/scripts/ci/architecture.mjs

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { extname, basename, dirname } from "node:path";
+import { readFileSync } from "node:fs";
+
+const MAX_LINES = 800;
+const MAX_DIRECT_FILES = 8;
+const MAX_DIRECT_DIRS = 8;
+const LINE_LIMIT_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".mjs", ".cjs", ".css"]);
+
+// Repository-root protocol files are intentionally discoverable by Git, npm,
+// Node, Vite, contributors, and agents. Keep that conventional surface explicit
+// instead of hiding required/default-discovery files merely to satisfy a count.
+const ROOT_PROTOCOL_FILES = new Set([
+  ".env.example",
+  ".gitignore",
+  ".nvmrc",
+  "AGENTS.md",
+  "CHANGELOG.md",
+  "CONTEXT.md",
+  "CONTRIBUTING.md",
+  "LICENSE",
+  "NOTICE.md",
+  "README.md",
+  "package-lock.json",
+  "package.json",
+  "tsconfig.build.json",
+  "tsconfig.json",
+  "vite.config.ts",
+]);
+
+const tracked = gitTrackedFiles();
+const violations = [];
+const directFiles = new Map();
+const directDirs = new Map();
+
+for (const path of tracked) {
+  const parent = normalizeDirectory(dirname(path));
+  directFiles.set(parent, (directFiles.get(parent) ?? 0) + 1);
+
+  let child = parent;
+  while (child !== ".") {
+    const grandparent = normalizeDirectory(dirname(child));
+    let children = directDirs.get(grandparent);
+    if (!children) directDirs.set(grandparent, children = new Set());
+    children.add(basename(child));
+    child = grandparent;
+  }
+
+  if (LINE_LIMIT_EXTENSIONS.has(extname(path))) {
+    const lines = physicalLineCount(readFileSync(path, "utf8"));
+    if (lines > MAX_LINES) violations.push(`${path}: ${lines} lines > ${MAX_LINES}`);
+  }
+}
+
+for (const path of tracked.filter((path) => dirname(path) === ".")) {
+  if (!ROOT_PROTOCOL_FILES.has(path)) violations.push(`repository root has unclassified file: ${path}`);
+}
+
+for (const allowed of ROOT_PROTOCOL_FILES) {
+  if (!tracked.includes(allowed)) continue;
+  // Presence is allowed, not required; this loop documents the intentional set.
+}
+
+const directories = new Set([...directFiles.keys(), ...directDirs.keys()]);
+for (const directory of [...directories].sort()) {
+  const files = directFiles.get(directory) ?? 0;
+  const dirs = directDirs.get(directory)?.size ?? 0;
+  if (directory !== "." && files > MAX_DIRECT_FILES) {
+    violations.push(`${directory}: ${files} direct files > ${MAX_DIRECT_FILES}`);
+  }
+  if (dirs > MAX_DIRECT_DIRS) {
+    violations.push(`${directory}: ${dirs} direct directories > ${MAX_DIRECT_DIRS}`);
+  }
+}
+
+if (violations.length > 0) {
+  console.error("Architecture check failed:");
+  for (const violation of violations) console.error(`- ${violation}`);
+  process.exit(1);
+}
+
+console.log(
+  `Architecture check passed: ${tracked.length} tracked files; ` +
+  `code <= ${MAX_LINES} lines; non-root directories <= ${MAX_DIRECT_FILES} files / ${MAX_DIRECT_DIRS} directories.`,
+);
+
+function gitTrackedFiles() {
+  const result = spawnSync("git", ["ls-files", "-z"], {
+    cwd: process.cwd(),
+    encoding: "utf8",
+    windowsHide: true,
+    shell: false,
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error(`git ls-files failed with exit ${result.status ?? "unknown"}`);
+  return result.stdout.split("\0").filter(Boolean);
+}
+
+function normalizeDirectory(directory) {
+  return directory === "" ? "." : directory.replaceAll("\\", "/");
+}
+
+function physicalLineCount(text) {
+  if (text.length === 0) return 0;
+  const newlines = text.match(/\n/g)?.length ?? 0;
+  return newlines + (text.endsWith("\n") ? 0 : 1);
+}

package/scripts/ci/verify.mjs

@@ -9,10 +9,15 @@ if (!npmCli) {
 
 console.log(`CI environment: ${process.platform}/${process.arch} ${process.version}`);
 runNpm(["--version"], "npm version");
+runNpm(["run", "architecture:check"], "Architecture");
 runNpm(["run", "release:check"], "Release metadata");
 runNpm(["run", "typecheck"], "Typecheck");
 runNpm(["test"], "Full test suite");
 runNpm(["run", "build"], "Build");
+// The traffic audit is an end-to-end wire-budget check, not a platform feature
+// matrix. Run it once on Linux so regressions are gated without tripling the
+// 7677/7678 server exercise across every CI operating system.
+if (process.platform === "linux") runNpm(["run", "traffic:audit"], "Traffic audit");
 runNpm(["run", "lsp:interop"], "Optional LSP interoperability");
 run(process.execPath, ["dist/cli.js", "doctor"], "Doctor");