@csark0812/skeleton 4.0.1 → 5.0.0

package/dist/cli.js

@@ -15968,8 +15968,7 @@ var require_extend = __commonJS((exports, module) => {
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync22 } from "node:fs";
-import process7 from "node:process";
+import process5 from "node:process";
 
 // src/audit/config/load.ts
 var import_ajv = __toESM(require_ajv(), 1);
@@ -16903,7 +16902,6 @@ var $visitAsync = visit.visitAsync;
 
 // src/audit/core/shared.ts
 var CATALOG_REL_PATH = ".skeleton/catalog.md";
-var REGISTRY_DIR_REL = ".skeleton";
 var EXTERNAL_LINK_RE = /^(https?:|mailto:|#)/;
 var DOC_META_RE = /<!--\s*doc-meta:\s*owner=[^|]+\|\s*last-reviewed=\d{4}-\d{2}-\d{2}\s*-->/;
 var DOC_META_LAST_REVIEWED_RE = /last-reviewed=(\d{4}-\d{2}-\d{2})/;
@@ -17002,8 +17000,7 @@ function isDraftPlacementAllowed(relPath, draftPathPrefixes) {
 // src/audit/config/load.ts
 var SCHEMA_CANDIDATES = [
   join(dirname(fileURLToPath(import.meta.url)), "../../../schemas/config.schema.json"),
-  join(dirname(fileURLToPath(import.meta.url)), "../schemas/config.schema.json"),
-  join(dirname(fileURLToPath(import.meta.url)), "../../schemas/config.schema.json")
+  join(dirname(fileURLToPath(import.meta.url)), "../schemas/config.schema.json")
 ];
 var ROOT_CONFIG_TOML = "skeleton.toml";
 var LEGACY_CONFIG_YAML = join(".skeleton", "config.yaml");
@@ -17083,9 +17080,6 @@ function nonPublicSkills(config) {
   return config.scan.nonPublicSkills ?? [];
 }
 
-// src/audit/run.ts
-import process4 from "node:process";
-
 // src/catalog.ts
 import { existsSync as existsSync5, mkdirSync, readFileSync as readFileSync5, writeFileSync } from "node:fs";
 import { dirname as dirname3, join as join5 } from "node:path";
@@ -18229,7 +18223,6 @@ function listOwnedSkillSlugs(index) {
 
 // src/audit/core/collect.ts
 var MARKDOWN_GLOBS = ["**/*.md", "**/*.mdc"];
-var BUILTIN_INCLUDE_PATTERNS = [".skeleton/customize/**"];
 function isMarkdownFile(absPath) {
   return absPath.endsWith(".md") || absPath.endsWith(".mdc");
 }
@@ -18271,7 +18264,7 @@ function expandPatterns(root, patterns, exclude) {
 }
 function collectScanFiles(config, root, skillIndex) {
   const exclude = mergedExcludes(config);
-  const includePatterns = [...BUILTIN_INCLUDE_PATTERNS, ...config.scan.include];
+  const includePatterns = [...config.scan.include];
   if (skillIndex) {
     includePatterns.push(...skillCollectAugments(skillIndex));
   }
@@ -18571,19 +18564,11 @@ function writeCatalog(root) {
   writeFileSync(abs, content, "utf8");
   return { path: normalizeRelPath(CATALOG_REL_PATH), entries };
 }
-function catalogAuditWarnings(root) {
+function refreshLocalCatalog(root) {
   if (process3.env.CI === "true")
-    return [];
-  const result = checkCatalog(root);
-  if (result.missing) {
-    return [
-      `${CATALOG_REL_PATH} missing — run \`skeleton catalog\` so agents can skim SSOT summaries`
-    ];
-  }
-  if (result.stale) {
-    return [`${CATALOG_REL_PATH} outdated — run \`skeleton catalog\` to refresh`];
-  }
-  return [];
+    return "skipped-ci";
+  writeCatalog(root);
+  return "current";
 }
 function runCatalogCli(options = {}) {
   const root = options.root ?? findRepoRoot();
@@ -18617,8 +18602,7 @@ import { basename as basename2, dirname as dirname4, extname, join as join6 } fr
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var SCHEMA_CANDIDATES2 = [
   join6(dirname4(fileURLToPath2(import.meta.url)), "../../../schemas/policy-file.schema.json"),
-  join6(dirname4(fileURLToPath2(import.meta.url)), "../schemas/policy-file.schema.json"),
-  join6(dirname4(fileURLToPath2(import.meta.url)), "../../schemas/policy-file.schema.json")
+  join6(dirname4(fileURLToPath2(import.meta.url)), "../schemas/policy-file.schema.json")
 ];
 function resolvePolicySchemaPath() {
   for (const candidate of SCHEMA_CANDIDATES2) {
@@ -18945,7 +18929,8 @@ function createContext(options = {}) {
     registryHasTableHeader: false,
     skillIndex,
     lockedSkillSlugs: new Set(skillIndex.foreignSlugs),
-    policies: options.policies ?? []
+    policies: options.policies ?? [],
+    fileSource: options.fileSource
   };
 }
 
@@ -30900,9 +30885,8 @@ function printWarnings(label, warnings) {
     return;
   console.log(`${label} warnings:
 `);
-  for (const i of warnings) {
-    const linkPart = i.link ? ` (${i.link})` : "";
-    console.log(`- ${i.file}${linkPart}: ${i.message}`);
+  for (const item of warnings) {
+    console.log(`${item.file}: warning: ${item.message}`);
   }
   console.log("");
 }
@@ -30912,12 +30896,65 @@ function printSuccess(label, options, warnings) {
   console.log(`${label} passed${countNote}.`);
   return 0;
 }
+var REREAD_CODES = new Set([
+  "review-dependency-changed",
+  "impacted-document-review-required",
+  "review-document-changed",
+  "review-dependency-set-changed"
+]);
+function isRereadIssue(item) {
+  return Boolean(item.code && REREAD_CODES.has(item.code));
+}
+function rereadTrigger(item) {
+  if (item.code === "review-document-changed")
+    return item.file;
+  if (item.code === "review-dependency-changed" || item.code === "impacted-document-review-required") {
+    return item.link ?? null;
+  }
+  return null;
+}
+function orderTriggers(file, triggers) {
+  const rest = [...triggers].filter((path3) => path3 !== file).sort();
+  return triggers.has(file) ? [file, ...rest] : rest;
+}
+function collectRereadTriggers(errors2) {
+  const triggers = new Map;
+  const rest = [];
+  for (const item of errors2) {
+    if (!isRereadIssue(item)) {
+      rest.push(item);
+      continue;
+    }
+    const current = triggers.get(item.file) ?? new Set;
+    const trigger = rereadTrigger(item);
+    if (trigger)
+      current.add(trigger);
+    triggers.set(item.file, current);
+  }
+  return { triggers, rest };
+}
+function printRereadDiagnostic(file, triggers) {
+  console.log(`${file}: error: review required`);
+  const changed = orderTriggers(file, triggers);
+  if (changed.length > 0) {
+    console.log(`  changed: ${changed.join(", ")}`);
+    return;
+  }
+  console.log("  changed: review dependency set");
+}
+function printRereadLists(errors2) {
+  const { triggers, rest } = collectRereadTriggers(errors2);
+  for (const file of [...triggers.keys()].sort()) {
+    printRereadDiagnostic(file, triggers.get(file) ?? new Set);
+  }
+  return rest;
+}
 function printErrors(label, errors2) {
   console.log(`${label} failed:
 `);
-  for (const i of errors2) {
-    const linkPart = i.link ? ` (${i.link})` : "";
-    console.log(`- ${i.file}${linkPart}: ${i.message}`);
+  const rest = printRereadLists(errors2);
+  for (const item of rest) {
+    console.log(`${item.file}: error: ${item.message}`);
   }
   return 1;
 }
@@ -30931,11 +30968,43 @@ function printTextReport(ctx) {
 
 // src/audit/core/review-proof.ts
 import { createHash } from "node:crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync2, readFileSync as readFileSync11, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname8, relative as relative6 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync2, readFileSync as readFileSync12, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname8 } from "node:path";
+
+// src/audit/core/repo-files.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "node:fs";
+import { join as join11 } from "node:path";
+function gitShow(root2, spec) {
+  const proc = spawnSync2("git", ["show", spec], {
+    cwd: root2,
+    encoding: "utf8",
+    maxBuffer: 20000000
+  });
+  if (proc.status !== 0)
+    return null;
+  return proc.stdout;
+}
+function readRepoText(root2, relPath2, source = "worktree") {
+  const normalized = normalizeRelPath(relPath2);
+  if (source === "index")
+    return gitShow(root2, `:${normalized}`);
+  const abs = join11(root2, normalized);
+  if (!existsSync12(abs))
+    return null;
+  return readFileSync11(abs, "utf8");
+}
+function pathDiffersFromHead(root2, relPath2) {
+  const normalized = normalizeRelPath(relPath2);
+  const head = gitShow(root2, `HEAD:${normalized}`);
+  const worktree = readRepoText(root2, normalized, "worktree");
+  if (worktree === null)
+    return head !== null;
+  return worktree !== (head ?? "");
+}
 
 // src/audit/core/review-deps.ts
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 var REVIEW_DEPS_RE = /<!--\s*review-deps:\s*([^>]*?)-->/gi;
 var GLOB_MAGIC_RE = /[*?{[]/;
 function parseReviewDepsMarkers(content3) {
@@ -30967,7 +31036,7 @@ function resolveReviewDependencies(root2, patterns) {
       throw new Error(`Invalid review dependency path: ${pattern}`);
     }
     if (!isReviewDependencyGlob(pattern)) {
-      if (!existsSync12(`${root2}/${pattern}`)) {
+      if (!existsSync13(`${root2}/${pattern}`)) {
         throw new Error(`Review dependency path is missing: ${pattern}`);
       }
       targets.add(pattern);
@@ -31059,19 +31128,19 @@ function parseLock(content3) {
     return null;
   }
 }
-function loadLock(root2, relPath2) {
-  const abs = resolveWritePath(root2, relPath2);
-  if (!existsSync13(abs))
+function loadLock(root2, relPath2, source = "worktree") {
+  const content3 = readRepoText(root2, relPath2, source);
+  if (content3 === null)
     return null;
-  return parseLock(readFileSync11(abs, "utf8"));
+  return parseLock(content3);
 }
 function hashDependencies(root2, targets) {
   const out = {};
   for (const target of targets) {
     const abs = resolveWritePath(root2, target);
-    if (!existsSync13(abs))
+    if (!existsSync14(abs))
       throw new Error(`Cannot attest missing review dependency: ${target}`);
-    out[target] = hash(readFileSync11(abs, "utf8"));
+    out[target] = hash(readFileSync12(abs, "utf8"));
   }
   return out;
 }
@@ -31100,7 +31169,7 @@ function commitWrites(root2, writes) {
   try {
     for (const [relPath2, content3] of writes) {
       const abs = resolveWritePath(root2, relPath2);
-      originals.set(relPath2, existsSync13(abs) ? readFileSync11(abs, "utf8") : null);
+      originals.set(relPath2, existsSync14(abs) ? readFileSync12(abs, "utf8") : null);
       mkdirSync2(dirname8(abs), { recursive: true });
       writeFileSync3(abs, content3, "utf8");
       written.push(relPath2);
@@ -31131,7 +31200,7 @@ function attestDocuments(options) {
   if (proofPath) {
     const absProof = resolveWritePath(ctx.root, proofPath);
     lock = loadLock(ctx.root, proofPath);
-    if (existsSync13(absProof) && !lock) {
+    if (existsSync14(absProof) && !lock) {
       throw new Error(`Review proof lockfile is malformed: ${proofPath}`);
     }
     lock ??= emptyLock();
@@ -31139,9 +31208,9 @@ function attestDocuments(options) {
   const writes = new Map;
   for (const relPath2 of selected) {
     const abs = resolveWritePath(ctx.root, relPath2);
-    if (!existsSync13(abs))
+    if (!existsSync14(abs))
       throw new Error(`Cannot attest missing document: ${relPath2}`);
-    const original = readFileSync11(abs, "utf8");
+    const original = readFileSync12(abs, "utf8");
     if (!DOC_META_RE.test(original)) {
       throw new Error(`Cannot attest ${relPath2}: missing doc-meta comment`);
     }
@@ -31191,7 +31260,13 @@ function validateEntry(input) {
     }));
     return issues;
   }
-  issues.push(...dependencyHashIssues({ root: ctx.root, relPath: relPath2, targets: currentTargets, entry }));
+  issues.push(...dependencyHashIssues({
+    root: ctx.root,
+    relPath: relPath2,
+    targets: currentTargets,
+    entry,
+    fileSource: ctx.fileSource
+  }));
   return issues;
 }
 function documentProofIssues(relPath2, content3, entry) {
@@ -31225,16 +31300,17 @@ function currentDependencies(input) {
 }
 function dependencyHashIssues(input) {
   const { root: root2, relPath: relPath2, targets, entry } = input;
+  const source = input.fileSource ?? "worktree";
   const issues = [];
   for (const target of targets) {
-    const abs = resolveWritePath(root2, target);
-    if (!existsSync13(abs)) {
+    const content3 = readRepoText(root2, target, source);
+    if (content3 === null) {
       issues.push(issue("review-proof", relPath2, {
         code: "review-dependency-missing",
         message: `recorded review dependency is missing: ${target}`,
         link: target
       }));
-    } else if (entry.reviewDependencies[target] !== hash(readFileSync11(abs, "utf8"))) {
+    } else if (entry.reviewDependencies[target] !== hash(content3)) {
       issues.push(changedDependencyIssue(relPath2, target));
     }
   }
@@ -31244,8 +31320,9 @@ function runReviewProofRule(ctx) {
   if (!ctx.config.reviewProof)
     return [];
   const relLock = lockPath(ctx);
-  const absLock = resolveWritePath(ctx.root, relLock);
-  if (!existsSync13(absLock)) {
+  const source = ctx.fileSource ?? "worktree";
+  const lockContent = readRepoText(ctx.root, relLock, source);
+  if (lockContent === null) {
     return [
       issue("review-proof", relLock, {
         code: "review-proof-lock-missing",
@@ -31253,7 +31330,7 @@ function runReviewProofRule(ctx) {
       })
     ];
   }
-  const lock = parseLock(readFileSync11(absLock, "utf8"));
+  const lock = parseLock(lockContent);
   if (!lock) {
     return [
       issue("review-proof", relLock, {
@@ -31264,11 +31341,10 @@ function runReviewProofRule(ctx) {
   }
   const issues = [];
   for (const relPath2 of ctx.docMetaPaths) {
-    const abs = resolveWritePath(ctx.root, relPath2);
-    if (!existsSync13(abs))
+    const content3 = readRepoText(ctx.root, relPath2, source);
+    if (content3 === null)
       continue;
-    const content3 = readFileSync11(abs, "utf8");
-    const entry = lock.documents[normalizeRelPath(relative6(ctx.root, abs))];
+    const entry = lock.documents[normalizeRelPath(relPath2)];
     if (!entry) {
       issues.push(issue("review-proof", relPath2, {
         code: "review-proof-missing",
@@ -31295,8 +31371,8 @@ function runBannedRule(ctx) {
 var bannedRule = { id: "banned", run: runBannedRule };
 
 // src/audit/rules/doc-meta.ts
-import { existsSync as existsSync14, readFileSync as readFileSync12 } from "node:fs";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync13 } from "node:fs";
+import { join as join12 } from "node:path";
 function checkDocMetaBanner(relPath2, content3) {
   if (DOC_META_RE.test(content3))
     return null;
@@ -31351,10 +31427,10 @@ function runDocMetaRule(ctx) {
   const issues = [];
   const today = new Date;
   for (const relPath2 of ctx.docMetaPaths) {
-    const abs = join11(ctx.root, relPath2);
-    if (!existsSync14(abs))
+    const abs = join12(ctx.root, relPath2);
+    if (!existsSync15(abs))
       continue;
-    const content3 = readFileSync12(abs, "utf8");
+    const content3 = readFileSync13(abs, "utf8");
     const banner = checkDocMetaBanner(relPath2, content3);
     if (banner) {
       issues.push(banner);
@@ -31382,7 +31458,7 @@ function runDocMetaRule(ctx) {
 var docMetaRule = { id: "doc-meta", run: runDocMetaRule };
 
 // src/audit/rules/links.ts
-import { existsSync as existsSync15, readFileSync as readFileSync13 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "node:fs";
 import { dirname as dirname9, resolve as resolve5 } from "node:path";
 function resolveLink2(sourceFile, target) {
   const withoutAnchor = target.split("#")[0]?.split("?")[0] ?? "";
@@ -31406,13 +31482,13 @@ function checkAgentFile(input, resolved, relSource) {
     return null;
   }
   const agentPath = resolved.endsWith(".md") ? resolved : `${resolved}.md`;
-  if (existsSync15(agentPath))
+  if (existsSync16(agentPath))
     return null;
   return issue("links", relSource, { message: "missing agent file", link: input.linkLabel });
 }
 function checkBrokenPath(ctx) {
   const { input, pathPart, resolved, relSource, relTarget } = ctx;
-  if (!(pathPart && !existsSync15(resolved)))
+  if (!(pathPart && !existsSync16(resolved)))
     return null;
   return issue("links", relSource, {
     message: `broken link → ${relTarget}`,
@@ -31421,9 +31497,9 @@ function checkBrokenPath(ctx) {
 }
 function checkBrokenAnchor(ctx) {
   const { input, anchor, resolved, relSource, relTarget } = ctx;
-  if (!(anchor && existsSync15(resolved)))
+  if (!(anchor && existsSync16(resolved)))
     return null;
-  const targetContent = readFileSync13(resolved, "utf8");
+  const targetContent = readFileSync14(resolved, "utf8");
   const slugs = extractHeadingSlugs(targetContent, resolved);
   const anchorSlug = slugifyAnchor(anchor);
   if (slugs.has(anchorSlug))
@@ -31475,8 +31551,8 @@ function runLinksRule(ctx) {
 var linksRule = { id: "links", run: runLinksRule };
 
 // src/audit/rules/near-duplicate.ts
-import { readFileSync as readFileSync14 } from "node:fs";
-import { join as join12 } from "node:path";
+import { readFileSync as readFileSync15 } from "node:fs";
+import { join as join13 } from "node:path";
 
 // src/audit/core/ssot-fit.ts
 var DEFAULT_SSOT_OVERLAP_MIN = 0.35;
@@ -31764,7 +31840,7 @@ function runNearDuplicateRule(ctx) {
   const ignored = ignoredPairSet(ctx);
   const entries = eligibleEntries(ctx);
   const fingerprints = entries.map((e) => {
-    const content3 = readFileSync14(join12(ctx.root, e.path), "utf8");
+    const content3 = readFileSync15(join13(ctx.root, e.path), "utf8");
     const tokens = tokenize2(bodyWithoutSsotNoise(content3));
     return {
       path: e.path,
@@ -31859,12 +31935,105 @@ function runProsePolicyRule(ctx) {
 }
 var prosePolicyRule = { id: "prose-policy", run: runProsePolicyRule };
 
+// src/audit/core/review-coverage.ts
+var DEFAULT_REVIEW_COVERAGE_INCLUDE = [
+  "**/*.{ts,tsx,js,jsx,mjs,cjs,py}",
+  "package.json",
+  "project.json"
+];
+var DEFAULT_REVIEW_COVERAGE_EXCLUDE = [
+  "**/__tests__/**",
+  "**/*.test.*",
+  "**/*.spec.*",
+  "**/fixtures/**",
+  "templates/**",
+  "**/dist/**",
+  "**/node_modules/**",
+  "**/.venv/**",
+  "**/.git/**",
+  ".skeleton/plugins/**"
+];
+function reviewCoveragePatterns(config) {
+  const configured = config.reviewCoverage;
+  if (configured?.include && configured.include.length === 0) {
+    return { include: [], exclude: [] };
+  }
+  return {
+    include: configured?.include && configured.include.length > 0 ? configured.include : DEFAULT_REVIEW_COVERAGE_INCLUDE,
+    exclude: [...DEFAULT_REVIEW_COVERAGE_EXCLUDE, ...configured?.exclude ?? []]
+  };
+}
+function pathRequiresReviewCoverage(relPath2, config) {
+  const { include, exclude } = reviewCoveragePatterns(config);
+  if (include.length === 0)
+    return false;
+  const path3 = normalizeRelPath(relPath2);
+  if (exclude.some((pattern) => matchesGlobScope(path3, pattern)))
+    return false;
+  return include.some((pattern) => matchesGlobScope(path3, pattern));
+}
+function collectReviewDependencyPatterns(input) {
+  const patterns = new Set;
+  const source = input.fileSource ?? "worktree";
+  for (const abs of collectScanFiles(input.config, input.root, input.skillIndex)) {
+    const rel = relPath(abs, input.root);
+    const content3 = readRepoText(input.root, rel, source);
+    if (content3 === null)
+      continue;
+    for (const pattern of reviewDependencyPatterns(content3))
+      patterns.add(pattern);
+  }
+  return [...patterns].sort();
+}
+function pathHasReviewOwner(relPath2, patterns) {
+  return patterns.some((pattern) => reviewDependencyMatchesPath(pattern, relPath2));
+}
+function collectReviewCoverageFiles(root2, config) {
+  const { include, exclude } = reviewCoveragePatterns(config);
+  if (include.length === 0)
+    return [];
+  const files = new Set;
+  for (const pattern of include) {
+    for (const match of globSync(pattern, {
+      cwd: root2,
+      onlyFiles: true,
+      dot: true,
+      ignore: exclude
+    })) {
+      const rel = normalizeRelPath(match);
+      if (exclude.some((item) => matchesGlobScope(rel, item)))
+        continue;
+      files.add(rel);
+    }
+  }
+  return [...files].sort();
+}
+
+// src/audit/rules/review-coverage.ts
+function runReviewCoverageRule(ctx) {
+  const patterns = collectReviewDependencyPatterns({
+    root: ctx.root,
+    config: ctx.config,
+    skillIndex: ctx.skillIndex,
+    fileSource: ctx.fileSource
+  });
+  return collectReviewCoverageFiles(ctx.root, ctx.config).filter((path3) => !pathHasReviewOwner(path3, patterns)).map((path3) => issue("review-coverage", path3, {
+    code: "review-coverage-gap",
+    message: "file has no owning document; add a review-deps path or glob on the paper that describes it"
+  }));
+}
+var reviewCoverageRule = {
+  id: "review-coverage",
+  global: true,
+  run: runReviewCoverageRule
+};
+
 // src/audit/rules/review-deps.ts
-import { relative as relative7 } from "node:path";
+import { relative as relative6 } from "node:path";
 function runReviewDepsRule(ctx) {
   const issues = [];
   for (const abs of collectScanFiles(ctx.config, ctx.root, ctx.skillIndex)) {
-    const path3 = normalizeRelPath(relative7(ctx.root, abs));
+    const path3 = normalizeRelPath(relative6(ctx.root, abs));
     for (const marker of parseReviewDepsMarkers(readFileContent(abs))) {
       issues.push(...validateMarker(ctx.root, path3, marker.paths));
     }
@@ -31925,16 +32094,16 @@ function runScanRootsRule(ctx) {
 var scanRootsRule = { id: "scan-roots", run: runScanRootsRule };
 
 // src/audit/rules/skill-index.ts
-import { existsSync as existsSync16, readdirSync as readdirSync2, readFileSync as readFileSync15 } from "node:fs";
-import { join as join13, relative as relative8 } from "node:path";
+import { existsSync as existsSync17, readdirSync as readdirSync2, readFileSync as readFileSync16 } from "node:fs";
+import { join as join14, relative as relative7 } from "node:path";
 function walkSkillMarkdown(dir) {
   const files = [];
-  if (!existsSync16(dir))
+  if (!existsSync17(dir))
     return files;
   for (const entry of readdirSync2(dir, { withFileTypes: true })) {
     if (entry.name.startsWith("."))
       continue;
-    const fullPath = join13(dir, entry.name);
+    const fullPath = join14(dir, entry.name);
     if (entry.isDirectory()) {
       files.push(...walkSkillMarkdown(fullPath));
       continue;
@@ -31960,8 +32129,8 @@ function parseReadmeTaxonomySlugs(content3) {
 }
 function scanFileForSkillLinks(ctx, filePath, index2) {
   const issues = [];
-  const rel = relative8(ctx.root, filePath).replace(/\\/g, "/");
-  const content3 = readFileSync15(filePath, "utf8");
+  const rel = relative7(ctx.root, filePath).replace(/\\/g, "/");
+  const content3 = readFileSync16(filePath, "utf8");
   for (const match of content3.matchAll(SKILL_LINK_RE)) {
     const slug2 = match[1];
     if (!slug2)
@@ -31974,14 +32143,14 @@ function scanFileForSkillLinks(ctx, filePath, index2) {
 }
 function taxonomyIssuesForReadme(input) {
   const { ctx, index: index2, skillRoot, diskSlugs, nonPublic } = input;
-  const readmePath = join13(ctx.root, skillRoot.relPath, "README.md");
-  if (!existsSync16(readmePath))
+  const readmePath = join14(ctx.root, skillRoot.relPath, "README.md");
+  if (!existsSync17(readmePath))
     return [];
-  const readme = readFileSync15(readmePath, "utf8");
+  const readme = readFileSync16(readmePath, "utf8");
   if (!readme.includes("## Taxonomy"))
     return [];
   const taxonomySlugs = parseReadmeTaxonomySlugs(readme);
-  const nestedSlugs = diskSlugs.filter((slug2) => existsSync16(join13(ctx.root, skillRoot.relPath, slug2, "SKILL.md")));
+  const nestedSlugs = diskSlugs.filter((slug2) => existsSync17(join14(ctx.root, skillRoot.relPath, slug2, "SKILL.md")));
   const foreign = new Set(index2.foreignSlugs);
   const publicSlugs = nestedSlugs.filter((slug2) => !(nonPublic.has(slug2) || foreign.has(slug2)));
   const relReadme = `${skillRoot.relPath}/README.md`;
@@ -32014,10 +32183,10 @@ function slugsForRoot(skillRoot, index2, owned) {
 function auditSkillRoot(input) {
   const { ctx, index: index2, skillRoot, owned } = input;
   const issues = [];
-  const base = skillRoot.kind === "nested" ? join13(ctx.root, skillRoot.relPath) : ctx.root;
+  const base = skillRoot.kind === "nested" ? join14(ctx.root, skillRoot.relPath) : ctx.root;
   for (const slug2 of slugsForRoot(skillRoot, index2, owned)) {
-    const skillDir = join13(base, slug2);
-    if (!existsSync16(skillDir))
+    const skillDir = join14(base, slug2);
+    if (!existsSync17(skillDir))
       continue;
     for (const skillMd of walkSkillMarkdown(skillDir)) {
       issues.push(...scanFileForSkillLinks(ctx, skillMd, index2));
@@ -32067,8 +32236,8 @@ function runSsotRule(ctx) {
 var ssotRule = { id: "ssot", run: runSsotRule };
 
 // src/audit/rules/ssot-summary.ts
-import { readFileSync as readFileSync16 } from "node:fs";
-import { join as join14 } from "node:path";
+import { readFileSync as readFileSync17 } from "node:fs";
+import { join as join15 } from "node:path";
 function runSsotSummaryRule(ctx) {
   const overlapMin = ctx.config.docsLint?.ssotOverlapMin ?? DEFAULT_SSOT_OVERLAP_MIN;
   const margin = ctx.config.docsLint?.ssotBetterMatchMargin ?? DEFAULT_BETTER_MATCH_MARGIN;
@@ -32076,7 +32245,7 @@ function runSsotSummaryRule(ctx) {
   const files = ctx.ssotEntries.map((entry) => ({
     path: entry.path,
     summary: entry.summary,
-    content: readFileSync16(join14(ctx.root, entry.path), "utf8")
+    content: readFileSync17(join15(ctx.root, entry.path), "utf8")
   }));
   return evaluateSsotFit(files, {
     overlapMin,
@@ -32097,6 +32266,7 @@ var docsRules = [
   { ...nearDuplicateRule, global: true },
   { ...ssotSummaryRule, global: true },
   { ...coverageGapsRule, global: true },
+  { ...reviewCoverageRule, global: true },
   linksRule,
   docMetaRule,
   reviewProofRule,
@@ -32263,14 +32433,7 @@ function labelForSuite(suite) {
 function catalogStatusFor(root2, suite) {
   if (suite !== "docs" && suite !== "self")
     return "not-applicable";
-  if (process4.env.CI === "true")
-    return "skipped-ci";
-  const result = checkCatalog(root2);
-  if (result.missing)
-    return "missing";
-  if (result.stale)
-    return "stale";
-  return "current";
+  return refreshLocalCatalog(root2);
 }
 function buildAuditResult(input) {
   const diagnostics = finalizeIssues(input.issues, input.options.strict);
@@ -32366,7 +32529,8 @@ async function evaluateAudit(options) {
   const base = createContext({
     root: options.root,
     paths: pathScoped ? options.paths : undefined,
-    includeExcludedSkillTrees: options.suite === "skills" && !pathScoped
+    includeExcludedSkillTrees: options.suite === "skills" && !pathScoped,
+    fileSource: options.fileSource
   });
   const loaded = await loadPlugins(base.root, base.config);
   const ctx = { ...base, policies: loaded.policies };
@@ -32408,11 +32572,6 @@ async function evaluateAudit(options) {
   for (const rule of executableRules) {
     issues.push(...rule.run(ctx));
   }
-  if (options.suite === "docs" || options.suite === "self") {
-    for (const message of catalogAuditWarnings(ctx.root)) {
-      issues.push(issue("catalog", CATALOG_REL_PATH, { message, severity: "warning" }));
-    }
-  }
   const executed = executableRules.map((rule) => rule.id);
   return buildAuditResult({
     options,
@@ -32441,175 +32600,15 @@ async function runAudit(options) {
   return printAuditResult(await evaluateAudit(options), options.json);
 }
 
-// src/customize/resolve.ts
-import { existsSync as existsSync17, readFileSync as readFileSync17 } from "node:fs";
-import { basename as basename3, join as join15, relative as relative9 } from "node:path";
-function customizeDir(root2) {
-  return join15(root2, REGISTRY_DIR_REL, "customize");
-}
-function customizePathForSlug(root2, slug2) {
-  return join15(customizeDir(root2), `${slug2}.md`);
-}
-function resolveSlugFile(root2, slug2) {
-  const direct = customizePathForSlug(root2, slug2);
-  if (existsSync17(direct)) {
-    return {
-      content: readFileSync17(direct, "utf8"),
-      path: normalizeRelPath(relative9(root2, direct))
-    };
-  }
-  return { content: null, path: null };
-}
-function alwaysIncludeBasenames(root2) {
-  try {
-    const config = loadConfig(root2);
-    return config.customize?.alwaysInclude ?? [];
-  } catch {
-    return [];
-  }
-}
-function readAlwaysInclude(root2, basenames, skipBasename) {
-  const parts = [];
-  const paths = [];
-  const dir = customizeDir(root2);
-  for (const name of basenames) {
-    const file = basename3(name);
-    if (skipBasename && file === skipBasename)
-      continue;
-    const abs = join15(dir, file);
-    if (!existsSync17(abs))
-      continue;
-    parts.push(readFileSync17(abs, "utf8").trimEnd());
-    paths.push(normalizeRelPath(relative9(root2, abs)));
-  }
-  return { parts, paths };
-}
-function resolveCustomize(root2, slug2) {
-  const slugFile = resolveSlugFile(root2, slug2);
-  const alwaysNames = alwaysIncludeBasenames(root2);
-  const skip = slugFile.path !== null && slugFile.path !== undefined ? basename3(slugFile.path) : null;
-  const always = readAlwaysInclude(root2, alwaysNames, skip);
-  const parts = [];
-  const included = [];
-  if (slugFile.content !== null && slugFile.content !== undefined && slugFile.content.trim().length > 0) {
-    parts.push(slugFile.content.trimEnd());
-    if (slugFile.path)
-      included.push(slugFile.path);
-  }
-  parts.push(...always.parts);
-  included.push(...always.paths);
-  if (parts.length === 0) {
-    return { slug: slug2, content: null, path: slugFile.path, included: [] };
-  }
-  return {
-    slug: slug2,
-    content: `${parts.join(`
-
----
-
-`)}
-`,
-    path: slugFile.path ?? always.paths[0] ?? null,
-    included
-  };
-}
-function resolveCustomizeFromRoot(slug2, startDir) {
-  const root2 = findRepoRoot(startDir);
-  return resolveCustomize(root2, slug2);
-}
-
-// src/hooks/run.ts
-import process5 from "node:process";
-function parsePayload(raw) {
-  if (!raw.trim())
-    return {};
-  return JSON.parse(raw);
-}
-function extractPath(payload) {
-  const input = payload.tool_input ?? payload.toolInput ?? {};
-  const candidates = [
-    input.path,
-    input.file_path,
-    input.filePath,
-    input.target_file,
-    input.targetFile
-  ];
-  for (const value of candidates) {
-    if (typeof value === "string" && value.trim())
-      return normalizeRelPath(value.trim());
-  }
-  return null;
-}
-function extractSkillSlug(payload) {
-  const tool = payload.tool_name ?? payload.toolName ?? "";
-  if (tool === "Skill" || tool === "skill") {
-    const input = payload.tool_input ?? payload.toolInput ?? {};
-    const slug2 = input.skill ?? input.slug ?? input.name;
-    if (typeof slug2 === "string" && slug2.trim())
-      return slug2.trim();
-  }
-  const path3 = extractPath(payload);
-  if (path3)
-    return slugFromPath(path3, process5.cwd());
-  return null;
-}
-function cursorResponse(content3) {
-  return JSON.stringify({ additional_context: content3 });
-}
-function claudeResponse(content3) {
-  return JSON.stringify({
-    hookSpecificOutput: {
-      additionalContext: content3
-    }
-  });
-}
-function codexResponse(content3) {
-  return JSON.stringify({ additionalContext: content3 });
-}
-function formatResponse(payload, content3) {
-  const tool = payload.tool_name ?? payload.toolName ?? "";
-  if (tool === "read_file")
-    return codexResponse(content3);
-  if (payload.hook_event_name?.toLowerCase().includes("claude"))
-    return claudeResponse(content3);
-  if (tool === "Read" && payload.hook_event_name === "postToolUse")
-    return cursorResponse(content3);
-  if (tool === "Read" || tool === "Skill")
-    return claudeResponse(content3);
-  return cursorResponse(content3);
-}
-function runCustomizeHook(raw) {
-  try {
-    const payload = parsePayload(raw);
-    const slug2 = extractSkillSlug(payload);
-    if (!slug2)
-      return "{}";
-    const resolved = resolveCustomizeFromRoot(slug2);
-    if (!resolved.content)
-      return "{}";
-    const from = resolved.included.length > 0 ? resolved.included.join(", ") : resolved.path ?? ".skeleton/customize";
-    const prefix = `
-
----
-Customize override for /${slug2} (from ${from}):
-
-`;
-    return formatResponse(payload, prefix + resolved.content);
-  } catch (error) {
-    console.error(`customize hook error: ${error}`);
-    return "{}";
-  }
-}
-
 // src/init/init.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { copyFileSync, existsSync as existsSync21, mkdirSync as mkdirSync4, readFileSync as readFileSync19 } from "node:fs";
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { copyFileSync, existsSync as existsSync21, mkdirSync as mkdirSync3, readFileSync as readFileSync20 } from "node:fs";
 import { join as join19 } from "node:path";
-import process6 from "node:process";
+import process4 from "node:process";
 
-// src/init/merge-hooks.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync3, readFileSync as readFileSync18, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname12, join as join18 } from "node:path";
+// src/init/merge-precommit.ts
+import { existsSync as existsSync19, readFileSync as readFileSync18, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join17 } from "node:path";
 
 // src/init/package-paths.ts
 import { existsSync as existsSync18 } from "node:fs";
@@ -32632,279 +32631,45 @@ function resolveTemplatesDir() {
   return dir;
 }
 
-// src/init/resolve-hook-command.ts
-import { existsSync as existsSync19, realpathSync as realpathSync5 } from "node:fs";
-import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname11, join as join17, relative as relative10, resolve as resolve6 } from "node:path";
-var PACKAGE_NAME = "@csark0812/skeleton";
-var CLI_DIST = "dist/cli.js";
-var PACKAGE_ROOT = resolvePackageRoot();
-var DEV_HOOK_COMMAND = "bun src/cli.ts hook customize";
-var FALLBACK_HOOK_COMMAND = `node node_modules/${PACKAGE_NAME}/${CLI_DIST} hook customize`;
-function safeRealpath2(path3) {
-  try {
-    return realpathSync5(path3);
-  } catch {
-    return path3;
-  }
-}
-function toRepoRelative(cwd, absPath) {
-  const rel = relative10(safeRealpath2(cwd), safeRealpath2(absPath)).replace(/\\/g, "/");
-  return rel.startsWith("..") ? absPath.replace(/\\/g, "/") : rel;
-}
-function tryResolvePublishedCli(cwd) {
-  try {
-    const req = createRequire3(join17(cwd, "package.json"));
-    return req.resolve(`${PACKAGE_NAME}/${CLI_DIST}`);
-  } catch {
-    return null;
-  }
-}
-function walkNodeModulesCli(cwd) {
-  let dir = cwd;
-  while (true) {
-    const candidate = join17(dir, "node_modules", PACKAGE_NAME, CLI_DIST);
-    if (existsSync19(candidate))
-      return candidate;
-    const parent = dirname11(dir);
-    if (parent === dir)
-      break;
-    dir = parent;
-  }
-  return null;
-}
-function isInsidePackageRoot(cwd) {
-  const rel = relative10(PACKAGE_ROOT, resolve6(cwd)).replace(/\\/g, "/");
-  return rel === "" || !(rel.startsWith("..") || rel.startsWith("/"));
-}
-function nodeCliHookCommand(cliPath) {
-  return `node ${cliPath} hook customize`;
-}
-function resolveHookCommand(cwd) {
-  if (isInsidePackageRoot(cwd))
-    return DEV_HOOK_COMMAND;
-  const published = tryResolvePublishedCli(cwd);
-  if (published)
-    return nodeCliHookCommand(toRepoRelative(cwd, published));
-  const hoisted = walkNodeModulesCli(cwd);
-  if (hoisted)
-    return nodeCliHookCommand(toRepoRelative(cwd, hoisted));
-  return FALLBACK_HOOK_COMMAND;
-}
-function isSkeletonHookCommand(command) {
-  if (!command)
-    return false;
-  if (/\bhook\s+customize\b/.test(command))
-    return true;
-  return /customize-on-skill-read\.(js|ts)\b/.test(command);
-}
-
-// src/init/merge-hooks.ts
+// src/init/merge-precommit.ts
 var TEMPLATES_DIR = resolveTemplatesDir();
-function identityKey(platform, event, matcher) {
-  return `skeleton:customize:${platform}:${event}:${matcher}`;
-}
-function loadFragment(name, hookCommand) {
-  const raw = readFileSync18(join18(TEMPLATES_DIR, name), "utf8");
-  return JSON.parse(raw.replaceAll("{{HOOK_COMMAND}}", hookCommand));
-}
-function readJson(path3) {
-  if (!existsSync20(path3))
-    return null;
-  try {
-    return JSON.parse(readFileSync18(path3, "utf8"));
-  } catch (error) {
-    throw new Error(`Invalid JSON in ${path3}: ${error}`);
-  }
-}
-function writeJson(path3, value) {
-  mkdirSync3(dirname12(path3), { recursive: true });
-  writeFileSync4(path3, `${JSON.stringify(value, null, 2)}
-`, "utf8");
-}
-function deepEqual(a, b) {
-  return JSON.stringify(a) === JSON.stringify(b);
-}
-function mergeExistingCursorHook(input) {
-  const { postToolUse, skeletonIdx, canonical, opts } = input;
-  const current = postToolUse[skeletonIdx];
-  const userEdited = current && !opts.forceHooks && (current.matcher !== canonical.matcher || !isSkeletonHookCommand(current.command));
-  if (userEdited) {
-    return {
-      platform: "cursor",
-      action: "conflict",
-      message: identityKey("cursor", "postToolUse", String(current.matcher ?? "Read"))
-    };
-  }
-  const extras = Object.fromEntries(Object.entries(current ?? {}).filter(([key]) => !["command", "matcher"].includes(key)));
-  const merged = { ...extras, ...canonical };
-  if (deepEqual(current, merged))
-    return { platform: "cursor", action: "skipped" };
-  postToolUse[skeletonIdx] = merged;
-  return null;
-}
-function persistCursorHooks(input) {
-  const { targetPath, existing, hooks, postToolUse, skeletonIdx } = input;
-  const next = {
-    ...existing,
-    version: existing.version ?? 1,
-    hooks: { ...hooks, postToolUse }
-  };
-  if (deepEqual(existing, next))
-    return { platform: "cursor", action: "skipped" };
-  writeJson(targetPath, next);
-  return { platform: "cursor", action: skeletonIdx >= 0 ? "updated" : "added" };
-}
-function mergeCursorHooks(targetPath, fragment, opts) {
-  const existing = readJson(targetPath) ?? {};
-  const hooks = existing.hooks ?? {};
-  const postToolUse = [...hooks.postToolUse ?? []];
-  const incoming = fragment.hooks?.postToolUse?.[0];
-  if (!incoming)
-    return { platform: "cursor", action: "skipped" };
-  const skeletonIdx = postToolUse.findIndex((entry) => isSkeletonHookCommand(entry.command));
-  const canonical = { ...incoming, matcher: incoming.matcher ?? "Read" };
-  if (skeletonIdx >= 0) {
-    const conflict = mergeExistingCursorHook({ postToolUse, skeletonIdx, canonical, opts });
-    if (conflict)
-      return conflict;
-  } else {
-    postToolUse.push(canonical);
-  }
-  return persistCursorHooks({ targetPath, existing, hooks, postToolUse, skeletonIdx });
-}
-function mergeExistingNestedSkeletonHook(input) {
-  const { hooks, skeletonIdx, incomingHook, opts, platform, eventName, matcher } = input;
-  const current = hooks[skeletonIdx];
-  const userEdited = current && !opts.forceHooks && (current.type !== incomingHook.type || !isSkeletonHookCommand(current.command));
-  if (userEdited) {
-    return {
-      changed: false,
-      conflict: {
-        platform,
-        action: "conflict",
-        message: identityKey(platform, eventName, matcher)
-      }
-    };
-  }
-  const extras = Object.fromEntries(Object.entries(current ?? {}).filter(([key]) => !["type", "command"].includes(key)));
-  const merged = { ...extras, ...incomingHook };
-  if (!deepEqual(current, merged)) {
-    hooks[skeletonIdx] = merged;
-    return { changed: true };
-  }
-  return { changed: false };
-}
-function mergeIncomingHookGroup(args) {
-  const { group, incomingHook, eventHooks, opts, platform, eventName } = args;
-  const matcher = group.matcher ?? "";
-  const groupIdx = eventHooks.findIndex((g) => g.matcher === matcher);
-  if (groupIdx < 0) {
-    eventHooks.push({ ...group, hooks: [{ ...incomingHook }] });
-    return { changed: true };
-  }
-  const existingGroup = eventHooks[groupIdx];
-  const hooks = [...existingGroup?.hooks ?? []];
-  const skeletonIdx = hooks.findIndex((entry) => isSkeletonHookCommand(entry.command));
-  if (skeletonIdx >= 0) {
-    const result = mergeExistingNestedSkeletonHook({
-      hooks,
-      skeletonIdx,
-      incomingHook,
-      opts,
-      platform,
-      eventName,
-      matcher
-    });
-    if (result.conflict)
-      return { changed: false, conflict: result.conflict };
-    eventHooks[groupIdx] = { ...existingGroup, matcher, hooks };
-    return { changed: result.changed };
-  }
-  hooks.push({ ...incomingHook });
-  eventHooks[groupIdx] = { ...existingGroup, matcher, hooks };
-  return { changed: true };
-}
-function mergeIncomingGroups(args) {
-  let changed = false;
-  for (const incomingGroup of args.incomingGroups) {
-    const incomingHook = incomingGroup.hooks?.[0];
-    if (!incomingHook)
-      continue;
-    const result = mergeIncomingHookGroup({
-      group: incomingGroup,
-      incomingHook,
-      eventHooks: args.eventHooks,
-      opts: args.opts,
-      platform: args.platform,
-      eventName: args.eventName
-    });
-    if (result.conflict)
-      return { changed: false, conflict: result.conflict };
-    if (result.changed)
-      changed = true;
-  }
-  return { changed };
-}
-function mergeNestedHooks(args) {
-  const { platform, targetPath, eventName } = args;
-  const existing = readJson(targetPath) ?? {};
-  const rootHooks = existing.hooks ?? {};
-  const eventHooks = [...rootHooks[eventName] ?? []];
-  const incomingGroups = args.fragment.hooks?.[eventName] ?? [];
-  const result = mergeIncomingGroups({
-    incomingGroups,
-    eventHooks,
-    opts: args.opts,
-    platform,
-    eventName
-  });
-  if (result.conflict)
-    return result.conflict;
-  if (!result.changed)
-    return { platform, action: "skipped" };
-  const next = {
-    ...existing,
-    hooks: { ...rootHooks, [eventName]: eventHooks }
-  };
-  writeJson(targetPath, next);
-  return { platform, action: "updated" };
-}
-function mergeHookConfigs(opts) {
-  const results = [];
-  const cursorPath = join18(opts.cwd, ".cursor/hooks.json");
-  const cursorFragment = loadFragment("cursor-hooks.fragment.json", opts.hookCommand);
-  results.push(mergeCursorHooks(cursorPath, cursorFragment, opts));
-  const claudePath = join18(opts.cwd, ".claude/settings.json");
-  const claudeFragment = loadFragment("claude-settings.fragment.json", opts.hookCommand);
-  results.push(mergeNestedHooks({
-    platform: "claude",
-    targetPath: claudePath,
-    fragment: claudeFragment,
-    eventName: "PostToolUse",
-    opts
-  }));
-  const codexPath = join18(opts.cwd, ".codex/hooks.json");
-  if (existsSync20(join18(opts.cwd, ".codex"))) {
-    const codexFragment = loadFragment("codex-hooks.fragment.json", opts.hookCommand);
-    results.push(mergeNestedHooks({
-      platform: "codex",
-      targetPath: codexPath,
-      fragment: codexFragment,
-      eventName: "PostToolUse",
-      opts
-    }));
-  } else {
-    results.push({ platform: "codex", action: "skipped", message: "missing .codex directory" });
-  }
-  return results;
+var PRECOMMIT_NAME = ".pre-commit-config.yaml";
+var HOOK_ID = "id: skeleton-validate-staged";
+var LOCAL_HOOK_BLOCK = `  - repo: local
+    hooks:
+      - id: skeleton-validate-staged
+        name: skeleton validate changed (staged)
+        entry: node node_modules/@csark0812/skeleton/dist/cli.js validate changed --staged
+        language: system
+        pass_filenames: false
+`;
+function mergePrecommitConfig(cwd) {
+  const target = join17(cwd, PRECOMMIT_NAME);
+  const template = readFileSync18(join17(TEMPLATES_DIR, "pre-commit-config.yaml"), "utf8");
+  if (!existsSync19(target)) {
+    writeFileSync4(target, template, "utf8");
+    return "added";
+  }
+  const existing = readFileSync18(target, "utf8");
+  if (existing.includes(HOOK_ID))
+    return "skipped";
+  const suffix = existing.includes("repos:") ? `
+${LOCAL_HOOK_BLOCK}` : `
+${template}`;
+  writeFileSync4(target, `${existing.trimEnd()}${suffix}`, "utf8");
+  return "updated";
 }
+
+// src/init/merge-scripts.ts
+import { existsSync as existsSync20, readFileSync as readFileSync19, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join18 } from "node:path";
+var TEMPLATES_DIR2 = resolveTemplatesDir();
 function mergePackageJsonScripts(cwd) {
   const pkgPath = join18(cwd, "package.json");
   if (!existsSync20(pkgPath))
     return "skipped";
-  const fragment = JSON.parse(readFileSync18(join18(TEMPLATES_DIR, "package.json.scripts.fragment.json"), "utf8"));
-  const pkg = JSON.parse(readFileSync18(pkgPath, "utf8"));
+  const fragment = JSON.parse(readFileSync19(join18(TEMPLATES_DIR2, "package.json.scripts.fragment.json"), "utf8"));
+  const pkg = JSON.parse(readFileSync19(pkgPath, "utf8"));
   pkg.scripts ??= {};
   let changed = false;
   for (const [key, value] of Object.entries(fragment)) {
@@ -32915,7 +32680,7 @@ function mergePackageJsonScripts(cwd) {
   }
   if (!changed)
     return "skipped";
-  writeFileSync4(pkgPath, `${JSON.stringify(pkg, null, 2)}
+  writeFileSync5(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `, "utf8");
   return "updated";
 }
@@ -32958,25 +32723,24 @@ function skillsAddArgs(options = {}) {
 }
 
 // src/init/init.ts
-var TEMPLATES_DIR2 = resolveTemplatesDir();
+var TEMPLATES_DIR3 = resolveTemplatesDir();
 function writeScaffold(cwd) {
   const skeletonDir2 = join19(cwd, ".skeleton");
-  mkdirSync4(skeletonDir2, { recursive: true });
+  mkdirSync3(skeletonDir2, { recursive: true });
   let created = false;
   const tomlPath = join19(cwd, "skeleton.toml");
   const legacyYaml = join19(skeletonDir2, "config.yaml");
   if (!(existsSync21(tomlPath) || existsSync21(legacyYaml))) {
-    copyFileSync(join19(TEMPLATES_DIR2, "skeleton.toml"), tomlPath);
+    copyFileSync(join19(TEMPLATES_DIR3, "skeleton.toml"), tomlPath);
     created = true;
   }
-  mkdirSync4(join19(skeletonDir2, "customize"), { recursive: true });
   return created ? "created" : "skipped";
 }
 function assertPackageResolvable(cwd) {
   const pkgPath = join19(cwd, "package.json");
   if (!existsSync21(pkgPath))
     return;
-  const pkg = JSON.parse(readFileSync19(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync20(pkgPath, "utf8"));
   const hasDep = pkg.devDependencies?.["@csark0812/skeleton"] || pkg.dependencies?.["@csark0812/skeleton"];
   if (!hasDep) {
     try {
@@ -32987,23 +32751,13 @@ function assertPackageResolvable(cwd) {
   }
 }
 function runSkillsAdd(args, cwd) {
-  const result = spawnSync2("npx", args, {
+  const result = spawnSync3("npx", args, {
     cwd,
     stdio: "inherit",
     shell: false
   });
   return result.status ?? 1;
 }
-function logHookMergeResult(result) {
-  if (result.action === "conflict") {
-    console.error(`init: skipped ${result.platform} hook (user-edited) — re-run with --force-hooks to restore`);
-    return;
-  }
-  if (result.action === "added")
-    console.log(`init: added ${result.platform} customize hook`);
-  if (result.action === "updated")
-    console.log(`init: updated ${result.platform} customize hook`);
-}
 function installSkillsIfRequested(options, cwd) {
   if (!(options.skills && !options.noSkills))
     return "skipped";
@@ -33016,30 +32770,34 @@ function installSkillsIfRequested(options, cwd) {
   return "installed";
 }
 function runInit(options = {}) {
-  const cwd = options.cwd ?? process6.cwd();
+  const cwd = options.cwd ?? process4.cwd();
   assertPackageResolvable(cwd);
   const scaffold = writeScaffold(cwd);
-  const hookCommand = resolveHookCommand(cwd);
-  const hooks = mergeHookConfigs({ cwd, hookCommand, forceHooks: options.forceHooks });
   const scripts = mergePackageJsonScripts(cwd);
-  for (const result of hooks)
-    logHookMergeResult(result);
+  const precommit = mergePrecommitConfig(cwd);
   if (scaffold === "created") {
-    console.log("init: wrote skeleton.toml (hooks optional — see docs)");
+    console.log("init: wrote skeleton.toml");
   } else {
     console.log("init: skeleton.toml or .skeleton/ already present — skipped scaffold write");
   }
   if (scripts === "updated") {
     console.log("init: merged validate/audit scripts into package.json");
   }
+  if (precommit === "added") {
+    console.log("init: wrote .pre-commit-config.yaml (run pre-commit install once per machine)");
+  } else if (precommit === "updated") {
+    console.log("init: added skeleton validate hook to .pre-commit-config.yaml");
+  }
   const skills = installSkillsIfRequested(options, cwd);
-  return { scaffold, hooks, scripts, skills };
+  return { scaffold, scripts, skills, precommit };
 }
 
 // src/init/parse-args.ts
-var SKELETON_INIT_FLAGS = new Set(["--force-hooks", "--skills", "--no-skills"]);
+var SKELETON_INIT_FLAGS = new Set(["--skills", "--no-skills"]);
 function parseInitArgs(argv) {
-  const forceHooks = argv.includes("--force-hooks");
+  if (argv.includes("--force-hooks")) {
+    throw new Error("init: --force-hooks was removed with customize hooks");
+  }
   const noSkills = argv.includes("--no-skills");
   const skills = argv.includes("--skills");
   const skillsFlags = [];
@@ -33054,14 +32812,14 @@ function parseInitArgs(argv) {
     if (skills)
       skillsFlags.push(arg);
   }
-  return { forceHooks, skills, noSkills, skillsFlags };
+  return { skills, noSkills, skillsFlags };
 }
 
 // src/plugins/build.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync22, readFileSync as readFileSync20, writeFileSync as writeFileSync5 } from "node:fs";
-import { basename as basename4, dirname as dirname13, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync21, writeFileSync as writeFileSync6 } from "node:fs";
+import { basename as basename3, dirname as dirname11, resolve as resolve6 } from "node:path";
 function parseBuildPluginArgs(argv) {
   let check = false;
   let entry;
@@ -33086,7 +32844,7 @@ function collectPluginEntries(root2, config, entry) {
   return (config.plugins ?? []).map((e) => resolvePluginTsPath(root2, e));
 }
 function localImportPaths(tsAbs, content3) {
-  const dir = dirname13(tsAbs);
+  const dir = dirname11(tsAbs);
   const deps = [];
   const re = /(?:from\s+|import\s*\(\s*|import\s+)["'](\.[^"']+)["']/g;
   for (const match of content3.matchAll(re)) {
@@ -33096,9 +32854,9 @@ function localImportPaths(tsAbs, content3) {
     const candidates = [];
     if (spec.endsWith(".js")) {
       const withoutJs = spec.slice(0, -".js".length);
-      candidates.push(resolve7(dir, `${withoutJs}.ts`), resolve7(dir, spec), resolve7(dir, withoutJs, "index.ts"));
+      candidates.push(resolve6(dir, `${withoutJs}.ts`), resolve6(dir, spec), resolve6(dir, withoutJs, "index.ts"));
     } else {
-      candidates.push(resolve7(dir, spec), resolve7(dir, `${spec}.ts`), resolve7(dir, `${spec}.js`), resolve7(dir, spec, "index.ts"));
+      candidates.push(resolve6(dir, spec), resolve6(dir, `${spec}.ts`), resolve6(dir, `${spec}.js`), resolve6(dir, spec, "index.ts"));
     }
     for (const candidate of candidates) {
       if (existsSync22(candidate) && candidate.endsWith(".ts")) {
@@ -33118,8 +32876,8 @@ function sourceFingerprint(tsAbs, seen = new Set) {
     if (seen.has(abs))
       return;
     seen.add(abs);
-    const content3 = readFileSync20(abs, "utf8");
-    hash2.update(basename4(abs));
+    const content3 = readFileSync21(abs, "utf8");
+    hash2.update(basename3(abs));
     hash2.update("\x00");
     hash2.update(content3);
     hash2.update("\x00");
@@ -33131,7 +32889,7 @@ function sourceFingerprint(tsAbs, seen = new Set) {
   return hash2.digest("hex");
 }
 function writeStamp(tsAbs, mjsAbs) {
-  writeFileSync5(stampPathForMjs(mjsAbs), `${sourceFingerprint(tsAbs)}
+  writeFileSync6(stampPathForMjs(mjsAbs), `${sourceFingerprint(tsAbs)}
 `, "utf8");
 }
 async function buildOne(tsAbs) {
@@ -33139,7 +32897,7 @@ async function buildOne(tsAbs) {
   if (!existsSync22(tsAbs)) {
     throw new Error(`Plugin source not found: ${tsAbs}`);
   }
-  const proc = spawnSync3("bun", ["build", tsAbs, "--target=node", "--format=esm", `--outfile=${mjsAbs}`, "--packages=external"], { encoding: "utf8" });
+  const proc = spawnSync4("bun", ["build", tsAbs, "--target=node", "--format=esm", `--outfile=${mjsAbs}`, "--packages=external"], { encoding: "utf8" });
   if (proc.error) {
     const code3 = proc.error.code;
     if (code3 === "ENOENT") {
@@ -33166,7 +32924,7 @@ function checkOne(tsAbs) {
   if (!existsSync22(stampAbs)) {
     throw new Error(`Plugin stale: ${mjsAbs} has no fingerprint stamp. Run: skeleton build-plugin`);
   }
-  const expected = readFileSync20(stampAbs, "utf8").trim();
+  const expected = readFileSync21(stampAbs, "utf8").trim();
   const actual = sourceFingerprint(tsAbs);
   if (expected !== actual) {
     throw new Error(`Plugin stale: ${mjsAbs} does not match ${tsAbs} (or local imports). Run: skeleton build-plugin`);
@@ -33195,15 +32953,15 @@ async function runBuildPlugin(options = {}) {
 }
 
 // src/validate/changed.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync21 } from "node:fs";
-import { basename as basename5, extname as extname2, join as join20 } from "node:path";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync23, readFileSync as readFileSync22 } from "node:fs";
+import { basename as basename4, extname as extname2, join as join20 } from "node:path";
 
 // src/validate/git-diff.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 function gitDiffChangedFiles(options = {}) {
   const root2 = options.root ?? findRepoRoot();
-  const proc = spawnSync4("git", gitDiffArgs(options), { cwd: root2, encoding: "utf8" });
+  const proc = spawnSync5("git", gitDiffArgs(options), { cwd: root2, encoding: "utf8" });
   if (proc.status !== 0) {
     throw new Error(proc.stderr?.trim() || "git diff failed");
   }
@@ -33239,6 +32997,32 @@ function addChangedPath(input) {
   });
 }
 
+// src/validate/staged.ts
+function stageRequiredIssue(file) {
+  return issue("validate-changed", file, {
+    code: "stage-required",
+    message: "worktree differs from HEAD and is not staged; stage the attested document and review-lock.json when hash mode is on"
+  });
+}
+function stageRequiredDiagnostics(input) {
+  if (!input.staged)
+    return [];
+  const staged = new Set(input.stagedPaths.map(normalizeRelPath));
+  const required = [...input.impactedDocuments];
+  if (input.config.reviewProof) {
+    required.push(input.config.reviewProof.lockfile ?? DEFAULT_REVIEW_LOCKFILE);
+  }
+  const issues = [];
+  for (const path3 of [...new Set(required)].sort()) {
+    if (staged.has(path3))
+      continue;
+    if (!pathDiffersFromHead(input.root, path3))
+      continue;
+    issues.push(stageRequiredIssue(path3));
+  }
+  return issues;
+}
+
 // src/validate/changed.ts
 var DOC_EXTENSIONS = new Set([".md", ".mdc", ".yaml", ".yml"]);
 var POLICY_EXTENSIONS = new Set([".yaml", ".yml"]);
@@ -33251,7 +33035,7 @@ function isSkeletonYamlCandidate(normalized, ext) {
   if (!(normalized.startsWith(".skeleton/") || normalized.startsWith(".skeleton\\"))) {
     return false;
   }
-  const name = basename5(normalized).toLowerCase();
+  const name = basename4(normalized).toLowerCase();
   if (name === "config.yaml" || name === "config.yml")
     return false;
   return true;
@@ -33276,7 +33060,7 @@ function bucketForDocPath(normalized, ctx) {
 function bucketFor(relPath2, ctx) {
   const normalized = normalizeRelPath(relPath2);
   const ext = extname2(normalized).toLowerCase();
-  const name = basename5(normalized);
+  const name = basename4(normalized);
   if (CODE_EXTENSIONS.has(ext))
     return "code";
   if (COMMAND_CONFIG_NAMES.has(name))
@@ -33314,30 +33098,51 @@ function parseJsonContent(content3) {
 function validationIssue(code3, file, message) {
   return issue("validate-changed", file, { code: code3, message, severity: "error" });
 }
-function validateJson(relPath2, root2) {
-  const abs = join20(root2, relPath2);
+function rereadValidationIssue(file, target) {
+  return issue("validate-changed", file, {
+    code: "impacted-document-review-required",
+    message: "a linked review dependency changed; re-read the entire document, then attest it with --fix=doc-meta --confirm-reviewed and include the document in validation",
+    severity: "error",
+    link: target
+  });
+}
+function validateJson(relPath2, root2, fileSource) {
+  const content3 = readRepoText(root2, relPath2, fileSource);
+  if (content3 === null)
+    return validationIssue("invalid-json", relPath2, "path not found");
   try {
-    parseJsonContent(readFileSync21(abs, "utf8"));
+    parseJsonContent(content3);
     return null;
   } catch (error) {
     return validationIssue("invalid-json", relPath2, `invalid JSON: ${error}`);
   }
 }
-function validatePolicy(relPath2, root2) {
-  const abs = join20(root2, relPath2);
+function validatePolicy(relPath2, root2, fileSource) {
+  const content3 = readRepoText(root2, relPath2, fileSource);
+  if (content3 === null)
+    return validationIssue("invalid-policy", relPath2, "path not found");
   try {
-    loadPolicyFile(abs, readFileSync21(abs, "utf8"));
+    loadPolicyFile(join20(root2, relPath2), content3);
     return null;
   } catch (error) {
     return validationIssue("invalid-policy", relPath2, `invalid policy: ${error}`);
   }
 }
-function validateShell(relPath2, root2) {
+function validateShell(relPath2, root2, fileSource) {
+  if (fileSource === "index") {
+    const content3 = readRepoText(root2, relPath2, fileSource);
+    if (content3 === null)
+      return validationIssue("invalid-shell", relPath2, "path not found");
+    const bash2 = spawnSync6("bash", ["-n"], { input: content3, encoding: "utf8" });
+    if (bash2.status === 0)
+      return null;
+    return validationIssue("invalid-shell", relPath2, `shell syntax check failed: ${bash2.stderr}`);
+  }
   const abs = join20(root2, relPath2);
-  const shellcheck = spawnSync5("shellcheck", [abs], { encoding: "utf8" });
+  const shellcheck = spawnSync6("shellcheck", [abs], { encoding: "utf8" });
   if (shellcheck.status === 0)
     return null;
-  const bash = spawnSync5("bash", ["-n", abs], { encoding: "utf8" });
+  const bash = spawnSync6("bash", ["-n", abs], { encoding: "utf8" });
   if (bash.status === 0)
     return null;
   return validationIssue("invalid-shell", relPath2, `shell syntax check failed: ${bash.stderr || shellcheck.stderr}`);
@@ -33361,7 +33166,7 @@ function packageManagerFromPackageJson(root2) {
   if (!existsSync23(pkgPath))
     return null;
   try {
-    const pkg = JSON.parse(readFileSync21(pkgPath, "utf8"));
+    const pkg = JSON.parse(readFileSync22(pkgPath, "utf8"));
     const raw = pkg.packageManager?.split("@")[0];
     if (raw === "bun" || raw === "npm" || raw === "pnpm" || raw === "yarn")
       return raw;
@@ -33440,20 +33245,20 @@ function classifyPaths(ctx) {
   }
   return state;
 }
-function validateLocalBuckets(buckets, root2) {
+function validateLocalBuckets(buckets, root2, fileSource) {
   const diagnostics = [];
   for (const relPath2 of buckets.shell) {
-    const found = validateShell(relPath2, root2);
+    const found = validateShell(relPath2, root2, fileSource);
     if (found)
       diagnostics.push(found);
   }
   for (const relPath2 of buckets.json) {
-    const found = validateJson(relPath2, root2);
+    const found = validateJson(relPath2, root2, fileSource);
     if (found)
       diagnostics.push(found);
   }
   for (const relPath2 of buckets.policy) {
-    const found = validatePolicy(relPath2, root2);
+    const found = validatePolicy(relPath2, root2, fileSource);
     if (found)
       diagnostics.push(found);
   }
@@ -33466,16 +33271,24 @@ function discoverImpactedDocuments(input) {
   const changed = new Set(input.relPaths.map(normalizeRelPath));
   const impacted = [];
   for (const abs of collectScanFiles(input.config, input.root, input.skillIndex)) {
-    const document4 = impactedDocumentForPath(abs, input.root, changed);
+    const document4 = impactedDocumentForPath({
+      abs,
+      root: input.root,
+      changed,
+      fileSource: input.fileSource
+    });
     if (document4)
       impacted.push(document4);
   }
   return impacted.sort((a, b) => a.path.localeCompare(b.path));
 }
-function impactedDocumentForPath(abs, root2, changed) {
-  const path3 = relPath(abs, root2);
-  const reviewDependencies = reviewDependencyPatterns(readFileSync21(abs, "utf8"));
-  const reasons = impactReasons(path3, reviewDependencies, changed);
+function impactedDocumentForPath(input) {
+  const path3 = relPath(input.abs, input.root);
+  const content3 = readRepoText(input.root, path3, input.fileSource);
+  if (content3 === null)
+    return null;
+  const reviewDependencies = reviewDependencyPatterns(content3);
+  const reasons = impactReasons(path3, reviewDependencies, input.changed);
   return reasons.length > 0 ? { path: path3, reviewDependencies, reasons } : null;
 }
 function impactReasons(path3, reviewDependencies, changed) {
@@ -33494,18 +33307,35 @@ function dateModeImpactDiagnostics(input) {
     return [];
   const changed = new Set(input.relPaths.map(normalizeRelPath));
   const today = formatLocalReviewDate(new Date);
-  const diagnostics = [];
-  for (const impacted of input.impactedDocuments) {
-    if (!impacted.reasons.some((reason) => reason.kind === "changed-review-dependency"))
-      continue;
-    const content3 = readFileSync21(join20(input.root, impacted.path), "utf8");
-    if (changed.has(impacted.path) && docMetaLastReviewed(content3) === today)
+  return input.impactedDocuments.flatMap((impacted) => dateModeIssuesForDocument({
+    impacted,
+    changed,
+    today,
+    root: input.root,
+    fileSource: input.fileSource
+  }));
+}
+function dateModeIssuesForDocument(input) {
+  const content3 = readRepoText(input.root, input.impacted.path, input.fileSource);
+  if (!content3) {
+    return input.impacted.reasons.filter((reason) => reason.kind === "changed-review-dependency" && reason.target).map((reason) => rereadValidationIssue(input.impacted.path, reason.target ?? ""));
+  }
+  if (input.changed.has(input.impacted.path) && docMetaLastReviewed(content3) === input.today) {
+    return [];
+  }
+  const issues = [];
+  for (const reason of input.impacted.reasons) {
+    if (reason.kind !== "changed-review-dependency" || !reason.target)
       continue;
-    diagnostics.push(validationIssue("impacted-document-review-required", impacted.path, "a linked review dependency changed; re-read the entire document, then attest it with --fix=doc-meta --confirm-reviewed and include the document in validation"));
+    issues.push(rereadValidationIssue(input.impacted.path, reason.target));
   }
-  return diagnostics;
+  return issues;
+}
+function uncoveredChangedPathDiagnostics(relPaths, config, patterns) {
+  return relPaths.map(normalizeRelPath).filter((path3) => pathRequiresReviewCoverage(path3, config)).filter((path3) => !pathHasReviewOwner(path3, patterns)).map((path3) => validationIssue("uncovered-changed-path", path3, "no scanned document claims this path with review-deps. Add a review-deps marker on the owning paper."));
 }
-function classificationDiagnostics(classification, root2, base) {
+function classificationDiagnostics(input) {
+  const { classification, root: root2, base, coverageCandidateCount } = input;
   const diagnostics = [];
   for (const orphan of classification.orphans) {
     diagnostics.push(validationIssue("orphan-policy", orphan, "file is under .skeleton/ but is not referenced by any plugin policies glob; export it from a plugin policies array or move it"));
@@ -33514,7 +33344,7 @@ function classificationDiagnostics(classification, root2, base) {
     diagnostics.push(validationIssue("missing-path", missing, "path not found"));
   }
   const audited = auditedPathCount(classification.buckets);
-  if ((classification.skipped.length > 0 || classification.buckets.code.length > 0) && audited === 0 && !base) {
+  if ((classification.skipped.length > 0 || classification.buckets.code.length > 0) && audited === 0 && coverageCandidateCount === 0 && !base) {
     diagnostics.push(validationIssue("all-paths-skipped", ".", `all paths were skipped (code/config). This does not verify application code.
 ${codeValidationHint(root2)}`));
   }
@@ -33545,35 +33375,54 @@ function auditOptions(suite, root2, paths, extra = {}) {
     ...extra
   };
 }
+async function auditSkillChanges(input) {
+  const sourceOpt = { fileSource: input.fileSource };
+  if (input.skills.length === 0)
+    return [];
+  if (!input.base) {
+    return [await evaluateAudit(auditOptions("skills", input.root, [], sourceOpt))];
+  }
+  return [
+    await evaluateAudit(auditOptions("skills", input.root, input.skills, {
+      pathScopedOnly: true,
+      ...sourceOpt
+    }))
+  ];
+}
+async function auditPolicyChanges(input) {
+  const sourceOpt = { fileSource: input.fileSource };
+  const audits = [await evaluateAudit(auditOptions("docs", input.root, [], sourceOpt))];
+  const skillPaths = listSkillMarkdownPaths(input.root, input.skillIndex);
+  if (skillPaths.length === 0)
+    return audits;
+  audits.push(await evaluateAudit(auditOptions("skills", input.root, skillPaths, {
+    pathScopedOnly: true,
+    ...sourceOpt
+  })));
+  return audits;
+}
 async function evaluateBucketAudits(input) {
-  const { classification, root: root2, skillIndex, base } = input;
+  const { classification, root: root2, skillIndex, base, fileSource } = input;
   const audits = [];
-  const diagnostics = validateLocalBuckets(classification.buckets, root2);
+  const diagnostics = validateLocalBuckets(classification.buckets, root2, fileSource);
+  const sourceOpt = { fileSource };
   if (base) {
-    audits.push(await evaluateAudit(auditOptions("self", root2, [], { globalOnly: true })));
+    audits.push(await evaluateAudit(auditOptions("self", root2, [], { globalOnly: true, ...sourceOpt })));
   }
   if (classification.buckets.docs.length > 0) {
-    audits.push(await evaluateAudit(auditOptions("docs", root2, classification.buckets.docs, { pathScopedOnly: true })));
-  }
-  if (classification.buckets.skills.length > 0) {
-    if (!base) {
-      diagnostics.push(validationIssue("full-skills-audit-required", classification.buckets.skills[0] ?? ".", "skill paths need the full skills suite; run skeleton audit skills (audit self covers docs and .skeleton; excluded skill trees still need audit skills)"));
-    } else {
-      audits.push(await evaluateAudit(auditOptions("skills", root2, classification.buckets.skills, {
-        pathScopedOnly: true
-      })));
-    }
+    audits.push(await evaluateAudit(auditOptions("docs", root2, classification.buckets.docs, {
+      pathScopedOnly: true,
+      ...sourceOpt
+    })));
   }
-  if (classification.buckets.policy.length > 0) {
-    if (!base) {
-      diagnostics.push(validationIssue("full-policy-audit-required", classification.buckets.policy[0] ?? ".", "policy YAML changes need full prose passes; run skeleton audit docs and skeleton audit skills"));
-    } else {
-      audits.push(await evaluateAudit(auditOptions("docs", root2, [])));
-      const skillPaths = listSkillMarkdownPaths(root2, skillIndex);
-      if (skillPaths.length > 0) {
-        audits.push(await evaluateAudit(auditOptions("skills", root2, skillPaths, { pathScopedOnly: true })));
-      }
-    }
+  audits.push(...await auditSkillChanges({
+    skills: classification.buckets.skills,
+    root: root2,
+    base,
+    fileSource
+  }));
+  if (classification.buckets.policy.length > 0 && !diagnostics.some((item) => item.code === "invalid-policy")) {
+    audits.push(...await auditPolicyChanges({ root: root2, skillIndex, fileSource }));
   }
   return { audits, diagnostics };
 }
@@ -33611,6 +33460,7 @@ function emptyClassification() {
 }
 async function evaluateValidateChanged(options = {}) {
   const root2 = options.root ?? findRepoRoot();
+  refreshLocalCatalog(root2);
   const resolvedPaths = resolvePaths(options);
   const relPaths = resolvedPaths.paths;
   if (relPaths.length === 0) {
@@ -33618,6 +33468,7 @@ async function evaluateValidateChanged(options = {}) {
   }
   const config = loadConfig(root2);
   const skillIndex = buildSkillIndex(root2, config.skillOwnership);
+  const fileSource = options.staged ? "index" : "worktree";
   let wiredPolicies;
   try {
     wiredPolicies = await collectWiredPolicyRelPaths(root2, config);
@@ -33638,37 +33489,58 @@ async function evaluateValidateChanged(options = {}) {
     skillIndex
   });
   classification.missing = classification.missing.filter((path3) => !resolvedPaths.deleted.has(path3));
-  const impactedDocuments = discoverImpactedDocuments({ relPaths, root: root2, config, skillIndex });
+  const impactedDocuments = discoverImpactedDocuments({
+    relPaths,
+    root: root2,
+    config,
+    skillIndex,
+    fileSource
+  });
   for (const impacted of impactedDocuments) {
     if (!classification.buckets.docs.includes(impacted.path)) {
       classification.buckets.docs.push(impacted.path);
     }
   }
   classification.buckets.docs.sort();
-  const diagnostics = classificationDiagnostics(classification, root2, options.base);
-  if (diagnostics.length > 0) {
-    return resultFor({
-      options,
-      relPaths,
-      classification: publicClassification(classification),
-      impactedDocuments,
-      diagnostics
-    });
-  }
+  const ownerPatterns = collectReviewDependencyPatterns({
+    root: root2,
+    config,
+    skillIndex,
+    fileSource
+  });
+  const livePaths = relPaths.filter((path3) => !resolvedPaths.deleted.has(path3));
+  const coverageCandidateCount = livePaths.filter((path3) => pathRequiresReviewCoverage(path3, config)).length;
+  const diagnostics = [
+    ...classificationDiagnostics({
+      classification,
+      root: root2,
+      base: options.base,
+      coverageCandidateCount
+    }),
+    ...uncoveredChangedPathDiagnostics(livePaths, config, ownerPatterns),
+    ...stageRequiredDiagnostics({
+      staged: options.staged ?? false,
+      stagedPaths: relPaths,
+      impactedDocuments: impactedDocuments.map((item) => item.path),
+      config,
+      root: root2
+    })
+  ];
   const evaluated = await evaluateBucketAudits({
     classification,
     root: root2,
     skillIndex,
-    base: options.base
+    base: options.base,
+    fileSource
   });
-  evaluated.diagnostics.push(...dateModeImpactDiagnostics({ config, impactedDocuments, relPaths, root: root2 }));
+  evaluated.diagnostics.push(...dateModeImpactDiagnostics({ config, impactedDocuments, relPaths, root: root2, fileSource }));
   return resultFor({
     options,
     relPaths,
     classification: publicClassification(classification),
     impactedDocuments,
     audits: evaluated.audits,
-    diagnostics: evaluated.diagnostics
+    diagnostics: [...diagnostics, ...evaluated.diagnostics]
   });
 }
 function printValidateChangedResult(result) {
@@ -33679,16 +33551,20 @@ function printValidateChangedResult(result) {
   for (const path3 of result.classification.foreignSkills) {
     console.log(`validate changed: skipping foreign skill ${path3} (owned upstream; see skills-lock.json / skillOwnership)`);
   }
-  for (const audit of result.audits)
-    printAuditResult(audit, false);
-  for (const impacted of result.impactedDocuments) {
-    for (const reason of impacted.reasons) {
-      if (reason.kind !== "changed-review-dependency")
-        continue;
-      console.log(`validate changed: ${impacted.path} requires review (dependency ${reason.dependency} matched ${reason.target})`);
+  if (result.ok) {
+    for (const audit of result.audits)
+      printAuditResult(audit, false);
+  } else {
+    for (const audit of result.audits.filter((item) => !item.ok)) {
+      printAuditResult(audit, false);
     }
   }
-  for (const diagnostic of result.diagnostics) {
+  const rereadDiagnostics = result.diagnostics.filter(isRereadIssue);
+  const otherDiagnostics = result.diagnostics.filter((item) => !isRereadIssue(item));
+  if (rereadDiagnostics.length > 0) {
+    printReport(rereadDiagnostics, { label: "validate changed" });
+  }
+  for (const diagnostic of otherDiagnostics) {
     const path3 = diagnostic.file === "." ? "" : `${diagnostic.file}: `;
     console.error(`validate changed: ${path3}${diagnostic.message}`);
   }
@@ -33716,16 +33592,14 @@ function usage() {
   console.error(`Usage: skeleton <command>
 
 Commands:
-  init [--force-hooks] [--skills] [--no-skills] [skills add flags…]
+  init [--skills] [--no-skills] [skills add flags…]
   audit docs|self|skills [--strict] [--json] [--paths=a,b] [--only=rule]
                          [--fix[=doc-meta|anchors|ssot]] [--dry-run]
                          [--confirm-reviewed (doc-meta only; requires --paths)]
   build-plugin [path] [--check]
   validate changed [paths…] [--staged] [--base <ref>]
   catalog [--check] [--strict]  write or check .skeleton/catalog.md (gitignored)
-  customize resolve <slug> [--json]
-  hook customize            (reads a host hook payload on stdin)
-Note: \`register\` was removed — add a source-of-truth marker to the file and run \`skeleton catalog\`.`);
+Note: \`register\`, \`customize\`, and \`hook\` were removed.`);
 }
 function parseValidateChangedArgs(rest) {
   const paths = [];
@@ -33788,28 +33662,9 @@ function handleCatalog(argv) {
   }
   return runCatalogCli({ check: argv.includes("--check"), strict: argv.includes("--strict") });
 }
-function handleCustomizeResolve(argv) {
-  const slug2 = argv[0];
-  const json = argv.includes("--json");
-  if (!slug2) {
-    console.error("customize resolve: slug required");
-    return 1;
-  }
-  const result = resolveCustomizeFromRoot(slug2);
-  if (json) {
-    console.log(JSON.stringify(result, null, 2));
-  } else if (result.content) {
-    process7.stdout.write(result.content);
-  }
-  return 0;
-}
-function handleHook(argv) {
-  if (argv[0] !== "customize") {
-    usage();
-    return 1;
-  }
-  process7.stdout.write(runCustomizeHook(readFileSync22(0, "utf8")));
-  return 0;
+function handleRemovedOverlay(command) {
+  console.error(`${command}: removed — overlay inject is gone. Edit the skill in its owning repo.`);
+  return 1;
 }
 function handleInit(argv) {
   runInit(parseInitArgs(argv));
@@ -33830,9 +33685,8 @@ async function dispatchCommand(argv) {
     case "catalog":
       return handleCatalog(rest);
     case "customize":
-      return rest[0] === "resolve" ? handleCustomizeResolve(rest.slice(1)) : null;
     case "hook":
-      return handleHook(rest);
+      return handleRemovedOverlay(command);
     case "init":
       return handleInit(rest);
     default:
@@ -33840,22 +33694,22 @@ async function dispatchCommand(argv) {
   }
 }
 async function main() {
-  const argv = process7.argv.slice(2);
+  const argv = process5.argv.slice(2);
   const command = argv[0];
   if (!command || command === "--help" || command === "-h") {
     usage();
-    process7.exit(command ? 0 : 1);
+    process5.exit(command ? 0 : 1);
   }
   try {
     const exitCode = await dispatchCommand(argv);
     if (exitCode === null) {
       usage();
-      process7.exit(1);
+      process5.exit(1);
     }
-    process7.exit(exitCode);
+    process5.exit(exitCode);
   } catch (error) {
     console.error(String(error));
-    process7.exit(1);
+    process5.exit(1);
   }
 }
 main();