@csark0812/skeleton 4.0.0 → 4.0.2

package/dist/cli.js

@@ -15968,8 +15968,8 @@ var require_extend = __commonJS((exports, module) => {
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync22 } from "node:fs";
-import process7 from "node:process";
+import { readFileSync as readFileSync24 } from "node:fs";
+import process6 from "node:process";
 
 // src/audit/config/load.ts
 var import_ajv = __toESM(require_ajv(), 1);
@@ -17083,9 +17083,6 @@ function nonPublicSkills(config) {
   return config.scan.nonPublicSkills ?? [];
 }
 
-// src/audit/run.ts
-import process4 from "node:process";
-
 // src/catalog.ts
 import { existsSync as existsSync5, mkdirSync, readFileSync as readFileSync5, writeFileSync } from "node:fs";
 import { dirname as dirname3, join as join5 } from "node:path";
@@ -18571,19 +18568,11 @@ function writeCatalog(root) {
   writeFileSync(abs, content, "utf8");
   return { path: normalizeRelPath(CATALOG_REL_PATH), entries };
 }
-function catalogAuditWarnings(root) {
+function refreshLocalCatalog(root) {
   if (process3.env.CI === "true")
-    return [];
-  const result = checkCatalog(root);
-  if (result.missing) {
-    return [
-      `${CATALOG_REL_PATH} missing — run \`skeleton catalog\` so agents can skim SSOT summaries`
-    ];
-  }
-  if (result.stale) {
-    return [`${CATALOG_REL_PATH} outdated — run \`skeleton catalog\` to refresh`];
-  }
-  return [];
+    return "skipped-ci";
+  writeCatalog(root);
+  return "current";
 }
 function runCatalogCli(options = {}) {
   const root = options.root ?? findRepoRoot();
@@ -18945,7 +18934,8 @@ function createContext(options = {}) {
     registryHasTableHeader: false,
     skillIndex,
     lockedSkillSlugs: new Set(skillIndex.foreignSlugs),
-    policies: options.policies ?? []
+    policies: options.policies ?? [],
+    fileSource: options.fileSource
   };
 }
 
@@ -30900,9 +30890,8 @@ function printWarnings(label, warnings) {
     return;
   console.log(`${label} warnings:
 `);
-  for (const i of warnings) {
-    const linkPart = i.link ? ` (${i.link})` : "";
-    console.log(`- ${i.file}${linkPart}: ${i.message}`);
+  for (const item of warnings) {
+    console.log(`${item.file}: warning: ${item.message}`);
   }
   console.log("");
 }
@@ -30912,12 +30901,65 @@ function printSuccess(label, options, warnings) {
   console.log(`${label} passed${countNote}.`);
   return 0;
 }
+var REREAD_CODES = new Set([
+  "review-dependency-changed",
+  "impacted-document-review-required",
+  "review-document-changed",
+  "review-dependency-set-changed"
+]);
+function isRereadIssue(item) {
+  return Boolean(item.code && REREAD_CODES.has(item.code));
+}
+function rereadTrigger(item) {
+  if (item.code === "review-document-changed")
+    return item.file;
+  if (item.code === "review-dependency-changed" || item.code === "impacted-document-review-required") {
+    return item.link ?? null;
+  }
+  return null;
+}
+function orderTriggers(file, triggers) {
+  const rest = [...triggers].filter((path3) => path3 !== file).sort();
+  return triggers.has(file) ? [file, ...rest] : rest;
+}
+function collectRereadTriggers(errors2) {
+  const triggers = new Map;
+  const rest = [];
+  for (const item of errors2) {
+    if (!isRereadIssue(item)) {
+      rest.push(item);
+      continue;
+    }
+    const current = triggers.get(item.file) ?? new Set;
+    const trigger = rereadTrigger(item);
+    if (trigger)
+      current.add(trigger);
+    triggers.set(item.file, current);
+  }
+  return { triggers, rest };
+}
+function printRereadDiagnostic(file, triggers) {
+  console.log(`${file}: error: review required`);
+  const changed = orderTriggers(file, triggers);
+  if (changed.length > 0) {
+    console.log(`  changed: ${changed.join(", ")}`);
+    return;
+  }
+  console.log("  changed: review dependency set");
+}
+function printRereadLists(errors2) {
+  const { triggers, rest } = collectRereadTriggers(errors2);
+  for (const file of [...triggers.keys()].sort()) {
+    printRereadDiagnostic(file, triggers.get(file) ?? new Set);
+  }
+  return rest;
+}
 function printErrors(label, errors2) {
   console.log(`${label} failed:
 `);
-  for (const i of errors2) {
-    const linkPart = i.link ? ` (${i.link})` : "";
-    console.log(`- ${i.file}${linkPart}: ${i.message}`);
+  const rest = printRereadLists(errors2);
+  for (const item of rest) {
+    console.log(`${item.file}: error: ${item.message}`);
   }
   return 1;
 }
@@ -30931,11 +30973,43 @@ function printTextReport(ctx) {
 
 // src/audit/core/review-proof.ts
 import { createHash } from "node:crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync2, readFileSync as readFileSync11, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname8, relative as relative6 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync2, readFileSync as readFileSync12, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname8 } from "node:path";
+
+// src/audit/core/repo-files.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "node:fs";
+import { join as join11 } from "node:path";
+function gitShow(root2, spec) {
+  const proc = spawnSync2("git", ["show", spec], {
+    cwd: root2,
+    encoding: "utf8",
+    maxBuffer: 20000000
+  });
+  if (proc.status !== 0)
+    return null;
+  return proc.stdout;
+}
+function readRepoText(root2, relPath2, source = "worktree") {
+  const normalized = normalizeRelPath(relPath2);
+  if (source === "index")
+    return gitShow(root2, `:${normalized}`);
+  const abs = join11(root2, normalized);
+  if (!existsSync12(abs))
+    return null;
+  return readFileSync11(abs, "utf8");
+}
+function pathDiffersFromHead(root2, relPath2) {
+  const normalized = normalizeRelPath(relPath2);
+  const head = gitShow(root2, `HEAD:${normalized}`);
+  const worktree = readRepoText(root2, normalized, "worktree");
+  if (worktree === null)
+    return head !== null;
+  return worktree !== (head ?? "");
+}
 
 // src/audit/core/review-deps.ts
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 var REVIEW_DEPS_RE = /<!--\s*review-deps:\s*([^>]*?)-->/gi;
 var GLOB_MAGIC_RE = /[*?{[]/;
 function parseReviewDepsMarkers(content3) {
@@ -30967,7 +31041,7 @@ function resolveReviewDependencies(root2, patterns) {
       throw new Error(`Invalid review dependency path: ${pattern}`);
     }
     if (!isReviewDependencyGlob(pattern)) {
-      if (!existsSync12(`${root2}/${pattern}`)) {
+      if (!existsSync13(`${root2}/${pattern}`)) {
         throw new Error(`Review dependency path is missing: ${pattern}`);
       }
       targets.add(pattern);
@@ -31059,19 +31133,19 @@ function parseLock(content3) {
     return null;
   }
 }
-function loadLock(root2, relPath2) {
-  const abs = resolveWritePath(root2, relPath2);
-  if (!existsSync13(abs))
+function loadLock(root2, relPath2, source = "worktree") {
+  const content3 = readRepoText(root2, relPath2, source);
+  if (content3 === null)
     return null;
-  return parseLock(readFileSync11(abs, "utf8"));
+  return parseLock(content3);
 }
 function hashDependencies(root2, targets) {
   const out = {};
   for (const target of targets) {
     const abs = resolveWritePath(root2, target);
-    if (!existsSync13(abs))
+    if (!existsSync14(abs))
       throw new Error(`Cannot attest missing review dependency: ${target}`);
-    out[target] = hash(readFileSync11(abs, "utf8"));
+    out[target] = hash(readFileSync12(abs, "utf8"));
   }
   return out;
 }
@@ -31100,7 +31174,7 @@ function commitWrites(root2, writes) {
   try {
     for (const [relPath2, content3] of writes) {
       const abs = resolveWritePath(root2, relPath2);
-      originals.set(relPath2, existsSync13(abs) ? readFileSync11(abs, "utf8") : null);
+      originals.set(relPath2, existsSync14(abs) ? readFileSync12(abs, "utf8") : null);
       mkdirSync2(dirname8(abs), { recursive: true });
       writeFileSync3(abs, content3, "utf8");
       written.push(relPath2);
@@ -31131,7 +31205,7 @@ function attestDocuments(options) {
   if (proofPath) {
     const absProof = resolveWritePath(ctx.root, proofPath);
     lock = loadLock(ctx.root, proofPath);
-    if (existsSync13(absProof) && !lock) {
+    if (existsSync14(absProof) && !lock) {
       throw new Error(`Review proof lockfile is malformed: ${proofPath}`);
     }
     lock ??= emptyLock();
@@ -31139,9 +31213,9 @@ function attestDocuments(options) {
   const writes = new Map;
   for (const relPath2 of selected) {
     const abs = resolveWritePath(ctx.root, relPath2);
-    if (!existsSync13(abs))
+    if (!existsSync14(abs))
       throw new Error(`Cannot attest missing document: ${relPath2}`);
-    const original = readFileSync11(abs, "utf8");
+    const original = readFileSync12(abs, "utf8");
     if (!DOC_META_RE.test(original)) {
       throw new Error(`Cannot attest ${relPath2}: missing doc-meta comment`);
     }
@@ -31191,7 +31265,13 @@ function validateEntry(input) {
     }));
     return issues;
   }
-  issues.push(...dependencyHashIssues({ root: ctx.root, relPath: relPath2, targets: currentTargets, entry }));
+  issues.push(...dependencyHashIssues({
+    root: ctx.root,
+    relPath: relPath2,
+    targets: currentTargets,
+    entry,
+    fileSource: ctx.fileSource
+  }));
   return issues;
 }
 function documentProofIssues(relPath2, content3, entry) {
@@ -31225,16 +31305,17 @@ function currentDependencies(input) {
 }
 function dependencyHashIssues(input) {
   const { root: root2, relPath: relPath2, targets, entry } = input;
+  const source = input.fileSource ?? "worktree";
   const issues = [];
   for (const target of targets) {
-    const abs = resolveWritePath(root2, target);
-    if (!existsSync13(abs)) {
+    const content3 = readRepoText(root2, target, source);
+    if (content3 === null) {
       issues.push(issue("review-proof", relPath2, {
         code: "review-dependency-missing",
         message: `recorded review dependency is missing: ${target}`,
         link: target
       }));
-    } else if (entry.reviewDependencies[target] !== hash(readFileSync11(abs, "utf8"))) {
+    } else if (entry.reviewDependencies[target] !== hash(content3)) {
       issues.push(changedDependencyIssue(relPath2, target));
     }
   }
@@ -31244,8 +31325,9 @@ function runReviewProofRule(ctx) {
   if (!ctx.config.reviewProof)
     return [];
   const relLock = lockPath(ctx);
-  const absLock = resolveWritePath(ctx.root, relLock);
-  if (!existsSync13(absLock)) {
+  const source = ctx.fileSource ?? "worktree";
+  const lockContent = readRepoText(ctx.root, relLock, source);
+  if (lockContent === null) {
     return [
       issue("review-proof", relLock, {
         code: "review-proof-lock-missing",
@@ -31253,7 +31335,7 @@ function runReviewProofRule(ctx) {
       })
     ];
   }
-  const lock = parseLock(readFileSync11(absLock, "utf8"));
+  const lock = parseLock(lockContent);
   if (!lock) {
     return [
       issue("review-proof", relLock, {
@@ -31264,11 +31346,10 @@ function runReviewProofRule(ctx) {
   }
   const issues = [];
   for (const relPath2 of ctx.docMetaPaths) {
-    const abs = resolveWritePath(ctx.root, relPath2);
-    if (!existsSync13(abs))
+    const content3 = readRepoText(ctx.root, relPath2, source);
+    if (content3 === null)
       continue;
-    const content3 = readFileSync11(abs, "utf8");
-    const entry = lock.documents[normalizeRelPath(relative6(ctx.root, abs))];
+    const entry = lock.documents[normalizeRelPath(relPath2)];
     if (!entry) {
       issues.push(issue("review-proof", relPath2, {
         code: "review-proof-missing",
@@ -31295,8 +31376,8 @@ function runBannedRule(ctx) {
 var bannedRule = { id: "banned", run: runBannedRule };
 
 // src/audit/rules/doc-meta.ts
-import { existsSync as existsSync14, readFileSync as readFileSync12 } from "node:fs";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "node:fs";
+import { join as join12 } from "node:path";
 function checkDocMetaBanner(relPath2, content3) {
   if (DOC_META_RE.test(content3))
     return null;
@@ -31351,10 +31432,10 @@ function runDocMetaRule(ctx) {
   const issues = [];
   const today = new Date;
   for (const relPath2 of ctx.docMetaPaths) {
-    const abs = join11(ctx.root, relPath2);
-    if (!existsSync14(abs))
+    const abs = join12(ctx.root, relPath2);
+    if (!existsSync15(abs))
       continue;
-    const content3 = readFileSync12(abs, "utf8");
+    const content3 = readFileSync13(abs, "utf8");
     const banner = checkDocMetaBanner(relPath2, content3);
     if (banner) {
       issues.push(banner);
@@ -31382,7 +31463,7 @@ function runDocMetaRule(ctx) {
 var docMetaRule = { id: "doc-meta", run: runDocMetaRule };
 
 // src/audit/rules/links.ts
-import { existsSync as existsSync15, readFileSync as readFileSync13 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "node:fs";
 import { dirname as dirname9, resolve as resolve5 } from "node:path";
 function resolveLink2(sourceFile, target) {
   const withoutAnchor = target.split("#")[0]?.split("?")[0] ?? "";
@@ -31406,13 +31487,13 @@ function checkAgentFile(input, resolved, relSource) {
     return null;
   }
   const agentPath = resolved.endsWith(".md") ? resolved : `${resolved}.md`;
-  if (existsSync15(agentPath))
+  if (existsSync16(agentPath))
     return null;
   return issue("links", relSource, { message: "missing agent file", link: input.linkLabel });
 }
 function checkBrokenPath(ctx) {
   const { input, pathPart, resolved, relSource, relTarget } = ctx;
-  if (!(pathPart && !existsSync15(resolved)))
+  if (!(pathPart && !existsSync16(resolved)))
     return null;
   return issue("links", relSource, {
     message: `broken link → ${relTarget}`,
@@ -31421,9 +31502,9 @@ function checkBrokenPath(ctx) {
 }
 function checkBrokenAnchor(ctx) {
   const { input, anchor, resolved, relSource, relTarget } = ctx;
-  if (!(anchor && existsSync15(resolved)))
+  if (!(anchor && existsSync16(resolved)))
     return null;
-  const targetContent = readFileSync13(resolved, "utf8");
+  const targetContent = readFileSync14(resolved, "utf8");
   const slugs = extractHeadingSlugs(targetContent, resolved);
   const anchorSlug = slugifyAnchor(anchor);
   if (slugs.has(anchorSlug))
@@ -31475,8 +31556,8 @@ function runLinksRule(ctx) {
 var linksRule = { id: "links", run: runLinksRule };
 
 // src/audit/rules/near-duplicate.ts
-import { readFileSync as readFileSync14 } from "node:fs";
-import { join as join12 } from "node:path";
+import { readFileSync as readFileSync15 } from "node:fs";
+import { join as join13 } from "node:path";
 
 // src/audit/core/ssot-fit.ts
 var DEFAULT_SSOT_OVERLAP_MIN = 0.35;
@@ -31764,7 +31845,7 @@ function runNearDuplicateRule(ctx) {
   const ignored = ignoredPairSet(ctx);
   const entries = eligibleEntries(ctx);
   const fingerprints = entries.map((e) => {
-    const content3 = readFileSync14(join12(ctx.root, e.path), "utf8");
+    const content3 = readFileSync15(join13(ctx.root, e.path), "utf8");
     const tokens = tokenize2(bodyWithoutSsotNoise(content3));
     return {
       path: e.path,
@@ -31859,12 +31940,104 @@ function runProsePolicyRule(ctx) {
 }
 var prosePolicyRule = { id: "prose-policy", run: runProsePolicyRule };
 
+// src/audit/core/review-coverage.ts
+var DEFAULT_REVIEW_COVERAGE_INCLUDE = [
+  "**/*.{ts,tsx,js,jsx,mjs,cjs,py}",
+  "package.json",
+  "project.json"
+];
+var DEFAULT_REVIEW_COVERAGE_EXCLUDE = [
+  "**/__tests__/**",
+  "**/*.test.*",
+  "**/*.spec.*",
+  "**/fixtures/**",
+  "templates/**",
+  "dist/**",
+  "node_modules/**",
+  ".git/**",
+  ".skeleton/plugins/**"
+];
+function reviewCoveragePatterns(config) {
+  const configured = config.reviewCoverage;
+  if (configured?.include && configured.include.length === 0) {
+    return { include: [], exclude: [] };
+  }
+  return {
+    include: configured?.include && configured.include.length > 0 ? configured.include : DEFAULT_REVIEW_COVERAGE_INCLUDE,
+    exclude: [...DEFAULT_REVIEW_COVERAGE_EXCLUDE, ...configured?.exclude ?? []]
+  };
+}
+function pathRequiresReviewCoverage(relPath2, config) {
+  const { include, exclude } = reviewCoveragePatterns(config);
+  if (include.length === 0)
+    return false;
+  const path3 = normalizeRelPath(relPath2);
+  if (exclude.some((pattern) => matchesGlobScope(path3, pattern)))
+    return false;
+  return include.some((pattern) => matchesGlobScope(path3, pattern));
+}
+function collectReviewDependencyPatterns(input) {
+  const patterns = new Set;
+  const source = input.fileSource ?? "worktree";
+  for (const abs of collectScanFiles(input.config, input.root, input.skillIndex)) {
+    const rel = relPath(abs, input.root);
+    const content3 = readRepoText(input.root, rel, source);
+    if (content3 === null)
+      continue;
+    for (const pattern of reviewDependencyPatterns(content3))
+      patterns.add(pattern);
+  }
+  return [...patterns].sort();
+}
+function pathHasReviewOwner(relPath2, patterns) {
+  return patterns.some((pattern) => reviewDependencyMatchesPath(pattern, relPath2));
+}
+function collectReviewCoverageFiles(root2, config) {
+  const { include, exclude } = reviewCoveragePatterns(config);
+  if (include.length === 0)
+    return [];
+  const files = new Set;
+  for (const pattern of include) {
+    for (const match of globSync(pattern, {
+      cwd: root2,
+      onlyFiles: true,
+      dot: true,
+      ignore: exclude
+    })) {
+      const rel = normalizeRelPath(match);
+      if (exclude.some((item) => matchesGlobScope(rel, item)))
+        continue;
+      files.add(rel);
+    }
+  }
+  return [...files].sort();
+}
+
+// src/audit/rules/review-coverage.ts
+function runReviewCoverageRule(ctx) {
+  const patterns = collectReviewDependencyPatterns({
+    root: ctx.root,
+    config: ctx.config,
+    skillIndex: ctx.skillIndex,
+    fileSource: ctx.fileSource
+  });
+  return collectReviewCoverageFiles(ctx.root, ctx.config).filter((path3) => !pathHasReviewOwner(path3, patterns)).map((path3) => issue("review-coverage", path3, {
+    code: "review-coverage-gap",
+    message: "file has no owning document; add a review-deps path or glob on the paper that describes it"
+  }));
+}
+var reviewCoverageRule = {
+  id: "review-coverage",
+  global: true,
+  run: runReviewCoverageRule
+};
+
 // src/audit/rules/review-deps.ts
-import { relative as relative7 } from "node:path";
+import { relative as relative6 } from "node:path";
 function runReviewDepsRule(ctx) {
   const issues = [];
   for (const abs of collectScanFiles(ctx.config, ctx.root, ctx.skillIndex)) {
-    const path3 = normalizeRelPath(relative7(ctx.root, abs));
+    const path3 = normalizeRelPath(relative6(ctx.root, abs));
     for (const marker of parseReviewDepsMarkers(readFileContent(abs))) {
       issues.push(...validateMarker(ctx.root, path3, marker.paths));
     }
@@ -31925,16 +32098,16 @@ function runScanRootsRule(ctx) {
 var scanRootsRule = { id: "scan-roots", run: runScanRootsRule };
 
 // src/audit/rules/skill-index.ts
-import { existsSync as existsSync16, readdirSync as readdirSync2, readFileSync as readFileSync15 } from "node:fs";
-import { join as join13, relative as relative8 } from "node:path";
+import { existsSync as existsSync17, readdirSync as readdirSync2, readFileSync as readFileSync16 } from "node:fs";
+import { join as join14, relative as relative7 } from "node:path";
 function walkSkillMarkdown(dir) {
   const files = [];
-  if (!existsSync16(dir))
+  if (!existsSync17(dir))
     return files;
   for (const entry of readdirSync2(dir, { withFileTypes: true })) {
     if (entry.name.startsWith("."))
       continue;
-    const fullPath = join13(dir, entry.name);
+    const fullPath = join14(dir, entry.name);
     if (entry.isDirectory()) {
       files.push(...walkSkillMarkdown(fullPath));
       continue;
@@ -31960,8 +32133,8 @@ function parseReadmeTaxonomySlugs(content3) {
 }
 function scanFileForSkillLinks(ctx, filePath, index2) {
   const issues = [];
-  const rel = relative8(ctx.root, filePath).replace(/\\/g, "/");
-  const content3 = readFileSync15(filePath, "utf8");
+  const rel = relative7(ctx.root, filePath).replace(/\\/g, "/");
+  const content3 = readFileSync16(filePath, "utf8");
   for (const match of content3.matchAll(SKILL_LINK_RE)) {
     const slug2 = match[1];
     if (!slug2)
@@ -31974,14 +32147,14 @@ function scanFileForSkillLinks(ctx, filePath, index2) {
 }
 function taxonomyIssuesForReadme(input) {
   const { ctx, index: index2, skillRoot, diskSlugs, nonPublic } = input;
-  const readmePath = join13(ctx.root, skillRoot.relPath, "README.md");
-  if (!existsSync16(readmePath))
+  const readmePath = join14(ctx.root, skillRoot.relPath, "README.md");
+  if (!existsSync17(readmePath))
     return [];
-  const readme = readFileSync15(readmePath, "utf8");
+  const readme = readFileSync16(readmePath, "utf8");
   if (!readme.includes("## Taxonomy"))
     return [];
   const taxonomySlugs = parseReadmeTaxonomySlugs(readme);
-  const nestedSlugs = diskSlugs.filter((slug2) => existsSync16(join13(ctx.root, skillRoot.relPath, slug2, "SKILL.md")));
+  const nestedSlugs = diskSlugs.filter((slug2) => existsSync17(join14(ctx.root, skillRoot.relPath, slug2, "SKILL.md")));
   const foreign = new Set(index2.foreignSlugs);
   const publicSlugs = nestedSlugs.filter((slug2) => !(nonPublic.has(slug2) || foreign.has(slug2)));
   const relReadme = `${skillRoot.relPath}/README.md`;
@@ -32014,10 +32187,10 @@ function slugsForRoot(skillRoot, index2, owned) {
 function auditSkillRoot(input) {
   const { ctx, index: index2, skillRoot, owned } = input;
   const issues = [];
-  const base = skillRoot.kind === "nested" ? join13(ctx.root, skillRoot.relPath) : ctx.root;
+  const base = skillRoot.kind === "nested" ? join14(ctx.root, skillRoot.relPath) : ctx.root;
   for (const slug2 of slugsForRoot(skillRoot, index2, owned)) {
-    const skillDir = join13(base, slug2);
-    if (!existsSync16(skillDir))
+    const skillDir = join14(base, slug2);
+    if (!existsSync17(skillDir))
       continue;
     for (const skillMd of walkSkillMarkdown(skillDir)) {
       issues.push(...scanFileForSkillLinks(ctx, skillMd, index2));
@@ -32067,8 +32240,8 @@ function runSsotRule(ctx) {
 var ssotRule = { id: "ssot", run: runSsotRule };
 
 // src/audit/rules/ssot-summary.ts
-import { readFileSync as readFileSync16 } from "node:fs";
-import { join as join14 } from "node:path";
+import { readFileSync as readFileSync17 } from "node:fs";
+import { join as join15 } from "node:path";
 function runSsotSummaryRule(ctx) {
   const overlapMin = ctx.config.docsLint?.ssotOverlapMin ?? DEFAULT_SSOT_OVERLAP_MIN;
   const margin = ctx.config.docsLint?.ssotBetterMatchMargin ?? DEFAULT_BETTER_MATCH_MARGIN;
@@ -32076,7 +32249,7 @@ function runSsotSummaryRule(ctx) {
   const files = ctx.ssotEntries.map((entry) => ({
     path: entry.path,
     summary: entry.summary,
-    content: readFileSync16(join14(ctx.root, entry.path), "utf8")
+    content: readFileSync17(join15(ctx.root, entry.path), "utf8")
   }));
   return evaluateSsotFit(files, {
     overlapMin,
@@ -32097,6 +32270,7 @@ var docsRules = [
   { ...nearDuplicateRule, global: true },
   { ...ssotSummaryRule, global: true },
   { ...coverageGapsRule, global: true },
+  { ...reviewCoverageRule, global: true },
   linksRule,
   docMetaRule,
   reviewProofRule,
@@ -32263,14 +32437,7 @@ function labelForSuite(suite) {
 function catalogStatusFor(root2, suite) {
   if (suite !== "docs" && suite !== "self")
     return "not-applicable";
-  if (process4.env.CI === "true")
-    return "skipped-ci";
-  const result = checkCatalog(root2);
-  if (result.missing)
-    return "missing";
-  if (result.stale)
-    return "stale";
-  return "current";
+  return refreshLocalCatalog(root2);
 }
 function buildAuditResult(input) {
   const diagnostics = finalizeIssues(input.issues, input.options.strict);
@@ -32366,7 +32533,8 @@ async function evaluateAudit(options) {
   const base = createContext({
     root: options.root,
     paths: pathScoped ? options.paths : undefined,
-    includeExcludedSkillTrees: options.suite === "skills" && !pathScoped
+    includeExcludedSkillTrees: options.suite === "skills" && !pathScoped,
+    fileSource: options.fileSource
   });
   const loaded = await loadPlugins(base.root, base.config);
   const ctx = { ...base, policies: loaded.policies };
@@ -32408,11 +32576,6 @@ async function evaluateAudit(options) {
   for (const rule of executableRules) {
     issues.push(...rule.run(ctx));
   }
-  if (options.suite === "docs" || options.suite === "self") {
-    for (const message of catalogAuditWarnings(ctx.root)) {
-      issues.push(issue("catalog", CATALOG_REL_PATH, { message, severity: "warning" }));
-    }
-  }
   const executed = executableRules.map((rule) => rule.id);
   return buildAuditResult({
     options,
@@ -32442,20 +32605,20 @@ async function runAudit(options) {
 }
 
 // src/customize/resolve.ts
-import { existsSync as existsSync17, readFileSync as readFileSync17 } from "node:fs";
-import { basename as basename3, join as join15, relative as relative9 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync18 } from "node:fs";
+import { basename as basename3, join as join16, relative as relative8 } from "node:path";
 function customizeDir(root2) {
-  return join15(root2, REGISTRY_DIR_REL, "customize");
+  return join16(root2, REGISTRY_DIR_REL, "customize");
 }
 function customizePathForSlug(root2, slug2) {
-  return join15(customizeDir(root2), `${slug2}.md`);
+  return join16(customizeDir(root2), `${slug2}.md`);
 }
 function resolveSlugFile(root2, slug2) {
   const direct = customizePathForSlug(root2, slug2);
-  if (existsSync17(direct)) {
+  if (existsSync18(direct)) {
     return {
-      content: readFileSync17(direct, "utf8"),
-      path: normalizeRelPath(relative9(root2, direct))
+      content: readFileSync18(direct, "utf8"),
+      path: normalizeRelPath(relative8(root2, direct))
     };
   }
   return { content: null, path: null };
@@ -32476,11 +32639,11 @@ function readAlwaysInclude(root2, basenames, skipBasename) {
     const file = basename3(name);
     if (skipBasename && file === skipBasename)
       continue;
-    const abs = join15(dir, file);
-    if (!existsSync17(abs))
+    const abs = join16(dir, file);
+    if (!existsSync18(abs))
       continue;
-    parts.push(readFileSync17(abs, "utf8").trimEnd());
-    paths.push(normalizeRelPath(relative9(root2, abs)));
+    parts.push(readFileSync18(abs, "utf8").trimEnd());
+    paths.push(normalizeRelPath(relative8(root2, abs)));
   }
   return { parts, paths };
 }
@@ -32519,7 +32682,7 @@ function resolveCustomizeFromRoot(slug2, startDir) {
 }
 
 // src/hooks/run.ts
-import process5 from "node:process";
+import process4 from "node:process";
 function parsePayload(raw) {
   if (!raw.trim())
     return {};
@@ -32550,7 +32713,7 @@ function extractSkillSlug(payload) {
   }
   const path3 = extractPath(payload);
   if (path3)
-    return slugFromPath(path3, process5.cwd());
+    return slugFromPath(path3, process4.cwd());
   return null;
 }
 function cursorResponse(content3) {
@@ -32602,40 +32765,40 @@ Customize override for /${slug2} (from ${from}):
 }
 
 // src/init/init.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { copyFileSync, existsSync as existsSync21, mkdirSync as mkdirSync4, readFileSync as readFileSync19 } from "node:fs";
-import { join as join19 } from "node:path";
-import process6 from "node:process";
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { copyFileSync, existsSync as existsSync23, mkdirSync as mkdirSync4, readFileSync as readFileSync21 } from "node:fs";
+import { join as join21 } from "node:path";
+import process5 from "node:process";
 
 // src/init/merge-hooks.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync3, readFileSync as readFileSync18, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname12, join as join18 } from "node:path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync3, readFileSync as readFileSync19, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname12, join as join19 } from "node:path";
 
 // src/init/package-paths.ts
-import { existsSync as existsSync18 } from "node:fs";
-import { dirname as dirname10, join as join16 } from "node:path";
+import { existsSync as existsSync19 } from "node:fs";
+import { dirname as dirname10, join as join17 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var MODULE_DIR = dirname10(fileURLToPath4(import.meta.url));
-var PACKAGE_ROOT_CANDIDATES = [join16(MODULE_DIR, "../.."), join16(MODULE_DIR, "..")];
+var PACKAGE_ROOT_CANDIDATES = [join17(MODULE_DIR, "../.."), join17(MODULE_DIR, "..")];
 function resolvePackageRoot() {
   for (const candidate of PACKAGE_ROOT_CANDIDATES) {
-    if (existsSync18(join16(candidate, "package.json")))
+    if (existsSync19(join17(candidate, "package.json")))
       return candidate;
   }
   throw new Error("Could not resolve @csark0812/skeleton package root");
 }
 function resolveTemplatesDir() {
-  const dir = join16(resolvePackageRoot(), "templates/skeleton-init");
-  if (!existsSync18(dir)) {
+  const dir = join17(resolvePackageRoot(), "templates/skeleton-init");
+  if (!existsSync19(dir)) {
     throw new Error("Missing templates/skeleton-init in package");
   }
   return dir;
 }
 
 // src/init/resolve-hook-command.ts
-import { existsSync as existsSync19, realpathSync as realpathSync5 } from "node:fs";
+import { existsSync as existsSync20, realpathSync as realpathSync5 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname11, join as join17, relative as relative10, resolve as resolve6 } from "node:path";
+import { dirname as dirname11, join as join18, relative as relative9, resolve as resolve6 } from "node:path";
 var PACKAGE_NAME = "@csark0812/skeleton";
 var CLI_DIST = "dist/cli.js";
 var PACKAGE_ROOT = resolvePackageRoot();
@@ -32649,12 +32812,12 @@ function safeRealpath2(path3) {
   }
 }
 function toRepoRelative(cwd, absPath) {
-  const rel = relative10(safeRealpath2(cwd), safeRealpath2(absPath)).replace(/\\/g, "/");
+  const rel = relative9(safeRealpath2(cwd), safeRealpath2(absPath)).replace(/\\/g, "/");
   return rel.startsWith("..") ? absPath.replace(/\\/g, "/") : rel;
 }
 function tryResolvePublishedCli(cwd) {
   try {
-    const req = createRequire3(join17(cwd, "package.json"));
+    const req = createRequire3(join18(cwd, "package.json"));
     return req.resolve(`${PACKAGE_NAME}/${CLI_DIST}`);
   } catch {
     return null;
@@ -32663,8 +32826,8 @@ function tryResolvePublishedCli(cwd) {
 function walkNodeModulesCli(cwd) {
   let dir = cwd;
   while (true) {
-    const candidate = join17(dir, "node_modules", PACKAGE_NAME, CLI_DIST);
-    if (existsSync19(candidate))
+    const candidate = join18(dir, "node_modules", PACKAGE_NAME, CLI_DIST);
+    if (existsSync20(candidate))
       return candidate;
     const parent = dirname11(dir);
     if (parent === dir)
@@ -32674,7 +32837,7 @@ function walkNodeModulesCli(cwd) {
   return null;
 }
 function isInsidePackageRoot(cwd) {
-  const rel = relative10(PACKAGE_ROOT, resolve6(cwd)).replace(/\\/g, "/");
+  const rel = relative9(PACKAGE_ROOT, resolve6(cwd)).replace(/\\/g, "/");
   return rel === "" || !(rel.startsWith("..") || rel.startsWith("/"));
 }
 function nodeCliHookCommand(cliPath) {
@@ -32705,14 +32868,14 @@ function identityKey(platform, event, matcher) {
   return `skeleton:customize:${platform}:${event}:${matcher}`;
 }
 function loadFragment(name, hookCommand) {
-  const raw = readFileSync18(join18(TEMPLATES_DIR, name), "utf8");
+  const raw = readFileSync19(join19(TEMPLATES_DIR, name), "utf8");
   return JSON.parse(raw.replaceAll("{{HOOK_COMMAND}}", hookCommand));
 }
 function readJson(path3) {
-  if (!existsSync20(path3))
+  if (!existsSync21(path3))
     return null;
   try {
-    return JSON.parse(readFileSync18(path3, "utf8"));
+    return JSON.parse(readFileSync19(path3, "utf8"));
   } catch (error) {
     throw new Error(`Invalid JSON in ${path3}: ${error}`);
   }
@@ -32872,10 +33035,10 @@ function mergeNestedHooks(args) {
 }
 function mergeHookConfigs(opts) {
   const results = [];
-  const cursorPath = join18(opts.cwd, ".cursor/hooks.json");
+  const cursorPath = join19(opts.cwd, ".cursor/hooks.json");
   const cursorFragment = loadFragment("cursor-hooks.fragment.json", opts.hookCommand);
   results.push(mergeCursorHooks(cursorPath, cursorFragment, opts));
-  const claudePath = join18(opts.cwd, ".claude/settings.json");
+  const claudePath = join19(opts.cwd, ".claude/settings.json");
   const claudeFragment = loadFragment("claude-settings.fragment.json", opts.hookCommand);
   results.push(mergeNestedHooks({
     platform: "claude",
@@ -32884,8 +33047,8 @@ function mergeHookConfigs(opts) {
     eventName: "PostToolUse",
     opts
   }));
-  const codexPath = join18(opts.cwd, ".codex/hooks.json");
-  if (existsSync20(join18(opts.cwd, ".codex"))) {
+  const codexPath = join19(opts.cwd, ".codex/hooks.json");
+  if (existsSync21(join19(opts.cwd, ".codex"))) {
     const codexFragment = loadFragment("codex-hooks.fragment.json", opts.hookCommand);
     results.push(mergeNestedHooks({
       platform: "codex",
@@ -32900,11 +33063,11 @@ function mergeHookConfigs(opts) {
   return results;
 }
 function mergePackageJsonScripts(cwd) {
-  const pkgPath = join18(cwd, "package.json");
-  if (!existsSync20(pkgPath))
+  const pkgPath = join19(cwd, "package.json");
+  if (!existsSync21(pkgPath))
     return "skipped";
-  const fragment = JSON.parse(readFileSync18(join18(TEMPLATES_DIR, "package.json.scripts.fragment.json"), "utf8"));
-  const pkg = JSON.parse(readFileSync18(pkgPath, "utf8"));
+  const fragment = JSON.parse(readFileSync19(join19(TEMPLATES_DIR, "package.json.scripts.fragment.json"), "utf8"));
+  const pkg = JSON.parse(readFileSync19(pkgPath, "utf8"));
   pkg.scripts ??= {};
   let changed = false;
   for (const [key, value] of Object.entries(fragment)) {
@@ -32920,6 +33083,37 @@ function mergePackageJsonScripts(cwd) {
   return "updated";
 }
 
+// src/init/merge-precommit.ts
+import { existsSync as existsSync22, readFileSync as readFileSync20, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join20 } from "node:path";
+var TEMPLATES_DIR2 = resolveTemplatesDir();
+var PRECOMMIT_NAME = ".pre-commit-config.yaml";
+var HOOK_ID = "id: skeleton-validate-staged";
+var LOCAL_HOOK_BLOCK = `  - repo: local
+    hooks:
+      - id: skeleton-validate-staged
+        name: skeleton validate changed (staged)
+        entry: node node_modules/@csark0812/skeleton/dist/cli.js validate changed --staged
+        language: system
+        pass_filenames: false
+`;
+function mergePrecommitConfig(cwd) {
+  const target = join20(cwd, PRECOMMIT_NAME);
+  const template = readFileSync20(join20(TEMPLATES_DIR2, "pre-commit-config.yaml"), "utf8");
+  if (!existsSync22(target)) {
+    writeFileSync5(target, template, "utf8");
+    return "added";
+  }
+  const existing = readFileSync20(target, "utf8");
+  if (existing.includes(HOOK_ID))
+    return "skipped";
+  const suffix = existing.includes("repos:") ? `
+${LOCAL_HOOK_BLOCK}` : `
+${template}`;
+  writeFileSync5(target, `${existing.trimEnd()}${suffix}`, "utf8");
+  return "updated";
+}
+
 // src/init/skills-args.ts
 var SKILLS_SOURCE = "csark0812/skeleton";
 var DEFAULT_SKILL = "skeleton";
@@ -32958,25 +33152,25 @@ function skillsAddArgs(options = {}) {
 }
 
 // src/init/init.ts
-var TEMPLATES_DIR2 = resolveTemplatesDir();
+var TEMPLATES_DIR3 = resolveTemplatesDir();
 function writeScaffold(cwd) {
-  const skeletonDir2 = join19(cwd, ".skeleton");
+  const skeletonDir2 = join21(cwd, ".skeleton");
   mkdirSync4(skeletonDir2, { recursive: true });
   let created = false;
-  const tomlPath = join19(cwd, "skeleton.toml");
-  const legacyYaml = join19(skeletonDir2, "config.yaml");
-  if (!(existsSync21(tomlPath) || existsSync21(legacyYaml))) {
-    copyFileSync(join19(TEMPLATES_DIR2, "skeleton.toml"), tomlPath);
+  const tomlPath = join21(cwd, "skeleton.toml");
+  const legacyYaml = join21(skeletonDir2, "config.yaml");
+  if (!(existsSync23(tomlPath) || existsSync23(legacyYaml))) {
+    copyFileSync(join21(TEMPLATES_DIR3, "skeleton.toml"), tomlPath);
     created = true;
   }
-  mkdirSync4(join19(skeletonDir2, "customize"), { recursive: true });
+  mkdirSync4(join21(skeletonDir2, "customize"), { recursive: true });
   return created ? "created" : "skipped";
 }
 function assertPackageResolvable(cwd) {
-  const pkgPath = join19(cwd, "package.json");
-  if (!existsSync21(pkgPath))
+  const pkgPath = join21(cwd, "package.json");
+  if (!existsSync23(pkgPath))
     return;
-  const pkg = JSON.parse(readFileSync19(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync21(pkgPath, "utf8"));
   const hasDep = pkg.devDependencies?.["@csark0812/skeleton"] || pkg.dependencies?.["@csark0812/skeleton"];
   if (!hasDep) {
     try {
@@ -32987,7 +33181,7 @@ function assertPackageResolvable(cwd) {
   }
 }
 function runSkillsAdd(args, cwd) {
-  const result = spawnSync2("npx", args, {
+  const result = spawnSync3("npx", args, {
     cwd,
     stdio: "inherit",
     shell: false
@@ -33016,24 +33210,30 @@ function installSkillsIfRequested(options, cwd) {
   return "installed";
 }
 function runInit(options = {}) {
-  const cwd = options.cwd ?? process6.cwd();
+  const cwd = options.cwd ?? process5.cwd();
   assertPackageResolvable(cwd);
   const scaffold = writeScaffold(cwd);
   const hookCommand = resolveHookCommand(cwd);
   const hooks = mergeHookConfigs({ cwd, hookCommand, forceHooks: options.forceHooks });
   const scripts = mergePackageJsonScripts(cwd);
+  const precommit = mergePrecommitConfig(cwd);
   for (const result of hooks)
     logHookMergeResult(result);
   if (scaffold === "created") {
-    console.log("init: wrote skeleton.toml (hooks optional — see docs)");
+    console.log("init: wrote skeleton.toml (IDE customize hooks optional)");
   } else {
     console.log("init: skeleton.toml or .skeleton/ already present — skipped scaffold write");
   }
   if (scripts === "updated") {
     console.log("init: merged validate/audit scripts into package.json");
   }
+  if (precommit === "added") {
+    console.log("init: wrote .pre-commit-config.yaml (run pre-commit install once per machine)");
+  } else if (precommit === "updated") {
+    console.log("init: added skeleton validate hook to .pre-commit-config.yaml");
+  }
   const skills = installSkillsIfRequested(options, cwd);
-  return { scaffold, hooks, scripts, skills };
+  return { scaffold, hooks, scripts, skills, precommit };
 }
 
 // src/init/parse-args.ts
@@ -33058,9 +33258,9 @@ function parseInitArgs(argv) {
 }
 
 // src/plugins/build.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync22, readFileSync as readFileSync20, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync22, writeFileSync as writeFileSync6 } from "node:fs";
 import { basename as basename4, dirname as dirname13, resolve as resolve7 } from "node:path";
 function parseBuildPluginArgs(argv) {
   let check = false;
@@ -33101,7 +33301,7 @@ function localImportPaths(tsAbs, content3) {
       candidates.push(resolve7(dir, spec), resolve7(dir, `${spec}.ts`), resolve7(dir, `${spec}.js`), resolve7(dir, spec, "index.ts"));
     }
     for (const candidate of candidates) {
-      if (existsSync22(candidate) && candidate.endsWith(".ts")) {
+      if (existsSync24(candidate) && candidate.endsWith(".ts")) {
         deps.push(candidate);
         break;
       }
@@ -33118,7 +33318,7 @@ function sourceFingerprint(tsAbs, seen = new Set) {
     if (seen.has(abs))
       return;
     seen.add(abs);
-    const content3 = readFileSync20(abs, "utf8");
+    const content3 = readFileSync22(abs, "utf8");
     hash2.update(basename4(abs));
     hash2.update("\x00");
     hash2.update(content3);
@@ -33131,15 +33331,15 @@ function sourceFingerprint(tsAbs, seen = new Set) {
   return hash2.digest("hex");
 }
 function writeStamp(tsAbs, mjsAbs) {
-  writeFileSync5(stampPathForMjs(mjsAbs), `${sourceFingerprint(tsAbs)}
+  writeFileSync6(stampPathForMjs(mjsAbs), `${sourceFingerprint(tsAbs)}
 `, "utf8");
 }
 async function buildOne(tsAbs) {
   const mjsAbs = mjsPathForTs(tsAbs);
-  if (!existsSync22(tsAbs)) {
+  if (!existsSync24(tsAbs)) {
     throw new Error(`Plugin source not found: ${tsAbs}`);
   }
-  const proc = spawnSync3("bun", ["build", tsAbs, "--target=node", "--format=esm", `--outfile=${mjsAbs}`, "--packages=external"], { encoding: "utf8" });
+  const proc = spawnSync4("bun", ["build", tsAbs, "--target=node", "--format=esm", `--outfile=${mjsAbs}`, "--packages=external"], { encoding: "utf8" });
   if (proc.error) {
     const code3 = proc.error.code;
     if (code3 === "ENOENT") {
@@ -33156,17 +33356,17 @@ ${proc.stderr || proc.stdout || `exit ${proc.status}`}`);
 }
 function checkOne(tsAbs) {
   const mjsAbs = mjsPathForTs(tsAbs);
-  if (!existsSync22(mjsAbs)) {
+  if (!existsSync24(mjsAbs)) {
     throw new Error(`Plugin not built: ${tsAbs} (missing ${mjsAbs}). Run: skeleton build-plugin`);
   }
-  if (!existsSync22(tsAbs)) {
+  if (!existsSync24(tsAbs)) {
     throw new Error(`Plugin source not found: ${tsAbs}`);
   }
   const stampAbs = stampPathForMjs(mjsAbs);
-  if (!existsSync22(stampAbs)) {
+  if (!existsSync24(stampAbs)) {
     throw new Error(`Plugin stale: ${mjsAbs} has no fingerprint stamp. Run: skeleton build-plugin`);
   }
-  const expected = readFileSync20(stampAbs, "utf8").trim();
+  const expected = readFileSync22(stampAbs, "utf8").trim();
   const actual = sourceFingerprint(tsAbs);
   if (expected !== actual) {
     throw new Error(`Plugin stale: ${mjsAbs} does not match ${tsAbs} (or local imports). Run: skeleton build-plugin`);
@@ -33195,15 +33395,15 @@ async function runBuildPlugin(options = {}) {
 }
 
 // src/validate/changed.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync21 } from "node:fs";
-import { basename as basename5, extname as extname2, join as join20 } from "node:path";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync25, readFileSync as readFileSync23 } from "node:fs";
+import { basename as basename5, extname as extname2, join as join22 } from "node:path";
 
 // src/validate/git-diff.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 function gitDiffChangedFiles(options = {}) {
   const root2 = options.root ?? findRepoRoot();
-  const proc = spawnSync4("git", gitDiffArgs(options), { cwd: root2, encoding: "utf8" });
+  const proc = spawnSync5("git", gitDiffArgs(options), { cwd: root2, encoding: "utf8" });
   if (proc.status !== 0) {
     throw new Error(proc.stderr?.trim() || "git diff failed");
   }
@@ -33239,6 +33439,32 @@ function addChangedPath(input) {
   });
 }
 
+// src/validate/staged.ts
+function stageRequiredIssue(file) {
+  return issue("validate-changed", file, {
+    code: "stage-required",
+    message: "worktree differs from HEAD and is not staged; stage the attested document and review-lock.json when hash mode is on"
+  });
+}
+function stageRequiredDiagnostics(input) {
+  if (!input.staged)
+    return [];
+  const staged = new Set(input.stagedPaths.map(normalizeRelPath));
+  const required = [...input.impactedDocuments];
+  if (input.config.reviewProof) {
+    required.push(input.config.reviewProof.lockfile ?? DEFAULT_REVIEW_LOCKFILE);
+  }
+  const issues = [];
+  for (const path3 of [...new Set(required)].sort()) {
+    if (staged.has(path3))
+      continue;
+    if (!pathDiffersFromHead(input.root, path3))
+      continue;
+    issues.push(stageRequiredIssue(path3));
+  }
+  return issues;
+}
+
 // src/validate/changed.ts
 var DOC_EXTENSIONS = new Set([".md", ".mdc", ".yaml", ".yml"]);
 var POLICY_EXTENSIONS = new Set([".yaml", ".yml"]);
@@ -33314,30 +33540,51 @@ function parseJsonContent(content3) {
 function validationIssue(code3, file, message) {
   return issue("validate-changed", file, { code: code3, message, severity: "error" });
 }
-function validateJson(relPath2, root2) {
-  const abs = join20(root2, relPath2);
+function rereadValidationIssue(file, target) {
+  return issue("validate-changed", file, {
+    code: "impacted-document-review-required",
+    message: "a linked review dependency changed; re-read the entire document, then attest it with --fix=doc-meta --confirm-reviewed and include the document in validation",
+    severity: "error",
+    link: target
+  });
+}
+function validateJson(relPath2, root2, fileSource) {
+  const content3 = readRepoText(root2, relPath2, fileSource);
+  if (content3 === null)
+    return validationIssue("invalid-json", relPath2, "path not found");
   try {
-    parseJsonContent(readFileSync21(abs, "utf8"));
+    parseJsonContent(content3);
     return null;
   } catch (error) {
     return validationIssue("invalid-json", relPath2, `invalid JSON: ${error}`);
   }
 }
-function validatePolicy(relPath2, root2) {
-  const abs = join20(root2, relPath2);
+function validatePolicy(relPath2, root2, fileSource) {
+  const content3 = readRepoText(root2, relPath2, fileSource);
+  if (content3 === null)
+    return validationIssue("invalid-policy", relPath2, "path not found");
   try {
-    loadPolicyFile(abs, readFileSync21(abs, "utf8"));
+    loadPolicyFile(join22(root2, relPath2), content3);
     return null;
   } catch (error) {
     return validationIssue("invalid-policy", relPath2, `invalid policy: ${error}`);
   }
 }
-function validateShell(relPath2, root2) {
-  const abs = join20(root2, relPath2);
-  const shellcheck = spawnSync5("shellcheck", [abs], { encoding: "utf8" });
+function validateShell(relPath2, root2, fileSource) {
+  if (fileSource === "index") {
+    const content3 = readRepoText(root2, relPath2, fileSource);
+    if (content3 === null)
+      return validationIssue("invalid-shell", relPath2, "path not found");
+    const bash2 = spawnSync6("bash", ["-n"], { input: content3, encoding: "utf8" });
+    if (bash2.status === 0)
+      return null;
+    return validationIssue("invalid-shell", relPath2, `shell syntax check failed: ${bash2.stderr}`);
+  }
+  const abs = join22(root2, relPath2);
+  const shellcheck = spawnSync6("shellcheck", [abs], { encoding: "utf8" });
   if (shellcheck.status === 0)
     return null;
-  const bash = spawnSync5("bash", ["-n", abs], { encoding: "utf8" });
+  const bash = spawnSync6("bash", ["-n", abs], { encoding: "utf8" });
   if (bash.status === 0)
     return null;
   return validationIssue("invalid-shell", relPath2, `shell syntax check failed: ${bash.stderr || shellcheck.stderr}`);
@@ -33357,11 +33604,11 @@ function resolvePaths(options) {
   };
 }
 function packageManagerFromPackageJson(root2) {
-  const pkgPath = join20(root2, "package.json");
-  if (!existsSync23(pkgPath))
+  const pkgPath = join22(root2, "package.json");
+  if (!existsSync25(pkgPath))
     return null;
   try {
-    const pkg = JSON.parse(readFileSync21(pkgPath, "utf8"));
+    const pkg = JSON.parse(readFileSync23(pkgPath, "utf8"));
     const raw = pkg.packageManager?.split("@")[0];
     if (raw === "bun" || raw === "npm" || raw === "pnpm" || raw === "yarn")
       return raw;
@@ -33369,13 +33616,13 @@ function packageManagerFromPackageJson(root2) {
   return null;
 }
 function packageManagerFromLockfiles(root2) {
-  if (existsSync23(join20(root2, "bun.lock")) || existsSync23(join20(root2, "bun.lockb")))
+  if (existsSync25(join22(root2, "bun.lock")) || existsSync25(join22(root2, "bun.lockb")))
     return "bun";
-  if (existsSync23(join20(root2, "pnpm-lock.yaml")))
+  if (existsSync25(join22(root2, "pnpm-lock.yaml")))
     return "pnpm";
-  if (existsSync23(join20(root2, "yarn.lock")))
+  if (existsSync25(join22(root2, "yarn.lock")))
     return "yarn";
-  if (existsSync23(join20(root2, "package-lock.json")))
+  if (existsSync25(join22(root2, "package-lock.json")))
     return "npm";
   return null;
 }
@@ -33401,8 +33648,8 @@ function emptyBuckets() {
 function classifySinglePath(input) {
   const { relPath: relPath2, ctx, state, bucketCtx } = input;
   const normalized = normalizeRelPath(relPath2);
-  const abs = join20(ctx.root, normalized);
-  if (!existsSync23(abs)) {
+  const abs = join22(ctx.root, normalized);
+  if (!existsSync25(abs)) {
     state.missing.push(normalized);
     return;
   }
@@ -33440,20 +33687,20 @@ function classifyPaths(ctx) {
   }
   return state;
 }
-function validateLocalBuckets(buckets, root2) {
+function validateLocalBuckets(buckets, root2, fileSource) {
   const diagnostics = [];
   for (const relPath2 of buckets.shell) {
-    const found = validateShell(relPath2, root2);
+    const found = validateShell(relPath2, root2, fileSource);
     if (found)
       diagnostics.push(found);
   }
   for (const relPath2 of buckets.json) {
-    const found = validateJson(relPath2, root2);
+    const found = validateJson(relPath2, root2, fileSource);
     if (found)
       diagnostics.push(found);
   }
   for (const relPath2 of buckets.policy) {
-    const found = validatePolicy(relPath2, root2);
+    const found = validatePolicy(relPath2, root2, fileSource);
     if (found)
       diagnostics.push(found);
   }
@@ -33466,16 +33713,24 @@ function discoverImpactedDocuments(input) {
   const changed = new Set(input.relPaths.map(normalizeRelPath));
   const impacted = [];
   for (const abs of collectScanFiles(input.config, input.root, input.skillIndex)) {
-    const document4 = impactedDocumentForPath(abs, input.root, changed);
+    const document4 = impactedDocumentForPath({
+      abs,
+      root: input.root,
+      changed,
+      fileSource: input.fileSource
+    });
     if (document4)
       impacted.push(document4);
   }
   return impacted.sort((a, b) => a.path.localeCompare(b.path));
 }
-function impactedDocumentForPath(abs, root2, changed) {
-  const path3 = relPath(abs, root2);
-  const reviewDependencies = reviewDependencyPatterns(readFileSync21(abs, "utf8"));
-  const reasons = impactReasons(path3, reviewDependencies, changed);
+function impactedDocumentForPath(input) {
+  const path3 = relPath(input.abs, input.root);
+  const content3 = readRepoText(input.root, path3, input.fileSource);
+  if (content3 === null)
+    return null;
+  const reviewDependencies = reviewDependencyPatterns(content3);
+  const reasons = impactReasons(path3, reviewDependencies, input.changed);
   return reasons.length > 0 ? { path: path3, reviewDependencies, reasons } : null;
 }
 function impactReasons(path3, reviewDependencies, changed) {
@@ -33494,18 +33749,35 @@ function dateModeImpactDiagnostics(input) {
     return [];
   const changed = new Set(input.relPaths.map(normalizeRelPath));
   const today = formatLocalReviewDate(new Date);
-  const diagnostics = [];
-  for (const impacted of input.impactedDocuments) {
-    if (!impacted.reasons.some((reason) => reason.kind === "changed-review-dependency"))
-      continue;
-    const content3 = readFileSync21(join20(input.root, impacted.path), "utf8");
-    if (changed.has(impacted.path) && docMetaLastReviewed(content3) === today)
+  return input.impactedDocuments.flatMap((impacted) => dateModeIssuesForDocument({
+    impacted,
+    changed,
+    today,
+    root: input.root,
+    fileSource: input.fileSource
+  }));
+}
+function dateModeIssuesForDocument(input) {
+  const content3 = readRepoText(input.root, input.impacted.path, input.fileSource);
+  if (!content3) {
+    return input.impacted.reasons.filter((reason) => reason.kind === "changed-review-dependency" && reason.target).map((reason) => rereadValidationIssue(input.impacted.path, reason.target ?? ""));
+  }
+  if (input.changed.has(input.impacted.path) && docMetaLastReviewed(content3) === input.today) {
+    return [];
+  }
+  const issues = [];
+  for (const reason of input.impacted.reasons) {
+    if (reason.kind !== "changed-review-dependency" || !reason.target)
       continue;
-    diagnostics.push(validationIssue("impacted-document-review-required", impacted.path, "a linked review dependency changed; re-read the entire document, then attest it with --fix=doc-meta --confirm-reviewed and include the document in validation"));
+    issues.push(rereadValidationIssue(input.impacted.path, reason.target));
   }
-  return diagnostics;
+  return issues;
+}
+function uncoveredChangedPathDiagnostics(relPaths, config, patterns) {
+  return relPaths.map(normalizeRelPath).filter((path3) => pathRequiresReviewCoverage(path3, config)).filter((path3) => !pathHasReviewOwner(path3, patterns)).map((path3) => validationIssue("uncovered-changed-path", path3, "no scanned document claims this path with review-deps. Add a review-deps marker on the owning paper."));
 }
-function classificationDiagnostics(classification, root2, base) {
+function classificationDiagnostics(input) {
+  const { classification, root: root2, base, coverageCandidateCount } = input;
   const diagnostics = [];
   for (const orphan of classification.orphans) {
     diagnostics.push(validationIssue("orphan-policy", orphan, "file is under .skeleton/ but is not referenced by any plugin policies glob; export it from a plugin policies array or move it"));
@@ -33514,7 +33786,7 @@ function classificationDiagnostics(classification, root2, base) {
     diagnostics.push(validationIssue("missing-path", missing, "path not found"));
   }
   const audited = auditedPathCount(classification.buckets);
-  if ((classification.skipped.length > 0 || classification.buckets.code.length > 0) && audited === 0 && !base) {
+  if ((classification.skipped.length > 0 || classification.buckets.code.length > 0) && audited === 0 && coverageCandidateCount === 0 && !base) {
     diagnostics.push(validationIssue("all-paths-skipped", ".", `all paths were skipped (code/config). This does not verify application code.
 ${codeValidationHint(root2)}`));
   }
@@ -33545,35 +33817,54 @@ function auditOptions(suite, root2, paths, extra = {}) {
     ...extra
   };
 }
+async function auditSkillChanges(input) {
+  const sourceOpt = { fileSource: input.fileSource };
+  if (input.skills.length === 0)
+    return [];
+  if (!input.base) {
+    return [await evaluateAudit(auditOptions("skills", input.root, [], sourceOpt))];
+  }
+  return [
+    await evaluateAudit(auditOptions("skills", input.root, input.skills, {
+      pathScopedOnly: true,
+      ...sourceOpt
+    }))
+  ];
+}
+async function auditPolicyChanges(input) {
+  const sourceOpt = { fileSource: input.fileSource };
+  const audits = [await evaluateAudit(auditOptions("docs", input.root, [], sourceOpt))];
+  const skillPaths = listSkillMarkdownPaths(input.root, input.skillIndex);
+  if (skillPaths.length === 0)
+    return audits;
+  audits.push(await evaluateAudit(auditOptions("skills", input.root, skillPaths, {
+    pathScopedOnly: true,
+    ...sourceOpt
+  })));
+  return audits;
+}
 async function evaluateBucketAudits(input) {
-  const { classification, root: root2, skillIndex, base } = input;
+  const { classification, root: root2, skillIndex, base, fileSource } = input;
   const audits = [];
-  const diagnostics = validateLocalBuckets(classification.buckets, root2);
+  const diagnostics = validateLocalBuckets(classification.buckets, root2, fileSource);
+  const sourceOpt = { fileSource };
   if (base) {
-    audits.push(await evaluateAudit(auditOptions("self", root2, [], { globalOnly: true })));
+    audits.push(await evaluateAudit(auditOptions("self", root2, [], { globalOnly: true, ...sourceOpt })));
   }
   if (classification.buckets.docs.length > 0) {
-    audits.push(await evaluateAudit(auditOptions("docs", root2, classification.buckets.docs, { pathScopedOnly: true })));
-  }
-  if (classification.buckets.skills.length > 0) {
-    if (!base) {
-      diagnostics.push(validationIssue("full-skills-audit-required", classification.buckets.skills[0] ?? ".", "skill paths need the full skills suite; run skeleton audit skills (audit self covers docs and .skeleton; excluded skill trees still need audit skills)"));
-    } else {
-      audits.push(await evaluateAudit(auditOptions("skills", root2, classification.buckets.skills, {
-        pathScopedOnly: true
-      })));
-    }
+    audits.push(await evaluateAudit(auditOptions("docs", root2, classification.buckets.docs, {
+      pathScopedOnly: true,
+      ...sourceOpt
+    })));
   }
-  if (classification.buckets.policy.length > 0) {
-    if (!base) {
-      diagnostics.push(validationIssue("full-policy-audit-required", classification.buckets.policy[0] ?? ".", "policy YAML changes need full prose passes; run skeleton audit docs and skeleton audit skills"));
-    } else {
-      audits.push(await evaluateAudit(auditOptions("docs", root2, [])));
-      const skillPaths = listSkillMarkdownPaths(root2, skillIndex);
-      if (skillPaths.length > 0) {
-        audits.push(await evaluateAudit(auditOptions("skills", root2, skillPaths, { pathScopedOnly: true })));
-      }
-    }
+  audits.push(...await auditSkillChanges({
+    skills: classification.buckets.skills,
+    root: root2,
+    base,
+    fileSource
+  }));
+  if (classification.buckets.policy.length > 0 && !diagnostics.some((item) => item.code === "invalid-policy")) {
+    audits.push(...await auditPolicyChanges({ root: root2, skillIndex, fileSource }));
   }
   return { audits, diagnostics };
 }
@@ -33611,6 +33902,7 @@ function emptyClassification() {
 }
 async function evaluateValidateChanged(options = {}) {
   const root2 = options.root ?? findRepoRoot();
+  refreshLocalCatalog(root2);
   const resolvedPaths = resolvePaths(options);
   const relPaths = resolvedPaths.paths;
   if (relPaths.length === 0) {
@@ -33618,6 +33910,7 @@ async function evaluateValidateChanged(options = {}) {
   }
   const config = loadConfig(root2);
   const skillIndex = buildSkillIndex(root2, config.skillOwnership);
+  const fileSource = options.staged ? "index" : "worktree";
   let wiredPolicies;
   try {
     wiredPolicies = await collectWiredPolicyRelPaths(root2, config);
@@ -33638,37 +33931,57 @@ async function evaluateValidateChanged(options = {}) {
     skillIndex
   });
   classification.missing = classification.missing.filter((path3) => !resolvedPaths.deleted.has(path3));
-  const impactedDocuments = discoverImpactedDocuments({ relPaths, root: root2, config, skillIndex });
+  const impactedDocuments = discoverImpactedDocuments({
+    relPaths,
+    root: root2,
+    config,
+    skillIndex,
+    fileSource
+  });
   for (const impacted of impactedDocuments) {
     if (!classification.buckets.docs.includes(impacted.path)) {
       classification.buckets.docs.push(impacted.path);
     }
   }
   classification.buckets.docs.sort();
-  const diagnostics = classificationDiagnostics(classification, root2, options.base);
-  if (diagnostics.length > 0) {
-    return resultFor({
-      options,
-      relPaths,
-      classification: publicClassification(classification),
-      impactedDocuments,
-      diagnostics
-    });
-  }
+  const ownerPatterns = collectReviewDependencyPatterns({
+    root: root2,
+    config,
+    skillIndex,
+    fileSource
+  });
+  const coverageCandidateCount = relPaths.filter((path3) => pathRequiresReviewCoverage(path3, config)).length;
+  const diagnostics = [
+    ...classificationDiagnostics({
+      classification,
+      root: root2,
+      base: options.base,
+      coverageCandidateCount
+    }),
+    ...uncoveredChangedPathDiagnostics(relPaths, config, ownerPatterns),
+    ...stageRequiredDiagnostics({
+      staged: options.staged ?? false,
+      stagedPaths: relPaths,
+      impactedDocuments: impactedDocuments.map((item) => item.path),
+      config,
+      root: root2
+    })
+  ];
   const evaluated = await evaluateBucketAudits({
     classification,
     root: root2,
     skillIndex,
-    base: options.base
+    base: options.base,
+    fileSource
   });
-  evaluated.diagnostics.push(...dateModeImpactDiagnostics({ config, impactedDocuments, relPaths, root: root2 }));
+  evaluated.diagnostics.push(...dateModeImpactDiagnostics({ config, impactedDocuments, relPaths, root: root2, fileSource }));
   return resultFor({
     options,
     relPaths,
     classification: publicClassification(classification),
     impactedDocuments,
     audits: evaluated.audits,
-    diagnostics: evaluated.diagnostics
+    diagnostics: [...diagnostics, ...evaluated.diagnostics]
   });
 }
 function printValidateChangedResult(result) {
@@ -33679,16 +33992,20 @@ function printValidateChangedResult(result) {
   for (const path3 of result.classification.foreignSkills) {
     console.log(`validate changed: skipping foreign skill ${path3} (owned upstream; see skills-lock.json / skillOwnership)`);
   }
-  for (const audit of result.audits)
-    printAuditResult(audit, false);
-  for (const impacted of result.impactedDocuments) {
-    for (const reason of impacted.reasons) {
-      if (reason.kind !== "changed-review-dependency")
-        continue;
-      console.log(`validate changed: ${impacted.path} requires review (dependency ${reason.dependency} matched ${reason.target})`);
+  if (result.ok) {
+    for (const audit of result.audits)
+      printAuditResult(audit, false);
+  } else {
+    for (const audit of result.audits.filter((item) => !item.ok)) {
+      printAuditResult(audit, false);
     }
   }
-  for (const diagnostic of result.diagnostics) {
+  const rereadDiagnostics = result.diagnostics.filter(isRereadIssue);
+  const otherDiagnostics = result.diagnostics.filter((item) => !isRereadIssue(item));
+  if (rereadDiagnostics.length > 0) {
+    printReport(rereadDiagnostics, { label: "validate changed" });
+  }
+  for (const diagnostic of otherDiagnostics) {
     const path3 = diagnostic.file === "." ? "" : `${diagnostic.file}: `;
     console.error(`validate changed: ${path3}${diagnostic.message}`);
   }
@@ -33799,7 +34116,7 @@ function handleCustomizeResolve(argv) {
   if (json) {
     console.log(JSON.stringify(result, null, 2));
   } else if (result.content) {
-    process7.stdout.write(result.content);
+    process6.stdout.write(result.content);
   }
   return 0;
 }
@@ -33808,7 +34125,7 @@ function handleHook(argv) {
     usage();
     return 1;
   }
-  process7.stdout.write(runCustomizeHook(readFileSync22(0, "utf8")));
+  process6.stdout.write(runCustomizeHook(readFileSync24(0, "utf8")));
   return 0;
 }
 function handleInit(argv) {
@@ -33840,22 +34157,22 @@ async function dispatchCommand(argv) {
   }
 }
 async function main() {
-  const argv = process7.argv.slice(2);
+  const argv = process6.argv.slice(2);
   const command = argv[0];
   if (!command || command === "--help" || command === "-h") {
     usage();
-    process7.exit(command ? 0 : 1);
+    process6.exit(command ? 0 : 1);
   }
   try {
     const exitCode = await dispatchCommand(argv);
     if (exitCode === null) {
       usage();
-      process7.exit(1);
+      process6.exit(1);
     }
-    process7.exit(exitCode);
+    process6.exit(exitCode);
   } catch (error) {
     console.error(String(error));
-    process7.exit(1);
+    process6.exit(1);
   }
 }
 main();