@aperant/framework 0.17.0 → 0.20.0

package/src/cli/coordination/auto-emit-artifact-ready.mjs

@@ -3,8 +3,8 @@
  * auto-emit-artifact-ready.mjs — code-enforced plan-ready signal.
  *
  * Promotes the `artifact.ready{kind:'plan'}` emit from a markdown contract
- * in `skills/apt-plan/adapters/conductor.md` to a framework-level
- * postcondition of `apt-tools commit`. This closes the Conductor v2 gap
+ * in `skills/apt-plan/adapters/showrunner.md` to a framework-level
+ * postcondition of `apt-tools commit`. This closes the Showrunner v2 gap
  * exposed during live verification 2026-05-15: the planner's QUICK /
  * SIMPLE track is hard-exempt from "new interaction discipline"
  * (Aperant Fast Path Guarantee ID-05), so the markdown emit step was
@@ -19,7 +19,7 @@
  *     OpenCode, Codex) traverses via `apt-tools commit`
  *
  * Conditions for emit (ALL must hold — otherwise no-op):
- *   1. `APERANT_TERMINAL_ID` is set in process.env (Conductor PTY context).
+ *   1. `APERANT_TERMINAL_ID` is set in process.env (Showrunner PTY context).
  *   2. The committed files include a path matching
  *      `.aperant/tasks/{task-id}/implementation_plan.json`.
  *
@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto'
 import { appendFileSync, mkdirSync, readFileSync } from 'node:fs'
 import { hostname } from 'node:os'
 import { join } from 'node:path'
-import { validateConductorEvent } from './event-schema.mjs'
+import { validateShowrunnerEvent } from './event-schema.mjs'
 
 const PLAN_PATH_RE = /^(?:\.\/)?\.aperant\/tasks\/([^/]+)\/implementation_plan\.json$/
 
@@ -70,7 +70,7 @@ export function maybeAutoEmitPlanReady({ files, projectRoot }) {
 		terminal_id: terminalId,
 	}
 
-	const validation = validateConductorEvent('artifact.ready', data)
+	const validation = validateShowrunnerEvent('artifact.ready', data)
 	if (!validation.ok) {
 		return { emitted: false, reason: `schema violation: ${validation.error}` }
 	}

package/src/cli/coordination/event-schema.d.ts

@@ -5,9 +5,11 @@
 
 export type ValidateResult = { ok: true } | { ok: false; error: string }
 
-export function validateConductorEvent(
+export function validateShowrunnerEvent(
 	op: string,
 	data: Record<string, unknown> | undefined | null,
 ): ValidateResult
 
-export const CONDUCTOR_VALIDATED_OPS: ReadonlySet<string>
+export const SHOWRUNNER_VALIDATED_OPS: ReadonlySet<string>
+
+export const PRODUCE_VALIDATED_OPS: ReadonlySet<string>

package/src/cli/coordination/event-schema.mjs

@@ -1,12 +1,12 @@
 /**
  * @internal
- * event-schema.mjs — single source of truth for conductor event payload shapes.
+ * event-schema.mjs — single source of truth for showrunner event payload shapes.
  *
  * Why this lives in `framework`, not `core`:
  *   `packages/core` depends on `@aperant/framework`. The schema is shared by
  *   the CLI write path (`commands/event.mjs`), the framework lifecycle write
  *   seam (`coordination/store.mjs:appendEvent`), and the core IPC write seam
- *   (`packages/core/src/runtime/orchestration/conductor/event-log.ts`).
+ *   (`packages/core/src/runtime/orchestration/showrunner/event-log.ts`).
  *   Putting it in the lower layer keeps a single rule table that every
  *   writer can import.
  *
@@ -22,11 +22,11 @@
  *   - `awaiting-input` / `input-rescinded` MUST carry both terminal_id and
  *     request_id so the drawer can pair cards strictly.
  *   - `artifact.ready{kind:'plan'}` is the canonical plan-completion signal
- *     consumed by the conductor's reviewer queue (Step 5's reviewPlan tool).
+ *     consumed by the showrunner's reviewer queue (Step 5's reviewPlan tool).
  */
 
-/** Conductor ops the schema enforces. Other ops pass through unchanged. */
-const CONDUCTOR_OPS = new Set([
+/** Showrunner ops the schema enforces. Other ops pass through unchanged. */
+const SHOWRUNNER_OPS = new Set([
 	'phase.changed',
 	'artifact.ready',
 	'awaiting-input',
@@ -35,34 +35,120 @@ const CONDUCTOR_OPS = new Set([
 	'budget.exceeded',
 	'terminal.enrolled',
 	'terminal.unenrolled',
-	'conductor.intent',
-	'conductor.cross_check',
-	'conductor.realignment',
+	'showrunner.intent',
+	'showrunner.cross_check',
+	'showrunner.realignment',
 	// c-4 (action-capable) — gate verdict + boot-replay audit trail
-	'conductor.action.executed',
-	'conductor.action.gate_blocked',
-	'conductor.boot_reconciled',
+	'showrunner.action.executed',
+	'showrunner.action.gate_blocked',
+	'showrunner.boot_reconciled',
 	// AC21 — MCP-server consent decisions audited to .aperant/events/*.jsonl
 	'mcp-consent.approved',
 	'mcp-consent.denied',
 	'mcp-consent.tofu-reprompt',
 ])
 
+/**
+ * Produce outer-loop ops (M1) — the `/apt:produce` roadmap-mutation vocabulary.
+ * Kept as a PARALLEL set (not merged into SHOWRUNNER_OPS) so the two surfaces
+ * stay conceptually distinct; both are consulted by the same
+ * `validateShowrunnerEvent` entry point that `store.appendEvent` calls, so a
+ * malformed produce event is rejected fail-closed on the canonical event log
+ * (ID-04 / AC4). Every produce op carries a `run_id` tagging its run.
+ */
+const PRODUCE_OPS = new Set([
+	'produce.run.started',
+	'produce.setpoint.frozen',
+	'produce.roadmap.milestone_added',
+	'produce.roadmap.milestone_status_changed',
+	'produce.tick',
+	// M2 — the oracle + held-out cross-family blind-probe forensic trail. Every
+	// oracle/probe decision lands on the same append-only log, fail-closed
+	// against malformed entries (US-1 / AC1 / AC12). The probe ops are
+	// STRUCTURALLY blind: they carry only a hash/result/family, NEVER the probe
+	// content (ID-M2-03). The projection still folds `produce.roadmap.*` ONLY,
+	// so these never enter the roadmap the Showrunner re-reads each tick.
+	'produce.milestone.implemented',
+	'produce.probe.frozen',
+	'produce.probe.run',
+	'produce.oracle.judged',
+	'produce.oracle.verdict',
+	'produce.oracle.probe_gap',
+	// M3 — the Lyapunov acceptance-criteria ledger + scope-change forensic trail.
+	// Every criteria-open / criteria-close / scope-change decision lands on the
+	// same append-only log, fail-closed against malformed entries (US-4 / AC1). V
+	// (open acceptance criteria) = declared − closed, folded by ledger.mjs. The
+	// projection still folds `produce.roadmap.*` ONLY — criteria/scope ops are a
+	// SEPARATE fold, so the M1/M2 roadmap-blindness invariant is preserved.
+	'produce.criteria.declared',
+	'produce.criteria.closed',
+	'produce.scope.changed',
+	// M4 — the saga + verification-TTL forensic trail. Each plan→execute→verify→
+	// review→ship phase transition, every FORWARD compensation, every diverse
+	// review verdict, and every TTL re-verify / regression lands on the same
+	// append-only log, fail-closed against malformed entries (US-2 / AC1). The
+	// saga fold is SEPARATE from the roadmap projection (which still folds
+	// `produce.roadmap.*` ONLY), so the M1/M2/M3 blindness invariant holds. The
+	// saga-phase ops enforce a closed `phase` vocabulary (ALLOWED_SAGA_PHASES),
+	// mirroring the phase.changed.to / artifact.ready.kind allowed-value pattern.
+	'produce.saga.phase_entered',
+	'produce.saga.phase_completed',
+	'produce.saga.compensated',
+	'produce.saga.reviewed',
+	'produce.ttl.reverified',
+	'produce.ttl.regression_detected',
+	// M5 — the WSJF/WIP scheduler's audited decision. The wake `tick` emits ONE
+	// `produce.schedule.computed` alongside its `produce.tick` so the scheduler's
+	// pick is a recorded fact on the append-only log (the event-sourced ethos). It
+	// uses the `produce.schedule.*` prefix — the roadmap projection folds
+	// `produce.roadmap.*` ONLY, so this op NEVER enters the roadmap the Showrunner
+	// re-reads (the M1/M2 blindness invariant holds automatically — ID-M5-06).
+	'produce.schedule.computed',
+	// M6 — the Claim Envelope lifecycle forensic trail. A claim's CONTENT lives in
+	// the frozen `claims/<claim-id>.json` file, referenced by `content_hash` — it
+	// NEVER touches the log (ID-M6-07, mirrors produce.probe.frozen /
+	// produce.setpoint.frozen). `declared` seeds the claim ledger, `expired` drops
+	// it from the active set, `consumed` records a bounded down-projected delta
+	// (target_kind value-checked against the closed set). The claim ledger is a
+	// SEPARATE fold (projectClaims) — the roadmap projection still folds
+	// `produce.roadmap.*` ONLY, so these ops NEVER enter the roadmap the Showrunner
+	// re-reads (the M1/M2 blindness invariant holds automatically).
+	'produce.claim.declared',
+	'produce.claim.expired',
+	'produce.claim.consumed',
+])
+
 /** Allowed values for `phase.changed.to` — PTY busy/idle only. */
 const ALLOWED_PHASE_VALUES = new Set(['busy', 'idle'])
 
+/**
+ * Allowed values for the saga `phase` on `produce.saga.phase_entered` /
+ * `produce.saga.phase_completed` / `produce.saga.compensated` (M4). The saga
+ * models plan→execute→verify→review→ship; an out-of-vocabulary phase is rejected
+ * fail-closed, mirroring the ALLOWED_PHASE_VALUES value check for phase.changed.
+ */
+const ALLOWED_SAGA_PHASES = new Set(['plan', 'execute', 'verify', 'review', 'ship'])
+
+/**
+ * Allowed values for the claim `target_kind` on `produce.claim.consumed` (M6).
+ * Consumption is a DELTA down-projection onto ONE acceptance-criterion / subtask /
+ * proof-obligation (ID-M6-06); an out-of-vocabulary kind is rejected fail-closed,
+ * mirroring the ALLOWED_SAGA_PHASES value check for the saga-phase ops.
+ */
+const ALLOWED_CLAIM_TARGET_KINDS = new Set(['acceptance_criterion', 'subtask', 'proof_obligation'])
+
 /** Allowed values for `artifact.ready.kind`. */
 const ALLOWED_ARTIFACT_KINDS = new Set(['plan', 'spec', 'build', 'review'])
 
 /**
- * Validate the data payload of a conductor event against the op's contract.
+ * Validate the data payload of a showrunner event against the op's contract.
  *
  * @param {string} op
  * @param {Record<string, unknown> | undefined | null} data
  * @returns {{ ok: true } | { ok: false, error: string }}
  */
-export function validateConductorEvent(op, data) {
-	if (!CONDUCTOR_OPS.has(op)) return { ok: true }
+export function validateShowrunnerEvent(op, data) {
+	if (!SHOWRUNNER_OPS.has(op) && !PRODUCE_OPS.has(op)) return { ok: true }
 	const d = data && typeof data === 'object' ? data : {}
 
 	switch (op) {
@@ -105,13 +191,13 @@ export function validateConductorEvent(op, data) {
 			return { ok: true }
 		}
 
-		case 'conductor.intent':
+		case 'showrunner.intent':
 			return requireFields(op, d, ['terminal_id', 'request_id', 'action', 'reasoning'])
 
-		case 'conductor.cross_check':
+		case 'showrunner.cross_check':
 			return requireFields(op, d, ['terminal_id', 'request_id'])
 
-		case 'conductor.realignment': {
+		case 'showrunner.realignment': {
 			const r = requireFields(op, d, ['terminal_id', 'request_id_orig'])
 			if (!r.ok) return r
 			if (d.attempt_n === undefined || d.attempt_n === null)
@@ -125,10 +211,10 @@ export function validateConductorEvent(op, data) {
 		case 'budget.exceeded':
 			return requireFields(op, d, ['terminal_id'])
 
-		case 'conductor.action.executed':
+		case 'showrunner.action.executed':
 			return requireFields(op, d, ['terminal_id', 'request_id', 'action_kind', 'idempotency_key'])
 
-		case 'conductor.action.gate_blocked':
+		case 'showrunner.action.gate_blocked':
 			return requireFields(op, d, [
 				'terminal_id',
 				'request_id',
@@ -152,7 +238,130 @@ export function validateConductorEvent(op, data) {
 				'session_id',
 			])
 
-		case 'conductor.boot_reconciled': {
+		// Produce outer-loop (M1) — roadmap-mutation + tick vocabulary. Every
+		// op requires its `run_id`; roadmap ops additionally carry the
+		// milestone identity / status the projection folds (ID-04 / AC4).
+		case 'produce.run.started':
+			return requireFields(op, d, ['run_id', 'setpoint_hash'])
+
+		case 'produce.setpoint.frozen':
+			return requireFields(op, d, ['run_id', 'setpoint_hash', 'setpoint_path'])
+
+		case 'produce.roadmap.milestone_added':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'title'])
+
+		case 'produce.roadmap.milestone_status_changed':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'status'])
+
+		case 'produce.tick':
+			return requireFields(op, d, ['run_id'])
+
+		// Produce M2 — oracle + held-out cross-family blind-probe vocabulary.
+		// The implementer family is the recorded disjointness anchor (ID-M2-02);
+		// the probe ops are content-blind (only hash/result/family — ID-M2-03).
+
+		// The Showrunner records who implemented a milestone once per milestone;
+		// the cross-family rule is enforced against THIS recorded fact.
+		case 'produce.milestone.implemented':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'implementer_family'])
+
+		// The frozen blind-probe SET is announced by hash + author family ONLY —
+		// NEVER the probe content (structural probe-blindness, AC5).
+		case 'produce.probe.frozen':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'probe_set_hash', 'author_family'])
+
+		// A blind-probe RUN carries only its pass/fail result, the running family,
+		// and the HEAD sha it ran against — no probe content.
+		case 'produce.probe.run':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'result', 'probe_family', 'head_sha'])
+
+		// The independent evidence-quality oracle's verdict over verify-proof's
+		// captured evidence, tagged with the (cross-family) oracle family.
+		case 'produce.oracle.judged':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'verdict', 'oracle_family'])
+
+		// The two-gate done verdict (visible AND blind agree) — the ONLY path to
+		// `done` (ID-03: the Showrunner never self-attests).
+		case 'produce.oracle.verdict':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'verdict'])
+
+		// The reward-hacking canary near-miss: visible gate passed, blind gate
+		// failed → the milestone stays open (ID-M2-06 / AC9).
+		case 'produce.oracle.probe_gap':
+			return requireFields(op, d, ['run_id', 'milestone_id'])
+
+		// Produce M3 — the Lyapunov acceptance-criteria ledger (V = declared −
+		// closed) + the scope-change escape hatch (ID-M3-01 / ID-M3-04 / AC1). A
+		// criterion binds to a milestone; it opens on `declared` (V += 1), closes
+		// on `closed` (V −= 1). `produce.scope.changed` is the ONLY sanctioned
+		// post-descent V increase — `milestone_id` is optional (a scope change may
+		// not target one milestone), so only `run_id` + `reason` are required.
+		case 'produce.criteria.declared':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'criterion_id', 'text'])
+
+		case 'produce.criteria.closed':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'criterion_id'])
+
+		case 'produce.scope.changed':
+			return requireFields(op, d, ['run_id', 'reason'])
+
+		// Produce M4 — the saga phase model + FORWARD compensators + verification-TTL.
+		// The saga-phase ops (entered/completed/compensated) enforce the closed
+		// `phase` vocabulary (ALLOWED_SAGA_PHASES), mirroring the phase.changed.to
+		// value check. No op names a probe/review CONTENT field — the roadmap
+		// projection still folds `produce.roadmap.*` ONLY (blindness preserved).
+		case 'produce.saga.phase_entered':
+		case 'produce.saga.phase_completed': {
+			const r = requireFields(op, d, ['run_id', 'milestone_id', 'phase'])
+			if (!r.ok) return r
+			return checkSagaPhase(op, d)
+		}
+
+		case 'produce.saga.compensated': {
+			const r = requireFields(op, d, ['run_id', 'milestone_id', 'phase', 'compensator'])
+			if (!r.ok) return r
+			return checkSagaPhase(op, d)
+		}
+
+		// A diverse-review verdict over the milestone's diff, tagged with the
+		// (cross-family) reviewer family. Content-free — verdict + family only.
+		case 'produce.saga.reviewed':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'reviewer_family', 'verdict'])
+
+		// A scheduled post-`done` TTL re-verify RUN against HEAD — result/head_sha
+		// only, never probe content. A regression fires the forward compensator.
+		case 'produce.ttl.reverified':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'head_sha', 'result'])
+
+		case 'produce.ttl.regression_detected':
+			return requireFields(op, d, ['run_id', 'milestone_id', 'head_sha'])
+
+		// Produce M5 — the WSJF/WIP scheduler's recorded pick. Only `run_id` is
+		// required (the `picked` ids + `wip_limit` are optional context); the
+		// roadmap projection folds `produce.roadmap.*` ONLY, so it never sees this
+		// op (blindness preserved — ID-M5-06).
+		case 'produce.schedule.computed':
+			return requireFields(op, d, ['run_id'])
+
+		// Produce M6 — the Claim Envelope lifecycle. `declared` carries a
+		// `content_hash` ONLY (the full envelope lives in the frozen
+		// claims/<claim-id>.json file — ID-M6-07); `consumed.target_kind` is
+		// value-checked against the closed set (mirrors ALLOWED_SAGA_PHASES /
+		// checkSagaPhase). No op names a claim-content field — the roadmap
+		// projection still folds `produce.roadmap.*` ONLY (blindness preserved).
+		case 'produce.claim.declared':
+			return requireFields(op, d, ['run_id', 'profile', 'claim_id', 'content_hash'])
+
+		case 'produce.claim.expired':
+			return requireFields(op, d, ['run_id', 'claim_id', 'reason'])
+
+		case 'produce.claim.consumed': {
+			const r = requireFields(op, d, ['run_id', 'claim_id', 'target_kind'])
+			if (!r.ok) return r
+			return checkClaimTargetKind(op, d)
+		}
+
+		case 'showrunner.boot_reconciled': {
 			// Fleet-wide event — numeric fields only. All optional but if
 			// present must be finite numbers (zero allowed).
 			const numFields = ['cleaned_leases', 'replayed', 'start_offset']
@@ -174,7 +383,10 @@ export function validateConductorEvent(op, data) {
 }
 
 /** Set of ops the schema validates — exported for test enumeration. */
-export const CONDUCTOR_VALIDATED_OPS = CONDUCTOR_OPS
+export const SHOWRUNNER_VALIDATED_OPS = SHOWRUNNER_OPS
+
+/** Produce outer-loop ops the schema validates — exported for test enumeration. */
+export const PRODUCE_VALIDATED_OPS = PRODUCE_OPS
 
 /**
  * @param {string} op
@@ -191,3 +403,46 @@ function requireFields(op, d, fields) {
 	if (missing.length === 0) return { ok: true }
 	return { ok: false, error: `${op} missing required field(s): ${missing.join(', ')}` }
 }
+
+/**
+ * Validate the saga `phase` value against ALLOWED_SAGA_PHASES (M4). Mirrors the
+ * inline phase.changed.to value check — fail-closed on an out-of-vocabulary
+ * phase so a saga event can never carry an unknown phase onto the log.
+ *
+ * @param {string} op
+ * @param {Record<string, unknown>} d
+ * @returns {{ ok: true } | { ok: false, error: string }}
+ */
+function checkSagaPhase(op, d) {
+	if (!ALLOWED_SAGA_PHASES.has(String(d.phase))) {
+		return {
+			ok: false,
+			error: `${op}.phase must be one of [${[...ALLOWED_SAGA_PHASES].join(', ')}], got: ${String(
+				d.phase,
+			)}`,
+		}
+	}
+	return { ok: true }
+}
+
+/**
+ * Validate the claim `target_kind` value against ALLOWED_CLAIM_TARGET_KINDS (M6).
+ * Mirrors checkSagaPhase — fail-closed on an out-of-vocabulary target kind so a
+ * produce.claim.consumed event can never carry an unknown delta target onto the
+ * log (ID-M6-06).
+ *
+ * @param {string} op
+ * @param {Record<string, unknown>} d
+ * @returns {{ ok: true } | { ok: false, error: string }}
+ */
+function checkClaimTargetKind(op, d) {
+	if (!ALLOWED_CLAIM_TARGET_KINDS.has(String(d.target_kind))) {
+		return {
+			ok: false,
+			error: `${op}.target_kind must be one of [${[...ALLOWED_CLAIM_TARGET_KINDS].join(
+				', ',
+			)}], got: ${String(d.target_kind)}`,
+		}
+	}
+	return { ok: true }
+}

package/src/cli/coordination/store.mjs

@@ -32,7 +32,7 @@ import { withFileLock } from '../util/fs-lock.mjs'
 import { atomicWriteJson } from '../util/io.mjs'
 import { getAgentIdentity, resolveSharedRoot } from './agent-identity.mjs'
 import { appendLifecycleEvent } from './event-log.mjs'
-import { validateConductorEvent } from './event-schema.mjs'
+import { validateShowrunnerEvent } from './event-schema.mjs'
 import { advanceLastSeen as lastSeenAdvance, readLastSeen as lastSeenRead } from './last-seen.mjs'
 import {
 	listActive as teamStatusListActive,
@@ -131,16 +131,16 @@ export function createCoordinationStore(projectRoot) {
 		 * call via appendLifecycleEvent. Best-effort: filesystem errors are
 		 * swallowed so a missing events/ dir never breaks task lifecycle.
 		 *
-		 * Step 1 — schema gate: conductor ops written via the store seam are
+		 * Step 1 — schema gate: showrunner ops written via the store seam are
 		 * validated against `event-schema.mjs` before they reach disk.
 		 * Schema violations throw (caught here and surfaced via console.warn)
-		 * because a malformed conductor event would silently break the
+		 * because a malformed showrunner event would silently break the
 		 * drawer's pairing logic — we want it loud, not best-effort.
 		 */
 		appendEvent(evt) {
 			try {
 				if (evt && typeof evt.op === 'string') {
-					const validation = validateConductorEvent(evt.op, evt.data)
+					const validation = validateShowrunnerEvent(evt.op, evt.data)
 					if (!validation.ok) {
 						console.warn(`[store.appendEvent] schema violation: ${validation.error}`)
 						return null

package/src/cli/dispatch.mjs

@@ -62,7 +62,7 @@ import { cmdEditCheck } from './commands/edit-check.mjs'
 import { cmdEffects } from './commands/effects.mjs'
 import { cmdEvent } from './commands/event.mjs'
 import { cmdFanOut } from './commands/fan-out.mjs'
-import { cmdFeaturesAudit } from './commands/features-audit.mjs'
+import { cmdFeaturesReconcile } from './commands/features-reconcile.mjs'
 import { cmdFollowups } from './commands/followups.mjs'
 import { cmdGate } from './commands/gate.mjs'
 import { cmdHealthCheck } from './commands/health-check.mjs'
@@ -78,6 +78,7 @@ import { cmdPersonas } from './commands/personas.mjs'
 import { cmdPlanApproval } from './commands/plan-approval.mjs'
 import { cmdPrReview } from './commands/pr-review.mjs'
 import { cmdPrecompactHook } from './commands/precompact-hook.mjs'
+import { cmdProduce } from './commands/produce.mjs'
 import { cmdProductContext } from './commands/product-context.mjs'
 import { cmdProfile } from './commands/profile.mjs'
 // cmdRecipeDiff — loaded lazily in the dispatch handler (Fast Path PRF-001)
@@ -260,7 +261,7 @@ export const DISPATCH = {
 			exitCode: 1,
 		}))()
 	},
-	'features-audit': (args) => wrap(cmdFeaturesAudit)(args[1], args.slice(2)),
+	'features-reconcile': (args) => wrap(cmdFeaturesReconcile)(args[1], args.slice(2)),
 	'init-state': (args) => wrap(cmdInitState)(args[1], args.slice(2)),
 	'risk-check': (args) => wrap(cmdRiskCheck)(args[1], args.slice(2)),
 	'edit-check': (args) => wrap(cmdEditCheck)(args.slice(1)),
@@ -326,6 +327,7 @@ export const DISPATCH = {
 	team: (args) => wrap(cmdTeam)(args[1], args[2], args.slice(3)),
 	active: (args) => wrap(cmdActive)(args[1], args[2], args.slice(3)),
 	roadmap: (args) => wrap(cmdRoadmap)(args[1], args[2], args.slice(3)),
+	produce: (args) => wrap(cmdProduce)(args[1], args[2], args.slice(3)),
 	seed: (args) => wrap(cmdSeed)(args[1], args[2], args.slice(3)),
 	workflow: (args) => wrap(cmdWorkflow)(args[1], args[2], args.slice(3)),
 	'pr-review': (args) => wrap(cmdPrReview)(args[1], args[2], args.slice(3)),

package/src/cli/features/area-shape.mjs

@@ -0,0 +1,140 @@
+/**
+ * area-shape.mjs — hand-rolled structural validator for feature-registry
+ * area files, mirroring `src/schemas/feature-registry.ts` (FeatureRegistrySchema)
+ * PLUS the uniqueness refinement (feature ids unique per area; sub_feature ids
+ * unique per feature group).
+ *
+ * WHY A TWIN VALIDATOR EXISTS (ID-07): the bare-node CI check
+ * (`bin/features-reconcile-check.mjs`) runs with NO node_modules, so it cannot
+ * import zod. This module is node:-builtins only (in fact, zero imports).
+ * `feature-registry-schema-parity.test.ts` validates shared fixtures against
+ * BOTH this validator and the zod schema so they cannot drift.
+ *
+ * Semantics mirror zod defaults:
+ *   - unknown keys are ALLOWED (zod objects are non-strict);
+ *   - `components` and `sub_features` may be absent (zod `.default([])`);
+ *   - `route` stays required non-empty — non-routed areas use the literal
+ *     "(cross-cutting)" (chrome.json precedent), never null.
+ *
+ * Returns { ok, errors: [] } — never throws.
+ */
+
+const ID_RE = /^[a-z0-9-]+$/
+const LAST_SCANNED_RE = /^\d{4}-\d{2}-\d{2}(T[\d:.Z+-]+)?$/
+const TESTABLE_VALUES = new Set(['testable', 'observable', 'blocked'])
+const WIRED_VALUES = new Set([true, false, 'stubbed', 'partial'])
+
+function isNonEmptyString(v) {
+	return typeof v === 'string' && v.length > 0
+}
+
+function checkOptionalString(errors, at, v) {
+	if (v !== undefined && !isNonEmptyString(v)) {
+		errors.push(`${at}: must be a non-empty string when present`)
+	}
+}
+
+function validateSubFeature(errors, at, sub) {
+	if (!sub || typeof sub !== 'object' || Array.isArray(sub)) {
+		errors.push(`${at}: must be an object`)
+		return
+	}
+	if (!isNonEmptyString(sub.id) || !ID_RE.test(sub.id)) {
+		errors.push(`${at}.id: must match ${ID_RE}`)
+	}
+	if (!isNonEmptyString(sub.name)) errors.push(`${at}.name: required non-empty string`)
+	checkOptionalString(errors, `${at}.component`, sub.component)
+	if (!isNonEmptyString(sub.type)) errors.push(`${at}.type: required non-empty string`)
+	if (!WIRED_VALUES.has(sub.wired)) {
+		errors.push(`${at}.wired: must be true|false|"stubbed"|"partial"`)
+	}
+	if (sub.handler !== undefined && typeof sub.handler !== 'string') {
+		errors.push(`${at}.handler: must be a string when present`)
+	}
+	if (sub.shortcut !== undefined && typeof sub.shortcut !== 'string') {
+		errors.push(`${at}.shortcut: must be a string when present`)
+	}
+	if (sub.testable !== undefined && !TESTABLE_VALUES.has(sub.testable)) {
+		errors.push(`${at}.testable: must be "testable"|"observable"|"blocked" when present`)
+	}
+	if (sub.test_hint !== undefined && typeof sub.test_hint !== 'string') {
+		errors.push(`${at}.test_hint: must be a string when present`)
+	}
+	// default / range / options are `unknown` in the zod schema — anything goes.
+}
+
+function validateFeatureGroup(errors, at, group) {
+	if (!group || typeof group !== 'object' || Array.isArray(group)) {
+		errors.push(`${at}: must be an object`)
+		return
+	}
+	if (!isNonEmptyString(group.id) || !ID_RE.test(group.id)) {
+		errors.push(`${at}.id: must match ${ID_RE}`)
+	}
+	if (!isNonEmptyString(group.name)) errors.push(`${at}.name: required non-empty string`)
+	checkOptionalString(errors, `${at}.component`, group.component)
+	if (group.sub_features !== undefined) {
+		if (!Array.isArray(group.sub_features)) {
+			errors.push(`${at}.sub_features: must be an array when present`)
+		} else {
+			const seen = new Set()
+			for (const [i, sub] of group.sub_features.entries()) {
+				validateSubFeature(errors, `${at}.sub_features[${i}]`, sub)
+				const id = sub?.id
+				if (isNonEmptyString(id)) {
+					if (seen.has(id)) {
+						errors.push(`${at}.sub_features[${i}].id: duplicate sub_feature id "${id}" in group`)
+					}
+					seen.add(id)
+				}
+			}
+		}
+	}
+}
+
+/**
+ * Structural + uniqueness validation of an area-file value.
+ *
+ * @param {unknown} data — parsed JSON of a `.aperant/features/<area>.json`
+ * @returns {{ ok: boolean, errors: string[] }}
+ */
+export function validateAreaShape(data) {
+	const errors = []
+	if (!data || typeof data !== 'object' || Array.isArray(data)) {
+		return { ok: false, errors: ['area file must be a JSON object'] }
+	}
+	if (!isNonEmptyString(data.area)) errors.push('area: required non-empty string')
+	if (!isNonEmptyString(data.route)) {
+		errors.push(
+			'route: required non-empty string — use "(cross-cutting)" for non-routed areas, never null',
+		)
+	}
+	if (data.components !== undefined) {
+		if (!Array.isArray(data.components)) {
+			errors.push('components: must be an array when present')
+		} else {
+			for (const [i, c] of data.components.entries()) {
+				if (!isNonEmptyString(c)) errors.push(`components[${i}]: must be a non-empty string`)
+			}
+		}
+	}
+	if (!isNonEmptyString(data.last_scanned) || !LAST_SCANNED_RE.test(data.last_scanned)) {
+		errors.push('last_scanned: must be a YYYY-MM-DD or full ISO 8601 date string')
+	}
+	if (!Array.isArray(data.features)) {
+		errors.push('features: required array')
+	} else {
+		const seen = new Set()
+		for (const [i, group] of data.features.entries()) {
+			validateFeatureGroup(errors, `features[${i}]`, group)
+			const id = group?.id
+			if (isNonEmptyString(id)) {
+				if (seen.has(id)) {
+					errors.push(`features[${i}].id: duplicate feature id "${id}" in area`)
+				}
+				seen.add(id)
+			}
+		}
+	}
+	return { ok: errors.length === 0, errors }
+}