@bvdm/delano 0.1.5 → 0.1.8

package/assets/payload/.agents/scripts/check-local-sync-map.mjs

@@ -0,0 +1,151 @@
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const repoRoot = resolveRepoRoot(__dirname);
+const errors = [];
+const warnings = [];
+const jsonMode = process.argv.includes("--json");
+
+const syncMap = buildLocalSyncMap(repoRoot);
+validateSyncMap(syncMap);
+
+if (jsonMode) {
+  console.log(JSON.stringify({ sync_map: syncMap, errors, warnings }, null, 2));
+} else if (errors.length === 0) {
+  const taskCount = syncMap.projects.reduce((sum, project) => sum + project.tasks.length, 0);
+  console.log(`Local sync map check passed for ${syncMap.projects.length} projects and ${taskCount} tasks.`);
+  if (warnings.length > 0) for (const warning of warnings) console.warn(`Warning: ${warning}`);
+}
+
+if (errors.length > 0) {
+  if (!jsonMode) {
+    console.error("Local sync map check failed:");
+    for (const error of errors) console.error(`- ${error}`);
+  }
+  process.exit(1);
+}
+
+function buildLocalSyncMap(root) {
+  const projectsRoot = path.join(root, ".project", "projects");
+  const linearMap = readJson(path.join(root, ".project", "registry", "linear-map.json"), "linear map", { projects: {}, tasks: {} });
+  const projects = [];
+
+  if (!existsSync(projectsRoot)) {
+    errors.push("Missing .project/projects directory.");
+    return { schema_version: 1, source: "local-project-contracts", projects };
+  }
+
+  for (const entry of readdirSync(projectsRoot, { withFileTypes: true })) {
+    if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
+    const projectDir = path.join(projectsRoot, entry.name);
+    const spec = parseFrontmatter(readText(path.join(projectDir, "spec.md")));
+    const plan = parseFrontmatter(readText(path.join(projectDir, "plan.md")));
+    const projectSlug = spec.slug || entry.name;
+    const registryProject = linearMap.projects?.[projectSlug] || {};
+    const project = {
+      slug: projectSlug,
+      local_path: `.project/projects/${entry.name}`,
+      linear_project_id: firstNonEmpty(plan.linear_project_id, spec.linear_project_id, registryProject.linear_project_id, registryProject.id),
+      github_repo: firstNonEmpty(plan.github_repo, spec.github_repo, registryProject.github_repo),
+      tasks: []
+    };
+
+    const tasksDir = path.join(projectDir, "tasks");
+    if (existsSync(tasksDir)) {
+      for (const taskEntry of readdirSync(tasksDir, { withFileTypes: true })) {
+        if (!taskEntry.isFile() || !taskEntry.name.endsWith(".md")) continue;
+        const taskPath = path.join(tasksDir, taskEntry.name);
+        const fm = parseFrontmatter(readText(taskPath));
+        if (!fm.id) {
+          warnings.push(`${project.local_path}/tasks/${taskEntry.name} has no task id and was skipped.`);
+          continue;
+        }
+        const registryTask = linearMap.tasks?.[`${projectSlug}:${fm.id}`] || linearMap.tasks?.[fm.id] || {};
+        project.tasks.push({
+          local_id: fm.id,
+          local_path: `${project.local_path}/tasks/${taskEntry.name}`,
+          status: fm.status || "unknown",
+          linear_issue_id: firstNonEmpty(fm.linear_issue_id, registryTask.linear_issue_id, registryTask.id),
+          github_issue: firstNonEmpty(fm.github_issue, registryTask.github_issue),
+          github_pr: firstNonEmpty(fm.github_pr, registryTask.github_pr),
+          depends_on: parseList(fm.depends_on || "[]")
+        });
+      }
+    }
+    project.tasks.sort((a, b) => a.local_id.localeCompare(b.local_id));
+    projects.push(project);
+  }
+
+  projects.sort((a, b) => a.slug.localeCompare(b.slug));
+  return { schema_version: 1, source: "local-project-contracts", projects };
+}
+
+function validateSyncMap(syncMap) {
+  if (syncMap.schema_version !== 1) errors.push("local sync map schema_version must be 1.");
+  if (!Array.isArray(syncMap.projects)) errors.push("local sync map projects must be an array.");
+  const seenProjects = new Set();
+  for (const project of syncMap.projects || []) {
+    if (!project.slug || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(project.slug)) errors.push(`invalid project slug: ${project.slug || "<missing>"}`);
+    if (seenProjects.has(project.slug)) errors.push(`duplicate project slug: ${project.slug}`);
+    seenProjects.add(project.slug);
+    if (!project.local_path || !/^\.project\/projects\/[^/]+$/.test(project.local_path)) errors.push(`invalid local project path for ${project.slug}`);
+    const seenTasks = new Set();
+    for (const task of project.tasks || []) {
+      const taskKey = `${project.slug}:${task.local_id}`;
+      if (!/^T-[0-9]{3}$/.test(task.local_id || "")) errors.push(`invalid task id in ${project.slug}: ${task.local_id || "<missing>"}`);
+      if (seenTasks.has(task.local_id)) errors.push(`duplicate task id in ${project.slug}: ${task.local_id}`);
+      seenTasks.add(task.local_id);
+      if (!task.local_path?.startsWith(`${project.local_path}/tasks/`)) errors.push(`invalid task path for ${taskKey}`);
+      if (!Array.isArray(task.depends_on)) errors.push(`depends_on must be normalized as an array for ${taskKey}`);
+    }
+  }
+}
+
+function parseFrontmatter(text) {
+  const match = text.match(/^---\n([\s\S]*?)\n---\n/);
+  if (!match) return {};
+  const result = {};
+  for (const line of match[1].split("\n")) {
+    const index = line.indexOf(":");
+    if (index === -1) continue;
+    result[line.slice(0, index).trim()] = line.slice(index + 1).trim();
+  }
+  return result;
+}
+
+function parseList(raw) {
+  const value = String(raw).trim();
+  if (!value || value === "[]") return [];
+  if (value.startsWith("[") && value.endsWith("]")) {
+    return value.slice(1, -1).split(",").map((item) => item.trim().replace(/^[\"']|[\"']$/g, "")).filter(Boolean);
+  }
+  return [value.replace(/^[\"']|[\"']$/g, "")].filter(Boolean);
+}
+
+function firstNonEmpty(...values) {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim() !== "") return value.trim();
+  }
+  return "";
+}
+
+function readText(filePath) {
+  try { return readFileSync(filePath, "utf8"); }
+  catch { return ""; }
+}
+
+function readJson(filePath, label, fallback) {
+  try { return JSON.parse(readFileSync(filePath, "utf8")); }
+  catch (error) { warnings.push(`Could not read ${label}: ${error.message}`); return fallback; }
+}
+
+function resolveRepoRoot(startDir) {
+  const candidates = [path.resolve(startDir, ".."), path.resolve(startDir, "..", "..")];
+  for (const candidate of candidates) {
+    if (existsSync(path.join(candidate, ".agents")) && existsSync(path.join(candidate, ".project"))) return candidate;
+  }
+  return path.resolve(startDir, "..");
+}

package/assets/payload/.agents/scripts/check-log-safety.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+cd "$root"
+
+errors=0
+
+require_file() {
+  local file="$1"
+  if [[ -f "$file" ]]; then
+    echo "✅ $file"
+  else
+    echo "❌ Missing log-safety file: $file"
+    errors=$((errors + 1))
+  fi
+}
+
+echo "Log safety check"
+echo "================"
+
+require_file ".agents/common/log-safety.js"
+require_file ".agents/hooks/user-prompt-logger.js"
+require_file ".agents/logs/schema.md"
+
+if [[ -e .claude || -L .claude ]]; then
+  require_file ".claude/common/log-safety.js"
+fi
+
+if grep -q 'prompt_hash' .agents/hooks/user-prompt-logger.js && grep -q 'DELANO_LOG_RAW_PROMPTS' .agents/hooks/user-prompt-logger.js; then
+  echo "✅ Prompt logger stores hash metadata by default and gates raw text"
+else
+  echo "❌ Prompt logger must store prompt_hash and gate raw text behind DELANO_LOG_RAW_PROMPTS"
+  errors=$((errors + 1))
+fi
+
+if grep -q 'redactObject' .agents/hooks/post-tool-logger.js && grep -q 'redactObject' .agents/scripts/log-event.js; then
+  echo "✅ Change/event metadata passes through redaction helpers"
+else
+  echo "❌ Change/event logging must redact metadata before write"
+  errors=$((errors + 1))
+fi
+
+raw_schema_matches="$(grep -RIn '"prompt"[[:space:]]*:[[:space:]]*"string"' .agents .claude 2>/dev/null || true)"
+if [[ -n "$raw_schema_matches" ]]; then
+  echo "❌ Raw prompt schema still documented:"
+  echo "$raw_schema_matches"
+  errors=$((errors + 1))
+else
+  echo "✅ Raw prompt schema is not documented as default"
+fi
+
+if grep -q 'echo .*\$root' .agents/hooks/bash-worktree-fix.sh; then
+  echo "❌ bash-worktree-fix.sh prints the absolute repository root"
+  errors=$((errors + 1))
+else
+  echo "✅ bash-worktree-fix.sh prints a placeholder instead of the absolute root"
+fi
+
+if [[ $errors -gt 0 ]]; then
+  exit 1
+fi

package/assets/payload/.agents/scripts/check-operating-modes.mjs

@@ -0,0 +1,99 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const repoRoot = resolveRepoRoot(__dirname);
+const modesPath = path.join(repoRoot, ".agents", "schemas", "operating-modes.json");
+const rulePath = path.join(repoRoot, ".agents", "rules", "delivery-modes.md");
+const errors = [];
+
+const contract = readJson(modesPath, "operating modes contract");
+const modes = Array.isArray(contract.modes) ? contract.modes : [];
+const expectedModes = [0, 1, 2, 3, 4];
+const expectedSlugs = ["patch", "scoped-change", "feature", "uncertain-feature", "multi-stream"];
+
+if (contract.schema_version !== 1) {
+  errors.push("operating-modes.json schema_version must be 1.");
+}
+
+if (modes.length !== expectedModes.length) {
+  errors.push(`operating-modes.json must define ${expectedModes.length} modes.`);
+}
+
+const seenModes = new Set();
+const seenSlugs = new Set();
+for (const [index, expectedMode] of expectedModes.entries()) {
+  const mode = modes[index];
+  if (!mode) continue;
+
+  if (mode.mode !== expectedMode) {
+    errors.push(`mode index ${index} must be mode ${expectedMode}.`);
+  }
+  if (mode.slug !== expectedSlugs[index]) {
+    errors.push(`mode ${expectedMode} must use slug ${expectedSlugs[index]}.`);
+  }
+  if (seenModes.has(mode.mode)) {
+    errors.push(`duplicate operating mode: ${mode.mode}`);
+  }
+  seenModes.add(mode.mode);
+  if (seenSlugs.has(mode.slug)) {
+    errors.push(`duplicate operating mode slug: ${mode.slug}`);
+  }
+  seenSlugs.add(mode.slug);
+
+  for (const field of ["name", "use_when"]) {
+    if (typeof mode[field] !== "string" || mode[field].trim() === "") {
+      errors.push(`mode ${expectedMode} must define non-empty ${field}.`);
+    }
+  }
+  if (!Array.isArray(mode.requires) || mode.requires.length === 0) {
+    errors.push(`mode ${expectedMode} must define at least one requirement.`);
+  }
+}
+
+const doc = readText(rulePath, "delivery modes rule");
+for (const slug of expectedSlugs) {
+  if (!doc.includes(slug)) {
+    errors.push(`delivery-modes.md must document slug: ${slug}`);
+  }
+}
+
+if (errors.length > 0) {
+  console.error("Operating modes check failed:");
+  for (const error of errors) console.error(`- ${error}`);
+  process.exit(1);
+}
+
+console.log("Operating modes check passed for modes 0 through 4.");
+
+function readJson(filePath, label) {
+  try {
+    return JSON.parse(readFileSync(filePath, "utf8"));
+  } catch (error) {
+    errors.push(`Could not read ${label} at ${toRepoPath(filePath)}: ${error.message}`);
+    return {};
+  }
+}
+
+function readText(filePath, label) {
+  try {
+    return readFileSync(filePath, "utf8");
+  } catch (error) {
+    errors.push(`Could not read ${label} at ${toRepoPath(filePath)}: ${error.message}`);
+    return "";
+  }
+}
+
+function resolveRepoRoot(startDir) {
+  const candidates = [path.resolve(startDir, ".."), path.resolve(startDir, "..", "..")];
+  for (const candidate of candidates) {
+    if (existsSync(path.join(candidate, ".agents", "schemas"))) return candidate;
+  }
+  return path.resolve(startDir, "..");
+}
+
+function toRepoPath(filePath) {
+  return path.relative(repoRoot, filePath).split(path.sep).join("/");
+}

package/assets/payload/.agents/scripts/check-path-standards.sh

@@ -17,7 +17,7 @@ if find .project .agents "${compat_paths[@]}" \
   \( -name '*.md' -o -name '*.json' -o -name '*.yaml' -o -name '*.yml' \) \
   -not -path '.agents/logs/*' \
   -not -path '.claude/logs/*' \
-  -print0 | xargs -0 grep -nE '(/home/[^[:space:]]+|/Users/[^[:space:]]+|[A-Za-z]:\\[^[:space:]]+)' > "$matches_file" 2>/dev/null; then
+  -print0 | xargs -0 grep -nE '(/home/[^[:space:]]+|/Users/[^[:space:]]+|/mnt/[A-Za-z]/[^[:space:]]+|[A-Za-z]:\\[^[:space:]]+)' > "$matches_file" 2>/dev/null; then
   echo "Absolute path violations found:"
   cat "$matches_file"
   exit 1

package/assets/payload/.agents/scripts/check-skill-output-evals.mjs

@@ -0,0 +1,13 @@
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const __filename = fileURLToPath(import.meta.url); const __dirname = path.dirname(__filename);
+const repoRoot = resolveRepoRoot(__dirname);
+const root = path.join(repoRoot, ".agents", "eval-fixtures", "skill-output");
+const errors=[]; let checked=0;
+for (const kind of ["valid","invalid"]) for (const dir of listDirs(path.join(root, kind))) { const fixture=JSON.parse(readFileSync(path.join(root, kind, dir, "output.json"), "utf8")); checked++; const valid=Array.isArray(fixture.evidence) && fixture.evidence.length > 0 && fixture.privacy === "metadata-only"; if (kind === "valid" && !valid) errors.push(`${dir} expected valid skill output`); if (kind === "invalid" && valid) errors.push(`${dir} expected invalid skill output`); }
+if (checked < 2) errors.push("expected at least one valid and one invalid skill output fixture");
+if(errors.length){ console.error("Skill output eval check failed:"); errors.forEach(e=>console.error(`- ${e}`)); process.exit(1); }
+console.log(`Skill output eval check passed for ${checked} fixture(s).`);
+function listDirs(dir){ if(!existsSync(dir)) return []; return readdirSync(dir,{withFileTypes:true}).filter(d=>d.isDirectory()).map(d=>d.name); }
+function resolveRepoRoot(startDir){ for(const c of [path.resolve(startDir,".."),path.resolve(startDir,"..","..")]) if(existsSync(path.join(c,".agents"))) return c; return path.resolve(startDir,".."); }

package/assets/payload/.agents/scripts/check-status-transitions.mjs

@@ -0,0 +1,169 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const repoRoot = resolveRepoRoot(__dirname);
+const contractPath = path.join(repoRoot, ".agents", "schemas", "status-transitions.json");
+const args = process.argv.slice(2);
+const projectsRoot = path.resolve(repoRoot, valueAfter(args, "--projects-root") || path.join(".project", "projects"));
+const errors = [];
+
+const contract = readJson(contractPath, "status transition contract");
+if (contract.schema_version !== 1) {
+  errors.push("status-transitions.json schema_version must be 1.");
+}
+const rules = Array.isArray(contract.task_rules) ? contract.task_rules : [];
+for (const requiredRule of ["ready-dependencies-done", "blocked-owner-check-back"]) {
+  if (!rules.some((rule) => rule.id === requiredRule)) {
+    errors.push(`status transition contract missing rule: ${requiredRule}`);
+  }
+}
+
+const transitionRequest = parseTransitionArgs(args);
+if (transitionRequest) {
+  validateTransitionRequest(transitionRequest);
+  finish();
+}
+
+for (const projectDir of listDirectories(projectsRoot)) {
+  const tasksDir = path.join(projectDir, "tasks");
+  if (!existsSync(tasksDir)) continue;
+
+  const tasks = new Map();
+  for (const taskFile of listMarkdownFiles(tasksDir)) {
+    const frontmatter = parseFrontmatter(taskFile);
+    const id = frontmatter.id || path.basename(taskFile, ".md").split("-").slice(0, 2).join("-");
+    tasks.set(id, { file: taskFile, frontmatter });
+  }
+
+  for (const [taskId, task] of tasks.entries()) {
+    const status = task.frontmatter.status || "";
+    const dependencies = parseList(task.frontmatter.depends_on || "[]");
+
+    if (["ready", "in-progress", "done"].includes(status)) {
+      for (const dependencyId of dependencies) {
+        const dependency = tasks.get(dependencyId);
+        if (!dependency) continue;
+        const dependencyStatus = dependency.frontmatter.status || "";
+        if (dependencyStatus !== "done") {
+          const message = `${toRepoPath(task.file)} has status ${status} but depends on unresolved ${dependencyId} (${dependencyStatus || "missing status"}).`;
+          errors.push(message);
+        }
+      }
+    }
+
+    if (status === "blocked") {
+      for (const field of ["blocked_owner", "blocked_check_back"]) {
+        if (!task.frontmatter[field] || task.frontmatter[field].trim() === "") {
+          errors.push(`${toRepoPath(task.file)} is blocked but missing ${field}.`);
+        }
+      }
+    }
+  }
+}
+
+finish();
+
+function parseTransitionArgs(args) {
+  if (!args.includes("--validate-transition")) return null;
+  const nextStatus = valueAfter(args, "--validate-transition");
+  const dependencyStatuses = valueAfter(args, "--dependency-statuses")
+    .split(",")
+    .map((value) => value.trim())
+    .filter(Boolean);
+  const blockedOwner = valueAfter(args, "--blocked-owner");
+  const blockedCheckBack = valueAfter(args, "--blocked-check-back");
+  return { nextStatus, dependencyStatuses, blockedOwner, blockedCheckBack };
+}
+
+function validateTransitionRequest(request) {
+  if (["ready", "in-progress", "done"].includes(request.nextStatus)) {
+    for (const dependencyStatus of request.dependencyStatuses) {
+      if (dependencyStatus !== "done") {
+        errors.push(`cannot transition to ${request.nextStatus} with unresolved dependency status: ${dependencyStatus}`);
+      }
+    }
+  }
+
+  if (request.nextStatus === "blocked") {
+    if (!request.blockedOwner) errors.push("cannot transition to blocked without blocked_owner");
+    if (!request.blockedCheckBack) errors.push("cannot transition to blocked without blocked_check_back");
+  }
+}
+
+function valueAfter(args, flag) {
+  const index = args.indexOf(flag);
+  if (index === -1 || index === args.length - 1) return "";
+  return args[index + 1];
+}
+
+function finish() {
+  if (errors.length > 0) {
+    console.error("Status transition check failed:");
+    for (const error of errors) console.error(`- ${error}`);
+    process.exit(1);
+  }
+
+  console.log("Status transition check passed for current project tasks.");
+  process.exit(0);
+}
+
+function readJson(filePath, label) {
+  try { return JSON.parse(readFileSync(filePath, "utf8")); }
+  catch (error) { errors.push(`Could not read ${label} at ${toRepoPath(filePath)}: ${error.message}`); return {}; }
+}
+
+function parseFrontmatter(filePath) {
+  const text = readFileSync(filePath, "utf8");
+  const match = text.match(/^---\n([\s\S]*?)\n---\n/);
+  if (!match) {
+    errors.push(`${toRepoPath(filePath)} is missing frontmatter.`);
+    return {};
+  }
+  const result = {};
+  for (const line of match[1].split("\n")) {
+    const index = line.indexOf(":");
+    if (index === -1) continue;
+    result[line.slice(0, index).trim()] = line.slice(index + 1).trim();
+  }
+  return result;
+}
+
+function parseList(raw) {
+  const value = raw.trim();
+  if (!value || value === "[]") return [];
+  if (value.startsWith("[") && value.endsWith("]")) {
+    const inner = value.slice(1, -1).trim();
+    if (!inner) return [];
+    return inner.split(",").map((item) => item.trim().replace(/^['\"]|['\"]$/g, "")).filter(Boolean);
+  }
+  return [value.replace(/^['\"]|['\"]$/g, "")].filter(Boolean);
+}
+
+function listDirectories(root) {
+  if (!existsSync(root)) return [];
+  return readdirSync(root, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => path.join(root, entry.name));
+}
+
+function listMarkdownFiles(root) {
+  if (!existsSync(root)) return [];
+  return readdirSync(root, { withFileTypes: true })
+    .filter((entry) => entry.isFile() && entry.name.endsWith(".md"))
+    .map((entry) => path.join(root, entry.name));
+}
+
+function resolveRepoRoot(startDir) {
+  const candidates = [path.resolve(startDir, ".."), path.resolve(startDir, "..", "..")];
+  for (const candidate of candidates) {
+    if (existsSync(path.join(candidate, ".project", "projects")) && existsSync(path.join(candidate, ".agents"))) return candidate;
+  }
+  return path.resolve(startDir, "..");
+}
+
+function toRepoPath(filePath) {
+  return path.relative(repoRoot, filePath).split(path.sep).join("/");
+}

package/assets/payload/.agents/scripts/check-strict-fixtures.mjs

@@ -0,0 +1,140 @@
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const repoRoot = resolveRepoRoot(__dirname);
+const fixturesRoot = path.join(repoRoot, ".agents", "validation-fixtures", "strict");
+const manifestPath = path.join(fixturesRoot, "manifest.json");
+const errors = [];
+
+const manifest = readJson(manifestPath, "strict fixture manifest");
+const fixtures = Array.isArray(manifest.fixtures) ? manifest.fixtures : [];
+const requiredInvalidRules = new Set(["missing-evidence", "broken-dependencies", "stale-context", "path-leak", "invalid-transition"]);
+
+if (manifest.schema_version !== 1) errors.push("strict fixture manifest schema_version must be 1.");
+if (!fixtures.some((fixture) => fixture.kind === "valid" && fixture.expected === "pass")) {
+  errors.push("strict fixtures must include at least one valid passing project.");
+}
+
+for (const rule of requiredInvalidRules) {
+  if (!fixtures.some((fixture) => fixture.kind === "invalid" && fixture.expected_rule === rule)) {
+    errors.push(`strict fixtures missing invalid fixture for rule: ${rule}`);
+  }
+}
+
+for (const fixture of fixtures) {
+  const fixturePath = path.join(fixturesRoot, fixture.path || "");
+  if (!existsSync(fixturePath)) {
+    errors.push(`fixture path does not exist: ${fixture.path}`);
+    continue;
+  }
+
+  const violations = validateFixture(fixturePath);
+  if (fixture.kind === "valid" && violations.length > 0) {
+    errors.push(`${fixture.name} expected pass but produced violations: ${violations.join(", ")}`);
+  }
+  if (fixture.kind === "invalid" && !violations.includes(fixture.expected_rule)) {
+    errors.push(`${fixture.name} expected rule ${fixture.expected_rule} but produced: ${violations.join(", ") || "none"}`);
+  }
+}
+
+if (errors.length > 0) {
+  console.error("Strict fixture check failed:");
+  for (const error of errors) console.error(`- ${error}`);
+  process.exit(1);
+}
+
+console.log(`Strict fixture check passed for ${fixtures.length} fixtures.`);
+
+function validateFixture(fixturePath) {
+  const violations = new Set();
+  const markdownFiles = listMarkdownFiles(fixturePath);
+  const tasks = new Map();
+
+  for (const file of markdownFiles) {
+    const text = readFileSync(file, "utf8");
+    if (/PATH_LEAK_TOKEN\(/.test(text) || /\/home\/[^\s)]+/.test(text) || /\/Users\/[^\s)]+/.test(text) || /\/mnt\/[A-Za-z]\/[^\s)]+/.test(text) || /[A-Z]:\\Users\\[^\s)]+/i.test(text)) violations.add("path-leak");
+    const frontmatter = parseFrontmatter(text);
+    if (frontmatter.id && frontmatter.status) tasks.set(frontmatter.id, { file, text, frontmatter });
+    if (frontmatter.review_by && Date.parse(frontmatter.review_by) < Date.parse("2026-04-29T00:00:00Z")) violations.add("stale-context");
+  }
+
+  for (const task of tasks.values()) {
+    const fm = task.frontmatter;
+    const dependencies = parseList(fm.depends_on || "[]");
+    if (["ready", "in-progress", "done"].includes(fm.status)) {
+      for (const dependencyId of dependencies) {
+        const dependency = tasks.get(dependencyId);
+        if (dependency && dependency.frontmatter.status !== "done") violations.add("broken-dependencies");
+      }
+    }
+    if (fm.status === "blocked" && (!fm.blocked_owner || !fm.blocked_check_back)) violations.add("invalid-transition");
+    if (fm.status === "done") {
+      const acceptance = section(task.text, "Acceptance Criteria");
+      const evidence = section(task.text, "Evidence Log");
+      if (acceptance.includes("- [ ]") || !/^- \d{4}-\d{2}-\d{2}.*(validation passed|Validation:|passed:)/im.test(evidence)) {
+        violations.add("missing-evidence");
+      }
+    }
+  }
+
+  return [...violations].sort();
+}
+
+function parseFrontmatter(text) {
+  const match = text.match(/^---\n([\s\S]*?)\n---\n/);
+  if (!match) return {};
+  const result = {};
+  for (const line of match[1].split("\n")) {
+    const index = line.indexOf(":");
+    if (index === -1) continue;
+    result[line.slice(0, index).trim()] = line.slice(index + 1).trim();
+  }
+  return result;
+}
+
+function parseList(raw) {
+  const value = raw.trim();
+  if (!value || value === "[]") return [];
+  if (value.startsWith("[") && value.endsWith("]")) {
+    return value.slice(1, -1).split(",").map((item) => item.trim().replace(/^['\"]|['\"]$/g, "")).filter(Boolean);
+  }
+  return [value.replace(/^['\"]|['\"]$/g, "")].filter(Boolean);
+}
+
+function section(text, heading) {
+  const lines = text.split("\n");
+  const start = lines.findIndex((line) => line.trim() === `## ${heading}`);
+  if (start === -1) return "";
+  const collected = [];
+  for (const line of lines.slice(start + 1)) {
+    if (line.startsWith("## ")) break;
+    collected.push(line);
+  }
+  return collected.join("\n").trim();
+}
+
+function listMarkdownFiles(root) {
+  const files = [];
+  for (const entry of readdirSync(root, { withFileTypes: true })) {
+    const fullPath = path.join(root, entry.name);
+    if (entry.isDirectory()) files.push(...listMarkdownFiles(fullPath));
+    if (entry.isFile() && entry.name.endsWith(".md")) files.push(fullPath);
+  }
+  return files;
+}
+
+function readJson(filePath, label) {
+  try { return JSON.parse(readFileSync(filePath, "utf8")); }
+  catch (error) { errors.push(`Could not read ${label}: ${error.message}`); return {}; }
+}
+
+function resolveRepoRoot(startDir) {
+  const candidates = [path.resolve(startDir, ".."), path.resolve(startDir, "..", "..")];
+  for (const candidate of candidates) {
+    if (existsSync(path.join(candidate, ".agents")) && existsSync(path.join(candidate, ".project"))) return candidate;
+  }
+  return path.resolve(startDir, "..");
+}