@dzhechkov/harness-core 0.7.4 → 0.7.6

package/src/agentdb-index.ts

@@ -110,7 +110,19 @@ export async function indexPatternsToAgentdb(
     };
     const model = resolveEmbedModel(projectRoot);
     if ('error' in model) return { indexed: 0, error: model.error };
-    const emb = new EmbeddingService({ model: model.model, dimension: model.dim, provider: 'transformers' });
+    const emb = new EmbeddingService({
+      model: model.model,
+      dimension: model.dim,
+      provider: 'transformers',
+      // agentdb >= 3.0.0-alpha.20 refuses UNREGISTERED models without an explicit role policy
+      // (its built-in registry knows all-MiniLM-L6-v2 but not our multilingual variant — grounded
+      // in dist/src/controllers/EmbeddingService.js:53). paraphrase-multilingual-MiniLM is a
+      // SYMMETRIC sentence-transformer (no query/passage instruction prefixes), so the policy is
+      // {kind:'symmetric'} — the same one the registry assigns its own symmetric models. On
+      // alpha.18 the extra field is ignored; without it alpha.20 threw and the vector tier fell
+      // to lexical SILENTLY (mirror writes answered {indexed:0, error} — measured 2026-08-24).
+      rolePolicy: { kind: 'symmetric' },
+    } as never);
     await emb.initialize();
 
     const dbFile = resolveAgentdbPath(projectRoot, opts.dbPath);
@@ -242,7 +254,19 @@ export async function resolveAgentdbEmbedder(
     };
     const model = resolveEmbedModel(projectRoot);
     if ('error' in model) return { error: model.error };
-    const emb = new EmbeddingService({ model: model.model, dimension: model.dim, provider: 'transformers' });
+    const emb = new EmbeddingService({
+      model: model.model,
+      dimension: model.dim,
+      provider: 'transformers',
+      // agentdb >= 3.0.0-alpha.20 refuses UNREGISTERED models without an explicit role policy
+      // (its built-in registry knows all-MiniLM-L6-v2 but not our multilingual variant — grounded
+      // in dist/src/controllers/EmbeddingService.js:53). paraphrase-multilingual-MiniLM is a
+      // SYMMETRIC sentence-transformer (no query/passage instruction prefixes), so the policy is
+      // {kind:'symmetric'} — the same one the registry assigns its own symmetric models. On
+      // alpha.18 the extra field is ignored; without it alpha.20 threw and the vector tier fell
+      // to lexical SILENTLY (mirror writes answered {indexed:0, error} — measured 2026-08-24).
+      rolePolicy: { kind: 'symmetric' },
+    } as never);
     await emb.initialize();
     return { embed: (t: string) => emb.embed(t) };
   } catch (err) {

package/src/amendment-trace.ts

@@ -74,7 +74,12 @@ export const MIN_MATCHABLE_ID_LENGTH = 8;
 export function extractTestTitles(body: string): string[] {
   const code = body.replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/(^|[^:])\/\/[^\n]*/g, '$1');
   const out: string[] = [];
-  const re = /\b(?:it|test|describe)(?:\.\w+)*(?:\s*\([^()]{0,200}\))?\s*(?:`[^`]*`)?\s*\(\s*(['"`])([\s\S]{1,300}?)\1/g;
+  // The modifier-argument group admits ONE level of nested parens: `it.skipIf(!existsSync(BIN))`
+  // carries a call inside the guard, and the flat `[^()]{0,200}` failed on it — so every title in
+  // a file whose tests were guarded that way was invisible, and `dz amendment-check` reported
+  // `searched 1 test title(s)` over a nine-test file (MEASURED 2026-08-24 on the name-check
+  // feature; worked around there by de-guarding the tests, fixed here at the extractor).
+  const re = /\b(?:it|test|describe)(?:\.\w+)*(?:\s*\((?:[^()]|\([^()]*\)){0,200}\))?\s*(?:`[^`]*`)?\s*\(\s*(['"`])([\s\S]{1,300}?)\1/g;
   for (let m = re.exec(code); m !== null; m = re.exec(code)) if (m[2]) out.push(m[2]);
   return out;
 }

package/src/cadence.ts

@@ -0,0 +1,227 @@
+/**
+ * `dz cadence` — the "what shipped" aggregator (backlog ef740b44), built on one spine:
+ * A WINDOW DEEPER THAN THE RECORD IS REFUSED (ADR-001). The weekly-digest research (2026-08-22)
+ * caught a «year» digest standing on 174 days of data — scale forgery by aggregation; an
+ * aggregator that silently computes any requested period repeats it mechanically.
+ *
+ * Four sources, every degradation NAMED in the report, never a silent zero:
+ *  - graded shipments: features/<slug>/08_qe_report.md through the hardened readQeGrade
+ *    (prefix-negation aware, all measured real-world grade forms); ungraded reports are a COLUMN;
+ *  - npm publishes: the dz recap registry-time cache (third-party timestamps);
+ *  - guard repeat decay on a FIXED rule set: a rule enters only with events BEFORE the window
+ *    start (the data-driven birth proxy — the no-stubs class of «zero repeats because the rule is
+ *    young» is excluded by construction);
+ *  - knowledge reuse: recall events per bucket from .dz/recall-usage.jsonl.
+ */
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { readQeGrade } from './score.js';
+
+export type CadenceWindow = 'day' | 'week' | 'month' | 'quarter' | 'halfyear' | 'year';
+
+export const CADENCE_WINDOW_DAYS: Record<CadenceWindow, number> = {
+  day: 1, week: 7, month: 30, quarter: 91, halfyear: 182, year: 365,
+};
+
+export interface CadenceWindowDecision {
+  readonly ok: boolean;
+  readonly reason: string;
+  /** The largest window today's record CAN honestly carry, or null when even `day` cannot. */
+  readonly largestAllowed: CadenceWindow | null;
+}
+
+/**
+ * ADR-001: a window is accepted only when the record is at least TWO windows deep — two full units
+ * are the minimum for the word «cadence»; one point has no rhythm.
+ */
+export function decideCadenceWindow(window: CadenceWindow, dataDepthDays: number): CadenceWindowDecision {
+  const need = CADENCE_WINDOW_DAYS[window] * 2;
+  const order: CadenceWindow[] = ['year', 'halfyear', 'quarter', 'month', 'week', 'day'];
+  const largestAllowed = order.find((w) => dataDepthDays >= CADENCE_WINDOW_DAYS[w] * 2) ?? null;
+  if (dataDepthDays >= need) return { ok: true, reason: `record depth ${dataDepthDays}d covers 2×${window}`, largestAllowed };
+  return {
+    ok: false,
+    reason: `REFUSED: the record is ${dataDepthDays} day(s) deep and a ${window} cadence needs ${need} — a cadence computed from under two full windows is a scale forgery, not a number` +
+      (largestAllowed ? `; the largest honest window today is «${largestAllowed}»` : '; even «day» is not established yet'),
+    largestAllowed,
+  };
+}
+
+/** ISO week key (YYYY-Www) for a ms timestamp. */
+export function isoWeekOf(ms: number): string {
+  const d = new Date(ms);
+  const t = new Date(Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), d.getUTCDate()));
+  const day = t.getUTCDay() === 0 ? 7 : t.getUTCDay();
+  t.setUTCDate(t.getUTCDate() + 4 - day);
+  const yearStart = Date.UTC(t.getUTCFullYear(), 0, 1);
+  const week = Math.ceil(((t.getTime() - yearStart) / 86400000 + 1) / 7);
+  return `${t.getUTCFullYear()}-W${String(week).padStart(2, '0')}`;
+}
+
+export interface CadenceEvent { readonly ts: number; readonly kind: string; readonly detail?: string }
+
+/** Bucket events into ISO weeks inside [windowStart, now]. */
+export function weeklyBuckets(events: readonly CadenceEvent[], windowStartMs: number, nowMs: number): Map<string, CadenceEvent[]> {
+  const out = new Map<string, CadenceEvent[]>();
+  for (const e of events) {
+    if (!isFinite(e.ts) || e.ts < windowStartMs || e.ts > nowMs) continue;
+    const k = isoWeekOf(e.ts);
+    const list = out.get(k) ?? [];
+    list.push(e);
+    out.set(k, list);
+  }
+  return out;
+}
+
+export interface GuardDecayRow { readonly rule: string; readonly before: number; readonly inWindow: number }
+
+/**
+ * Repeat decay over the FIXED set: only rules with at least one event BEFORE the window start
+ * qualify (their existence predates the window); newborn rules are EXCLUDED by construction and
+ * returned separately so the exclusion is visible.
+ */
+export function guardRepeatDecay(
+  events: readonly { ts: number; rule: string }[],
+  windowStartMs: number,
+): { decay: GuardDecayRow[]; excludedNewborn: string[] } {
+  const before = new Map<string, number>();
+  const inWindow = new Map<string, number>();
+  for (const e of events) {
+    if (!isFinite(e.ts) || e.rule === '') continue;
+    if (e.ts < windowStartMs) before.set(e.rule, (before.get(e.rule) ?? 0) + 1);
+    else inWindow.set(e.rule, (inWindow.get(e.rule) ?? 0) + 1);
+  }
+  const decay: GuardDecayRow[] = [...before.entries()]
+    .map(([rule, b]) => ({ rule, before: b, inWindow: inWindow.get(rule) ?? 0 }))
+    .sort((a, b) => b.before - a.before);
+  const excludedNewborn = [...inWindow.keys()].filter((r) => !before.has(r)).sort();
+  return { decay, excludedNewborn };
+}
+
+export interface CadenceReport {
+  readonly window: CadenceWindow;
+  readonly decision: CadenceWindowDecision;
+  readonly depthDays: number;
+  readonly shipments: { graded: Record<string, number>; ungraded: number; gradedTotal: number; byGrade: Record<string, number> };
+  readonly npmPublishes: { weekly: Record<string, number>; degraded: string | null };
+  readonly guard: { decay: GuardDecayRow[]; excludedNewborn: string[]; degraded: string | null };
+  readonly recalls: { weekly: Record<string, number>; degraded: string | null };
+}
+
+function safeJsonl(path: string): unknown[] {
+  const out: unknown[] = [];
+  try {
+    for (const line of readFileSync(path, 'utf-8').split('\n')) {
+      if (line.trim() === '') continue;
+      try { out.push(JSON.parse(line)); } catch { /* torn line — skip, counted nowhere */ }
+    }
+  } catch { /* absent file — callers name the degradation */ }
+  return out;
+}
+
+/** Build the full report. `now` injectable — the refusal decision must be testable. */
+export function buildCadenceReport(root: string, window: CadenceWindow, now?: number): CadenceReport {
+  const nowMs = typeof now === 'number' && isFinite(now) ? now : Date.now();
+
+  // Shipment events: graded 08 reports, dated by the run-cost ledger (fallback: report mtime is
+  // NOT used — an mtime moves on every touch; an undatable report lands in `ungraded`... no: in
+  // its own named bucket via ledger-missing) — v1 keeps the honest subset: ledger-dated only.
+  const ledger = safeJsonl(join(root, '.dz', 'feature-adr', 'run-cost-ledger.jsonl')) as Array<{ slug?: string; date?: string }>;
+  const dateBySlug = new Map<string, number>();
+  let earliest = nowMs;
+  for (const r of ledger) {
+    if (typeof r.slug !== 'string' || typeof r.date !== 'string') continue;
+    const ts = Date.parse(r.date);
+    if (!isFinite(ts)) continue;
+    if (!dateBySlug.has(r.slug) || ts > (dateBySlug.get(r.slug) as number)) dateBySlug.set(r.slug, ts);
+    if (ts < earliest) earliest = ts;
+  }
+  // Record depth is the UNION of sources — the npm registry reaches months past the ledger, and a
+  // refusal computed from the shallowest source alone would under-admit honest windows.
+  let unionEarliest = earliest;
+  try {
+    const cache = JSON.parse(readFileSync(join(root, '.dz', 'recap', 'npm-times.json'), 'utf-8')) as { packages?: Record<string, { versions?: Record<string, string> }> };
+    for (const entry of Object.values(cache.packages ?? {})) for (const iso of Object.values(entry.versions ?? {})) {
+      const ts = Date.parse(iso); if (isFinite(ts) && ts < unionEarliest) unionEarliest = ts;
+    }
+  } catch { /* cache absent — named later */ }
+  for (const row of safeJsonl(join(root, '.dz', 'guard-audit.jsonl')) as Array<{ ts?: string }>) {
+    const ts = Date.parse(String(row.ts ?? '')); if (isFinite(ts) && ts < unionEarliest) unionEarliest = ts;
+  }
+  const depthDays = Math.floor((nowMs - unionEarliest) / 86400000);
+  const decision = decideCadenceWindow(window, depthDays);
+  const windowStart = nowMs - CADENCE_WINDOW_DAYS[window] * 86400000;
+
+  const gradedWeekly: Record<string, number> = {};
+  const byGrade: Record<string, number> = {};
+  let ungraded = 0;
+  let gradedTotal = 0;
+  const featuresDir = join(root, 'features');
+  if (existsSync(featuresDir) && decision.ok) {
+    for (const slug of readdirSync(featuresDir)) {
+      const report = join(featuresDir, slug, '08_qe_report.md');
+      if (!existsSync(report)) continue;
+      const ts = dateBySlug.get(slug);
+      if (ts === undefined || ts < windowStart || ts > nowMs) continue;
+      const grade = readQeGrade(readFileSync(report, 'utf-8')).grade;
+      if (grade === null) { ungraded += 1; continue; }
+      gradedTotal += 1;
+      byGrade[grade] = (byGrade[grade] ?? 0) + 1;
+      const wk = isoWeekOf(ts);
+      gradedWeekly[wk] = (gradedWeekly[wk] ?? 0) + 1;
+    }
+  }
+
+  // npm publishes from the recap cache — third-party registry timestamps.
+  const npmWeekly: Record<string, number> = {};
+  let npmDegraded: string | null = null;
+  const npmCache = join(root, '.dz', 'recap', 'npm-times.json');
+  if (!existsSync(npmCache)) {
+    npmDegraded = 'no npm-times cache — run `dz recap --refresh-publishes` first (registry timestamps are third-party data this command never fetches itself)';
+  } else if (decision.ok) {
+    try {
+      const cache = JSON.parse(readFileSync(npmCache, 'utf-8')) as { packages?: Record<string, { versions?: Record<string, string> }> };
+      for (const entry of Object.values(cache.packages ?? {})) {
+        for (const iso of Object.values(entry.versions ?? {})) {
+          const ts = Date.parse(iso);
+          if (!isFinite(ts) || ts < windowStart || ts > nowMs) continue;
+          const wk = isoWeekOf(ts);
+          npmWeekly[wk] = (npmWeekly[wk] ?? 0) + 1;
+        }
+      }
+    } catch { npmDegraded = 'npm-times cache unreadable — refresh it (`dz recap --refresh-publishes`)'; }
+  }
+
+  // Guard decay on the fixed set.
+  const guardRows = (safeJsonl(join(root, '.dz', 'guard-audit.jsonl')) as Array<{ ts?: string; at?: string; rule?: string; violations?: Array<{ rule?: string }> }>)
+    .flatMap((r) => {
+      const ts = Date.parse(String(r.ts ?? r.at ?? ''));
+      if (!isFinite(ts)) return [];
+      // the live shape: one audit row carries violations[] each naming its rule
+      if (Array.isArray(r.violations)) return r.violations.map((v) => ({ ts, rule: String(v?.rule ?? '') })).filter((x) => x.rule !== '');
+      return typeof r.rule === 'string' && r.rule !== '' ? [{ ts, rule: r.rule }] : [];
+    });
+  const guard = decision.ok ? guardRepeatDecay(guardRows, windowStart) : { decay: [], excludedNewborn: [] };
+  const guardDegraded = guardRows.length === 0 ? 'no guard-audit events on disk — decay has nothing to stand on' : null;
+
+  // Knowledge reuse: recall events.
+  const recallRows = (safeJsonl(join(root, '.dz', 'recall-usage.jsonl')) as Array<{ ts?: string; at?: string }>)
+    .map((r) => Date.parse(String(r.ts ?? r.at ?? '')))
+    .filter((t) => isFinite(t));
+  const recallWeekly: Record<string, number> = {};
+  if (decision.ok) for (const ts of recallRows) {
+    if (ts < windowStart || ts > nowMs) continue;
+    const wk = isoWeekOf(ts);
+    recallWeekly[wk] = (recallWeekly[wk] ?? 0) + 1;
+  }
+  const recallDegraded = recallRows.length === 0 ? 'no recall-usage events — the reuse leg has nothing to stand on' : null;
+
+  return {
+    window, decision, depthDays,
+    shipments: { graded: gradedWeekly, ungraded, gradedTotal, byGrade },
+    npmPublishes: { weekly: npmWeekly, degraded: npmDegraded },
+    guard: { ...guard, degraded: guardDegraded },
+    recalls: { weekly: recallWeekly, degraded: recallDegraded },
+  };
+}

package/src/feature-adr-routing.ts

@@ -188,7 +188,7 @@ export function decideUsageAction(
 // ── Data tables (data-only extensibility — gpt-5.6-ready) ───────────────────
 
 /** Known codex ids. Adding a new id (e.g. `'gpt-5.7'`) is a DATA-ONLY change. */
-export const KNOWN_CODEX: Record<string, number> = { auto: 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-sol': 1 };
+export const KNOWN_CODEX: Record<string, number> = { auto: 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-luna': 1, 'gpt-5.6-terra': 1, 'gpt-5.6-sol': 1 };
 
 /** The Claude model names the Workflow runtime accepts as `agent()` `model`. */
 export const CLAUDE_NAMES: Record<string, number> = { fable: 1, opus: 1, sonnet: 1, haiku: 1 };
@@ -2029,7 +2029,12 @@ export function planCompletenessGateCmd(repo: string, featureDir: string, tier?:
     // and the tried paths live OUTSIDE the verdict line so no path can smuggle a second verdict word
     // into it.
     'echo "K2_GATE_SCRIPT=${GS:-none}"',
-    'echo "K2_GATE_TRIED=${C1:-(none)} | $C2 | $C3"',
+    'echo "K2_GATE_TRIED=C1(args.gateScript)=${C1:-<unset>} | C2(workspace)=$C2 | C3(target-repo)=$C3"',
+    // A COLLAPSE is not a second candidate. When the workspace was not pinned, WS falls back to the
+    // gate agent own cwd — in the field that WAS the target repo, so C2 and C3 printed the same path
+    // twice and the chain silently degenerated from three candidates to two. Saying so turns a
+    // puzzling duplicate into an instruction. Not verdict-shaped, so the parser anchoring is untouched.
+    '[ "$C2" = "$C3" ] && echo "K2_GATE_NOTE=the workspace candidate resolved to the TARGET repo (WS==repo), so only two distinct candidates were tried; pass args.workspace or args.gateScript when the feature-adr skill is installed outside the target repo"',
     'if [ -z "$GS" ]; then echo "K2 plan-completeness: NOT-ESTABLISHED — tooling-missing: no gate script at any candidate on the K2_GATE_TRIED line above"; echo "K2_EXIT=3"; else cd ' + q(repo) + ' && node "$GS" ' + q(featureDir) + t + ' 2>&1; echo "K2_EXIT=$?"; fi',
   ].join('\n')
 }

package/src/index.ts

@@ -76,6 +76,7 @@ export type { CreateSkillOptions, CreateSkillResult } from './create-skill.js';
 export { checkUpstream, checkAllUpstream, discoverSourcePackages, loadSourcesManifest } from './sync-upstream.js';
 export type { SyncUpstreamReport, UpstreamCheckResult, SourcesManifest, SourcePackageInfo } from './sync-upstream.js';
 export { sweepSkillDrift, syncCanonicalSkill } from './skill-drift.js';
+export { SKILL_INSTALL_ROOTS, SKILL_INSTALL_ROOT_BY_TARGET, DEV_SKILL_ROOT, TARGET_ENRICHMENT_ASSETS } from './skill-install-roots.js';
 export type { SweepResult, DriftedSkill, SyncResult, SyncCanonicalOptions } from './skill-drift.js';
 export { benchmarkSkill, benchmarkSkills, compareSkills } from './benchmark.js';
 export { buildRegistry, searchRegistry, filterByCategory, skillPackBaseDirs, discoverSkillPackDirs, discoverVerifiablePackDirs } from './registry.js';
@@ -331,6 +332,7 @@ export {
   compactRecallUsageLog,
   compactRecallUsageLogChecked,
   appendRecallUsage,
+  countRecallEventsForRun,
   runtimeOf,
   RUNTIMES,
 } from './recall-usage.js';
@@ -461,7 +463,7 @@ export type {
   ChainDefectAge,
   ChainDefectAges,
 } from './event-chain.js';
-export { decideProvenance, environmentCanMintProvenance, publishArgv, discoverPackages, publishPackages, bumpPatch, compareVersions, findUnpackagedSkills, orderByDependencies, syncReadmeVersion } from './publish.js';
+export { decideProvenance, environmentCanMintProvenance, publishArgv, discoverPackages, publishPackages, bumpPatch, compareVersions, findUnpackagedSkills, findUnpublishedWorkspaceFloors, orderByDependencies, syncReadmeVersion } from './publish.js';
 export { fetchAllDownloads } from './downloads.js';
 export type { PackageDownloads, DownloadsReport } from './downloads.js';
 export { discoverInstalled, checkUpgrades } from './upgrade.js';
@@ -818,6 +820,7 @@ export * from './recap.js';
 export * from './provenance.js';
 export * from './name-check.js';
 export * from './cli-flag-notice.js';
+export * from './tg-post.js';
 
 // Mutation gate (feature ha-mutation-gate) — deliberately break each NAMED protection in a scratch
 // copy, run the suite, REQUIRE red. Proves a test DISCRIMINATES, not merely that it is green.
@@ -832,3 +835,7 @@ export * from './backlog.js';
 // no-stubs (backlog 0b403a0106103901) — deterministic unfinished-stub-marker scan over the
 // CHANGE-SET, wired as the `no-stubs` SOFT publish guard rule + the feature-adr Step-8 QE item.
 export * from './no-stubs.js';
+export { quiescenceProbeScript, decideWriterQuiescence, WQ_WINDOW_SECONDS, WQ_MAX_WINDOWS, WQ_REQUIRED_QUIET } from './writer-quiescence.js';
+export type { WriterQuiescenceDecision } from './writer-quiescence.js';
+export { decideCadenceWindow, isoWeekOf, weeklyBuckets, guardRepeatDecay, buildCadenceReport, CADENCE_WINDOW_DAYS } from './cadence.js';
+export type { CadenceWindow, CadenceReport, CadenceWindowDecision } from './cadence.js';

package/src/loop-blobs.generated.ts

@@ -61,11 +61,11 @@ export const BLOBS: Record<string, LoopBlob> = {
   "model-resolver": {
     name: "model-resolver",
     version: "1.0.0",
-    contentHash: "dd4020b613dc3814aaaf5c6a07a82bff844680f3be43d2943754f46b0b1bea3c",
+    contentHash: "e82ac2137279537f5b65725cbd8de5817fcbc89571068e2df843587352fa83f5",
     sourcePath: "packages/@dzhechkov/harness-core/src/feature-adr-routing.ts",
     requires: [],
     exports: ["specToOpts","resolveStageModel","KNOWN_CODEX","mergeOpts","stageLabel","modelLabel"],
-    code: "const OVERRIDE_REASONING = {\n    router: 'high',\n    requirements: 'xhigh',\n    research: 'xhigh',\n    adr: 'xhigh',\n    ideation: 'xhigh',\n    ddd: 'xhigh',\n    architecture: 'xhigh',\n    plan: 'xhigh',\n    code: 'xhigh',\n    qe: 'high',\n    fleet: 'high',\n};\nfunction topCodexId(env) {\n    let top = env.CODEX_MODEL;\n    if (top === 'auto') {\n        const ids = Object.keys(KNOWN_CODEX);\n        for (let i = 0; i < ids.length; i++) {\n            if (ids[i] !== 'auto')\n                top = ids[i] || top;\n        }\n    }\n    return top;\n}\nconst KNOWN_CODEX = { auto: 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-sol': 1 };\nconst CLAUDE_NAMES = { fable: 1, opus: 1, sonnet: 1, haiku: 1 };\nconst VALID_REASONING = { none: 1, minimal: 1, low: 1, medium: 1, high: 1, xhigh: 1 };\nconst DEFAULT_MODELS = {\n    router: 'fable',\n    requirements: 'sonnet',\n    research: 'sonnet',\n    adr: 'opus',\n    ideation: 'sonnet',\n    ddd: 'opus',\n    architecture: 'opus',\n    plan: 'sonnet',\n    code: null,\n    qe: null,\n    fleet: 'sonnet',\n};\nfunction specToOpts(spec, env) {\n    const log = env.log || function () { };\n    if (!spec)\n        return {};\n    const parts = String(spec).split(':');\n    const head = parts[0] || '';\n    if (head === 'codex') {\n        let id = parts[1] || env.CODEX_MODEL;\n        if (id !== 'auto' && !KNOWN_CODEX[id]) {\n            log('models: unknown codex id ' + id + ' — using ' + env.CODEX_MODEL);\n            id = env.CODEX_MODEL;\n        }\n        let reasoning = parts[2] || 'high';\n        if (!VALID_REASONING[reasoning]) {\n            log('models: unknown reasoning ' + reasoning + ' — using high');\n            reasoning = 'high';\n        }\n        return { agentType: 'codex:codex-rescue', codexModel: id, _reasoning: reasoning };\n    }\n    if (CLAUDE_NAMES[head])\n        return { model: head };\n    log('models: unknown spec ' + spec + ' — session-inherited');\n    return {};\n}\nfunction resolveCoderSpec(env) {\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return 'codex:' + env.CODEX_MODEL + ':high';\n    return 'opus';\n}\nfunction coderIsCodex(env) {\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return true;\n    const codeSpec = env.MODELS.code;\n    if (codeSpec && String(codeSpec).split(':')[0] === 'codex')\n        return true;\n    return false;\n}\nfunction resolveQeSpec(env) {\n    if (coderIsCodex(env))\n        return 'opus';\n    const CODEX_AVAILABLE = env.codexAvailable !== false;\n    if (!CODEX_AVAILABLE)\n        return 'opus';\n    return 'codex:' + topCodexId(env) + ':high';\n}\nfunction routingRequested(env) {\n    return (Object.keys(env.MODELS).length > 0 ||\n        env.PLANNER === 'codex' ||\n        env.CODER === 'codex' ||\n        env.CODER === 'codex-fallback' ||\n        env.QE_REVIEWER === 'codex' ||\n        env.QE_REVIEWER === 'codex-fallback');\n}\nfunction resolveStageModel(stage, env) {\n    if (env.usageOverride) {\n        const r = (env.usageReasoning && env.usageReasoning[stage]) || OVERRIDE_REASONING[stage] || 'high';\n        const o = specToOpts('codex:' + topCodexId(env) + ':' + r, env);\n        o._usageSwitched = true;\n        return o;\n    }\n    let spec = env.MODELS[stage];\n    if (spec === undefined) {\n        if (!routingRequested(env))\n            return {};\n        spec = DEFAULT_MODELS[stage];\n    }\n    if (stage === 'code' && (spec === null || spec === undefined))\n        return specToOpts(resolveCoderSpec(env), env);\n    if (stage === 'qe' && (spec === null || spec === undefined))\n        return specToOpts(resolveQeSpec(env), env);\n    return specToOpts(spec, env);\n}\nfunction modelLabel(opts) {\n    if (opts && opts.agentType === 'codex:codex-rescue') {\n        const base = 'codex:' + opts.codexModel + ':' + opts._reasoning;\n        return opts._usageSwitched ? base + ' (usage-switched)' : base;\n    }\n    if (opts && opts.model)\n        return opts.model;\n    return 'session';\n}\nfunction stageLabel(base, opts) {\n    const m = modelLabel(opts);\n    return m === 'session' ? base : base + ' · ' + m;\n}\nfunction mergeOpts(base, extra) {\n    const out = {};\n    for (const k in base)\n        out[k] = base[k];\n    for (const k in extra)\n        out[k] = extra[k];\n    return out;\n}",
+    code: "const OVERRIDE_REASONING = {\n    router: 'high',\n    requirements: 'xhigh',\n    research: 'xhigh',\n    adr: 'xhigh',\n    ideation: 'xhigh',\n    ddd: 'xhigh',\n    architecture: 'xhigh',\n    plan: 'xhigh',\n    code: 'xhigh',\n    qe: 'high',\n    fleet: 'high',\n};\nfunction topCodexId(env) {\n    let top = env.CODEX_MODEL;\n    if (top === 'auto') {\n        const ids = Object.keys(KNOWN_CODEX);\n        for (let i = 0; i < ids.length; i++) {\n            if (ids[i] !== 'auto')\n                top = ids[i] || top;\n        }\n    }\n    return top;\n}\nconst KNOWN_CODEX = { auto: 1, 'gpt-5.5': 1, 'gpt-5.6': 1, 'gpt-5.6-luna': 1, 'gpt-5.6-terra': 1, 'gpt-5.6-sol': 1 };\nconst CLAUDE_NAMES = { fable: 1, opus: 1, sonnet: 1, haiku: 1 };\nconst VALID_REASONING = { none: 1, minimal: 1, low: 1, medium: 1, high: 1, xhigh: 1 };\nconst DEFAULT_MODELS = {\n    router: 'fable',\n    requirements: 'sonnet',\n    research: 'sonnet',\n    adr: 'opus',\n    ideation: 'sonnet',\n    ddd: 'opus',\n    architecture: 'opus',\n    plan: 'sonnet',\n    code: null,\n    qe: null,\n    fleet: 'sonnet',\n};\nfunction specToOpts(spec, env) {\n    const log = env.log || function () { };\n    if (!spec)\n        return {};\n    const parts = String(spec).split(':');\n    const head = parts[0] || '';\n    if (head === 'codex') {\n        let id = parts[1] || env.CODEX_MODEL;\n        if (id !== 'auto' && !KNOWN_CODEX[id]) {\n            log('models: unknown codex id ' + id + ' — using ' + env.CODEX_MODEL);\n            id = env.CODEX_MODEL;\n        }\n        let reasoning = parts[2] || 'high';\n        if (!VALID_REASONING[reasoning]) {\n            log('models: unknown reasoning ' + reasoning + ' — using high');\n            reasoning = 'high';\n        }\n        return { agentType: 'codex:codex-rescue', codexModel: id, _reasoning: reasoning };\n    }\n    if (CLAUDE_NAMES[head])\n        return { model: head };\n    log('models: unknown spec ' + spec + ' — session-inherited');\n    return {};\n}\nfunction resolveCoderSpec(env) {\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return 'codex:' + env.CODEX_MODEL + ':high';\n    return 'opus';\n}\nfunction coderIsCodex(env) {\n    if (env.CODER === 'codex' || env.CODER === 'codex-fallback')\n        return true;\n    const codeSpec = env.MODELS.code;\n    if (codeSpec && String(codeSpec).split(':')[0] === 'codex')\n        return true;\n    return false;\n}\nfunction resolveQeSpec(env) {\n    if (coderIsCodex(env))\n        return 'opus';\n    const CODEX_AVAILABLE = env.codexAvailable !== false;\n    if (!CODEX_AVAILABLE)\n        return 'opus';\n    return 'codex:' + topCodexId(env) + ':high';\n}\nfunction routingRequested(env) {\n    return (Object.keys(env.MODELS).length > 0 ||\n        env.PLANNER === 'codex' ||\n        env.CODER === 'codex' ||\n        env.CODER === 'codex-fallback' ||\n        env.QE_REVIEWER === 'codex' ||\n        env.QE_REVIEWER === 'codex-fallback');\n}\nfunction resolveStageModel(stage, env) {\n    if (env.usageOverride) {\n        const r = (env.usageReasoning && env.usageReasoning[stage]) || OVERRIDE_REASONING[stage] || 'high';\n        const o = specToOpts('codex:' + topCodexId(env) + ':' + r, env);\n        o._usageSwitched = true;\n        return o;\n    }\n    let spec = env.MODELS[stage];\n    if (spec === undefined) {\n        if (!routingRequested(env))\n            return {};\n        spec = DEFAULT_MODELS[stage];\n    }\n    if (stage === 'code' && (spec === null || spec === undefined))\n        return specToOpts(resolveCoderSpec(env), env);\n    if (stage === 'qe' && (spec === null || spec === undefined))\n        return specToOpts(resolveQeSpec(env), env);\n    return specToOpts(spec, env);\n}\nfunction modelLabel(opts) {\n    if (opts && opts.agentType === 'codex:codex-rescue') {\n        const base = 'codex:' + opts.codexModel + ':' + opts._reasoning;\n        return opts._usageSwitched ? base + ' (usage-switched)' : base;\n    }\n    if (opts && opts.model)\n        return opts.model;\n    return 'session';\n}\nfunction stageLabel(base, opts) {\n    const m = modelLabel(opts);\n    return m === 'session' ? base : base + ' · ' + m;\n}\nfunction mergeOpts(base, extra) {\n    const out = {};\n    for (const k in base)\n        out[k] = base[k];\n    for (const k in extra)\n        out[k] = extra[k];\n    return out;\n}",
   },
   "usage-probes": {
     name: "usage-probes",

package/src/operations.ts

@@ -196,7 +196,12 @@ function enrichEmitForTarget(
       `interface:`,
       `  display_name: "${name}"`,
       `policy:`,
-      `  allow_implicit_invocation: ${risk.level === 'low' || risk.level === 'medium'}`,
+      // MEASURED (hermes research, codex.md §63, twin-test): codex PARSES this file and
+      // `allow_implicit_invocation: false` HIDES the skill from the session entirely — it is a
+      // visibility switch, not an ask-first switch. Risk-gating through it silently disappeared a
+      // compiled pack (the terraform smoke pack never registered, backlog 2b80420f). Visibility is
+      // therefore ALWAYS true; the risk score stays as INFORMATION for the operator below.
+      `  allow_implicit_invocation: true  # false would HIDE the skill from codex entirely (measured); risk is informational, see risk_level`,
       `  risk_level: "${risk.level}"`,
       `  risk_score: ${risk.total.toFixed(2)}`,
       `  risk_axes:`,
@@ -835,24 +840,39 @@ export async function runDoctor(options: { projectRoot: string }): Promise<Docto
   const nodeMajor = Number(process.versions.node.split('.')[0] ?? '0');
   checks.push({ name: 'node >= 20', ok: nodeMajor >= 20, detail: `node ${process.version}` });
 
-  // 2. Key directories
-  for (const dir of ['.claude/skills', 'packages/@dzhechkov/skills-meta']) {
+  // 2/3. MONOREPO-ONLY checks, gated on PROJECT KIND (backlog fcf29728: in a consumer project
+  // skills-meta and the 10 adapters are not there and MUST not be — both checks were red forever
+  // and dz doctor could never exit 0 outside this repository, a standing false BLOCK for any
+  // consumer CI). Kind detection is structural: a checkout that carries packages/@dzhechkov IS the
+  // monorepo (or a fork of it) and owes itself these checks; anything else is a consumer project
+  // and gets a NAMED skip — a skip, never a silent pass and never a fail.
+  const isMonorepo = existsSync(join(root, 'packages', '@dzhechkov'));
+  checks.push({
+    name: '.claude/skills present',
+    ok: existsSync(join(root, '.claude', 'skills')),
+    detail: '.claude/skills',
+  });
+  if (isMonorepo) {
+    checks.push({
+      name: 'packages/@dzhechkov/skills-meta present',
+      ok: existsSync(join(root, 'packages/@dzhechkov/skills-meta')),
+      detail: 'packages/@dzhechkov/skills-meta',
+    });
+    const adapters = ['adapter-claude', 'adapter-codex', 'adapter-opencode', 'adapter-hermes', 'adapter-openclaude', 'adapter-copilot', 'adapter-agents-md', 'adapter-cursor', 'adapter-gemini', 'adapter-windsurf'];
+    const foundAdapters = adapters.filter((a) => existsSync(join(root, 'packages/@dzhechkov', a)));
+    checks.push({
+      name: 'adapters present',
+      ok: foundAdapters.length === adapters.length,
+      detail: `${foundAdapters.length}/${adapters.length} adapters found`,
+    });
+  } else {
     checks.push({
-      name: `${dir} present`,
-      ok: existsSync(join(root, dir)),
-      detail: dir,
+      name: 'monorepo checks',
+      ok: true,
+      detail: 'consumer project (no packages/@dzhechkov) — skills-meta/adapter checks are the MONOREPO\'s own duty and are skipped here by kind, not by silence',
     });
   }
 
-  // 3. Adapter resolvability (one per target platform)
-  const adapters = ['adapter-claude', 'adapter-codex', 'adapter-opencode', 'adapter-hermes', 'adapter-openclaude', 'adapter-copilot', 'adapter-agents-md', 'adapter-cursor', 'adapter-gemini', 'adapter-windsurf'];
-  const foundAdapters = adapters.filter((a) => existsSync(join(root, 'packages/@dzhechkov', a)));
-  checks.push({
-    name: 'adapters present',
-    ok: foundAdapters.length === adapters.length,
-    detail: `${foundAdapters.length}/${adapters.length} adapters found`,
-  });
-
   // 4. Package version consistency
   const pkgsDir = join(root, 'packages/@dzhechkov');
   if (existsSync(pkgsDir)) {
@@ -937,10 +957,17 @@ export async function runDoctor(options: { projectRoot: string }): Promise<Docto
     const skillDirs = readdirSync(skillsDir, { withFileTypes: true })
       .filter((e) => e.isDirectory() && !e.name.startsWith('.'));
     const withSkillMd = skillDirs.filter((e) => existsSync(join(skillsDir, e.name, 'SKILL.md')));
+    // A visible dir with NO SKILL.md is almost never a broken skill — it is a FOREIGN directory
+    // (measured: a 102-file health-advisor/ residue from an old `ha init` read as «27/28», which a
+    // human parses as "one skill is broken" and goes fixing a skill; the true cure is cleanup).
+    // Name the offenders and say which treatment applies (HA-improvements 2026-08, b5ba7b4a).
+    const foreign = skillDirs.filter((e) => !existsSync(join(skillsDir, e.name, 'SKILL.md'))).map((e) => e.name);
     checks.push({
       name: 'skills health',
       ok: withSkillMd.length === skillDirs.length,
-      detail: `${withSkillMd.length}/${skillDirs.length} skill dirs have SKILL.md`,
+      detail: foreign.length === 0
+        ? `${withSkillMd.length}/${skillDirs.length} skill dirs have SKILL.md`
+        : `${withSkillMd.length}/${skillDirs.length} skill dirs have SKILL.md — ${foreign.length} FOREIGN dir(s) in the skills root (not broken skills; the cure is cleanup, not repair): ${foreign.slice(0, 5).join(', ')}${foreign.length > 5 ? ', …' : ''}`,
     });
   }
 
@@ -1007,14 +1034,20 @@ export async function runDoctor(options: { projectRoot: string }): Promise<Docto
         const usageLog = join(root, '.dz', 'recall-usage.jsonl');
         const { newest, hasCodexRow } = newestRecallUsageRuntime(usageLog);
         const fresh = newest !== undefined && Date.now() - Date.parse(newest) < 14 * 24 * 60 * 60 * 1000;
+        // In a CONSUMER project the machine-global hook is wired but a FRESH project has zero rows
+        // by construction — dead-leg and new-project are indistinguishable there, and a permanent
+        // red on arrival is a false CI block (fcf29728). The row degrades to an ADVISORY (ok:true,
+        // wording intact) outside the monorepo; in the monorepo it stays the hard row that killed
+        // the 19-day dark leg.
+        const applyLegOk = hasCodexRow && fresh;
         checks.push({
           name: 'codex apply-leg (recall hook)',
-          ok: hasCodexRow && fresh,
-          detail: hasCodexRow
+          ok: isMonorepo ? applyLegOk : true,
+          detail: (isMonorepo || applyLegOk ? '' : 'advisory (consumer project — a fresh store has no rows by construction): ') + (hasCodexRow
             ? fresh
               ? `codex recall rows present, newest ${newest}`
               : `codex recall hook is WIRED but SILENT: newest recall-usage row is ${String(newest)} — the entry may have lost hook trust (re-run dz hooks-sync --target codex --verify)`
-            : 'codex recall hook is WIRED but has NEVER written a row — a dead leg looks exactly like a correctly-silent one, so this is reported non-OK until one lands',
+            : 'codex recall hook is WIRED but has NEVER written a row — a dead leg looks exactly like a correctly-silent one, so this is reported non-OK until one lands'),
         });
       }
     }

package/src/provenance.ts

@@ -25,6 +25,12 @@ export type SourceVerdict =
   | 'no-source'
   /** The manifest did not declare what kind of source this is — never inferred from its shape. */
   | 'unknown-kind'
+  /** A PUBLIC external web URL (http/https). It is already public by construction, so it cannot
+   *  "leave this machine" — nothing local to protect. Refused only if the URL is malformed. */
+  | 'public-url'
+  /** A `url` claim whose value is not a well-formed http(s) URL — a scheme this gate will not clear
+   *  (a file://, a bare word, or a non-URL) must not pass as a public web source. */
+  | 'malformed-url'
   /** A store record that the TRACKED public list does not name. Default-deny. */
   | 'not-marked-public'
   /** The path does not resolve. You cannot cite what does not exist. */
@@ -164,6 +170,18 @@ export function classifySource(claim: SourceClaim, facts: SourceProvenanceFacts)
     return at('allowed', 'committed, reviewed, and not refused by the owner\'s boundary');
   }
 
+  if (claim.kind === 'url') {
+    // The channel translates OTHERS' public tweets/posts; their sources are PUBLIC web URLs. Such a
+    // URL is already public — it cannot leak off this machine, so there is no local secret to
+    // protect (the whole point of the path/record checks). It is cleared iff it is a well-formed
+    // http(s) URL; anything else (file://, a bare path, a non-URL) is refused, never inferred.
+    let ok = false;
+    try { const u = new URL(source); ok = u.protocol === 'http:' || u.protocol === 'https:'; } catch { ok = false; }
+    return ok
+      ? at('public-url', 'a public http(s) web source — already public, nothing local to protect')
+      : at('malformed-url', 'kind "url" but the value is not a well-formed http(s) URL — a public web source must be a real http(s) URL');
+  }
+
   return at('unknown-kind', `the manifest declares kind ${JSON.stringify(claim.kind ?? null)} — a kind this gate cannot check is refused, never inferred from the path's shape`);
 }
 
@@ -187,7 +205,11 @@ export function decideSourceProvenance(manifest: SourceManifest | null, facts: S
     return { outcome: 'not-established', exit: 3, claims: [], reason: 'the manifest lists no claims — a draft with nothing to check has not been shown to be safe, only left unchecked' };
   }
   const claims = manifest.claims.map((c) => classifySource(c, facts));
-  const blocked = claims.filter((c) => c.verdict !== 'allowed');
+  // A claim passes iff its verdict is a CLEARED one: a repo-internal source proven safe (allowed),
+  // or a public web URL that is already public by construction (public-url — the tg-post channel
+  // case). Every other verdict is a refusal.
+  const CLEARED = new Set(['allowed', 'public-url']);
+  const blocked = claims.filter((c) => !CLEARED.has(c.verdict));
   if (blocked.length > 0) {
     return {
       outcome: 'blocked',