@cleocode/cleo 2026.10.3 → 2026.10.4

package/dist/cli/check-RWJLBCI2.js

@@ -0,0 +1,907 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  getOperationParams,
+  paramsToCittyArgs
+} from "./chunk-W33Q3FBH.js";
+import {
+  negatedFlag
+} from "./chunk-47JYZAMS.js";
+import {
+  defineCommand,
+  showUsage
+} from "./chunk-PKKZPOOP.js";
+import {
+  dispatchFromCli
+} from "./chunk-3IOQVUO7.js";
+import "./chunk-AWCQH2W5.js";
+import "./chunk-OGV57L4J.js";
+import "./chunk-ZBISIPCK.js";
+import {
+  cliError
+} from "./chunk-3ZO3M37V.js";
+import "./chunk-6JSJNYH2.js";
+import "./chunk-QFFQSKRC.js";
+
+// packages/cleo/src/cli/commands/check.ts
+import { formatPrGateSummary, runPrGate } from "@cleocode/core/internal";
+function emitPrGateSummary(summary) {
+  const envelope = {
+    success: summary.passed,
+    data: {
+      passed: summary.passed,
+      summary: summary.summary,
+      gates: summary.gates,
+      repoRoot: summary.repoRoot
+    },
+    meta: { operation: "check.pr", timestamp: (/* @__PURE__ */ new Date()).toISOString() }
+  };
+  process.stdout.write(`${JSON.stringify(envelope)}
+`);
+  process.stderr.write(`${formatPrGateSummary(summary)}
+`);
+}
+var SUPPORTED_PROTOCOL_TYPES = [
+  "research",
+  "consensus",
+  "architecture-decision",
+  "specification",
+  "decomposition",
+  "implementation",
+  "contribution",
+  "validation",
+  "testing",
+  "release",
+  "artifact-publish",
+  "provenance"
+];
+var checkSchemaCommand = defineCommand({
+  meta: {
+    name: "schema",
+    description: "Validate schema (type: todo, config, archive, log, sessions)"
+  },
+  args: paramsToCittyArgs(getOperationParams("query", "check", "schema")),
+  async run({ args }) {
+    await dispatchFromCli(
+      "query",
+      "check",
+      "schema",
+      { type: args["type"] },
+      { command: "check" }
+    );
+  }
+});
+var checkCoherenceCommand = defineCommand({
+  meta: { name: "coherence", description: "Run coherence check across task data" },
+  async run() {
+    await dispatchFromCli("query", "check", "coherence", {}, { command: "check" });
+  }
+});
+var checkTaskCommand = defineCommand({
+  meta: { name: "task", description: "Validate a specific task" },
+  args: { taskId: { type: "positional", description: "Task ID to validate", required: true } },
+  async run({ args }) {
+    await dispatchFromCli(
+      "query",
+      "check",
+      "task",
+      { taskId: args.taskId },
+      { command: "check" }
+    );
+  }
+});
+var checkOutputCommand = defineCommand({
+  meta: {
+    name: "output",
+    description: "Validate an agent output file against the manifest schema"
+  },
+  args: {
+    filePath: { type: "positional", description: "Path to agent output file", required: true },
+    "task-id": { type: "string", description: "Task ID the output file belongs to" }
+  },
+  async run({ args }) {
+    await dispatchFromCli(
+      "query",
+      "check",
+      "output",
+      { filePath: args.filePath, taskId: args["task-id"] },
+      { command: "check", operation: "check.output" }
+    );
+  }
+});
+var checkCanonDocsCommand = defineCommand({
+  meta: {
+    name: "docs",
+    description: "CI gate: block raw *.md writes that bypass the docs SSoT (T9796)"
+  },
+  args: {
+    base: {
+      type: "string",
+      description: "Git ref to diff against (default: origin/main)"
+    }
+  },
+  async run({ args }) {
+    await dispatchFromCli(
+      "query",
+      "check",
+      "canon.docs",
+      { baseRef: args.base },
+      { command: "check", operation: "check.canon.docs" }
+    );
+  }
+});
+var checkCanonCommand = defineCommand({
+  meta: { name: "canon", description: "CI gate: detect canon drift between docs and live code" },
+  subCommands: {
+    docs: checkCanonDocsCommand
+  },
+  async run({ cmd, rawArgs }) {
+    const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
+    if (firstArg && cmd.subCommands && firstArg in cmd.subCommands) return;
+    await dispatchFromCli("query", "check", "canon", {}, { command: "check" });
+  }
+});
+var checkProtocolCommand = defineCommand({
+  meta: {
+    name: "protocol",
+    description: `Validate any of the 12 RCASD-IVTR+C protocols: ${SUPPORTED_PROTOCOL_TYPES.join(", ")}`
+  },
+  args: {
+    protocolType: {
+      type: "positional",
+      description: "Protocol type to validate",
+      required: true
+    },
+    "task-id": { type: "string", description: "Task ID to validate (mode=task, default)" },
+    "manifest-file": { type: "string", description: "Manifest file to validate (mode=manifest)" },
+    strict: { type: "boolean", description: "Exit with error code on violations" },
+    "voting-matrix-file": { type: "string", description: "consensus: voting matrix JSON file" },
+    "epic-id": { type: "string", description: "decomposition: parent epic ID" },
+    "sibling-count": { type: "string", description: "decomposition: actual sibling count" },
+    "max-siblings": { type: "string", description: "decomposition: configured max siblings" },
+    "spec-file": { type: "string", description: "specification: path to spec markdown" },
+    "has-code-changes": {
+      type: "boolean",
+      description: "research: code changes detected (forbidden)"
+    },
+    "has-task-tags": {
+      type: "boolean",
+      description: "implementation: @task tags present in code"
+    },
+    "has-contribution-tags": {
+      type: "boolean",
+      description: "contribution: @contribution tags present"
+    },
+    version: { type: "string", description: "release: target version (semver/calver)" },
+    "has-changelog": { type: "boolean", description: "release: changelog updated" },
+    "artifact-type": {
+      type: "string",
+      description: "artifact-publish: artifact handler (npm-package, docker-image, ...)"
+    },
+    "build-passed": { type: "boolean", description: "artifact-publish: build step succeeded" },
+    "has-attestation": {
+      type: "boolean",
+      description: "provenance: in-toto attestation generated"
+    },
+    "has-sbom": {
+      type: "boolean",
+      description: "provenance: SBOM (CycloneDX/SPDX) generated"
+    },
+    "adr-content": { type: "string", description: "ADR: ADR markdown body for section check" },
+    status: {
+      type: "string",
+      description: "ADR: lifecycle status (proposed|accepted|superseded|deprecated)"
+    },
+    "hitl-reviewed": { type: "boolean", description: "ADR: HITL review completed" },
+    "downstream-flagged": {
+      type: "boolean",
+      description: "ADR: downstream artifacts flagged for review"
+    },
+    "persisted-in-db": {
+      type: "boolean",
+      description: "ADR: persisted in canonical decisions table"
+    },
+    "spec-match-confirmed": {
+      type: "boolean",
+      description: "validation: implementation matches spec"
+    },
+    "test-suite-passed": {
+      type: "boolean",
+      description: "validation: existing test suite passed"
+    },
+    "protocol-compliance-checked": {
+      type: "boolean",
+      description: "validation: upstream protocols checked"
+    },
+    framework: { type: "string", description: "testing: detected test framework" },
+    "tests-run": { type: "string", description: "testing: total tests executed" },
+    "tests-passed": { type: "string", description: "testing: tests that passed" },
+    "tests-failed": { type: "string", description: "testing: tests that failed" },
+    "coverage-percent": { type: "string", description: "testing: coverage percentage" },
+    "coverage-threshold": { type: "string", description: "testing: configured coverage threshold" },
+    "ivt-loop-converged": { type: "boolean", description: "testing: IVT loop converged on spec" },
+    "ivt-loop-iterations": { type: "string", description: "testing: IVT iteration count" }
+  },
+  async run({ args }) {
+    const protocolType = args.protocolType;
+    if (!SUPPORTED_PROTOCOL_TYPES.includes(protocolType)) {
+      cliError(
+        `Unknown protocol type "${protocolType}". Supported: ${SUPPORTED_PROTOCOL_TYPES.join(", ")}`,
+        2,
+        {
+          name: "E_VALIDATION",
+          fix: `Use one of: ${SUPPORTED_PROTOCOL_TYPES.join(", ")}`
+        }
+      );
+      process.exit(2);
+    }
+    const mode = args["manifest-file"] ? "manifest" : "task";
+    await dispatchFromCli(
+      "query",
+      "check",
+      "protocol",
+      {
+        protocolType,
+        mode,
+        taskId: args["task-id"],
+        manifestFile: args["manifest-file"],
+        strict: args.strict,
+        votingMatrixFile: args["voting-matrix-file"],
+        epicId: args["epic-id"],
+        siblingCount: args["sibling-count"] !== void 0 ? Number.parseInt(args["sibling-count"], 10) : void 0,
+        maxSiblings: args["max-siblings"] !== void 0 ? Number.parseInt(args["max-siblings"], 10) : void 0,
+        specFile: args["spec-file"],
+        hasCodeChanges: args["has-code-changes"],
+        hasTaskTags: args["has-task-tags"],
+        hasContributionTags: args["has-contribution-tags"],
+        version: args.version,
+        hasChangelog: args["has-changelog"],
+        artifactType: args["artifact-type"],
+        buildPassed: args["build-passed"],
+        hasAttestation: args["has-attestation"],
+        hasSbom: args["has-sbom"],
+        adrContent: args["adr-content"],
+        status: args.status,
+        hitlReviewed: args["hitl-reviewed"],
+        downstreamFlagged: args["downstream-flagged"],
+        persistedInDb: args["persisted-in-db"],
+        specMatchConfirmed: args["spec-match-confirmed"],
+        testSuitePassed: args["test-suite-passed"],
+        protocolComplianceChecked: args["protocol-compliance-checked"],
+        framework: args.framework,
+        testsRun: args["tests-run"] !== void 0 ? Number.parseInt(args["tests-run"], 10) : void 0,
+        testsPassed: args["tests-passed"] !== void 0 ? Number.parseInt(args["tests-passed"], 10) : void 0,
+        testsFailed: args["tests-failed"] !== void 0 ? Number.parseInt(args["tests-failed"], 10) : void 0,
+        coveragePercent: args["coverage-percent"] !== void 0 ? Number.parseFloat(args["coverage-percent"]) : void 0,
+        coverageThreshold: args["coverage-threshold"] !== void 0 ? Number.parseFloat(args["coverage-threshold"]) : void 0,
+        ivtLoopConverged: args["ivt-loop-converged"],
+        ivtLoopIterations: args["ivt-loop-iterations"] !== void 0 ? Number.parseInt(args["ivt-loop-iterations"], 10) : void 0
+      },
+      { command: "check" }
+    );
+  }
+});
+var checkProvenanceCommand = defineCommand({
+  meta: {
+    name: "provenance",
+    description: "Audit git log for commits missing a Task ID (T####)"
+  },
+  args: {
+    since: {
+      type: "string",
+      description: 'Git revision range start (e.g. "v2026.5.0", "HEAD~50", "main")'
+    },
+    branch: {
+      type: "string",
+      description: "Branch to audit (default: HEAD)"
+    },
+    strict: {
+      type: "boolean",
+      description: "Exit with code 1 if any untagged commits are found"
+    },
+    limit: {
+      type: "string",
+      description: "Maximum number of commits to audit (default: 200)"
+    }
+  },
+  async run({ args }) {
+    const { execSync } = await import("node:child_process");
+    const since = args.since;
+    const branch = args.branch || "HEAD";
+    const strict = Boolean(args.strict);
+    const limit = args.limit ? Number.parseInt(args.limit, 10) : 200;
+    const range = since ? `${since}..${branch}` : branch;
+    let logOutput;
+    try {
+      logOutput = execSync(`git log --no-merges --pretty=format:"%H	%s" -n ${limit} ${range}`, {
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      cliError(`git log failed: ${message}`, 1, {
+        name: "E_GIT_LOG",
+        fix: "Ensure you are inside a git repository and the range is valid."
+      });
+      process.exit(1);
+    }
+    const lines = logOutput.trim().split("\n").filter(Boolean);
+    const TASK_ID_RE = /T[0-9]+/;
+    const EXEMPT_RE = /^(Merge |Revert |fixup! |squash! |amend! )/;
+    const untagged = [];
+    const total = lines.length;
+    for (const line of lines) {
+      const tabIdx = line.indexOf("	");
+      if (tabIdx < 0) continue;
+      const sha = line.slice(0, tabIdx).trim();
+      const subject = line.slice(tabIdx + 1).trim();
+      if (EXEMPT_RE.test(subject)) continue;
+      if (!TASK_ID_RE.test(subject)) {
+        untagged.push({ sha: sha.slice(0, 12), subject });
+      }
+    }
+    const tagged = total - untagged.length;
+    const result = {
+      success: true,
+      data: {
+        audited: total,
+        tagged,
+        untagged: untagged.length,
+        untaggedCommits: untagged,
+        range,
+        passed: untagged.length === 0
+      },
+      meta: { operation: "check.provenance" }
+    };
+    process.stdout.write(`${JSON.stringify(result)}
+`);
+    if (strict && untagged.length > 0) {
+      process.stderr.write(
+        `[provenance] ${untagged.length} of ${total} audited commits lack a Task ID.
+`
+      );
+      process.exit(1);
+    }
+  }
+});
+var checkArchCommand = defineCommand({
+  meta: {
+    name: "arch",
+    description: "Run all 5 SG-ARCH-SOLID architectural lint gates and emit a LAFS envelope (T9837)"
+  },
+  args: {
+    strict: {
+      type: "boolean",
+      description: "Fail even if gates are in baseline mode (passes --strict to each script)"
+    },
+    json: {
+      type: "boolean",
+      description: "Emit JSON envelope only (no human output)"
+    }
+  },
+  async run({ args }) {
+    const { spawnSync } = await import("node:child_process");
+    const { existsSync } = await import("node:fs");
+    const { join, resolve } = await import("node:path");
+    const strict = Boolean(args.strict);
+    const jsonOnly = Boolean(args.json);
+    const repoRoot = resolve(process.cwd());
+    const gates = [
+      {
+        id: "gate-1",
+        task: "T9837a",
+        script: "scripts/lint-no-raw-define-command.mjs",
+        description: "No defineCommand() outside cli/lib factory"
+      },
+      {
+        id: "gate-2",
+        task: "T9837b",
+        script: "scripts/lint-no-direct-db-open.mjs",
+        description: "No DatabaseSync outside core/store"
+      },
+      {
+        id: "gate-3",
+        task: "T9837c",
+        script: "scripts/lint-contracts-fan-out.mjs",
+        description: "No inline types imported by >2 files"
+      },
+      {
+        id: "gate-4",
+        task: "T9837d",
+        script: "scripts/lint-no-ssot-exempt.mjs",
+        description: "No SSoT-EXEMPT without linked task ID"
+      },
+      {
+        id: "gate-5",
+        task: "T9837e",
+        script: "scripts/lint-cli-package-boundary.mjs",
+        description: "No business-logic helper > 30 LOC in CLI commands"
+      },
+      {
+        id: "gate-6",
+        task: "T11640",
+        script: "scripts/lint-no-bare-get-active-session.mjs",
+        description: "No NEW bare getActiveSession() callsites (use resolveCurrentSession)"
+        // get-active-session-allowed: gate description string, not a callsite
+      },
+      {
+        id: "gate-7",
+        task: "T12041",
+        script: "scripts/lint-no-domain-db-singleton.mjs",
+        description: "No NEW per-domain DB singleton cache (bind via the ProjectStore/GlobalStore ports)"
+      },
+      {
+        // T12087: zero-tolerance. An unbounded fork pool froze this machine
+        // twice, and it only ever bites locally — CI runners have 2-4 cores, so
+        // the unsafe default passes there and takes down the developer instead.
+        id: "gate-8",
+        task: "T12087",
+        script: "scripts/lint-vitest-memory-safe.mjs",
+        description: "Every vitest config spreads the memory-safe fork bounds (workers + heap cap)"
+      },
+      {
+        // T12076: ratchet, not zero-tolerance. 106 static core-barrel imports
+        // force the full 1266-module @cleocode/core graph to load before any
+        // command runs (measured: 2.54 s for the barrel vs 0.12 s for a deep
+        // module). Converting them one at a time produced an
+        // EnvironmentTeardownError, so the count is allowed to fall but never
+        // rise, and the measurement travels with the gate.
+        id: "gate-10",
+        task: "T12076",
+        script: "scripts/lint-cli-startup-barrel-imports.mjs",
+        description: "No NEW static @cleocode/core barrel import in the CLI (startup cost)"
+      },
+      {
+        // T12093: zero-tolerance. `release-prepare.yml` invoked two commands
+        // that never existed (`cleo version-bump`, `cleo release changelog`),
+        // each discovered only after a full ~20-minute green preflight — and
+        // the same break shipped in the template every consuming project
+        // renders. A manifest read answers it in 200 ms.
+        id: "gate-9",
+        task: "T12093",
+        script: "scripts/lint-workflow-cleo-commands.mjs",
+        description: "Every `cleo` command invoked by a workflow (or its template) exists"
+      },
+      // ---------------------------------------------------------------------
+      // T12122 (GH #1251): the nine gates below were documented in AGENTS.md's
+      // gate table but were NEVER bundled here, so `cleo check arch` reported
+      // a green that covered 10 of the 15 documented gates. Every agent is
+      // told to run this command to self-check before pushing, so the command
+      // silently covering two-thirds of its own documentation is the same
+      // defect class as a filter that is accepted and not applied.
+      //
+      // All nine were measured before bundling: none needs a build, network
+      // access, or non-trivial time (~800 ms for all nine combined), so there
+      // was no reason for the omission and nothing has to be skipped.
+      // ---------------------------------------------------------------------
+      {
+        id: "gate-11",
+        task: "T9802",
+        script: "scripts/lint-paths-ssot.mjs",
+        description: "env-paths / XDG_DATA_HOME / worktree path strings live in packages/paths only"
+      },
+      {
+        id: "gate-12",
+        task: "T9860",
+        script: "scripts/lint-deployed-template-parity.mjs",
+        description: ".github/workflows/* matches the rendered core workflow templates"
+      },
+      {
+        id: "gate-13",
+        task: "T11281",
+        script: "scripts/lint-node-engine-ssot.mjs",
+        description: "Every package engines.node equals the root floor"
+      },
+      {
+        id: "gate-14",
+        task: "T11400",
+        script: "scripts/lint-publish-surface.mjs",
+        description: "release.yml publish_pkg list is the npm publish SSoT"
+      },
+      {
+        id: "gate-15",
+        task: "T11418",
+        script: "scripts/lint-no-runtime-in-contracts.mjs",
+        description: "packages/contracts is types-only (no net-new runtime helper)"
+      },
+      {
+        id: "gate-16",
+        task: "T11409",
+        script: "scripts/lint-tools-vs-skills-boundary.mjs",
+        description: "Atomic tool primitives are defined only in their home packages"
+      },
+      {
+        id: "gate-17",
+        task: "T11389",
+        script: "scripts/lint-no-crate-publish.mjs",
+        description: "Every crate declares publish = false (zero crates.io)"
+      },
+      {
+        id: "gate-18",
+        task: "T11783",
+        script: "scripts/lint-llm-chokepoint.mjs",
+        description: "LLM resolution + client/transport construction stay in the chokepoint"
+      },
+      {
+        id: "gate-19",
+        task: "T12069",
+        script: "scripts/lint-injection-commands.mjs",
+        description: "Every `cleo` command named in CLEO-INJECTION.md exists"
+      },
+      {
+        // T12122: the gate on the gates. Without it, this list and the
+        // AGENTS.md table drift apart again the moment someone adds one and
+        // not the other — which is exactly how the 10-vs-15 split happened.
+        id: "gate-20",
+        task: "T12122",
+        script: "scripts/lint-arch-gate-parity.mjs",
+        description: "The bundled gate list and the AGENTS.md gate table are the same set"
+      },
+      {
+        // gh#1283: some tables live in BOTH cleo.db scopes, and nexus ATTACHes
+        // the global file onto the shared project handle. A bare name then
+        // resolves by SQLite search order and answers without saying which
+        // file it read. Narrow by design — qualifying EVERYTHING would break
+        // the nexus registry fall-through that depends on bare names.
+        id: "gate-21",
+        task: "T12156",
+        script: "scripts/lint-dual-scope-unqualified-reads.mjs",
+        description: "No unqualified SQL reads of tables resident in both cleo.db scopes"
+      },
+      {
+        // gh#1223: every module reaching the AI SDK can emit on stdout via
+        // `ai@6`'s console.info banner. An INVENTORY rather than a per-module
+        // rule — the guard is installed once at the envelope funnel by design.
+        id: "gate-22",
+        task: "T12169",
+        script: "scripts/lint-ai-sdk-surface.mjs",
+        description: "No unreviewed module reaches the AI SDK at runtime"
+      },
+      {
+        // T12308: gate 14 checks the injection TEMPLATE and gate 15 the
+        // workflow `run:` blocks. The third agent-facing surface is the one
+        // CLEO GENERATES — the spawn prompt — and nothing checked it. It had
+        // been telling every validation-stage agent to run `cleo verify <id>
+        // --run` after that flag was dropped, and every orchestrated agent to
+        // pass `cleo conduit subscribe --topicName`, which is not the flag.
+        id: "gate-23",
+        task: "T12308",
+        script: "scripts/lint-agent-prompt-commands.mjs",
+        description: "Every `cleo` invocation CLEO writes into an agent prompt exists and is runnable"
+      },
+      {
+        // T12382: the only `.cant` parser users received was a committed
+        // linux-x64 binary; every other OS threw. A committed binary also
+        // goes stale silently (the committed lafs-napi one already rejects
+        // every real envelope). Binaries are built by CI and staged at
+        // release, so none may be tracked.
+        id: "gate-24",
+        task: "T12382",
+        script: "scripts/lint-no-committed-native-binaries.mjs",
+        description: "No native .node/.wasm binary is committed (built by CI, staged at release)"
+      },
+      {
+        // T12455 (salvaged from T12138 / gh#1207): SCOPE differs from gate 19
+        // deliberately. Gate 19 ratchets a repo-wide count (may fall, never
+        // rise); this permits ZERO across the modules reachable from the CLI
+        // entrypoint's static import graph, because those are paid on EVERY
+        // invocation including `cleo --version` — one import was 87% of CLI
+        // startup. Neither subsumes the other; the filenames carry the split.
+        id: "gate-25",
+        task: "T12455",
+        script: "scripts/lint-cli-startup-barrel-entrypoint.mjs",
+        description: "No module reachable from the CLI entrypoint statically imports a core barrel"
+      },
+      {
+        // T12528: citty parses `--no-<name>` as `{ <name>: false }`, never as
+        // `{ 'no-<name>': true }`, so a handler reading `args['no-<name>']`
+        // silently ignores the flag. Sixteen handlers did, including
+        // `orchestrate spawn --no-worktree` and `release plan --no-changelog`.
+        // Every read goes through `negatedFlag()` in cli/lib/negated-flag.ts.
+        id: "gate-26",
+        task: "T12528",
+        script: "scripts/lint-no-negated-flag-reads.mjs",
+        description: "No raw args['no-<flag>'] read in the CLI (citty never sets it)"
+      },
+      {
+        // T12483: the owner rule that every human decision goes through the
+        // harness ask tool with options (never prose; subagents relay to the
+        // orchestrator) must reach every surface an agent reads: the injected
+        // template, the ct-cleo / ct-orchestrator skills, and the spawn-prompt
+        // return contract emitted at every tier.
+        id: "gate-27",
+        task: "T12483",
+        script: "scripts/lint-hitl-rule-delivery.mjs",
+        description: "HITL ask-tool rule present on every agent delivery surface"
+      },
+      {
+        // T12332 (Gate A): every cleo.db table now carries a replication
+        // class, and replication captures writes at the chokepoint
+        // (openDualScopeDb and the canonical accessors, which are exempt). A
+        // raw INSERT/UPDATE/DELETE/REPLACE elsewhere is a write nobody can
+        // enumerate. A ratchet: today's offenders are baselined per
+        // (file, table), a new one fails, and a removed one must leave the
+        // baseline in the same change.
+        id: "gate-28",
+        task: "T12332",
+        script: "scripts/lint-no-raw-table-writes.mjs",
+        description: "No new raw SQL write on a classified cleo.db table (ratchet)"
+      },
+      {
+        // T12648: SKILL.md frontmatter is the skills metadata SSoT (D11157).
+        // The manifest is generated from it, so a hand-edited version, a
+        // directory the manifest omits, or an entry with no directory fails.
+        id: "gate-29",
+        task: "T12648",
+        script: "scripts/lint-skills-manifest.mjs",
+        description: "Skills manifest generated from valid SKILL.md frontmatter"
+      },
+      {
+        // T12648: a skill named by stage guidance, the spawn prompt or a
+        // .cant protocol must exist, be declared install: harness and be
+        // installed; metadata.install must match what install does.
+        id: "gate-30",
+        task: "T12648",
+        script: "scripts/lint-emitted-skills.mjs",
+        description: "Every skill code emits is installable (ratchet)"
+      },
+      {
+        // T12649: gate 14's command/flag rules applied to every canonical
+        // skill. Core-tier skills are zero-tolerance; others ratchet.
+        id: "gate-31",
+        task: "T12649",
+        script: "scripts/lint-skill-commands.mjs",
+        description: "Every cleo command a skill teaches exists and is runnable"
+      },
+      {
+        // T12124 (gh#1256): skills declare the code they document in
+        // metadata.covers. Here: every core/LOOM skill declares live covers;
+        // CI adds the PR diff check (--base).
+        id: "gate-32",
+        task: "T12124",
+        script: "scripts/lint-skill-coverage.mjs",
+        description: "Skills declare live metadata.covers (PR diff checked in CI)"
+      },
+      {
+        // T9148 / T12124: ct-cleo stays a thin pointer — ratcheted.
+        id: "gate-33",
+        task: "T12124",
+        script: "scripts/check-ct-cleo-thin.mjs",
+        description: "ct-cleo SKILL.md does not grow (thin-pointer ratchet)"
+      },
+      {
+        // T12704: an ES module has no `require`. A bare `require()` throws
+        // under Node while vitest supplies one, so tests stay green and the
+        // shipped build fails, usually inside a swallowing `try`: the docs
+        // audit wrote nothing, two doctor checks never ran, and no
+        // .worktreeinclude glob ever copied.
+        id: "gate-34",
+        task: "T12704",
+        script: "scripts/lint-no-esm-bare-require.mjs",
+        description: "No bare require() in ESM package sources"
+      },
+      {
+        // T12663: every model call site is a registered decision site
+        // (spec system-one-integration §3.5, D11158): decide()/askSiteDecision
+        // name a registry id, LLM entry points live in registered files of a
+        // generative/agent rung, a System One site runs `on` only with go-live
+        // evidence, and chokepoint bypasses are baselined per file.
+        id: "gate-35",
+        task: "T12663",
+        script: "scripts/lint-model-call-sites.mjs",
+        description: "Every model call site is a registered decision site (ratchet)"
+      },
+      {
+        // T12819 / T12827 (journal spec §2.3a, §3.5 Rule 4): nothing drops
+        // cleo_trigger_suspend; only dropSyncMachinery drops _sync_* tables;
+        // migrations never mention capture triggers; forward-only migration
+        // rules (owned triggers carry the suspension clause, deterministic
+        // DML, no parent DELETE in a rebuild file); released migration files
+        // are byte-identical to the base ref (#1719).
+        id: "gate-36",
+        task: "T12819",
+        script: "scripts/lint-sync-schema.mjs",
+        description: "Change-journal schema rules (suspend table, migrations)"
+      },
+      {
+        // T12897: every syncing cleo.db table is declared in ROW_IDENTITY or
+        // exempt with a reason and a task in ROW_IDENTITY_EXEMPT; a stale
+        // exemption (table gone, no longer syncing, or declared) fails too.
+        // The fresh-store check is store/__tests__/row-identity-gate.test.ts.
+        id: "gate-37",
+        task: "T12897",
+        script: "scripts/lint-row-identity-coverage.mjs",
+        description: "Every syncing cleo.db table has declared row identity or an exemption"
+      },
+      {
+        // T12881: the raw sync applier never runs TypeScript write paths, so
+        // every rejection site on a synced write path is tagged
+        // `// @sync-invariant <id>` (contracts sync-write-invariants
+        // registry) or an escape with a reason. Untagged sites are baselined
+        // per (file, symbol, code); the baseline only shrinks. Registry
+        // closure: tables classified, triggers created by migrations, no
+        // dead gates (spec t12859 §3.6.7).
+        id: "gate-38",
+        task: "T12881",
+        script: "scripts/lint-sync-write-invariants.mjs",
+        description: "Every synced-write rejection site is classified (ratchet)"
+      },
+      {
+        // T13126: gates 19 and 25 read the CLI SOURCE graph, and stayed green
+        // while every `cleo` call evaluated all of CORE: the unsplit esbuild
+        // bundle hoisted each lazy `import()`'s externals to static imports.
+        // This gate measures the BUILT CLI instead: the entry's static graph
+        // must not import a barrel, and `--version`, `--help` and `show` run in
+        // a throwaway sandbox under module-count budgets (the ratchet) and RSS
+        // ceilings. Needs a current `pnpm run build`; a missing or stale build
+        // fails rather than measuring code that is no longer there.
+        id: "gate-39",
+        task: "T13126",
+        script: "scripts/check-cli-startup-graph.mjs",
+        description: "Built CLI startup graph and per-command module budgets (ratchet)"
+      }
+    ];
+    const scriptArgs = strict ? ["--strict"] : ["--check"];
+    const results = [];
+    let anyFailed = false;
+    for (const gate of gates) {
+      const scriptPath = join(repoRoot, gate.script);
+      if (!existsSync(scriptPath)) {
+        results.push({
+          id: gate.id,
+          task: gate.task,
+          script: gate.script,
+          description: gate.description,
+          status: "skipped",
+          exitCode: null,
+          stdout: "",
+          stderr: `Script not yet created (task ${gate.task} pending).`
+        });
+        continue;
+      }
+      const result = spawnSync("node", [scriptPath, ...scriptArgs], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        cwd: repoRoot
+      });
+      const passed = result.status === 0;
+      if (!passed) anyFailed = true;
+      results.push({
+        id: gate.id,
+        task: gate.task,
+        script: gate.script,
+        description: gate.description,
+        status: passed ? "pass" : "fail",
+        exitCode: result.status,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? ""
+      });
+    }
+    const passCount = results.filter((r) => r.status === "pass").length;
+    const failCount = results.filter((r) => r.status === "fail").length;
+    const skipCount = results.filter((r) => r.status === "skipped").length;
+    const envelope = {
+      success: !anyFailed,
+      data: {
+        saga: "T9831",
+        epic: "T9837",
+        mode: strict ? "strict" : "baseline",
+        summary: { pass: passCount, fail: failCount, skipped: skipCount, total: gates.length },
+        gates: results,
+        passed: !anyFailed
+      },
+      meta: {
+        operation: "check.arch",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    };
+    process.stdout.write(`${JSON.stringify(envelope)}
+`);
+    if (!jsonOnly) {
+      process.stderr.write(`
+`);
+      process.stderr.write(`SG-ARCH-SOLID Architectural Boundary Check (T9837)
+`);
+      process.stderr.write(`${"\u2500".repeat(52)}
+`);
+      for (const r of results) {
+        const icon = r.status === "pass" ? "PASS" : r.status === "fail" ? "FAIL" : "SKIP";
+        process.stderr.write(`  [${icon}] ${r.id} (${r.task}) \u2014 ${r.description}
+`);
+        if (r.status === "fail" && r.stderr.trim()) {
+          const lines = r.stderr.trim().split("\n").slice(0, 3);
+          for (const line of lines) {
+            process.stderr.write(`         ${line}
+`);
+          }
+        }
+        if (r.status === "skipped") {
+          process.stderr.write(`         ${r.stderr.trim()}
+`);
+        }
+      }
+      process.stderr.write(`${"\u2500".repeat(52)}
+`);
+      process.stderr.write(
+        `  Result: ${passCount} passed, ${failCount} failed, ${skipCount} skipped
+`
+      );
+      process.stderr.write(`
+`);
+    }
+    if (anyFailed) process.exit(1);
+  }
+});
+var checkPrCommand = defineCommand({
+  meta: {
+    name: "pr",
+    description: "Run the CI required-gates locally and report one pass/fail summary (T11956)"
+  },
+  args: {
+    full: {
+      type: "boolean",
+      description: "Also run the complete standalone-lint surface (slower, exhaustive)"
+    },
+    only: {
+      type: "string",
+      description: 'Comma-separated gate ids to run (e.g. "biome,typecheck,test")'
+    },
+    "memory-max": {
+      type: "string",
+      description: "MemoryMax for cgroup-capped heavy gates on Linux (default: 16G)"
+    },
+    "no-keep-going": {
+      type: "boolean",
+      description: "Stop at the first failing gate instead of running them all"
+    }
+  },
+  async run({ args }) {
+    const onlyRaw = args.only;
+    const summary = runPrGate({
+      full: Boolean(args.full),
+      only: onlyRaw ? onlyRaw.split(",").map((s) => s.trim()).filter(Boolean) : void 0,
+      memoryMax: args["memory-max"],
+      keepGoing: !negatedFlag(args, "keep-going"),
+      onProgress: (line) => process.stderr.write(`${line}
+`)
+    });
+    emitPrGateSummary(summary);
+    if (!summary.passed) process.exit(1);
+  }
+});
+var checkCommand = defineCommand({
+  meta: { name: "check", description: "Validation and compliance checks" },
+  subCommands: {
+    schema: checkSchemaCommand,
+    coherence: checkCoherenceCommand,
+    task: checkTaskCommand,
+    output: checkOutputCommand,
+    canon: checkCanonCommand,
+    protocol: checkProtocolCommand,
+    provenance: checkProvenanceCommand,
+    arch: checkArchCommand,
+    pr: checkPrCommand
+  },
+  async run({ cmd, rawArgs }) {
+    const firstArg = rawArgs?.find((a) => !a.startsWith("-"));
+    if (firstArg && cmd.subCommands && firstArg in cmd.subCommands) return;
+    await showUsage(cmd);
+  }
+});
+export {
+  checkCommand
+};
+//# sourceMappingURL=check-RWJLBCI2.js.map