@event4u/agent-config 8.4.0 → 8.5.0

package/src/scripts/lint_flows.ts

@@ -2,19 +2,19 @@
 /**
  * Validate-on-load linter for the first-class flow layer (`src/flows/*.yaml`).
  *
- * TypeScript twin of `src/scripts/lint_flows.py` (ADR-200, Phase 4 / Wave 4b
+ * Ported from the retired Python `src/scripts/lint_flows.py` (ADR-200, Phase 4 / Wave 4b
  * — PORT). Mirrors the CLI contract EXACTLY — the `--quiet` flag (argparse,
  * so `-h`/`--help` exit 0 with a usage line), the same two-check-per-file
  * shape-vs-resolution split, byte-identical violation messages, the same
  * stdout/stderr split (success on stdout, violations on stderr), exit codes
  * (0 clean · 1 violations · 3 internal error), scan scope (`src/flows/*.yaml`
  * minus `surface-map.yaml`), and ordering (sorted glob). snake_case kept.
- * No behaviour changes — latent quirks replicated.
+ * Historical quirks are preserved deliberately — tests and downstream consumers pin the exact behaviour.
  *
  * road-to-6.1.0 Step 8b (ADR-055). Two checks per flow file:
  *
  *   1. Shape — validates against `src/scripts/schemas/flow.schema.json`
- *      (Draft-07). The Python original uses the `jsonschema` library; this
+ *      (Draft-07). the retired Python implementation uses the `jsonschema` library; this
  *      twin hand-rolls a Draft-07 validator covering exactly the keyword set
  *      this schema uses (type, required, additionalProperties:false,
  *      properties, $ref, pattern, minLength, minItems, items) and reproduces
@@ -28,7 +28,7 @@
  * Plus the layer-level invariants: closed-set id == filename stem, and
  * completeness (every closed-set flow has exactly one file).
  *
- * The Python original imports `jsonschema` and exits 3 with
+ * the retired Python implementation imports `jsonschema` and exits 3 with
  * `lint_flows: jsonschema not installed` when it is absent. The TS twin has
  * no such dependency, so that exit-3 path never fires — the schema check is
  * always available, matching the installed-library case.
@@ -466,7 +466,7 @@ function _isFile(p: string): boolean {
 
 function _rel(p: string): string {
     // Path.relative_to(ROOT) raises ValueError when p is outside ROOT; the
-    // Python original then returns str(path). Mirror with the absolute path.
+    // historical behaviour returns str(path) — keep the absolute path then.
     const r = path.relative(ROOT, p);
     if (r === '' || r.startsWith('..') || path.isAbsolute(r)) {
         return p;

package/src/scripts/lint_framework_leakage.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env tsx
 // Lint generic skills/rules/commands for framework/language leakage.
 //
-// TypeScript twin of src/scripts/lint_framework_leakage.py. Exits 1 on hit
+// TypeScript port of the retired Python src/scripts/lint_framework_leakage.py. Exits 1 on hit
 // (CI-blocking). Enforces the framework-neutrality rule. Replicates the
 // carve-out filename exemption, inventory exemption, framework-frontmatter
 // exemption, the auto cross-stack ±10-line window heuristic, the allowlist

package/src/scripts/lint_framework_leakage_allowlist.json

@@ -581,7 +581,7 @@
     {
       "file": "src/skills/code-review/SKILL.md",
       "lines": [
-        214
+        222
       ],
       "reason": "Cross-stack formatter enumeration (ECS, Prettier, Ruff, gofmt) — multi-ecosystem documentation"
     },
@@ -618,9 +618,17 @@
     {
       "file": "src/skills/verify-completion-evidence/SKILL.md",
       "lines": [
-        183
+        191
       ],
       "reason": "Carve-out pointer to the quality-tools skill (the sanctioned one-line handoff shape from framework-neutrality-in-generic-skills)"
+    },
+    {
+      "file": "src/skills/api-endpoint/SKILL.md",
+      "lines": [
+        52,
+        69
+      ],
+      "reason": "Cross-stack validation primitive enumeration and pointer to laravel-api-endpoint carve-out"
     }
   ]
 }

package/src/scripts/lint_frontmatter_boilerplate.ts

@@ -2,7 +2,7 @@
 /**
  * Fail when an artefact carries a frontmatter field equal to its schema default.
  *
- * TypeScript twin of `src/scripts/lint_frontmatter_boilerplate.py` (ADR-200,
+ * Ported from the retired Python `src/scripts/lint_frontmatter_boilerplate.py` (ADR-200,
  * Phase 4 / Wave 4b). Mirrors the Python CLI contract exactly: `--quiet`,
  * scan scope + ordering (skills / rules / commands / personas via
  * `artefact_roots()`), finding messages, stdout/stderr split, exit codes
@@ -11,7 +11,7 @@
  * The frontmatter loader (`validate_frontmatter.apply_schema_defaults`) injects
  * the default at read time, so omitting the field is always behaviour-preserving.
  *
- * NOTE (divergence candidate — DC-1): the Python original imports
+ * NOTE (divergence candidate — DC-1): the retired Python implementation imports
  * `_CATEGORIES`, `_iter`, `_plan_drops` from `migrate_frontmatter_defaults.py`,
  * which has no `.ts` twin yet (out of this batch's scope). To keep TS-only
  * dispatcher resolution working, those three helpers (and `_same`) are inlined

package/src/scripts/lint_ghostwriter_source.ts

@@ -2,12 +2,12 @@
 /**
  * Lint ghostwriter profile sources.
  *
- * TypeScript twin of `src/scripts/lint_ghostwriter_source.py` (ADR-200,
- * Phase 4 / Wave 4b). The CLI contract is mirrored EXACTLY — `--quiet`
+ * Ported from the retired Python `src/scripts/lint_ghostwriter_source.py` (ADR-200,
+ * Phase 4 / Wave 4b). The CLI contract is pinned — `--quiet`
  * detected by argv membership, exit codes (0 / 1), stdout/stderr split,
  * byte-identical messages, same scan scope (`*.md` sorted in each tier),
  * same package- then consumer-side ordering. No behaviour changes —
- * latent bugs replicated.
+ * historical quirks preserved (consumers pin the exact behaviour).
  *
  * Two storage tiers (docs/contracts/ghostwriter-schema.md):
  *   * src/agent-src/ghostwriter/  — package source, fictional fixtures only.

package/src/scripts/lint_global_paths.ts

@@ -2,7 +2,7 @@
 /**
  * Permissions-audit entry-gate for the global install tree.
  *
- * TypeScript twin of `src/scripts/lint_global_paths.py` (ADR-200, Phase 4 /
+ * Ported from the retired Python `src/scripts/lint_global_paths.py` (ADR-200, Phase 4 /
  * Wave 4b). Mirrors the Python CLI contract exactly: same policy source,
  * finding messages, finding order, stdout/stderr split, and exit codes.
  *

package/src/scripts/lint_handoffs.ts

@@ -2,7 +2,7 @@
 /**
  * Lint cross-wing handoffs declared in senior-tier skills' `## Related Skills`.
  *
- * TypeScript twin of `src/scripts/lint_handoffs.py` (ADR-200, Phase 4 /
+ * Ported from the retired Python `src/scripts/lint_handoffs.py` (ADR-200, Phase 4 /
  * Wave 4b). Mirrors the CLI contract EXACTLY — the `--quiet` flag is a
  * bare `sys.argv` membership check (NOT argparse, so there is no real
  * `-h`/`--help`; `main(argv)` treats `argv[0]` as a skills-dir override,

package/src/scripts/lint_hidden_unicode.ts

@@ -1,6 +1,6 @@
 // P1.1 — hidden-Unicode / smuggling-codepoint linter (road-to-security-pillar.md).
 //
-// TypeScript twin of `src/scripts/lint_hidden_unicode.py` (ADR-200 —
+// Ported from the retired Python `src/scripts/lint_hidden_unicode.py` (ADR-200 —
 // Python→TS migration). Behaviour mirrors the Python module byte-for-byte.
 //
 // Detects the invisible-character class used by the "rules-file backdoor"

package/src/scripts/lint_hook_concern_budget.ts

@@ -2,7 +2,7 @@
 /**
  * Lint the hook concern budget against `src/scripts/hook_manifest.yaml`.
  *
- * TypeScript twin of `src/scripts/lint_hook_concern_budget.py` (ADR-200,
+ * Ported from the retired Python `src/scripts/lint_hook_concern_budget.py` (ADR-200,
  * Phase 4 / Wave 4b). Mirrors the CLI contract EXACTLY — `--manifest` /
  * `--settings` / `--strict` argparse flags, exit codes (0 clean or warn-only,
  * 1 schema load failed, 2 hard-fail with violations), byte-identical
@@ -10,7 +10,7 @@
  * `.agent-settings.yml` `hooks.concern_budget.*` line walker, and the same
  * defaults. No behaviour changes.
  *
- * The Python original imports `hooks.dispatch_hook._load_yaml` (which is
+ * the retired Python implementation imports `hooks.dispatch_hook._load_yaml` (which is
  * `yaml.safe_load(text) or {}` when PyYAML is present). That hook module is
  * not yet ported, so this twin inlines the equivalent `yaml`-package load
  * (version 1.1 → PyYAML safe_load parity). When the dispatch_hook twin

package/src/scripts/lint_hook_manifest.ts

@@ -2,7 +2,7 @@
 /**
  * Lint `src/scripts/hook_manifest.yaml`.
  *
- * TypeScript twin of `src/scripts/lint_hook_manifest.py` (ADR-200, Phase 4 /
+ * Ported from the retired Python `src/scripts/lint_hook_manifest.py` (ADR-200, Phase 4 /
  * Wave 4b). Mirrors the Python CLI contract exactly: same manifest default,
  * finding messages, finding order, stdout/stderr split, and exit codes.
  *
@@ -97,7 +97,7 @@ function _isDir(p: string): boolean {
 }
 
 /**
- * Load the manifest. The Python original reuses dispatch_hook._load_yaml
+ * Load the manifest. the retired Python implementation reuses dispatch_hook._load_yaml
  * which prefers PyYAML (with a narrow fallback parser when PyYAML is absent).
  * The TS runtime always has the `yaml` package, so this mirrors the
  * PyYAML-present path (`yaml.safe_load(text) or {}`).

package/src/scripts/lint_instruction_smuggling.ts

@@ -1,6 +1,6 @@
 // P1.2 — instruction-smuggling / suppression-phrase linter (road-to-security-pillar.md).
 //
-// TypeScript twin of `src/scripts/lint_instruction_smuggling.py` (ADR-200 —
+// Ported from the retired Python `src/scripts/lint_instruction_smuggling.py` (ADR-200 —
 // Python→TS migration). Behaviour mirrors the Python module byte-for-byte.
 //
 // Detects instructions smuggled into rule/skill/command bodies (and MCP tool

package/src/scripts/lint_load_context.ts

@@ -2,8 +2,8 @@
 /**
  * Lint the `load_context:` / `load_context_eager:` frontmatter schema.
  *
- * TypeScript twin of `src/scripts/lint_load_context.py` (ADR-200,
- * Phase 4 / Wave 4b). The CLI contract is mirrored EXACTLY — `--quiet`
+ * Ported from the retired Python `src/scripts/lint_load_context.py` (ADR-200,
+ * Phase 4 / Wave 4b). The CLI contract is pinned — `--quiet`
  * flag (positional `--quiet` detection in argv, like the Python
  * `"--quiet" in sys.argv`), exit codes (0 clean / warnings-only, 1 errors),
  * byte-identical error + warning + success messages, same scan dirs,

package/src/scripts/lint_marketplace.ts

@@ -2,7 +2,7 @@
 /**
  * Lint .claude-plugin/marketplace.json for the event4u/agent-config package.
  *
- * TypeScript twin of `src/scripts/lint_marketplace.py` (ADR-200, Phase 4 /
+ * Ported from the retired Python `src/scripts/lint_marketplace.py` (ADR-200, Phase 4 /
  * Wave 4b). Mirrors the Python CLI contract exactly: same cwd-relative scan
  * roots, finding messages, stdout output, and exit codes.
  *

package/src/scripts/lint_marketplace_install_completeness.ts

@@ -3,8 +3,8 @@
  * Lint that every command in `hooks/hooks.json` resolves to a real
  * dispatcher subcommand in `scripts/_dispatch.bash`.
  *
- * TypeScript twin of `src/scripts/lint_marketplace_install_completeness.py`
- * (ADR-200, Phase 4 / Wave 4b). The CLI contract is mirrored EXACTLY —
+ * Ported from the retired Python `src/scripts/lint_marketplace_install_completeness.py`
+ * (ADR-200, Phase 4 / Wave 4b). The CLI contract is pinned —
  * `--hooks-json` / `--dispatch-bash` flags, exit codes (0 clean, 1 unknown
  * subcommand, 2 schema/file error), stdout/stderr split, byte-identical
  * finding messages, same command-extraction regexes and scan order.

package/src/scripts/lint_mcp_config_security.ts

@@ -1,6 +1,6 @@
 // P1.3 — MCP-config security linter (road-to-security-pillar.md). OWASP ASI04.
 //
-// TypeScript twin of `src/scripts/lint_mcp_config_security.py` (ADR-200 —
+// Ported from the retired Python `src/scripts/lint_mcp_config_security.py` (ADR-200 —
 // Python→TS migration). Behaviour mirrors the Python module byte-for-byte.
 //
 // Scans shipped MCP configuration — named config files (`*.mcp.json`,

package/src/scripts/lint_mcp_registry_manifest.ts

@@ -2,7 +2,7 @@
 /**
  * Lint `dist/mcp/registry-manifest.json` against its JSON Schema.
  *
- * TypeScript twin of `src/scripts/lint_mcp_registry_manifest.py` (ADR-200,
+ * Ported from the retired Python `src/scripts/lint_mcp_registry_manifest.py` (ADR-200,
  * Phase 4 / Wave 4b). Mirrors the CLI contract EXACTLY — `--quiet` flag
  * (argparse, so a real `-h`/`--help` prints usage + exits 0), the
  * `❌  <msg>` failures on stderr, the `✅  mcp registry manifest OK

package/src/scripts/lint_media_policy_linkage.ts

@@ -2,12 +2,12 @@
 /**
  * Lint structural reachability of media governance policies.
  *
- * TypeScript twin of `src/scripts/lint_media_policy_linkage.py` (ADR-200,
- * Phase 4 / Wave 4b). Mirrors the Python CLI contract EXACTLY — `--quiet`
+ * Ported from the retired Python `src/scripts/lint_media_policy_linkage.py` (ADR-200,
+ * Phase 4 / Wave 4b). The CLI contract is pinned — `--quiet`
  * flag read from argv at module load, scan roots + policy ordering (policies
  * sorted; scan files via rglob), finding messages, output channel (all on
  * stdout except the final orphan summary on stderr), exit codes. No
- * behaviour changes — latent bugs replicated (note: `POLICY_DIR` /
+ * behaviour changes — historical quirks preserved (consumers pin the exact behaviour). (note: `POLICY_DIR` /
  * `SCAN_ROOTS` point at `agents/policies/media`, matching the .py).
  *
  * Every policy file under `agents/policies/media/` (except README) must be

package/src/scripts/lint_missions.ts

@@ -2,15 +2,15 @@
 /**
  * WARN-ONLY mission manifest and catalog linter.
  *
- * TypeScript twin of `src/scripts/lint_missions.py` (ADR-200, Python→TypeScript
- * migration). The CLI contract is mirrored EXACTLY — argparse flags
+ * Ported from the retired Python `src/scripts/lint_missions.py` (ADR-200, Python→TypeScript
+ * migration). The CLI contract is pinned — argparse flags
  * (`--strict` / `--quiet` / `--check-precondition MISSION REPO`, `-h`/`--help`
  * exit 0, unknown arg → exit 2), the scan order (`sorted(MISSIONS_ROOT.iterdir())`
  * minus dot-dirs), byte-identical finding lines, the missing-schema short-circuit
  * (exit 2 strict / 0 otherwise), the stdout/stderr split, and exit codes
  * (0 warn-only / 1 strict+ERROR). snake_case kept.
  *
- * The Python original uses the `jsonschema` Draft7Validator; this twin
+ * the retired Python implementation uses the `jsonschema` Draft7Validator; this twin
  * hand-rolls a Draft-07 validator covering exactly the keyword set the two
  * mission schemas use (type, required, additionalProperties [false | schema],
  * properties, $ref [#/definitions], pattern, enum, minLength, maxLength,

package/src/scripts/lint_model_tier_coverage.ts

@@ -2,11 +2,11 @@
 /**
  * Fail when a skill or command lacks a `model_tier` value.
  *
- * TypeScript twin of `src/scripts/lint_model_tier_coverage.py` (ADR-200,
- * Phase 4 / Wave 4b). Mirrors the Python CLI contract EXACTLY — `--quiet`
+ * Ported from the retired Python `src/scripts/lint_model_tier_coverage.py` (ADR-200,
+ * Phase 4 / Wave 4b). The CLI contract is pinned — `--quiet`
  * flag, target enumeration + ordering (skills via artefact_roots, then
  * commands via iter_commands), finding messages, stdout/stderr split,
- * exit codes. No behaviour changes — latent bugs replicated.
+ * exit codes. Historical quirks are preserved deliberately — tests and downstream consumers pin the exact behaviour.
  *
  * Phase 5 coverage gate of `road-to-model-capability-tiers.md` (ADR-035):
  * every skill and command MUST declare an explicit `model_tier`

package/src/scripts/lint_namespace.ts

@@ -3,8 +3,8 @@
  * Namespace linter. Enforces `<stem>-<intent>` kebab-case + reserved
  * names list across skills / rules / commands / personas.
  *
- * TypeScript twin of `src/scripts/lint_namespace.py` (ADR-200, Phase 4 /
- * Wave 4b). The CLI contract is mirrored EXACTLY — `--name` / `--quiet`
+ * Ported from the retired Python `src/scripts/lint_namespace.py` (ADR-200, Phase 4 /
+ * Wave 4b). The CLI contract is pinned — `--name` / `--quiet`
  * flags, exit codes (0 clean, 1 issues / single-name fail), stdout/stderr
  * split (findings + BASELINE-on-failure to stderr; success BASELINE to
  * stdout), byte-identical finding messages, same `sorted(root.glob(glob))`

package/src/scripts/lint_namespace_collisions.ts

@@ -2,8 +2,8 @@
 /**
  * Single-namespace collision lint (road-to-6.0.0-D Phase 0 Step 4).
  *
- * TypeScript twin of `src/scripts/lint_namespace_collisions.py` (ADR-200,
- * Phase 4 / Wave 4b). The CLI contract is mirrored EXACTLY — exit codes
+ * Ported from the retired Python `src/scripts/lint_namespace_collisions.py` (ADR-200,
+ * Phase 4 / Wave 4b). The CLI contract is pinned — exit codes
  * (0 no collisions, 1 collision, 3 internal error), stdout/stderr split,
  * byte-identical finding messages, same `iter_all_sources()` scan order,
  * same normalization, same frontmatter `name:` extraction.

package/src/scripts/lint_new_skill_gate.ts

@@ -2,13 +2,13 @@
 /**
  * Forward gate for NEW skills (6.0.0-C Phase 4 Step 8b).
  *
- * TypeScript twin of `src/scripts/lint_new_skill_gate.py` (ADR-200, Phase 4 /
+ * Ported from the retired Python `src/scripts/lint_new_skill_gate.py` (ADR-200, Phase 4 /
  * Wave 4b — PORT). Mirrors the CLI contract EXACTLY — the `--baseline` (default
  * `main`) and `--quiet` argparse flags, the git diff/status forward-only skill
  * detection, byte-identical violation messages, stdout-only output (no
  * stderr split except the git-failure exit-3 path), and exit codes
  * (0 clean · 1 violations · 3 internal/git error). snake_case kept. No
- * behaviour changes — latent quirks replicated.
+ * behaviour changes — historical quirks preserved (consumers pin the exact behaviour).
  *
  * A newly added skill must clear two gates before it joins the surface:
  *
@@ -19,7 +19,7 @@
  *
  * FORWARD-ONLY: only SKILL.md files added since `--baseline` are gated.
  *
- * The Python original imports `_parse`, `_cosine`, `collect`, `Skill` from
+ * the retired Python implementation imports `_parse`, `_cosine`, `collect`, `Skill` from
  * `audit_skill_overlap`. That module has no TS twin in this batch, so the four
  * needed symbols are ported privately below (faithful 1:1 of the originals);
  * when `audit_skill_overlap` is ported in its own phase these can be

package/src/scripts/lint_no_new_atomic_commands.ts

@@ -2,8 +2,8 @@
 /**
  * Atomic-command linter for the command-collapse policy.
  *
- * TypeScript twin of `src/scripts/lint_no_new_atomic_commands.py`
- * (ADR-200, Phase 4 / Wave 4b). The CLI contract is mirrored EXACTLY —
+ * Ported from the retired Python `src/scripts/lint_no_new_atomic_commands.py`
+ * (ADR-200, Phase 4 / Wave 4b). The CLI contract is pinned —
  * `--baseline` / `--all` flags, exit codes (0 clean, 1 violations,
  * 3 internal error), stdout/stderr split, byte-identical messages, the
  * same git invocations (`git diff --name-only --diff-filter=A
@@ -24,7 +24,10 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 const _HERE = fileURLToPath(import.meta.url);
 // src/scripts/lint_no_new_atomic_commands.ts → parent.parent.parent is repo root.
 const ROOT = path.resolve(path.dirname(_HERE), '..', '..');
-const COMMANDS_DIR = '.agent-src.uncondensed/commands';
+// Repointed 2026-07-08 (ADR-115): the legacy uncondensed commands dir no
+// longer exists — command sources live at src/domains/**/command.md.
+// Only files named `command.md` are commands; pack READMEs etc. are skipped.
+const COMMANDS_DIR = 'src/domains';
 const CLUSTER_CONTRACT = 'docs/contracts/command-clusters.md';
 
 interface Violation {
@@ -135,7 +138,7 @@ function added_command_files(baseline: string): string[] {
     }
     const files: string[] = [];
     for (const p of (diff.stdout ?? '').split('\n')) {
-        if (p.endsWith('.md') && p !== '' && path.basename(p) !== 'AGENTS.md') {
+        if (p !== '' && path.basename(p) === 'command.md') {
             files.push(p);
         }
     }
@@ -157,7 +160,7 @@ function added_command_files(baseline: string): string[] {
             const rawPath = line.slice(3).trim();
             const parts = rawPath.split(' -> ');
             const p = parts[parts.length - 1]!;
-            if (p.endsWith('.md') && path.basename(p) !== 'AGENTS.md') {
+            if (path.basename(p) === 'command.md') {
                 if (!files.includes(p)) {
                     files.push(p);
                 }
@@ -181,7 +184,7 @@ function _rglobMdSorted(dir: string): string[] {
             const full = path.join(current, entry.name);
             if (entry.isDirectory()) {
                 walk(full);
-            } else if (entry.isFile() && entry.name.endsWith('.md')) {
+            } else if (entry.isFile() && entry.name === 'command.md') {
                 out.push(full);
             }
         }

package/src/scripts/lint_no_python_twin_rationale.ts

@@ -0,0 +1,102 @@
+#!/usr/bin/env tsx
+/**
+ * Python-twin rationale guard (road-to-truth-and-reference-hygiene Phase 2).
+ *
+ * The py2ts migration (ADR-200) is closed and its Python originals are
+ * deleted; the parity scaffolding comments ("TypeScript twin of …", "latent
+ * Python quirks replicated", "byte-identical to the Python original") were
+ * swept on 2026-07-08 and re-attributed to their live consumers (tests,
+ * checksum gates, pinned CLI contracts). This lint keeps the residue from
+ * creeping back: a NEW comment that rationalises behaviour by fidelity to
+ * the deleted Python twin fails CI.
+ *
+ * Scope: comment lines in `src/scripts/**\/*.ts`. Historical provenance
+ * mentions ("ported from the retired Python `x.py` (ADR-200)") are fine —
+ * they state history, not a live contract; only the twin-rationale shapes
+ * below are banned.
+ *
+ * Exit codes: 0 clean · 1 findings.
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const _HERE = fileURLToPath(import.meta.url);
+export const ROOT = path.resolve(path.dirname(_HERE), '..', '..');
+const SCOPE = path.join(ROOT, 'src', 'scripts');
+
+/** Banned rationale shapes (case-insensitive). */
+export const BANNED: ReadonlyArray<[string, RegExp]> = [
+    ['twin-of', /\btwin of\b/i],
+    ['latent-quirks', /latent (?:python )?(?:quirks|bugs) replicated/i],
+    ['byte-identical-python', /byte-identical to the python/i],
+    ['python-original', /\bthe python original\b/i],
+];
+
+const COMMENT = /^\s*(\/\/|\*|\/\*)/;
+
+function* walk(dir: string): Generator<string> {
+    for (const e of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) =>
+        a.name < b.name ? -1 : 1,
+    )) {
+        const full = path.join(dir, e.name);
+        if (e.isDirectory()) yield* walk(full);
+        else if (e.name.endsWith('.ts')) yield full;
+    }
+}
+
+export function scan_file(rel: string, text: string): string[] {
+    const findings: string[] = [];
+    const lines = text.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i]!;
+        if (!COMMENT.test(line)) continue;
+        for (const [name, pat] of BANNED) {
+            if (pat.test(line)) {
+                findings.push(`${rel}:${i + 1}: ${name} — ${line.trim().slice(0, 100)}`);
+            }
+        }
+    }
+    return findings;
+}
+
+export function main(argv: readonly string[] = process.argv.slice(2)): number {
+    const QUIET = argv.includes('--quiet');
+    const findings: string[] = [];
+    for (const f of walk(SCOPE)) {
+        if (path.resolve(f) === path.resolve(_HERE)) continue; // this guard documents the shapes
+        const rel = path.relative(ROOT, f).split(path.sep).join('/');
+        findings.push(...scan_file(rel, fs.readFileSync(f, 'utf-8')));
+    }
+    if (findings.length === 0) {
+        if (!QUIET) process.stdout.write('✅  No Python-twin rationale in src/scripts comments.\n');
+        return 0;
+    }
+    process.stdout.write(`❌  Python-twin rationale reintroduced — ${findings.length} finding(s):\n`);
+    for (const f of findings) process.stdout.write(`    ${f}\n`);
+    process.stdout.write(
+        '\nFix: state the LIVE contract instead (which test/gate/consumer pins the\n' +
+            'behaviour) — never fidelity to the deleted Python original. See\n' +
+            'road-to-truth-and-reference-hygiene Phase 2.\n',
+    );
+    return 1;
+}
+
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) return false;
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) return true;
+    try {
+        return (
+            fs.realpathSync(fileURLToPath(import.meta.url)) ===
+            fs.realpathSync(path.resolve(process.argv[1]))
+        );
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry() || process.argv[1] === _HERE) {
+    process.exit(main(process.argv.slice(2)));
+}

package/src/scripts/lint_one_off_age.ts

@@ -2,12 +2,12 @@
 /**
  * One-off-script age linter.
  *
- * TypeScript twin of `src/scripts/lint_one_off_age.py` (ADR-200, Phase 4 /
+ * Ported from the retired Python `src/scripts/lint_one_off_age.py` (ADR-200, Phase 4 /
  * Wave 4b). Mirrors the CLI contract EXACTLY — `--format {text,json}` /
  * `--root` argparse flags, exit codes (0 clean incl. warnings, 1 hard
  * fail, 3 internal error), stdout/stderr split, byte-identical finding
  * messages, the same scan tree (`<root>/scripts/_one_off`) and ordering
- * (sorted iterdir). No behaviour changes — latent quirks replicated
+ * (sorted iterdir). Historical quirks are preserved deliberately — tests and downstream consumers pin the exact behaviour.
  * (e.g. `scan` walks `scripts/_one_off`, NOT the module-level
  * `ONE_OFF_DIR = src/scripts/_one_off`, which is unused).
  *

package/src/scripts/lint_orchestration_dsl.ts

@@ -2,8 +2,8 @@
 /**
  * Lint `.agent-config/orchestrations/*.yaml` pipeline files.
  *
- * TypeScript twin of `src/scripts/lint_orchestration_dsl.py` (ADR-200,
- * Phase 4 / Wave 4b). The CLI contract is mirrored EXACTLY — `--dir` /
+ * Ported from the retired Python `src/scripts/lint_orchestration_dsl.py` (ADR-200,
+ * Phase 4 / Wave 4b). The CLI contract is pinned — `--dir` /
  * `--file` flags, exit codes (0 clean, 1 hard failure, 2 file/schema-load
  * error), stdout/stderr split (all findings on stderr), byte-identical
  * finding messages, same scan order, same `resolve_logical` ref resolution,
@@ -51,7 +51,7 @@ const SUBAGENT_MODES = new Set([
 
 /**
  * Reuse the dispatcher's loader so the linter sees what the runtime sees.
- * The Python original calls `hooks.dispatch_hook._load_yaml`, which prefers
+ * the retired Python implementation calls `hooks.dispatch_hook._load_yaml`, which prefers
  * PyYAML (present in this environment) and falls back to a flat mini-parser
  * only when PyYAML is unavailable. Orchestration files use full nested YAML,
  * so the PyYAML path is the live one — `yaml` (npm) reproduces it.

package/src/scripts/lint_orchestrator_auto_detect.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env tsx
 // Auto-detection contract linter for command orchestrators (6.1.0 Step 1).
 //
-// TypeScript twin of src/scripts/lint_orchestrator_auto_detect.py. Every
+// TypeScript port of the retired Python src/scripts/lint_orchestrator_auto_detect.py. Every
 // command source under src/domains/**/command.md that opts into auto-detection
 // (front-matter `auto_detect: true`) MUST honor the non-interactive contract:
 // a body link to the contract doc + the `## Non-interactive & auto-detection`

package/src/scripts/lint_pack_boundaries.ts

@@ -2,12 +2,12 @@
 /**
  * Enforce cross-pack reference boundaries.
  *
- * TypeScript twin of `src/scripts/lint_pack_boundaries.py` (ADR-200, Phase 4 /
+ * Ported from the retired Python `src/scripts/lint_pack_boundaries.py` (ADR-200, Phase 4 /
  * Wave 4b). Mirrors the Python CLI contract exactly: `--format text|json`,
  * `--quiet`, same scan scope (packages/*\/.agent-src.uncondensed/), file
  * ordering, link regex, resolution semantics, finding messages, stdout/stderr
  * split, and exit codes (0 clean / skipped, 1 violations). No behaviour
- * changes — latent bugs replicated.
+ * changes — historical quirks preserved (consumers pin the exact behaviour).
  *
  * Walks every markdown link in every artefact under
  * `packages/*\/.agent-src.uncondensed/` and verifies the link target's pack is

package/src/scripts/lint_pack_dependencies.ts

@@ -2,7 +2,7 @@
 /**
  * Pack dependency + pack-graph lints.
  *
- * TypeScript twin of `src/scripts/lint_pack_dependencies.py` (ADR-200,
+ * Ported from the retired Python `src/scripts/lint_pack_dependencies.py` (ADR-200,
  * Phase 4 / Wave 4b). Mirrors the Python CLI contract exactly: same checks,
  * finding messages, stdout/stderr split, and exit codes.
  *
@@ -15,7 +15,7 @@
  *
  * Exit codes: 0 = clean · 1 = drift and/or a cycle · 3 = internal error.
  *
- * The Python original imports generate_pack_manifests (`gpm`) for the manifest
+ * the retired Python implementation imports generate_pack_manifests (`gpm`) for the manifest
  * derivation. `gpm` has no TS twin yet (out of this batch's scope), so the
  * needed gpm internals are ported as private helpers below, mirroring the
  * Python source 1:1. They are prefixed `_gpm_` to mark their provenance.

package/src/scripts/lint_pack_first_win.ts

@@ -2,8 +2,8 @@
 /**
  * Pack first-win linter.
  *
- * TypeScript twin of `src/scripts/lint_pack_first_win.py` (ADR-200,
- * Phase 4 / Wave 4b). The CLI contract is mirrored EXACTLY — `main()`
+ * Ported from the retired Python `src/scripts/lint_pack_first_win.py` (ADR-200,
+ * Phase 4 / Wave 4b). The CLI contract is pinned — `main()`
  * IGNORES argv entirely (any flag, including the `--quiet` the Taskfile
  * passes, is silently accepted), exit codes (0 clean, 1 violations),
  * stdout/stderr split, byte-identical finding messages.

package/src/scripts/lint_persona_governance.ts

@@ -2,11 +2,11 @@
 /**
  * Lint persona governance — per-domain cap (hard) + citation floor (warn).
  *
- * TypeScript twin of `src/scripts/lint_persona_governance.py` (ADR-200,
- * Phase 4 / Wave 4b). Mirrors the Python CLI contract EXACTLY — `--quiet`
+ * Ported from the retired Python `src/scripts/lint_persona_governance.py` (ADR-200,
+ * Phase 4 / Wave 4b). The CLI contract is pinned — `--quiet`
  * flag read from argv at module load, persona enumeration + sorted ordering,
  * finding messages, output channel (emit → stdout; overflow summary on
- * stderr), exit codes. No behaviour changes — latent bugs replicated.
+ * stderr), exit codes. Historical quirks are preserved deliberately — tests and downstream consumers pin the exact behaviour.
  *
  * Enforces the mechanical checks in
  * `.agent-src.uncondensed/rules/persona-governance.md`:

package/src/scripts/lint_positioning.ts

@@ -2,7 +2,7 @@
 /**
  * Positioning consistency lint for event4u/agent-config.
  *
- * TypeScript twin of `src/scripts/lint_positioning.py` (ADR-200, Phase 4 /
+ * Ported from the retired Python `src/scripts/lint_positioning.py` (ADR-200, Phase 4 /
  * Wave 4b). Mirrors the CLI contract EXACTLY — the `--quiet` argparse flag,
  * exit codes (0 clean, 1 drift, 2 missing PyYAML — inert here since `yaml`
  * is always present), byte-identical stdout (success line) and stderr