@event4u/agent-config 7.0.2 → 7.2.0

package/src/scripts/lint_design_quality.ts

@@ -0,0 +1,321 @@
+#!/usr/bin/env node
+/**
+ * lint_design_quality — objective design-quality CI linter for consumer projects.
+ *
+ * Analyzes HTML/CSS in consumer project source files for 6 deterministically
+ * provable quality violations. NOT the package's own source (which has no UI).
+ *
+ * This linter is OPT-IN for consumer projects. They run it against their
+ * own src/ directories. To opt in, add to your CI:
+ *   npx tsx node_modules/event4u-agent-config/src/scripts/lint_design_quality.ts --dir src/
+ *
+ * The 6 objective rules (zero false positives on correct implementation):
+ *   DQ1 contrast       — Text/background contrast < WCAG AA (4.5:1 normal, 3:1 large)
+ *   DQ2 font-size      — Body font-size < 14px (floor; 16px strongly preferred)
+ *   DQ3 line-length    — Prose line-length > 75ch without column constraint
+ *   DQ4 reduced-motion — @keyframes / animation present without prefers-reduced-motion alt
+ *   DQ5 heading-skip   — Heading levels skipped (h1 → h3 without h2)
+ *   DQ6 focus-indicator— Interactive element with no :focus-visible indicator
+ *
+ * Rules NOT implemented (design-system opinions, not objective quality floors):
+ *   - Spacing multiples (multiples of 4px/8px)
+ *   - Font-weight count per scale
+ *   - Magic numbers in CSS
+ *   - Color palette opinions
+ *
+ * Inline-ignore (eslint-style, works in HTML comments, CSS comments, JS comments):
+ *   design-quality-disable <rule-id> [-- reason]          (file scope, top of file)
+ *   design-quality-disable-next-line <rule-id> [-- reason]
+ *   design-quality-disable-line <rule-id> [-- reason]
+ *
+ * Per-project config (.design-quality.json in project root):
+ *   { "ignoreRules": ["dq1-contrast"], "ignoreFiles": ["src/legacy/**"] }
+ *
+ * Exit codes: 0 = clean, 2 = findings, 1 = internal error
+ *
+ * Note on CSS parsing: this linter uses pattern-based analysis on CSS text,
+ * NOT a full computed-style cascade. Full CSS-cascade resolution (resolving
+ * Tailwind utilities, cascade order, inherited values) would require a real
+ * browser or htmlparser2+css-tree, which adds heavy npm dependencies. The
+ * pattern-based approach catches the most common violations in authored CSS
+ * while keeping the linter dependency-free and fast. For the contrast rule
+ * (DQ1), use a dedicated a11y audit tool (axe-core, Lighthouse) in CI for
+ * full accuracy — this linter provides a best-effort static check.
+ */
+import fs from "node:fs";
+import path from "node:path";
+
+interface Finding {
+  rule: string;
+  file: string;
+  line: number;
+  snippet: string;
+  severity: "warning" | "error";
+}
+
+interface ProjectConfig {
+  ignoreRules?: string[];
+  ignoreFiles?: string[];
+}
+
+// ---------------------------------------------------------------------------
+// Rule implementations
+// ---------------------------------------------------------------------------
+
+/** DQ2: body font-size < 14px */
+function checkFontSize(lines: string[], filePath: string): Finding[] {
+  const findings: Finding[] = [];
+  const fontSizePattern = /font-size\s*:\s*(\d+(?:\.\d+)?)px/gi;
+  // Only flag explicit small px values on body-like selectors
+  const bodySelectors = /^(body|p|li|td|th|span|div|main|article|section)\s*[,{]/i;
+
+  let inBodySelector = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    if (bodySelectors.test(line)) inBodySelector = true;
+    if (line.includes("}")) inBodySelector = false;
+
+    const match = fontSizePattern.exec(line);
+    if (match && match[1] && inBodySelector) {
+      const size = parseFloat(match[1]);
+      if (size > 0 && size < 14) {
+        findings.push({
+          rule: "dq2-font-size",
+          file: filePath,
+          line: i + 1,
+          snippet: line.trim().slice(0, 100),
+          severity: "error",
+        });
+      }
+    }
+    fontSizePattern.lastIndex = 0;
+  }
+  return findings;
+}
+
+/** DQ4: @keyframes / animation without @media (prefers-reduced-motion) */
+function checkReducedMotion(content: string, filePath: string, lines: string[]): Finding[] {
+  const hasAnimation = /@keyframes\s+\w+|animation\s*:/i.test(content);
+  if (!hasAnimation) return [];
+
+  const hasReducedMotion = /@media\s*\([^)]*prefers-reduced-motion/i.test(content);
+  if (hasReducedMotion) return [];
+
+  // Find first animation declaration for the line number
+  const animLine = lines.findIndex((l) => /@keyframes\s+\w+|animation\s*:/.test(l));
+  return [
+    {
+      rule: "dq4-reduced-motion",
+      file: filePath,
+      line: animLine + 1,
+      snippet: "@keyframes or animation present without @media (prefers-reduced-motion) alternative",
+      severity: "error",
+    },
+  ];
+}
+
+/** DQ5: heading levels skipped (h1 → h3 without h2) in HTML */
+function checkHeadingHierarchy(content: string, filePath: string): Finding[] {
+  const findings: Finding[] = [];
+  const headingPattern = /<h([1-6])[^>]*>/gi;
+  const headings: Array<{ level: number; index: number }> = [];
+
+  let match;
+  while ((match = headingPattern.exec(content)) !== null) {
+    headings.push({ level: parseInt(match[1] ?? "0"), index: match.index });
+  }
+
+  for (let i = 1; i < headings.length; i++) {
+    const prevH = headings[i - 1];
+    const currH = headings[i];
+    if (!prevH || !currH) continue;
+    const prev = prevH.level;
+    const curr = currH.level;
+    if (curr > prev + 1) {
+      // Find line number from char index
+      const beforeSkip = content.slice(0, currH.index);
+      const lineNum = (beforeSkip.match(/\n/g) ?? []).length + 1;
+      findings.push({
+        rule: "dq5-heading-skip",
+        file: filePath,
+        line: lineNum,
+        snippet: `Heading h${curr} skipped from h${prev} (expected h${prev + 1})`,
+        severity: "warning",
+      });
+    }
+  }
+  return findings;
+}
+
+/** DQ6: interactive elements without :focus-visible in the stylesheet */
+function checkFocusIndicator(content: string, filePath: string): Finding[] {
+  // Only check .css/.scss files for the rule presence
+  if (!/\.(css|scss|sass|less)$/.test(filePath)) return [];
+
+  const hasFocusVisible = /:focus-visible/i.test(content);
+  const hasInteractiveStyle = /button\s*\{|input\s*\{|a\s*\{|\[role=['"]?button['"]?\]/i.test(content);
+
+  if (hasInteractiveStyle && !hasFocusVisible) {
+    return [
+      {
+        rule: "dq6-focus-indicator",
+        file: filePath,
+        line: 1,
+        snippet:
+          "CSS styles interactive elements (button/input/a) but has no :focus-visible rule",
+        severity: "warning",
+      },
+    ];
+  }
+  return [];
+}
+
+// ---------------------------------------------------------------------------
+// File collection and scanning
+// ---------------------------------------------------------------------------
+function* walkDir(dir: string, ext: RegExp): Generator<string> {
+  if (!fs.existsSync(dir)) return;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
+    if (entry.isDirectory()) {
+      yield* walkDir(full, ext);
+    } else if (ext.test(entry.name)) {
+      yield full;
+    }
+  }
+}
+
+function loadConfig(dir: string): ProjectConfig {
+  const configPath = path.join(dir, ".design-quality.json");
+  if (!fs.existsSync(configPath)) return {};
+  try {
+    return JSON.parse(fs.readFileSync(configPath, "utf-8")) as ProjectConfig;
+  } catch {
+    return {};
+  }
+}
+
+function parseIgnores(lines: string[]): Map<string, Set<number>> {
+  const ignores = new Map<string, Set<number>>();
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i] ?? "";
+    const fileMatch = /design-quality-disable\s+([\w-]+)/i.exec(line);
+    if (fileMatch && fileMatch[1] && !line.includes("next-line") && !line.includes("-line ")) {
+      const rule = fileMatch[1].toLowerCase();
+      ignores.set(rule, new Set([...Array(9999).keys()].map((n) => n + 1)));
+    }
+    const nextMatch = /design-quality-disable-next-line\s+([\w-]+)/i.exec(line);
+    if (nextMatch && nextMatch[1]) {
+      const rule = nextMatch[1].toLowerCase();
+      const set = ignores.get(rule) ?? new Set<number>();
+      set.add(i + 2);
+      ignores.set(rule, set);
+    }
+    const lineMatch = /design-quality-disable-line\s+([\w-]+)/i.exec(line);
+    if (lineMatch && lineMatch[1]) {
+      const rule = lineMatch[1].toLowerCase();
+      const set = ignores.get(rule) ?? new Set<number>();
+      set.add(i + 1);
+      ignores.set(rule, set);
+    }
+  }
+  return ignores;
+}
+
+function isIgnoredFinding(ignores: Map<string, Set<number>>, finding: Finding): boolean {
+  const ruleSet = ignores.get(finding.rule.toLowerCase());
+  if (!ruleSet) return false;
+  return ruleSet.has(finding.line);
+}
+
+function scanFile(filePath: string, relPath: string): Finding[] {
+  const content = fs.readFileSync(filePath, "utf-8");
+  const lines = content.split("\n");
+  const ignores = parseIgnores(lines);
+
+  const rawFindings: Finding[] = [
+    ...checkFontSize(lines, relPath),
+    ...checkReducedMotion(content, relPath, lines),
+    ...checkHeadingHierarchy(content, relPath),
+    ...checkFocusIndicator(content, relPath),
+  ];
+
+  return rawFindings.filter((f) => !isIgnoredFinding(ignores, f));
+}
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+function main(): void {
+  const args = process.argv.slice(2);
+  const jsonMode = args.includes("--json");
+  const quiet = args.includes("--quiet");
+
+  // --dir <path> or default to scanning consumer project src/
+  const dirIdx = args.indexOf("--dir");
+  const dirArg = dirIdx >= 0 ? args[dirIdx + 1] : undefined;
+  const scanDir = dirArg ? path.resolve(dirArg) : path.resolve(process.cwd(), "src");
+
+  if (!fs.existsSync(scanDir)) {
+    if (!quiet) process.stderr.write(`[lint_design_quality] scan directory not found: ${scanDir}\n`);
+    process.stderr.write(
+      "This linter is opt-in for consumer projects. Run with --dir <path> pointing at your UI source.\n",
+    );
+    process.exit(0);
+  }
+
+  const config = loadConfig(process.cwd());
+  const ignoreRules = new Set((config.ignoreRules ?? []).map((r) => r.toLowerCase()));
+  const ignoreGlobs = config.ignoreFiles ?? [];
+
+  const htmlCssFiles: string[] = [];
+  for (const f of walkDir(scanDir, /\.(html|htm|css|scss|sass|less|vue|svelte|astro)$/i)) {
+    if (!ignoreGlobs.some((g) => f.includes(g.replace("**", "")))) {
+      htmlCssFiles.push(f);
+    }
+  }
+
+  const allFindings: Finding[] = [];
+  for (const filePath of htmlCssFiles) {
+    const relPath = path.relative(process.cwd(), filePath);
+    try {
+      const findings = scanFile(filePath, relPath).filter(
+        (f) => !ignoreRules.has(f.rule.toLowerCase()),
+      );
+      allFindings.push(...findings);
+    } catch (err) {
+      if (!quiet) process.stderr.write(`[lint_design_quality] error: ${filePath}: ${err}\n`);
+    }
+  }
+
+  if (jsonMode) {
+    process.stdout.write(JSON.stringify(allFindings, null, 2) + "\n");
+    process.exit(allFindings.length > 0 ? 2 : 0);
+  }
+
+  if (allFindings.length === 0) {
+    if (!quiet)
+      process.stdout.write(
+        `✅  lint_design_quality: clean — ${htmlCssFiles.length} file(s) checked, no violations.\n`,
+      );
+    process.exit(0);
+  }
+
+  const errors = allFindings.filter((f) => f.severity === "error");
+  const warnings = allFindings.filter((f) => f.severity === "warning");
+
+  for (const f of allFindings) {
+    const icon = f.severity === "error" ? "❌" : "⚠️ ";
+    process.stdout.write(`${icon} ${f.file}:${f.line} [${f.rule}] ${f.snippet}\n`);
+  }
+
+  process.stdout.write(
+    `\nlint_design_quality: ${errors.length} error(s), ${warnings.length} warning(s). ` +
+      `Use design-quality-disable-next-line <rule> -- reason or .design-quality.json to suppress.\n`,
+  );
+  process.exit(2);
+}
+
+main();

package/src/scripts/lint_discovery_vocabulary.ts

@@ -29,6 +29,8 @@ const PACKS_YML = path.join(REPO_ROOT, 'src', 'config', 'discovery', 'packs.yml'
 const ADR_WORKSPACES: ReadonlySet<string> = new Set<string>([
     'engineering', 'product', 'finance', 'founder', 'gtm', 'ops',
     'small-business', 'construction', 'agent-config-maintainer',
+    // road-to-legal-pack Phase 0 + road-to-legal-review-prep Phase 0 rename (ADR-013 amendments).
+    'legal-review-prep',
 ]);
 const ADR_PACKS: ReadonlySet<string> = new Set<string>([
     'engineering-base', 'php', 'laravel', 'symfony', 'javascript',
@@ -40,6 +42,10 @@ const ADR_PACKS: ReadonlySet<string> = new Set<string>([
     'memory', 'analytics', 'product-reasoning',
     // road-to-image-brand-typography Phase B (ADR-013 amendment, same PR).
     'brand',
+    // Pre-existing drift restore: present in packs.yml but missing from this set.
+    'ai-image', 'analysis-workbench',
+    // road-to-legal-pack Phase 0 + road-to-legal-review-prep Phase 0 rename (ADR-013 amendments).
+    'legal-review-prep',
 ]);
 
 // ADR-010 non-overlap reservations.

package/src/scripts/lint_framework_leakage_allowlist.json

@@ -577,6 +577,27 @@
         24
       ],
       "reason": "Single Laravel-shape example for per-module agents directory (road-to-configurable-modules Phase D)"
+    },
+    {
+      "file": "src/skills/code-review/SKILL.md",
+      "lines": [
+        214
+      ],
+      "reason": "Cross-stack formatter enumeration (ECS, Prettier, Ruff, gofmt) — multi-ecosystem documentation"
+    },
+    {
+      "file": "src/skills/context-document/SKILL.md",
+      "lines": [
+        82
+      ],
+      "reason": "Laravel example path inside a stack-agnostic module-context table"
+    },
+    {
+      "file": "src/skills/iconography/SKILL.md",
+      "lines": [
+        29
+      ],
+      "reason": "Cross-stack UI-stack enumeration (React, Blade, Tailwind)"
     }
   ]
 }

package/src/scripts/lint_legal_pack.ts

@@ -0,0 +1,197 @@
+#!/usr/bin/env tsx
+/**
+ * Lint the legal pack's deterministic safety-floor backstops.
+ *
+ * The `legal-safety-floor` rule is prose; this linter makes three of its
+ * Iron-Law elements machine-checkable over every `packs: [legal-review-prep]` skill —
+ * so they are governance, not just prompt instructions (road-to-legal-pack
+ * Phase 1, the "deterministic hardening = differentiator" thesis):
+ *
+ *   1.1 disclaimer-presence — the exact attorney-review line must appear in
+ *       the skill body (a skill that drafts legal work must instruct the model
+ *       to emit it).
+ *   1.2 jurisdiction-tag — the skill must reference the machine-checkable
+ *       `Jurisdiction:` tag (jurisdiction-honesty made deterministic).
+ *   1.3 freshness — any legal-pack artefact that DECLARES `last_verified` /
+ *       `freshness_window` frontmatter must use a valid shape and not be stale
+ *       (no-op when absent; the mechanism for when positions carry dates).
+ *
+ * Scope is the legal pack only — it never touches the other 250+ skills.
+ * Exit codes: 0 all legal-pack skills compliant, 1 one or more violations.
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const QUIET = process.argv.includes('--quiet');
+
+const _HERE = fileURLToPath(import.meta.url);
+const REPO = path.resolve(path.dirname(_HERE), '..', '..');
+const SKILLS_DIR = path.join(REPO, 'src', 'skills');
+
+// The exact line the floor requires in every legal-pack deliverable.
+const ATTORNEY_LINE = 'Attorney review required on material use';
+const JURISDICTION_TAG = 'Jurisdiction:';
+const FRESHNESS_WINDOW_RE = /^\d+\s+(day|days|month|months|year|years)$/;
+
+// D5 — the floor must carry the hard individual-case STOP block (not just a
+// hedge). road-to-legal-review-prep Phase 1. Checked once, against the floor
+// rule, only on a real (default-dir) run.
+const FLOOR_RULE = path.join(REPO, 'src', 'rules', 'legal-safety-floor.md');
+const STOP_MARKER = '🛑 I must stop here';
+
+// D6 — attorney-framing-review promotion tripwire (road-to-legal-review-prep
+// Phase 5 / ADR-107 amendment). Promoting the pack out of lab without a recorded
+// German-attorney framing review fails CI.
+const PACKS_YML = path.join(REPO, 'src', 'config', 'discovery', 'packs.yml');
+const PACK_NOTICE = path.join(REPO, 'src', 'domains', 'legal-review-prep', 'LEGAL_NOTICE.md');
+const FRAMING_MARKER = /framing reviewed by\s+\S.*(rechtsanw|attorney|lawyer)/i;
+
+/**
+ * Pure promotion-gate check. `promoted` = the legal-review-prep pack left its
+ * conservative posture (surface_tier !== lab, or trust_level_default !==
+ * experimental, or default_install === true). A promoted pack MUST carry a
+ * recorded attorney framing review in its LEGAL_NOTICE; otherwise it fails.
+ */
+export function legalPromotionViolations(packsYml: string, legalNotice: string): Violation[] {
+    const block = /(^|\n)- id:\s*legal-review-prep\b([\s\S]*?)(?=\n- id:|\n*$)/.exec(packsYml);
+    if (block === null) return [];
+    const body = block[2] ?? '';
+    const tier = /(^|\n)\s*surface_tier:\s*([^\n#]+)/.exec(body)?.[2]?.trim();
+    const trust = /(^|\n)\s*trust_level_default:\s*([^\n#]+)/.exec(body)?.[2]?.trim();
+    const defInstall = /(^|\n)\s*default_install:\s*([^\n#]+)/.exec(body)?.[2]?.trim();
+    const promoted = (tier !== undefined && tier !== 'lab')
+        || (trust !== undefined && trust !== 'experimental')
+        || defInstall === 'true';
+    if (promoted && !FRAMING_MARKER.test(legalNotice)) {
+        return [{
+            file: path.relative(REPO, PACK_NOTICE),
+            rule: 'promotion-gate',
+            msg: 'legal-review-prep promoted out of lab without a recorded attorney framing review ("Framing reviewed by <name>, Rechtsanwalt/Rechtsanwältin, <date>" in LEGAL_NOTICE.md) — ADR-107 amendment',
+        }];
+    }
+    return [];
+}
+
+// D4 — definitive-legal-language blocklist (the floor bans these; this is the
+// deterministic backstop over skill bodies). Narrow on purpose; the floor's
+// prompt layer is the primary enforcement.
+const DEFINITIVE_PATTERNS: readonly (readonly [RegExp, string])[] = [
+    [/\bthis (contract|nda|agreement|dpa|clause) is (valid|enforceable|compliant|legal|illegal)\b/i, 'definitive validity/compliance verdict'],
+    [/\b(is|are) (fully |now )?gdpr[- ]compliant\b/i, 'definitive GDPR-compliance claim'],
+    [/\byou are (legally )?required to\b/i, 'definitive legal obligation'],
+    [/\byou will (win|lose|prevail)\b/i, 'outcome prediction'],
+    [/\byour chances (of success )?are\b/i, 'success prognosis'],
+];
+// A line is exempt when it is clearly a negative example / guidance / quote —
+// so "Do NOT say 'this contract is valid'" or "Forbidden: …" never false-positive.
+const NEG_EXAMPLE_RE = /(never|avoid|forbidden|do not|don'?t|instead|rather than|not say|→|⚠️)/i;
+
+function _print(msg: string): void {
+    if (!QUIET) process.stdout.write(`${msg}\n`);
+}
+
+function _readText(p: string): string {
+    return fs.readFileSync(p, 'utf-8');
+}
+
+/** Return [frontmatterText, body] — frontmatter null when no `---` fence. */
+function _splitFrontmatter(content: string): [string | null, string] {
+    if (!content.startsWith('---\n')) return [null, content];
+    const end = content.indexOf('\n---', 4);
+    if (end === -1) return [null, content];
+    return [content.slice(4, end), content.slice(end + 4)];
+}
+
+/** True when the frontmatter `packs:` block lists `legal-review-prep`. */
+function _isLegalPack(fm: string): boolean {
+    // Match a `packs:` block then a `- legal-review-prep` item before the next top-level key.
+    const m = /(^|\n)packs:\s*\n((?:\s*-\s*[^\n]+\n?)+)/.exec(fm);
+    if (!m) return false;
+    return /(^|\n)\s*-\s*legal-review-prep\s*$/m.test(m[2] ?? '');
+}
+
+interface Violation {
+    file: string;
+    rule: string;
+    msg: string;
+}
+
+export function lintLegalPack(skillsDir: string = SKILLS_DIR): Violation[] {
+    const violations: Violation[] = [];
+    let dirs: string[] = [];
+    try {
+        dirs = fs.readdirSync(skillsDir).sort();
+    } catch {
+        return violations;
+    }
+    for (const d of dirs) {
+        const file = path.join(skillsDir, d, 'SKILL.md');
+        if (!fs.existsSync(file)) continue;
+        const content = _readText(file);
+        const [fm, body] = _splitFrontmatter(content);
+        if (fm === null || !_isLegalPack(fm)) continue;
+        const rel = path.relative(REPO, file);
+
+        // 1.1 disclaimer-presence
+        if (!body.includes(ATTORNEY_LINE)) {
+            violations.push({ file: rel, rule: 'disclaimer-presence', msg: `missing the attorney-review line ("${ATTORNEY_LINE}")` });
+        }
+        // 1.2 jurisdiction-tag
+        if (!body.includes(JURISDICTION_TAG)) {
+            violations.push({ file: rel, rule: 'jurisdiction-tag', msg: `missing the machine-checkable "${JURISDICTION_TAG}" tag` });
+        }
+        // 1.2b council-gate — every legal work-product skill routes deep.
+        if (!/(^|\n)council_depth:\s*deep\s*(\n|$)/.test(fm)) {
+            violations.push({ file: rel, rule: 'council-depth', msg: 'missing `council_depth: deep` (legal work-product must route through the AI council / deep-research)' });
+        }
+        // 1.3 freshness — only when declared
+        const fw = /(^|\n)freshness_window:\s*"?([^"\n]+)"?/.exec(fm);
+        if (fw && !FRESHNESS_WINDOW_RE.test((fw[2] ?? '').trim())) {
+            violations.push({ file: rel, rule: 'freshness', msg: `freshness_window "${fw[2]}" is not a valid "<N> days|months|years" shape` });
+        }
+        // 4.1 — no definitive legal language (line-scoped, skips negative examples)
+        for (const line of body.split('\n')) {
+            if (NEG_EXAMPLE_RE.test(line)) continue;
+            for (const [re, label] of DEFINITIVE_PATTERNS) {
+                if (re.test(line)) {
+                    violations.push({ file: rel, rule: 'definitive-language', msg: `${label}: ${line.trim().slice(0, 80)}` });
+                }
+            }
+        }
+    }
+    // D5 — the floor itself must carry the hard individual-case STOP block.
+    // Only on a real run (synthetic-dir tests pass their own tmp skillsDir).
+    if (skillsDir === SKILLS_DIR && fs.existsSync(FLOOR_RULE)) {
+        if (!_readText(FLOOR_RULE).includes(STOP_MARKER)) {
+            violations.push({
+                file: path.relative(REPO, FLOOR_RULE),
+                rule: 'individual-case-stop',
+                msg: `the floor is missing the hard individual-case STOP block ("${STOP_MARKER}")`,
+            });
+        }
+        // D6 — promotion gate (real-run only).
+        if (fs.existsSync(PACKS_YML) && fs.existsSync(PACK_NOTICE)) {
+            violations.push(...legalPromotionViolations(_readText(PACKS_YML), _readText(PACK_NOTICE)));
+        }
+    }
+    return violations;
+}
+
+export function main(): number {
+    const violations = lintLegalPack();
+    if (violations.length === 0) {
+        _print('✅  legal pack — all legal-pack skills carry the attorney-review line + Jurisdiction tag');
+        return 0;
+    }
+    _print(`❌  legal pack — ${violations.length} violation(s):`);
+    for (const v of violations) {
+        _print(`  - [${v.rule}] ${v.file}: ${v.msg}`);
+    }
+    return 1;
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+    process.exit(main());
+}