@dzhechkov/harness-core 0.6.1 → 0.7.2

package/src/agentdb-index.ts

@@ -173,7 +173,14 @@ export async function indexPatternsToAgentdb(
  * The RECALL/search default task_types. Deliberately EXCLUDES `dz-backlog`: `dz recall` (and
  * feature-adr Step-0) must never surface raw backlog ideas as if they were earned lessons (ADR-005).
  */
-const DZ_TASK_TYPES = ['dz-teach', 'dz-learning'] as const;
+/**
+ * The PATTERN scope — the task types a learned-pattern count covers. Exported so `dz vector status`
+ * can report a mirrored count comparable to its lexical one; the lifecycle superset below is for
+ * ownership, and reporting IT beside a pattern count once led a reader to conclude half the index
+ * was orphaned when none of it was.
+ */
+export const DZ_PATTERN_TASK_TYPES = ['dz-teach', 'dz-learning'] as const;
+const DZ_TASK_TYPES = DZ_PATTERN_TASK_TYPES;
 
 /**
  * The dz-owned task_types for LIFECYCLE scans (id enumeration + reindex ownership) — a SUPERSET of

package/src/guard.ts

@@ -73,6 +73,28 @@ export interface GuardFacts {
   readonly skillPacks?: readonly { readonly name: string; readonly nonRegistrable: readonly string[] }[];
   /** for readme-first: per publishable package, is a version bump staged without a README change? */
   readonly readmeFirst?: readonly { readonly name: string; readonly versionBumped: boolean; readonly readmeChanged: boolean }[];
+  /**
+   * for review-round: per publishable package, does this change bump a version AND touch SOURCE, and
+   * did it bring a GRADED QE report with it? `undefined` (the whole fact absent) means the tree could
+   * not be read — the rule then reports nothing, which is different from reporting "no review".
+   */
+  readonly reviewRound?: {
+    readonly packages: readonly { readonly name: string; readonly versionBumped: boolean; readonly sourceChanged: boolean }[];
+    /** grades parsed out of `features/*∕08_qe_report.md` files in this change set, in file order. */
+    readonly grades: readonly { readonly report: string; readonly grade: string }[];
+    /**
+     * Optional floor from `.dz/guard.json` → `reviewRound.minGrade`. Carried in the FACT because a
+     * rule body is a pure function of facts and takes no config — and because the owner reserved the
+     * choice of threshold, so the DEFAULT must stay "a grade is present".
+     */
+    readonly minGrade?: string | undefined;
+    /**
+     * `false` when the gatherer TRIED and could not read the tree. The note below fires only on
+     * that, never on a caller that simply never gathered — otherwise every synthetic evaluation
+     * carries a warning about evidence nobody asked for.
+     */
+    readonly gathered?: boolean | undefined;
+  };
   /**
    * for agents-md-policy-sync: result of the pure policy drift detector, gathered by the CLI.
    * `applicable:false` is a repo whose canonical policy sources are unreadable; omission means the
@@ -246,6 +268,7 @@ export const DEFAULT_RULES: readonly GuardRule[] = [
   // Description ASSEMBLED from STUB_MARKERS so guard.ts itself stays clean under the scan it defines
   // (structural self-exemption — tested in no-stubs.test.ts).
   { id: 'no-stubs', severity: 'soft', ops: ['publish'], description: `an unfinished-stub marker (${STUB_MARKERS.join('/')} / "${STUB_PHRASES.join('", "')}") left in a CHANGED file — any unwaived match means the change ships incomplete; waive per line with "no-stubs: <reason>" or per path in .dz/guard.json stubWaivers (reason MANDATORY)` },
+  { id: 'review-round', severity: 'hard', ops: ['publish'], description: 'a package publishing CHANGED SOURCE must bring a GRADED features/*/08_qe_report.md in the same change. Scoped to source so a docs-only republish is never blocked; the floor is PRESENCE of a grade unless .dz/guard.json sets reviewRound.minGrade. It proves a graded report EXISTS for this change — NOT that the review was independent, competent, or taken against this exact revision' },
   { id: 'licence-hold', severity: 'hard', ops: ['publish'], description: 'a pack that declares a licence hold (package.json.licenseHold — ADR-001 hermes-claude-adaptation) must not become publishable until the hold is satisfied: LICENSE present without the PENDING grant placeholder, a Grant-Confirmation URL, non-empty THIRD_PARTY_NOTICES, and a clean SPDX license field' },
 ];
 
@@ -337,6 +360,50 @@ const CHECKERS: Record<string, (f: GuardFacts, sev: GuardSeverity) => Violation[
     }
     return out;
   },
+  'review-round': (f, sev) => {
+    // The publish gate had eleven rules and not one asked whether anyone but the author had read the
+    // code. MEASURED cost (health-advisor slice H): five rounds graded F, thirteen packages published
+    // on the author's own verification, and round six found six defects in ALREADY-PUBLISHED code.
+    //
+    // Scoped to CHANGED SOURCE on purpose (ADR-001): a HARD rule that also fired on a docs-only
+    // republish would be a rule someone switches off. `undefined` facts mean the tree could not be
+    // read — silence, not an accusation.
+    const rr = f.reviewRound;
+    if (rr === undefined) return [];
+    const min = typeof rr.minGrade === 'string' ? rr.minGrade.trim().toUpperCase() : undefined;
+    // The grade must BE a letter, not merely START with one: keyed on the first character alone,
+    // "approved" reads as an A and "broken" as a B (found by cross-family review). The fact gatherer
+    // already extracts a bounded letter, so this is defence in depth — and a pure function has no
+    // business being looser than its caller.
+    const rank = (g: string): number => {
+      const t = String(g ?? '').trim().toUpperCase();
+      return t.length === 1 ? 'ABCDF'.indexOf(t) : -1;
+    };
+    const graded = rr.grades.filter((g) => rank(g.grade) >= 0);
+    const out: Violation[] = [];
+    for (const p of rr.packages) {
+      if (!(p.versionBumped === true && p.sourceChanged === true)) continue;
+      if (graded.length === 0) {
+        out.push({
+          rule: 'review-round',
+          severity: sev,
+          detail: `${p.name}: source changed and the version is bumped, but this change brings no GRADED features/*/08_qe_report.md — a publish gate that cannot tell "reviewed" from "not reviewed" treats them alike. (This proves a graded report EXISTS in this change; it does NOT prove the review was independent, was competent, covered THIS package, or was taken against this revision.)`,
+        });
+        continue;
+      }
+      if (min !== undefined && rank(min) >= 0) {
+        const best = graded.reduce((a, b) => (rank(a.grade) <= rank(b.grade) ? a : b));
+        if (rank(best.grade) > rank(min)) {
+          out.push({
+            rule: 'review-round',
+            severity: sev,
+            detail: `${p.name}: the best review grade in this change is ${best.grade.trim()} (${best.report}), below the configured floor ${min} — .dz/guard.json reviewRound.minGrade`,
+          });
+        }
+      }
+    }
+    return out;
+  },
   'agents-md-policy-sync': (f, _sev) => {
     const fact = f.policyDrift;
     if (!fact || fact.applicable !== true || !Array.isArray(fact.drifted)) return [];
@@ -557,6 +624,13 @@ export function evaluateGuard(facts: GuardFacts, rules: readonly GuardRule[] = D
       notes.push(`no-stubs: ${skipped} changed scannable file(s) not scanned (deleted/oversize/unreadable/beyond the file cap) — the stub scan is fail-open, so this is a coverage gap on the record, not a violation`);
     }
   }
+  if (checked.includes('review-round') && facts.reviewRound?.gathered === false) {
+    // A HARD gate that passes SILENTLY when it could not gather its evidence is a gate you cannot
+    // tell from one that checked and approved (raised by cross-family review). It still does not
+    // BLOCK — absence of facts is ignorance, not an accusation, and blocking every non-git checkout
+    // would make the rule unusable — but the ignorance goes on the record.
+    notes.push('review-round: the working-tree change could not be read, so NO review evidence was gathered — this run neither confirms nor denies that the code was reviewed');
+  }
   if (checked.includes('agents-md-policy-sync')) {
     // A repo that never opted in (no `dz:policies` fence in AGENTS.md) is OUT OF SCOPE, not
     // inconclusive — noting it on every run would put a permanent line in a channel that exists to

package/src/index.ts

@@ -78,7 +78,7 @@ export type { SyncUpstreamReport, UpstreamCheckResult, SourcesManifest, SourcePa
 export { sweepSkillDrift, syncCanonicalSkill } from './skill-drift.js';
 export type { SweepResult, DriftedSkill, SyncResult, SyncCanonicalOptions } from './skill-drift.js';
 export { benchmarkSkill, benchmarkSkills, compareSkills } from './benchmark.js';
-export { buildRegistry, searchRegistry, filterByCategory, skillPackBaseDirs, discoverSkillPackDirs } from './registry.js';
+export { buildRegistry, searchRegistry, filterByCategory, skillPackBaseDirs, discoverSkillPackDirs, discoverVerifiablePackDirs } from './registry.js';
 // Package skill-layout resolution (feature dz-install-npx-init) — the ONE seam that knows where an
 // npm package keeps its skills (flat / templates/.claude/skills / skills). `cmdInstall` calls it;
 // `dz init`/`dz registry` are the filed follow-up consumers.
@@ -262,6 +262,8 @@ export {
   decideReadBack,
   recordVerdictLine,
 } from './run-records.js';
+export { decidePublishSigning, decidePostSigningVerification, decideSignableSet, publishSigningLine, signableSetLine } from './publish-signing.js';
+export type { PublishSigningVerdict, PublishSigningDecision, SignableSetDecision } from './publish-signing.js';
 export type { RecordKind, RecordVerdict, RecordDecision } from './run-records.js';
 export type { AmendmentRow, AmendmentVerdict, AmendmentResolution, AmendmentOutcome, AmendmentDecision, PlanCoverageGap } from './amendment-trace.js';
 export {

package/src/publish-signing.ts

@@ -0,0 +1,217 @@
+/**
+ * Whether `dz publish` must re-sign a pack before packing it (feature `sign-after-bump`).
+ *
+ * `dz publish` never signed. It BUMPS the version and REWRITES the README, while
+ * `.dz-manifest.json` stays whatever an operator signed by hand at some earlier moment — so
+ * publish's own mutations invalidate it and the tarball ships an inventory that disagrees with its
+ * contents on at least `package.json` and `README.md`. MEASURED 2026-08-18 on a live published
+ * package: a recipient running `dz doctor --require-signing` sees TAMPERED.
+ *
+ * It became urgent on 2026-08-21, when the packaged trust root was restored. Until then a consumer's
+ * verifier reported `trust root: none` and checked nothing, so stale signatures were invisible. From
+ * the next release onward the verifier WORKS — and without this it greets every user with a false
+ * alarm indistinguishable from a real compromise.
+ *
+ * Pure: facts in, verdict out. The caller owns the filesystem and the key.
+ */
+
+export type PublishSigningVerdict =
+  /** the pack is signed and the key is usable — re-sign after the bump, before packing */
+  | 're-sign'
+  /** the pack carries no manifest: it was never signed, and publish must not grant it a signature */
+  | 'skip-unsigned-pack'
+  /** dry run: sign nothing, write nothing */
+  | 'skip-dry-run'
+  /** --bump-only: no tarball is produced, so no signature can reach anyone */
+  | 'skip-bump-only'
+  /** re-signed, but the result does not verify against the trust root — publish must STOP */
+  | 'refuse-unverified-after-signing'
+  /** the pack is signed but no usable key is present — publishing would ship a stale inventory */
+  | 'refuse-no-key'
+  /** the key lives inside the repository working tree */
+  | 'refuse-key-inside-tree';
+
+export interface PublishSigningDecision {
+  readonly verdict: PublishSigningVerdict;
+  /** True for every refusal — pre-sign and post-sign alike: publish must STOP rather than ship a stale or unverifiable manifest. */
+  readonly blocking: boolean;
+  readonly reason: string;
+}
+
+const ok = (verdict: PublishSigningVerdict, reason: string): PublishSigningDecision => ({ verdict, blocking: false, reason });
+const stop = (verdict: PublishSigningVerdict, reason: string): PublishSigningDecision => ({ verdict, blocking: true, reason });
+
+export function decidePublishSigning(input: {
+  /** Does the pack already carry a `.dz-manifest.json`? */
+  packHasManifest: boolean;
+  /** The resolved key path, or null when none was supplied or found. */
+  keyPath: string | null;
+  keyExists: boolean;
+  /**
+   * True when the resolved key path is inside the repository working tree. The CALLER must resolve
+   * symlinks before computing this — a pure function cannot canonicalise a path, and a link pointing
+   * into the tree would otherwise pass (cross-family review, 2026-08-21).
+   */
+  keyInsideTree: boolean;
+  dryRun: boolean;
+  /** `--bump-only` produces no tarball, so nothing signed or unsigned can reach a consumer. */
+  bumpOnly?: boolean;
+}): PublishSigningDecision {
+  // A6 — the default path must stay inert. Checked FIRST: a dry run must not refuse either, or it
+  // would report a failure for a publish that was never going to happen.
+  if (input.dryRun) return ok('skip-dry-run', 'dry run — nothing is signed and nothing is written');
+
+  // No tarball, no recipient: refusing here would block a bump for a signature nobody will receive.
+  if (input.bumpOnly === true) return ok('skip-bump-only', '--bump-only — no tarball is produced, so no signature can reach anyone');
+
+  // A5 — a pack that was never signed must not silently acquire a signature. Signing is a claim about
+  // provenance, and publish is not the place to start making one nobody asked for.
+  if (!input.packHasManifest) {
+    return ok('skip-unsigned-pack', 'this pack carries no .dz-manifest.json — it was never signed, and publish does not start signing it now');
+  }
+
+  // A3 — a private key inside the tree is one `git add` away from being published. Refuse before any
+  // read of it: the check is about the PATH, not about what the file contains.
+  if (input.keyInsideTree) {
+    return stop('refuse-key-inside-tree', 'the signing key resolves to a path INSIDE the repository — a leaked signing key is not revertible');
+  }
+
+  // A2 — the pack is signed, so a consumer WILL verify it. Publishing now ships an inventory the
+  // bump has already invalidated, and under a working trust root that reads as TAMPERED. Refusing is
+  // the smaller harm, and the message names the remedy.
+  if (input.keyPath === null || !input.keyExists) {
+    return stop(
+      'refuse-no-key',
+      'this pack is signed but no signing key is available, so publishing would ship a manifest the version bump already invalidated — pass --sign-key <path outside the repo>, or unsign the pack deliberately',
+    );
+  }
+
+  return ok('re-sign', 'signed pack with a usable key — re-sign after the bump and README sync, before packing');
+}
+
+/** The one line a caller prints, in the shape the other gates use. */
+export function publishSigningLine(pack: string, d: PublishSigningDecision): string {
+  return `publish signing (${pack}): ${d.verdict.toUpperCase()} — ${d.reason}`;
+}
+
+
+/**
+ * The verdict AFTER re-signing, and the reason this feature does not try to enumerate pre-conditions.
+ *
+ * Cross-family review (2026-08-21) showed the pre-flight checks could not be made sufficient: a key
+ * that EXISTS may be the WRONG key, an unreadable file, a public key, or the wrong algorithm — and any
+ * of those produces a pack that a consumer's trust root rejects, which is the exact harm this feature
+ * exists to prevent, recreated by the fix. Enumerating those states is a losing game.
+ *
+ * So the guard is the OUTCOME: after re-signing, verify the pack against the trust root the CONSUMER
+ * will use. A pack that does not verify must not be published, whatever the reason. This is
+ * measure-don't-assume applied to our own repair.
+ */
+export function decidePostSigningVerification(input: {
+  /** Did `verifyManifest(pack, manifest, trustRootPem)` return ok? */
+  verifiesAgainstTrustRoot: boolean;
+  /** False when no trust root is available to verify against at all. */
+  trustRootPresent: boolean;
+  /** The pack the caller intended to verify. */
+  pack?: string;
+  /** The pack the verification actually ran against. A mismatch is a refusal, not a pass. */
+  verifiedPack?: string;
+}): PublishSigningDecision {
+  // Cross-family review, round 2: this function took two bare booleans, so a caller could assert a
+  // PASS obtained from a different pack (or a different trust root) and get a non-blocking verdict.
+  // Binding the claim to its subject is the cheapest half of that fix; the whole fix is verifying the
+  // TARBALL rather than the source tree, which is filed as the next step.
+  if (input.pack !== undefined && input.verifiedPack !== undefined && input.pack !== input.verifiedPack) {
+    return stop(
+      'refuse-unverified-after-signing',
+      `the verification ran against \`${input.verifiedPack}\` but the pack being published is \`${input.pack}\` — a pass about another artifact is not a pass`,
+    );
+  }
+  if (!input.trustRootPresent) {
+    // Not established is not a pass: we cannot claim the signature is good, and we must not pretend.
+    return stop(
+      'refuse-unverified-after-signing',
+      'the pack was re-signed but there is no trust root to verify the result against — publishing would ship a signature nobody here could check',
+    );
+  }
+  if (!input.verifiesAgainstTrustRoot) {
+    return stop(
+      'refuse-unverified-after-signing',
+      'the pack was re-signed but does not verify against the trust root — most likely the WRONG signing key; publishing it would hand every consumer a TAMPERED verdict',
+    );
+  }
+  return ok('re-sign', 're-signed and verified against the trust root the consumer will use');
+}
+
+/**
+ * Which files a pack's manifest must cover — the ones the CONSUMER receives, not the ones the author
+ * happens to have on disk.
+ *
+ * MEASURED 2026-08-21 by a live install of the published `harness-cli@0.6.1`: with the trust root
+ * restored, six packs reported TAMPERED. Two causes, and only one of them was the version bump.
+ * The other: `skills-devops` signs 127 files including `CHANGELOG.md` and a test file, while its
+ * `files[]` ships neither — so the recipient's verifier reports "listed in the manifest but absent",
+ * permanently, no matter when we sign. A manifest that describes the author's disk instead of the
+ * artifact is a signature over the wrong thing.
+ *
+ * The reverse direction matters more and was never checked at all: a file that SHIPS but is not in
+ * the manifest is an UNSIGNED file inside a signed pack, and nothing would have said so.
+ */
+export interface SignableSetDecision {
+  /** The files to sign: present on disk AND in the published tarball. */
+  readonly sign: readonly string[];
+  /** On disk, signed today, but never shipped — the cause of "listed in the manifest but absent". */
+  readonly droppedNotPublished: readonly string[];
+  /** SHIPPED but not signable — an unsigned file inside a signed pack. Reported LOUDLY. */
+  readonly publishedButUnsigned: readonly string[];
+}
+
+/** A packed inventory we refuse to reason about at all — the caller must fix the probe, not proceed. */
+export class UnusableInventoryError extends Error {}
+
+/**
+ * Reject an inventory before it can be trusted. Every state here was fail-open until cross-family
+ * review named them (2026-08-21): an EMPTY list read as "nothing ships" and silently signed nothing,
+ * duplicates were erased by Set construction, and `./x`, `../outside`, `/abs` were compared literally
+ * so a traversal path could match on both sides and pass.
+ */
+function assertUsableInventory(packed: readonly string[]): void {
+  if (packed.length === 0) {
+    throw new UnusableInventoryError('the packed inventory is EMPTY — a failed or truncated probe is not the same as a pack that ships nothing');
+  }
+  const seen = new Set<string>();
+  for (const p of packed) {
+    if (p !== p.trim() || p === '') throw new UnusableInventoryError(`packed path is blank or padded: ${JSON.stringify(p)}`);
+    if (p.startsWith('/') || /^[A-Za-z]:/.test(p)) throw new UnusableInventoryError(`packed path is absolute: ${p}`);
+    if (p.startsWith('./') || p.includes('../') || p.includes('\\')) throw new UnusableInventoryError(`packed path is not a normal POSIX relative path: ${p}`);
+    const key = p.toLowerCase();
+    if (seen.has(key)) throw new UnusableInventoryError(`packed inventory contains a duplicate or case-collision: ${p}`);
+    seen.add(key);
+  }
+}
+
+export function decideSignableSet(input: {
+  /** What the signable walk found on disk (manifest and SBOM already excluded). */
+  signable: readonly string[];
+  /** What `npm pack` says the tarball will contain, `package/`-prefix already stripped. */
+  packed: readonly string[];
+  /** Names the manifest never covers because they are written after signing. */
+  selfNames?: readonly string[];
+}): SignableSetDecision {
+  assertUsableInventory(input.packed);
+  const self = new Set(input.selfNames ?? ['.dz-manifest.json', 'sbom.json']);
+  const packedSet = new Set(input.packed.filter((p) => !self.has(p)));
+  const signableSet = new Set(input.signable.filter((p) => !self.has(p)));
+  const sign = [...signableSet].filter((p) => packedSet.has(p)).sort();
+  const droppedNotPublished = [...signableSet].filter((p) => !packedSet.has(p)).sort();
+  const publishedButUnsigned = [...packedSet].filter((p) => !signableSet.has(p)).sort();
+  return { sign, droppedNotPublished, publishedButUnsigned };
+}
+
+/** One line naming both asymmetries, because a count alone tells an author nothing to act on. */
+export function signableSetLine(pack: string, d: SignableSetDecision): string {
+  const parts = [`${d.sign.length} signed`];
+  if (d.droppedNotPublished.length > 0) parts.push(`${d.droppedNotPublished.length} on disk but never shipped (${d.droppedNotPublished.slice(0, 3).join(', ')})`);
+  if (d.publishedButUnsigned.length > 0) parts.push(`${d.publishedButUnsigned.length} SHIPPED BUT UNSIGNED (${d.publishedButUnsigned.slice(0, 3).join(', ')})`);
+  return `signable set (${pack}): ${parts.join(' · ')}`;
+}

package/src/publish.ts

@@ -6,6 +6,9 @@
  */
 
 import { existsSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';
+import { join as pathJoin, relative as pathRelative, resolve as pathResolve } from 'node:path';
+
+import { decidePublishSigning, decidePostSigningVerification } from './publish-signing.js';
 import { join } from 'node:path';
 import { execSync } from 'node:child_process';
 
@@ -35,6 +38,12 @@ export interface PublishReport {
   readonly dryRun: boolean;
 }
 
+/** Is `p` inside `dir`? Used to refuse a signing key that lives in the repository working tree. */
+function isInsideDir(p: string, dir: string): boolean {
+  const rel = pathRelative(pathResolve(dir), pathResolve(p));
+  return rel !== '' && !rel.startsWith('..') && !pathResolve(p).startsWith('..');
+}
+
 /** Bump patch version: 0.3.11 → 0.3.12 */
 export function bumpPatch(version: string): string {
   // Parse the core x.y.z, tolerating a 2-part "x.y" (treated as x.y.0) and a
@@ -100,7 +109,9 @@ export function formatPublishError(err: unknown): string {
 // ── npm provenance (ADR-001, publish-provenance) ────────────────────────────
 //
 // Provenance is minted from a GitHub OIDC token during the publish job. There is no private key for us
-// to hold, leak, or rotate — which is why it supersedes the Ed25519 signing key we never generated.
+// to hold, leak, or rotate. It COMPLEMENTS the Ed25519 pack signature rather than superseding it: the
+// key was generated on 2026-07-19 and the packs carry `.dz-manifest.json`, which is why publish must
+// re-sign after its own bump (feature `sign-after-bump`).
 // It can only be produced where a token can be minted, so the DECISION belongs to the environment, and
 // the decision is a pure function whose output is the exact argv a test can assert.
 
@@ -293,6 +304,23 @@ export function publishPackages(
     dryRun?: boolean | undefined;
     filter?: string[] | undefined;
     bumpOnly?: boolean | undefined;
+    /**
+     * Path to the Ed25519 signing key, OUTSIDE the repository. A pack that carries a
+     * `.dz-manifest.json` must be re-signed after publish's own bump and README sync, or the tarball
+     * ships an inventory it already invalidated. Absent + a signed pack ⇒ publish REFUSES that pack.
+     */
+    signKey?: string | undefined;
+    /**
+     * How to actually re-sign. Injected rather than imported so this module stays free of the CLI's
+     * manifest writer, and so a test can observe the call without touching a real key.
+     */
+    reSign?: ((packDir: string, keyPath: string) => void) | undefined;
+    /**
+     * Verify the pack against the trust root a CONSUMER would use, after re-signing. Injected for the
+     * same reason as `reSign`: this module stays free of the verifier, and a test can drive both
+     * outcomes without a real key.
+     */
+    verifyAfterSign?: ((packDir: string) => { ok: boolean; trustRootPresent: boolean; pack?: string }) | undefined;
     /**
      * Pre-publish claim-check gate over each package's README (ADR-001). Default `'warn'`:
      * records the finding count on the result but NEVER changes publish status — additive, so the
@@ -401,6 +429,79 @@ export function publishPackages(
         execSync('pnpm build', { cwd: pkg.dir, stdio: 'pipe', encoding: 'utf-8' });
       }
 
+      // Re-sign AFTER the bump, the README sync and the build, and BEFORE the tarball is built.
+      // publish MUTATES the pack — a signature taken at any earlier moment describes files that no
+      // longer exist, and the tarball then ships an inventory that disagrees with its own contents.
+      // MEASURED 2026-08-18 on a live published package: a recipient running `dz doctor
+      // --require-signing` sees TAMPERED. Harmless while consumers had no trust root; from the
+      // release that restores it, a false alarm indistinguishable from a real compromise.
+      const signing = decidePublishSigning({
+        packHasManifest: existsSync(pathJoin(pkg.dir, '.dz-manifest.json')),
+        keyPath: opts.signKey ?? null,
+        keyExists: opts.signKey !== undefined && existsSync(opts.signKey),
+        keyInsideTree: opts.signKey !== undefined && isInsideDir(opts.signKey, monorepoRoot),
+        dryRun: opts.dryRun ?? false,
+        bumpOnly: opts.bumpOnly ?? false,
+      });
+      if (signing.blocking) {
+        results.push({ name: pkg.name, oldVersion, newVersion, status: 'error', error: signing.reason, claimCheck: claimCheckSummary });
+        try { writeFileSync(pkgJsonPath, originalPkgJson); } catch { /* best-effort restore */ }
+        if (originalReadme !== undefined) {
+          try { writeFileSync(pathJoin(pkg.dir, 'README.md'), originalReadme); } catch { /* best-effort restore */ }
+        }
+        continue;
+      }
+      if (signing.verdict === 're-sign') {
+        // Re-sign, then VERIFY THE OUTCOME against the trust root the consumer will use. Enumerating
+        // pre-conditions (key present? outside the tree?) cannot be made sufficient — an existing key
+        // may be the WRONG key, unreadable, a public key, or the wrong algorithm, and each of those
+        // ships a pack the consumer rejects, recreating the very harm this fixes (cross-family review,
+        // 2026-08-21). Measure the result instead.
+        let verified = false;
+        let trustRootPresent = false;
+        let verifiedPack: string | undefined;
+        // Snapshot the manifest and SBOM: if the post-sign verification refuses, the tree must not be
+        // left holding a signature we just decided not to stand behind (round-2 review, finding 7).
+        const manifestPath = pathJoin(pkg.dir, '.dz-manifest.json');
+        const sbomPath = pathJoin(pkg.dir, 'sbom.json');
+        const priorManifest = existsSync(manifestPath) ? readFileSync(manifestPath, 'utf-8') : null;
+        const priorSbom = existsSync(sbomPath) ? readFileSync(sbomPath, 'utf-8') : null;
+        const restoreSignature = (): void => {
+          try { if (priorManifest !== null) writeFileSync(manifestPath, priorManifest); } catch { /* best-effort */ }
+          try { if (priorSbom !== null) writeFileSync(sbomPath, priorSbom); } catch { /* best-effort */ }
+        };
+        try {
+          opts.reSign?.(pkg.dir, opts.signKey as string);
+          const check = opts.verifyAfterSign?.(pkg.dir);
+          trustRootPresent = check?.trustRootPresent ?? false;
+          verified = check?.ok ?? false;
+          verifiedPack = check?.pack;
+        } catch (err) {
+          restoreSignature();
+          results.push({ name: pkg.name, oldVersion, newVersion, status: 'error', error: `re-signing failed: ${(err as Error).message}`, claimCheck: claimCheckSummary });
+          try { writeFileSync(pkgJsonPath, originalPkgJson); } catch { /* best-effort restore */ }
+          if (originalReadme !== undefined) {
+            try { writeFileSync(pathJoin(pkg.dir, 'README.md'), originalReadme); } catch { /* best-effort restore */ }
+          }
+          continue;
+        }
+        const after = decidePostSigningVerification({
+          verifiesAgainstTrustRoot: verified,
+          trustRootPresent,
+          pack: pkg.name,
+          ...(verifiedPack === undefined ? {} : { verifiedPack }),
+        });
+        if (after.blocking) {
+          restoreSignature();
+          results.push({ name: pkg.name, oldVersion, newVersion, status: 'error', error: after.reason, claimCheck: claimCheckSummary });
+          try { writeFileSync(pkgJsonPath, originalPkgJson); } catch { /* best-effort restore */ }
+          if (originalReadme !== undefined) {
+            try { writeFileSync(pathJoin(pkg.dir, 'README.md'), originalReadme); } catch { /* best-effort restore */ }
+          }
+          continue;
+        }
+      }
+
       // Publish
       execSync(publishCmd, {
         cwd: pkg.dir,

package/src/registry.ts

@@ -7,7 +7,7 @@
  * @packageDocumentation
  */
 
-import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, realpathSync, statSync, type Dirent } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -98,6 +98,89 @@ export function discoverSkillPackDirs(cwd: string): { pack: string; dir: string
   return out;
 }
 
+/**
+ * Every pack whose SIGNATURE should be checked: the skill packs above, PLUS any directory in the same
+ * base dirs that carries a `.dz-manifest.json`, whatever it is called.
+ *
+ * A separate function on purpose (ADR-001). `discoverSkillPackDirs` answers "which skill packs are
+ * here?" and the `skills-` prefix is a roughly correct answer to THAT. Signature verification asks a
+ * different question, and there the prefix is simply wrong: MEASURED 2026-08-21 — 52 signed packs on
+ * disk, 26 in the verdict, exactly half invisible, including `keysarium`, `health-advisor`,
+ * `harness-core`, `harness-cli` and all ten adapters. `keysarium` drifted from its own signature that
+ * same day and the tool said nothing; it was found by a hand-written hash comparison.
+ *
+ * The UNION rather than a replacement: enumerating only manifest-bearing directories would silently
+ * drop the `unsigned` verdict for a `skills-*` pack that carries no manifest — turning "unsigned" into
+ * "absent", which is the same class of silence this fixes.
+ */
+export function discoverVerifiablePackDirs(cwd: string): { pack: string; dir: string }[] {
+  const out: { pack: string; dir: string }[] = [];
+  // Keyed on the RESOLVED path: a globally-installed `dz` reaches its own bundled packs as well as the
+  // project's, and one directory counted twice inflates exactly the coverage number this exists to
+  // make honest.
+  const seen = new Set<string>();
+  const add = (pack: string, dir: string): void => {
+    // realpath, not resolve: pnpm links workspace packages into `node_modules` as SYMLINKS, so the
+    // SAME pack is reachable under several paths. MEASURED 2026-08-21 — 78 entries over 52 real
+    // directories, fourteen of them counted three times. `resolve` normalises a path; only `realpath`
+    // answers "is this the same directory".
+    let key: string;
+    try {
+      key = realpathSync(dir);
+    } catch {
+      key = resolve(dir);
+    }
+    if (seen.has(key)) return;
+    seen.add(key);
+    // Return the RESOLVED path. A symlink is a name, not an object: reporting the link would make the
+    // verdict describe something a later swap can redirect, and would leave two names for one pack
+    // depending on which was seen first (cross-family review, 2026-08-21).
+    out.push({ pack, dir: key });
+  };
+  // An unreadable base must not abort the enumeration: the skill-pack scan does not catch its own
+  // readdir, so without this a single permission error hides EVERY pack — a silence far worse than the
+  // one this function was written to remove.
+  try {
+    for (const p of discoverSkillPackDirs(cwd)) add(p.pack, p.dir);
+  } catch {
+    /* fall through to the manifest scan, which catches per-base */
+  }
+  for (const base of skillPackBaseDirs(cwd)) {
+    let entries: Dirent[];
+    try {
+      entries = readdirSync(base, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const e of entries) {
+      const dir = join(base, e.name);
+      const isDir =
+        e.isDirectory() ||
+        (e.isSymbolicLink() &&
+          (() => {
+            try {
+              return statSync(dir).isDirectory();
+            } catch {
+              return false;
+            }
+          })());
+      if (!isDir) continue;
+      // Presence of the manifest is the whole test — an unexpected one is a FACT to be judged, not
+      // noise to be filtered by name. But it must be a FILE: `existsSync` is true for a DIRECTORY
+      // named `.dz-manifest.json`, which would let any directory declare its parent verifiable
+      // (cross-family review, 2026-08-21).
+      let hasManifest = false;
+      try {
+        hasManifest = statSync(join(dir, '.dz-manifest.json')).isFile();
+      } catch {
+        hasManifest = false;
+      }
+      if (hasManifest) add(e.name, dir);
+    }
+  }
+  return out;
+}
+
 /** A single skill in the registry. */
 export interface RegistryEntry {
   readonly id: string;