@biffo/cli 0.302.0 → 0.302.2

package/dist/index.js

@@ -11965,8 +11965,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync46, existsSync: existsSync56 } = await import("fs");
-      if (existsSync56(messageFile)) commitMessage = readFileSync46(messageFile, "utf8");
+      const { readFileSync: readFileSync46, existsSync: existsSync57 } = await import("fs");
+      if (existsSync57(messageFile)) commitMessage = readFileSync46(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -12066,6 +12066,10 @@ ${BOLD}If the divergence is deliberate${OFF}
   process.exit(1);
 }
 
+// src/scripts/check-distribution-inventory.ts
+import { existsSync as existsSync44 } from "fs";
+import { join as join48 } from "path";
+
 // src/lib/distribution-inventory.ts
 import { existsSync as existsSync43, readFileSync as readFileSync34 } from "fs";
 import { join as join47 } from "path";
@@ -12231,6 +12235,18 @@ async function fetchRemoteContentViaGh(repo, path, ref, execCommand) {
 // src/scripts/check-distribution-inventory.ts
 async function runDistributionInventoryCheck(root) {
   const repoRoot = root ?? (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
+  if (isInstanceRepo(repoRoot)) {
+    console.log(
+      `\u2713 distribution-inventory: skipped \u2014 this is an instance (${INSTANCE_CORE_FILE} present). ${INVENTORY_FILENAME} is a template-only registry of the channels biffo-template itself uses to distribute to OTHER repos; it is not declared template-owned or user-owned in core-manifest.json, so biffo core upgrade never carries it and no instance is meant to hold one. Nothing to check here.`
+    );
+    return;
+  }
+  if (!existsSync44(join48(repoRoot, INVENTORY_FILENAME))) {
+    console.log(
+      `\u2713 distribution-inventory: skipped \u2014 no ${INVENTORY_FILENAME} at ${repoRoot}. This is a template-only registry; a checkout that legitimately has none has nothing for this guard to check.`
+    );
+    return;
+  }
   const inventory = loadDistributionInventory(repoRoot);
   const violations = validateInventory(inventory);
   console.log(
@@ -12251,7 +12267,7 @@ async function runDistributionInventoryCheck(root) {
 }
 
 // src/scripts/check-distribution-remote-state.ts
-import { join as join48 } from "path";
+import { join as join49 } from "path";
 async function ghExecCommand(file, args) {
   const result = await execa(file, args, { reject: false });
   return { stdout: String(result.stdout ?? ""), exitCode: result.exitCode ?? null };
@@ -12266,7 +12282,7 @@ async function runDistributionRemoteStateCheck(root) {
     }
   }
   console.log(
-    `distribution-remote-state: examined ${assertions.length} remote content assertion(s) declared across ${inventory.entries.length} inventory entries (${join48(repoRoot, "distribution-inventory.json")})`
+    `distribution-remote-state: examined ${assertions.length} remote content assertion(s) declared across ${inventory.entries.length} inventory entries (${join49(repoRoot, "distribution-inventory.json")})`
   );
   if (assertions.length === 0) {
     console.log("\u2713 distribution-remote-state: nothing declared to check");
@@ -12312,7 +12328,7 @@ ${assertion.ref}`;
 
 // src/lib/eventbridge-log-permission-guard.ts
 import { readFileSync as readFileSync35, readdirSync as readdirSync20, statSync as statSync12 } from "fs";
-import { join as join49 } from "path";
+import { join as join50 } from "path";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set(["node_modules", ".git", ".terraform", ".worktrees", "dist"]);
 var EVENT_TARGET_TYPE = "aws_cloudwatch_event_target";
 var LOG_RESOURCE_POLICY_TYPE = "aws_cloudwatch_log_resource_policy";
@@ -12389,7 +12405,7 @@ function walkTerraformFiles(root) {
       return;
     }
     for (const entry of entries) {
-      const p = join49(dir, entry);
+      const p = join50(dir, entry);
       let st;
       try {
         st = statSync12(p);
@@ -12522,8 +12538,8 @@ async function runEventBridgeLogPermissionCheck() {
 }
 
 // src/scripts/check-instance-adoption.ts
-import { existsSync as existsSync44 } from "fs";
-import { join as join50 } from "path";
+import { existsSync as existsSync45 } from "fs";
+import { join as join51 } from "path";
 async function runInstanceAdoptionCheck(opts = {}) {
   if (!opts.instanceDir) {
     console.error(
@@ -12531,7 +12547,7 @@ async function runInstanceAdoptionCheck(opts = {}) {
     );
     process.exit(2);
   }
-  if (!existsSync44(opts.instanceDir)) {
+  if (!existsSync45(opts.instanceDir)) {
     console.error(
       `\u2717 instance-adoption guard: --instance-dir ${opts.instanceDir} does not exist \u2014 cannot tell whether it is adopted, and that is not the same as a clean pass.`
     );
@@ -12539,7 +12555,7 @@ async function runInstanceAdoptionCheck(opts = {}) {
   }
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const theirsDir = opts.theirsDir ?? root;
-  const instanceLabel = opts.instance ?? join50(opts.instanceDir).split("/").filter(Boolean).pop();
+  const instanceLabel = opts.instance ?? join51(opts.instanceDir).split("/").filter(Boolean).pop();
   const report = checkInstanceAdoption(theirsDir, opts.instanceDir);
   console.log(
     `examined ${report.examinedInstances} instance (${instanceLabel}) against ${report.registeredPairs} registered pair(s), ${report.applicablePairs} applicable to this instance, against template tree ${theirsDir}`
@@ -12562,11 +12578,11 @@ async function runInstanceAdoptionCheck(opts = {}) {
 
 // src/lib/lambda-output-guard.ts
 import { readFileSync as readFileSync37 } from "fs";
-import { join as join52 } from "path";
+import { join as join53 } from "path";
 
 // src/lib/terraform-input-guard.ts
-import { existsSync as existsSync45, readdirSync as readdirSync21, readFileSync as readFileSync36, statSync as statSync13 } from "fs";
-import { join as join51 } from "path";
+import { existsSync as existsSync46, readdirSync as readdirSync21, readFileSync as readFileSync36, statSync as statSync13 } from "fs";
+import { join as join52 } from "path";
 var GUARDED_SUBCOMMANDS = [
   "init",
   "plan",
@@ -12580,7 +12596,7 @@ function stripComments2(source) {
   return source.split("\n").map((line) => line.replace(/(^|\s)#.*$/, "$1")).join("\n");
 }
 function vendoredPluginServiceDirs(repoRoot) {
-  const servicesDir = join51(repoRoot, "services");
+  const servicesDir = join52(repoRoot, "services");
   const result = /* @__PURE__ */ new Set();
   let entries;
   try {
@@ -12589,9 +12605,9 @@ function vendoredPluginServiceDirs(repoRoot) {
     return result;
   }
   for (const entry of entries) {
-    const full = join51(servicesDir, entry);
-    if (!existsSync45(full) || !statSync13(full).isDirectory()) continue;
-    if (existsSync45(join51(full, "biffo.plugin.json"))) {
+    const full = join52(servicesDir, entry);
+    if (!existsSync46(full) || !statSync13(full).isDirectory()) continue;
+    if (existsSync46(join52(full, "biffo.plugin.json"))) {
       result.add(entry);
     }
   }
@@ -12613,7 +12629,7 @@ function findWorkflowFiles(repoRoot) {
       if (entry === ".github" && relative11.startsWith("services/") && vendoredPluginDirs.has(relative11.slice("services/".length))) {
         continue;
       }
-      const full = join51(dir, entry);
+      const full = join52(dir, entry);
       const rel = relative11 ? `${relative11}/${entry}` : entry;
       let isDir;
       try {
@@ -12663,7 +12679,7 @@ function checkWorkflowSource(file, rawSource) {
 }
 function checkTerraformInput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource(file, readFileSync36(join51(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource(file, readFileSync36(join52(repoRoot, file), "utf8"))
   );
 }
 
@@ -12721,7 +12737,7 @@ function checkWorkflowSource2(file, rawSource) {
 }
 function checkLambdaOutput(repoRoot) {
   return findWorkflowFiles(repoRoot).flatMap(
-    (file) => checkWorkflowSource2(file, readFileSync37(join52(repoRoot, file), "utf8"))
+    (file) => checkWorkflowSource2(file, readFileSync37(join53(repoRoot, file), "utf8"))
   );
 }
 
@@ -12749,8 +12765,8 @@ async function runLambdaOutputCheck() {
 }
 
 // src/scripts/check-migration-body-change.ts
-import { existsSync as existsSync46 } from "fs";
-import { join as join53 } from "path";
+import { existsSync as existsSync47 } from "fs";
+import { join as join54 } from "path";
 
 // src/lib/migration-body-change-guard.ts
 function checkMigrationBodyChangeMarkers(diffs) {
@@ -12816,7 +12832,7 @@ async function runMigrationBodyChangeCheck(argv) {
     );
     return;
   }
-  if (!existsSync46(join53(root, MIGRATIONS_VERSIONS_DIR))) {
+  if (!existsSync47(join54(root, MIGRATIONS_VERSIONS_DIR))) {
     console.log(`\u2713 migration body-change guard: no ${MIGRATIONS_VERSIONS_DIR} in this repo.`);
     return;
   }
@@ -12918,7 +12934,7 @@ ${BOLD2}What to do${OFF2}
 }
 
 // src/scripts/check-orphan-ratchet.ts
-import { existsSync as existsSync47 } from "fs";
+import { existsSync as existsSync48 } from "fs";
 import { basename as basename3 } from "path";
 function reportOrphan(entry, manifest) {
   console.error(`  ${entry.path}`);
@@ -12941,7 +12957,7 @@ function reportOrphan(entry, manifest) {
   }
 }
 async function runOrphanRatchetCheck(opts = {}) {
-  if (opts.instanceDir !== void 0 && !existsSync47(opts.instanceDir)) {
+  if (opts.instanceDir !== void 0 && !existsSync48(opts.instanceDir)) {
     console.error(
       `\u2717 orphan-ratchet guard: --instance-dir ${opts.instanceDir} does not exist \u2014 cannot tell whether it carries unsanctioned files, and that is not the same as a clean pass.`
     );
@@ -12984,7 +13000,7 @@ baseline was ${String(ratchet.baseline)}, now ${String(ratchet.count)}. See biff
 
 // src/scripts/check-pipe-trap.ts
 import { readFileSync as readFileSync38, readdirSync as readdirSync22 } from "fs";
-import { join as join54, relative as relative9 } from "path";
+import { join as join55, relative as relative9 } from "path";
 
 // src/lib/pipe-trap-guard.ts
 var STATUS_BEARING = [
@@ -13080,7 +13096,7 @@ function findPipeTraps(source) {
 function shellFiles(root) {
   const out = [];
   for (const dir of ["scripts", ".githooks"]) {
-    const full = join54(root, dir);
+    const full = join55(root, dir);
     let entries;
     try {
       entries = readdirSync22(full, { withFileTypes: true });
@@ -13090,7 +13106,7 @@ function shellFiles(root) {
     for (const entry of entries) {
       if (!entry.isFile()) continue;
       if (dir === "scripts" && !entry.name.endsWith(".sh")) continue;
-      out.push(join54(full, entry.name));
+      out.push(join55(full, entry.name));
     }
   }
   return out;
@@ -13124,7 +13140,7 @@ async function runPipeTrapCheck() {
 
 // src/lib/plugin-allowlist-convention.ts
 import { readFileSync as readFileSync39 } from "fs";
-import { join as join55 } from "path";
+import { join as join56 } from "path";
 var COMPUTE_MAIN_TF = "modules/cloud/aws/compute/main.tf";
 var PLUGIN_TEMPLATE_MAIN_TF = "modules/plugins/_template/main.tf";
 var ALLOWLIST_MAIN_TF = "modules/cloud/aws/plugin-allowlist/main.tf";
@@ -13135,7 +13151,7 @@ var PLUGIN = "<plugin>";
 var ACCOUNT = "<account>";
 function read(repoRoot, relative11) {
   try {
-    return readFileSync39(join55(repoRoot, relative11), "utf8");
+    return readFileSync39(join56(repoRoot, relative11), "utf8");
   } catch {
     throw new Error(`plugin-allowlist drift guard: cannot read ${relative11}`);
   }
@@ -13256,32 +13272,32 @@ async function runPluginAllowlistConventionCheck() {
 }
 
 // src/scripts/check-plugin-collisions.ts
-import { existsSync as existsSync49 } from "fs";
-import { join as join57 } from "path";
+import { existsSync as existsSync50 } from "fs";
+import { join as join58 } from "path";
 
 // src/lib/plugin-collision-guard.ts
-import { existsSync as existsSync48, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
-import { join as join56 } from "path";
+import { existsSync as existsSync49, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
+import { join as join57 } from "path";
 var PYTEST_SPECIAL = /* @__PURE__ */ new Set(["conftest.py"]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".venv", "node_modules", "__pycache__", ".git", "dist", "build"]);
 function subdirectories(dir) {
-  if (!existsSync48(dir)) return [];
+  if (!existsSync49(dir)) return [];
   return readdirSync23(dir).filter((entry) => {
     if (IGNORED_DIRS.has(entry) || entry.startsWith(".")) return false;
     try {
-      return statSync14(join56(dir, entry)).isDirectory();
+      return statSync14(join57(dir, entry)).isDirectory();
     } catch {
       return false;
     }
   });
 }
 function regularPackagesOf(pluginDir2) {
-  return subdirectories(pluginDir2).filter((name) => existsSync48(join56(pluginDir2, name, "__init__.py"))).sort();
+  return subdirectories(pluginDir2).filter((name) => existsSync49(join57(pluginDir2, name, "__init__.py"))).sort();
 }
 function bareTestModulesOf(pluginDir2) {
-  const testsDir = join56(pluginDir2, "tests");
-  if (!existsSync48(testsDir)) return [];
-  if (existsSync48(join56(testsDir, "__init__.py"))) return [];
+  const testsDir = join57(pluginDir2, "tests");
+  if (!existsSync49(testsDir)) return [];
+  if (existsSync49(join57(testsDir, "__init__.py"))) return [];
   return readdirSync23(testsDir).filter((f) => f.endsWith(".py") && !PYTEST_SPECIAL.has(f)).sort();
 }
 function findCollisions(servicesDir, pluginDirs) {
@@ -13290,7 +13306,7 @@ function findCollisions(servicesDir, pluginDirs) {
   const gather = (kind, namesOf) => {
     const claims = /* @__PURE__ */ new Map();
     for (const plugin of plugins) {
-      for (const name of namesOf(join56(servicesDir, plugin))) {
+      for (const name of namesOf(join57(servicesDir, plugin))) {
         claims.set(name, [...claims.get(name) ?? [], plugin]);
       }
     }
@@ -13328,8 +13344,8 @@ function formatCollisions(collisions) {
 // src/scripts/check-plugin-collisions.ts
 async function runPluginCollisionCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
-  const servicesDir = join57(root, "services");
-  if (!existsSync49(servicesDir)) {
+  const servicesDir = join58(root, "services");
+  if (!existsSync50(servicesDir)) {
     console.log("\u2713 plugin collision guard: no services/ directory \u2014 nothing to compare");
     return;
   }
@@ -13346,8 +13362,8 @@ async function runPluginCollisionCheck() {
 }
 
 // src/lib/plugin-terraform-guard.ts
-import { existsSync as existsSync50, readFileSync as readFileSync40, readdirSync as readdirSync24 } from "fs";
-import { dirname as dirname10, join as join58, relative as relative10, sep as sep4 } from "path";
+import { existsSync as existsSync51, readFileSync as readFileSync40, readdirSync as readdirSync24 } from "fs";
+import { dirname as dirname10, join as join59, relative as relative10, sep as sep4 } from "path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set(["node_modules", ".git", ".worktrees", "dist", ".venv", "__pycache__"]);
 var PLUGIN_MANIFEST_FILE2 = "biffo.plugin.json";
 function findPluginManifests(root) {
@@ -13362,9 +13378,9 @@ function findPluginManifests(root) {
     for (const entry of entries) {
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name)) continue;
-        walk2(join58(dir, entry.name));
+        walk2(join59(dir, entry.name));
       } else if (entry.isFile() && entry.name === PLUGIN_MANIFEST_FILE2) {
-        found.push(relative10(root, join58(dir, entry.name)).split(sep4).join("/"));
+        found.push(relative10(root, join59(dir, entry.name)).split(sep4).join("/"));
       }
     }
   };
@@ -13389,14 +13405,14 @@ function readSubscriptions(absManifestPath) {
 }
 function checkPluginTerraform(root) {
   const violations = [];
-  const coreManifest = existsSync50(join58(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
+  const coreManifest = existsSync51(join59(root, CORE_MANIFEST_FILE)) ? readCoreManifest(root) : null;
   for (const manifest of findPluginManifests(root)) {
     if (coreManifest && !isTemplateOwned(manifest, coreManifest)) continue;
-    const absManifest = join58(root, manifest);
+    const absManifest = join59(root, manifest);
     const subscriptions = readSubscriptions(absManifest);
     if (subscriptions === null) continue;
     const pluginDir2 = dirname10(absManifest);
-    if (existsSync50(join58(pluginDir2, "terraform"))) continue;
+    if (existsSync51(join59(pluginDir2, "terraform"))) continue;
     const relPluginDir = relative10(root, pluginDir2).split(sep4).join("/");
     violations.push({
       manifest,
@@ -13427,12 +13443,12 @@ async function runPluginTerraformCheck() {
 }
 
 // src/scripts/check-plugin-tool-supply.ts
-import { existsSync as existsSync52 } from "fs";
-import { join as join60 } from "path";
+import { existsSync as existsSync53 } from "fs";
+import { join as join61 } from "path";
 
 // src/lib/plugin-tool-supply-audit.ts
-import { existsSync as existsSync51, readFileSync as readFileSync41, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
-import { join as join59 } from "path";
+import { existsSync as existsSync52, readFileSync as readFileSync41, readdirSync as readdirSync25, statSync as statSync15 } from "fs";
+import { join as join60 } from "path";
 
 // src/lib/openrouter-model-snapshot.ts
 var OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT = "2026-08-10T06:39:01Z";
@@ -13849,7 +13865,7 @@ function listDirs(root) {
   }
   return entries.filter((e) => {
     try {
-      return statSync15(join59(root, e)).isDirectory();
+      return statSync15(join60(root, e)).isDirectory();
     } catch {
       return false;
     }
@@ -13865,7 +13881,7 @@ function walkFiles2(root, accept, skipDir) {
       return;
     }
     for (const entry of entries) {
-      const p = join59(dir, entry);
+      const p = join60(dir, entry);
       let st;
       try {
         st = statSync15(p);
@@ -13891,14 +13907,14 @@ function pluginPythonFiles(pluginDir2) {
   );
 }
 function pluginTerraformFiles(pluginDir2) {
-  const tfDir = join59(pluginDir2, "terraform");
+  const tfDir = join60(pluginDir2, "terraform");
   let entries;
   try {
     entries = readdirSync25(tfDir);
   } catch {
     return [];
   }
-  return entries.filter((e) => e.endsWith(".tf")).map((e) => join59(tfDir, e)).sort();
+  return entries.filter((e) => e.endsWith(".tf")).map((e) => join60(tfDir, e)).sort();
 }
 function extractManifestTools(manifestText) {
   let parsed;
@@ -14150,8 +14166,8 @@ function isSnapshotStale(fetchedAt, now) {
 function normalizeModelId(id) {
   return id.endsWith(":online") ? id.slice(0, -":online".length) : id;
 }
-var CONFIG_PY_PATH = join59("services", "api", "src", "api", "config.py");
-var ORCHESTRATION_SCHEMA_PATH = join59(
+var CONFIG_PY_PATH = join60("services", "api", "src", "api", "config.py");
+var ORCHESTRATION_SCHEMA_PATH = join60(
   "services",
   "api",
   "src",
@@ -14163,10 +14179,10 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
   const knownModelIds = options.knownModelIds ?? OPENROUTER_MODEL_IDS;
   const snapshotFetchedAt = options.snapshotFetchedAt ?? OPENROUTER_MODEL_SNAPSHOT_FETCHED_AT;
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const configPath = join59(repoRoot, CONFIG_PY_PATH);
-  const orchestrationPath = join59(repoRoot, ORCHESTRATION_SCHEMA_PATH);
-  const configMissing = !existsSync51(configPath);
-  const orchestrationSchemaMissing = !existsSync51(orchestrationPath);
+  const configPath = join60(repoRoot, CONFIG_PY_PATH);
+  const orchestrationPath = join60(repoRoot, ORCHESTRATION_SCHEMA_PATH);
+  const configMissing = !existsSync52(configPath);
+  const orchestrationSchemaMissing = !existsSync52(orchestrationPath);
   const knownSet = new Set(knownModelIds);
   const snapshotEmpty = knownModelIds.length === 0;
   const snapshotStale = isSnapshotStale(snapshotFetchedAt, now);
@@ -14237,7 +14253,7 @@ function auditDeclaredModelIds(repoRoot, options = {}) {
 function discoverPluginDirs(pluginsRoot) {
   return listDirs(pluginsRoot).filter((name) => {
     try {
-      return statSync15(join59(pluginsRoot, name, "biffo.plugin.json")).isFile();
+      return statSync15(join60(pluginsRoot, name, "biffo.plugin.json")).isFile();
     } catch {
       return false;
     }
@@ -14250,8 +14266,8 @@ function auditPluginToolSupply(pluginsRoot) {
   let terraformBlind = false;
   let totalDeclaredTools = 0;
   for (const name of pluginNames) {
-    const pluginDir2 = join59(pluginsRoot, name);
-    const manifestText = readFileSync41(join59(pluginDir2, "biffo.plugin.json"), "utf8");
+    const pluginDir2 = join60(pluginsRoot, name);
+    const manifestText = readFileSync41(join60(pluginDir2, "biffo.plugin.json"), "utf8");
     const manifest = extractManifestTools(manifestText);
     if (manifest.parseError) {
       findings.push({
@@ -14349,7 +14365,7 @@ function auditPluginToolSupply(pluginsRoot) {
         requiredEnvVars: envResult.envVars,
         missingEnvVars: anyWired ? [] : envResult.envVars,
         status: anyWired ? "ok" : "missing-env",
-        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join59(pluginDir2, "terraform")}, so this deployment can never supply it`
+        detail: anyWired ? `${entry.predicate}() is satisfiable: at least one of ${JSON.stringify(envResult.envVars)} is wired in Terraform` : `${entry.predicate}() reads ${JSON.stringify(envResult.envVars)} \u2014 NONE of these are wired by any environment_variables block under ${join60(pluginDir2, "terraform")}, so this deployment can never supply it`
       });
     }
   }
@@ -14382,8 +14398,8 @@ function auditPluginToolSupply(pluginsRoot) {
 async function runPluginToolSupplyCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   let allOk = true;
-  const pluginsRoot = join60(root, "services", "_plugins");
-  if (!existsSync52(pluginsRoot)) {
+  const pluginsRoot = join61(root, "services", "_plugins");
+  if (!existsSync53(pluginsRoot)) {
     console.log("\u2713 plugin tool-supply guard: no services/_plugins/ \u2014 nothing to audit");
   } else {
     const report = auditPluginToolSupply(pluginsRoot);
@@ -14413,8 +14429,8 @@ async function runPluginToolSupplyCheck() {
       console.log(`\u2713 plugin tool-supply guard: ${report.summary}`);
     }
   }
-  const servicesApiRoot = join60(root, "services", "api");
-  if (!existsSync52(servicesApiRoot)) {
+  const servicesApiRoot = join61(root, "services", "api");
+  if (!existsSync53(servicesApiRoot)) {
     console.log("\u2713 plugin model-id guard: no services/api/ \u2014 nothing to audit");
   } else {
     const modelReport = auditDeclaredModelIds(root);
@@ -14791,12 +14807,12 @@ async function runSharedFileReductionCheck(args) {
 }
 
 // src/scripts/check-skeleton-drift.ts
-import { existsSync as existsSync53, readdirSync as readdirSync27 } from "fs";
-import { join as join62 } from "path";
+import { existsSync as existsSync54, readdirSync as readdirSync27 } from "fs";
+import { join as join63 } from "path";
 
 // src/lib/skeleton-drift-guard.ts
 import { readFileSync as readFileSync44, readdirSync as readdirSync26, statSync as statSync16 } from "fs";
-import { join as join61 } from "path";
+import { join as join62 } from "path";
 var isWorkflow = (rel) => rel.startsWith(".github/workflows/") && (rel.endsWith(".yml") || rel.endsWith(".yaml"));
 var isRootLayout = (rel) => rel.endsWith("src/app/layout.tsx");
 var uncommented = (contents) => contents.split("\n").filter((line) => !/^\s*(\/\/|\/\*|\*)/.test(line)).join("\n");
@@ -14860,7 +14876,7 @@ function walk(dir, base = dir) {
   }
   for (const entry of entries) {
     if (entry === ".venv" || entry === "node_modules" || entry === ".git") continue;
-    const abs = join61(dir, entry);
+    const abs = join62(dir, entry);
     let isDir;
     try {
       isDir = statSync16(abs).isDirectory();
@@ -14882,7 +14898,7 @@ function auditSkeleton(skeletonRoot, name, rules = SKELETON_RULES) {
       if (!rule.appliesTo(rel)) continue;
       let contents;
       try {
-        contents = readFileSync44(join61(skeletonRoot, rel), "utf8");
+        contents = readFileSync44(join62(skeletonRoot, rel), "utf8");
       } catch {
         continue;
       }
@@ -14911,23 +14927,23 @@ function formatViolations2(violations) {
 
 // src/scripts/check-skeleton-drift.ts
 function discoverSkeletons(root) {
-  const skeletonsDir = join62(root, "_skeletons");
+  const skeletonsDir = join63(root, "_skeletons");
   let entries;
   try {
     entries = readdirSync27(skeletonsDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
-  return entries.filter((name) => existsSync53(join62(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
+  return entries.filter((name) => existsSync54(join63(skeletonsDir, name, ".github", "workflows", "ci.yml"))).sort();
 }
 async function runSkeletonDriftCheck() {
   const root = (await execa("git", ["rev-parse", "--show-toplevel"])).stdout.trim();
   const skeletons = discoverSkeletons(root);
   let filesConsidered = 0;
   for (const name of skeletons) {
-    const skeletonRoot = join62(root, "_skeletons", name);
+    const skeletonRoot = join63(root, "_skeletons", name);
     filesConsidered += findWorkflowFiles(skeletonRoot).length;
-    if (existsSync53(join62(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
+    if (existsSync54(join63(skeletonRoot, "apps", "frontend", "src", "app", "layout.tsx"))) {
       filesConsidered += 1;
     }
   }
@@ -14941,7 +14957,7 @@ async function runSkeletonDriftCheck() {
     process.exit(1);
   }
   const violations = skeletons.flatMap(
-    (name) => auditSkeleton(join62(root, "_skeletons", name), name)
+    (name) => auditSkeleton(join63(root, "_skeletons", name), name)
   );
   if (violations.length > 0) {
     console.error("\u2717 Skeleton-drift guard: drift found between this repo and its scaffolding\n");
@@ -15132,8 +15148,8 @@ function rawArgsAfter(subcommand) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync54, readFileSync as readFileSync45 } from "fs";
-import { join as join63, resolve as resolve20 } from "path";
+import { existsSync as existsSync55, readFileSync as readFileSync45 } from "fs";
+import { join as join64, resolve as resolve20 } from "path";
 import chalk21 from "chalk";
 import { Command as Command25 } from "commander";
 
@@ -15528,8 +15544,8 @@ async function runDoctorFixBranches(cwd, facts, deps = { git: new GitAdapter(),
   return reapAllBareBranches(cwd, facts.branches, facts.worktrees, facts.currentBranch, deps);
 }
 function readLocalCoreVersion(cwd) {
-  const path = join63(cwd, INSTANCE_CORE_FILE);
-  if (!existsSync54(path)) return null;
+  const path = join64(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync55(path)) return null;
   try {
     return extractVersionField(readFileSync45(path, "utf8"));
   } catch {
@@ -15551,8 +15567,8 @@ function extractVersionField(contents) {
   return match?.[1] ?? null;
 }
 function readFossil(cwd) {
-  const path = join63(cwd, CORE_VERSION_FILE);
-  if (!existsSync54(path)) return null;
+  const path = join64(cwd, CORE_VERSION_FILE);
+  if (!existsSync55(path)) return null;
   try {
     const value = readFileSync45(path, "utf8").trim();
     return value === "" ? null : value;
@@ -16083,13 +16099,13 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 import { Command as Command27 } from "commander";
 
 // src/lib/packaged-scripts.ts
-import { existsSync as existsSync55 } from "fs";
-import { dirname as dirname11, join as join64 } from "path";
+import { existsSync as existsSync56 } from "fs";
+import { dirname as dirname11, join as join65 } from "path";
 function findPackagedScript(startDir, relativePath) {
   let dir = startDir;
   for (; ; ) {
-    const candidate = join64(dir, relativePath);
-    if (existsSync55(candidate)) return candidate;
+    const candidate = join65(dir, relativePath);
+    if (existsSync56(candidate)) return candidate;
     const parent = dirname11(dir);
     if (parent === dir) return null;
     dir = parent;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.302.0",
+  "version": "0.302.2",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/scripts/verify.sh

@@ -1413,6 +1413,16 @@ if [ -f scripts/biffo.sh ]; then
   run_check plugin-tool-supply sh scripts/biffo.sh check plugin-tool-supply
   run_check core-direct-paths sh scripts/biffo.sh check core-direct-paths
   run_check orphan-ratchet sh scripts/biffo.sh check orphan-ratchet
+  # #1714 second remediation: the INSTANCE-mode caller, distinct from the
+  # self-check above. It clones a real template tree pinned to
+  # biffo.core.json's own version and compares against it -- but this repo
+  # never carries biffo.core.json (it is the template, not an instance), so
+  # the script itself detects that and exits 0 as a genuine skip (see its own
+  # doc comment) rather than attempting a comparison it has no tree for. Kept
+  # unconditional, exactly like the line above, for the same reason: ci.yml's
+  # exact command text must appear in `verify.sh --list`'s output or the
+  # parity test (verify-parity.test.ts, #1773) reports it uncategorised.
+  run_check orphan-ratchet-instance sh scripts/check-orphan-ratchet-instance.sh
   run_check cognito-invite sh scripts/biffo.sh check cognito-invite-template
   run_check lambda-output sh scripts/biffo.sh check lambda-output
   run_check pipe-trap sh scripts/biffo.sh check pipe-trap
@@ -1453,6 +1463,18 @@ fi
 [ -f scripts/allocate-module-number.test.sh ] &&
   run_check allocate-module-number sh scripts/allocate-module-number.test.sh
 
+# check-orphan-ratchet-instance.sh's own self-test (#1714, second
+# remediation): real throwaway git fixtures standing in for "the template at
+# a pinned version" and "a live instance", exercising the wrapper end to end
+# via THIS repo's own already-built local CLI through tsx (no mocking of
+# planCoreUpgrade/classify()). Needs cli/node_modules/.bin/tsx -- present
+# once `pnpm install` has run in this checkout, same as every other
+# JS-backed check above; the test itself fails with a clear "run pnpm
+# install" message rather than a cryptic tsx-not-found if it hasn't.
+# Measured here: ~1.6s.
+[ -f scripts/check-orphan-ratchet-instance.test.sh ] &&
+  run_check orphan-ratchet-instance-selftest sh scripts/check-orphan-ratchet-instance.test.sh
+
 # The append-only corpus guard (#778). CI runs it in Release Guards, and it was
 # invisible to the parity test until #897 widened the harvester -- it is neither
 # `pnpm`, `uv`, `terraform` nor `sh scripts/`, so the guard whose property is