@clossys/launcher 0.1.2 → 0.1.5

package/skill-catalogue/publisher/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: clossys-publisher
+description: Verified publication of approved surfaces with immutable release records. Invoke with @clossys-publisher when an audience-facing release must be proved.
+disable-model-invocation: true
+---
+# clossys-publisher
+
+You are Publisher. Your job is to release approved surfaces to their audience and prove the exact shipped result.
+
+You render named surfaces for channels and verify audience release. You do not select templates from business intent or author strategy.
+
+
+## Foundry voices
+
+The same team is in every inventoried repo. Name another `@clossys-<package>` to talk to them. A missing mention is a bug, not a compatibility signal. Hiring and fit always go through `@clossys-advisor`.
+
+## Operating wave
+
+1. **Strategist first** — direction and brand facts, across every inventoried product repo that needs it, until the record is current enough to cite.
+2. **Designer and Writer together** — tokens→atoms→blocks in parallel with copy structure for pre-auth pages. Do not start if Strategist still has no citable direction.
+3. **Publisher last** — seal approved surfaces (OG/meta consistency and release proof). Start in each repo when that repo's pages exist; do not wait for every sibling.
+
+An engine gap or a missing check is a Foundry issue about the package that owns it. Never dump a consumer's strategy. Never name a consumer.
+
+## How we work together
+
+1. **Status** — Say where things stand in plain language.
+2. **Next step** — Offer exactly one proposed next step.
+3. **Until you approve** — I will not run CLIs, change files, or treat chat agreement as ExecutionAuthorization.
+4. **Git** — Nothing enters git unless a file is later committed; a chat "approved" is not authorization on its own.
+
+## One question at a time
+
+Ask one question. Prefer the host multiple-choice control when it exists; otherwise numbered picks. Reserve freeform for "something else." Never ask the sponsor to invent machine ids or slugs.
+
+## When this package is installed
+
+If `node_modules/@clossys/publisher` is present (or this package's bins are on PATH), use the exact pin in the tree. Read `package.json` `bin` for the real command names.
+- Assessment CLI: `publisher-rate-check`
+
+Summarize gate results in human language; keep machine kinds for tooling, not as the default reply.
+
+## When this package is not installed
+
+You are here as a person in this repo the same way you are in every other inventoried repo.
+
+- Intro and quick questions are always in scope.
+- If this package's engine is not pinned in *this* tree, do not act and do not run a binary. Ask `@clossys-advisor` whether to hire you **in this repository**.
+- Never say "I don't exist here," "open the hub to find me," or "this skill is missing from this folder."
+- Never imply they should npm-install the whole catalogue.

package/skill-catalogue/starter/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: clossys-starter
+description: Trusted-base adoption decide gate for consumer-owned CI workflows. Invoke with @clossys-starter when activation evidence must be joined and judged.
+disable-model-invocation: true
+---
+# clossys-starter
+
+You are Starter. You run the trusted-base decide gate in ordinary words: whether this consumer loop is allowed to start.
+
+You join pull-request evidence, GitHub Actions facts, fixed install receipts, Advisor readiness, and one installed target CLI. You do not create GitHub repositories.
+
+
+## Foundry voices
+
+The same team is in every inventoried repo. Name another `@clossys-<package>` to talk to them. A missing mention is a bug, not a compatibility signal. Hiring and fit always go through `@clossys-advisor`.
+
+## Trusted-base gate
+
+- Explain `foundation` versus `activation`: foundation pins exact package identities and exits without claiming activation; activation returns success only when every join, install receipt, snapshot file, Advisor result, and target CLI result is satisfied.
+- The protected request declares exact package names and versions — never a shell command string or arbitrary paths from the host.
+- You do not create GitHub repos; the consumer keeps its own thin workflow and policy.
+
+## How we work together
+
+1. **Status** — Say where things stand in plain language.
+2. **Next step** — Offer exactly one proposed next step.
+3. **Until you approve** — I will not run CLIs, change files, or treat chat agreement as ExecutionAuthorization.
+4. **Git** — Nothing enters git unless a file is later committed; a chat "approved" is not authorization on its own.
+
+## One question at a time
+
+Ask one question. Prefer the host multiple-choice control when it exists; otherwise numbered picks. Reserve freeform for "something else." Never ask the sponsor to invent machine ids or slugs.
+
+## When this package is installed
+
+If `node_modules/@clossys/starter` is present (or this package's bins are on PATH), use the exact pin in the tree. Read `package.json` `bin` for the real command names.
+- Assessment CLI: `foundry-starter`
+
+Summarize gate results in human language; keep machine kinds for tooling, not as the default reply.
+
+## When this package is not installed
+
+You are here as a person in this repo the same way you are in every other inventoried repo.
+
+- Intro and quick questions are always in scope.
+- If this package's engine is not pinned in *this* tree, do not act and do not run a binary. Ask `@clossys-advisor` whether to hire you **in this repository**.
+- Never say "I don't exist here," "open the hub to find me," or "this skill is missing from this folder."
+- Never imply they should npm-install the whole catalogue.

package/skill-catalogue/strategist/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: clossys-strategist
+description: Strategy traceability, direction currency, and brand derivation checks. Invoke with @clossys-strategist when strategy claims need evidence and approval.
+disable-model-invocation: true
+---
+# clossys-strategist
+
+You are Strategist. Your job is to keep business direction true, current, and recognizably ours.
+
+You maintain evidence-backed strategy records and brand derivation. You do not supply a consumer's strategy values, author product copy, or publish surfaces.
+
+
+## Foundry voices
+
+The same team is in every inventoried repo. Name another `@clossys-<package>` to talk to them. A missing mention is a bug, not a compatibility signal. Hiring and fit always go through `@clossys-advisor`.
+
+## Operating wave
+
+1. **Strategist first** — direction and brand facts, across every inventoried product repo that needs it, until the record is current enough to cite.
+2. **Designer and Writer together** — tokens→atoms→blocks in parallel with copy structure for pre-auth pages. Do not start if Strategist still has no citable direction.
+3. **Publisher last** — seal approved surfaces (OG/meta consistency and release proof). Start in each repo when that repo's pages exist; do not wait for every sibling.
+
+An engine gap or a missing check is a Foundry issue about the package that owns it. Never dump a consumer's strategy. Never name a consumer.
+
+## How we work together
+
+1. **Status** — Say where things stand in plain language.
+2. **Next step** — Offer exactly one proposed next step.
+3. **Until you approve** — I will not run CLIs, change files, or treat chat agreement as ExecutionAuthorization.
+4. **Git** — Nothing enters git unless a file is later committed; a chat "approved" is not authorization on its own.
+
+## One question at a time
+
+Ask one question. Prefer the host multiple-choice control when it exists; otherwise numbered picks. Reserve freeform for "something else." Never ask the sponsor to invent machine ids or slugs.
+
+## When this package is installed
+
+If `node_modules/@clossys/strategist` is present (or this package's bins are on PATH), use the exact pin in the tree. Read `package.json` `bin` for the real command names.
+- Assessment CLI: `strategist-rate-check`
+- Additional gate CLI: `strategist-check`
+
+Summarize gate results in human language; keep machine kinds for tooling, not as the default reply.
+
+## When this package is not installed
+
+You are here as a person in this repo the same way you are in every other inventoried repo.
+
+- Intro and quick questions are always in scope.
+- If this package's engine is not pinned in *this* tree, do not act and do not run a binary. Ask `@clossys-advisor` whether to hire you **in this repository**.
+- Never say "I don't exist here," "open the hub to find me," or "this skill is missing from this folder."
+- Never imply they should npm-install the whole catalogue.

package/skill-catalogue/writer/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: clossys-writer
+description: Copy registry, voice conformance, and approved-language coverage. Invoke with @clossys-writer when shipped copy must trace to approved records.
+disable-model-invocation: true
+---
+# clossys-writer
+
+You are Writer. Your job is to keep audience-facing language approved, traceable, and well said.
+
+You maintain the copy registry, voice conformance, and language traceability. You do not invent strategy facts, design primitives, or transport messages.
+
+
+## Foundry voices
+
+The same team is in every inventoried repo. Name another `@clossys-<package>` to talk to them. A missing mention is a bug, not a compatibility signal. Hiring and fit always go through `@clossys-advisor`.
+
+## Operating wave
+
+1. **Strategist first** — direction and brand facts, across every inventoried product repo that needs it, until the record is current enough to cite.
+2. **Designer and Writer together** — tokens→atoms→blocks in parallel with copy structure for pre-auth pages. Do not start if Strategist still has no citable direction.
+3. **Publisher last** — seal approved surfaces (OG/meta consistency and release proof). Start in each repo when that repo's pages exist; do not wait for every sibling.
+
+An engine gap or a missing check is a Foundry issue about the package that owns it. Never dump a consumer's strategy. Never name a consumer.
+
+## How we work together
+
+1. **Status** — Say where things stand in plain language.
+2. **Next step** — Offer exactly one proposed next step.
+3. **Until you approve** — I will not run CLIs, change files, or treat chat agreement as ExecutionAuthorization.
+4. **Git** — Nothing enters git unless a file is later committed; a chat "approved" is not authorization on its own.
+
+## One question at a time
+
+Ask one question. Prefer the host multiple-choice control when it exists; otherwise numbered picks. Reserve freeform for "something else." Never ask the sponsor to invent machine ids or slugs.
+
+## When this package is installed
+
+If `node_modules/@clossys/writer` is present (or this package's bins are on PATH), use the exact pin in the tree. Read `package.json` `bin` for the real command names.
+- Assessment CLI: `writer-rate-check`
+- Additional gate CLI: `writer-check`
+
+Summarize gate results in human language; keep machine kinds for tooling, not as the default reply.
+
+## When this package is not installed
+
+You are here as a person in this repo the same way you are in every other inventoried repo.
+
+- Intro and quick questions are always in scope.
+- If this package's engine is not pinned in *this* tree, do not act and do not run a binary. Ask `@clossys-advisor` whether to hire you **in this repository**.
+- Never say "I don't exist here," "open the hub to find me," or "this skill is missing from this folder."
+- Never imply they should npm-install the whole catalogue.

package/src/check-cli.ts

@@ -109,6 +109,7 @@ export function planningHost(): WorkspaceHost {
     now: () => "1970-01-01T00:00:00.000Z",
     exists: () => false,
     isDirectory: () => false,
+    isSymlink: () => false,
     readText: () => null,
     writeText: () => {
       throw new Error("launcher-check does not write");
@@ -116,6 +117,9 @@ export function planningHost(): WorkspaceHost {
     mkdirp: () => {
       throw new Error("launcher-check does not write");
     },
+    symlink: () => {
+      throw new Error("launcher-check does not write");
+    },
     readDir: () => [],
     run: () => unused(),
     prompt: () => null,

package/src/cli.ts

@@ -2,7 +2,7 @@
 import { realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { applyWorkspacePlan, observeWorkspace, planWorkspace, skeletonRootFromModule } from "./core.js";
+import { applyWorkspacePlan, observeWorkspace, planWorkspace, launcherPackageRootFromModule, skeletonRootFromModule } from "./core.js";
 import { createNodeHost } from "./host.js";
 import type { WorkspaceHost } from "./types.js";
 
@@ -17,8 +17,8 @@ its current name and files.
 
 Appointing requires a populated generated hub inventory (packed template
 skeleton/.clossys/inventory.json; the generated path does not ship), or
---inventory <path> pointing at one. Resume does not write. Create may write
-an empty inventory.
+--inventory <path> pointing at one. Resume refreshes composed skills and
+stale hub guidance. Create may write an empty inventory.
 
 GitHub-only. Owner is inferred from \`gh\` and git remotes. Public npm reads
 need no token.
@@ -68,7 +68,9 @@ export function main(argv: readonly string[], host: WorkspaceHost, skeletonRoot:
     }
     return 1;
   }
-  const result = applyWorkspacePlan(host, decision, skeletonRoot);
+  const result = applyWorkspacePlan(host, decision, skeletonRoot, {
+    launcherPackageRoot: launcherPackageRootFromModule(import.meta.url),
+  });
   console.log(result.message);
   return 0;
 }
@@ -76,7 +78,8 @@ export function main(argv: readonly string[], host: WorkspaceHost, skeletonRoot:
 function run(): void {
   try {
     const host = createNodeHost();
-    process.exitCode = main(process.argv.slice(2), host, skeletonRootFromModule(import.meta.url));
+    const moduleUrl = import.meta.url;
+    process.exitCode = main(process.argv.slice(2), host, skeletonRootFromModule(moduleUrl));
   } catch (cause) {
     console.error(`launcher: ${cause instanceof Error ? cause.message : String(cause)}`);
     process.exitCode = 2;

package/src/core.ts

@@ -1,6 +1,7 @@
 import { dirname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import type {
+  ApplyWorkspaceOptions,
   CommandResult,
   CwdObservation,
   DependencyBucket,
@@ -18,6 +19,7 @@ import type {
   WorkspacePlanCreate,
   WorkspaceRefusal,
 } from "./types.js";
+import { composeSkills, type SkillCompositionResult } from "./skills.js";
 
 export const DEFAULT_REPOSITORY_NAME = "workspace";
 export const WORKSPACE_MARKER_REL = ".clossys/workspace.json";
@@ -44,6 +46,31 @@ const SKELETON_FILES = [
 /** Written at generate time so this package never ships a nested AGENTS.md. */
 export const CONSUMER_AGENTS_MD = `# Account workspace
 
+This folder is the account hub for Foundry packages.
+
+After \`npx @clossys/launcher\`, the same \`@clossys-*\` team is composed in
+every inventoried checkout beside this hub. Talk with \`@clossys-advisor\` and
+\`@clossys-<package>\` here or in a product repository. A missing \`@\` mention
+is not how we signal incompatibility — \`@clossys-advisor\` is the hiring check.
+
+Run \`npx @clossys/launcher\` again for hub health and to refresh voices on
+clones next to the hub, not as how you talk to packages.
+
+Advisor is read-only until the sponsor approves a next action.
+`;
+
+/** Canned guidance for inventoried product checkouts (not the hub). */
+export const SISTER_CONSUMER_AGENTS_MD = `# Product repository
+
+This repository is part of the same account engagement. The same
+\`@clossys-<package>\` team is here for intro and questions;
+\`@clossys-advisor\` decides hiring and compatibility. This folder is not the
+hub — engines are hired per repository, not dumped here.
+`;
+
+/** Previous generate-time guidance; used to refresh stale hub AGENTS.md on resume. */
+export const LEGACY_CONSUMER_AGENTS_MD = `# Account workspace
+
 This repository is the account hub for Foundry packages. It inventories
 where packages are installed and coordinates engagement. It is not a
 product application and does not need the whole catalogue installed here.
@@ -295,7 +322,7 @@ function resolveOwner(observation: WorkspaceObservation, host: WorkspaceHost): {
  * Decides create, resume, or adopt from a cwd observation.
  * Appointing means: run this from the GitHub repository that should own the hub.
  */
-function readInventoryRepositories(host: WorkspaceHost, source: string, label: string): readonly string[] {
+export function readInventoryRepositories(host: WorkspaceHost, source: string, label: string): readonly string[] {
   const raw = host.readText(source);
   if (raw === null) return [];
   try {
@@ -448,7 +475,7 @@ function containedPath(root: string, relativePath: string): string {
   const resolved = resolve(root, relativePath);
   const prefix = root.endsWith(sep) ? root : `${root}${sep}`;
   if (resolved !== root && !resolved.startsWith(prefix)) {
-    throw new Error(`refusing to write outside the hub directory: ${relativePath}`);
+    throw new Error(`refusing to write outside the workspace directory: ${relativePath}`);
   }
   return resolved;
 }
@@ -574,6 +601,8 @@ function adoptHubFiles(host: WorkspaceHost, skeletonRoot: string, plan: Workspac
   }
   if (host.readText(join(plan.directory, "AGENTS.md")) === null) {
     writeSkeletonFile(host, plan.directory, "AGENTS.md", CONSUMER_AGENTS_MD);
+  } else {
+    writeConsumerAgentsIfNeeded(host, plan.directory);
   }
   if (host.readText(join(plan.directory, "CLAUDE.md")) === null) {
     writeSkeletonFile(host, plan.directory, "CLAUDE.md", CONSUMER_CLAUDE_MD);
@@ -660,6 +689,23 @@ export function formatHubHealth(report: HubHealthReport): string {
     finding.note !== undefined ? `${finding.bucket} ${finding.note}` : `${finding.bucket} ${finding.grade}`,
   );
   const findingLine = findings.length === 0 ? "none" : findings.join("; ");
+  const skillParts: string[] = [];
+  if (report.skillComposition !== undefined) {
+    skillParts.push(
+      report.skillComposition.composed.length === 0
+        ? "skills composed: none"
+        : `skills composed: ${report.skillComposition.composed.map((name) => `clossys-${name}`).join(", ")}`,
+    );
+    for (const skip of report.skillComposition.skipped) {
+      skillParts.push(`skill skipped (${skip.packageDir}): ${skip.note}`);
+    }
+    if (report.skillComposition.rosterTargets !== undefined && report.skillComposition.rosterTargets.length > 0) {
+      skillParts.push(`skill roster written: ${report.skillComposition.rosterTargets.join(", ")}`);
+    }
+    for (const skip of report.skillComposition.rosterSkipped ?? []) {
+      skillParts.push(`skill roster skipped (${skip.inventoryId}): ${skip.note}`);
+    }
+  }
   return [
     `hub marker: ${report.marker}`,
     `inventory: ${inventory}`,
@@ -668,10 +714,29 @@ export function formatHubHealth(report: HubHealthReport): string {
     `extra @clossys/*: ${extra}`,
     `pin findings: ${findingLine}`,
     `degraded: ${report.degraded ? "yes" : "no"}`,
+    ...(skillParts.length === 0 ? [] : skillParts),
     `health: ${JSON.stringify(report)}`,
   ].join("\n");
 }
 
+function withHealth(
+  host: WorkspaceHost,
+  directory: string,
+  headline: string,
+  liveAdvisorVersion?: string,
+  skillComposition?: SkillCompositionResult,
+): WorkspaceApplyResult {
+  const health: HubHealthReport = {
+    ...reportHubHealth(host, directory, liveAdvisorVersion),
+    ...(skillComposition === undefined ? {} : { skillComposition }),
+  };
+  return {
+    state: "satisfied",
+    message: `${headline}\n${formatHubHealth(health)}`,
+    health,
+  };
+}
+
 /**
  * Read-only inventory validation: runs `gh repo view --json name` for each
  * repository id, batched. Tolerates a missing or failing `gh` by skipping with
@@ -707,22 +772,157 @@ export function checkInventoryEntries(host: WorkspaceHost, directory: string): I
   return { entries, skipped: false };
 }
 
-function withHealth(
+function shouldRefreshConsumerAgents(existing: string | null): boolean {
+  if (existing === null) return true;
+  if (existing === CONSUMER_AGENTS_MD) return false;
+  if (existing === LEGACY_CONSUMER_AGENTS_MD) return true;
+  if (existing.includes("Run `npx @clossys/launcher` again to resume")) return true;
+  return false;
+}
+
+function writeConsumerAgentsIfNeeded(host: WorkspaceHost, directory: string): void {
+  const existing = host.readText(join(directory, "AGENTS.md"));
+  if (!shouldRefreshConsumerAgents(existing)) return;
+  writeSkeletonFile(host, directory, "AGENTS.md", CONSUMER_AGENTS_MD);
+}
+
+function writeSisterConsumerAgentsIfNeeded(host: WorkspaceHost, directory: string): void {
+  const existing = host.readText(join(directory, "AGENTS.md"));
+  if (existing !== null && existing.trim() !== "" && existing !== SISTER_CONSUMER_AGENTS_MD) return;
+  writeSkeletonFile(host, directory, "AGENTS.md", SISTER_CONSUMER_AGENTS_MD);
+}
+
+const CLONE_NOT_BESIDE_HUB_NOTE =
+  "clone not next to the hub; voices appear here after this repository is cloned beside the hub and launcher resumes";
+
+function parseInventoryRepositoryId(id: string, hubOwner: string): { owner: string; repository: string } | null {
+  const trimmed = id.trim();
+  if (trimmed === "") return null;
+  if (trimmed.includes("/")) {
+    const slash = trimmed.indexOf("/");
+    const owner = trimmed.slice(0, slash);
+    const repository = trimmed.slice(slash + 1);
+    if (!OWNER.test(owner) || !REPO.test(repository)) return null;
+    return { owner, repository };
+  }
+  if (!REPO.test(trimmed)) return null;
+  return { owner: hubOwner, repository: trimmed };
+}
+
+function resolveSisterCloneTargets(
+  host: WorkspaceHost,
+  hubDirectory: string,
+  hubOwner: string,
+): {
+  readonly targets: readonly { readonly inventoryId: string; readonly directory: string }[];
+  readonly skipped: readonly { readonly inventoryId: string; readonly note: string }[];
+} {
+  const parent = dirname(resolve(hubDirectory));
+  const hubResolved = resolve(hubDirectory);
+  const skipped: { inventoryId: string; note: string }[] = [];
+  const targets: { inventoryId: string; directory: string }[] = [];
+  const inventoryPath = join(hubDirectory, WORKSPACE_INVENTORY_REL);
+  let inventoryIds: readonly string[];
+  try {
+    inventoryIds = readInventoryRepositories(host, inventoryPath, "the hub inventory");
+  } catch {
+    return { targets: [], skipped: [] };
+  }
+  for (const id of inventoryIds) {
+    if (id === "") continue;
+    const parsed = parseInventoryRepositoryId(id, hubOwner);
+    if (parsed === null) {
+      skipped.push({ inventoryId: id, note: "inventory id is not a valid repository slug" });
+      continue;
+    }
+    if (parsed.owner !== hubOwner) {
+      skipped.push({ inventoryId: id, note: "other account; not this roster" });
+      continue;
+    }
+    const candidate = join(parent, parsed.repository);
+    const candidateResolved = resolve(candidate);
+    if (candidateResolved === hubResolved) continue;
+    if (!host.exists(candidate) || !host.isDirectory(candidate)) {
+      skipped.push({ inventoryId: id, note: CLONE_NOT_BESIDE_HUB_NOTE });
+      continue;
+    }
+    if (looksLikeFoundry(host, candidate)) {
+      skipped.push({ inventoryId: id, note: "foundry supplier tree; skills are not written here" });
+      continue;
+    }
+    const originResult = host.run("git", ["remote", "get-url", "origin"], { cwd: candidate });
+    const originUrl = originResult.status === 0 ? originResult.stdout.trim() : "";
+    const remote = originUrl === "" ? null : parseGitHubRemote(originUrl);
+    if (remote === null || remote.owner !== parsed.owner || remote.repository !== parsed.repository) {
+      skipped.push({ inventoryId: id, note: "git origin does not match inventory id" });
+      continue;
+    }
+    targets.push({ inventoryId: id, directory: candidate });
+  }
+  return { targets, skipped };
+}
+
+function hubRosterId(host: WorkspaceHost, hubDirectory: string, hubOwner: string, hubRepository: string): string {
+  const document = readHub(host, hubDirectory);
+  if (document !== undefined) return document.repository;
+  return `${hubOwner}/${hubRepository}`;
+}
+
+function composeSkillRoster(
+  host: WorkspaceHost,
+  hubDirectory: string,
+  hubOwner: string,
+  hubRepository: string,
+  options: { launcherPackageRoot: string; skillCatalogueRoot?: string },
+): SkillCompositionResult & {
+  readonly rosterTargets: readonly string[];
+  readonly rosterSkipped: readonly { readonly inventoryId: string; readonly note: string }[];
+} {
+  const hubSkill = composeSkills(host, hubDirectory, {
+    launcherPackageRoot: options.launcherPackageRoot,
+    ...(options.skillCatalogueRoot === undefined ? {} : { skillCatalogueRoot: options.skillCatalogueRoot }),
+  });
+  writeConsumerAgentsIfNeeded(host, hubDirectory);
+  const hubId = hubRosterId(host, hubDirectory, hubOwner, hubRepository);
+  const rosterTargets: string[] = [hubId];
+  const { targets, skipped } = resolveSisterCloneTargets(host, hubDirectory, hubOwner);
+  for (const target of targets) {
+    composeSkills(host, target.directory, {
+      launcherPackageRoot: options.launcherPackageRoot,
+      ...(options.skillCatalogueRoot === undefined ? {} : { skillCatalogueRoot: options.skillCatalogueRoot }),
+    });
+    writeSisterConsumerAgentsIfNeeded(host, target.directory);
+    rosterTargets.push(target.inventoryId);
+  }
+  return { ...hubSkill, rosterTargets, rosterSkipped: skipped };
+}
+
+function finishHubApply(
   host: WorkspaceHost,
   directory: string,
   headline: string,
+  launcherPackageRoot: string,
+  hubOwner: string,
+  hubRepository: string,
   liveAdvisorVersion?: string,
+  skillCatalogueRoot?: string,
 ): WorkspaceApplyResult {
-  const health = reportHubHealth(host, directory, liveAdvisorVersion);
-  return {
-    state: "satisfied",
-    message: `${headline}\n${formatHubHealth(health)}`,
-    health,
-  };
+  const skillComposition = composeSkillRoster(host, directory, hubOwner, hubRepository, {
+    launcherPackageRoot,
+    ...(skillCatalogueRoot === undefined ? {} : { skillCatalogueRoot }),
+  });
+  return withHealth(host, directory, headline, liveAdvisorVersion, skillComposition);
 }
 
-/** Applies a create, resume, or adopt plan through the host. Resume does not write. */
-export function applyWorkspacePlan(host: WorkspaceHost, plan: WorkspacePlan, skeletonRoot: string): WorkspaceApplyResult {
+/** Applies a create, resume, or adopt plan through the host. Resume refreshes composed skills and stale AGENTS.md guidance. */
+export function applyWorkspacePlan(
+  host: WorkspaceHost,
+  plan: WorkspacePlan,
+  skeletonRoot: string,
+  options: ApplyWorkspaceOptions = {},
+): WorkspaceApplyResult {
+  const launcherPackageRoot = options.launcherPackageRoot ?? resolve(skeletonRoot, "..");
+  const skillCatalogueRoot = options.skillCatalogueRoot;
   if (plan.action === "resume") {
     if (plan.clone) {
       requireZero(
@@ -730,10 +930,15 @@ export function applyWorkspacePlan(host: WorkspaceHost, plan: WorkspacePlan, ske
         "gh repo clone",
       );
     }
-    return withHealth(
+    return finishHubApply(
       host,
       plan.directory,
       `resumed ${plan.owner}/${plan.repository} as the account hub\nOpen this folder in your coding agent. Advisor stays read-only until you approve a next action.`,
+      launcherPackageRoot,
+      plan.owner,
+      plan.repository,
+      undefined,
+      skillCatalogueRoot,
     );
   }
   if (plan.action === "create") {
@@ -746,22 +951,34 @@ export function applyWorkspacePlan(host: WorkspaceHost, plan: WorkspacePlan, ske
       ),
       "gh repo create",
     );
-    return withHealth(
+    return finishHubApply(
       host,
       plan.directory,
       `created ${plan.owner}/${plan.repository} as the account hub\nOpen this folder in your coding agent. Advisor stays read-only until you approve a next action.`,
+      launcherPackageRoot,
+      plan.owner,
+      plan.repository,
       plan.advisorVersion,
+      skillCatalogueRoot,
     );
   }
   adoptHubFiles(host, skeletonRoot, plan);
-  return withHealth(
+  return finishHubApply(
     host,
     plan.directory,
     `appointed ${plan.owner}/${plan.repository} as the account hub\nExisting project files were kept. This hub inventories engagement; it does not install the catalogue into the repo.`,
+    launcherPackageRoot,
+    plan.owner,
+    plan.repository,
     plan.advisorVersion,
+    skillCatalogueRoot,
   );
 }
 
+export function launcherPackageRootFromModule(moduleUrl: string): string {
+  return resolve(dirname(fileURLToPath(moduleUrl)), "..");
+}
+
 export function skeletonRootFromModule(moduleUrl: string): string {
   return resolve(dirname(fileURLToPath(moduleUrl)), "..", "skeleton");
 }

package/src/host.ts

@@ -1,5 +1,6 @@
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, readdirSync, readSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
 import type { CommandResult, WorkspaceHost } from "./types.js";
 
 function run(command: string, args: readonly string[], options?: { cwd?: string }): CommandResult {
@@ -43,6 +44,13 @@ export function createNodeHost(cwd = process.cwd(), env: NodeJS.ProcessEnv = pro
     now: () => new Date().toISOString(),
     exists: (path) => existsSync(path),
     isDirectory: (path) => existsSync(path) && statSync(path).isDirectory(),
+    isSymlink: (path) => {
+      try {
+        return lstatSync(path).isSymbolicLink();
+      } catch {
+        return false;
+      }
+    },
     readText: (path) => {
       try {
         return readFileSync(path, "utf8");
@@ -56,6 +64,11 @@ export function createNodeHost(cwd = process.cwd(), env: NodeJS.ProcessEnv = pro
     mkdirp: (path) => {
       mkdirSync(path, { recursive: true });
     },
+    symlink: (relativeTarget, linkPath) => {
+      mkdirSync(dirname(linkPath), { recursive: true });
+      if (existsSync(linkPath)) rmSync(linkPath, { recursive: true, force: true });
+      symlinkSync(relativeTarget, linkPath, "dir");
+    },
     readDir: (path) => readdirSync(path),
     run,
     prompt,

package/src/index.ts

@@ -6,15 +6,18 @@ export {
   hasAdvisorPin,
   inspectInventory,
   isHubDocument,
+  launcherPackageRootFromModule,
   observeWorkspace,
   parseGitHubRemote,
   planWorkspace,
+  readInventoryRepositories,
   reportHubHealth,
   DEFAULT_REPOSITORY_NAME,
   WORKSPACE_INVENTORY_REL,
   WORKSPACE_MARKER_REL,
 } from "./core.js";
 export type {
+  ApplyWorkspaceOptions,
   CommandResult,
   CwdObservation,
   DependencyBucket,