@ersbeth/codelife 0.0.0-bootstrap.0 → 0.11.1

package/scripts/git/status.mjs

@@ -0,0 +1,25 @@
+// git.status(): the branch, its upstream, ahead and behind, and the three sets, as JSON — read from
+// `git status --porcelain=v2 --branch -uall -z`; a name holding a newline answers `unreadable`.
+import { git, records } from './lib.mjs';
+
+const s = { oid: '', branch: '', upstream: '', ahead: 0, behind: 0, staged: [], modified: [], untracked: [] };
+const r = records(git('status', '--porcelain=v2', '--branch', '-uall', '-z'));
+for (let i = 0; i < r.length; i++) {
+  const e = r[i], m = e.match(/^([12u]) (..) /);
+  if (e.startsWith('# branch.oid ')) s.oid = e.slice(13);
+  else if (e.startsWith('# branch.head ')) s.branch = e.slice(14);
+  else if (e.startsWith('# branch.upstream ')) s.upstream = e.slice(18);
+  else if (e.startsWith('# branch.ab ')) [s.ahead, s.behind] = e.slice(12).split(' ').map((x) => Math.abs(+x));
+  else if (e.startsWith('? ')) s.untracked.push(e.slice(2));
+  else if (m) {
+    const path = e.split(' ').slice({ 1: 8, 2: 9, u: 10 }[m[1]]).join(' ');
+    if (m[1] === '2') i++;
+    if (m[2][0] !== '.') s.staged.push(path);
+    if (m[2][1] !== '.') s.modified.push(path);
+  }
+}
+if ([...s.staged, ...s.modified, ...s.untracked].some((p) => p.includes('\n'))) {
+  console.log('unreadable');
+  process.exit(1);
+}
+console.log(JSON.stringify(s));

package/scripts/git/submodules.mjs

@@ -0,0 +1,5 @@
+// git.submodules(commit): the paths of the submodules a commit's tree holds — its gitlinks — as JSON.
+import { arg, git, records } from './lib.mjs';
+
+const tree = records(git('ls-tree', '-r', '-z', arg(0, '<commit>')));
+console.log(JSON.stringify(tree.filter((e) => e.startsWith('160000 ')).map((e) => e.slice(e.indexOf('\t') + 1))));

package/scripts/init.mjs

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+// The first installation, `pnpm dlx @ersbeth/codelife init` (R-272): adds the package as a
+// dependency of the repository it runs in and links it, and nothing else — no contract, no hooks,
+// no `prepare`; `/setup` does the rest. An optional argument is the package spec to add, the
+// published version this file belongs to by default.
+import './node-floor.mjs'
+import { readFileSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
+import { link } from './link.mjs'
+import { packageManager } from './package-manager.mjs'
+
+const repo = process.cwd()
+const { version } = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'))
+const spec = process.argv[3] ?? `@ersbeth/codelife@${version}`
+const pm = packageManager(repo) || process.env.npm_config_user_agent?.split('/')[0] || 'npm'
+const add = pm === 'npm' ? ['install', '-D'] : ['add', '-D']
+
+const r = spawnSync(pm, [...add, spec], { cwd: repo, stdio: 'inherit' })
+if (r.status !== 0) process.exit(r.status ?? 1)
+link(repo)
+console.log('codelife: installed. Open Claude Code in this folder, trust it, run /reload-plugins, then /setup.')

package/scripts/install.mjs

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+// Wires the clone it runs in: the hooks path, the pruning fetch and the ssh keepalive, the three
+// local keys a hook needs to be run and to hold, and the plugin's link (link.mjs). A repository's `prepare` runs it —
+// `node node_modules/@ersbeth/codelife/scripts/install.mjs` — and never its `postinstall`, which
+// npm runs in whoever installs a dependency (R-272). This repository, which is the package, runs
+// `node scripts/install.mjs`.
+//
+// The keepalive is for the one window the `pre-push` hook cannot leave: git runs it after it has
+// contacted the remote, so the tier runs inside a connection held idle, and a remote that drops
+// idle connections breaks the push of a tip the tier just passed. Inert for an HTTPS remote.
+import './node-floor.mjs'
+import { spawnSync } from 'node:child_process'
+import { LINK, link } from './link.mjs'
+
+// The keepalive is appended once to a command the contributor set, so an identity for a second
+// account keeps its options (#1059).
+const ssh = spawnSync('git', ['config', 'core.sshCommand'], { encoding: 'utf8' }).stdout?.trim() || 'ssh'
+const keys = [
+  ['core.hooksPath', '.githooks'],
+  ['fetch.prune', 'true'],
+  ['core.sshCommand', ssh.includes('ServerAliveInterval') ? ssh : `${ssh} -o ServerAliveInterval=20 -o ServerAliveCountMax=10`],
+]
+
+// Outside a git repository — a tarball unpacked, a build container — there is no clone to wire.
+const clone = spawnSync('git', ['rev-parse', '--git-dir'], { stdio: 'ignore' }).status === 0
+
+for (const [key, value] of clone ? keys : []) {
+  const r = spawnSync('git', ['config', '--local', key, value], { stdio: 'inherit' })
+  if (r.status !== 0) process.exit(r.status ?? 1)
+}
+
+if (link(process.cwd())) console.log(`codelife: linked ${LINK} — a Claude Code session already open here, or the one in which you trust this folder, loads its skills only after /reload-plugins.`)

package/scripts/lenses/A11Y.md

@@ -0,0 +1,91 @@
+# Lens A11Y — Accessibility & i18n
+
+## Objective
+
+Say whether the interface can be used by someone who is not the person who wrote it: reachable
+without a mouse, readable by assistive technology, and translatable without editing the markup.
+This lens measures what the **tree** shows; what only a rendered page shows is out of its reach by
+construction, and it says so rather than guessing.
+
+## What this lens can and cannot see
+
+A lens runs in an agent that only reads. So this lens reads markup, stylesheets, component
+files and resource bundles, and it reports on what those declare. **Focus order as a user meets it,
+a live accessibility tree, a contrast ratio as composited, a screen reader's actual announcement** —
+none of those are visible from a file, and none is estimated here. They belong to a real browser,
+and a finding about them written from the tree alone would
+be a guess with an `Evidence:` line.
+
+That boundary is the lens's, not a limitation to apologise for: everything below is checkable from
+the tree, and a repository that fixes it all still needs someone to look at the page.
+
+## Questions
+
+- **Is every interactive element reachable and named?** A control built from a non-interactive
+  element with a click handler and no role, no tab position and no accessible name is invisible to
+  everything but a mouse.
+- **Does every image, icon and media element carry a text alternative** — or an explicit marker
+  saying it is decorative? An absent alternative and a deliberate empty one are different answers,
+  and only one of them is a defect.
+- **Is every form control associated with a label**, by reference and not by proximity?
+- **Is the document's language declared**, and its direction where the supported locales need one?
+- **Are user-visible strings externalised**, or written into the markup? A literal string is a
+  string no translator will ever see, and the count of them is the real state of the i18n effort.
+- **Are the locale-sensitive values formatted through the platform's own facilities** — dates,
+  numbers, currencies, plurals — or assembled by concatenation? Concatenation is what makes a
+  translation grammatically impossible rather than merely absent.
+- **Does anything check any of this automatically**, at any point? Where nothing does, that is the
+  finding, and it outlives every individual instance below it.
+
+## Probes
+
+The subject is the markup among the tracked files: the extensions this
+repository uses — `.html`, `.htm`, `.vue`, `.svelte`, `.jsx`, `.tsx`, `.astro` — read from that list
+and named in *Method* rather than assumed from a framework. None → this lens has no subject: say so
+under `Limits`. Then, searched over that markup:
+
+- **Images and media without a text alternative** — `<(img|area|input[^>]*type="image")[^>]*>`,
+  each hit counted as named (`alt="…"`), explicitly decorative (`alt=""`) or without one.
+- **Controls a keyboard cannot reach** — `<(div|span|li|td)[^>]*(onClick|@click|v-on:click|on:click)`,
+  the hits carrying neither `role=` nor `tabindex=`.
+- **Form controls, against the labels that reference them** — `<(input|select|textarea)\b` counted
+  beside `<label[^>]*\b(for|:for|htmlFor)=`.
+- **The declared language and direction** — `<html[^>]*>`, and `\b(lang|dir)="[^"]*"` by value.
+- **Externalised strings against literal ones** — the tracked paths under a `locales`, `locale`,
+  `i18n`, `lang` or `translations` directory, beside the user-visible text still in the markup,
+  `>[[:space:]]*[A-Z][a-z]+( [a-z]+){2,}`.
+- **Locale-sensitive formatting, done by the platform or by hand** — over every tracked file,
+  `\bIntl\.[A-Za-z]+` beside `toFixed\(|toLocaleString\(\)|' \+ .*(count|total|name)`.
+- **Whether anything checks this without a person** — `axe|pa11y|lighthouse|eslint-plugin-jsx-a11y|vue-a11y|accessibility`
+  in `package.json`; nothing → nothing checks this but a reader.
+
+Every count above is reported with the command beside it, and a count of zero from an empty markup
+subject is *not applicable*, never a pass.
+
+## For a change
+
+A change gives every interactive element it adds a name, every image an alternative, and writes
+no user-visible string into the markup — each checked by the probes above, run over the files it
+touches.
+
+The i18n objective is the one worth being strict about: a literal string is trivial to externalise
+while the line is being written and expensive once a page is full of them, so a change adds none
+even where the repository holds many already, whose count is a campaign's.
+
+What a change does to focus order, contrast or a screen reader's announcement no command checks
+here — the probes see no live accessibility tree — so an objective on it is left to the review.
+
+## Signals learned
+
+- **This lens ships without campaign history**, no application having been ported when it was
+  written, and its content was settled at what a subagent can read rather than deferred whole. Grow it
+  from the first application campaign.
+- **The absence of automated checking outranks the instances.** Fifty missing alternatives are one
+  cause; report the cause as a finding and the instances as its evidence, rather than fifty findings
+  a reader has to group themselves.
+- **An empty alternative is an answer.** A probe that counts *no `alt`* and *`alt=""`* together
+  reports deliberate decisions as defects and loses the reader's trust for the rest of the report.
+- **Count the literal strings.** It is the one i18n figure that is unarguable, cheap, and moves in a
+  direction anyone can see between two campaigns.
+- Do not report an ARIA attribute as an improvement where a native element would do. Added ARIA on
+  a wrong element is a second wrong answer, and this lens should not recommend one.

package/scripts/lenses/ARCH.md

@@ -0,0 +1,90 @@
+# Lens ARCH — Architecture & design
+
+## Objective
+
+Say whether the public surface can be enumerated, whether dependencies go one way, and whether a
+path predicts what it holds. A layered design whose layers call each other in both directions is
+one layer with extra files, and nobody finds out until a change has to be made in five places at
+once; a layout whose paths lie sends every reader to the wrong file first.
+
+## Questions
+
+- **Can the public surface be listed** from the repository itself — the commands, the exported
+  symbols, the entry points — or does it take reading every file to know what a consumer can touch?
+- **Do dependencies go one way?** Name the layers the repository claims, then check the direction at
+  the boundary. The interesting failure is not a cycle in the imports; it is a lower layer that
+  *knows* about a higher one — a core module that imports the UI, a utility that reaches back into
+  the feature that uses it.
+- Is the **boundary written down** where the code is, or only in a design document? A rule that
+  lives only in `docs/` is a rule the next contributor will not meet.
+- Does the repository declare **more surface than it has**, or less? A manifest listing entry points
+  that no longer exist, or omitting ones consumers already use.
+- What would it take to **remove one piece**? A component nothing can be removed around is a
+  component everything depends on.
+- **Does a path predict the domain it holds?** Given a feature and no search, can a contributor say
+  where its file lives, and be right? What is in `utils/`, `helpers/`, `misc/`, `common/` — names
+  that mean *we had nowhere to put this*, whose contents are the domains the layout does not have?
+- **Does a path predict the status of what it holds** — shipped, generated, test, fixture? The
+  dangerous case is generated output beside hand-written source with nothing distinguishing them.
+  Are there **two homes for one kind of thing** — tests in two trees, configuration in three places?
+  What the target's layout imposes is CONF's question; what the repository's own paths say is this
+  one.
+
+## Probes
+
+- **The boundary this repository declares** — the kind of artefact it ships most, as a glob over the
+  tracked files, and the marker that puts an instance on one side of it or the other,
+  both read from the tree and named in *Method*. The instances the marker is found in are one side,
+  the rest of the kind the other. No instance of the kind → the boundary probe has no subject, said
+  under `Limits`.
+- **Is the boundary written where the code is?** Where an artefact declares what it depends on,
+  read that declaration beside the call sites in its own files, and compare the two both ways.
+- **The surface, against what the manifest declares** — the manifest is `release.version_file` of
+  the contract the caller passed you, never a literal path, the same reason GOV reads it from the
+  contract: its top-level keys are the declared surface, and a manifest that is not JSON leaves the
+  surface unread, said under `Limits`.
+- **The shape of the tree, at the depth where domains live** — the directories of the tracked
+  files' paths, three levels down.
+- **The names that mean "nowhere else to put this"** — tracked paths through a `utils`, `helpers`,
+  `misc` or `common` directory.
+- **Does status show in the path?** Generated output beside source is the case that bites: tracked
+  paths under `dist/`, `build/` or `generated/`.
+
+**A grep for the other side's *name* is not this probe.** A skill's files name other skills without
+invoking them, and two shapes do it in every corpus: the skill's own `## Calls` section, which is a
+declaration and not a call site, and guidance naming a skill as *Next* — `/setup` here. Match
+on the **invocation**, and read a skill's declaration apart from its call sites, or the lens
+reports a violation per document.
+
+## For a change
+
+A change adds no call in the forbidden direction, no surface the manifest does not declare, no file
+where its path does not predict it, and no second home for something that already has one — each
+answerable from the files it touches and their neighbours. The layer and tree inventories are a
+campaign's, and no objective rests on them.
+
+## Signals learned
+
+- **The direction rule needs a mechanical form, or it is prose.** codelife's own is each skill's
+  declared call list, held equal both ways to the call sites found in its own files by a guard in
+  the suite. Frontmatter cannot carry such a rule, which is why it is a guard and not a field.
+- **What the probe above looked like on codelife**, as a worked example of filling its two
+  parameters: `kind='*/SKILL.md'` and `marker='^user-invocable: false'` answered the menu boundary
+  both ways, and the declaration-against-call-sites question was answered by reading each skill's
+  `## Calls` section apart from the `<name>.<operation>` matches in its own files. Those values are
+  codelife's; the shape is every repository's.
+- A repository whose layers are **directories** makes this lens cheap; one whose layers are a
+  convention in file names makes it a judgement call, and the lens says which it was.
+- A manifest with five keys and a surface of seven commands is not a defect on its own — say what
+  the manifest is *for* in that ecosystem before calling the gap a finding.
+- **A repository with no `utils/` is worth saying so.** Measured on codelife: none of `utils`,
+  `helpers`, `misc` or `common` existed, and the layout was `skills/<name>/{SKILL.md,references/,
+  templates/}` — the same three names everywhere. That is the answer, and it is short.
+- **The status question is where a mostly-prose repository still has teeth.** codelife's
+  `CHANGELOG.md` is generated and sits at the root beside hand-written files; what distinguishes it
+  is a `generated[]` entry in the contract, not its path. Say when the distinction lives somewhere
+  other than the layout.
+- A `templates/` directory beside a `references/` directory is a real distinction — one is copied
+  into a target repository, the other is read by the skill — and it is invisible from the names
+  alone. When a layout encodes a distinction only its author knows, that is the finding.
+- Depth is not a defect. Do not report nesting; report a path that lies.

package/scripts/lenses/BUG.md

@@ -0,0 +1,52 @@
+# Lens BUG — Defects
+
+## Objective
+
+Say what the code gets wrong — its logic, its states, its asynchrony, its resources — on the
+boundaries a caller can reach. Not whether a test covers it: a defect no test reaches is still a
+defect, and the one this lens exists to find.
+
+## Questions
+
+- **Trace each changed or central function branch by branch.** For each branch, what input reaches
+  it, and is the result right there? The empty collection, the single element, the last page, the
+  boundary value, the value that is neither — `0`, `''`, `null`, `NaN`.
+- **What states can the code be in, and is each handled?** A transition that leaves an object half
+  updated, a flag two paths set and one path clears, a state the type allows and no branch expects.
+- **What does asynchrony allow?** Two calls interleaved, a result arriving after the caller moved
+  on, a read and a write of the same value with an `await` between them.
+- **Is every resource released** on every path — a file, a handle, a listener, a timer, a lock —
+  including the path that throws?
+- **What did a deleted line carry that nothing restored?** A guard, a normalisation, a default, an
+  ordering. Removed lines are read as hard as added ones.
+- Does a value cross a **unit, encoding or index base** without saying so — milliseconds and
+  seconds, bytes and characters, one-based and zero-based?
+
+## Probes
+
+- **The files the tree changes most** — where defects concentrate, and where to trace first: the
+  history `verify` handed over under `tree`.
+- **Comparisons that turn an empty value into a syntax error, in the shell scripts the tree ships**
+  — the tracked files whose first line is a shell shebang, `^#!.*sh`, then `\[ \$[a-z_]+ [=!]` in
+  them.
+- **Fixes already made** — the fix commits of that history: a defect class this repository has had
+  is worth looking for again beside it.
+
+The probes only point at where to read: the method is the trace. Name in *Method* which functions
+were traced and to which depth — a lens that read three functions and says so is worth more than
+one that claims the tree.
+
+## For a change
+
+A change holds on every branch it adds or changes, and on the boundaries a caller reaches through
+them — the empty case, the last case, the concurrent case — each named with the test that reaches
+it. What a line it removes carried — a check, a default, an ordering — is restored, or the plan
+says why it is no longer owed. A defect the change makes reachable on a line it leaves untouched is
+the change's own, and its objective names that line.
+
+## Signals learned
+
+- A repository that is mostly prose still has a defect surface: its scripts, its hooks, its
+  generators. Say which files carried the lens rather than reporting *not applicable*.
+- An unquoted variable in a shell test — `[ $x = y ]` — is a defect that shows only on the empty
+  value, which is exactly the value nobody tries by hand.

package/scripts/lenses/BUILD.md

@@ -0,0 +1,40 @@
+# Lens BUILD — Build
+
+## Objective
+
+Say whether the build is reproducible, silent, and whether what is committed as its output
+matches what the sources produce today. A stale committed artefact is a lie that ships.
+
+## Questions
+
+Whether the build runs, is silent, leaves the committed output as it is and gives the same bytes
+twice is the script's to say; what it reports is read here for its cause and its weight — a
+difference in committed output weighs as far as the two have drifted, a non-reproducible file as
+what bakes it (a timestamp, an absolute path).
+
+- Does the build **run clean from a fresh clone**, with the declared package manager and the
+  declared version, without a manual step nobody wrote down?
+- Does the build **depend on something undeclared** — a global binary, an environment variable, a
+  network fetch at build time?
+
+## Probes
+
+`BUILD.mjs`, run by `verify` before the lenses, whose lines you are handed. It builds
+twice in the tree with the manager the lockfile names — say so in *Method*, and let the caller's
+closing fingerprint report what it left — and reports a build that fails, each line of its output
+that warns, each tracked file the build changed, and each file two builds wrote differently. With
+no `build` script it could not tell, which is *not applicable* under *Limits*.
+
+## For a change
+
+A change to a source a `generated[]` entry builds from updates that output with it. The contract
+declares which paths are built from which sources, so the objective names the output and the
+command that regenerates it with nothing left to commit.
+
+## Signals learned
+
+- A repository with no build at all is not a BUILD finding — the lens reports *not applicable* and
+  says so in *Limits*. Inventing a build to audit is how an audit loses a reader.
+- `dist/` committed **and** in `.gitignore` is a real state and a real finding: the file is
+  tracked from before it was ignored, and git will keep serving the stale one.
+- A build that is silent only because its warnings are routed to a log file is not silent.

package/scripts/lenses/COMPAT.md

@@ -0,0 +1,67 @@
+# Lens COMPAT — Runtime & browser compatibility
+
+## Objective
+
+Say which runtimes and browsers the application claims to support, where that claim is written, and
+whether anything tests it there. A support claim nobody derives the build from is a claim the first
+user on the oldest supported browser disproves.
+
+## Questions
+
+- **What is the declared target?** The runtime floor in the manifest, the browser list wherever the
+  repository keeps it, the target the build tool is configured with — and do those three agree? They
+  are three declarations of one fact, and they drift apart silently because each is read by a
+  different tool.
+- **Does the shipped output respect the declared target?** Syntax the target cannot parse is a blank
+  page, not a degraded feature, and it is produced by a build whose own configuration said otherwise.
+- **Is anything tested on the target**, or only on whatever the contributor and the pipeline happen
+  to run? One runtime version passing is evidence about one runtime version.
+- **Which platform APIs does the code call**, and is each one available across the declared range?
+  The dangerous ones are recent and widely shipped — available everywhere the author looked.
+- **What happens on an unsupported runtime** — a message, a degraded mode, or a stack trace?
+- **Is the declared range still the intended one?** A browser list copied from a template years ago
+  is a cost paid at every build for users who no longer exist.
+
+## Probes
+
+- **The three declarations, wherever this repository keeps them** — `engines` and `browserslist`
+  in `package.json`, each absence reported as an absence rather than as a default; and the tracked
+  runtime declaration files — `.browserslistrc`, `.nvmrc`, `.node-version`, `.tool-versions` — or
+  the line saying there is none.
+- **The target the build is configured with** — `target|browserslist|esbuild|transpile|downlevel`
+  in the configuration the repository's build tool reads, found in the tree and named in *Method*;
+  none found → the target is undeclared on this side.
+- **What the shipped output actually requires** — `\?\?=|\?\.|#[a-zA-Z]+ *[=(]|static *\{|await `
+  over the built artefacts the contract's `generated[]` rows name, the newest syntax deciding the
+  real floor; no built output → the syntax floor is unmeasured, not zero.
+- **Where anything is tested, and on what** — the tracked CI and container files — `.gitlab-ci.yml`,
+  `.github/workflows/`, a `Dockerfile` — and `(node|browser|playwright|chromium|firefox|webkit)[-_ ]?version[^,}]*`
+  across the tree.
+- **Platform APIs the code reaches for**, which is what a declared range has to cover —
+  `\b(navigator|structuredClone|ResizeObserver|IntersectionObserver|AbortSignal|Intl|OffscreenCanvas|WebGL2RenderingContext|showOpenFilePicker)\b`,
+  counted by name.
+
+A repository with no declared target and no build answers *not applicable* under `Limits`: this lens
+measures the distance between a claim and its verification, and where there is no claim the finding
+is the absence of one.
+
+## For a change
+
+A change keeps the declared target unless it moves it on purpose, and reaches past it nowhere. The
+second is the one easily missed: an added call to a platform API newer than the declared floor
+looks like ordinary code and breaks only on the oldest browser the repository promises to support.
+Where the change moves the build's target, the plan names what the move makes unreachable.
+
+## Signals learned
+
+- **This lens ships without campaign history**, no application having been ported when it was
+  written. Grow it from the first application campaign.
+- **Three declarations, one fact.** The runtime floor, the browser list and the build target are
+  read by three different tools and nothing compares them; where two disagree, report which one the
+  shipped artefact actually obeys — that is the one users meet.
+- **Measure the output, not the intention.** The syntax in the built artefact is the real floor,
+  whatever the configuration says, and it is the only figure here that cannot be argued with.
+- **A pipeline matrix is a support claim.** Where one exists and omits a declared target, that gap is
+  a finding with its evidence already written down.
+- Do not report a missing browser list as a defect for a repository that ships no browser code. Ask
+  what is claimed before asking what is tested.

package/scripts/lenses/CONF.md

@@ -0,0 +1,49 @@
+# Lens CONF — Conformity to the target
+
+## Objective
+
+Say where the repository differs from the target definition. The target lives in the plugin and
+never in the repository, so a difference is drift rather than a local convention, and the question
+is never *which shape is better* but *how far is this one from the one definition every repository
+converges on*.
+
+## Referential
+
+**It is handed to you; you never invent it**: the target definition, `target-base.md` and
+`target-<kind>.md`, and `measure.txt`, the port's own measure of each item, copied into your
+folder. One of them missing → say so under `Limits` and emit nothing. A lens that invents a
+target measures the repository against itself, which is the one thing this lens exists not to do.
+
+## Questions
+
+- **Which items does `measure.txt` read *to do*?** Each is a candidate, its remedy
+  `/port-toolchain`; you never classify an item again. One it reads deferred, refused or blocked is
+  a line of your report, one *not read* a line of `Limits`, and a `toolchain: not ported` gives no
+  candidate at all — a deliberate stop is not an unfinished port.
+- For an item it reads *to do*, is anything in the tree **a local reinvention of what the target
+  defines** for it? A second hook, a second script name, a second layout for the same job.
+
+## Probes
+
+Read each item `measure.txt` reads *to do* against its rows of the definition: the file, script,
+hook or setting they name, searched in `tracked.txt` and read where it is.
+
+## For a change
+
+A change moves no item of the target's definition away from it: an item it touches, done before
+the change, is not *to do* after it — no script renamed off the standard name, no
+hook edited into a local variant, no generated output the target declares that the change stops
+producing. The tree's conformity is a campaign's, never a change's.
+
+A change that touches nothing the definition names has no objective here. That is the common case,
+and padding it is what makes the lens ignorable.
+
+## Signals learned
+
+- **This lens ships without campaign history**, having been written while the definition it reads
+  covered the base and one `kind`. Grow it from the first campaign that runs it.
+- **Drift is usually one aspect, not one item.** A repository that renamed one standard script has
+  usually renamed the hook that calls it and the documentation that names it; look for the aspect
+  behind two item-level differences before writing them as two findings.
+- Do not report a divergence the target does not cover. A framework, a router, a CSS approach, a
+  deployment — those are per-repository choices, and the target says so.

package/scripts/lenses/DEPS.md

@@ -0,0 +1,43 @@
+# Lens DEPS — Dependencies & supply chain
+
+## Objective
+
+Say which dependencies fix a horizon, whether the lockfile matches the manager, and what the
+repository needs that it never declares. The dangerous dependency is rarely the one in the manifest;
+it is the binary everyone happens to have installed.
+
+## Questions
+
+Whether one lockfile, the manager's own, is kept, and whether `engines` and `packageManager` pin
+the runtime, is the script's to say; an unpinned manager is a different resolver on every machine.
+
+- **What does the repository call that it does not declare?** External binaries invoked by scripts,
+  hooks and CI — read them in the tracked scripts, the hooks and `package.json`. These are
+  dependencies with no version, no lockfile and no install step — and they fail on a colleague's
+  machine, not on the author's.
+- Which dependency **fixes a horizon**: a peer range that decides what a consumer may install, a
+  transitive pin that blocks an upgrade elsewhere?
+- Anything **unmaintained, deprecated, or resolving to a different registry** than the others?
+
+## Probes
+
+`DEPS.mjs`, run by `verify` before the lenses, whose lines you are handed. It reports
+several lockfiles, a lockfile of another manager than `packageManager`, no `engines`, and no
+`packageManager`. With no `package.json` it could not tell.
+
+## For a change
+
+A dependency a change adds, a version it moves and **a binary it invokes** are each declared where
+the repository declares its dependencies. The third is the one easily missed, because it looks
+like a shell line rather than a dependency change.
+
+## Signals learned
+
+- **Zero declared dependencies does not mean no supply chain.** Report the undeclared set as the
+  dependency list, because that is what it is.
+- **`engines` and `packageManager` both absent** is worth one line even when nothing has broken:
+  a hook that calls a manager by name already assumes one the repository never names.
+- A tool only the tracker's verbs call — `glab`, `gh` — is a different class from one a hook or a
+  build calls: the first stops a verb saying *not connected*, the second breaks a commit. Say which.
+- Do not report the absence of a lockfile as a finding when there is nothing to lock. Report the gap
+  between what is locked and what is called.

package/scripts/lenses/DOC.md

@@ -0,0 +1,73 @@
+# Lens DOC — Documentation
+
+## Objective
+
+Say whether every verifiable statement in the documentation is true **today**, and what would
+remind a committer to update it tomorrow. Documentation is not audited for beauty or completeness:
+it is audited for truth and for the mechanism that keeps it true.
+
+## Questions
+
+- **The authority document first.** The `CLAUDE.md`, or whatever file an agent reads first and
+  trusts most: a false line there costs more than the same line anywhere else, because nothing
+  downstream questions it. Every verifiable statement in it is checked before any other document's.
+- **Is there exactly one authority?** `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, a copilot
+  instructions file — several is worse than none, because an agent picks one and never learns the
+  others contradict it.
+- **Is its transient part mixed with its standing rules?** A brief whose rules and whose current
+  state are interleaved rots as one document, and the rules rot with the state.
+- **Which statements are verifiable, and are they true?** A command, a path, a version, a script
+  name, a URL, a count. Resolve them against the tree, count them. A prose claim about intent is not this
+  lens's business; a command that no longer exists is. Whether the code does what a document
+  *specifies* is INTENT's question, not this one.
+- Is a **fact stated in two places**? Duplication of a rule is acceptable; duplication of a
+  verifiable fact means one of the two is already wrong or soon will be.
+- Does the documentation say what the repository **does now**, or what it did? Look for the
+  tell-tales: a *Status* line, a *Next steps* section, a roadmap with dates.
+- Is there a **mechanism** keeping it true — a test that runs the README's commands, a hook, a
+  generated section — or does it depend on someone remembering?
+- Are the **audiences** separated? A README that is at once a sales page, a tutorial and a
+  contributor guide serves none of the three.
+- Do the **links resolve**, including relative ones after a file moved?
+
+## Probes
+
+- **One authority, or several — and how much of it is transient** — which of `CLAUDE.md`,
+  `AGENTS.md`, `.cursorrules` and `.github/copilot-instructions.md` the tracked files hold, and
+  their `^## ` headings.
+- **Every fenced command in the documentation** — the `bash`, `sh` and `console` fences of
+  `README.md`, `CONTRIBUTING.md` and `docs/`, each read with its lines, to check it.
+- **Script names cited in prose against the ones that exist** — `pnpm [a-z:]*|npm run [a-z:]*` in
+  the Markdown, beside the `scripts` of `package.json`.
+- **Relative links that point nowhere** — `\]\([^)#][^)]*\.md[^)]*\)` in the Markdown, each target,
+  its anchor dropped, looked for among the tracked files.
+- **When the documentation last moved against when the code did** — the two dates of the history
+  `verify` handed over under `tree`: both sides are the tree's own, not a layout this or that
+  repository happens to have.
+
+## For a change
+
+A change to something the documentation states changes the documentation with it. **No Markdown
+line still carries what the change removes**: each name, path and command it takes away and does
+not carry elsewhere, searched in the repository's Markdown as a whole word and a fixed string,
+finds nothing. A behaviour that changes without any name changing is INTENT's, against the issue.
+
+And a change adds no verifiable statement — a command, a path — that is already false when
+written: the cheaper fix, and the more embarrassing one to ship.
+
+## Signals learned
+
+- A *Status* or *Where we are* section is the fastest-rotting prose in any repository: check it
+  first, and check every claim in it individually. Found on codelife, where the brief still said a
+  tool was not installed hours after it had been.
+- A command in a README that was correct when written and is now wrong will have been copied into
+  a CI file, an issue template and a colleague's notes. Search for it before declaring it fixed in
+  one place.
+- Documentation duplicating a *verifiable fact* the tooling holds — a script's body, a command, a
+  path — is a finding even when both copies currently agree.
+- **A brief that is mostly state is a brief whose rules rot with its state.** Measured on codelife:
+  120 of 201 lines of its `CLAUDE.md` were a transient *Where we are*. The standing rules above it
+  were correct; the question is whether a reader who stops after the first false line ever reaches
+  them.
+- One authority document and no competitor is a good answer — say it, briefly, rather than skipping
+  to what is wrong.