@biffo/cli 0.278.1 → 0.278.3

package/_skeletons/plugin-template/web-admin/src/lib/auth.test.ts

@@ -0,0 +1,127 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const getCurrentUser = vi.fn()
+const poolConstructor = vi.fn()
+
+vi.mock('amazon-cognito-identity-js', () => ({
+  CognitoUserPool: class {
+    constructor(...args: unknown[]) {
+      poolConstructor(...args)
+    }
+    getCurrentUser = getCurrentUser
+  },
+}))
+
+const resolveCoreIdentity = vi.fn()
+vi.mock('./identity', () => ({ resolveCoreIdentity }))
+
+vi.mock('./cognito-hygiene', () => ({ pruneForeignCognitoCredentials: vi.fn() }))
+
+// Fresh module each test: the pool is memoised at module scope.
+async function loadAuth() {
+  vi.resetModules()
+  return await import('./auth')
+}
+
+describe('getCurrentSession', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resolveCoreIdentity.mockResolvedValue({
+      userPoolId: 'us-east-1_DOCPOOL',
+      clientId: 'docclientid',
+    })
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it('returns null when no user is stored in the shared localStorage session', async () => {
+    const { getCurrentSession } = await loadAuth()
+    getCurrentUser.mockReturnValue(null)
+    await expect(getCurrentSession()).resolves.toBeNull()
+  })
+
+  it('returns null when no identity is resolvable', async () => {
+    resolveCoreIdentity.mockResolvedValue(null)
+    const { getCurrentSession } = await loadAuth()
+    await expect(getCurrentSession()).resolves.toBeNull()
+    expect(poolConstructor).not.toHaveBeenCalled()
+  })
+
+  it('builds the pool once across multiple sequential session reads (memoised)', async () => {
+    const { getCurrentSession } = await loadAuth()
+    getCurrentUser.mockReturnValue(null)
+
+    await getCurrentSession()
+    await getCurrentSession()
+
+    expect(poolConstructor).toHaveBeenCalledTimes(1)
+    expect(poolConstructor).toHaveBeenCalledWith({
+      UserPoolId: 'us-east-1_DOCPOOL',
+      ClientId: 'docclientid',
+    })
+  })
+})
+
+// biffo-plugin-marketing#55: the pool used to be memoised on the SETTLED value,
+// so concurrent callers that started before the first resolution completed each
+// ran an independent resolution (including pruneForeignCognitoCredentials()'s
+// localStorage scan-and-delete). campaign-studio's Pipeline.tsx/Results.tsx now
+// fire several concurrent getArtefact calls on one mount, which is what made
+// this newly load-bearing rather than academic.
+describe('concurrent callers share one pool resolution (biffo-plugin-marketing#55)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it('resolves the pool exactly once when two callers race before it settles', async () => {
+    // A manually-resolved identity lookup guarantees BOTH calls are in flight
+    // before resolution, rather than relying on incidental microtask timing.
+    let resolveIdentity!: (value: { userPoolId: string; clientId: string }) => void
+    resolveCoreIdentity.mockReturnValue(
+      new Promise((resolve) => {
+        resolveIdentity = resolve
+      }),
+    )
+    const { getCurrentSession } = await loadAuth()
+    getCurrentUser.mockReturnValue(null)
+
+    const first = getCurrentSession()
+    const second = getCurrentSession()
+
+    resolveIdentity({ userPoolId: 'us-east-1_DOCPOOL', clientId: 'docclientid' })
+
+    await Promise.all([first, second])
+
+    // The regression this guards: without in-flight memoisation, both callers
+    // independently reach the pool constructor before either could observe
+    // the other's result.
+    expect(poolConstructor).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not cache a rejection — a later call gets a fresh attempt', async () => {
+    resolveCoreIdentity.mockResolvedValue({
+      userPoolId: 'us-east-1_DOCPOOL',
+      clientId: 'docclientid',
+    })
+    // Simulate a transient failure building the pool itself (identity
+    // resolution here never rejects — it catches internally — but the pool
+    // construction step must still not be able to poison the memo forever).
+    poolConstructor.mockImplementationOnce(() => {
+      throw new Error('transient pool construction failure')
+    })
+    const { getCurrentSession } = await loadAuth()
+    getCurrentUser.mockReturnValue(null)
+
+    await expect(getCurrentSession()).rejects.toThrow('transient pool construction failure')
+
+    // Retried, not replayed: the second call gets its own attempt and succeeds.
+    await expect(getCurrentSession()).resolves.toBeNull()
+    expect(poolConstructor).toHaveBeenCalledTimes(2)
+  })
+})

package/_skeletons/plugin-template/web-admin/src/lib/auth.ts

@@ -20,23 +20,34 @@ import { resolveCoreIdentity } from './identity'
 // The pool is built lazily and memoised: a missing identity resolves to null →
 // "signed out", never a hard crash.
 
-let userPool: CognitoUserPool | null = null
+let poolPromise: Promise<CognitoUserPool | null> | null = null
 
-async function getUserPool(): Promise<CognitoUserPool | null> {
-  if (userPool) return userPool
-  const identity = await resolveCoreIdentity()
-  if (!identity) return null
-  // Once per page load, and only with a resolved client id: drop credentials
-  // left behind by pools this deployment no longer uses (biffo-template#834).
-  // The portal and the sibling skeleton do the same; this origin is shared, so
-  // whichever app loads first does the cleaning.
-  pruneForeignCognitoCredentials(identity.clientId)
-  const poolData: ICognitoUserPoolData = {
-    UserPoolId: identity.userPoolId,
-    ClientId: identity.clientId,
-  }
-  userPool = new CognitoUserPool(poolData)
-  return userPool
+// Memoises the IN-FLIGHT promise, not the settled value (biffo-plugin-marketing#55).
+// `poolPromise ??=` assigns synchronously, before the first `await` inside the IIFE
+// runs, so every caller that arrives before the first resolution completes shares
+// that SAME promise instead of each re-running resolveCoreIdentity() and
+// pruneForeignCognitoCredentials()'s localStorage scan-and-delete independently.
+// A rejection clears the memo (`.catch` below) so one transient failure does not
+// poison every later call for the rest of the page's life.
+function getUserPool(): Promise<CognitoUserPool | null> {
+  poolPromise ??= (async () => {
+    const identity = await resolveCoreIdentity()
+    if (!identity) return null
+    // Once per page load, and only with a resolved client id: drop credentials
+    // left behind by pools this deployment no longer uses (biffo-template#834).
+    // The portal and the sibling skeleton do the same; this origin is shared, so
+    // whichever app loads first does the cleaning.
+    pruneForeignCognitoCredentials(identity.clientId)
+    const poolData: ICognitoUserPoolData = {
+      UserPoolId: identity.userPoolId,
+      ClientId: identity.clientId,
+    }
+    return new CognitoUserPool(poolData)
+  })().catch((err: unknown) => {
+    poolPromise = null
+    throw err
+  })
+  return poolPromise
 }
 
 /** The shared portal session, or null if there isn't a valid one (→ redirect to login). */
@@ -78,5 +89,5 @@ export async function getFreshIdToken(): Promise<string | null> {
 
 /** Test-only: reset the memoised pool. */
 export function __resetUserPoolForTests(): void {
-  userPool = null
+  poolPromise = null
 }

package/_skeletons/sibling-template/apps/frontend/src/lib/auth.test.ts

@@ -181,6 +181,68 @@ describe('runtime core identity resolution', () => {
   })
 })
 
+// biffo-plugin-marketing#55: the pool used to be memoised on the SETTLED value,
+// so callers that started before the first resolution completed each ran an
+// independent resolution. Pipeline.tsx firing several concurrent getArtefact
+// calls on mount is what made this newly load-bearing rather than academic.
+describe('concurrent callers share one pool resolution (biffo-plugin-marketing#55)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  afterEach(() => {
+    vi.unstubAllEnvs()
+    vi.restoreAllMocks()
+  })
+
+  it('resolves the pool exactly once when two callers race before it settles', async () => {
+    // A manually-resolved fetch guarantees BOTH calls are in flight before
+    // resolution, rather than relying on incidental microtask timing.
+    let resolveFetch!: (value: unknown) => void
+    global.fetch = vi.fn(
+      () =>
+        new Promise((resolve) => {
+          resolveFetch = resolve
+        }),
+    ) as unknown as typeof fetch
+    const { getCurrentSession } = await loadAuth()
+    getCurrentUser.mockReturnValue(null)
+
+    const first = getCurrentSession()
+    const second = getCurrentSession()
+
+    resolveFetch({
+      ok: true,
+      json: async () => ({ userPoolId: 'us-east-1_DOCPOOL', clientId: 'docclientid' }),
+    })
+
+    await Promise.all([first, second])
+
+    // The regression this guards: without in-flight memoisation, both callers
+    // independently reach the pool constructor (and the localStorage prune
+    // inside getUserPool) before either could observe the other's result.
+    expect(poolConstructor).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not cache a rejection — a later call gets a fresh attempt', async () => {
+    mockFetchDocument()
+    // Simulate a transient failure building the pool itself (identity
+    // resolution here never rejects — it catches internally — but the pool
+    // construction step must still not be able to poison the memo forever).
+    poolConstructor.mockImplementationOnce(() => {
+      throw new Error('transient pool construction failure')
+    })
+    const { getCurrentSession } = await loadAuth()
+    getCurrentUser.mockReturnValue(null)
+
+    await expect(getCurrentSession()).rejects.toThrow('transient pool construction failure')
+
+    // Retried, not replayed: the second call gets its own attempt and succeeds.
+    await expect(getCurrentSession()).resolves.toBeNull()
+    expect(poolConstructor).toHaveBeenCalledTimes(2)
+  })
+})
+
 // The CognitoUserPool constructor throws ("Both UserPoolId and ClientId are
 // required") when either value is missing, and `next build` prerenders `/` in
 // Node — which imports this module. Building the pool at module scope therefore

package/_skeletons/sibling-template/apps/frontend/src/lib/auth.ts

@@ -53,26 +53,37 @@ import { resolveCoreIdentity } from './identity'
 // The pool itself is memoised: resolveCoreIdentity() is memoised too, but the
 // CognitoUserPool wrapper is built here exactly once so repeated session reads
 // reuse one instance (and its localStorage view of the shared session).
-let userPool: CognitoUserPool | null = null
-
-async function getUserPool(): Promise<CognitoUserPool | null> {
-  if (userPool) return userPool
+//
+// Memoises the IN-FLIGHT promise, not the settled value (biffo-plugin-marketing#55).
+// `poolPromise ??=` assigns synchronously, before the first `await` inside the IIFE
+// runs, so every caller that arrives before the first resolution completes shares
+// that SAME promise instead of each re-running resolveCoreIdentity() and
+// pruneForeignCognitoCredentials()'s localStorage scan-and-delete independently.
+// A rejection clears the memo (`.catch` below) so one transient failure does not
+// poison every later call for the rest of the page's life.
+let poolPromise: Promise<CognitoUserPool | null> | null = null
 
-  const identity = await resolveCoreIdentity()
-  if (!identity) return null
+function getUserPool(): Promise<CognitoUserPool | null> {
+  poolPromise ??= (async () => {
+    const identity = await resolveCoreIdentity()
+    if (!identity) return null
 
-  // Once per page load, and only with a resolved client id: drop credentials
-  // left behind by pools this deployment no longer uses (biffo-template#834).
-  // Cheap, and it keeps the shared origin from accumulating dead tokens for
-  // every pool the portal has ever pointed at.
-  pruneForeignCognitoCredentials(identity.clientId)
+    // Once per page load, and only with a resolved client id: drop credentials
+    // left behind by pools this deployment no longer uses (biffo-template#834).
+    // Cheap, and it keeps the shared origin from accumulating dead tokens for
+    // every pool the portal has ever pointed at.
+    pruneForeignCognitoCredentials(identity.clientId)
 
-  const poolData: ICognitoUserPoolData = {
-    UserPoolId: identity.userPoolId,
-    ClientId: identity.clientId,
-  }
-  userPool = new CognitoUserPool(poolData)
-  return userPool
+    const poolData: ICognitoUserPoolData = {
+      UserPoolId: identity.userPoolId,
+      ClientId: identity.clientId,
+    }
+    return new CognitoUserPool(poolData)
+  })().catch((err: unknown) => {
+    poolPromise = null
+    throw err
+  })
+  return poolPromise
 }
 
 /**

package/dist/index.js

@@ -951,7 +951,7 @@ var GitAdapter = class {
    * scaffold's throwaway temp dir inherits.
    */
   async configuredIdentity(cwd) {
-    const read = async (key) => {
+    const read2 = async (key) => {
       try {
         const { stdout } = await execa2("git", ["config", "--get", key], cwd ? { cwd } : {});
         return stdout.trim() || null;
@@ -959,7 +959,7 @@ var GitAdapter = class {
         return null;
       }
     };
-    return { name: await read("user.name"), email: await read("user.email") };
+    return { name: await read2("user.name"), email: await read2("user.email") };
   }
   async isGitRepo(cwd) {
     try {
@@ -1596,7 +1596,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
+      await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
     }
     throw new Error(
       `Branch "${branch}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -1611,7 +1611,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
+      await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
     }
     throw new Error(
       `Ref "${ref}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -1845,7 +1845,7 @@ var GitHubAdapter = class {
             }
             if (status !== 404 || Date.now() >= deadline) throw err;
             log.info("Branch protection endpoint not yet ready, retrying...");
-            await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
+            await new Promise((resolve20) => setTimeout(resolve20, protectionIntervalMs));
           }
         }
       }
@@ -2018,7 +2018,7 @@ var GitHubAdapter = class {
           }
           if (status !== 404 || Date.now() >= deadline) throw err;
           log.info("Branch protection endpoint not yet ready, retrying...");
-          await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
+          await new Promise((resolve20) => setTimeout(resolve20, protectionIntervalMs));
         }
       }
     } catch (err) {
@@ -2291,7 +2291,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
+        await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
       }
     }
   }
@@ -2310,7 +2310,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
+        await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
       }
     }
   }
@@ -2334,7 +2334,7 @@ var GitHubAdapter = class {
       } else {
         log.info("  Waiting for run to be queued...");
       }
-      await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
+      await new Promise((resolve20) => setTimeout(resolve20, intervalMs));
     }
     throw new Error(
       `Workflow ${workflowId} did not complete within ${timeoutMs / 1e3 / 60} minutes`
@@ -4272,7 +4272,7 @@ var AwsAdapter = class {
         const code = err.Code;
         if (code === "OperationAborted" && attempt < maxAttempts) {
           log.info(`  Waiting for S3 to release "${bucketName}"... (${attempt}/${maxAttempts})`);
-          await new Promise((resolve19) => setTimeout(resolve19, retryDelayMs));
+          await new Promise((resolve20) => setTimeout(resolve20, retryDelayMs));
         } else if (code === "OperationAborted") {
           return false;
         } else {
@@ -10718,8 +10718,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa11("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync38, existsSync: existsSync46 } = await import("fs");
-      if (existsSync46(messageFile)) commitMessage = readFileSync38(messageFile, "utf8");
+      const { readFileSync: readFileSync39, existsSync: existsSync46 } = await import("fs");
+      if (existsSync46(messageFile)) commitMessage = readFileSync39(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -11336,14 +11336,150 @@ async function runPipeTrapCheck() {
   console.log(`\u2713 Pipe-trap guard: no status-bearing command is piped away`);
 }
 
+// src/scripts/check-plugin-allowlist-convention.ts
+import { execa as execa15 } from "execa";
+
+// src/lib/plugin-allowlist-convention.ts
+import { readFileSync as readFileSync34 } from "fs";
+import { join as join46 } from "path";
+var COMPUTE_MAIN_TF = "modules/cloud/aws/compute/main.tf";
+var PLUGIN_TEMPLATE_MAIN_TF = "modules/plugins/_template/main.tf";
+var ALLOWLIST_MAIN_TF = "modules/cloud/aws/plugin-allowlist/main.tf";
+var ALLOWLIST_VARIABLES_TF = "modules/cloud/aws/plugin-allowlist/variables.tf";
+var PROJECT = "<project>";
+var ENV = "<env>";
+var PLUGIN = "<plugin>";
+var ACCOUNT = "<account>";
+function read(repoRoot, relative9) {
+  try {
+    return readFileSync34(join46(repoRoot, relative9), "utf8");
+  } catch {
+    throw new Error(`plugin-allowlist drift guard: cannot read ${relative9}`);
+  }
+}
+function assignedString(source, name) {
+  const match = new RegExp(`^\\s*${name}\\s*=\\s*"((?:[^"\\\\]|\\\\.)*)"\\s*$`, "m").exec(source);
+  return match?.[1];
+}
+function resolve18(expression, bindings) {
+  let current = expression;
+  for (let pass = 0; pass < 10; pass += 1) {
+    const next = current.replace(/\$\{([^}]+)\}/g, (whole, ref) => {
+      const bound = bindings[ref.trim()];
+      return bound === void 0 ? whole : bound;
+    });
+    if (next === current) break;
+    current = next;
+  }
+  return current;
+}
+function composeExpectedRoleName(repoRoot) {
+  const compute = read(repoRoot, COMPUTE_MAIN_TF);
+  const template = read(repoRoot, PLUGIN_TEMPLATE_MAIN_TF);
+  const namePrefix = assignedString(compute, "name_prefix");
+  const functionName = assignedString(compute, "function_name");
+  const roleName = /resource\s+"aws_iam_role"\s+"lambda"\s*\{[^}]*?\bname\s*=\s*"([^"]*)"/s.exec(
+    compute
+  )?.[1];
+  if (!namePrefix || !functionName || !roleName) {
+    throw new Error(
+      `plugin-allowlist drift guard: could not read the naming convention out of ${COMPUTE_MAIN_TF}. If that module was restructured, update this guard along with it.`
+    );
+  }
+  const pluginFunctionName = /module\s+"function"\s*\{[\s\S]*?\bfunction_name\s*=\s*"([^"]*)"/.exec(
+    template
+  )?.[1];
+  if (!pluginFunctionName) {
+    throw new Error(
+      `plugin-allowlist drift guard: could not read module "function"'s function_name out of ${PLUGIN_TEMPLATE_MAIN_TF}.`
+    );
+  }
+  const bindings = {
+    "var.project_name": PROJECT,
+    "var.environment": ENV,
+    "var.plugin_name": PLUGIN,
+    "var.function_name": resolve18(pluginFunctionName, {
+      "var.plugin_name": PLUGIN
+    })
+  };
+  bindings["local.name_prefix"] = resolve18(namePrefix, bindings);
+  bindings["local.function_name"] = resolve18(functionName, bindings);
+  return resolve18(roleName, bindings);
+}
+function readAllowlistGlob(repoRoot) {
+  const allowlist = read(repoRoot, ALLOWLIST_MAIN_TF);
+  const glob = /for\s+name\s+in\s+var\.enabled_plugins\s*:\s*\n\s*"([^"]*)"/.exec(allowlist)?.[1];
+  if (!glob) {
+    throw new Error(
+      `plugin-allowlist drift guard: could not find the "for name in var.enabled_plugins" glob in ${ALLOWLIST_MAIN_TF}.`
+    );
+  }
+  return resolve18(glob, {
+    "data.aws_caller_identity.current.account_id": ACCOUNT,
+    "var.project_name": PROJECT,
+    "var.environment": ENV,
+    name: PLUGIN
+  });
+}
+function checkAllowlistConvention(repoRoot) {
+  const violations = [];
+  const expectedRoleName = composeExpectedRoleName(repoRoot);
+  const expectedGlob = `arn:aws:sts::${ACCOUNT}:assumed-role/${expectedRoleName}/*`;
+  const actualGlob = readAllowlistGlob(repoRoot);
+  if (actualGlob !== expectedGlob) {
+    violations.push({
+      file: ALLOWLIST_MAIN_TF,
+      message: `the allowlist glob no longer matches the role name the naming modules build.
+  ${COMPUTE_MAIN_TF} + ${PLUGIN_TEMPLATE_MAIN_TF} produce: ${expectedGlob}
+  ${ALLOWLIST_MAIN_TF} allowlists:                        ${actualGlob}
+Plugins would be rejected by require_service_principal (ADR-0009). Fix the glob, not this guard.`
+    });
+  }
+  const variables = read(repoRoot, ALLOWLIST_VARIABLES_TF);
+  const enabledPluginsBlock = /variable\s+"enabled_plugins"\s*\{[\s\S]*?\n\}/.exec(variables)?.[0];
+  if (!enabledPluginsBlock || !/\bdefault\s*=\s*\[\s*\]/.test(enabledPluginsBlock)) {
+    violations.push({
+      file: ALLOWLIST_VARIABLES_TF,
+      message: "enabled_plugins must default to [] so an unconfigured instance allowlists nobody (ADR-0009 fail-closed)."
+    });
+  }
+  return violations;
+}
+
+// src/scripts/check-plugin-allowlist-convention.ts
+async function runPluginAllowlistConventionCheck() {
+  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  let violations;
+  try {
+    violations = checkAllowlistConvention(root);
+  } catch (err) {
+    console.error("\u2717 Plugin-allowlist convention guard: could not run\n");
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+  console.log(`audited the plugin-allowlist naming convention under ${root}`);
+  if (violations.length > 0) {
+    console.error("\u2717 Plugin-allowlist convention guard: drift found\n");
+    for (const v of violations) {
+      console.error(`  ${v.file}
+  ${v.message}`);
+    }
+    console.error("\nSee biffo-template#266, biffo-template#1545, tabsii-platform#863.");
+    process.exit(1);
+  }
+  console.log(
+    "\u2713 Plugin-allowlist convention guard: the allowlist glob matches the role name the naming modules build, and enabled_plugins still defaults to [] (fail-closed)"
+  );
+}
+
 // src/scripts/check-plugin-collisions.ts
 import { existsSync as existsSync39 } from "fs";
-import { join as join47 } from "path";
-import { execa as execa15 } from "execa";
+import { join as join48 } from "path";
+import { execa as execa16 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
 import { existsSync as existsSync38, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
-import { join as join46 } from "path";
+import { join as join47 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
@@ -11351,19 +11487,19 @@ function subdirectories(dir) {
   return readdirSync20(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync12(join46(dir, entry)).isDirectory();
+      return statSync12(join47(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync38(join46(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync38(join47(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join46(pluginDir2, "tests");
+  const testsDir = join47(pluginDir2, "tests");
   if (!existsSync38(testsDir)) return [];
-  if (existsSync38(join46(testsDir, "__init__.py"))) return [];
+  if (existsSync38(join47(testsDir, "__init__.py"))) return [];
   return readdirSync20(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
@@ -11372,7 +11508,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join46(servicesDir, plugin))) {
+      for (const name of namesOf(join47(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -11409,8 +11545,8 @@ function formatCollisions(collisions) {
 
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
-  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join47(root, "services");
+  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const servicesDir = join48(root, "services");
   if (!existsSync39(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
@@ -11428,11 +11564,11 @@ async function runPluginCollisionCheck() {
 }
 
 // src/scripts/check-plugin-terraform.ts
-import { execa as execa16 } from "execa";
+import { execa as execa17 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync40, readFileSync as readFileSync34, readdirSync as readdirSync21 } from "fs";
-import { dirname as dirname10, join as join48, relative as relative8, sep as sep3 } from "path";
+import { existsSync as existsSync40, readFileSync as readFileSync35, readdirSync as readdirSync21 } from "fs";
+import { dirname as dirname10, join as join49, relative as relative8, sep as sep3 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -11447,9 +11583,9 @@ function findPluginManifests(root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name)) continue;
-        walk2(join48(dir, entry.name));
+        walk2(join49(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative8(root, join48(dir, entry.name)).split(sep3).join("/"));
+        found.push(relative8(root, join49(dir, entry.name)).split(sep3).join("/"));
       }
     }
   };
@@ -11459,7 +11595,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync34(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync35(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -11474,14 +11610,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync40(join48(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync40(join49(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join48(root, manifest);
+    const absManifest = join49(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync40(join48(pluginDir2, "terraform"))) continue;
+    if (existsSync40(join49(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative8(root, pluginDir2).split(sep3).join("/");
     violations.push({
       manifest,
@@ -11501,7 +11637,7 @@ function formatViolations(violations) {
 
 // src/scripts/check-plugin-terraform.ts
 async function runPluginTerraformCheck() {
-  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const violations = checkPluginTerraform(root);
   if (violations.length > 0) {
     console.error("\u2717 plugin Terraform guard: event subscriptions with no infrastructure\n");
@@ -11513,12 +11649,12 @@ async function runPluginTerraformCheck() {
 
 // src/scripts/check-plugin-tool-supply.ts
 import { existsSync as existsSync42 } from "fs";
-import { join as join50 } from "path";
-import { execa as execa17 } from "execa";
+import { join as join51 } from "path";
+import { execa as execa18 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync41, readFileSync as readFileSync35, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
-import { join as join49 } from "path";
+import { existsSync as existsSync41, readFileSync as readFileSync36, readdirSync as readdirSync22, statSync as statSync13 } from "fs";
+import { join as join50 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -11935,7 +12071,7 @@ function listDirs(root) {
   }
   return entries.filter((e) => {
     try {
-      return statSync13(join49(root, e)).isDirectory();
+      return statSync13(join50(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -11951,7 +12087,7 @@ function walkFiles2(root, accept, skipDir) {
       return;
     }
     for (const entry of entries) {
-      const p = join49(dir, entry);
+      const p = join50(dir, entry);
       let st;
       try {
         st = statSync13(p);
@@ -11977,14 +12113,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join49(pluginDir2, "terraform");
+  const tfDir = join50(pluginDir2, "terraform");
   let entries;
   try {
     entries = readdirSync22(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join49(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join50(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -12236,8 +12372,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join49("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join49(
+var CONFIG_PY_PATH = join50("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join50(
   "services",
   "api",
   "src",
@@ -12249,8 +12385,8 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join49(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join49(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configPath = join50(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join50(repoRoot, ORCHESTRATION_SCHEMA_PATH);
   const configMissing = !existsSync41(configPath);
   const orchestrationSchemaMissing = !existsSync41(orchestrationPath);
   const knownSet = new Set(knownModelIds);
@@ -12270,13 +12406,13 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   };
   let settingsBlind = false;
   if (!configMissing) {
-    const settingsFields = extractSettingsModelFields(readFileSync35(configPath, "utf8"));
+    const settingsFields = extractSettingsModelFields(readFileSync36(configPath, "utf8"));
     if (settingsFields.length === 0) settingsBlind = true;
     for (const { field, value } of settingsFields) record(`${CONFIG_PY_PATH}#${field}`, value);
   }
   let curatedFieldsBlind = false;
   if (!orchestrationSchemaMissing) {
-    const curated = extractCuratedModelFields(readFileSync35(orchestrationPath, "utf8"));
+    const curated = extractCuratedModelFields(readFileSync36(orchestrationPath, "utf8"));
     if (curated.rawFieldCount > 0 && curated.fields.every((f) => f.defaultValue === null && f.optionValues.length === 0)) {
       curatedFieldsBlind = true;
     }
@@ -12323,7 +12459,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync13(join49(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync13(join50(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -12336,8 +12472,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join49(pluginsRoot, name);
-    const manifestText = readFileSync35(join49(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join50(pluginsRoot, name);
+    const manifestText = readFileSync36(join50(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -12355,13 +12491,13 @@ function auditPluginToolSupply(pluginsRoot) {
     totalDeclaredTools += manifest.tools.length;
     const pySources = pluginPythonFiles(pluginDir2).map((f) => ({
       file: f,
-      text: readFileSync35(f, "utf8")
+      text: readFileSync36(f, "utf8")
     }));
     const resolver = buildSymbolResolver(pySources);
     const registry = extractToolRegistryEntries(pySources, resolver);
     if (registry.rawToolDefinitionCount > 0 && registry.entries.length === 0) registryBlind = true;
     const tfFiles = pluginTerraformFiles(pluginDir2);
-    const tfText = tfFiles.map((f) => readFileSync35(f, "utf8")).join("\n");
+    const tfText = tfFiles.map((f) => readFileSync36(f, "utf8")).join("\n");
     const terraform = extractTerraformEnvKeys(tfText);
     if (terraform.rawMarkerCount > 0 && terraform.resolvedBlockCount === 0) terraformBlind = true;
     for (const toolName of manifest.tools) {
@@ -12435,7 +12571,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join49(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join50(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -12466,9 +12602,9 @@ function auditPluginToolSupply(pluginsRoot) {
 
 // src/scripts/check-plugin-tool-supply.ts
 async function runPluginToolSupplyCheck() {
-  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join50(root, "services", "_plugins");
+  const pluginsRoot = join51(root, "services", "_plugins");
   if (!existsSync42(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
@@ -12499,7 +12635,7 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join50(root, "services", "api");
+  const servicesApiRoot = join51(root, "services", "api");
   if (!existsSync42(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
@@ -12546,7 +12682,7 @@ async function runPluginToolSupplyCheck() {
 }
 
 // src/scripts/check-release-subject.ts
-import { execa as execa18 } from "execa";
+import { execa as execa19 } from "execa";
 
 // src/lib/release-version.ts
 var MINOR_TYPES = /* @__PURE__ */ new Set(["feat"]);
@@ -12583,7 +12719,7 @@ async function fetchPrTitleViaGh({
   PR_NUMBER,
   GH_REPO
 }) {
-  const { stdout } = await execa18(
+  const { stdout } = await execa19(
     "gh",
     ["pr", "view", PR_NUMBER, "--repo", GH_REPO, "--json", "title", "--jq", ".title"],
     { env: { ...process.env, GH_TOKEN } }
@@ -12619,7 +12755,7 @@ async function resolveReleaseSubject({
       );
     }
   }
-  return (await execa18("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
+  return (await execa19("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
 }
 async function runReleaseSubjectCheck(argv) {
   const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
@@ -12627,9 +12763,9 @@ async function runReleaseSubjectCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  await execa18("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa18("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
+  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  await execa19("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa19("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
     cwd: root
   });
   const changedFiles = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -12678,12 +12814,12 @@ async function runReleaseSubjectCheck(argv) {
 
 // src/scripts/check-skeleton-drift.ts
 import { existsSync as existsSync43, readdirSync as readdirSync24 } from "fs";
-import { join as join52 } from "path";
-import { execa as execa19 } from "execa";
+import { join as join53 } from "path";
+import { execa as execa20 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
-import { readFileSync as readFileSync36, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
-import { join as join51 } from "path";
+import { readFileSync as readFileSync37, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
+import { join as join52 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -12747,7 +12883,7 @@ function walk(dir, base = dir) {
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join51(dir, entry);
+    const abs = join52(dir, entry);
     let isDir;
     try {
       isDir = statSync14(abs).isDirectory();
@@ -12769,7 +12905,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync36(join51(skeletonRoot, rel), "utf8");
+        contents = readFileSync37(join52(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -12798,23 +12934,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join52(root, "_skeletons");
+  const skeletonsDir = join53(root, "_skeletons");
   let entries;
   try {
     entries = readdirSync24(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync43(join52(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync43(join53(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
-  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join52(root, "_skeletons", name);
+    const skeletonRoot = join53(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync43(join52(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync43(join53(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -12828,7 +12964,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join52(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join53(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -12840,9 +12976,9 @@ async function runSkeletonDriftCheck() {
 }
 
 // src/scripts/check-terraform-input.ts
-import { execa as execa20 } from "execa";
+import { execa as execa21 } from "execa";
 async function runTerraformInputCheck() {
-  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -12865,7 +13001,7 @@ async function runTerraformInputCheck() {
 
 // src/commands/check.ts
 var checkCommand = new Command23("check").description(
-  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input) run in CI and git hooks, plus out-of-band audits (branch protection)"
+  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention) run in CI and git hooks, plus out-of-band audits (branch protection)"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
   await runOwnershipCheck(rawArgsAfter("ownership"));
@@ -12879,6 +13015,11 @@ checkCommand.command("plugin-collisions").description("Refuse two vendored plugi
 checkCommand.command("plugin-terraform").description("Verify every template-owned plugin declaring infra ships a Terraform module").action(async () => {
   await runPluginTerraformCheck();
 });
+checkCommand.command("plugin-allowlist-convention").description(
+  "Refuse the ADR-0009 service-principal allowlist glob drifting from the IAM role name modules/cloud/aws/compute + modules/plugins/_template actually build (#266) \u2014 terraform validate is silent on this because the allowlist never references either naming module by design, so a rename would leave every plugin call rejected with no signal before a real deploy hits it. tabsii-platform#863 is this exact failure shape already reaching production, via a hand-maintained allowlist that simply omitted the plugin host."
+).action(async () => {
+  await runPluginAllowlistConventionCheck();
+});
 checkCommand.command("adr-numbering").description(
   "Refuse two ADRs in this repo's own docs/ADR/ claiming the same number (tabsii-platform#449)"
 ).action(async () => {
@@ -12951,8 +13092,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync44, readFileSync as readFileSync37 } from "fs";
-import { join as join53, resolve as resolve18 } from "path";
+import { existsSync as existsSync44, readFileSync as readFileSync38 } from "fs";
+import { join as join54, resolve as resolve19 } from "path";
 import chalk21 from "chalk";
 import { Command as Command24 } from "commander";
 
@@ -13080,7 +13221,7 @@ var INTEGRATION_BRANCH = "dev";
 var doctorCommand = new Command24("doctor").description(
   "Report repo-state conditions that make everything read from this checkout unreliable"
 ).option("--cwd <path>", "Repo root to inspect (defaults to the current directory)").option("--no-fetch", "Skip the fetch; report against refs as they already are locally").action(async (options) => {
-  const cwd = options.cwd ? resolve18(options.cwd) : process.cwd();
+  const cwd = options.cwd ? resolve19(options.cwd) : process.cwd();
   try {
     const findings = await runDoctor({ cwd, fetch: options.fetch !== false });
     printFindings(findings);
@@ -13127,10 +13268,10 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join53(cwd, INSTANCE_CORE_FILE);
+  const path = join54(cwd, INSTANCE_CORE_FILE);
   if (!existsSync44(path)) return null;
   try {
-    return parseCoreRecord(readFileSync37(path, "utf8"));
+    return parseCoreRecord(readFileSync38(path, "utf8"));
   } catch {
     return null;
   }
@@ -13145,10 +13286,10 @@ function parseCoreRecord(contents) {
   }
 }
 function readFossil(cwd) {
-  const path = join53(cwd, CORE_VERSION_FILE);
+  const path = join54(cwd, CORE_VERSION_FILE);
   if (!existsSync44(path)) return null;
   try {
-    const value = readFileSync37(path, "utf8").trim();
+    const value = readFileSync38(path, "utf8").trim();
     return value === "" ? null : value;
   } catch {
     return null;
@@ -13598,11 +13739,11 @@ import { Command as Command26 } from "commander";
 
 // src/lib/packaged-scripts.ts
 import { existsSync as existsSync45 } from "fs";
-import { dirname as dirname11, join as join54 } from "path";
+import { dirname as dirname11, join as join55 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join54(dir, relativePath);
+    const candidate = join55(dir, relativePath);
     if (existsSync45(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.278.1",
+  "version": "0.278.3",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/scripts/practices-metrics.mjs

@@ -997,6 +997,52 @@ export const RACE_THRESHOLD_MINUTES = 10
  *   just before the window opened is not in `prs` to be counted. The bias is
  *   one-directional and toward zero, so a rise is always real.
  *
+ * ## `racedShare` is not portable across repos with different CI speed (#1419)
+ *
+ * `RACE_THRESHOLD_MINUTES` is an **absolute** 10 minutes, the same number for
+ * every repo regardless of how long that repo's own CI takes to reach green.
+ * That makes the threshold a function of pipeline latency as much as of
+ * contention: a repo whose median time-to-green already exceeds 10 minutes
+ * crosses `racedShare`'s numerator condition on wait time alone, before any
+ * question of whether `dev` moved underneath it.
+ *
+ * Measured live 2026-08-12, four repos, 7-day window, `strict: false` on
+ * three of the four (the fourth, `biffo-plugin-idea-scout`, `true`):
+ *
+ * | repo | runner | `greenToMergeP50Minutes` | `repushRate` | `racedShare` | `staleMergeShare` |
+ * | --- | --- | ---: | ---: | ---: | ---: |
+ * | `biffo-template` | hosted | 4.1 | 15.0% | 12.6% | 18.1% |
+ * | `biffo-platform` | hosted | 4.4 | 12.5% | 12.5% | 0% |
+ * | `biffo-plugin-idea-scout` | hosted | 7.3 | 46.2% | 23.1% | 0% |
+ * | `tabsii-platform` | **self-hosted, spot** | **14.7** | **42.7%** | **41.3%** | 7.3% |
+ *
+ * `tabsii-platform` is the only repo of the four on self-hosted (spot) runner
+ * capacity, and its median green-to-merge lag (14.7min) already clears the
+ * fixed 10-minute threshold by itself — consistent with the runner-queueing
+ * cost recorded elsewhere in this estate for that fleet. `racedShare` tracks
+ * `repushRate` far more tightly across this table than it tracks `strict`
+ * (three of the four rows are `strict: false` and still span 12.5%–41.3%),
+ * which reconfirms H4's amendment to H3: *"`racedShare` counts PRs that sat
+ * green over ten minutes and were repushed. It is arithmetically a function of
+ * how many times you push."*
+ *
+ * The clincher against reading `racedShare` as *this repo has more genuine
+ * integration contention*: `staleMergeShare` — the metric that actually
+ * detects whether `dev` moved between a PR's last green run and its merge —
+ * is **lower** at `tabsii-platform` (7.3%) than at `biffo-template` (18.1%).
+ * If `tabsii-platform`'s elevated `racedShare` reflected more real racing
+ * against a moving `dev`, `staleMergeShare` should read higher there too, not
+ * lower. It does not, so the elevated reading is better read as this repo's
+ * own CI/runner latency and repush volume crossing an absolute threshold, not
+ * as more contention.
+ *
+ * **Practical consequence: never read `racedShare` as a bare cross-repo
+ * defect rate.** Read it beside `greenToMergeP50Minutes` (this repo's own
+ * pipeline speed relative to the fixed threshold) and `repushRate` (the
+ * arithmetic driver), and treat `staleMergeShare` as the tie-breaker when the
+ * two disagree about whether a high `racedShare` is genuine contention. The
+ * dashboard's tooltip on this cell carries the same note.
+ *
  * @param {Array<{createdAt: string, mergedAt: string | null, headRefName: string, baseRefName?: string}>} prs
  * @param {Map<string, Array<Record<string, unknown>>>} runsByBranch
  */