@dzhechkov/harness-core 0.7.5 → 0.7.6

package/sbom.json

@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e4b3fb2b1f94a81266e077a192da27dcab830172599703c4495746f560a41f07"
+          "content": "6e0c7dc75ea18f37464949db1871dc6ab7a97b23e9dfff9af37bcdf19f4fbc83"
         }
       ]
     },
@@ -1445,7 +1445,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ceb6662e21993cad25708c438410ad1b2d81eb05e59cae62c239719b71ac5107"
+          "content": "8ee50d5067b71b1d68c57dd8c5f0f0a327ffc282755a13d17565613b9d036f92"
         }
       ]
     },
@@ -1455,7 +1455,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "aaff9f23dec9c15c4d3cc74d13a5704649a305514c9e621100381ecf1c4f4143"
+          "content": "ccc9f6d9ce8ba5699010c5b590fef6509d80ed928043b8747f5c52980d5c0596"
         }
       ]
     },
@@ -1465,7 +1465,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "283d55283adbfe3a358b0f2e48cb05af47468274aa251a0f3419acd284937794"
+          "content": "b8bfd4707746ca1ded26c2ccc9a4afbe5a9acf529b74e128dadced1631d1adde"
         }
       ]
     },
@@ -1635,7 +1635,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "76a367dc0bab660eac680001e5b2f4441fd7961a4d1bb540757244459dbba7f0"
+          "content": "4eadcf12e18ccfbe77f857d71e52b29d51b35ee8bb9bbdf3a34cfb6724826c10"
         }
       ]
     },
@@ -1645,7 +1645,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4d113675e5deda687e50ec4c5df54611497469187f6725236ba62dd2f9d0a7ed"
+          "content": "de6cd5f7de860105804f100e487b65a78f2edd67a40645a710ad81c12e1c5b72"
         }
       ]
     },
@@ -1655,7 +1655,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "368927d5b439f5180bd0f49820d8d598eaae1679bd5fd91af6a9a0a78e08d7c0"
+          "content": "bdb6933fa24b0e02ed293fe4e9c52910e2ed4f5652ea7bcb0dbbb7dc996cc224"
         }
       ]
     },
@@ -1665,7 +1665,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d3ee98a0953cf6134331cc1a31bd959fbcf83313bd93973d58125164fe04f7b7"
+          "content": "b47db4310de5fd7a586e795e10abe108e18cd164d1cb1862e67c227310a68001"
         }
       ]
     },
@@ -2555,7 +2555,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "25497c798af7e7b614acea014826873c3db41232bdbda57399814b5b8b2e2687"
+          "content": "0531b606a3f4450741ec80efbcb9c32ff0a925496e85e4071cb395eeeeaf9dfb"
         }
       ]
     },
@@ -2565,7 +2565,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ec7f64eb9a3938a446beba21cf1134e901522c87e69639ba2d27fa161a9f0236"
+          "content": "edefc472f25e03e14d27545cd3fbc0a78e59cee49e4cddc397d0f05321feac22"
         }
       ]
     },
@@ -2575,7 +2575,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "09bf8999ae95138b5fe21e70af3642cb6bea0593365108e8756e820f53c6aafc"
+          "content": "a5656ebc2049c324ebe7707e1263beb16ceb0875ee078353203e346eb67fff42"
         }
       ]
     },
@@ -2585,7 +2585,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "db6c50a2c5cbba8dc47671bd540740ed8e3bfbc742a51d9dd3a4ecc343ff32a8"
+          "content": "74f4d718f0ca68857448c043eb8f439c841604db64ee2d799ddec9f66dc15556"
         }
       ]
     },
@@ -3555,7 +3555,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "cbbf348e4693f5d8bbffa9b53b014f414121b04efcd71a3c9af185d78fc29227"
+          "content": "01cc22fc645fc6656d6dd5d32d124a6d2ffe29130724a2142c3e12b84b891378"
         }
       ]
     },
@@ -3565,7 +3565,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "086c9da449289de56c0267c45b6dfc88ef924e5377d6da93216fde2b6c91f8d3"
+          "content": "c6ab4133ae6464684e14f619cd8175adec744bb775e9724bfd0808752a62692b"
         }
       ]
     },
@@ -3575,7 +3575,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8897f3f2cb32e671477bfb8f803e69aae64f3944594e1d33ebfbb5fea910d223"
+          "content": "dfa4e1ef2b211af0957cea622c6066891c34452b4f9092bc143350b150ff6708"
         }
       ]
     },
@@ -3585,7 +3585,47 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "fe02423ea0ca2460f97cfa47ff6f9c564106920fae151a8552ce4520ab4a463f"
+          "content": "51ced5700c3efafbb1de270302a789578e80cf80d4859190f5ecdb646378a479"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/skill-install-roots.d.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "7aebdacaa5d1641e739628049a5bfcc94d5191bc62dfc70744906c579d0bf52c"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/skill-install-roots.d.ts.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "948876ad8b0b1cab37d52957e0ffa69afd18a3154a6204f85159e748ed2c3830"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/skill-install-roots.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "5e218e069af73918ab7d028ce7694640e0cc506f714608873c6b1138587bed1b"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "dist/skill-install-roots.js.map",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "6f46e1622b721bb009e7da347487af5a730279cdd26a712d34ed885c366bfebc"
         }
       ]
     },
@@ -3875,7 +3915,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b07d9ab76b98d7fe7c0d576e8a027681d2ee134b93fc7e4faaa411a088f1776b"
+          "content": "f05456c49df6e2c4e5162a95b879a71fc2a89f509f2e1c94fd9cae926ef761f0"
         }
       ]
     },
@@ -3885,7 +3925,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "282906840e019b31b8e4749e21e3e858378bdf72a0f71045546461c0e320137b"
+          "content": "4c2311420512b9e7d61a8eef321a0ed7704428b5b5daaaaba09ac09e2040dfa6"
         }
       ]
     },
@@ -3895,7 +3935,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "dd60c66726cfe835f80e9e3a1714df8364814fbca6fcee82b397960a7ad092c8"
+          "content": "c30c63f093e12f152b9d4eac12e1b3921d2f81a27cac062dd783e9a7d91663cf"
         }
       ]
     },
@@ -3905,7 +3945,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9c1c302f824a99de31ddafad8780e7369a61903cc81e1d0a8bbabab05a22a493"
+          "content": "e698d6514ca71031acce40edf875cf0fd2c7acabf3ab336601abec26a0f0bd86"
         }
       ]
     },
@@ -4275,7 +4315,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "57cb5a9676f0013a407ad3b7afb9915da56b37447bd4bd3806a8c63415f9c563"
+          "content": "18c9057f70d27a1c2183677a0e74a1e032a153b28d0d9292439ed294ab6104d9"
         }
       ]
     },
@@ -4635,7 +4675,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4431a710b1d5d6a025aab2d7790eb1cb46816a0332c5e45637467036f7ac8f37"
+          "content": "4a2d4c4c9c952521e0265fc62a01de3a7cd277c1c9eab8be252532bb72d0ae96"
         }
       ]
     },
@@ -4685,7 +4725,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d75e2db8aacda1d4a5c0271721a08da0bedee0a9d293396ddfc71229c3c5cb9f"
+          "content": "18a9f1e7f84b56f0c7aa23b096a15c414418ecdd4fafc2f29d38d6dcbf761c84"
         }
       ]
     },
@@ -4915,7 +4955,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d76e4adf1de495beb6c30cc665c17a7d9a43657fb4e1ec0640208b1617a22cb6"
+          "content": "09930294d2b7fcd2938c15b8d8a62a9d1615c064a2479cae1918e0ea4d4ba045"
         }
       ]
     },
@@ -5155,7 +5195,17 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ced99bc1638fbc2a54c61182b06f5f014018c945fd1dd84720bcef3597442ad4"
+          "content": "64814af9f30ed22e5b3e77e01c73b06995092ca54ac84d8cea327cd1b25402d3"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "src/skill-install-roots.ts",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "513710bca94206f9f50abfcf0bd934b315a5af97cad4f5f302b2559d5821848f"
         }
       ]
     },
@@ -5235,7 +5285,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "33ef88f037ea2e34b41836d04f21812fea743022dcbd30f51361c696ddc46e9a"
+          "content": "003d420be10bd0dd61eb6fe5c724d5de6d0c02b72e37bbae5a57c269545e3abb"
         }
       ]
     },

package/src/feature-adr-routing.ts

@@ -2029,7 +2029,12 @@ export function planCompletenessGateCmd(repo: string, featureDir: string, tier?:
     // and the tried paths live OUTSIDE the verdict line so no path can smuggle a second verdict word
     // into it.
     'echo "K2_GATE_SCRIPT=${GS:-none}"',
-    'echo "K2_GATE_TRIED=${C1:-(none)} | $C2 | $C3"',
+    'echo "K2_GATE_TRIED=C1(args.gateScript)=${C1:-<unset>} | C2(workspace)=$C2 | C3(target-repo)=$C3"',
+    // A COLLAPSE is not a second candidate. When the workspace was not pinned, WS falls back to the
+    // gate agent own cwd — in the field that WAS the target repo, so C2 and C3 printed the same path
+    // twice and the chain silently degenerated from three candidates to two. Saying so turns a
+    // puzzling duplicate into an instruction. Not verdict-shaped, so the parser anchoring is untouched.
+    '[ "$C2" = "$C3" ] && echo "K2_GATE_NOTE=the workspace candidate resolved to the TARGET repo (WS==repo), so only two distinct candidates were tried; pass args.workspace or args.gateScript when the feature-adr skill is installed outside the target repo"',
     'if [ -z "$GS" ]; then echo "K2 plan-completeness: NOT-ESTABLISHED — tooling-missing: no gate script at any candidate on the K2_GATE_TRIED line above"; echo "K2_EXIT=3"; else cd ' + q(repo) + ' && node "$GS" ' + q(featureDir) + t + ' 2>&1; echo "K2_EXIT=$?"; fi',
   ].join('\n')
 }

package/src/index.ts

@@ -76,6 +76,7 @@ export type { CreateSkillOptions, CreateSkillResult } from './create-skill.js';
 export { checkUpstream, checkAllUpstream, discoverSourcePackages, loadSourcesManifest } from './sync-upstream.js';
 export type { SyncUpstreamReport, UpstreamCheckResult, SourcesManifest, SourcePackageInfo } from './sync-upstream.js';
 export { sweepSkillDrift, syncCanonicalSkill } from './skill-drift.js';
+export { SKILL_INSTALL_ROOTS, SKILL_INSTALL_ROOT_BY_TARGET, DEV_SKILL_ROOT, TARGET_ENRICHMENT_ASSETS } from './skill-install-roots.js';
 export type { SweepResult, DriftedSkill, SyncResult, SyncCanonicalOptions } from './skill-drift.js';
 export { benchmarkSkill, benchmarkSkills, compareSkills } from './benchmark.js';
 export { buildRegistry, searchRegistry, filterByCategory, skillPackBaseDirs, discoverSkillPackDirs, discoverVerifiablePackDirs } from './registry.js';

package/src/provenance.ts

@@ -25,6 +25,12 @@ export type SourceVerdict =
   | 'no-source'
   /** The manifest did not declare what kind of source this is — never inferred from its shape. */
   | 'unknown-kind'
+  /** A PUBLIC external web URL (http/https). It is already public by construction, so it cannot
+   *  "leave this machine" — nothing local to protect. Refused only if the URL is malformed. */
+  | 'public-url'
+  /** A `url` claim whose value is not a well-formed http(s) URL — a scheme this gate will not clear
+   *  (a file://, a bare word, or a non-URL) must not pass as a public web source. */
+  | 'malformed-url'
   /** A store record that the TRACKED public list does not name. Default-deny. */
   | 'not-marked-public'
   /** The path does not resolve. You cannot cite what does not exist. */
@@ -164,6 +170,18 @@ export function classifySource(claim: SourceClaim, facts: SourceProvenanceFacts)
     return at('allowed', 'committed, reviewed, and not refused by the owner\'s boundary');
   }
 
+  if (claim.kind === 'url') {
+    // The channel translates OTHERS' public tweets/posts; their sources are PUBLIC web URLs. Such a
+    // URL is already public — it cannot leak off this machine, so there is no local secret to
+    // protect (the whole point of the path/record checks). It is cleared iff it is a well-formed
+    // http(s) URL; anything else (file://, a bare path, a non-URL) is refused, never inferred.
+    let ok = false;
+    try { const u = new URL(source); ok = u.protocol === 'http:' || u.protocol === 'https:'; } catch { ok = false; }
+    return ok
+      ? at('public-url', 'a public http(s) web source — already public, nothing local to protect')
+      : at('malformed-url', 'kind "url" but the value is not a well-formed http(s) URL — a public web source must be a real http(s) URL');
+  }
+
   return at('unknown-kind', `the manifest declares kind ${JSON.stringify(claim.kind ?? null)} — a kind this gate cannot check is refused, never inferred from the path's shape`);
 }
 
@@ -187,7 +205,11 @@ export function decideSourceProvenance(manifest: SourceManifest | null, facts: S
     return { outcome: 'not-established', exit: 3, claims: [], reason: 'the manifest lists no claims — a draft with nothing to check has not been shown to be safe, only left unchecked' };
   }
   const claims = manifest.claims.map((c) => classifySource(c, facts));
-  const blocked = claims.filter((c) => c.verdict !== 'allowed');
+  // A claim passes iff its verdict is a CLEARED one: a repo-internal source proven safe (allowed),
+  // or a public web URL that is already public by construction (public-url — the tg-post channel
+  // case). Every other verdict is a refusal.
+  const CLEARED = new Set(['allowed', 'public-url']);
+  const blocked = claims.filter((c) => !CLEARED.has(c.verdict));
   if (blocked.length > 0) {
     return {
       outcome: 'blocked',

package/src/skill-drift.ts

@@ -21,9 +21,11 @@
  */
 
 import { readdirSync, statSync, readFileSync, writeFileSync, mkdirSync, rmSync, existsSync } from 'node:fs';
-import { join, relative, resolve, dirname, basename } from 'node:path';
+import { join, relative, resolve, dirname, basename, sep } from 'node:path';
 import { createHash } from 'node:crypto';
 
+import { DEV_SKILL_ROOT, SKILL_INSTALL_ROOTS, TARGET_ENRICHMENT_ASSETS } from './skill-install-roots.js';
+
 /** One shared skill whose copies byte-differ (`driftFiles > 0`). */
 export interface DriftedSkill {
   /** Skill dir basename (e.g. `goap-research-ed25519`). */
@@ -48,9 +50,15 @@ export interface SweepOptions {
    *   `.claude/skills/<skill>` dev copies are excluded — the repo's own `dz sync` test treats them as
    *   "legitimately lagging" the published version, so counting them makes the gate red-on-arrival.
    *   The dangerous drift (goap, brutal-honesty) was always between PUBLISHED packages.
-   * - `'all'`: packages + `.claude/skills` (the raw sweep the audit script does).
+   * - `'installs'` (what the `no-skill-drift` HARD rule uses): packages + every per-target install
+   *   root EXCEPT {@link DEV_SKILL_ROOT}. Machine-generated installs have no licence to lag, so
+   *   holding them to byte-identity is a gate that can actually be satisfied — unlike `'all'`,
+   *   which includes the hand-edited dev tree and is therefore red-on-arrival as a gate.
+   * - `'all'`: packages + EVERY per-target skills install root ({@link SKILL_INSTALL_ROOTS}) — the
+   *   raw sweep the audit script does. A root that is absent, or present without a `SKILL.md`,
+   *   contributes nothing, so this is inert for a repo that installs only one target.
    */
-  readonly scope?: 'packages' | 'all';
+  readonly scope?: 'packages' | 'installs' | 'all';
   /** Skill basenames whose drift is ACCEPTED (documented intentional forks) — reported separately, never counted as gate drift. */
   readonly allowlist?: readonly string[];
 }
@@ -144,9 +152,42 @@ function walk(dir: string): string[] {
  * so BOTH the CI sweep AND the canonical-free `sync-canonical --check` share one implementation and
  * yield the same verdict. Behavior-preserving refactor — no numbers change.
  */
+/**
+ * Is this skill-dir-relative path a TARGET ENRICHMENT asset ({@link TARGET_ENRICHMENT_ASSETS})?
+ *
+ * Such a file exists in ONE copy by design — `dz init --enrich` writes it into the install tree and
+ * the canonical never has it. Counting it as drift makes the gate unsatisfiable; removing it during
+ * a heal destroys valid output. Compared with POSIX separators so a Windows `relative()` still matches.
+ */
+function isEnrichmentAsset(rel: string, copyDir: string): boolean {
+  const owner = TARGET_ENRICHMENT_ASSETS[rel.split(sep).join('/')];
+  if (owner === undefined) return false;
+  // The exemption is only valid inside the root that OWNS the asset. Elsewhere the same filename is
+  // a misplaced extra file, and waving it through would make the sweep report clean while the healer
+  // preserved it. ANCHORED at the skill dir, not searched across the whole absolute path: a repo that
+  // itself lives under a directory containing `/.agents/skills/` would otherwise have every copy in
+  // it — packages included — classified as codex-owned (cross-family review, 2026-08-25).
+  const posix = copyDir.split(sep).join('/');
+  return posix.endsWith('/' + owner + '/' + posix.split('/').slice(-1)[0]);
+}
+
+/**
+ * The canonical's own file list, with every enrichment-asset NAME removed regardless of where the
+ * canonical came from. A canonical picked by `--auto` (or handed in with `--from`) can itself be an
+ * enriched install copy; propagating its target-specific metadata into the package and other target
+ * copies is never correct, and the exemption above would then stop it ever being cleaned up.
+ */
+function withoutEnrichmentNames(rels: readonly string[]): string[] {
+  return rels.filter((r) => TARGET_ENRICHMENT_ASSETS[r.split(sep).join('/')] === undefined);
+}
+
 function comparePeers(copies: readonly string[]): { driftFiles: number; missingFiles: number; totalFiles: number } {
   const relFiles = new Set<string>();
-  for (const c of copies) for (const f of walk(c)) relFiles.add(relative(c, f));
+  for (const c of copies) for (const f of walk(c)) {
+    const rel = relative(c, f);
+    if (isEnrichmentAsset(rel, c)) continue;
+    relFiles.add(rel);
+  }
 
   let driftFiles = 0;
   let missingFiles = 0;
@@ -172,7 +213,10 @@ function comparePeers(copies: readonly string[]): { driftFiles: number; missingF
  * hence it is only ever reached behind an explicit `--auto` opt-in plus a loud warning.
  */
 function pickMostComplete(copies: readonly string[]): string {
-  return [...copies].sort().reduce((best, c) => (walk(c).length > walk(best).length ? c : best));
+  // Enrichment assets do not make a copy more COMPLETE — they make it a target install. Counting
+  // them would let an enriched copy win the heuristic on files no other copy is supposed to have.
+  const size = (d: string): number => withoutEnrichmentNames(walk(d).map((p) => relative(d, p))).length;
+  return [...copies].sort().reduce((best, c) => (size(c) > size(best) ? c : best));
 }
 
 /**
@@ -198,12 +242,24 @@ function resolveCanonical(
 }
 
 /**
- * Every skill dir (a dir containing `SKILL.md`) under `packages/` + `.claude/skills`, excluding
- * `node_modules` / `__pycache__`. Ported verbatim from `scripts/drift-sweep-skills.mjs`.
+ * Every skill dir (a dir containing `SKILL.md`) under `packages/` + every per-target install root
+ * in {@link SKILL_INSTALL_ROOTS}, excluding `node_modules` / `__pycache__`. Originally ported from
+ * `scripts/drift-sweep-skills.mjs`, which searched `.claude/skills` alone — see ADR-001
+ * (skill-copy-discovery) for why one hardcoded root let the Codex install drift unseen.
  */
-function findSkillDirs(root: string, scope: 'packages' | 'all' = 'all'): string[] {
+function findSkillDirs(root: string, scope: 'packages' | 'installs' | 'all' = 'all'): string[] {
   const dirs: string[] = [];
-  const roots = scope === 'packages' ? [join(root, 'packages')] : [join(root, 'packages'), join(root, '.claude', 'skills')];
+  // Roots are ANCHORED at the repo root — never a recursive search for `*/skills`. A stale agent
+  // worktree under `.claude/worktrees/<id>/` holds a full second copy of `packages/`,
+  // `.claude/skills` AND `.agents/skills`; a recursive sweep would report every skill in the repo
+  // as drifting against a checkout nobody maintains, and the healer would be entitled to WRITE
+  // into it (ADR-001, Option C rejected on exactly this measurement).
+  const installRoots = scope === 'installs'
+    ? SKILL_INSTALL_ROOTS.filter((r) => r !== DEV_SKILL_ROOT)
+    : SKILL_INSTALL_ROOTS;
+  const roots = scope === 'packages'
+    ? [join(root, 'packages')]
+    : [join(root, 'packages'), ...installRoots.map((r) => join(root, ...r.split('/')))];
   const stack = roots.filter((p) => existsSync(p));
   while (stack.length) {
     const d = stack.pop() as string;
@@ -322,9 +378,7 @@ export function syncCanonicalSkill(root: string, skill: string, opts: SyncCanoni
     return { canonical: '', canonicalExists: false, resolvedFrom, copies: allCopies.length, synced: 0, drifted: 0, wrote: [] };
   }
 
-  const canonFiles = walk(canonical)
-    .map((p) => relative(canonical, p))
-    .sort();
+  const canonFiles = withoutEnrichmentNames(walk(canonical).map((p) => relative(canonical, p))).sort();
 
   // Every <skill>/ dir except the canonical itself.
   const copies = allCopies.filter((d) => relative(canonical, d) !== '');
@@ -334,7 +388,10 @@ export function syncCanonicalSkill(root: string, skill: string, opts: SyncCanoni
   const wrote: string[] = [];
 
   for (const copy of copies) {
-    const copyFiles = new Set(walk(copy).map((p) => relative(copy, p)));
+    // Target ENRICHMENT assets are excluded from the copy's file set entirely: they exist in the
+    // install tree by design, the canonical never has them, and both the drift verdict and the
+    // removal pass below must leave them alone.
+    const copyFiles = new Set(walk(copy).map((p) => relative(copy, p)).filter((f) => !isEnrichmentAsset(f, copy)));
     let differs = false;
     // Extra files in the copy not present in canonical ⇒ drift.
     for (const f of copyFiles) if (!canonFiles.includes(f)) differs = true;

package/src/skill-install-roots.ts

@@ -0,0 +1,119 @@
+/**
+ * Where installed skill dirs live — the single source of truth for skill-copy DISCOVERY.
+ *
+ * The harness installs skills into a per-TARGET tree (`dz install --target <name>`). Five of the
+ * ten targets in {@link TARGET_NAMES} emit an agentskills.io-shaped directory containing a
+ * `SKILL.md`; the other five (copilot, cursor, windsurf, gemini, agents-md) emit rules/instructions
+ * FILES and therefore hold no skill dirs to keep in sync.
+ *
+ * | Target | Root | Adapter constant |
+ * |---|---|---|
+ * | `claude-code` | `.claude/skills` | — (the adapter exports no root constant) |
+ * | `codex` | `.agents/skills` | `CODEX_SKILLS_ROOT` |
+ * | `opencode` | `.opencode/skills` | `OPENCODE_SKILLS_ROOT` |
+ * | `hermes` | `.hermes/skills` | `HERMES_SKILLS_ROOT` |
+ * | `openclaude` | `.openclaude/skills` | `OPENCLAUDE_SKILLS_ROOT` |
+ *
+ * **Why this list is data with no imports.** `skill-drift.ts` — the drift detector behind the
+ * `no-skill-drift` HARD guard rule — is deliberately dependency-free (`node:fs`/`node:path`/
+ * `node:crypto`). `targets.ts`, which owns the adapter registry, imports all ten adapter packages;
+ * importing it from the drift sweep would drag ten packages into the guard's load path for a list
+ * of five strings. So the list lives here as data, and the link back to the adapters is asserted in
+ * `test/skill-install-roots.test.ts`, where importing them costs nothing.
+ *
+ * **Why this matters (the defect that produced it, MEASURED 2026-08-25).** `findSkillDirs` searched
+ * `packages/` + `.claude/skills` only. `.agents/skills/feature-adr` — the Codex install — drifted
+ * from the canonical for a day while `dz sync-canonical feature-adr --check` reported "all 3 copies
+ * match canonical" and the HARD guard passed. Two feature-adr gates were degraded in that copy: the
+ * K1 name-availability section was missing from `SKILL.md`, and the C6 amendment-integrity check
+ * was missing from the K2 script. A gate that cannot see a copy cannot gate it.
+ *
+ * **Honest limit.** A target whose adapter exports no root constant (today: `claude-code`) must be
+ * listed here by hand — the completeness test proves every EXPORTED constant is covered, and cannot
+ * prove a constant that does not exist is covered.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Files a TARGET legitimately adds INSIDE an installed skill dir — enrichment, not drift.
+ *
+ * `dz init --enrich` / `dz setup --enrich` write per-target metadata into the skill dir itself
+ * (`operations.ts`): codex gets `<skillDir>/agents/openai.yaml` (UI metadata + risk scoring),
+ * hermes gets `<skillDir>/hermes-config.yaml`. OpenCode's enrichment lands in
+ * `.opencode/agents/<id>.md`, OUTSIDE any skill dir, so it needs no entry here.
+ *
+ * These paths must be invisible to the drift comparison and untouchable by the healer. Without the
+ * exemption, widening discovery to install roots would (a) report permanent, unfixable drift on any
+ * enriched install — making the HARD gate unsatisfiable — and (b) worse, let `dz sync-canonical`
+ * DELETE the enrichment, because the heal removes every file the canonical does not have. Found by
+ * cross-family review (Codex `gpt-5.6-sol`, 2026-08-25) on a latent defect: this repo's own
+ * `.agents/` install was never enriched, so no test and no live run would have shown it.
+ *
+ * Each asset is mapped to the install root that OWNS it, because the exemption must depend on WHERE
+ * the file sits, not only on its name: `agents/openai.yaml` under a package copy, or
+ * `hermes-config.yaml` outside the hermes root, is a misplaced file — waving it through would let
+ * the sweep report clean and the healer preserve it (second cross-family round, 2026-08-25).
+ *
+ * Keys are relative to the skill dir root and POSIX-separated; values are repo-root-relative install
+ * roots from {@link SKILL_INSTALL_ROOT_BY_TARGET}.
+ */
+export const TARGET_ENRICHMENT_ASSETS: Readonly<Record<string, string>> = {
+  'agents/openai.yaml': '.agents/skills',
+  'hermes-config.yaml': '.hermes/skills',
+};
+
+/**
+ * The one install root that is ALSO the repo's hand-edited development tree.
+ *
+ * `.claude/skills` is where this repo's own skills are authored before they are synced into
+ * `packages/`, so it legitimately LAGS the published copies — MEASURED 2026-08-25, `dz drift-check
+ * --all` reports three skills drifting for exactly that reason (`decision-mockups` 12/22 files,
+ * `idea2prd-manual` 3/11, `observability` 1/5). A byte-identity GATE that included it would be
+ * red-on-arrival, which is why `scope: 'packages'` exists at all.
+ *
+ * Every OTHER root in {@link SKILL_INSTALL_ROOTS} is machine-generated by `dz install --target …`
+ * and has no licence to lag: a stale generated copy is the defect this module was written for.
+ * That asymmetry is what `scope: 'installs'` encodes.
+ */
+export const DEV_SKILL_ROOT = '.claude/skills';
+
+/**
+ * Every `--target` name → the repo-root-relative dir into which it installs `SKILL.md`-bearing
+ * skill dirs, or `null` for a target that emits rules/instructions FILES and therefore holds no
+ * skill dirs to keep in sync.
+ *
+ * **This map, not the derived list, is the thing a new target must touch.** Its keys are asserted
+ * against `TARGET_NAMES` in `test/skill-install-roots.test.ts`, so adding target #11 turns that
+ * test RED until someone states whether it installs skill dirs — which is exactly the question
+ * nobody was asked when `codex` was added and its install tree went ungated. A test that
+ * hand-enumerated the adapter constants would have stayed green through that (raised by
+ * cross-family review, Codex `gpt-5.6-sol`, 2026-08-25).
+ *
+ * Kept as a literal with NO imports: `skill-drift.ts` consumes it and is documented dependency-free,
+ * while `targets.ts` — which owns the adapter registry — pulls in all ten adapter packages.
+ */
+export const SKILL_INSTALL_ROOT_BY_TARGET: Readonly<Record<string, string | null>> = {
+  'claude-code': '.claude/skills',
+  codex: '.agents/skills',
+  opencode: '.opencode/skills',
+  hermes: '.hermes/skills',
+  openclaude: '.openclaude/skills',
+  // Rules/instructions FILE targets — no skill dirs, nothing to compare.
+  copilot: null,
+  'agents-md': null,
+  cursor: null,
+  gemini: null,
+  windsurf: null,
+};
+
+/**
+ * Repo-root-relative directories that hold installed `SKILL.md`-bearing skill dirs — DERIVED from
+ * {@link SKILL_INSTALL_ROOT_BY_TARGET} so the two can never disagree. POSIX separators; consumers
+ * `join()` them onto the repo root themselves.
+ *
+ * Consumed by `findSkillDirs` (`skill-drift.ts`). A root that does not exist, or exists without any
+ * `SKILL.md`, contributes nothing — so listing a root the current repo does not use is inert.
+ */
+export const SKILL_INSTALL_ROOTS: readonly string[] = Object.values(SKILL_INSTALL_ROOT_BY_TARGET)
+  .filter((r): r is string => r !== null);