@biffo/cli 0.295.2 → 0.296.1

package/dist/index.js

@@ -8647,8 +8647,30 @@ function printEntry(entry) {
     const summary = entry.ui_components.map((c) => `${c.label} (${c.type})`).join(", ");
     console.log(`  UI components:          ${summary}`);
   }
+  printScopeSeamEntitlement(entry.name);
   console.log("");
 }
+function printScopeSeamEntitlement(name) {
+  console.log("");
+  console.log(chalk14.bold("  Scope-seam entitlement"));
+  console.log("    Declared by the INSTANCE, never by this plugin (ADR-0029, #1653).");
+  console.log("    A plugin manifest cannot grant it \u2014 biffo.plugin.json is not consulted.");
+  console.log("    To let this plugin call GET /internal/scopes or POST /internal/scope-check,");
+  console.log("    the instance operator adds it beside their own scope authorizer:");
+  console.log("");
+  console.log(chalk14.dim("      register_scope_authorizer("));
+  console.log(chalk14.dim("          authorizer,"));
+  console.log(
+    chalk14.dim(`          entitlements={"system:${name}": frozenset({"<permission_code>"})},`)
+  );
+  console.log(chalk14.dim("      )"));
+  console.log("");
+  console.log(
+    chalk14.dim(
+      "    <permission_code> is one of the INSTANCE's own codes, so ask the operator which\n    one covers this plugin's surface. This command cannot report what an instance\n    has actually entitled: the map is evaluated in the instance's API at import\n    time, and re-deriving it here would be a second authority that can drift from\n    the one enforcing the 403."
+    )
+  );
+}
 
 // src/commands/plugin-install.ts
 import { cpSync as cpSync5, existsSync as existsSync31, mkdirSync as mkdirSync11, readFileSync as readFileSync23, statSync as statSync7 } from "fs";
@@ -11678,8 +11700,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa14("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync45, existsSync: existsSync53 } = await import("fs");
-      if (existsSync53(messageFile)) commitMessage = readFileSync45(messageFile, "utf8");
+      const { readFileSync: readFileSync45, existsSync: existsSync54 } = await import("fs");
+      if (existsSync54(messageFile)) commitMessage = readFileSync45(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -11993,16 +12015,56 @@ async function runEventBridgeLogPermissionCheck() {
   console.log(`\u2713 EventBridge log permission guard: ${report.summary}`);
 }
 
-// src/scripts/check-lambda-output.ts
+// src/scripts/check-instance-adoption.ts
+import { existsSync as existsSync43 } from "fs";
+import { join as join48 } from "path";
 import { execa as execa16 } from "execa";
+async function runInstanceAdoptionCheck(opts = {}) {
+  if (!opts.instanceDir) {
+    console.error(
+      "\u2717 instance-adoption guard: --instance-dir is required \u2014 the real instance tree to check adoption against. There is no self-check default: this repo IS the template, it has no instance tree of its own to examine, and a fabricated one would prove nothing about a real gap."
+    );
+    process.exit(2);
+  }
+  if (!existsSync43(opts.instanceDir)) {
+    console.error(
+      `\u2717 instance-adoption guard: --instance-dir ${opts.instanceDir} does not exist \u2014 cannot tell whether it is adopted, and that is not the same as a clean pass.`
+    );
+    process.exit(2);
+  }
+  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const theirsDir = opts.theirsDir ?? root;
+  const instanceLabel = opts.instance ?? join48(opts.instanceDir).split("/").filter(Boolean).pop();
+  const report = checkInstanceAdoption(theirsDir, opts.instanceDir);
+  console.log(
+    `examined ${report.examinedInstances} instance (${instanceLabel}) against ${report.registeredPairs} registered pair(s), ${report.applicablePairs} applicable to this instance, against template tree ${theirsDir}`
+  );
+  const unadopted = report.findings.filter((f) => f.status === "unadopted");
+  if (unadopted.length === 0) {
+    console.log(`\u2713 instance-adoption guard (${instanceLabel}): no adoption gaps`);
+    return;
+  }
+  console.error(
+    `\u2717 instance-adoption guard (${instanceLabel}): ${unadopted.length} adoption gap(s) \u2014 shipped but not consumed (#1538/#1570):`
+  );
+  for (const f of unadopted) {
+    console.error(`  ${f.pair.id} \u2014 ${f.pair.userFile} does not consume ${f.pair.templateFile}`);
+    console.error(`    ${f.pair.remedy}`);
+  }
+  console.error("\nSee biffo-template#1538/#1570/#1609.");
+  process.exit(1);
+}
+
+// src/scripts/check-lambda-output.ts
+import { execa as execa17 } from "execa";
 
 // src/lib/lambda-output-guard.ts
 import { readFileSync as readFileSync36 } from "fs";
-import { join as join49 } from "path";
+import { join as join50 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { existsSync as existsSync43, readdirSync as readdirSync21, readFileSync as readFileSync35, statSync as statSync13 } from "fs";
-import { join as join48 } from "path";
+import { existsSync as existsSync44, readdirSync as readdirSync21, readFileSync as readFileSync35, statSync as statSync13 } from "fs";
+import { join as join49 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
   "plan",
@@ -12016,7 +12078,7 @@ function stripComments2(source) {
   return source.split("\n").map((line) => line.replace(/(^|\s)#.*$/, "$1")).join("\n");
 }
 function vendoredPluginServiceDirs(repoRoot) {
-  const servicesDir = join48(repoRoot, "services");
+  const servicesDir = join49(repoRoot, "services");
   const result = /* @__PURE__ */ new Set();
   let entries;
   try {
@@ -12025,9 +12087,9 @@ function vendoredPluginServiceDirs(repoRoot) {
     return result;
   }
   for (const entry of entries) {
-    const full = join48(servicesDir, entry);
-    if (!existsSync43(full) || !statSync13(full).isDirectory()) continue;
-    if (existsSync43(join48(full, "biffo.plugin.json"))) {
+    const full = join49(servicesDir, entry);
+    if (!existsSync44(full) || !statSync13(full).isDirectory()) continue;
+    if (existsSync44(join49(full, "biffo.plugin.json"))) {
       result.add(entry);
     }
   }
@@ -12048,7 +12110,7 @@ function findWorkflowFiles(repoRoot) {
       if (entry === ".github" && relative11.startsWith("services/") && vendoredPluginDirs.has(relative11.slice("services/".length))) {
         continue;
       }
-      const full = join48(dir, entry);
+      const full = join49(dir, entry);
       const rel = relative11 ? `${relative11}/${entry}` : entry;
       if (statSync13(full).isDirectory()) {
         walk2(full, rel);
@@ -12092,7 +12154,7 @@ function checkWorkflowSource(file, rawSource) {
 }
 function checkTerraformInput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource(file, readFileSync35(join48(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource(file, readFileSync35(join49(repoRoot, file), "utf8"))
   );
 }
 
@@ -12150,13 +12212,13 @@ function checkWorkflowSource2(file, rawSource) {
 }
 function checkLambdaOutput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource2(file, readFileSync36(join49(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource2(file, readFileSync36(join50(repoRoot, file), "utf8"))
   );
 }
 
 // src/scripts/check-lambda-output.ts
 async function runLambdaOutputCheck() {
-  const root = (await execa16("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -12178,9 +12240,9 @@ async function runLambdaOutputCheck() {
 }
 
 // src/scripts/check-migration-body-change.ts
-import { execa as execa17 } from "execa";
-import { existsSync as existsSync44 } from "fs";
-import { join as join50 } from "path";
+import { execa as execa18 } from "execa";
+import { existsSync as existsSync45 } from "fs";
+import { join as join51 } from "path";
 
 // src/lib/migration-body-change-guard.ts
 function checkMigrationBodyChangeMarkers(diffs) {
@@ -12235,18 +12297,18 @@ var GREEN = "\x1B[32m";
 var YELLOW2 = "\x1B[33m";
 var OFF2 = "\x1B[0m";
 async function showAt(ref, path, cwd) {
-  const result = await execa17("git", ["show", `${ref}:${path}`], { cwd, reject: false });
+  const result = await execa18("git", ["show", `${ref}:${path}`], { cwd, reject: false });
   return result.exitCode === 0 ? result.stdout : null;
 }
 async function runMigrationBodyChangeCheck(argv) {
-  const root = (await execa17("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   if (isInstanceRepo(root)) {
     console.log(
       `\u2713 migration body-change guard: skipped \u2014 this is an instance (${INSTANCE_CORE_FILE} present). Its migrations/versions/ is a carried, user-owned copy, not the template source this guard protects.`
     );
     return;
   }
-  if (!existsSync44(join50(root, MIGRATIONS_VERSIONS_DIR))) {
+  if (!existsSync45(join51(root, MIGRATIONS_VERSIONS_DIR))) {
     console.log(`\u2713 migration body-change guard: no ${MIGRATIONS_VERSIONS_DIR} in this repo.`);
     return;
   }
@@ -12255,8 +12317,8 @@ async function runMigrationBodyChangeCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  await execa17("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa17(
+  await execa18("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa18(
     "git",
     [
       "diff",
@@ -12349,8 +12411,8 @@ ${BOLD2}What to do${OFF2}
 
 // src/scripts/check-pipe-trap.ts
 import { readFileSync as readFileSync37, readdirSync as readdirSync22 } from "fs";
-import { join as join51, relative as relative9 } from "path";
-import { execa as execa18 } from "execa";
+import { join as join52, relative as relative9 } from "path";
+import { execa as execa19 } from "execa";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -12446,7 +12508,7 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join51(root, dir);
+    const full = join52(root, dir);
     let entries;
     try {
       entries = readdirSync22(full, { withFileTypes: true });
@@ -12456,13 +12518,13 @@ function shellFiles(root) {
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join51(full, entry.name));
+      out.push(join52(full, entry.name));
     }
   }
   return out;
 }
 async function runPipeTrapCheck() {
-  const root = (await execa18("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = shellFiles(root);
   console.log(`audited ${files.length} shell file(s) under scripts/ and .githooks/ under ${root}`);
   if (files.length === 0) {
@@ -12489,11 +12551,11 @@ async function runPipeTrapCheck() {
 }
 
 // src/scripts/check-plugin-allowlist-convention.ts
-import { execa as execa19 } from "execa";
+import { execa as execa20 } from "execa";
 
 // src/lib/plugin-allowlist-convention.ts
 import { readFileSync as readFileSync38 } from "fs";
-import { join as join52 } from "path";
+import { join as join53 } from "path";
 var COMPUTE_MAIN_TF = "modules/cloud/aws/compute/main.tf";
 var PLUGIN_TEMPLATE_MAIN_TF = "modules/plugins/_template/main.tf";
 var ALLOWLIST_MAIN_TF = "modules/cloud/aws/plugin-allowlist/main.tf";
@@ -12504,7 +12566,7 @@ var PLUGIN = "<plugin>";
 var ACCOUNT = "<account>";
 function read(repoRoot, relative11) {
   try {
-    return readFileSync38(join52(repoRoot, relative11), "utf8");
+    return readFileSync38(join53(repoRoot, relative11), "utf8");
   } catch {
     throw new Error(`plugin-allowlist drift guard: cannot read ${relative11}`);
   }
@@ -12600,7 +12662,7 @@ Plugins would be rejected by require_service_principal (ADR-0009). Fix the glob,
 
 // src/scripts/check-plugin-allowlist-convention.ts
 async function runPluginAllowlistConventionCheck() {
-  const root = (await execa19("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let violations;
   try {
     violations = checkAllowlistConvention(root);
@@ -12625,33 +12687,33 @@ async function runPluginAllowlistConventionCheck() {
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync46 } from "fs";
-import { join as join54 } from "path";
-import { execa as execa20 } from "execa";
+import { existsSync as existsSync47 } from "fs";
+import { join as join55 } from "path";
+import { execa as execa21 } from "execa";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync45, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
-import { join as join53 } from "path";
+import { existsSync as existsSync46, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
+import { join as join54 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync45(dir)) return [];
+  if (!existsSync46(dir)) return [];
   return readdirSync23(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync14(join53(dir, entry)).isDirectory();
+      return statSync14(join54(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync45(join53(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync46(join54(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join53(pluginDir2, "tests");
-  if (!existsSync45(testsDir)) return [];
-  if (existsSync45(join53(testsDir, "__init__.py"))) return [];
+  const testsDir = join54(pluginDir2, "tests");
+  if (!existsSync46(testsDir)) return [];
+  if (existsSync46(join54(testsDir, "__init__.py"))) return [];
   return readdirSync23(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
@@ -12660,7 +12722,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join53(servicesDir, plugin))) {
+      for (const name of namesOf(join54(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -12697,9 +12759,9 @@ function formatCollisions(collisions) {
 
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
-  const root = (await execa20("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join54(root, "services");
-  if (!existsSync46(servicesDir)) {
+  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const servicesDir = join55(root, "services");
+  if (!existsSync47(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -12716,11 +12778,11 @@ async function runPluginCollisionCheck() {
 }
 
 // src/scripts/check-plugin-terraform.ts
-import { execa as execa21 } from "execa";
+import { execa as execa22 } from "execa";
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync47, readFileSync as readFileSync39, readdirSync as readdirSync24 } from "fs";
-import { dirname as dirname10, join as join55, relative as relative10, sep as sep4 } from "path";
+import { existsSync as existsSync48, readFileSync as readFileSync39, readdirSync as readdirSync24 } from "fs";
+import { dirname as dirname10, join as join56, relative as relative10, sep as sep4 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -12735,9 +12797,9 @@ function findPluginManifests(root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name)) continue;
-        walk2(join55(dir, entry.name));
+        walk2(join56(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative10(root, join55(dir, entry.name)).split(sep4).join("/"));
+        found.push(relative10(root, join56(dir, entry.name)).split(sep4).join("/"));
       }
     }
   };
@@ -12762,14 +12824,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync47(join55(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync48(join56(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join55(root, manifest);
+    const absManifest = join56(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync47(join55(pluginDir2, "terraform"))) continue;
+    if (existsSync48(join56(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative10(root, pluginDir2).split(sep4).join("/");
     violations.push({
       manifest,
@@ -12789,7 +12851,7 @@ function formatViolations(violations) {
 
 // src/scripts/check-plugin-terraform.ts
 async function runPluginTerraformCheck() {
-  const root = (await execa21("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa22("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const violations = checkPluginTerraform(root);
   if (violations.length > 0) {
     console.error("\u2717 plugin Terraform guard: event subscriptions with no infrastructure\n");
@@ -12800,13 +12862,13 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync49 } from "fs";
-import { join as join57 } from "path";
-import { execa as execa22 } from "execa";
+import { existsSync as existsSync50 } from "fs";
+import { join as join58 } from "path";
+import { execa as execa23 } from "execa";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync48, readFileSync as readFileSync40, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
-import { join as join56 } from "path";
+import { existsSync as existsSync49, readFileSync as readFileSync40, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
+import { join as join57 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -13223,7 +13285,7 @@ function listDirs(root) {
   }
   return entries.filter((e) => {
     try {
-      return statSync15(join56(root, e)).isDirectory();
+      return statSync15(join57(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -13239,7 +13301,7 @@ function walkFiles2(root, accept, skipDir) {
       return;
     }
     for (const entry of entries) {
-      const p = join56(dir, entry);
+      const p = join57(dir, entry);
       let st;
       try {
         st = statSync15(p);
@@ -13265,14 +13327,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join56(pluginDir2, "terraform");
+  const tfDir = join57(pluginDir2, "terraform");
   let entries;
   try {
     entries = readdirSync25(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join56(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join57(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -13524,8 +13586,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join56("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join56(
+var CONFIG_PY_PATH = join57("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join57(
   "services",
   "api",
   "src",
@@ -13537,10 +13599,10 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join56(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join56(repoRoot, ORCHESTRATION_SCHEMA_PATH);
-  const configMissing = !existsSync48(configPath);
-  const orchestrationSchemaMissing = !existsSync48(orchestrationPath);
+  const configPath = join57(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join57(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configMissing = !existsSync49(configPath);
+  const orchestrationSchemaMissing = !existsSync49(orchestrationPath);
   const knownSet = new Set(knownModelIds);
   const snapshotEmpty = knownModelIds.length === 0;
   const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
@@ -13611,7 +13673,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync15(join56(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync15(join57(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -13624,8 +13686,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join56(pluginsRoot, name);
-    const manifestText = readFileSync40(join56(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join57(pluginsRoot, name);
+    const manifestText = readFileSync40(join57(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -13723,7 +13785,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join56(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join57(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -13754,10 +13816,10 @@ function auditPluginToolSupply(pluginsRoot) {
 
 // src/scripts/check-plugin-tool-supply.ts
 async function runPluginToolSupplyCheck() {
-  const root = (await execa22("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa23("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join57(root, "services", "_plugins");
-  if (!existsSync49(pluginsRoot)) {
+  const pluginsRoot = join58(root, "services", "_plugins");
+  if (!existsSync50(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
     const report = auditPluginToolSupply(pluginsRoot);
@@ -13787,8 +13849,8 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join57(root, "services", "api");
-  if (!existsSync49(servicesApiRoot)) {
+  const servicesApiRoot = join58(root, "services", "api");
+  if (!existsSync50(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
     const modelReport = auditDeclaredModelIds(root);
@@ -13834,7 +13896,7 @@ async function runPluginToolSupplyCheck() {
 }
 
 // src/scripts/check-release-subject.ts
-import { execa as execa23 } from "execa";
+import { execa as execa24 } from "execa";
 
 // src/lib/release-version.ts
 var MINOR_TYPES = /* @__PURE__ */ new Set(["feat"]);
@@ -13871,7 +13933,7 @@ async function fetchPrTitleViaGh({
   PR_NUMBER,
   GH_REPO
 }) {
-  const { stdout } = await execa23(
+  const { stdout } = await execa24(
     "gh",
     ["pr", "view", PR_NUMBER, "--repo", GH_REPO, "--json", "title", "--jq", ".title"],
     { env: { ...process.env, GH_TOKEN } }
@@ -13907,7 +13969,7 @@ async function resolveReleaseSubject({
       );
     }
   }
-  return (await execa23("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
+  return (await execa24("git", ["log", "-1", "--format=%s"], { cwd })).stdout.trim();
 }
 async function runReleaseSubjectCheck(argv) {
   const base = process.env["GITHUB_BASE_REF"] ?? argv[0];
@@ -13915,9 +13977,9 @@ async function runReleaseSubjectCheck(argv) {
     console.error("No base ref: set GITHUB_BASE_REF or pass a base branch as the first argument.");
     process.exit(2);
   }
-  const root = (await execa23("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  await execa23("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
-  const { stdout } = await execa23("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
+  const root = (await execa24("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  await execa24("git", ["fetch", "--quiet", "origin", base], { cwd: root, reject: false });
+  const { stdout } = await execa24("git", ["diff", "--name-only", `origin/${base}...HEAD`], {
     cwd: root
   });
   const changedFiles = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -14168,13 +14230,13 @@ async function runSharedFileReductionCheck(args) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync50, readdirSync as readdirSync27 } from "fs";
-import { join as join59 } from "path";
-import { execa as execa24 } from "execa";
+import { existsSync as existsSync51, readdirSync as readdirSync27 } from "fs";
+import { join as join60 } from "path";
+import { execa as execa25 } from "execa";
 
 // src/lib/skeleton-drift-guard.ts
 import { readFileSync as readFileSync43, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
-import { join as join58 } from "path";
+import { join as join59 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -14238,7 +14300,7 @@ function walk(dir, base = dir) {
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join58(dir, entry);
+    const abs = join59(dir, entry);
     let isDir;
     try {
       isDir = statSync16(abs).isDirectory();
@@ -14260,7 +14322,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync43(join58(skeletonRoot, rel), "utf8");
+        contents = readFileSync43(join59(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -14289,23 +14351,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join59(root, "_skeletons");
+  const skeletonsDir = join60(root, "_skeletons");
   let entries;
   try {
     entries = readdirSync27(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync50(join59(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync51(join60(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
-  const root = (await execa24("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa25("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join59(root, "_skeletons", name);
+    const skeletonRoot = join60(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync50(join59(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync51(join60(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -14319,7 +14381,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join59(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join60(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -14331,9 +14393,9 @@ async function runSkeletonDriftCheck() {
 }
 
 // src/scripts/check-terraform-input.ts
-import { execa as execa25 } from "execa";
+import { execa as execa26 } from "execa";
 async function runTerraformInputCheck() {
-  const root = (await execa25("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  const root = (await execa26("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const files = findWorkflowFiles(root);
   console.log(`audited ${files.length} workflow file(s) under ${root}`);
   if (files.length === 0) {
@@ -14356,7 +14418,7 @@ async function runTerraformInputCheck() {
 
 // src/commands/check.ts
 var checkCommand = new Command24("check").description(
-  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention, migration-body-change) run in CI and git hooks, plus out-of-band audits (branch protection, plugin-staleness)"
+  "Repo guards (ownership, release subject, plugin terraform, plugin collisions, eventbridge-log-permissions, plugin-tool-supply, core-direct-paths, instance-adoption, cognito-invite-template, lambda-output, pipe-trap, codeql-suppression, skeleton-drift, terraform-input, plugin-allowlist-convention, migration-body-change) run in CI and git hooks, plus out-of-band audits (branch protection, plugin-staleness)"
 );
 checkCommand.command("ownership").description("Refuse changes to template-owned paths in an instance (#370)").argument("[base]", "Base branch to diff against; defaults to $GITHUB_BASE_REF").option("--staged <messageFile>", "Check staged changes instead of a branch diff (commit hook)").allowExcessArguments(true).action(async () => {
   await runOwnershipCheck(rawArgsAfter("ownership"));
@@ -14408,6 +14470,17 @@ checkCommand.command("core-direct-paths").description(
     await runCoreDirectPathsCheck(opts);
   }
 );
+checkCommand.command("instance-adoption").description(
+  "Refuse a real instance tree that has not consumed a registered adoption channel its target template ships (#1538/#1570/#1609) \u2014 checkInstanceAdoption previously ran only inside `biffo core upgrade`, so a gap in an instance nobody happened to be upgrading went undetected for days (keiranholloway/biffo-platform, PR #174). --instance-dir is REQUIRED and has no self-check default: this repo is the template, not an instance."
+).option("--instance <name>", "Label for the report (defaults to the basename of --instance-dir)").option(
+  "--instance-dir <dir>",
+  "REQUIRED: the real instance tree to check adoption against (oursDir) \u2014 no self-check default exists (exits 2, cannot-tell, when omitted)"
+).option(
+  "--theirs-dir <dir>",
+  "Template tree that ships the channel (theirsDir); defaults to this repo root"
+).action(async (opts) => {
+  await runInstanceAdoptionCheck(opts);
+});
 checkCommand.command("cognito-invite-template").description(
   "Refuse a Cognito invite_message_template missing a required member or placeholder (#356) \u2014 terraform validate is silent on this, so a fresh deploy fails on its first apply"
 ).action(async () => {
@@ -14474,8 +14547,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync51, readFileSync as readFileSync44 } from "fs";
-import { join as join60, resolve as resolve20 } from "path";
+import { existsSync as existsSync52, readFileSync as readFileSync44 } from "fs";
+import { join as join61, resolve as resolve20 } from "path";
 import chalk21 from "chalk";
 import { Command as Command25 } from "commander";
 
@@ -14654,8 +14727,8 @@ async function runDoctor(options, deps = { git: new GitAdapter() }) {
   return runDoctorChecks(facts);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join60(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync51(path)) return null;
+  const path = join61(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync52(path)) return null;
   try {
     return extractVersionField(readFileSync44(path, "utf8"));
   } catch {
@@ -14677,8 +14750,8 @@ function extractVersionField(contents) {
   return match?.[1] ?? null;
 }
 function readFossil(cwd) {
-  const path = join60(cwd, CORE_VERSION_FILE);
-  if (!existsSync51(path)) return null;
+  const path = join61(cwd, CORE_VERSION_FILE);
+  if (!existsSync52(path)) return null;
   try {
     const value = readFileSync44(path, "utf8").trim();
     return value === "" ? null : value;
@@ -15129,13 +15202,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command27 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync52 } from "fs";
-import { dirname as dirname11, join as join61 } from "path";
+import { existsSync as existsSync53 } from "fs";
+import { dirname as dirname11, join as join62 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join61(dir, relativePath);
-    if (existsSync52(candidate)) return candidate;
+    const candidate = join62(dir, relativePath);
+    if (existsSync53(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.295.2",
+  "version": "0.296.1",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",