@dzhechkov/harness-cli 0.3.234 → 0.3.236

package/.dz-manifest.json

@@ -3,45 +3,13 @@
     "version": 1,
     "pack": "harness-cli",
     "files": [
-      {
-        "path": ".agentic-qe/brain.rvf",
-        "sha256": "8136cd4cc145d3dbe6ed3ae4489946bbc26e3e44172f0e5241ac45dde38bfead"
-      },
-      {
-        "path": ".agentic-qe/brain.rvf.lock",
-        "sha256": "96c3f61d34c63a8adf2a87cd10abc73b09946223798a543d2c477f6486ceba2b"
-      },
-      {
-        "path": ".agentic-qe/memory.db",
-        "sha256": "456372cb9a8c12f98ae6378338b8469d9be6df05cbe03a99b412d83d962b3d11"
-      },
-      {
-        "path": ".agentic-qe/memory.db-shm",
-        "sha256": "613a87ec0ce8a7cc48d1b6939999ac623c144ff5718f04b40b9d26519f517af2"
-      },
-      {
-        "path": ".agentic-qe/memory.db-wal",
-        "sha256": "8b037ea49fcdf20ebbe02798aaa6b5cdddd5cadd1f7239c629650093afd5ac2f"
-      },
-      {
-        "path": ".agentic-qe/patterns.rvf",
-        "sha256": "9090b2e6d339eaa183672ac0cf9f625dbd5f9fc76d64afcdb34a3f5871c31c5a"
-      },
-      {
-        "path": ".agentic-qe/patterns.rvf.idmap.json",
-        "sha256": "c2693f9a7f47a2d2bffe3004188e70ce08411bf8db47d07c60551d18ff7640c4"
-      },
-      {
-        "path": ".agentic-qe/patterns.rvf.lock",
-        "sha256": "ad77ee665c75491a8700381fb79205d308653e99a15013564c7732eeb6aa1181"
-      },
       {
         "path": "CHANGELOG.md",
         "sha256": "9555ead768fef7963e735b0c6af21a64412811531534108be3df61bc65b51021"
       },
       {
         "path": "README.md",
-        "sha256": "4a11112ac688fbc833439ec9d047da01abf0981189edf611f198dc36ae7c34ec"
+        "sha256": "1e36d7e9e6022d412c030975ec686b1ab91c61c64c807ef2e9ff3fa75ac8917c"
       },
       {
         "path": "coverage/coverage-final.json",
@@ -73,15 +41,15 @@
       },
       {
         "path": "dist/cli.d.ts.map",
-        "sha256": "8c3b6f509c494ff446a098239f39453510a385f879d86127e91a528287b32333"
+        "sha256": "8a00bf14c3fdd437b7e482da8c4018366041755714ed1791b1c523f9dee5de6c"
       },
       {
         "path": "dist/cli.js",
-        "sha256": "0ea78654ed97065078affc088022d25406568345f30aaf87ec30533b1537110a"
+        "sha256": "dea4446db1109285c1fc5f5283d7263462cb446f12b0d9b1e1e821374d0ca57d"
       },
       {
         "path": "dist/cli.js.map",
-        "sha256": "8fc984391e8ff91464f32e73d36253f292d558e2bb2676b2a18e474d8d1861d5"
+        "sha256": "a253625c94835ef94bbd141b1dd759578433423bd098314fd977c515f140dafe"
       },
       {
         "path": "dist/index.d.ts",
@@ -105,7 +73,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "68a09fba4c6068dd171738166ad659097bf99d08b8a80ca504ad5109148b4eb5"
+        "sha256": "543319797d47d599a646c7d695f82aa31491ffd97579edd691b6a9cb99af76ef"
       },
       {
         "path": "src/bin.ts",
@@ -113,7 +81,7 @@
       },
       {
         "path": "src/cli.ts",
-        "sha256": "af5541d8bd97570102b8df85b6ed598813b8d53ede9cc71533e40b808d5c033e"
+        "sha256": "c5d4902f9b0c4133318b15e757d07856872177dc92752d5996440524342b7f88"
       },
       {
         "path": "src/index.ts",
@@ -121,7 +89,7 @@
       },
       {
         "path": "test/cli.test.ts",
-        "sha256": "73b554b9f78681d9e1dd168b945bac427bcf027e11125157d8b4ab5e2b25dc22"
+        "sha256": "0538f3cfd8eb880305c08fef05a78601263003c54a6f1b44f97cd7ebd7bd37f9"
       },
       {
         "path": "tsconfig.json",
@@ -133,5 +101,5 @@
       }
     ]
   },
-  "signature": "XO+n3VwYnhgXfKF8nBdxZ4ALrmUgXX+3OSBzauqpk9UV8/PVbKLHspZQ2Pfu9zO7wIcharU8f+NF/GXMGCyWDw=="
+  "signature": "0IDcNO+8RqyABrL7YXlDBQLCTiNktCk/Ktd724vSyxsJ0/rti05jjEudABZo3+ILMok7jLgQs/YRalC77RdOCA=="
 }

package/README.md

@@ -372,6 +372,33 @@ the release job gets a perfectly attested malicious package.
 A ready-to-install workflow is at `features/publish-provenance/07_code_changes/publish.yml`; copy it to
 `.github/workflows/` and add an `NPM_TOKEN` secret.
 
+### Target parity — `dz parity` (the honest feature × target map)
+
+The harness runs on 10 targets, but not every feature runs everywhere: hooks, MCP (Model Context
+Protocol) and the Workflow runtime exist only on some platforms. `dz parity` answers "what do I
+actually get on X?" from a COMPUTED capability model — the matrix is never hand-written (a
+hand-maintained table is a drift surface; the model lives next to the code, under tests that
+refuse an unclassified 11th target).
+
+```bash
+dz parity                    # the full grid: ✓ full / ◐ manual (via which form) / — absent
+dz parity --target codex     # one target in detail: what works, THROUGH what
+dz parity --json             # machine contract (targets, capabilities, per-cell level + via)
+```
+
+Example (real output, trimmed):
+
+```
+dz parity — codex  (capabilities: shell, skills, mcp)
+  ✓ dz CLI (all commands)                    via shell command
+  ◐ feature-adr pipeline                     via interactive skill (plain /feature-adr)
+  — Step-10 Delivery Gate                    not available on this target
+  ◐ Integrity claim-check                    via dz claim-check (CLI) + publish gate
+```
+
+**When to use:** before promising a workflow to a teammate on Cursor/Codex/Hermes; when choosing
+a target for a project; as the requirements input for porting a feature to more targets.
+
 ### Verified release — `dz release` (4 HARD gates in front of `dz publish`)
 
 `dz publish` gates on guard / claim-check / signatures / provenance / files-whitelist — none of which
@@ -481,7 +508,7 @@ Get the whole set with `dz init --target claude-code --preset meta`, or pick one
 
 > **A skill and its npx toolkit are not duplicates — they're a graduation.** Several skills (e.g. `feature-adr`, `design-thinking`) exist BOTH as a skill inside a `dz` preset AND as a standalone `npx` package. The preset's SKILL.md is **fully functional on its own** (the whole methodology — modules + references — travels with it, and it auto-activates by description), and it's the only way to compile that capability to the **non-Claude platforms** (Codex/OpenCode/Hermes/OpenClaude) via `dz`. The npx package adds **project-level runtime governance** around the same skill: a slash command, governance rules, a context shard, and (for feature-adr) reward-learning + `/harvest`. So: pick the **skill/preset** for a working capability across platforms; pick the **npx toolkit** when you want it as a governed, command-driven fixture of one project.
 
-## All Commands (55)
+## All Commands (56)
 
 ```
 dz setup             --target <name> [--preset <name>] [--select id,id,...] [--skills-dir <dir>] [--memory agentdb] [--no-memory] [--no-hooks] [--install-driver] [--force]
@@ -541,6 +568,7 @@ dz sbom --pack <dir> [--out <file>]   # emit the CycloneDX 1.5 SBOM for a pack s
 dz guard check --op <publish|teach|consolidate|reindex> [--text <s>] [--json] [--force <reason>]   # declarative constraint layer before self-mutating ops: HARD violation → block (exit 1), SOFT → warn; zero-config defaults, .dz/guard.json to customise; dz guard --init | dz guard log (append-only audit). dz publish runs it automatically (--no-guard "<reason>" = logged escape hatch)
 dz feature-adr-setup --guards [--loc-cap <n>] [--apply]   # P3: scaffold DETERMINISTIC guard tests into the project — guards.config.json + a zero-dependency check.mjs runner (LOC cap, secret scan, frozen-file sha256 pins, waivers-with-reasons); wire `node architecture/guards/check.mjs` into CI
 dz publish           [--filter <name>] [--bump-only] [--claim-check <off|warn|error>]   (dry-run by default; pass --yes/--confirm to go live; claim-check gate defaults to warn — surfaces README claim findings, never blocks)
+dz parity            [--target <name>] [--json]   # honest feature×target map COMPUTED from the capability model — full / manual (via which form) / absent, per target
 dz release           [--filter <name>] [--affected] [--audit-dev] [--tag] [--publish] [--json] [--dry-run] [--no-issue]   # VERIFIED release: 4 HARD gates in front of dz publish — package test suites, pnpm audit --prod >=high (--audit-dev widens), node --check of every dist/bin file (unbuilt package with a build script ⇒ MISSING_DIST fail), bin smoke-boot "node <bin> --help" (temp cwd + timeout); --affected narrows to git-touched packages (fail-open); any red gate STOPS the release (exit 1) + best-effort gh issue; green ⇒ re-sign reminder, then the ready dz publish command (never with --yes injected)
 dz auto-canonicalize --source <github-url> --pack <skills-pack>
 dz sync-upstream     [--package <dir>] [--list] [--all]
@@ -1657,7 +1685,10 @@ dz guard (teach): ✗ BLOCK  [checked: no-secrets, store-bloat-cap]
 hatch `--no-guard "<reason>"` requires a reason and is logged to `.dz/guard-audit.jsonl` — an override is
 visible, never silent. Calibrated against false gates: in a pnpm workspace, `workspace:*` in source is
 *correct* (pnpm rewrites it at publish), so the rule resolves each workspace dep to the version it would
-ship as and blocks only a dep that would ship raw.
+ship as and blocks only a dep that would ship raw. The `readme-consistency` rule also holds the **docs
+site** in the contour: the command count on the Starlight CLI overview and the front-page tagline must
+match the cli README (the site once drifted 35→55 silently; now a mismatch is a warning here and a red
+test in CI). In a repo without the docs site those pairs simply aren't gathered — no false gate.
 
 ### `dz feature-adr-setup --guards` — when a project rule should be a TEST, not a reviewer's memory
 
@@ -2098,7 +2129,7 @@ npx @dzhechkov/p-replicator init
 
 ## Status
 
-`v0.3.234` — published on npm. Also available as [Claude Plugin](#claude-plugin). Part of [DZ Harness Hub](https://github.com/djd1m/dz-harness-hub).
+`v0.3.236` — published on npm. Also available as [Claude Plugin](#claude-plugin). Part of [DZ Harness Hub](https://github.com/djd1m/dz-harness-hub).
 
 ## Claude Plugin
 

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA4PH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAguK9E,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA8I5E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgQH,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAC5C;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAs0K9E,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAgJ5E"}

package/dist/cli.js

@@ -9,7 +9,7 @@ import { fileURLToPath } from 'node:url';
 import { execSync } from 'node:child_process';
 import { homedir, tmpdir } from 'node:os';
 import { createRequire } from 'node:module';
-import { createSkill, getSkillInfo, getWorkflow, isTargetName, listSkills, runDoctor, runInit, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, TARGET_NAMES, WORKFLOW_NAMES, importEcc, recordPattern, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, statuslineData, writeFeatureAdrState, computeUsage, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, claimCheck, summarize, queryBookKnowledge, loadStorePatternsSync, patternRecordId, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, decideProvenance, isInsideTree, signManifest, verifyManifest, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, collectPackageFacts, planReleaseGates, selectAffectedPackages, classifyGateExecutions, buildFailureIssue, buildReleaseNotes, releaseTagName, firstOutputLine, formatPublishError, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, } from '@dzhechkov/harness-core';
+import { createSkill, getSkillInfo, getWorkflow, isTargetName, listSkills, runDoctor, runInit, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, TARGET_NAMES, buildParityMatrix, TARGET_CAPABILITIES, TARGET_SHORT_LABELS, WORKFLOW_NAMES, importEcc, recordPattern, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, statuslineData, writeFeatureAdrState, computeUsage, deriveUsageCalibration, normalizeClaudeUsageModelKey, readUsageLimits, claimCheck, summarize, queryBookKnowledge, loadStorePatternsSync, patternRecordId, loadStoreRecords, recordToPattern, bundleSkills, brainHome, listBrain, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, decideProvenance, isInsideTree, signManifest, verifyManifest, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, collectPackageFacts, planReleaseGates, selectAffectedPackages, classifyGateExecutions, buildFailureIssue, buildReleaseNotes, releaseTagName, firstOutputLine, formatPublishError, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, } from '@dzhechkov/harness-core';
 import { getPreset, PRESET_NAMES } from '@dzhechkov/harness-presets';
 import { scanGitHub, analyzeRepo, generateReport, deepAnalyze, scanAllSources, ScoutMemory } from '@dzhechkov/scout';
 const USAGE = `dz - DZ cross-platform harness CLI
@@ -33,6 +33,7 @@ Usage:
   dz verify-pack --pack <dir> [--pubkey <path>]             (signature check; fail-closed; key from the repo, never the pack)
   dz publish [--filter <name>] [--bump-only] [--claim-check <off|warn|error>] [--require-signing] [--provenance|--no-provenance]   (dry-run by default; pass --yes/--confirm/--no-dry-run to go live; claim-check gate default warn — surfaces README claim findings, never blocks; error fails an offending package)
   dz release [--filter <name>] [--tag] [--publish] [--json] [--dry-run] [--no-issue]   (VERIFIED release: 4 HARD gates in FRONT of dz publish — full package test suites, audit >=high, node --check of every dist/bin file, bin smoke-boot via "node <bin> --help" — any red gate STOPS the release (exit 1) + best-effort gh issue; all green ⇒ re-sign reminder, then prints the ready dz publish command (or chains with --publish); never duplicates publish's own gates)
+  dz parity [--target <name>] [--json]   (the honest feature×target map, COMPUTED from the capability model — which harness feature is full / manual / absent on each of the ${TARGET_NAMES.length} targets, and via which form)
   dz setup --target <name> [--preset <name>] [--select id,id,...] [--skills-dir <dir>] [--project <dir>] [--memory agentdb] [--no-memory] [--no-hooks] [--install-driver] [--force] [--enrich]
   dz teach "<pattern>" [--reward <0-1>] [--domain <name>] [--type rule|success-pattern|lesson-learned] [--project <dir>] [--no-mirror]   (--project pins the learned store to <dir>/.dz, not the cwd — pin to a canonical brain)
   dz teach --from-json <file> [--project <dir>] [--no-mirror]   (bulk-import a 'dz recall --all --json' export — share a learned store across machines)
@@ -3262,6 +3263,85 @@ function cmdPublish(options, flags, cwd, write) {
     return report.errors > 0 ? 1 : 0;
 }
 /* ------------------------------------------------------------------ */
+/*  dz parity — the honest feature×target map (target-parity-matrix,   */
+/*  ADR-001): computed from the declarative model, never hand-written  */
+/* ------------------------------------------------------------------ */
+function cmdParity(options, flags, write) {
+    const json = flags.has('json');
+    if (flags.has('help')) {
+        write('dz parity [--target <name>] [--json] — the computed feature×target map (never hand-written)');
+        write(`  targets: ${TARGET_NAMES.join(', ')}`);
+        return 0;
+    }
+    const allowedFlags = new Set(['json', 'help']);
+    const allowedOptions = new Set(['target']);
+    // A stray positional is a typo'd invocation, not something to silently ignore (Codex QE gap 7).
+    if (options.has('_positional_0')) {
+        write(json ? JSON.stringify({ error: `unexpected argument "${options.get('_positional_0')}"`, exitCode: 1 }) : `dz parity: unexpected argument "${options.get('_positional_0')}"\n  allowed: --target <name>, --json`);
+        return 1;
+    }
+    for (const flag of flags) {
+        if (!allowedFlags.has(flag)) {
+            write(json ? JSON.stringify({ error: `unknown option --${flag}`, exitCode: 1 }) : `dz parity: unknown option --${flag}\n  allowed: --target <name>, --json`);
+            return 1;
+        }
+    }
+    for (const key of options.keys()) {
+        if (key.startsWith('_positional_'))
+            continue;
+        if (!allowedOptions.has(key)) {
+            write(json ? JSON.stringify({ error: `unknown option --${key}`, exitCode: 1 }) : `dz parity: unknown option --${key}\n  allowed: --target <name>, --json`);
+            return 1;
+        }
+    }
+    const matrix = buildParityMatrix();
+    const target = options.get('target');
+    if (target !== undefined && !TARGET_NAMES.includes(target)) {
+        if (json)
+            write(JSON.stringify({ error: `unknown target "${target}"`, targets: TARGET_NAMES, exitCode: 1 }, null, 2));
+        else
+            write(`dz parity: unknown target "${target}" — one of: ${TARGET_NAMES.join(', ')}`);
+        return 1;
+    }
+    if (json) {
+        const rows = matrix.map((r) => ({
+            id: r.feature.id,
+            title: r.feature.title,
+            cells: target !== undefined ? { [target]: r.cells[target] } : r.cells,
+        }));
+        // A filtered response stays internally consistent: capabilities are filtered too (Codex QE gap 9).
+        const caps = target !== undefined ? { [target]: TARGET_CAPABILITIES[target] } : TARGET_CAPABILITIES;
+        write(JSON.stringify({ targets: target !== undefined ? [target] : TARGET_NAMES, capabilities: caps, features: rows }, null, 2));
+        return 0;
+    }
+    if (target !== undefined) {
+        const t = target;
+        write(`\ndz parity — ${t}  (capabilities: ${TARGET_CAPABILITIES[t].join(', ')})\n`);
+        for (const r of matrix) {
+            const c = r.cells[t];
+            const icon = c.level === 'full' ? '✓' : c.level === 'manual' ? '◐' : '—';
+            write(`  ${icon} ${r.feature.title.padEnd(58)} ${c.level === 'none' ? 'not available on this target' : `via ${c.via ?? ''}`}`);
+        }
+        write('\n  ✓ full (the complete experience)   ◐ manual (works, you drive it by hand)   — not available');
+        return 0;
+    }
+    // Grid: one column per target, short header, one row per feature. Computed, never hand-written;
+    // the labels live NEXT TO the model (a local map here would be a second, unchecked registry).
+    const short = TARGET_SHORT_LABELS;
+    write('\ndz parity — feature × target (computed from the model; dz parity --target <name> for detail)\n');
+    write(`  ${'feature'.padEnd(52)} ${TARGET_NAMES.map((t) => (short[t] ?? t).padStart(4)).join('')}`);
+    for (const r of matrix) {
+        const cells = TARGET_NAMES.map((t) => {
+            const c = r.cells[t];
+            return (c.level === 'full' ? '✓' : c.level === 'manual' ? '◐' : '—').padStart(4);
+        }).join('');
+        write(`  ${r.feature.title.slice(0, 52).padEnd(52)} ${cells}`);
+    }
+    write('\n  ✓ full   ◐ manual (available, driven by hand)   — not available');
+    write(`  columns: ${TARGET_NAMES.map((t) => `${short[t] ?? t}=${t}`).join('  ')}`);
+    return 0;
+}
+/* ------------------------------------------------------------------ */
 /*  dz release — verified-release conveyor (feature release-verified,  */
 /*  ADR-001): 4 HARD gates in FRONT of the untouched dz publish.       */
 /* ------------------------------------------------------------------ */
@@ -4240,6 +4320,19 @@ function gatherReadmeCounts(root) {
         pairs.push({ label: 'commands (root CJM header vs cli All Commands)', a: cjm, b: cliAll });
     if (rootAll !== null && cliAll !== null)
         pairs.push({ label: 'All Commands (root vs cli)', a: rootAll, b: cliAll });
+    // sitedoc in the readme-first contour (feature sitedoc-readme-first, ADR-001 + Codex QE AM-3/AM-4):
+    // the docs SITE carries the same command count as the cli README. A MISSING file skips its pair
+    // (target repo without sitedoc — missing-evidence contract). But a file that EXISTS and no longer
+    // matches its anchored pattern emits a MISMATCH pair (a: -1) — silent non-extraction is the exact
+    // disease this contour cures (AM-1 applies to the guard path too, not only the CI test).
+    const sitePair = (rel, re, label) => {
+        if (cliAll === null || !existsSync(join(root, rel)))
+            return;
+        const found = num(read(rel), re);
+        pairs.push({ label, a: found ?? -1, b: cliAll });
+    };
+    sitePair('packages/@dzhechkov/sitedoc/src/content/docs/cli/overview.md', /^description: All (\d+) dz commands/m, 'commands (docs-site CLI overview description vs cli All Commands)');
+    sitePair('packages/@dzhechkov/sitedoc/src/content/docs/index.mdx', /^\s*tagline: "[^"]*?(\d+) commands/m, 'commands (docs-site index hero tagline vs cli All Commands)');
     return pairs;
 }
 /** Gather the facts one op needs. All I/O is best-effort — a missing signal skips its rule, never crashes. */
@@ -5492,6 +5585,8 @@ export async function runCli(argv, io = {}) {
                 return cmdPublish(options, flags, cwd, write);
             case 'release':
                 return cmdRelease(options, flags, cwd, write, io.releaseRunner);
+            case 'parity':
+                return cmdParity(options, flags, write);
             case 'registry':
                 return cmdRegistry(options, cwd, write);
             case 'benchmark':