@dzhechkov/harness-core 0.7.4 → 0.7.6

package/src/publish.ts

@@ -89,6 +89,68 @@ function maxPublished(name: string, localVersion: string): string {
   return pub !== undefined && compareVersions(pub, localVersion) > 0 ? pub : localVersion;
 }
 
+// ── workspace-floor preflight (feature workspace-dep-protocol, Codex P1) ─────
+//
+// Sibling deps are declared `workspace:^`, and pnpm rewrites them at pack time to `^<the sibling's
+// DISK version>`. That version is not necessarily PUBLISHED: `--bump-only` stages versions on disk,
+// and a later `--filter`ed publish of just the dependent would ship a floor nobody can install —
+// the publish itself succeeds, and every consumer `npm install` then fails with ETARGET. Staged is
+// not shipped; this preflight makes the difference a refusal instead of a broken release.
+
+/**
+ * Pure half: which `workspace:`-declared deps of a package would pack to a floor that is neither
+ * being published in this batch nor already on the registry?
+ *
+ * Fail-closed by design: a probe that cannot answer (offline, 404) reports the floor as
+ * unpublished — a publish needs the network anyway, and refusing beats shipping ETARGET.
+ */
+export function findUnpublishedWorkspaceFloors(opts: {
+  readonly dependencies: Record<string, string> | undefined;
+  /** pnpm rewrites `workspace:` in peerDependencies at pack time too (Codex P2) — same hazard. */
+  readonly peerDependencies?: Record<string, string> | undefined;
+  /** name → version on DISK, for every package in the workspace (what pnpm packs the floor from). */
+  readonly workspaceVersions: ReadonlyMap<string, string>;
+  /**
+   * Names whose publish has LANDED (or, in a dry-run preview, would land) BEFORE this package.
+   * Static batch membership is not enough (Codex P1): a sibling that failed its own gates earlier
+   * in the batch has no published floor, and its dependents must fall through to the probe.
+   */
+  readonly batch: ReadonlySet<string>;
+  readonly probe: (name: string, version: string) => boolean;
+}): { name: string; version: string }[] {
+  const missing: { name: string; version: string }[] = [];
+  const seen = new Set<string>();
+  // Sections are inspected INDEPENDENTLY, never object-merged: a plain peer range for the same
+  // sibling would overwrite a `workspace:^` dependency entry in a spread, and pnpm still rewrites
+  // the dependency section — the protocol in EITHER section makes the floor pack from disk.
+  const entries = [...Object.entries(opts.dependencies ?? {}), ...Object.entries(opts.peerDependencies ?? {})];
+  for (const [dep, spec] of entries) {
+    if (!String(spec).startsWith('workspace:')) continue;
+    if (seen.has(dep)) continue;
+    seen.add(dep);
+    if (opts.batch.has(dep)) continue; // publishes before this package (deps-first order)
+    const version = opts.workspaceVersions.get(dep);
+    if (version === undefined) {
+      // A workspace: spec naming a package that is not in the workspace — pnpm pack would die on
+      // it anyway, but die HERE with a name, not mid-batch.
+      missing.push({ name: dep, version: '(not in workspace)' });
+      continue;
+    }
+    if (!opts.probe(dep, version)) missing.push({ name: dep, version });
+  }
+  return missing;
+}
+
+/** Registry probe: is exactly `name@version` published? Empty output / 404 / offline ⇒ no. */
+function versionPublished(name: string, version: string): boolean {
+  try {
+    const out = execSync(`npm view ${name}@${version} version`, { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8', timeout: 20000 }).trim();
+    return out === version;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * `execSync` throws an Error whose `.message` is only `Command failed: <cmd>` — the child's real output
  * (the `npm ERR!` lines that say WHY a publish failed) sits on `.stdout` / `.stderr` and was being
@@ -331,6 +393,13 @@ export function publishPackages(
     claimGate?: 'off' | 'warn' | 'error' | undefined;
     /** ADR-001: `auto` (default) decides from the environment; `on` fails where it cannot work. */
     provenance?: ProvenanceMode | undefined;
+    /**
+     * Floor probe injection for the workspace-floor preflight (see
+     * `findUnpublishedWorkspaceFloors`). Default: a real `npm view` probe, which runs only on LIVE
+     * publishes — dry-run stays offline, matching `maxPublished`. Injecting a probe also arms the
+     * preflight under dry-run, which is how the wiring test drives it without network.
+     */
+    probeFloor?: ((name: string, version: string) => boolean) | undefined;
   } = {},
 ): PublishReport {
   // Decide ONCE, before the batch: `--provenance` in an incapable environment must fail here, not on
@@ -346,6 +415,15 @@ export function publishPackages(
   // freshly-bumped version, never a stale one (the harness-cli@0.3.122 breakage).
   const ordered = orderByDependencies(filtered);
 
+  // Workspace-floor preflight inputs: the full workspace version map (what pnpm would pack each
+  // floor from), and the names whose publish has LANDED so far in this run — grown as the loop
+  // proceeds, never assumed from batch membership (Codex P1: a sibling that failed its own gates
+  // has no published floor, and static membership would still have covered its dependents).
+  const workspaceVersions = new Map(packages.map((p) => [p.name, p.version]));
+  const landedInBatch = new Set<string>();
+  const armFloorPreflight = opts.bumpOnly !== true && (opts.dryRun !== true || opts.probeFloor !== undefined);
+  const probeFloor = opts.probeFloor ?? versionPublished;
+
   for (const pkg of ordered) {
     const oldVersion = pkg.version;
     // Bump from max(local, npm-published) so a locally-reverted version can't
@@ -370,6 +448,24 @@ export function publishPackages(
       continue;
     }
 
+    // Workspace-floor preflight (Codex P1, feature workspace-dep-protocol): a `workspace:^` dep
+    // packs to `^<sibling's DISK version>` — refuse if that floor is neither in this batch nor on
+    // the registry, or the publish succeeds and every consumer install dies with ETARGET.
+    if (armFloorPreflight) {
+      const manifest = JSON.parse(readFileSync(join(pkg.dir, 'package.json'), 'utf-8')) as { dependencies?: Record<string, string>; peerDependencies?: Record<string, string> };
+      const unpublishedFloors = findUnpublishedWorkspaceFloors({ dependencies: manifest.dependencies, peerDependencies: manifest.peerDependencies, workspaceVersions, batch: landedInBatch, probe: probeFloor });
+      if (unpublishedFloors.length > 0) {
+        results.push({
+          name: pkg.name,
+          oldVersion,
+          newVersion,
+          status: 'error',
+          error: `workspace floor(s) not published: ${unpublishedFloors.map((f) => `${f.name}@${f.version}`).join(', ')}. Publish the sibling(s) first or include them in --filter — a staged disk version is not a shipped one.`,
+        });
+        continue;
+      }
+    }
+
     // Pre-publish claim-check gate. Default `'warn'` per ADR-001: publishing SURFACES a
     // README's untagged claims by default, but `'warn'` NEVER changes publish status, so the
     // existing publish path is unaffected. `'error'` fails only THIS package when it carries a
@@ -405,6 +501,7 @@ export function publishPackages(
 
     if (opts.dryRun) {
       results.push({ name: pkg.name, oldVersion, newVersion, status: 'skipped', claimCheck: claimCheckSummary });
+      landedInBatch.add(pkg.name); // preview: this package passed its gates and WOULD land
       continue;
     }
 
@@ -511,6 +608,7 @@ export function publishPackages(
       });
 
       results.push({ name: pkg.name, oldVersion, newVersion, status: 'published', claimCheck: claimCheckSummary });
+      landedInBatch.add(pkg.name); // only an ACTUAL publish covers dependents (Codex P1)
     } catch (err) {
       // The version was written BEFORE build+publish; on any failure restore the
       // original package.json (and README, if we rewrote its version) so a failed

package/src/recall-hook-policy.ts

@@ -26,7 +26,9 @@
  *   where an irrelevant English one reaches 0.254. A single floor still works, with a thin 0.032
  *   margin; per-language floors triple it. Hence the defaults below.
  *
- * The turns that must stay silent do: `"спасибо"` scores 0.259, `"какой статус?"` 0.318 — both under
+ * The turns that must stay silent do (2026-07-09 numbers; re-measured 2026-08-24 — «спасибо» rose
+ * to 0.416 but is cut by the SIGNAL gate before any floor, and «какой статус?» rose to 0.386, which
+ * is what forced the recalibration above): both under
  * every floor here.
  *
  * @packageDocumentation
@@ -46,7 +48,18 @@ export interface RecallFloors {
  * slightly closer to any Latin text than two unrelated Latin texts are to each other — the baseline,
  * not the signal, is what shifts.
  */
-export const DEFAULT_RECALL_FLOORS: RecallFloors = { ru: 0.38, en: 0.31 };
+// RECALIBRATED 2026-08-24 on the LIVE 281-pattern store, end to end through `dz recall --json`
+// (the closeness feature made the true cosine visible, which is what exposed the drift): over the
+// probes that actually REACH the floor — the signal gate cuts "спасибо"/"thanks" first —
+//   ru: min(relevant)=0.409, max(irrelevant)=0.386 ("какой статус?", ABOVE the old 0.38 floor);
+//   en: min(relevant)=0.413, max(irrelevant)=0.332 (nonsense scored 0.327, above the old 0.31).
+// The 2026-07-09 floors were calibrated on 103 patterns; at 281 the irrelevant tail rose. The RU
+// window is now THIN (+0.023) — an honest limit, not a solved problem: it narrows again as the
+// store grows, and the next recalibration should follow the next major store growth.
+// en is 0.36 rather than the live midpoint 0.37 because the hermetic fixture's weakest relevant
+// probe sits at 0.369, and a floor above it would fail the calibration test that guards this file.
+// Probe set + raw results: test/fixtures/recall-floor-live-2026-08-24.json.
+export const DEFAULT_RECALL_FLOORS: RecallFloors = { ru: 0.40, en: 0.36 };
 
 /** Max hits injected into a turn. Three is the ADR default; more is noise, not context. */
 export const DEFAULT_RECALL_HOOK_LIMIT = 3;

package/src/recall-usage.ts

@@ -18,7 +18,7 @@
 // ReferenceError into `appendRecallUsage`'s own catch and returned **0 rows appended, silently**.
 // The Codex recall leg looked wired and correctly-silent for exactly the reason AM-4's forced-hit
 // canary exists to expose. Importing node: modules at the top costs nothing — they are built in.
-import { appendFileSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readSync } from 'node:fs';
+import { appendFileSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 
 import {
@@ -718,3 +718,46 @@ function readLogTailSync(file: string): LogTail {
     return EMPTY_LOG_TAIL;
   }
 }
+
+/**
+ * Recall events recorded for one run key — DISTINCT prompts, not rows.
+ *
+ * Why this exists: the /feature-adr live panel asserted `--recalled 3` as a LITERAL at three call
+ * sites, because the fallback writer that lights the panel had nowhere to get a real number. Now
+ * that `dz recall` records its own reads, the number is derivable — this is the derivation.
+ *
+ * Counted by `eventId`, not by row: one prompt that surfaced four lessons writes four rows sharing
+ * one eventId, and "recalled 4" would overstate what the operator did by a factor of hits-per-query.
+ * Rows predating eventIds (the log's schema grew) count one each — their rows WERE one-per-event.
+ *
+ * Returns null when the log cannot be read — the caller must record "unknown", never zero: an
+ * unreadable log and a run that recalled nothing are different facts (the dz sync 0/0 class).
+ */
+export function countRecallEventsForRun(projectRoot: string, runId: string): number | null {
+  const wanted = runId.trim();
+  if (wanted === '') return null;
+  const path = join(projectRoot, ...RECALL_USAGE_LOG_RELATIVE.split('/'));
+  if (!existsSync(path)) return 0;   // a real, readable absence: nothing has ever been recorded
+  let text: string;
+  try {
+    text = readFileSync(path, 'utf-8');
+  } catch {
+    return null;
+  }
+  const events = new Set<string>();
+  let preEventRows = 0;
+  for (const line of text.split('\n')) {
+    if (line.trim() === '') continue;
+    let row: Record<string, unknown>;
+    try {
+      row = JSON.parse(line) as Record<string, unknown>;
+    } catch {
+      continue;   // a torn row is the chain verifier's business, not a reason to fail the count
+    }
+    if (row['runId'] !== wanted) continue;
+    const ev = row['eventId'];
+    if (typeof ev === 'string' && ev !== '') events.add(ev);
+    else preEventRows += 1;
+  }
+  return events.size + preEventRows;
+}

package/src/score.ts

@@ -76,7 +76,12 @@ const NEGATION_RE = /\b(no|not|never|without|wasn'?t|isn'?t)\b/i;
  * `\bno\b` does NOT match "Nothing". Hedges like "skipped" stay out of both lists — they routinely
  * appear inside genuine evidence lines.
  */
-const NEGATION_QUANTIFIED_RE = /\b(no|not|never|without|nothing|none|neither|nor|nobody|wasn'?t|isn'?t)\b/i;
+// RU negation quantifiers joined 2026-08-24 with the RU live-markers (773185ca): a corpus where
+// 63% of traffic is Russian was screened by an English-only list — «ничего не измерено» would have
+// read as a live marker the moment ИЗМЕРЕНО joined the positives.
+// \b is ASCII-only in JS even under /u — «не» never matched through it (measured by the pin the
+// moment it was written). Unicode lookarounds carry the boundary instead.
+const NEGATION_QUANTIFIED_RE = /\b(no|not|never|without|nothing|none|neither|nor|nobody|wasn'?t|isn'?t)\b|(?<![\p{L}\p{N}])(не|нет|ни одного|ничего|никогда|без)(?![\p{L}\p{N}])/iu;
 
 function evidenceLinePositive(text: string, re: RegExp, negationRe: RegExp = NEGATION_RE): string | null {
   for (const line of text.split('\n')) {
@@ -137,7 +142,25 @@ export interface GradeReading {
  */
 export function readQeGrade(qeText: string): GradeReading {
   const found: string[] = [];
+  const lines = qeText.split('\n');
+  // Line offsets once, so each match maps to ITS line for the negation screen (67d7883d: the
+  // parser was negation-blind — «No Grade: B was assigned» contributed B and a cross-model PASS;
+  // the display-locator fix could not reach this because the GRADE rests here). The same
+  // deliberate trade as evidenceLinePositive: a genuine grade on a line that happens to carry a
+  // negation is SKIPPED (visible in `found`'s absence) rather than a negated line being COUNTED.
+  const lineStarts: number[] = [0];
+  for (let i = 0; i < lines.length - 1; i++) lineStarts.push((lineStarts[i] as number) + (lines[i] as string).length + 1);
+  // The screen covers the line PREFIX up to the match, not the whole line: «No Grade: B was
+  // assigned» negates BEFORE the grade; «**Grade: B** — no blockers remain» carries its negation
+  // AFTER, about something else entirely, and whole-line screening dropped that real, common
+  // phrase (caught by the standing display-locator pin the moment the sweep was «completed»).
+  const linePrefixOf = (idx: number): string => {
+    let lo = 0, hi = lineStarts.length - 1;
+    while (lo < hi) { const mid = (lo + hi + 1) >> 1; if ((lineStarts[mid] as number) <= idx) lo = mid; else hi = mid - 1; }
+    return qeText.slice(lineStarts[lo] as number, idx);
+  };
   for (const m of qeText.matchAll(new RegExp(GRADE_RE.source, 'g'))) {
+    if (NEGATION_QUANTIFIED_RE.test(linePrefixOf(m.index ?? 0))) continue;
     const g = normaliseGradeSign(m[1] as string);
     if (!found.includes(g)) found.push(g);
   }
@@ -226,14 +249,17 @@ export function scoreRun(slug: string, artifacts: RunArtifacts): RunScorecard {
   //    report is the cautionary case: "✅ (mechanism)" with no live evidence shipped a dead feature.
   //    POSITIVE (wave1-scorer-negation): "nothing was MEASURED" / "no reproducer was run" is the
   //    claim's exact opposite and used to score as proof of it (the crossrt-1 6/7 shape).
-  const live = evidenceLinePositive(qeText, /MEASURED|verified live|VERIFIED LIVE|reproducer/i, NEGATION_QUANTIFIED_RE);
+  // 773185ca: MEASURED-class markers in BOTH working languages. dz-recap carried 10× ИЗМЕРЕНО and
+  // 0× MEASURED and scored «всё выведено рассуждением» — the cyrillic-tokenizer class again.
+  const LIVE_MARKER_RE = /MEASURED|verified live|VERIFIED LIVE|reproducer|ИЗМЕРЕНО|МЕРЕНО|измерено|проверено живьём|живой прогон|репродьюсер/iu;
+  const live = evidenceLinePositive(qeText, LIVE_MARKER_RE, NEGATION_QUANTIFIED_RE);
   const liveAnywhere =
-    live ?? evidenceLinePositive(allText, /MEASURED|verified live|VERIFIED LIVE|reproducer/i, NEGATION_QUANTIFIED_RE);
+    live ?? evidenceLinePositive(allText, LIVE_MARKER_RE, NEGATION_QUANTIFIED_RE);
   add(
     'live-verification',
     'claims verified by running, not by reasoning',
     live !== null ? 'pass' : liveAnywhere !== null ? 'partial' : 'absent',
-    live ?? liveAnywhere ?? 'no MEASURED / verified-live / reproducer marker anywhere — every claim is inferred',
+    live ?? liveAnywhere ?? 'no MEASURED/ИЗМЕРЕНО/verified-live/reproducer marker anywhere — every claim is inferred',
   );
 
   // 5. README-first — the docs travelled in the same change.

package/src/skill-drift.ts

@@ -21,9 +21,11 @@
  */
 
 import { readdirSync, statSync, readFileSync, writeFileSync, mkdirSync, rmSync, existsSync } from 'node:fs';
-import { join, relative, resolve, dirname, basename } from 'node:path';
+import { join, relative, resolve, dirname, basename, sep } from 'node:path';
 import { createHash } from 'node:crypto';
 
+import { DEV_SKILL_ROOT, SKILL_INSTALL_ROOTS, TARGET_ENRICHMENT_ASSETS } from './skill-install-roots.js';
+
 /** One shared skill whose copies byte-differ (`driftFiles > 0`). */
 export interface DriftedSkill {
   /** Skill dir basename (e.g. `goap-research-ed25519`). */
@@ -48,9 +50,15 @@ export interface SweepOptions {
    *   `.claude/skills/<skill>` dev copies are excluded — the repo's own `dz sync` test treats them as
    *   "legitimately lagging" the published version, so counting them makes the gate red-on-arrival.
    *   The dangerous drift (goap, brutal-honesty) was always between PUBLISHED packages.
-   * - `'all'`: packages + `.claude/skills` (the raw sweep the audit script does).
+   * - `'installs'` (what the `no-skill-drift` HARD rule uses): packages + every per-target install
+   *   root EXCEPT {@link DEV_SKILL_ROOT}. Machine-generated installs have no licence to lag, so
+   *   holding them to byte-identity is a gate that can actually be satisfied — unlike `'all'`,
+   *   which includes the hand-edited dev tree and is therefore red-on-arrival as a gate.
+   * - `'all'`: packages + EVERY per-target skills install root ({@link SKILL_INSTALL_ROOTS}) — the
+   *   raw sweep the audit script does. A root that is absent, or present without a `SKILL.md`,
+   *   contributes nothing, so this is inert for a repo that installs only one target.
    */
-  readonly scope?: 'packages' | 'all';
+  readonly scope?: 'packages' | 'installs' | 'all';
   /** Skill basenames whose drift is ACCEPTED (documented intentional forks) — reported separately, never counted as gate drift. */
   readonly allowlist?: readonly string[];
 }
@@ -144,9 +152,42 @@ function walk(dir: string): string[] {
  * so BOTH the CI sweep AND the canonical-free `sync-canonical --check` share one implementation and
  * yield the same verdict. Behavior-preserving refactor — no numbers change.
  */
+/**
+ * Is this skill-dir-relative path a TARGET ENRICHMENT asset ({@link TARGET_ENRICHMENT_ASSETS})?
+ *
+ * Such a file exists in ONE copy by design — `dz init --enrich` writes it into the install tree and
+ * the canonical never has it. Counting it as drift makes the gate unsatisfiable; removing it during
+ * a heal destroys valid output. Compared with POSIX separators so a Windows `relative()` still matches.
+ */
+function isEnrichmentAsset(rel: string, copyDir: string): boolean {
+  const owner = TARGET_ENRICHMENT_ASSETS[rel.split(sep).join('/')];
+  if (owner === undefined) return false;
+  // The exemption is only valid inside the root that OWNS the asset. Elsewhere the same filename is
+  // a misplaced extra file, and waving it through would make the sweep report clean while the healer
+  // preserved it. ANCHORED at the skill dir, not searched across the whole absolute path: a repo that
+  // itself lives under a directory containing `/.agents/skills/` would otherwise have every copy in
+  // it — packages included — classified as codex-owned (cross-family review, 2026-08-25).
+  const posix = copyDir.split(sep).join('/');
+  return posix.endsWith('/' + owner + '/' + posix.split('/').slice(-1)[0]);
+}
+
+/**
+ * The canonical's own file list, with every enrichment-asset NAME removed regardless of where the
+ * canonical came from. A canonical picked by `--auto` (or handed in with `--from`) can itself be an
+ * enriched install copy; propagating its target-specific metadata into the package and other target
+ * copies is never correct, and the exemption above would then stop it ever being cleaned up.
+ */
+function withoutEnrichmentNames(rels: readonly string[]): string[] {
+  return rels.filter((r) => TARGET_ENRICHMENT_ASSETS[r.split(sep).join('/')] === undefined);
+}
+
 function comparePeers(copies: readonly string[]): { driftFiles: number; missingFiles: number; totalFiles: number } {
   const relFiles = new Set<string>();
-  for (const c of copies) for (const f of walk(c)) relFiles.add(relative(c, f));
+  for (const c of copies) for (const f of walk(c)) {
+    const rel = relative(c, f);
+    if (isEnrichmentAsset(rel, c)) continue;
+    relFiles.add(rel);
+  }
 
   let driftFiles = 0;
   let missingFiles = 0;
@@ -172,7 +213,10 @@ function comparePeers(copies: readonly string[]): { driftFiles: number; missingF
  * hence it is only ever reached behind an explicit `--auto` opt-in plus a loud warning.
  */
 function pickMostComplete(copies: readonly string[]): string {
-  return [...copies].sort().reduce((best, c) => (walk(c).length > walk(best).length ? c : best));
+  // Enrichment assets do not make a copy more COMPLETE — they make it a target install. Counting
+  // them would let an enriched copy win the heuristic on files no other copy is supposed to have.
+  const size = (d: string): number => withoutEnrichmentNames(walk(d).map((p) => relative(d, p))).length;
+  return [...copies].sort().reduce((best, c) => (size(c) > size(best) ? c : best));
 }
 
 /**
@@ -198,12 +242,24 @@ function resolveCanonical(
 }
 
 /**
- * Every skill dir (a dir containing `SKILL.md`) under `packages/` + `.claude/skills`, excluding
- * `node_modules` / `__pycache__`. Ported verbatim from `scripts/drift-sweep-skills.mjs`.
+ * Every skill dir (a dir containing `SKILL.md`) under `packages/` + every per-target install root
+ * in {@link SKILL_INSTALL_ROOTS}, excluding `node_modules` / `__pycache__`. Originally ported from
+ * `scripts/drift-sweep-skills.mjs`, which searched `.claude/skills` alone — see ADR-001
+ * (skill-copy-discovery) for why one hardcoded root let the Codex install drift unseen.
  */
-function findSkillDirs(root: string, scope: 'packages' | 'all' = 'all'): string[] {
+function findSkillDirs(root: string, scope: 'packages' | 'installs' | 'all' = 'all'): string[] {
   const dirs: string[] = [];
-  const roots = scope === 'packages' ? [join(root, 'packages')] : [join(root, 'packages'), join(root, '.claude', 'skills')];
+  // Roots are ANCHORED at the repo root — never a recursive search for `*/skills`. A stale agent
+  // worktree under `.claude/worktrees/<id>/` holds a full second copy of `packages/`,
+  // `.claude/skills` AND `.agents/skills`; a recursive sweep would report every skill in the repo
+  // as drifting against a checkout nobody maintains, and the healer would be entitled to WRITE
+  // into it (ADR-001, Option C rejected on exactly this measurement).
+  const installRoots = scope === 'installs'
+    ? SKILL_INSTALL_ROOTS.filter((r) => r !== DEV_SKILL_ROOT)
+    : SKILL_INSTALL_ROOTS;
+  const roots = scope === 'packages'
+    ? [join(root, 'packages')]
+    : [join(root, 'packages'), ...installRoots.map((r) => join(root, ...r.split('/')))];
   const stack = roots.filter((p) => existsSync(p));
   while (stack.length) {
     const d = stack.pop() as string;
@@ -322,9 +378,7 @@ export function syncCanonicalSkill(root: string, skill: string, opts: SyncCanoni
     return { canonical: '', canonicalExists: false, resolvedFrom, copies: allCopies.length, synced: 0, drifted: 0, wrote: [] };
   }
 
-  const canonFiles = walk(canonical)
-    .map((p) => relative(canonical, p))
-    .sort();
+  const canonFiles = withoutEnrichmentNames(walk(canonical).map((p) => relative(canonical, p))).sort();
 
   // Every <skill>/ dir except the canonical itself.
   const copies = allCopies.filter((d) => relative(canonical, d) !== '');
@@ -334,7 +388,10 @@ export function syncCanonicalSkill(root: string, skill: string, opts: SyncCanoni
   const wrote: string[] = [];
 
   for (const copy of copies) {
-    const copyFiles = new Set(walk(copy).map((p) => relative(copy, p)));
+    // Target ENRICHMENT assets are excluded from the copy's file set entirely: they exist in the
+    // install tree by design, the canonical never has them, and both the drift verdict and the
+    // removal pass below must leave them alone.
+    const copyFiles = new Set(walk(copy).map((p) => relative(copy, p)).filter((f) => !isEnrichmentAsset(f, copy)));
     let differs = false;
     // Extra files in the copy not present in canonical ⇒ drift.
     for (const f of copyFiles) if (!canonFiles.includes(f)) differs = true;

package/src/skill-install-roots.ts

@@ -0,0 +1,119 @@
+/**
+ * Where installed skill dirs live — the single source of truth for skill-copy DISCOVERY.
+ *
+ * The harness installs skills into a per-TARGET tree (`dz install --target <name>`). Five of the
+ * ten targets in {@link TARGET_NAMES} emit an agentskills.io-shaped directory containing a
+ * `SKILL.md`; the other five (copilot, cursor, windsurf, gemini, agents-md) emit rules/instructions
+ * FILES and therefore hold no skill dirs to keep in sync.
+ *
+ * | Target | Root | Adapter constant |
+ * |---|---|---|
+ * | `claude-code` | `.claude/skills` | — (the adapter exports no root constant) |
+ * | `codex` | `.agents/skills` | `CODEX_SKILLS_ROOT` |
+ * | `opencode` | `.opencode/skills` | `OPENCODE_SKILLS_ROOT` |
+ * | `hermes` | `.hermes/skills` | `HERMES_SKILLS_ROOT` |
+ * | `openclaude` | `.openclaude/skills` | `OPENCLAUDE_SKILLS_ROOT` |
+ *
+ * **Why this list is data with no imports.** `skill-drift.ts` — the drift detector behind the
+ * `no-skill-drift` HARD guard rule — is deliberately dependency-free (`node:fs`/`node:path`/
+ * `node:crypto`). `targets.ts`, which owns the adapter registry, imports all ten adapter packages;
+ * importing it from the drift sweep would drag ten packages into the guard's load path for a list
+ * of five strings. So the list lives here as data, and the link back to the adapters is asserted in
+ * `test/skill-install-roots.test.ts`, where importing them costs nothing.
+ *
+ * **Why this matters (the defect that produced it, MEASURED 2026-08-25).** `findSkillDirs` searched
+ * `packages/` + `.claude/skills` only. `.agents/skills/feature-adr` — the Codex install — drifted
+ * from the canonical for a day while `dz sync-canonical feature-adr --check` reported "all 3 copies
+ * match canonical" and the HARD guard passed. Two feature-adr gates were degraded in that copy: the
+ * K1 name-availability section was missing from `SKILL.md`, and the C6 amendment-integrity check
+ * was missing from the K2 script. A gate that cannot see a copy cannot gate it.
+ *
+ * **Honest limit.** A target whose adapter exports no root constant (today: `claude-code`) must be
+ * listed here by hand — the completeness test proves every EXPORTED constant is covered, and cannot
+ * prove a constant that does not exist is covered.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Files a TARGET legitimately adds INSIDE an installed skill dir — enrichment, not drift.
+ *
+ * `dz init --enrich` / `dz setup --enrich` write per-target metadata into the skill dir itself
+ * (`operations.ts`): codex gets `<skillDir>/agents/openai.yaml` (UI metadata + risk scoring),
+ * hermes gets `<skillDir>/hermes-config.yaml`. OpenCode's enrichment lands in
+ * `.opencode/agents/<id>.md`, OUTSIDE any skill dir, so it needs no entry here.
+ *
+ * These paths must be invisible to the drift comparison and untouchable by the healer. Without the
+ * exemption, widening discovery to install roots would (a) report permanent, unfixable drift on any
+ * enriched install — making the HARD gate unsatisfiable — and (b) worse, let `dz sync-canonical`
+ * DELETE the enrichment, because the heal removes every file the canonical does not have. Found by
+ * cross-family review (Codex `gpt-5.6-sol`, 2026-08-25) on a latent defect: this repo's own
+ * `.agents/` install was never enriched, so no test and no live run would have shown it.
+ *
+ * Each asset is mapped to the install root that OWNS it, because the exemption must depend on WHERE
+ * the file sits, not only on its name: `agents/openai.yaml` under a package copy, or
+ * `hermes-config.yaml` outside the hermes root, is a misplaced file — waving it through would let
+ * the sweep report clean and the healer preserve it (second cross-family round, 2026-08-25).
+ *
+ * Keys are relative to the skill dir root and POSIX-separated; values are repo-root-relative install
+ * roots from {@link SKILL_INSTALL_ROOT_BY_TARGET}.
+ */
+export const TARGET_ENRICHMENT_ASSETS: Readonly<Record<string, string>> = {
+  'agents/openai.yaml': '.agents/skills',
+  'hermes-config.yaml': '.hermes/skills',
+};
+
+/**
+ * The one install root that is ALSO the repo's hand-edited development tree.
+ *
+ * `.claude/skills` is where this repo's own skills are authored before they are synced into
+ * `packages/`, so it legitimately LAGS the published copies — MEASURED 2026-08-25, `dz drift-check
+ * --all` reports three skills drifting for exactly that reason (`decision-mockups` 12/22 files,
+ * `idea2prd-manual` 3/11, `observability` 1/5). A byte-identity GATE that included it would be
+ * red-on-arrival, which is why `scope: 'packages'` exists at all.
+ *
+ * Every OTHER root in {@link SKILL_INSTALL_ROOTS} is machine-generated by `dz install --target …`
+ * and has no licence to lag: a stale generated copy is the defect this module was written for.
+ * That asymmetry is what `scope: 'installs'` encodes.
+ */
+export const DEV_SKILL_ROOT = '.claude/skills';
+
+/**
+ * Every `--target` name → the repo-root-relative dir into which it installs `SKILL.md`-bearing
+ * skill dirs, or `null` for a target that emits rules/instructions FILES and therefore holds no
+ * skill dirs to keep in sync.
+ *
+ * **This map, not the derived list, is the thing a new target must touch.** Its keys are asserted
+ * against `TARGET_NAMES` in `test/skill-install-roots.test.ts`, so adding target #11 turns that
+ * test RED until someone states whether it installs skill dirs — which is exactly the question
+ * nobody was asked when `codex` was added and its install tree went ungated. A test that
+ * hand-enumerated the adapter constants would have stayed green through that (raised by
+ * cross-family review, Codex `gpt-5.6-sol`, 2026-08-25).
+ *
+ * Kept as a literal with NO imports: `skill-drift.ts` consumes it and is documented dependency-free,
+ * while `targets.ts` — which owns the adapter registry — pulls in all ten adapter packages.
+ */
+export const SKILL_INSTALL_ROOT_BY_TARGET: Readonly<Record<string, string | null>> = {
+  'claude-code': '.claude/skills',
+  codex: '.agents/skills',
+  opencode: '.opencode/skills',
+  hermes: '.hermes/skills',
+  openclaude: '.openclaude/skills',
+  // Rules/instructions FILE targets — no skill dirs, nothing to compare.
+  copilot: null,
+  'agents-md': null,
+  cursor: null,
+  gemini: null,
+  windsurf: null,
+};
+
+/**
+ * Repo-root-relative directories that hold installed `SKILL.md`-bearing skill dirs — DERIVED from
+ * {@link SKILL_INSTALL_ROOT_BY_TARGET} so the two can never disagree. POSIX separators; consumers
+ * `join()` them onto the repo root themselves.
+ *
+ * Consumed by `findSkillDirs` (`skill-drift.ts`). A root that does not exist, or exists without any
+ * `SKILL.md`, contributes nothing — so listing a root the current repo does not use is inert.
+ */
+export const SKILL_INSTALL_ROOTS: readonly string[] = Object.values(SKILL_INSTALL_ROOT_BY_TARGET)
+  .filter((r): r is string => r !== null);