@event4u/agent-config 2.25.0 → 3.0.0

package/scripts/install.sh

@@ -641,40 +641,139 @@ copy_if_missing() {
     cp "$source" "$target"
 }
 
-# Migrate legacy infra files from project root to agents/.
-# Pre-2.x layout: .agent-chat-history (+ .bak), .agent-prices.md lived at
-# the project root. They now live under agents/. Move them in place before
-# any other content sync so the updated gitignore block (which lists
-# /agents/.agent-chat-history*) and the chat-history hooks operate on the
-# already-migrated layout. Idempotent: skips silently if the target already
-# exists; never overwrites.
+# Migrate legacy infra files to their current home under agents/runtime/.
+# Three source layouts are handled per file:
+#   - pre-2.x:           <name> at project root
+#   - 2.x intermediate:  agents/<name>
+#   - current:           agents/runtime/<name>
+# Covered files: .agent-chat-history (+ .bak) and the append-only budget
+# history JSONLs. Idempotent: skips silently if the target already exists;
+# never overwrites.
+#
+# .agent-prices.md is handled separately by migrate_legacy_prices_file.
 migrate_legacy_root_infra() {
     local project_root="$1"
-    local agents_dir="$project_root/agents"
-    local items=(".agent-chat-history" ".agent-chat-history.bak" ".agent-prices.md")
+    local runtime_dir="$project_root/agents/runtime"
+    local items=(
+        ".agent-chat-history"
+        ".agent-chat-history.bak"
+        ".augment-budget-history.jsonl"
+        ".rule-budget-history.jsonl"
+    )
 
     for name in "${items[@]}"; do
-        local old="$project_root/$name"
-        local new="$agents_dir/$name"
+        local target="$runtime_dir/$name"
+        local sources=("$project_root/$name" "$project_root/agents/$name")
+
+        for old in "${sources[@]}"; do
+            [[ -e "$old" ]] || continue
+
+            if [[ -e "$target" ]]; then
+                log_warn "Legacy ${old#"$project_root/"} found, but agents/runtime/$name already exists — leaving source in place"
+                continue
+            fi
+
+            if $DRY_RUN; then
+                log_verbose "would migrate ${old#"$project_root/"} → agents/runtime/$name"
+                continue
+            fi
+
+            mkdir -p "$runtime_dir"
+            mv "$old" "$target"
+            log_info "Migrated ${old#"$project_root/"} → agents/runtime/$name"
+        done
+    done
+}
+
+# Migrate the low-impact decision corpus from agents/ to agents/decisions/.
+# Pre-refactor: the .md and its .lock.yaml lived at agents/ root. They
+# now live under agents/decisions/ to separate tracked decisions from
+# volatile runtime data. Idempotent: skips silently if the target
+# already exists; never overwrites.
+migrate_legacy_low_impact_decisions() {
+    local project_root="$1"
+    local decisions_dir="$project_root/agents/decisions"
+    local items=("low-impact-decisions.md" "low-impact-decisions.lock.yaml")
+
+    for name in "${items[@]}"; do
+        local old="$project_root/agents/$name"
+        local target="$decisions_dir/$name"
 
         [[ -e "$old" ]] || continue
 
-        if [[ -e "$new" ]]; then
-            log_warn "Legacy $name found at project root, but agents/$name already exists — leaving root copy in place"
+        if [[ -e "$target" ]]; then
+            log_warn "Legacy agents/$name found, but agents/decisions/$name already exists — leaving source in place"
             continue
         fi
 
         if $DRY_RUN; then
-            log_verbose "would migrate $name → agents/$name"
+            log_verbose "would migrate agents/$name → agents/decisions/$name"
             continue
         fi
 
-        mkdir -p "$agents_dir"
-        mv "$old" "$new"
-        log_info "Migrated $name → agents/$name"
+        mkdir -p "$decisions_dir"
+        mv "$old" "$target"
+        log_info "Migrated agents/$name → agents/decisions/$name"
     done
 }
 
+# Migrate the AI Council price cache to its current home under agents/runtime/.
+# Two source locations are handled:
+#   - pre-2.x:           .agent-prices.md at project root
+#   - 2.x intermediate:  agents/.agent-prices.md
+# Both move to agents/runtime/.agent-prices.md. Idempotent: skips silently
+# if the target already exists; never overwrites.
+migrate_legacy_prices_file() {
+    local project_root="$1"
+    local runtime_dir="$project_root/agents/runtime"
+    local target="$runtime_dir/.agent-prices.md"
+    local sources=("$project_root/.agent-prices.md" "$project_root/agents/.agent-prices.md")
+
+    for old in "${sources[@]}"; do
+        [[ -e "$old" ]] || continue
+
+        if [[ -e "$target" ]]; then
+            log_warn "Legacy ${old#"$project_root/"} found, but agents/runtime/.agent-prices.md already exists — leaving source in place"
+            continue
+        fi
+
+        if $DRY_RUN; then
+            log_verbose "would migrate ${old#"$project_root/"} → agents/runtime/.agent-prices.md"
+            continue
+        fi
+
+        mkdir -p "$runtime_dir"
+        mv "$old" "$target"
+        log_info "Migrated ${old#"$project_root/"} → agents/runtime/.agent-prices.md"
+    done
+}
+
+# Migrate the AI Council config from agents/.ai-council.yml to
+# agents/settings/.ai-council.yml. Idempotent: skips silently if the
+# target already exists; never overwrites.
+migrate_legacy_council_yml() {
+    local project_root="$1"
+    local settings_dir="$project_root/agents/settings"
+    local target="$settings_dir/.ai-council.yml"
+    local source="$project_root/agents/.ai-council.yml"
+
+    [[ -e "$source" ]] || return 0
+
+    if [[ -e "$target" ]]; then
+        log_warn "Legacy agents/.ai-council.yml found, but agents/settings/.ai-council.yml already exists — leaving source in place"
+        return 0
+    fi
+
+    if $DRY_RUN; then
+        log_verbose "would migrate agents/.ai-council.yml → agents/settings/.ai-council.yml"
+        return 0
+    fi
+
+    mkdir -p "$settings_dir"
+    mv "$source" "$target"
+    log_info "Migrated agents/.ai-council.yml → agents/settings/.ai-council.yml"
+}
+
 # Ensure .gitignore contains the managed agent-config block.
 # Delegates to scripts/sync_gitignore.py so the installer and the
 # standalone /sync-gitignore command share one source of truth
@@ -768,6 +867,9 @@ main() {
 
     # 0. Migrate legacy infra files (root → agents/) before any content sync.
     migrate_legacy_root_infra "$TARGET_DIR"
+    migrate_legacy_low_impact_decisions "$TARGET_DIR"
+    migrate_legacy_prices_file "$TARGET_DIR"
+    migrate_legacy_council_yml "$TARGET_DIR"
 
     # 0b. Resolve settings (e.g. augment.rules_use_symlinks). On first
     #     install the file does not exist yet → defaults preserved.
@@ -823,7 +925,7 @@ main() {
             if [[ "$airgap_mode" == "api" ]]; then
                 echo ""
                 echo "⚠️  airgapped environment detected — defaulting to mode: api"
-                echo "    Set defaults.member_mode: api in agents/.ai-council.yml when configuring the council."
+                echo "    Set defaults.member_mode: api in agents/settings/.ai-council.yml when configuring the council."
             fi
         fi
     elif ! $QUIET; then

package/scripts/inventory_frontmatter.py

@@ -10,7 +10,7 @@ YAML frontmatter of every file, and prints per-type:
 - sample values (up to 3) per key
 
 Output is Markdown on stdout, intended to be captured into
-`agents/docs/frontmatter-contract.md` as raw material for Phase 1 of the
+`agents/reference/docs/frontmatter-contract.md` as raw material for Phase 1 of the
 frontmatter-schema roadmap.
 
 Stdlib-only. No PyYAML — we do a simple line-based parse sufficient for

package/scripts/lint_agents_layout.py

@@ -0,0 +1,103 @@
+#!/usr/bin/env python3
+"""CI guard for the `agents/` top-level layout.
+
+The `agents/` tree is the project boundary for memory, roadmaps,
+runtime artefacts, settings, audits, and policies. Flat files at the
+`agents/` root are restricted to a small, intentional whitelist —
+everything else lives in a typed subdirectory (`runtime/`, `settings/`,
+`audits/`, `roadmaps/`, `policies/`, `contexts/`, etc.).
+
+Categories:
+
+  ALLOWED  — Whitelisted flat files. Linter is silent.
+  UNKNOWN  — Anything else. Linter fails.
+
+Exit codes:
+  0 — layout is clean.
+  1 — at least one UNKNOWN file.
+
+Invocation (from project root):
+  python3 scripts/lint_agents_layout.py
+  python3 scripts/lint_agents_layout.py --strict
+  python3 scripts/lint_agents_layout.py --quiet
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+AGENTS_ROOT = Path("agents")
+
+# Intentional flat files at agents/ root. Anything not in this set is
+# UNKNOWN (linter failure). Durable records live under typed subdirs:
+# decisions/ (low-impact corpus, ADR-style records), evidence/ (durable
+# reports / metrics / council artefacts), runtime/ (volatile, gitignored).
+ALLOWED_FLAT_FILES: frozenset[str] = frozenset(
+    {
+        # Entry document — narrative pointer to the agents/ tree.
+        "index.md",
+        # D1 anchor / progress dashboard — kept at root by the
+        # roadmap-progress-sync rule so consumers see it first.
+        "roadmaps-progress.md",
+        # Worked example for the ai-video pipeline. Stays adjacent to
+        # the agents/reference/ai-video/ dir as a reference template.
+        ".ai-video.xml.example",
+        # Empty-tree sentinel so agents/ survives a fresh checkout
+        # before any runtime artefact lands.
+        ".gitkeep",
+    }
+)
+
+
+def find_violations(root: Path) -> list[str]:
+    """Return UNKNOWN flat-file violations at the agents/ root."""
+    unknown: list[str] = []
+    if not root.is_dir():
+        return unknown
+
+    for path in sorted(root.iterdir()):
+        if not path.is_file():
+            continue
+        name = path.name
+        if name in ALLOWED_FLAT_FILES:
+            continue
+        unknown.append(
+            f"{path}: flat file not in agents/ whitelist — move to a typed "
+            f"subdirectory (runtime/, evidence/, decisions/, settings/, "
+            f"audits/, roadmaps/, policies/, contexts/, …) or add to "
+            f"ALLOWED_FLAT_FILES in scripts/lint_agents_layout.py with "
+            f"rationale."
+        )
+
+    return unknown
+
+
+def main() -> int:
+    args = sys.argv[1:]
+    # --strict kept for backward-compat; no longer affects exit code now
+    # that the LEGACY tier is gone.
+    _ = "--strict" in args
+    quiet = "--quiet" in args
+
+    unknown = find_violations(AGENTS_ROOT)
+
+    if unknown:
+        print("❌  agents/ layout violations (unknown flat files):\n")
+        for f in unknown:
+            print(f"  - {f}")
+        print(
+            "\nRule: scripts/lint_agents_layout.py — flat files at agents/ "
+            "root must be whitelisted. Typed subdirectories: runtime/, "
+            "evidence/, decisions/, settings/, audits/, roadmaps/, "
+            "policies/, contexts/, … ."
+        )
+        return 1
+
+    if not quiet:
+        print("✅  agents/ layout clean.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/lint_archived_skills.py

@@ -1,10 +1,10 @@
 #!/usr/bin/env python3
-"""Lint archive notes under agents/archived-skills/.
+"""Lint archive notes under agents/evidence/archived-skills/.
 
 Enforces the contract from
 .agent-src.uncompressed/templates/skill-archive-note.md:
 
-  1. Every <slug>.md under agents/archived-skills/ has the six required
+  1. Every <slug>.md under agents/evidence/archived-skills/ has the six required
      frontmatter fields with valid values.
   2. `reason` is one of {unused, merged, superseded, deprecated}.
   3. When `reason ∈ {merged, superseded}` the `replacement` slug exists
@@ -14,7 +14,7 @@ Enforces the contract from
      its frontmatter `replaced_by:` field.
 
 Hooked into `task ci` via `task lint-archived-skills`. Passes cleanly
-against an empty agents/archived-skills/ (only README.md present).
+against an empty agents/evidence/archived-skills/ (only README.md present).
 
 Exit codes:
   0  contract holds

package/scripts/lint_artefact_frontmatter.py

@@ -0,0 +1,180 @@
+#!/usr/bin/env python3
+"""Lint Phase-4 discovery frontmatter on every artefact.
+
+Walks the same trees as `scripts/build_discovery_manifest.py` (skills,
+rules, commands, templates under `.agent-src.uncompressed/`) and asserts
+per-file that the five ADR-013 keys (`workspaces`, `packs`, `lifecycle`,
+`trust`, `install`) are present and well-formed:
+
+  - `workspaces:` exists, is a non-empty list, every value in `workspaces.yml`
+  - `packs:`      exists, is a non-empty list, every value in `packs.yml`
+  - `lifecycle:`  is one of {active, deprecated, experimental, archived}
+  - `trust.level` is one of {core, professional, experimental, advisory, restricted}
+  - `trust.confidence` is one of {high, medium, low}
+  - `trust.human_review_required` is a bool
+  - `install.default` and `install.removable` are bools
+  - artefact path is not also listed in `unassigned-artefacts.yml`
+
+Exits 0 clean, 1 on any violation. Stdlib + pyyaml. Cap: ≤ 200 LOC.
+"""
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+from typing import Any
+
+try:
+    import yaml
+except ImportError:  # pragma: no cover
+    print("ERROR: PyYAML required (pip install pyyaml)", file=sys.stderr)
+    sys.exit(2)
+
+ROOT = Path(__file__).resolve().parents[1]
+SRC = ROOT / ".agent-src.uncompressed"
+VOCAB_DIR = ROOT / "config" / "discovery"
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from validate_frontmatter import parse_frontmatter  # noqa: E402
+
+LIFECYCLES = frozenset({"active", "deprecated", "experimental", "archived"})
+TRUST_LEVELS = frozenset(
+    {"core", "professional", "experimental", "advisory", "restricted"}
+)
+TRUST_CONFIDENCE = frozenset({"high", "medium", "low"})
+
+
+def _load_vocab() -> tuple[set[str], set[str], set[str]]:
+    ws = yaml.safe_load((VOCAB_DIR / "workspaces.yml").read_text("utf-8")) or []
+    packs = yaml.safe_load((VOCAB_DIR / "packs.yml").read_text("utf-8")) or []
+    raw_un = yaml.safe_load((VOCAB_DIR / "unassigned-artefacts.yml").read_text("utf-8")) or []
+    ws_ids = {e["id"] for e in ws}
+    pack_ids = {e["id"] for e in packs}
+    quarantine = {e["path"] for e in raw_un}
+    return ws_ids, pack_ids, quarantine
+
+
+def _iter_artefacts() -> list[Path]:
+    out: list[Path] = []
+    for p in sorted((SRC / "skills").rglob("SKILL.md")):
+        out.append(p)
+    for p in sorted((SRC / "rules").rglob("*.md")):
+        out.append(p)
+    for p in sorted((SRC / "commands").rglob("*.md")):
+        out.append(p)
+    if (SRC / "templates").exists():
+        for p in sorted((SRC / "templates").rglob("*.md")):
+            out.append(p)
+    return out
+
+
+def _check_one(
+    path: Path,
+    ws_ids: set[str],
+    pack_ids: set[str],
+    quarantine: set[str],
+) -> list[str]:
+    rel = path.relative_to(ROOT).as_posix()
+    errs: list[str] = []
+    if rel in quarantine:
+        # Quarantined scaffolds are not required to carry frontmatter and
+        # must NOT also try to (would shadow the materialisation contract).
+        text = path.read_text("utf-8", errors="replace")
+        fm, _ = parse_frontmatter(text)
+        if isinstance(fm, dict) and any(
+            k in fm for k in ("workspaces", "packs", "lifecycle", "trust", "install")
+        ):
+            errs.append(
+                f"{rel}: quarantined in unassigned-artefacts.yml but carries"
+                " discovery frontmatter — remove one or the other."
+            )
+        return errs
+
+    text = path.read_text("utf-8", errors="replace")
+    fm, _ = parse_frontmatter(text)
+    if not isinstance(fm, dict):
+        errs.append(f"{rel}: missing or unparseable frontmatter")
+        return errs
+
+    for key in ("workspaces", "packs", "lifecycle", "trust", "install"):
+        if key not in fm:
+            errs.append(f"{rel}: missing required key `{key}`")
+    if errs:
+        return errs
+
+    ws = fm["workspaces"]
+    if not isinstance(ws, list) or not ws:
+        errs.append(f"{rel}: workspaces must be a non-empty list")
+    else:
+        bad = [w for w in ws if w not in ws_ids]
+        if bad:
+            errs.append(f"{rel}: workspaces not in workspaces.yml: {bad}")
+
+    packs = fm["packs"]
+    if not isinstance(packs, list) or not packs:
+        errs.append(f"{rel}: packs must be a non-empty list")
+    else:
+        bad = [p for p in packs if p not in pack_ids]
+        if bad:
+            errs.append(f"{rel}: packs not in packs.yml: {bad}")
+
+    lc = fm["lifecycle"]
+    if lc not in LIFECYCLES:
+        errs.append(f"{rel}: lifecycle `{lc}` not in {sorted(LIFECYCLES)}")
+
+    trust = fm["trust"]
+    if not isinstance(trust, dict):
+        errs.append(f"{rel}: trust must be a mapping")
+    else:
+        if trust.get("level") not in TRUST_LEVELS:
+            errs.append(
+                f"{rel}: trust.level `{trust.get('level')}` not in {sorted(TRUST_LEVELS)}"
+            )
+        if trust.get("confidence") not in TRUST_CONFIDENCE:
+            errs.append(
+                f"{rel}: trust.confidence `{trust.get('confidence')}` not in"
+                f" {sorted(TRUST_CONFIDENCE)}"
+            )
+        if not isinstance(trust.get("human_review_required"), bool):
+            errs.append(f"{rel}: trust.human_review_required must be bool")
+
+    install = fm["install"]
+    if not isinstance(install, dict):
+        errs.append(f"{rel}: install must be a mapping")
+    else:
+        if not isinstance(install.get("default"), bool):
+            errs.append(f"{rel}: install.default must be bool")
+        if not isinstance(install.get("removable"), bool):
+            errs.append(f"{rel}: install.removable must be bool")
+    return errs
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--quiet", action="store_true")
+    args = parser.parse_args(argv)
+
+    ws_ids, pack_ids, quarantine = _load_vocab()
+    artefacts = _iter_artefacts()
+    all_errs: list[str] = []
+    for p in artefacts:
+        all_errs.extend(_check_one(p, ws_ids, pack_ids, quarantine))
+
+    if all_errs:
+        for e in all_errs:
+            print(f"ERROR: {e}", file=sys.stderr)
+        print(
+            f"\n{len(all_errs)} violation(s) across {len(artefacts)} artefact(s).",
+            file=sys.stderr,
+        )
+        return 1
+    if not args.quiet:
+        print(
+            f"✅  lint-artefact-frontmatter: {len(artefacts)} artefact(s) clean"
+            f" (quarantine: {len(quarantine)})."
+        )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/lint_discovery_manifest.py

@@ -0,0 +1,136 @@
+#!/usr/bin/env python3
+"""Lint a generated discovery-manifest.json against schema + checksum.
+
+Checks:
+1. File parses as JSON.
+2. Validates against `docs/contracts/discovery-manifest.schema.json`.
+3. Recomputes sha256 with the `checksum` field zeroed and compares.
+4. Cross-references workspace / pack IDs against `config/discovery/*.yml`.
+
+CLI:
+  python scripts/lint_discovery_manifest.py [--manifest PATH]
+
+Exit codes:
+  0  clean
+  1  schema or integrity failure
+"""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import sys
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+try:
+    import jsonschema
+except ImportError:
+    print("error: jsonschema not installed (pip install jsonschema)", file=sys.stderr)
+    sys.exit(1)
+
+ROOT = Path(__file__).resolve().parents[1]
+SCHEMA_PATH = ROOT / "docs" / "contracts" / "discovery-manifest.schema.json"
+VOCAB_DIR = ROOT / "config" / "discovery"
+DEFAULT_MANIFEST = ROOT / "dist" / "discovery" / "discovery-manifest.json"
+
+
+def _serialize(manifest: dict[str, Any]) -> str:
+    return json.dumps(manifest, indent=2, sort_keys=True, ensure_ascii=False) + "\n"
+
+
+def _check_checksum(manifest: dict[str, Any]) -> str | None:
+    actual = manifest.get("checksum", "")
+    if not isinstance(actual, str) or not actual.startswith("sha256:"):
+        return f"checksum: malformed value {actual!r}"
+    # Mirror scripts/build_discovery_manifest.py::_finalise_checksum —
+    # `generated_at` is wall-clock and excluded from the digest input so
+    # the hash stays byte-stable across runs.
+    snapshot = dict(manifest)
+    snapshot["checksum"] = "sha256:" + "0" * 64
+    snapshot["generated_at"] = "<normalised>"
+    raw = _serialize(snapshot).encode("utf-8")
+    expected = "sha256:" + hashlib.sha256(raw).hexdigest()
+    if expected != actual:
+        return f"checksum mismatch: expected {expected}, got {actual}"
+    return None
+
+
+def _check_vocab(manifest: dict[str, Any]) -> list[str]:
+    errs: list[str] = []
+    workspaces = yaml.safe_load((VOCAB_DIR / "workspaces.yml").read_text(encoding="utf-8")) or []
+    packs = yaml.safe_load((VOCAB_DIR / "packs.yml").read_text(encoding="utf-8")) or []
+    ws_ids = {w["id"] for w in workspaces}
+    pack_ids = {p["id"] for p in packs}
+
+    m_ws_ids = {w["id"] for w in manifest.get("workspaces", [])}
+    m_pk_ids = {p["id"] for p in manifest.get("packs", [])}
+    if m_ws_ids != ws_ids:
+        diff = ws_ids ^ m_ws_ids
+        errs.append(f"workspaces: vocabulary/manifest mismatch on {sorted(diff)}")
+    if m_pk_ids != pack_ids:
+        diff = pack_ids ^ m_pk_ids
+        errs.append(f"packs: vocabulary/manifest mismatch on {sorted(diff)}")
+
+    for a in manifest.get("artefacts", []):
+        for w in a.get("workspaces", []):
+            if w not in ws_ids:
+                errs.append(f"{a['path']}: unknown workspace '{w}'")
+        for p in a.get("packs", []):
+            if p not in pack_ids:
+                errs.append(f"{a['path']}: unknown pack '{p}'")
+    return errs
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--manifest", type=Path, default=DEFAULT_MANIFEST)
+    parser.add_argument("--quiet", action="store_true")
+    args = parser.parse_args(argv)
+
+    if not args.manifest.exists():
+        print(f"error: manifest not found at {args.manifest}", file=sys.stderr)
+        return 1
+
+    try:
+        manifest = json.loads(args.manifest.read_text(encoding="utf-8"))
+    except json.JSONDecodeError as exc:
+        print(f"error: invalid JSON: {exc}", file=sys.stderr)
+        return 1
+
+    schema = json.loads(SCHEMA_PATH.read_text(encoding="utf-8"))
+    try:
+        jsonschema.validate(manifest, schema)
+    except jsonschema.ValidationError as exc:
+        print(f"schema error: {exc.message}", file=sys.stderr)
+        path = "/".join(str(p) for p in exc.absolute_path)
+        if path:
+            print(f"  at: {path}", file=sys.stderr)
+        return 1
+
+    if (err := _check_checksum(manifest)):
+        print(f"error: {err}", file=sys.stderr)
+        return 1
+
+    vocab_errs = _check_vocab(manifest)
+    if vocab_errs:
+        for e in vocab_errs[:20]:
+            print(f"error: {e}", file=sys.stderr)
+        if len(vocab_errs) > 20:
+            print(f"  ... and {len(vocab_errs) - 20} more", file=sys.stderr)
+        return 1
+
+    if not args.quiet:
+        print(
+            f"OK {args.manifest.relative_to(ROOT)}: "
+            f"{len(manifest['artefacts'])} artefacts, "
+            f"{len(manifest['unassigned'])} unassigned, "
+            f"checksum verified"
+        )
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())