@biffo/cli 0.283.3 → 0.284.0

package/dist/index.js

@@ -9693,6 +9693,7 @@ import { cpSync as cpSync6, existsSync as existsSync35, mkdirSync as mkdirSync12
 import { join as join37, relative as relative7, resolve as resolve17 } from "path";
 import chalk19 from "chalk";
 import { Command as Command20 } from "commander";
+import { execa as execa7 } from "execa";
 import inquirer7 from "inquirer";
 var pluginUpgradeCommand = new Command20("upgrade").description(
   "Upgrade an installed plugin to a new minor version (biffo plugin upgrade <name>@<new-minor>) or refresh it in place from a local, unpublished checkout (biffo plugin upgrade --local <path>)"
@@ -9794,6 +9795,7 @@ async function runPluginUpgrade(target, options, deps) {
       refuseIfModuleStillReferenced(options.cwd, modulesDir, entry.name);
     }
     const previousProvenance = readProvenance(targetDir);
+    const previousPyproject = readPyprojectIfPresent(targetDir);
     rmSync10(targetDir, { recursive: true, force: true });
     mkdirSync12(targetDir, { recursive: true });
     cpSync6(tmpDir, targetDir, { recursive: true });
@@ -9804,6 +9806,7 @@ async function runPluginUpgrade(target, options, deps) {
     );
     writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, `services/${entry.name}`);
+    const newPyproject = readPyprojectIfPresent(targetDir);
     const stagePaths = [`services/${entry.name}`];
     if (existsSync35(modulesDir)) {
       rmSync10(modulesDir, { recursive: true, force: true });
@@ -9835,12 +9838,29 @@ async function runPluginUpgrade(target, options, deps) {
     if (seedResult.vendored) {
       stagePaths.push(seedResult.stagedPath);
     }
+    const lockOutcomes = await relockIfDependenciesChanged(
+      options.cwd,
+      `services/${entry.name}/pyproject.toml`,
+      previousPyproject,
+      newPyproject,
+      deps
+    );
+    for (const outcome of lockOutcomes) {
+      if (outcome.ok) stagePaths.push(outcome.trigger.lockfile);
+    }
     const label = currentVersion ? `${entry.name} ${currentVersion} -> ${entry.version}` : `${entry.name} to ${entry.version}`;
     const commitMessage = `feat(plugins): upgrade ${label}`;
     await deps.git.add(options.cwd, stagePaths);
     await deps.git.commit(options.cwd, commitMessage);
     log.success(`Committed: ${commitMessage}`);
-    console.log(chalk19.bold("\n  Plugin upgraded!\n"));
+    const lockFailures = describeFailures(lockOutcomes);
+    if (lockFailures.length > 0) {
+      console.log(chalk19.yellow.bold("\n  \u26A0 Plugin upgraded, but uv.lock needs attention\n"));
+      for (const failure of lockFailures) console.log(chalk19.yellow(`  ${failure}`));
+      console.log();
+    } else {
+      console.log(chalk19.bold("\n  Plugin upgraded!\n"));
+    }
     console.log(`  ${entry.name}@${entry.version} is committed at services/${entry.name}/`);
     console.log("  Push and redeploy to apply its updated tables and routes:");
     console.log(chalk19.dim(`    git push`));
@@ -9889,6 +9909,7 @@ async function runLocalPluginRefresh(localPath, options, deps) {
       refuseIfModuleStillReferenced(options.cwd, modulesDir, source.name);
     }
     const previousProvenance = readProvenance(targetDir);
+    const previousPyproject = readPyprojectIfPresent(targetDir);
     if (inTreeSource) {
       log.info(
         `services/${source.name}/ is already the local checkout \u2014 nothing to copy; re-syncing its Terraform module and checking for a migration.`
@@ -9902,6 +9923,7 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     const nextProvenance = inTreeSource ? inTreePluginProvenance(`services/${source.name}`) : await resolveLocalProvenance(source.sourceDir, source.origin);
     writePluginProvenance(targetDir, reconcileProvenance(previousProvenance, nextProvenance));
     applyWorkspaceSources(targetDir, options.cwd, `services/${source.name}`);
+    const newPyproject = readPyprojectIfPresent(targetDir);
     const stagePaths = [`services/${source.name}`];
     if (existsSync35(modulesDir)) {
       rmSync10(modulesDir, { recursive: true, force: true });
@@ -9935,6 +9957,16 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     if (seedResult.vendored) {
       stagePaths.push(seedResult.stagedPath);
     }
+    const lockOutcomes = await relockIfDependenciesChanged(
+      options.cwd,
+      `services/${source.name}/pyproject.toml`,
+      previousPyproject,
+      newPyproject,
+      deps
+    );
+    for (const outcome of lockOutcomes) {
+      if (outcome.ok) stagePaths.push(outcome.trigger.lockfile);
+    }
     await deps.git.add(options.cwd, stagePaths);
     if (!await deps.git.hasUncommittedChanges(options.cwd)) {
       log.warn(`services/${source.name}/ already matches ${source.origin} \u2014 nothing to commit.`);
@@ -9943,7 +9975,14 @@ async function runLocalPluginRefresh(localPath, options, deps) {
     const commitMessage = `chore(plugins): refresh ${source.name} from local checkout`;
     await deps.git.commit(options.cwd, commitMessage);
     log.success(`Committed: ${commitMessage}`);
-    console.log(chalk19.bold("\n  Plugin refreshed!\n"));
+    const lockFailures = describeFailures(lockOutcomes);
+    if (lockFailures.length > 0) {
+      console.log(chalk19.yellow.bold("\n  \u26A0 Plugin refreshed, but uv.lock needs attention\n"));
+      for (const failure of lockFailures) console.log(chalk19.yellow(`  ${failure}`));
+      console.log();
+    } else {
+      console.log(chalk19.bold("\n  Plugin refreshed!\n"));
+    }
     console.log(`  services/${source.name}/ now matches ${source.origin}`);
     console.log("  Push and redeploy to apply any updated tables and routes:");
     console.log(chalk19.dim(`    git push`));
@@ -9964,6 +10003,62 @@ ${refList}
 A plugin repo without terraform/ is missing the directory, not declaring that the module should go, and a wrong destructive action here is worse than no action. Either remove the reference(s) above yourself, or run 'biffo plugin uninstall ${name}', which removes the module and unwires the reference together.`
   );
 }
+async function relockIfDependenciesChanged(cwd, relPyprojectPath, previousPyproject, newPyproject, deps) {
+  if (!dependenciesChanged(previousPyproject, newPyproject)) return [];
+  const triggers = lockfilesNeedingRefresh([relPyprojectPath], cwd);
+  if (triggers.length === 0) return [];
+  const run = deps.runCommand ?? defaultRunCommand2;
+  const outcomes = await refreshLockfiles(cwd, triggers, run);
+  const refreshed = outcomes.filter((o) => o.ok);
+  if (refreshed.length > 0) {
+    log.success(
+      `Refreshed ${refreshed.map((o) => o.trigger.lockfile).join(", ")} \u2014 this refresh changed a dependency it locks.`
+    );
+  }
+  for (const message of describeFailures(outcomes)) log.warn(message);
+  return outcomes;
+}
+var defaultRunCommand2 = async (command, cwd) => {
+  const [bin, ...args] = command;
+  if (!bin) return { ok: false, error: "empty command" };
+  try {
+    await execa7(bin, args, { cwd });
+    return { ok: true };
+  } catch (err) {
+    const cause = err;
+    const detail = cause.stderr?.trim() || cause.shortMessage || cause.message || "failed";
+    return { ok: false, error: detail.split("\n")[0] ?? "failed" };
+  }
+};
+function readPyprojectIfPresent(targetDir) {
+  const path = join37(targetDir, "pyproject.toml");
+  return existsSync35(path) ? readFileSync26(path, "utf8") : null;
+}
+function dependenciesChanged(before, after) {
+  if (before === after) return false;
+  const beforeItems = before ? dependencySurface(before) : [];
+  const afterItems = after ? dependencySurface(after) : [];
+  return JSON.stringify(beforeItems) !== JSON.stringify(afterItems);
+}
+function dependencySurface(text) {
+  const items = [...readTomlStringArray(text, "dependencies")];
+  for (const header of ["dependency-groups", "project.optional-dependencies"]) {
+    const body = tomlTableBody(text, header);
+    if (!body) continue;
+    for (const m of body.matchAll(/^([A-Za-z0-9_.-]+)\s*=\s*\[/gm)) {
+      items.push(...readTomlStringArray(body, m[1]));
+    }
+  }
+  return items.sort();
+}
+function tomlTableBody(text, header) {
+  const escaped = header.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const headerMatch = new RegExp(`^\\[${escaped}\\]\\s*$`, "m").exec(text);
+  if (!headerMatch) return null;
+  const rest = text.slice(headerMatch.index + headerMatch[0].length);
+  const nextHeader = /^\[/m.exec(rest);
+  return nextHeader ? rest.slice(0, nextHeader.index) : rest;
+}
 function readInstalledVersion2(targetDir) {
   const manifestPath = join37(targetDir, "biffo.plugin.json");
   if (!existsSync35(manifestPath)) return void 0;
@@ -10314,7 +10409,7 @@ import { Command as Command24 } from "commander";
 // src/scripts/check-adr-numbering.ts
 import { existsSync as existsSync38 } from "fs";
 import { join as join39 } from "path";
-import { execa as execa7 } from "execa";
+import { execa as execa8 } from "execa";
 
 // src/lib/adr-numbering-guard.ts
 import { existsSync as existsSync37, readdirSync as readdirSync15, readFileSync as readFileSync28 } from "fs";
@@ -10388,7 +10483,7 @@ function formatAdrReservedRangeViolations(violations, reservedUpTo = TEMPLATE_AD
 
 // src/scripts/check-adr-numbering.ts
 async function runAdrNumberingCheck() {
-  const root = (await execa7("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa8("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const adrDir = join39(root, "docs", "ADR");
   if (!existsSync38(adrDir)) {
     console.log("\u2713 ADR numbering guard: no docs/ADR/ directory \u2014 nothing to compare");
@@ -10429,7 +10524,7 @@ Already accepted? List it in docs/ADR/${ALLOWLIST_FILENAME} instead of leaving t
 
 // src/scripts/check-branch-protection.ts
 import { Octokit as Octokit2 } from "@octokit/rest";
-import { execa as execa8 } from "execa";
+import { execa as execa9 } from "execa";
 
 // src/lib/branch-protection-apply.ts
 var CONTEXT_CONSISTENCY_THRESHOLD = 2 / 3;
@@ -10556,7 +10651,7 @@ async function resolveRepo(explicit) {
     }
     return { owner, repo };
   }
-  const { stdout } = await execa8("git", ["remote", "get-url", "origin"]);
+  const { stdout } = await execa9("git", ["remote", "get-url", "origin"]);
   const m = /github\.com[:/]([^/]+)\/(.+?)(?:\.git)?$/.exec(stdout.trim());
   if (!m?.[1] || !m[2]) {
     console.error(
@@ -10687,14 +10782,160 @@ async function runBranchProtectionCheck(explicitRepo, options = {}) {
   console.log(`\u2713 branch-protection guard: ${owner}/${repo} (${audited.join(", ")}) OK`);
 }
 
+// src/scripts/check-claim-invocation.ts
+import { execa as execa10 } from "execa";
+
+// src/lib/claim-invocation-parity.ts
+import { existsSync as existsSync39, readFileSync as readFileSync29, readdirSync as readdirSync16 } from "fs";
+import { join as join40 } from "path";
+function distributedAgentsDocs(root) {
+  const docs = [];
+  const own = join40(root, "AGENTS.md");
+  if (existsSync39(own)) docs.push({ path: "AGENTS.md", text: readFileSync29(own, "utf8") });
+  const skeletons = join40(root, "_skeletons");
+  if (existsSync39(skeletons)) {
+    for (const name of readdirSync16(skeletons).sort()) {
+      const abs = join40(skeletons, name, "AGENTS.md");
+      if (!existsSync39(abs)) continue;
+      docs.push({ path: `_skeletons/${name}/AGENTS.md`, text: readFileSync29(abs, "utf8") });
+    }
+  }
+  return docs;
+}
+function isClaimInvocation(line) {
+  return /\b(?:biffo\.sh|claim\.sh)\s+claim\b|\bclaim\.sh\s+\d|\bclaim\s+<issue-number>/.test(line);
+}
+function claimBlock(text) {
+  const lines = text.split("\n");
+  const out = [];
+  let fenced = false;
+  for (const raw of lines) {
+    if (/^\s*```/.test(raw)) {
+      fenced = !fenced;
+      continue;
+    }
+    if (!fenced) continue;
+    if (isClaimInvocation(raw)) out.push(raw.trimEnd());
+  }
+  return out;
+}
+function claimInvocations(text) {
+  const found = [];
+  let fenced = false;
+  for (const raw of text.split("\n")) {
+    if (/^\s*```/.test(raw)) {
+      fenced = !fenced;
+      continue;
+    }
+    if (fenced) {
+      if (isClaimInvocation(raw)) found.push(raw.trimEnd());
+      continue;
+    }
+    for (const match of raw.matchAll(/`([^`]+)`/g)) {
+      const span = match[1];
+      if (span !== void 0 && isClaimInvocation(span)) found.push(span.trim());
+    }
+  }
+  return found;
+}
+function isTokened(invocation) {
+  return /--as\b|--release\b|--guard\b/.test(invocation);
+}
+function auditClaimInvocationParity(docs) {
+  const violations = [];
+  if (docs.length === 0) {
+    return [
+      {
+        rule: "no-copies",
+        path: "(none)",
+        detail: "no distributed AGENTS.md found \u2014 a guard with an empty input set passes against anything"
+      }
+    ];
+  }
+  const [canonical, ...rest] = docs;
+  const canonicalBlock = claimBlock(canonical.text);
+  if (canonicalBlock.length === 0) {
+    violations.push({
+      rule: "missing-form",
+      path: canonical.path,
+      detail: "documents no claim invocation at all"
+    });
+  }
+  for (const doc of rest) {
+    const block = claimBlock(doc.text);
+    if (block.join("\n") !== canonicalBlock.join("\n")) {
+      violations.push({
+        rule: "block-drift",
+        path: doc.path,
+        detail: `claim block differs from ${canonical.path}
+    ${canonical.path}:
+${canonicalBlock.map((l) => `      ${l}`).join("\n")}
+    ${doc.path}:
+${block.map((l) => `      ${l}`).join("\n")}`
+      });
+    }
+  }
+  for (const doc of docs) {
+    const invocations = claimInvocations(doc.text);
+    for (const invocation of invocations) {
+      if (!isTokened(invocation)) {
+        violations.push({
+          rule: "untokened-form",
+          path: doc.path,
+          detail: `documents a claim with no --as token: ${invocation.trim()}`
+        });
+      }
+    }
+    if (!invocations.some((i) => /--as\b/.test(i))) {
+      violations.push({
+        rule: "missing-form",
+        path: doc.path,
+        detail: "never documents `claim <issue-number> --as <token>`"
+      });
+    }
+    if (!invocations.some((i) => /--release\b/.test(i))) {
+      violations.push({
+        rule: "missing-form",
+        path: doc.path,
+        detail: "never documents `claim <issue-number> --release <token>`"
+      });
+    }
+  }
+  return violations;
+}
+function formatParityViolations(violations) {
+  return violations.map((v) => `  [${v.rule}] ${v.path}: ${v.detail}`).join("\n");
+}
+
+// src/scripts/check-claim-invocation.ts
+async function runClaimInvocationCheck() {
+  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const docs = distributedAgentsDocs(root);
+  console.log(
+    `audited ${docs.length} distributed AGENTS.md (${docs.map((d) => d.path).join(", ") || "none"}) under ${root}`
+  );
+  const violations = auditClaimInvocationParity(docs);
+  if (violations.length > 0) {
+    console.error("\u2717 Claim-invocation guard: the distributed AGENTS.md copies disagree\n");
+    console.error(formatParityViolations(violations));
+    console.error(
+      "\nEvery copy must document the same invocation, and `--as <token>` is mandatory (#1562). Fix the skeletons too \u2014 they are what satellites receive."
+    );
+    process.exit(1);
+  }
+  console.log(
+    "\u2713 Claim-invocation guard: every distributed AGENTS.md documents the same, tokened, claim"
+  );
+}
+
 // src/scripts/check-codeql-suppression.ts
-import { existsSync as existsSync39 } from "fs";
-import { join as join41, relative as relative8 } from "path";
-import { execa as execa9 } from "execa";
+import { existsSync as existsSync40 } from "fs";
+import { join as join42, relative as relative8 } from "path";
+import { execa as execa11 } from "execa";
 
 // src/lib/codeql-suppression-guard.ts
-import { readdirSync as readdirSync16, readFileSync as readFileSync29, statSync as statSync9 } from "fs";
-import { join as join40 } from "path";
+import { readdirSync as readdirSync17, readFileSync as readFileSync30, statSync as statSync9 } from "fs";
+import { join as join41 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   ".worktrees",
@@ -10720,12 +10961,12 @@ function walkSourceFiles(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync16(dir);
+      entries = readdirSync17(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join40(dir, entry);
+      const p = join41(dir, entry);
       let st;
       try {
         st = statSync9(p);
@@ -10751,7 +10992,7 @@ function countSourceFiles(root) {
 function sweepCodeqlSuppressionComments(root) {
   const hits = [];
   for (const path of walkSourceFiles(root)) {
-    const text = readFileSync29(path, "utf8");
+    const text = readFileSync30(path, "utf8");
     for (const line of findCodeqlSuppressionComments(text)) {
       hits.push({ path, line, text: text.split("\n")[line - 1] ?? "" });
     }
@@ -10761,9 +11002,9 @@ function sweepCodeqlSuppressionComments(root) {
 
 // src/scripts/check-codeql-suppression.ts
 async function runCodeqlSuppressionCheck() {
-  const root = (await execa9("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const scanRoot = join41(root, "cli", "src");
-  if (!existsSync39(scanRoot)) {
+  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const scanRoot = join42(root, "cli", "src");
+  if (!existsSync40(scanRoot)) {
     console.log(
       "\u2014 codeql-suppression guard: skipped \u2014 no cli/src in this repo, so there is no CLI source to scan."
     );
@@ -10787,11 +11028,11 @@ async function runCodeqlSuppressionCheck() {
 }
 
 // src/scripts/check-cognito-invite-template.ts
-import { execa as execa10 } from "execa";
+import { execa as execa12 } from "execa";
 
 // src/lib/cognito-invite-template-guard.ts
-import { readdirSync as readdirSync17, readFileSync as readFileSync30, statSync as statSync10 } from "fs";
-import { join as join42 } from "path";
+import { readdirSync as readdirSync18, readFileSync as readFileSync31, statSync as statSync10 } from "fs";
+import { join as join43 } from "path";
 var REQUIRED_INVITE_MEMBERS = ["email_subject", "email_message", "sms_message"];
 var REQUIRED_INVITE_PLACEHOLDERS = ["{username}", "{####}"];
 var PLACEHOLDER_MEMBERS = ["email_message", "sms_message"];
@@ -10868,13 +11109,13 @@ function findModuleTerraformFiles(repoRoot) {
   const walk2 = (dir, relative11) => {
     let entries;
     try {
-      entries = readdirSync17(dir);
+      entries = readdirSync18(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry === "node_modules" || entry === ".git" || entry === ".worktrees") continue;
-      const full = join42(dir, entry);
+      const full = join43(dir, entry);
       const rel = `${relative11}/${entry}`;
       if (statSync10(full).isDirectory()) {
         walk2(full, rel);
@@ -10883,18 +11124,18 @@ function findModuleTerraformFiles(repoRoot) {
       }
     }
   };
-  walk2(join42(repoRoot, "modules"), "modules");
+  walk2(join43(repoRoot, "modules"), "modules");
   return found.sort();
 }
 function checkCognitoInviteTemplates(repoRoot) {
   return findModuleTerraformFiles(repoRoot).flatMap(
-    (file) => checkInviteTemplateSource(file, readFileSync30(join42(repoRoot, file), "utf8"))
+    (file) => checkInviteTemplateSource(file, readFileSync31(join43(repoRoot, file), "utf8"))
   );
 }
 
 // src/scripts/check-cognito-invite-template.ts
 async function runCognitoInviteTemplateCheck() {
-  const root = (await execa10("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findModuleTerraformFiles(root);
   console.log(`audited ${files.length} .tf file(s) under modules/ under ${root}`);
   if (files.length === 0) {
@@ -10916,12 +11157,12 @@ async function runCognitoInviteTemplateCheck() {
 }
 
 // src/scripts/check-core-direct-paths.ts
-import { join as join44 } from "path";
-import { execa as execa11 } from "execa";
+import { join as join45 } from "path";
+import { execa as execa13 } from "execa";
 
 // src/lib/core-direct-paths-audit.ts
-import { existsSync as existsSync40, readFileSync as readFileSync31, readdirSync as readdirSync18, statSync as statSync11 } from "fs";
-import { join as join43 } from "path";
+import { existsSync as existsSync41, readFileSync as readFileSync32, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
+import { join as join44 } from "path";
 var EXTERNAL_BASE_IDENTIFIERS = ["CORE_API_URL"];
 var API_ROUTE_PREFIX = "/api/v1";
 var TEST_FILE_SUFFIXES = [".test.ts", ".test.tsx", ".spec.ts", ".spec.tsx"];
@@ -11080,12 +11321,12 @@ function walkFiles(root, accept, skipDir) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync18(dir);
+      entries = readdirSync19(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join43(dir, entry);
+      const p = join44(dir, entry);
       let st;
       try {
         st = statSync11(p);
@@ -11115,7 +11356,7 @@ function auditFrontendExtraction(frontendSrcDir, externalBases = EXTERNAL_BASE_I
   const extracted = [];
   let rawTotal = 0;
   for (const file of files) {
-    const text = readFileSync31(file, "utf8");
+    const text = readFileSync32(file, "utf8");
     rawTotal += countRawExternalOccurrences(text, externalBases);
     extracted.push(...extractCoreDirectPaths(text, file, externalBases));
   }
@@ -11164,7 +11405,7 @@ function auditCoreRouteExtraction(apiSrcDir) {
   const prefixSet = /* @__PURE__ */ new Set();
   let rawApiRouterCount = 0;
   for (const file of files) {
-    const text = readFileSync31(file, "utf8");
+    const text = readFileSync32(file, "utf8");
     const extraction = extractCoreRoutePrefixes(text);
     rawApiRouterCount += extraction.rawApiRouterCount;
     for (const p of extraction.prefixes) prefixSet.add(normalizePrefix(p));
@@ -11180,10 +11421,10 @@ function pathMatchesAnyCorePrefix(normalized, corePrefixes, apiRoutePrefix = API
 }
 function resolveSiblingCoreSrc(params) {
   const { estateDir, sibling } = params;
-  const configPath = join43(estateDir, sibling, "biffo.sibling.json");
+  const configPath = join44(estateDir, sibling, "biffo.sibling.json");
   let raw;
   try {
-    raw = readFileSync31(configPath, "utf8");
+    raw = readFileSync32(configPath, "utf8");
   } catch (err) {
     throw new Error(
       `cannot resolve ${sibling}'s core: ${configPath} does not exist or is unreadable (${err.message}) -- refusing to guess which core serves this sibling.`
@@ -11203,8 +11444,8 @@ function resolveSiblingCoreSrc(params) {
       `cannot resolve ${sibling}'s core: ${configPath} has no non-empty "core_project" field.`
     );
   }
-  const coreApiSrcDir = join43(estateDir, coreProject, "services", "api", "src");
-  if (!existsSync40(coreApiSrcDir)) {
+  const coreApiSrcDir = join44(estateDir, coreProject, "services", "api", "src");
+  if (!existsSync41(coreApiSrcDir)) {
     throw new Error(
       `cannot resolve ${sibling}'s core: biffo.sibling.json names core_project "${coreProject}", but ${coreApiSrcDir} does not exist -- the instance is missing from this estate checkout, not merely unmatched. Refusing to silently skip ${sibling} and shrink the audit's denominator.`
     );
@@ -11245,9 +11486,9 @@ function auditSiblingCoreDirectPaths(params) {
 
 // src/scripts/check-core-direct-paths.ts
 async function runCoreDirectPathsCheck(opts = {}) {
-  const root = (await execa11("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const sibling = opts.sibling ?? "sibling-template (self-check)";
-  const frontendSrcDir = opts.frontendSrc ?? join44(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
+  const frontendSrcDir = opts.frontendSrc ?? join45(root, "_skeletons", "sibling-template", "apps", "frontend", "src");
   let coreApiSrcDir;
   let coreProject = null;
   if (opts.coreSrc) {
@@ -11263,7 +11504,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
     coreApiSrcDir = resolution.coreApiSrcDir;
     coreProject = resolution.coreProject;
   } else {
-    coreApiSrcDir = join44(root, "services", "api", "src");
+    coreApiSrcDir = join45(root, "services", "api", "src");
   }
   const report = auditSiblingCoreDirectPaths({ sibling, frontendSrcDir, coreApiSrcDir });
   console.log(
@@ -11299,7 +11540,7 @@ async function runCoreDirectPathsCheck(opts = {}) {
 }
 
 // src/scripts/check-core-ownership.ts
-import { execa as execa12 } from "execa";
+import { execa as execa14 } from "execa";
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
 var RED = "\x1B[31m";
@@ -11310,7 +11551,7 @@ async function runOwnershipCheck(argv) {
   const stagedFlag = args.indexOf("--staged");
   const staged = stagedFlag !== -1;
   const messageFile = staged ? args[stagedFlag + 1] : void 0;
-  const root = (await execa12("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const ownership = classifyRepoOwnership(root);
   if (ownership === "template") {
     console.log("\u2713 core ownership guard: skipped \u2014 this is the template, which owns these paths.");
@@ -11326,11 +11567,11 @@ async function runOwnershipCheck(argv) {
   let deletedFiles = [];
   let commitMessage = "";
   if (staged) {
-    const { stdout } = await execa12("git", ["diff", "--cached", "--name-status"], { cwd: root });
+    const { stdout } = await execa14("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync41, existsSync: existsSync50 } = await import("fs");
-      if (existsSync50(messageFile)) commitMessage = readFileSync41(messageFile, "utf8");
+      const { readFileSync: readFileSync42, existsSync: existsSync51 } = await import("fs");
+      if (existsSync51(messageFile)) commitMessage = readFileSync42(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -11338,18 +11579,18 @@ async function runOwnershipCheck(argv) {
       console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
       process.exit(2);
     }
-    await execa12("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-    const { stdout } = await execa12("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
+    await execa14("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+    const { stdout } = await execa14("git", ["diff", "--name-status", `origin/${base}...HEAD`], {
       cwd: root
     });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
-    const { stdout: log2 } = await execa12("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
+    const { stdout: log2 } = await execa14("git", ["log", "--format=%B", `origin/${base}..HEAD`], {
       cwd: root,
       reject: false
     });
     commitMessage = log2;
   }
-  const { stdout: gitBranch } = await execa12("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+  const { stdout: gitBranch } = await execa14("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
     cwd: root,
     reject: false
   });
@@ -11431,11 +11672,11 @@ ${BOLD}If the divergence is deliberate${OFF}
 }
 
 // src/scripts/check-eventbridge-log-permissions.ts
-import { execa as execa13 } from "execa";
+import { execa as execa15 } from "execa";
 
 // src/lib/eventbridge-log-permission-guard.ts
-import { readFileSync as readFileSync32, readdirSync as readdirSync19, statSync as statSync12 } from "fs";
-import { join as join45 } from "path";
+import { readFileSync as readFileSync33, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
+import { join as join46 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
 var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
@@ -11507,12 +11748,12 @@ function walkTerraformFiles(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync19(dir);
+      entries = readdirSync20(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join45(dir, entry);
+      const p = join46(dir, entry);
       let st;
       try {
         st = statSync12(p);
@@ -11555,7 +11796,7 @@ function auditEventBridgeLogPermissions(root) {
   let rawEventTargetCount = 0;
   let rawLogPolicyCount = 0;
   for (const file of files) {
-    const text = readFileSync32(file, "utf8");
+    const text = readFileSync33(file, "utf8");
     rawEventTargetCount += countRawResourceDeclarations(text, EVENT_TARGET_TYPE);
     rawLogPolicyCount += countRawResourceDeclarations(text, LOG_RESOURCE_POLICY_TYPE);
     eventTargetBlocks.push(...findResourceBlocks(text, file, EVENT_TARGET_TYPE));
@@ -11608,7 +11849,7 @@ function auditEventBridgeLogPermissions(root) {
 
 // src/scripts/check-eventbridge-log-permissions.ts
 async function runEventBridgeLogPermissionCheck() {
-  const root = (await execa13("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let report;
   try {
     report = auditEventBridgeLogPermissions(root);
@@ -11645,15 +11886,15 @@ async function runEventBridgeLogPermissionCheck() {
 }
 
 // src/scripts/check-lambda-output.ts
-import { execa as execa14 } from "execa";
+import { execa as execa16 } from "execa";
 
 // src/lib/lambda-output-guard.ts
-import { readFileSync as readFileSync34 } from "fs";
-import { join as join47 } from "path";
+import { readFileSync as readFileSync35 } from "fs";
+import { join as join48 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { existsSync as existsSync41, readdirSync as readdirSync20, readFileSync as readFileSync33, statSync as statSync13 } from "fs";
-import { join as join46 } from "path";
+import { existsSync as existsSync42, readdirSync as readdirSync21, readFileSync as readFileSync34, statSync as statSync13 } from "fs";
+import { join as join47 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
   "plan",
@@ -11667,18 +11908,18 @@ function stripComments2(source) {
   return source.split("\n").map((line) => line.replace(/(^|\s)#.*$/, "$1")).join("\n");
 }
 function vendoredPluginServiceDirs(repoRoot) {
-  const servicesDir = join46(repoRoot, "services");
+  const servicesDir = join47(repoRoot, "services");
   const result = /* @__PURE__ */ new Set();
   let entries;
   try {
-    entries = readdirSync20(servicesDir);
+    entries = readdirSync21(servicesDir);
   } catch {
     return result;
   }
   for (const entry of entries) {
-    const full = join46(servicesDir, entry);
-    if (!existsSync41(full) || !statSync13(full).isDirectory()) continue;
-    if (existsSync41(join46(full, "biffo.plugin.json"))) {
+    const full = join47(servicesDir, entry);
+    if (!existsSync42(full) || !statSync13(full).isDirectory()) continue;
+    if (existsSync42(join47(full, "biffo.plugin.json"))) {
       result.add(entry);
     }
   }
@@ -11690,7 +11931,7 @@ function findWorkflowFiles(repoRoot) {
   const walk2 = (dir, relative11) => {
     let entries;
     try {
-      entries = readdirSync20(dir);
+      entries = readdirSync21(dir);
     } catch {
       return;
     }
@@ -11699,7 +11940,7 @@ function findWorkflowFiles(repoRoot) {
       if (entry === ".github" && relative11.startsWith("services/") && vendoredPluginDirs.has(relative11.slice("services/".length))) {
         continue;
       }
-      const full = join46(dir, entry);
+      const full = join47(dir, entry);
       const rel = relative11 ? `${relative11}/${entry}` : entry;
       if (statSync13(full).isDirectory()) {
         walk2(full, rel);
@@ -11743,7 +11984,7 @@ function checkWorkflowSource(file, rawSource) {
 }
 function checkTerraformInput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource(file, readFileSync33(join46(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource(file, readFileSync34(join47(repoRoot, file), "utf8"))
   );
 }
 
@@ -11801,13 +12042,13 @@ function checkWorkflowSource2(file, rawSource) {
 }
 function checkLambdaOutput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource2(file, readFileSync34(join47(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource2(file, readFileSync35(join48(repoRoot, file), "utf8"))
   );
 }
 
 // src/scripts/check-lambda-output.ts
 async function runLambdaOutputCheck() {
-  const root = (await execa14("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -11829,9 +12070,9 @@ async function runLambdaOutputCheck() {
 }
 
 // src/scripts/check-pipe-trap.ts
-import { readFileSync as readFileSync35, readdirSync as readdirSync21 } from "fs";
-import { join as join48, relative as relative9 } from "path";
-import { execa as execa15 } from "execa";
+import { readFileSync as readFileSync36, readdirSync as readdirSync22 } from "fs";
+import { join as join49, relative as relative9 } from "path";
+import { execa as execa17 } from "execa";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -11927,23 +12168,23 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join48(root, dir);
+    const full = join49(root, dir);
     let entries;
     try {
-      entries = readdirSync21(full, { withFileTypes: true });
+      entries = readdirSync22(full, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join48(full, entry.name));
+      out.push(join49(full, entry.name));
     }
   }
   return out;
 }
 async function runPipeTrapCheck() {
-  const root = (await execa15("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = shellFiles(root);
   console.log(`audited ${files.length} shell file(s) under scripts/ and .githooks/ under ${root}`);
   if (files.length === 0) {
@@ -11953,7 +12194,7 @@ async function runPipeTrapCheck() {
     process.exit(1);
   }
   const findings = files.flatMap(
-    (file) => findPipeTraps(readFileSync35(file, "utf8")).map(
+    (file) => findPipeTraps(readFileSync36(file, "utf8")).map(
       (t) => `${relative9(root, file)}:${t.line}  ${t.text}
     ${t.reason}`
     )
@@ -11970,11 +12211,11 @@ async function runPipeTrapCheck() {
 }
 
 // src/scripts/check-plugin-allowlist-convention.ts
-import { execa as execa16 } from "execa";
+import { execa as execa18 } from "execa";
 
 // src/lib/plugin-allowlist-convention.ts
-import { readFileSync as readFileSync36 } from "fs";
-import { join as join49 } from "path";
+import { readFileSync as readFileSync37 } from "fs";
+import { join as join50 } from "path";
 var COMPUTE_MAIN_TF = "modules/cloud/aws/compute/main.tf";
 var PLUGIN_TEMPLATE_MAIN_TF = "modules/plugins/_template/main.tf";
 var ALLOWLIST_MAIN_TF = "modules/cloud/aws/plugin-allowlist/main.tf";
@@ -11985,7 +12226,7 @@ var PLUGIN = "<plugin>";
 var ACCOUNT = "<account>";
 function read(repoRoot, relative11) {
   try {
-    return readFileSync36(join49(repoRoot, relative11), "utf8");
+    return readFileSync37(join50(repoRoot, relative11), "utf8");
   } catch {
     throw new Error(`plugin-allowlist drift guard: cannot read ${relative11}`);
   }
@@ -12081,7 +12322,7 @@ Plugins would be rejected by require_service_principal (ADR-0009). Fix the glob,
 
 // src/scripts/check-plugin-allowlist-convention.ts
 async function runPluginAllowlistConventionCheck() {
-  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let violations;
   try {
     violations = checkAllowlistConvention(root);
@@ -12106,34 +12347,34 @@ async function runPluginAllowlistConventionCheck() {
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync43 } from "fs";
-import { join as join51 } from "path";
-import { execa as execa17 } from "execa";
+import { existsSync as existsSync44 } from "fs";
+import { join as join52 } from "path";
+import { execa as execa19 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync42, readdirSync as readdirSync22, statSync as statSync14 } from "fs";
-import { join as join50 } from "path";
+import { existsSync as existsSync43, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
+import { join as join51 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync42(dir)) return [];
-  return readdirSync22(dir).filter((entry) => {
+  if (!existsSync43(dir)) return [];
+  return readdirSync23(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync14(join50(dir, entry)).isDirectory();
+      return statSync14(join51(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync42(join50(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync43(join51(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join50(pluginDir2, "tests");
-  if (!existsSync42(testsDir)) return [];
-  if (existsSync42(join50(testsDir, "__init__.py"))) return [];
-  return readdirSync22(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
+  const testsDir = join51(pluginDir2, "tests");
+  if (!existsSync43(testsDir)) return [];
+  if (existsSync43(join51(testsDir, "__init__.py"))) return [];
+  return readdirSync23(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
   const plugins = (pluginDirs ?? subdirectories(servicesDir)).filter((name) => !name.startsWith("_")).filter((name) => name !== "api").sort();
@@ -12141,7 +12382,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join50(servicesDir, plugin))) {
+      for (const name of namesOf(join51(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -12178,9 +12419,9 @@ function formatCollisions(collisions) {
 
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
-  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join51(root, "services");
-  if (!existsSync43(servicesDir)) {
+  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const servicesDir = join52(root, "services");
+  if (!existsSync44(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -12197,11 +12438,11 @@ async function runPluginCollisionCheck() {
 }
 
 // src/scripts/check-plugin-terraform.ts
-import { execa as execa18 } from "execa";
+import { execa as execa20 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync44, readFileSync as readFileSync37, readdirSync as readdirSync23 } from "fs";
-import { dirname as dirname10, join as join52, relative as relative10, sep as sep4 } from "path";
+import { existsSync as existsSync45, readFileSync as readFileSync38, readdirSync as readdirSync24 } from "fs";
+import { dirname as dirname10, join as join53, relative as relative10, sep as sep4 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -12209,16 +12450,16 @@ function findPluginManifests(root) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync23(dir, { withFileTypes: true });
+      entries = readdirSync24(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name)) continue;
-        walk2(join52(dir, entry.name));
+        walk2(join53(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative10(root, join52(dir, entry.name)).split(sep4).join("/"));
+        found.push(relative10(root, join53(dir, entry.name)).split(sep4).join("/"));
       }
     }
   };
@@ -12228,7 +12469,7 @@ function findPluginManifests(root) {
 function readSubscriptions(absManifestPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync37(absManifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync38(absManifestPath, "utf8"));
   } catch {
     return null;
   }
@@ -12243,14 +12484,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync44(join52(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync45(join53(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join52(root, manifest);
+    const absManifest = join53(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync44(join52(pluginDir2, "terraform"))) continue;
+    if (existsSync45(join53(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative10(root, pluginDir2).split(sep4).join("/");
     violations.push({
       manifest,
@@ -12270,7 +12511,7 @@ function formatViolations(violations) {
 
 // src/scripts/check-plugin-terraform.ts
 async function runPluginTerraformCheck() {
-  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const violations = checkPluginTerraform(root);
   if (violations.length > 0) {
     console.error("\u2717 plugin Terraform guard: event subscriptions with no infrastructure\n");
@@ -12281,13 +12522,13 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync46 } from "fs";
-import { join as join54 } from "path";
-import { execa as execa19 } from "execa";
+import { existsSync as existsSync47 } from "fs";
+import { join as join55 } from "path";
+import { execa as execa21 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync45, readFileSync as readFileSync38, readdirSync as readdirSync24, statSync as statSync15 } from "fs";
-import { join as join53 } from "path";
+import { existsSync as existsSync46, readFileSync as readFileSync39, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
+import { join as join54 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -12698,13 +12939,13 @@ var OPENROUTER_MODEL_IDS = [
 function listDirs(root) {
   let entries;
   try {
-    entries = readdirSync24(root);
+    entries = readdirSync25(root);
   } catch {
     return [];
   }
   return entries.filter((e) => {
     try {
-      return statSync15(join53(root, e)).isDirectory();
+      return statSync15(join54(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -12715,12 +12956,12 @@ function walkFiles2(root, accept, skipDir) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = readdirSync24(dir);
+      entries = readdirSync25(dir);
     } catch {
       return;
     }
     for (const entry of entries) {
-      const p = join53(dir, entry);
+      const p = join54(dir, entry);
       let st;
       try {
         st = statSync15(p);
@@ -12746,14 +12987,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join53(pluginDir2, "terraform");
+  const tfDir = join54(pluginDir2, "terraform");
   let entries;
   try {
-    entries = readdirSync24(tfDir);
+    entries = readdirSync25(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join53(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join54(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -13005,8 +13246,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join53("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join53(
+var CONFIG_PY_PATH = join54("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join54(
   "services",
   "api",
   "src",
@@ -13018,10 +13259,10 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join53(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join53(repoRoot, ORCHESTRATION_SCHEMA_PATH);
-  const configMissing = !existsSync45(configPath);
-  const orchestrationSchemaMissing = !existsSync45(orchestrationPath);
+  const configPath = join54(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join54(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configMissing = !existsSync46(configPath);
+  const orchestrationSchemaMissing = !existsSync46(orchestrationPath);
   const knownSet = new Set(knownModelIds);
   const snapshotEmpty = knownModelIds.length === 0;
   const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
@@ -13039,13 +13280,13 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   };
   let settingsBlind = false;
   if (!configMissing) {
-    const settingsFields = extractSettingsModelFields(readFileSync38(configPath, "utf8"));
+    const settingsFields = extractSettingsModelFields(readFileSync39(configPath, "utf8"));
     if (settingsFields.length === 0) settingsBlind = true;
     for (const { field, value } of settingsFields) record(`${CONFIG_PY_PATH}#${field}`, value);
   }
   let curatedFieldsBlind = false;
   if (!orchestrationSchemaMissing) {
-    const curated = extractCuratedModelFields(readFileSync38(orchestrationPath, "utf8"));
+    const curated = extractCuratedModelFields(readFileSync39(orchestrationPath, "utf8"));
     if (curated.rawFieldCount > 0 && curated.fields.every((f) => f.defaultValue === null && f.optionValues.length === 0)) {
       curatedFieldsBlind = true;
     }
@@ -13092,7 +13333,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync15(join53(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync15(join54(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -13105,8 +13346,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join53(pluginsRoot, name);
-    const manifestText = readFileSync38(join53(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join54(pluginsRoot, name);
+    const manifestText = readFileSync39(join54(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -13124,13 +13365,13 @@ function auditPluginToolSupply(pluginsRoot) {
     totalDeclaredTools += manifest.tools.length;
     const pySources = pluginPythonFiles(pluginDir2).map((f) => ({
       file: f,
-      text: readFileSync38(f, "utf8")
+      text: readFileSync39(f, "utf8")
     }));
     const resolver = buildSymbolResolver(pySources);
     const registry = extractToolRegistryEntries(pySources, resolver);
     if (registry.rawToolDefinitionCount > 0 && registry.entries.length === 0) registryBlind = true;
     const tfFiles = pluginTerraformFiles(pluginDir2);
-    const tfText = tfFiles.map((f) => readFileSync38(f, "utf8")).join("\n");
+    const tfText = tfFiles.map((f) => readFileSync39(f, "utf8")).join("\n");
     const terraform = extractTerraformEnvKeys(tfText);
     if (terraform.rawMarkerCount > 0 && terraform.resolvedBlockCount === 0) terraformBlind = true;
     for (const toolName of manifest.tools) {
@@ -13204,7 +13445,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join53(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join54(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -13235,10 +13476,10 @@ function auditPluginToolSupply(pluginsRoot) {
 
 // src/scripts/check-plugin-tool-supply.ts
 async function runPluginToolSupplyCheck() {
-  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join54(root, "services", "_plugins");
-  if (!existsSync46(pluginsRoot)) {
+  const pluginsRoot = join55(root, "services", "_plugins");
+  if (!existsSync47(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
     const report = auditPluginToolSupply(pluginsRoot);
@@ -13268,8 +13509,8 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join54(root, "services", "api");
-  if (!existsSync46(servicesApiRoot)) {
+  const servicesApiRoot = join55(root, "services", "api");
+  if (!existsSync47(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
     const modelReport = auditDeclaredModelIds(root);
@@ -13315,7 +13556,7 @@ async function runPluginToolSupplyCheck() {
 }
 
 // src/scripts/check-release-subject.ts
-import { execa as execa20 } from "execa";
+import { execa as execa22 } from "execa";
 
 // src/lib/release-version.ts
 var MINOR_TYPES = /* @__PURE__ */ new Set(["feat"]);
@@ -13352,7 +13593,7 @@ async function fetchPrTitleViaGh({
   PR_NUMBER,
   GH_REPO
 }) {
-  const { stdout } = await execa20(
+  const { stdout } = await execa22(
     "gh",
     ["pr", "view", PR_NUMBER, "--repo", GH_REPO, "--json", "title", "--jq", ".title"],
     { env: { ...process.env, GH_TOKEN } }
@@ -13388,7 +13629,7 @@ async function resolveReleaseSubject({
       );
     }
   }
-  return (await execa20("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
+  return (await execa22("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
 }
 async function runReleaseSubjectCheck(argv) {
   const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
@@ -13396,9 +13637,9 @@ async function runReleaseSubjectCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  await execa20("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa20("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
+  const root = (await execa22("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  await execa22("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa22("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
     cwd: root
   });
   const changedFiles = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -13446,13 +13687,13 @@ async function runReleaseSubjectCheck(argv) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync47, readdirSync as readdirSync26 } from "fs";
-import { join as join56 } from "path";
-import { execa as execa21 } from "execa";
+import { existsSync as existsSync48, readdirSync as readdirSync27 } from "fs";
+import { join as join57 } from "path";
+import { execa as execa23 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
-import { readFileSync as readFileSync39, readdirSync as readdirSync25, statSync as statSync16 } from "fs";
-import { join as join55 } from "path";
+import { readFileSync as readFileSync40, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
+import { join as join56 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -13510,13 +13751,13 @@ function walk(dir, base = dir) {
   const out = [];
   let entries;
   try {
-    entries = readdirSync25(dir);
+    entries = readdirSync26(dir);
   } catch {
     return out;
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join55(dir, entry);
+    const abs = join56(dir, entry);
     let isDir;
     try {
       isDir = statSync16(abs).isDirectory();
@@ -13538,7 +13779,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync39(join55(skeletonRoot, rel), "utf8");
+        contents = readFileSync40(join56(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -13567,23 +13808,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join56(root, "_skeletons");
+  const skeletonsDir = join57(root, "_skeletons");
   let entries;
   try {
-    entries = readdirSync26(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    entries = readdirSync27(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync47(join56(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync48(join57(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
-  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa23("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join56(root, "_skeletons", name);
+    const skeletonRoot = join57(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync47(join56(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync48(join57(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -13597,7 +13838,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join56(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join57(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -13609,9 +13850,9 @@ async function runSkeletonDriftCheck() {
 }
 
 // src/scripts/check-terraform-input.ts
-import { execa as execa22 } from "execa";
+import { execa as execa24 } from "execa";
 async function runTerraformInputCheck() {
-  const root = (await execa22("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa24("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -13701,6 +13942,11 @@ checkCommand.command("codeql-suppression").description(
 ).action(async () => {
   await runCodeqlSuppressionCheck();
 });
+checkCommand.command("claim-invocation").description(
+  "Refuse a distributed AGENTS.md that documents a different claim invocation from the others, or an untokened `claim <issue>` (#1562) \u2014 `--as` reached one of three copies, so it was documented in zero satellites while working perfectly"
+).action(async () => {
+  await runClaimInvocationCheck();
+});
 checkCommand.command("skeleton-drift").description(
   "Refuse a fix this repo made for itself that never reached _skeletons/ \u2014 a hardcoded runner, the paid gitleaks action, an unhardened dependency audit, a hard-coded app title"
 ).action(async () => {
@@ -13735,8 +13981,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync48, readFileSync as readFileSync40 } from "fs";
-import { join as join57, resolve as resolve20 } from "path";
+import { existsSync as existsSync49, readFileSync as readFileSync41 } from "fs";
+import { join as join58, resolve as resolve20 } from "path";
 import chalk21 from "chalk";
 import { Command as Command25 } from "commander";
 
@@ -13915,10 +14161,10 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join57(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync48(path)) return null;
+  const path = join58(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync49(path)) return null;
   try {
-    return extractVersionField(readFileSync40(path, "utf8"));
+    return extractVersionField(readFileSync41(path, "utf8"));
   } catch {
     return null;
   }
@@ -13938,10 +14184,10 @@ function extractVersionField(contents) {
   return match?.[1] ?? null;
 }
 function readFossil(cwd) {
-  const path = join57(cwd, CORE_VERSION_FILE);
-  if (!existsSync48(path)) return null;
+  const path = join58(cwd, CORE_VERSION_FILE);
+  if (!existsSync49(path)) return null;
   try {
-    const value = readFileSync40(path, "utf8").trim();
+    const value = readFileSync41(path, "utf8").trim();
     return value === "" ? null : value;
   } catch {
     return null;
@@ -14390,13 +14636,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command27 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync49 } from "fs";
-import { dirname as dirname11, join as join58 } from "path";
+import { existsSync as existsSync50 } from "fs";
+import { dirname as dirname11, join as join59 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join58(dir, relativePath);
-    if (existsSync49(candidate)) return candidate;
+    const candidate = join59(dir, relativePath);
+    if (existsSync50(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;