@holdyourvoice/hyv 3.4.2 → 3.4.4

package/Readme.md

@@ -2,7 +2,7 @@
 
 [![npm downloads](https://img.shields.io/npm/dt/%40holdyourvoice%2Fhyv?label=npm%20downloads&color=2f81f7)](https://www.npmjs.com/package/@holdyourvoice/hyv)
 
-Hold Your Voice (`hyv`) is a local writing checker. It helps you edit AI-assisted writing without losing your own writing patterns.
+Hold Your Voice (`hyv`) is a local writing checker. It helps you edit AI-assisted writing without losing your own writing patterns. It is not an AI-authorship detector: it provides local, inspectable writing evidence while a human still decides what to publish.
 
 It runs two independent checks:
 
@@ -11,6 +11,66 @@ It runs two independent checks:
 
 The package also checks hidden Unicode, source-backed facts, document logic, and protected claims. All checks run locally, without model calls, automatic draft changes, or runtime network requests.
 
+## how it works
+
+```mermaid
+flowchart TD
+    samples["Writing samples"] --> profile["Local VoiceDNA profile"]
+    draft["Draft"] --> analyze["hyv analyze"]
+    profile --> analyze
+    brief["Optional WritingBrief"] -.-> analyze
+
+    subgraph inspect["1 · inspect the draft"]
+        analyze --> voice["VoiceDNA check"]
+        analyze --> patterns["AI pattern lint"]
+        analyze --> hidden["Hidden-text / Unicode check"]
+        voice --> local{"Local result"}
+        patterns --> local
+        hidden -.-> local
+    end
+
+    local -->|No blocking change| candidate["Candidate text"]
+    local -->|Blocking edit scope| editTask["Prepare fingerprint-bound edit task"]
+    local -->|Judgment required| judgment["Prepare and reduce judgments"]
+    judgment --> route{"SHIP, EDIT, or REBUILD?"}
+    route -->|SHIP| candidate
+    route -->|EDIT| editTask
+    route -->|REBUILD| authorization["REBUILD recommendation + CopySpec + signed authorization"]
+    authorization --> rebuildTask["Prepare fingerprint-bound rebuild task"]
+    editTask --> editor["Human editor or model you choose"]
+    rebuildTask --> editor
+    editor --> response["Bound response"]
+
+    brief -.-> logic
+    sources["Optional fact sources in WritingBrief"] -.-> facts
+    spec["Optional for verify-spec; required for rebuild"] -.-> authorization
+    spec -.-> standard
+
+    subgraph verification["2 · verification gate"]
+        candidate --> standard["hyv verify / verify-spec"]
+        response --> mode{"Bound task mode"}
+        mode -->|EDIT| editApply["apply-rewrite + standard verification"]
+        mode -->|REBUILD| rebuildApply["apply-rebuild + rebuild verification"]
+        standard --> standardRules["Preservation gate + CopySpec claims when supplied"]
+        editApply --> standardRules
+        rebuildApply --> rebuildRules["CopySpec claims; preservation reported"]
+        standardRules --> engines["VoiceDNA + AI Editor checks and blocking regressions"]
+        rebuildRules --> engines
+        engines --> logic["Logic lint"]
+        logic --> facts["Fact lint when sources are supplied"]
+        facts --> outputGate["Hidden-text + final-output gate"]
+        outputGate --> passed{"All required checks pass?"}
+    end
+
+    passed -->|No| repair["Repair externally or prepare a new task"]
+    repair --> analyze
+    passed -->|Yes| review["Semantic review and human approval, when required"]
+    review --> final["Run final-check after the last change"]
+    final --> output["Exact accepted text"]
+```
+
+HYV keeps draft inspection, candidate verification, and final delivery separate. Standard verification reruns VoiceDNA and AI Editor, rejects blocking regressions, enforces preservation, runs logic lint, applies fact lint when a WritingBrief supplies sources, and withholds hidden-text failures. `verify-spec` adds CopySpec claim checks. Authorized rebuilds require an upstream REBUILD recommendation, a CopySpec, and signed authorization; their verification reports preservation without using the standard preservation threshold. Run `final-check` again after the last human, model, formatter, or template change. HYV never calls a model; a human editor or model you choose supplies edits and judgments.
+
 ## install
 
 You need Node.js 20 or newer and at least two writing samples you have the right to use.
@@ -57,6 +117,8 @@ producer | hyv final-check -
 
 `final-check` writes accepted text to stdout. It withholds output and exits with code `2` when unresolved hidden Unicode remains.
 
+`delivery-check` is a separate opt-in offline check for placeholders, likely credential patterns, local Markdown links, and citation IDs in a local policy. It never fetches a URL or proves a fact.
+
 ## commands
 
 | Command | Purpose |
@@ -67,6 +129,10 @@ producer | hyv final-check -
 | `hyv inspect-hidden-text <draft> [policy.json]` | Inspect hidden text with an optional policy. |
 | `hyv apply-hidden-text-policy <draft> <policy.json> <output>` | Apply approved hidden-text removals. |
 | `hyv final-check <path\|->` | Gate the exact text before delivery. |
+| `hyv delivery-check <path\|-> [policy.json]` | Run optional local delivery-integrity checks. |
+| `hyv profile assess <sample...>` | Inspect sample readiness before building a profile. |
+| `hyv team-profile validate\|compose ...` | Validate or locally compose consent-bound team profile metadata. |
+| `hyv dispositions <draft> <profile>` | Return normalized `block`, `review`, and `signal` findings. |
 | `hyv fact-lint <draft\|-> --source=id:path` | Check claims against local source files. |
 | `hyv logic-lint <draft\|-> [brief.json]` | Check deterministic document logic. |
 | `hyv batch-analyze <draft...>` | Find repeated openings and endings across drafts. |
@@ -118,6 +184,8 @@ npm run check:release
 
 Read [CONTRIBUTING.md](CONTRIBUTING.md) before opening a pull request. The main design boundaries are in [Architecture](docs/ARCHITECTURE.md) and the full user guides are in the [wiki](https://github.com/shashank-sn/holdyourvoice/wiki).
 
+See the [roadmap](docs/ROADMAP.md), [rule authoring guide](docs/RULE-AUTHORING.md), and synthetic [benchmark scorecard command](scripts/public-scorecard.mjs). The public fixture scorecard does not measure human preference or model quality.
+
 ## license
 
 [MIT](LICENSE). Third-party writing and data keep their own rights.

package/dist/cli.js

@@ -20,7 +20,11 @@ import { loadApprovalContext } from './approval-context.js';
 import { formatFactLintReport, lintFacts } from './fact-linter.js';
 import { lintLogic } from './logic-linter.js';
 import { loadAll, validateAll, validateId, sortedIds, describe, emitJson, emitPrompt } from './agents/index.js';
-const usage = 'Commands: agent, profile, analyze, hygiene, inspect-hidden-text, apply-hidden-text-policy, final-check, fact-lint, logic-lint, batch-analyze, rewrite-prompt, prepare-rewrite, apply-rewrite, prepare-judgment, reduce-judgment, prepare-rebuild, rebuild-writer-request, apply-rebuild, verify, verify-spec, lifecycle, learning, patterns, mcp';
+import { inspectDeliveryIntegrity, parseDeliveryIntegrityPolicy } from './delivery-integrity.js';
+import { assessProfileReadiness } from './profile-quality.js';
+import { normalizeFinding, parseSurfacePolicy } from './disposition.js';
+import { composeTeamProfile, parseTeamProfileBundle } from './team-profile.js';
+const usage = 'Commands: agent, profile, team-profile, analyze, hygiene, inspect-hidden-text, apply-hidden-text-policy, final-check, delivery-check, fact-lint, logic-lint, batch-analyze, rewrite-prompt, prepare-rewrite, apply-rewrite, prepare-judgment, reduce-judgment, prepare-rebuild, rebuild-writer-request, apply-rebuild, verify, verify-spec, lifecycle, learning, patterns, dispositions, mcp';
 function input(path) {
     return path === '-' ? readFileSync(0, 'utf8') : readFileSync(path, 'utf8');
 }
@@ -379,10 +383,39 @@ function runAgent(args) {
     throw new Error('Usage: hyv agent <list|validate|describe|emit> ...');
 }
 function runProfile(args) {
+    if (args[0] === 'assess') {
+        if (args.length < 3)
+            throw new Error('Usage: hyv profile assess sample-a.md sample-b.md [sample-c.md]');
+        json(assessProfileReadiness(args.slice(1).map(input)));
+        return 0;
+    }
     const { output, samples, avoid } = profileArguments(args);
     writeJson(output, buildProfile(samples.map(input), avoid));
     return 0;
 }
+function runTeamProfile(args) {
+    const [action, bundlePath, authorPath, ...brandPaths] = args;
+    if (action === 'validate' && bundlePath && !authorPath) {
+        json(parseTeamProfileBundle(readJson(bundlePath)));
+        return 0;
+    }
+    if (action === 'compose' && bundlePath && authorPath) {
+        const brands = brandPaths.map(readProfile).filter((profile) => profile.version === '3');
+        if (brands.length !== brandPaths.length)
+            throw new Error('Team brand profiles must use Profile v3.');
+        json(composeTeamProfile(readProfile(authorPath), brands, parseTeamProfileBundle(readJson(bundlePath))));
+        return 0;
+    }
+    throw new Error('Usage: hyv team-profile <validate bundle.json|compose bundle.json author-profile.json [brand-profile.json...]>');
+}
+function runDeliveryCheck(args) {
+    const [path, policyPath, ...extra] = args;
+    if (!path || extra.length)
+        throw new Error('Usage: hyv delivery-check <path|-> [policy.json]');
+    const report = inspectDeliveryIntegrity(input(path), policyPath ? parseDeliveryIntegrityPolicy(readJson(policyPath)) : undefined, process.cwd());
+    json(report);
+    return report.passed ? 0 : 2;
+}
 function runAnalyze(args) {
     const [draft, profilePath, briefPath] = args;
     if (!draft || !profilePath)
@@ -720,6 +753,15 @@ function runPatterns() {
     json({ version: RULESET_VERSION, rules: serializedRules() });
     return 0;
 }
+function runDispositions(args) {
+    const [draft, profilePath, briefPath, surfacePolicyPath] = args;
+    if (!draft || !profilePath)
+        throw new Error('Usage: hyv dispositions draft.md profile.json [writing-brief.json]');
+    const report = analyze(input(draft), readProfile(profilePath), readBrief(briefPath));
+    const policy = surfacePolicyPath ? parseSurfacePolicy(readJson(surfacePolicyPath)) : undefined;
+    json({ version: '1', findings: [report.voiceDna, report.aiEditor, report.editorial].flatMap((engine) => engine?.findings.map((finding) => normalizeFinding(finding, policy)) ?? []) });
+    return 0;
+}
 async function runMcp(args) {
     if (args.length > 0)
         throw new Error('Usage: hyv mcp');
@@ -729,11 +771,13 @@ async function runMcp(args) {
 const commandHandlers = {
     agent: runAgent,
     profile: runProfile,
+    'team-profile': runTeamProfile,
     analyze: runAnalyze,
     hygiene: runHygiene,
     'inspect-hidden-text': runInspectHiddenText,
     'apply-hidden-text-policy': runApplyHiddenTextPolicy,
     'final-check': runFinalCheck,
+    'delivery-check': runDeliveryCheck,
     'fact-lint': runFactLint,
     'logic-lint': runLogicLint,
     'batch-analyze': runBatchAnalyze,
@@ -750,6 +794,7 @@ const commandHandlers = {
     lifecycle: runLifecycle,
     learning: runLearning,
     patterns: runPatterns,
+    dispositions: runDispositions,
     mcp: runMcp,
 };
 export async function runCli(args) {

package/dist/delivery-integrity.js

@@ -0,0 +1,42 @@
+import { existsSync, realpathSync } from 'node:fs';
+import { isAbsolute, relative, resolve } from 'node:path';
+function isInside(root, target) {
+    const path = relative(root, target);
+    return path === '' || (!path.startsWith('..') && !isAbsolute(path));
+}
+export function parseDeliveryIntegrityPolicy(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Delivery policy must be an object.');
+    const policy = value;
+    if (policy.version !== '1' || Object.keys(policy).some((key) => !['version', 'block', 'sourceIds'].includes(key)))
+        throw new Error('Delivery policy is not valid.');
+    if (policy.block !== undefined && (!Array.isArray(policy.block) || !policy.block.every((item) => item === 'placeholder' || item === 'local_link')))
+        throw new Error('Delivery policy block list is not valid.');
+    if (policy.sourceIds !== undefined && (!Array.isArray(policy.sourceIds) || !policy.sourceIds.every((item) => typeof item === 'string' && item.length > 0)))
+        throw new Error('Delivery policy source IDs are not valid.');
+    return policy;
+}
+export function inspectDeliveryIntegrity(text, policy = { version: '1' }, root = process.cwd()) {
+    const findings = [];
+    const disposition = (kind) => policy.block?.includes(kind) ? 'block' : 'review';
+    for (const match of text.matchAll(/{{\s*[^}]+\s*}}|\[\[\s*[^\]]+\s*\]\]|\b(?:TODO|TBD)\b/g)) {
+        findings.push({ kind: 'placeholder', disposition: disposition('placeholder'), excerpt: match[0], reason: 'Unresolved template or editorial placeholder.', suggestion: 'Replace or explicitly remove it before delivery.' });
+    }
+    for (const match of text.matchAll(/(?:sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16})/g)) {
+        findings.push({ kind: 'secret', disposition: 'review', excerpt: match[0].slice(0, 8) + '…', reason: 'Looks like a credential pattern; this is not proof that it is a secret.', suggestion: 'Remove it or verify it is safe to disclose.' });
+    }
+    for (const match of text.matchAll(/\[[^\]]+\]\(([^)#][^)]*)\)/g)) {
+        const target = match[1];
+        if (/^[a-z][a-z0-9+.-]*:/i.test(target) || target.startsWith('#'))
+            continue;
+        const resolved = resolve(root, target);
+        const missing = !isInside(root, resolved) || !existsSync(resolved) || !isInside(root, realpathSync(resolved));
+        if (missing)
+            findings.push({ kind: 'local_link', disposition: disposition('local_link'), excerpt: target, reason: 'Local Markdown target is missing or resolves outside the approved root.', suggestion: 'Fix the target or use an approved external URL.' });
+    }
+    for (const match of text.matchAll(/\[@([A-Za-z0-9._:-]+)\]/g)) {
+        if (!policy.sourceIds?.includes(match[1]))
+            findings.push({ kind: 'citation', disposition: 'signal', excerpt: match[0], reason: 'Citation identifier is not present in the supplied local source manifest.', suggestion: 'Add the ID to sourceIds or review the reference.' });
+    }
+    return { version: '1', passed: !findings.some((finding) => finding.disposition === 'block'), findings };
+}

package/dist/disposition.js

@@ -0,0 +1,14 @@
+export function parseSurfacePolicy(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Surface policy is invalid.');
+    const policy = value;
+    if (policy.version !== '1' || !policy.overrides || typeof policy.overrides !== 'object' || Array.isArray(policy.overrides) || Object.keys(policy).some((key) => !['version', 'overrides'].includes(key)) || !Object.entries(policy.overrides).every(([id, disposition]) => /^[a-z][a-z0-9.-]+$/.test(id) && ['block', 'review', 'signal'].includes(disposition)))
+        throw new Error('Surface policy is invalid.');
+    return policy;
+}
+export function normalizeFinding(finding, policy) {
+    const base = finding.appliedPolicy === 'blocking' || (finding.engine === 'voice_dna' && finding.severity === 'red') ? 'block'
+        : finding.appliedPolicy === 'judgment-required' ? 'review' : 'signal';
+    const disposition = policy?.overrides[finding.id] ?? base;
+    return { version: '1', id: finding.id, disposition, evidence: { engine: finding.engine, sentence: finding.sentence, excerpt: finding.excerpt }, reason: finding.reason, suggestion: finding.suggestion, confidence: 'deterministic' };
+}

package/dist/mcp-tools.js

@@ -13,6 +13,9 @@ import { buildProfile } from './voice-dna.js';
 import { finalOutputCheck, inspectHygiene } from './hygiene.js';
 import { finalizeLifecycle, inspectLifecycle, prepareLifecycle, recordApprovedLearning, submitSemanticVerdict, validateFinalApproval } from './lifecycle-adapter.js';
 import { MAX_JSON_BYTES } from './internal.js';
+import { lintFacts } from './fact-linter.js';
+import { inspectDeliveryIntegrity, parseDeliveryIntegrityPolicy } from './delivery-integrity.js';
+import { assessProfileReadiness } from './profile-quality.js';
 function profileFromJson(profileJson) {
     try {
         return parseProfile(JSON.parse(profileJson));
@@ -103,6 +106,16 @@ export function verifyCopySpecForMcp(original, candidate, profileJson, copySpecJ
 export function logicLintForMcp(draft, writingBriefJson) {
     return lintLogic(draft, writingBriefFromJson(writingBriefJson));
 }
+export function factLintForMcp(draft, sourcesJson, metadataJson) {
+    const sources = parsed(sourcesJson, 'Fact sources');
+    if (!Array.isArray(sources) || !sources.every((source) => source && typeof source === 'object' && typeof source.id === 'string' && typeof source.text === 'string'))
+        throw new Error('Fact sources are not valid.');
+    return lintFacts({ draft, sources: sources, metadata: metadataJson ? parsed(metadataJson, 'Fact metadata') : undefined });
+}
+export function deliveryCheckForMcp(text, policyJson) {
+    return inspectDeliveryIntegrity(text, policyJson ? parseDeliveryIntegrityPolicy(parsed(policyJson, 'Delivery policy')) : undefined);
+}
+export function assessProfileForMcp(samples) { return assessProfileReadiness(samples); }
 function parsed(json, label) {
     if (Buffer.byteLength(json, 'utf8') > MAX_JSON_BYTES)
         throw new Error(`${label} exceeds the byte limit.`);

package/dist/mcp.js

@@ -1,7 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
-import { analyzeBatchForMcp, analyzeForMcp, applyHiddenTextPolicyForMcp, applyRebuildForMcp, applyRewriteForMcp, buildProfileForMcp, clearLearningForMcp, finalOutputCheckForMcp, finalizeLifecycleForMcp, finalizeRejectionForMcp, inspectHiddenTextForMcp, inspectHygieneForMcp, inspectLearningForMcp, inspectLifecycleForMcp, logicLintForMcp, migrateLearningForMcp, patternsForMcp, prepareJudgmentForMcp, prepareLifecycleForMcp, prepareRebuildForMcp, prepareRewriteForMcp, ratifyLearningForMcp, rebuildWriterRequestForMcp, recordApprovedLearningForMcp, recordLearningForMcp, reduceJudgmentForMcp, rewritePromptForMcp, submitSemanticVerdictForMcp, supersedeLearningForMcp, validateFinalApprovalForMcp, verifyCopySpecForMcp, verifyForMcp } from './mcp-tools.js';
+import { analyzeBatchForMcp, analyzeForMcp, applyHiddenTextPolicyForMcp, applyRebuildForMcp, applyRewriteForMcp, assessProfileForMcp, buildProfileForMcp, clearLearningForMcp, deliveryCheckForMcp, factLintForMcp, finalOutputCheckForMcp, finalizeLifecycleForMcp, finalizeRejectionForMcp, inspectHiddenTextForMcp, inspectHygieneForMcp, inspectLearningForMcp, inspectLifecycleForMcp, logicLintForMcp, migrateLearningForMcp, patternsForMcp, prepareJudgmentForMcp, prepareLifecycleForMcp, prepareRebuildForMcp, prepareRewriteForMcp, ratifyLearningForMcp, rebuildWriterRequestForMcp, recordApprovedLearningForMcp, recordLearningForMcp, reduceJudgmentForMcp, rewritePromptForMcp, submitSemanticVerdictForMcp, supersedeLearningForMcp, validateFinalApprovalForMcp, verifyCopySpecForMcp, verifyForMcp } from './mcp-tools.js';
 import { HYV_VERSION } from './version.js';
 import { loadApprovalContext } from './approval-context.js';
 const writing = z.string().min(1).max(100_000);
@@ -15,6 +15,7 @@ const lifecycleJson = z.string().min(1).max(1_048_576);
 const approvedLearningText = z.string().min(1).max(1_048_576);
 const evaluatorId = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/);
 const semanticViolation = z.enum(['action_change', 'dropped_object', 'unsupported_claim', 'constraint_weakened', 'clarity_regression']);
+const factSourcesJson = z.string().min(2).max(250_000);
 const redactsSensitiveInputs = process.env.HYV_MCP_SENSITIVE_INPUT_REDACTION === '1';
 const learningOptions = {
     mutation_id: z.string().min(1).max(200).optional(),
@@ -57,6 +58,10 @@ server.registerTool('hyv_build_profile', {
     inputSchema: { samples, avoid },
     annotations: { readOnlyHint: true },
 }, async ({ samples: writingSamples, avoid: phrases }) => guardedJson(() => buildProfileForMcp(writingSamples, phrases)));
+server.registerTool('hyv_profile_assess', {
+    description: 'Assess local sample readiness before building a VoiceDNA profile. It returns aggregate counts and one-way sample digests, never stored sample text or an authorship verdict.',
+    inputSchema: { samples }, annotations: { readOnlyHint: true },
+}, async ({ samples: writingSamples }) => json(assessProfileForMcp(writingSamples)));
 server.registerTool('hyv_analyze', {
     description: 'Run separate VoiceDNA and AI Editor checks plus a non-scoring Unicode hygiene inspection against a draft using a portable profile JSON string.',
     inputSchema: { draft: writing, profile_json: profileJson, writing_brief_json: writingBriefJson.optional() },
@@ -80,6 +85,17 @@ server.registerTool('hyv_final_check', {
     inputSchema: { text: hygieneText },
     annotations: { readOnlyHint: true },
 }, async ({ text }) => json(finalOutputCheckForMcp(text)));
+server.registerTool('hyv_delivery_check', {
+    description: 'Run an opt-in local delivery-integrity check for placeholders, likely secrets, local links, and supplied citation IDs. It never fetches URLs and is separate from final-check.',
+    inputSchema: { text: hygieneText, policy_json: lifecycleJson.optional() }, annotations: { readOnlyHint: true },
+}, async ({ text, policy_json }) => guardedJson(() => deliveryCheckForMcp(text, policy_json)));
+server.registerTool('hyv_fact_lint', {
+    description: 'Compare a draft against explicitly supplied local evidence text. It is a source-consistency check, not a truth service, and does not make network requests.',
+    inputSchema: { draft: writing, sources_json: factSourcesJson, metadata_json: lifecycleJson.optional() }, annotations: { readOnlyHint: true },
+}, async ({ draft, sources_json, metadata_json }) => guardedJson(() => factLintForMcp(draft, sources_json, metadata_json)));
+server.registerTool('hyv_mcp_capabilities', {
+    description: 'Return the stable core MCP tool names and the compatibility-preserved advanced surface.', inputSchema: {}, annotations: { readOnlyHint: true },
+}, async () => json({ version: '1', serverVersion: HYV_VERSION, core: ['hyv_analyze', 'hyv_verify', 'hyv_fact_lint', 'hyv_final_check'], advanced: ['hyv_logic_lint', 'hyv_delivery_check', 'hyv_profile_assess'], sensitiveInputRedaction: redactsSensitiveInputs }));
 server.registerTool('hyv_logic_lint', {
     description: 'Run the deterministic document-coherence gate. It detects configured topic drift, unanchored inference, and direct internal contradictions; it does not verify facts or approve publication.',
     inputSchema: { draft: writing, writing_brief_json: writingBriefJson.optional() },

package/dist/mcp.test.js

@@ -64,7 +64,7 @@ test('serves local Claude tools over stdio', async () => {
     assert.equal(code, 0);
     const responses = stdout.trim().split('\n').map((line) => JSON.parse(line));
     const tools = responses.find((response) => response.id === 2)?.result?.tools;
-    assert.deepEqual(tools?.map((tool) => tool.name), ['hyv_build_profile', 'hyv_analyze', 'hyv_hygiene', 'hyv_inspect_hidden_text', 'hyv_apply_hidden_text_policy', 'hyv_final_check', 'hyv_logic_lint', 'hyv_rewrite_prompt', 'hyv_prepare_rewrite', 'hyv_apply_rewrite', 'hyv_prepare_judgment', 'hyv_reduce_judgment', 'hyv_verify', 'hyv_verify_copy_spec', 'hyv_batch_analyze', 'hyv_patterns', 'hyv_learning_inspect', 'hyv_learning_record', 'hyv_learning_ratify', 'hyv_learning_supersede', 'hyv_learning_migrate', 'hyv_learning_clear', 'hyv_lifecycle_prepare_semantic', 'hyv_lifecycle_submit_verdict', 'hyv_lifecycle_inspect', 'hyv_lifecycle_finalize']);
+    assert.deepEqual(tools?.map((tool) => tool.name), ['hyv_build_profile', 'hyv_profile_assess', 'hyv_analyze', 'hyv_hygiene', 'hyv_inspect_hidden_text', 'hyv_apply_hidden_text_policy', 'hyv_final_check', 'hyv_delivery_check', 'hyv_fact_lint', 'hyv_mcp_capabilities', 'hyv_logic_lint', 'hyv_rewrite_prompt', 'hyv_prepare_rewrite', 'hyv_apply_rewrite', 'hyv_prepare_judgment', 'hyv_reduce_judgment', 'hyv_verify', 'hyv_verify_copy_spec', 'hyv_batch_analyze', 'hyv_patterns', 'hyv_learning_inspect', 'hyv_learning_record', 'hyv_learning_ratify', 'hyv_learning_supersede', 'hyv_learning_migrate', 'hyv_learning_clear', 'hyv_lifecycle_prepare_semantic', 'hyv_lifecycle_submit_verdict', 'hyv_lifecycle_inspect', 'hyv_lifecycle_finalize']);
     assert.ok(tools?.filter((tool) => !['hyv_verify', 'hyv_verify_copy_spec', 'hyv_apply_hidden_text_policy', 'hyv_learning_record', 'hyv_learning_ratify', 'hyv_learning_supersede', 'hyv_learning_migrate', 'hyv_learning_clear'].includes(tool.name)).every((tool) => tool.annotations?.readOnlyHint));
     assert.equal(tools?.find((tool) => tool.name === 'hyv_verify')?.annotations?.readOnlyHint, true);
     assert.equal(tools?.find((tool) => tool.name === 'hyv_verify_copy_spec')?.annotations?.readOnlyHint, true);
@@ -76,6 +76,8 @@ test('serves local Claude tools over stdio', async () => {
     assert.equal(tools?.find((tool) => tool.name === 'hyv_learning_inspect')?.annotations?.readOnlyHint, true);
     assert.equal(tools?.find((tool) => tool.name === 'hyv_inspect_hidden_text')?.annotations?.readOnlyHint, true);
     assert.equal(tools?.find((tool) => tool.name === 'hyv_logic_lint')?.annotations?.readOnlyHint, true);
+    assert.equal(tools?.find((tool) => tool.name === 'hyv_fact_lint')?.annotations?.readOnlyHint, true);
+    assert.equal(tools?.find((tool) => tool.name === 'hyv_mcp_capabilities')?.annotations?.readOnlyHint, true);
     assert.equal(tools?.find((tool) => tool.name === 'hyv_apply_hidden_text_policy')?.annotations?.readOnlyHint, false);
     assert.equal(tools?.find((tool) => tool.name === 'hyv_learning_clear')?.annotations?.readOnlyHint, false);
     assert.deepEqual(tools?.filter((tool) => tool.name.startsWith('hyv_learning_')).map((tool) => [tool.name, tool.annotations?.readOnlyHint, tool.annotations?.destructiveHint]), [
@@ -98,7 +100,7 @@ test('registers capability tools only with host redaction attestation', async ()
     assert.equal(stderr, '');
     const response = stdout.trim().split('\n').map((line) => JSON.parse(line)).find((item) => item.id === 2);
     const names = response.result.tools.map((tool) => tool.name);
-    assert.equal(names.length, 31);
+    assert.equal(names.length, 35);
     assert.ok(names.includes('hyv_lifecycle_validate_final_approval'));
     assert.ok(names.includes('hyv_learning_record_approved'));
     assert.ok(names.includes('hyv_prepare_rebuild'));

package/dist/mirror-refs.test.js

@@ -0,0 +1,63 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+const mirrorScript = new URL('../scripts/mirror-refs.mjs', import.meta.url).pathname;
+function git(cwd, ...args) {
+    return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+}
+function refs(repository) {
+    const text = git(repository, 'for-each-ref', '--format=%(objectname)\t%(refname)', 'refs/heads', 'refs/tags');
+    return text ? text.split('\n').sort() : [];
+}
+test('reconciles branch and tag creates, rewrites, and deletions', () => {
+    const root = mkdtempSync(join(tmpdir(), 'hyv-mirror-refs-'));
+    const source = join(root, 'source.git');
+    const mirror = join(root, 'mirror.git');
+    const checkout = join(root, 'checkout');
+    try {
+        git(root, 'init', '--bare', '--quiet', source);
+        git(root, 'init', '--bare', '--quiet', mirror);
+        git(root, 'clone', '--quiet', source, checkout);
+        git(checkout, 'config', 'user.name', 'Mirror Test');
+        git(checkout, 'config', 'user.email', 'mirror-test@example.invalid');
+        git(checkout, 'switch', '--quiet', '-c', 'main');
+        writeFileSync(join(checkout, 'main.txt'), 'first\n');
+        git(checkout, 'add', 'main.txt');
+        git(checkout, 'commit', '--quiet', '-m', 'first');
+        git(checkout, 'switch', '--quiet', '-c', 'feature/test');
+        writeFileSync(join(checkout, 'feature.txt'), 'feature\n');
+        git(checkout, 'add', 'feature.txt');
+        git(checkout, 'commit', '--quiet', '-m', 'feature');
+        git(checkout, 'tag', 'v1.0.0');
+        git(checkout, 'push', '--quiet', '--all', 'origin');
+        git(checkout, 'push', '--quiet', '--tags', 'origin');
+        git(source, 'symbolic-ref', 'HEAD', 'refs/heads/main');
+        git(checkout, 'remote', 'set-head', 'origin', '-a');
+        git(checkout, 'remote', 'add', 'mirror', mirror);
+        execFileSync(process.execPath, [mirrorScript], { cwd: checkout, stdio: 'pipe' });
+        assert.deepEqual(refs(mirror), refs(source));
+        assert.equal(refs(mirror).some((ref) => ref.endsWith('refs/heads/HEAD')), false);
+        git(checkout, 'switch', '--quiet', 'main');
+        writeFileSync(join(checkout, 'main.txt'), 'rewritten\n');
+        git(checkout, 'add', 'main.txt');
+        git(checkout, 'commit', '--quiet', '--amend', '-m', 'rewritten main');
+        git(checkout, 'branch', '-D', 'feature/test');
+        git(checkout, 'tag', '-d', 'v1.0.0');
+        git(checkout, 'tag', 'v2.0.0');
+        git(checkout, 'push', '--quiet', '--force', 'origin', 'main');
+        git(checkout, 'push', '--quiet', 'origin', '--delete', 'feature/test');
+        git(checkout, 'push', '--quiet', 'origin', ':refs/tags/v1.0.0');
+        git(checkout, 'push', '--quiet', 'origin', 'v2.0.0');
+        execFileSync(process.execPath, [mirrorScript], { cwd: checkout, stdio: 'pipe' });
+        assert.deepEqual(refs(mirror), refs(source));
+        assert.equal(refs(mirror).some((ref) => ref.endsWith('refs/heads/feature/test')), false);
+        assert.equal(refs(mirror).some((ref) => ref.endsWith('refs/tags/v1.0.0')), false);
+        assert.equal(refs(mirror).some((ref) => ref.endsWith('refs/tags/v2.0.0')), true);
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});

package/dist/production-gates.test.js

@@ -0,0 +1,34 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { generateKeyPairSync, sign } from 'node:crypto';
+import { inspectDeliveryIntegrity, parseDeliveryIntegrityPolicy } from './delivery-integrity.js';
+import { normalizeFinding, parseSurfacePolicy } from './disposition.js';
+import { assessProfileReadiness } from './profile-quality.js';
+import { createTeamProfileBundle, parseTeamProfileBundle } from './team-profile.js';
+test('keeps delivery integrity opt-in and local', () => {
+    const report = inspectDeliveryIntegrity('Hello {{name}} [missing](missing.md) [@brief]', parseDeliveryIntegrityPolicy({ version: '1', block: ['placeholder', 'local_link'], sourceIds: ['brief'] }), process.cwd());
+    assert.equal(report.passed, false);
+    assert.deepEqual(report.findings.map((finding) => [finding.kind, finding.disposition]), [['placeholder', 'block'], ['local_link', 'block']]);
+    assert.throws(() => parseDeliveryIntegrityPolicy({ version: '2' }), /not valid/);
+});
+test('reports profile readiness without retaining raw samples', () => {
+    const report = assessProfileReadiness(['A short sample.', 'A short sample.']);
+    assert.equal(report.sampleDigests.length, 2);
+    assert.ok(report.findings.some((finding) => finding.id === 'duplicate_sample'));
+    assert.doesNotMatch(JSON.stringify(report), /A short sample/);
+});
+test('normalizes legacy findings without changing legacy fields', () => {
+    assert.equal(normalizeFinding({ engine: 'ai_editor', id: 'x', severity: 'red', appliedPolicy: 'blocking', sentence: 1, excerpt: 'x', reason: 'r', suggestion: 's' }).disposition, 'block');
+    assert.equal(normalizeFinding({ engine: 'ai_editor', id: 'x', severity: 'yellow', appliedPolicy: 'judgment-required', sentence: 1, excerpt: 'x', reason: 'r', suggestion: 's' }).disposition, 'review');
+    assert.equal(normalizeFinding({ engine: 'voice_dna', id: 'x', severity: 'yellow', sentence: 1, excerpt: 'x', reason: 'r', suggestion: 's' }).disposition, 'signal');
+    assert.equal(normalizeFinding({ engine: 'ai_editor', id: 'ai.question-hook', severity: 'yellow', appliedPolicy: 'advisory', sentence: 1, excerpt: 'x', reason: 'r', suggestion: 's' }, parseSurfacePolicy({ version: '1', overrides: { 'ai.question-hook': 'review' } })).disposition, 'review');
+});
+test('requires current, consent-bound team profile membership', () => {
+    const fingerprint = 'a'.repeat(64);
+    const keys = generateKeyPairSync('ed25519');
+    const unsigned = { version: '1', id: 'team.example', createdAt: '2026-08-24T00:00:00.000Z', retention: 'delete on request', members: [{ role: 'author', sourceType: 'individual-writing', profileFingerprint: fingerprint, consent: { approved: true, basis: 'written consent', expiresAt: '2026-09-01T00:00:00.000Z' } }] };
+    const canonical = (value) => Array.isArray(value) ? `[${value.map(canonical).join(',')}]` : value && typeof value === 'object' ? `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}` : JSON.stringify(value);
+    const bundle = createTeamProfileBundle({ ...unsigned, authorization: { issuer: 'test', publicKeyPem: keys.publicKey.export({ format: 'pem', type: 'spki' }).toString(), signatureBase64: sign(null, Buffer.from(canonical(unsigned)), keys.privateKey).toString('base64') } });
+    assert.equal(parseTeamProfileBundle(bundle, new Date('2026-08-25T00:00:00.000Z')).id, 'team.example');
+    assert.throws(() => parseTeamProfileBundle({ ...bundle, id: 'tampered' }, new Date('2026-08-25T00:00:00.000Z')), /digest/);
+});

package/dist/profile-quality.js

@@ -0,0 +1,17 @@
+import { createHash } from 'node:crypto';
+import { sentences, words } from './text.js';
+export function assessProfileReadiness(samples) {
+    const totalWords = samples.reduce((sum, sample) => sum + words(sample).length, 0);
+    const totalSentences = samples.reduce((sum, sample) => sum + sentences(sample).length, 0);
+    const sampleDigests = samples.map((sample) => createHash('sha256').update(sample.trim().replace(/\s+/g, ' ')).digest('hex'));
+    const findings = [];
+    if (samples.length < 3)
+        findings.push({ id: 'sample_count', disposition: 'review', reason: 'Two samples can build a profile but give a narrow baseline.', suggestion: 'Use three or more rights-cleared samples from the same writer and context.' });
+    if (totalWords < 300 || totalSentences < 12)
+        findings.push({ id: 'sample_length', disposition: 'review', reason: 'The sample set has limited text coverage.', suggestion: 'Add longer samples before treating voice drift as high-confidence evidence.' });
+    if (new Set(sampleDigests).size !== sampleDigests.length)
+        findings.push({ id: 'duplicate_sample', disposition: 'review', reason: 'At least two normalized samples are identical.', suggestion: 'Replace duplicate samples with distinct writing.' });
+    if (samples.some((sample) => /^\s*[-*#]|^\s*subject:/im.test(sample)) && samples.some((sample) => !/^\s*[-*#]|^\s*subject:/im.test(sample)))
+        findings.push({ id: 'format_spread', disposition: 'signal', reason: 'Samples mix visibly different formats.', suggestion: 'Use a profile per audience and format when the distinction matters.' });
+    return { version: '1', sampleCount: samples.length, totalWords, totalSentences, sampleDigests, findings };
+}

package/dist/rebuild-task.test.js

@@ -174,7 +174,7 @@ test('CLI and MCP rebuild helpers share fingerprints', () => {
         version: '1', audience: 'operators', intent: 'explain', format: 'outreach',
     });
     assert.match(briefTask.prompt, /# WritingBrief/);
-    assert.equal(HYV_VERSION, '3.4.2');
+    assert.equal(HYV_VERSION, '3.4.4');
 });
 test('apply rejects forged tasks, missing capability, and substituted profiles', () => {
     const reduction = rebuildRecommendation();

package/dist/release-audit.test.js

@@ -5,6 +5,37 @@ import { dirname, join } from 'node:path';
 import { execFileSync, spawnSync } from 'node:child_process';
 import test from 'node:test';
 const audit = new URL('../scripts/release-audit.mjs', import.meta.url).pathname;
+const mirrorWorkflow = `on:
+  push:
+  delete:
+  workflow_dispatch:
+  schedule:
+    - cron: '17 3 * * *'
+
+concurrency:
+  group: mirror-to-stitchflow
+  cancel-in-progress: false
+
+jobs:
+  mirror:
+    if: github.repository == 'shashank-sn/holdyourvoice'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - run: |
+          if [ -z "\${MIRROR_DEPLOY_KEY:-}" ]; then
+            exit 1
+          fi
+          node scripts/mirror-refs.mjs
+`;
+const mirrorReconciler = `
+const headsRefspec = '+refs/remotes/origin/*:refs/heads/*';
+const tagsRefspec = '+refs/tags/*:refs/tags/*';
+execFileSync('git', ['update-ref', '--no-deref', '-d', 'refs/remotes/origin/HEAD']);
+spawnSync('git', ['push', '--prune', 'mirror', headsRefspec, tagsRefspec]);
+execFileSync('git', ['ls-remote', '--refs', 'mirror', 'refs/heads/*', 'refs/tags/*']);
+`;
 const stage1Files = [
     'scripts/evaluate-rewrite-benchmark.mjs',
     'scripts/run-stage1-dry-run.mjs',
@@ -36,6 +67,8 @@ function fixture(files) {
         ].join('\n'),
         'src/version.ts': "export const HYV_VERSION = '1.0.0';",
         'src/stage1-evaluation.ts': "const baseline = '4e6269121d551c008a34db73077e1e4fea41b3f9'; const stage1 = '550ea24f652291dca13757fdbd2f0fa0b5e3f621';",
+        '.github/workflows/mirror-to-stitchflow.yml': mirrorWorkflow,
+        'scripts/mirror-refs.mjs': mirrorReconciler,
         'skills/hyv-test/agent.json': '{}',
         'skills/hyv-test/SKILL.md': '# test',
         'skills/hyv-test/agents/openai.yaml': 'name: test',
@@ -60,6 +93,66 @@ test('accepts the complete public package contract', () => {
         rmSync(directory, { recursive: true, force: true });
     }
 });
+test('requires the mirror workflow to run only in the public source repository', () => {
+    const directory = fixture({
+        'README.md': '# public',
+        '.github/workflows/mirror-to-stitchflow.yml': mirrorWorkflow.replace("    if: github.repository == 'shashank-sn/holdyourvoice'\n", ''),
+    });
+    try {
+        const result = spawnSync(process.execPath, [audit], { cwd: directory, encoding: 'utf8' });
+        assert.notEqual(result.status, 0);
+        assert.match(result.stderr, /mirror workflow must run only in the public source repository with a bounded timeout/);
+    }
+    finally {
+        rmSync(directory, { recursive: true, force: true });
+    }
+});
+for (const requirement of [
+    { name: 'deleted refs', fragment: '  delete:\n', error: /mirror workflow must reconcile deleted refs/ },
+    { name: 'manual recovery', fragment: '  workflow_dispatch:\n', error: /mirror workflow must support manual recovery/ },
+    { name: 'scheduled reconciliation', fragment: "  schedule:\n    - cron: '17 3 \* \* \*'\n", error: /mirror workflow must reconcile refs on a schedule/ },
+    { name: 'serialized updates', fragment: '  group: mirror-to-stitchflow\n', error: /mirror workflow must serialize full-ref updates and finish the active update/ },
+    { name: 'non-cancelled active updates', fragment: '  cancel-in-progress: false\n', error: /mirror workflow must serialize full-ref updates and finish the active update/ },
+    { name: 'bounded execution', fragment: '    timeout-minutes: 10\n', error: /mirror workflow must run only in the public source repository with a bounded timeout/ },
+    { name: 'current checkout action', fragment: '      - uses: actions/checkout@v7\n', error: /mirror workflow must use the current checkout action/ },
+    { name: 'deploy-key validation', fragment: '          if [ -z "${MIRROR_DEPLOY_KEY:-}" ]; then\n', error: /mirror workflow must validate the source deploy key/ },
+    { name: 'tested reconciliation', fragment: '          node scripts/mirror-refs.mjs\n', error: /mirror workflow must run the tested ref reconciler/ },
+]) {
+    test(`requires mirror ${requirement.name}`, () => {
+        const directory = fixture({
+            'README.md': '# public',
+            '.github/workflows/mirror-to-stitchflow.yml': mirrorWorkflow.replace(requirement.fragment, ''),
+        });
+        try {
+            const result = spawnSync(process.execPath, [audit], { cwd: directory, encoding: 'utf8' });
+            assert.notEqual(result.status, 0);
+            assert.match(result.stderr, requirement.error);
+        }
+        finally {
+            rmSync(directory, { recursive: true, force: true });
+        }
+    });
+}
+for (const requirement of [
+    { name: 'safe remote HEAD exclusion', fragment: "execFileSync('git', ['update-ref', '--no-deref', '-d', 'refs/remotes/origin/HEAD']);\n", error: /mirror reconciler must exclude the remote HEAD pseudo-ref without deleting the default branch/ },
+    { name: 'destination pruning', fragment: "spawnSync('git', ['push', '--prune', 'mirror', headsRefspec, tagsRefspec]);\n", error: /mirror reconciler must prune destination refs/ },
+    { name: 'post-push ref verification', fragment: "execFileSync('git', ['ls-remote', '--refs', 'mirror', 'refs/heads/*', 'refs/tags/*']);\n", error: /mirror reconciler must verify source and mirror ref parity/ },
+]) {
+    test(`requires mirror reconciler ${requirement.name}`, () => {
+        const directory = fixture({
+            'README.md': '# public',
+            'scripts/mirror-refs.mjs': mirrorReconciler.replace(requirement.fragment, ''),
+        });
+        try {
+            const result = spawnSync(process.execPath, [audit], { cwd: directory, encoding: 'utf8' });
+            assert.notEqual(result.status, 0);
+            assert.match(result.stderr, requirement.error);
+        }
+        finally {
+            rmSync(directory, { recursive: true, force: true });
+        }
+    });
+}
 test('requires exact Stage 1 scripts even when the checkpoint files remain', () => {
     const directory = fixture({
         'README.md': '# public',

package/dist/team-profile.js

@@ -0,0 +1,50 @@
+import { createHash, createPublicKey, verify } from 'node:crypto';
+import { profileFingerprint } from './learning.js';
+function canonical(value) { if (Array.isArray(value))
+    return `[${value.map(canonical).join(',')}]`; if (value && typeof value === 'object') {
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`).join(',')}}`;
+} return JSON.stringify(value); }
+function digest(value) { return createHash('sha256').update(canonical(value)).digest('hex'); }
+function validDate(value) { return Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value; }
+export function createTeamProfileBundle(input) {
+    const value = { version: '1', ...input };
+    return { ...value, digest: digest(value) };
+}
+export function parseTeamProfileBundle(value, now = new Date()) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Team profile bundle is invalid.');
+    const bundle = value;
+    if (bundle.version !== '1' || typeof bundle.id !== 'string' || !validDate(bundle.createdAt) || typeof bundle.retention !== 'string' || !Array.isArray(bundle.members) || !bundle.members.length || !bundle.authorization || typeof bundle.authorization.issuer !== 'string' || typeof bundle.authorization.publicKeyPem !== 'string' || typeof bundle.authorization.signatureBase64 !== 'string' || !/^[a-f0-9]{64}$/.test(bundle.digest ?? ''))
+        throw new Error('Team profile bundle is invalid.');
+    const { digest: provided, ...unsigned } = bundle;
+    if (digest(unsigned) !== provided)
+        throw new Error('Team profile bundle digest does not match.');
+    const signed = canonical({ version: bundle.version, id: bundle.id, createdAt: bundle.createdAt, retention: bundle.retention, members: bundle.members });
+    try {
+        if (!verify(null, Buffer.from(signed), createPublicKey(bundle.authorization.publicKeyPem), Buffer.from(bundle.authorization.signatureBase64, 'base64')))
+            throw new Error('invalid');
+    }
+    catch {
+        throw new Error('Team profile bundle authorization is invalid.');
+    }
+    if (!bundle.members.some((member) => member.role === 'author') || !bundle.members.every((member) => (member.role === 'author' || member.role === 'brand') && ['individual-writing', 'approved-brand-guide'].includes(member.sourceType) && /^[a-f0-9]{64}$/.test(member.profileFingerprint) && member.consent?.approved === true && typeof member.consent.basis === 'string' && validDate(member.consent.expiresAt) && Date.parse(member.consent.expiresAt) > now.getTime()))
+        throw new Error('Team profile bundle consent is invalid or expired.');
+    return bundle;
+}
+export function composeTeamProfile(author, brands, bundle, now = new Date()) {
+    const parsed = parseTeamProfileBundle(bundle, now);
+    if (!parsed.members.some((member) => member.role === 'author' && member.profileFingerprint === profileFingerprint(author)))
+        throw new Error('Team profile bundle does not authorize this author profile.');
+    if (author.version !== '3')
+        return author;
+    const policy = { ...author.rulePolicy };
+    for (const brand of brands) {
+        if (!parsed.members.some((member) => member.role === 'brand' && member.profileFingerprint === profileFingerprint(brand)))
+            throw new Error('Team profile bundle does not authorize this brand profile.');
+        for (const [id, state] of Object.entries(brand.rulePolicy))
+            if (!policy[id] || state === 'blocking')
+                policy[id] = state;
+    }
+    return { ...author, avoid: [...new Set([...author.avoid, ...brands.flatMap((brand) => brand.avoid)])], rulePolicy: policy };
+}

package/dist/version.js

@@ -1 +1 @@
-export const HYV_VERSION = '3.4.2';
+export const HYV_VERSION = '3.4.4';

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@holdyourvoice/hyv",
-  "version": "3.4.2",
+  "version": "3.4.4",
   "description": "A local-first dual-engine writing gate that protects voice and catches generic AI patterns.",
   "type": "module",
   "bin": { "hyv": "dist/cli.js" },
   "files": ["dist", "skills", "Readme.md", "LICENSE"],
-  "scripts": { "build": "tsc -p tsconfig.json", "bundle:claude": "esbuild src/mcp.ts --bundle --platform=node --format=esm --target=node20 --outfile=mcpb/server/index.js", "build:claude": "npm run build && npm run bundle:claude", "pack:claude": "npm run build:claude && node scripts/pack-claude.mjs", "stage1:evaluate": "node scripts/evaluate-rewrite-benchmark.mjs", "stage1:dry-run": "npm run build && node scripts/run-stage1-dry-run.mjs", "stage1:human-packet": "npm run build && node scripts/run-stage1-human-packet.mjs", "stage2:human-packet": "npm run build && node scripts/run-stage2-human-packet.mjs", "test": "npm run build && node --test \"dist/**/*.test.js\"", "check:release": "node scripts/release-audit.mjs", "prepack": "npm run check:release && npm test" },
+  "scripts": { "build": "tsc -p tsconfig.json", "bundle:claude": "esbuild src/mcp.ts --bundle --platform=node --format=esm --target=node20 --outfile=mcpb/server/index.js", "build:claude": "npm run build && npm run bundle:claude", "pack:claude": "npm run build:claude && node scripts/pack-claude.mjs", "scorecard": "node scripts/public-scorecard.mjs benchmarks", "validate:rule-contributions": "node scripts/validate-rule-contributions.mjs", "stage1:evaluate": "node scripts/evaluate-rewrite-benchmark.mjs", "stage1:dry-run": "npm run build && node scripts/run-stage1-dry-run.mjs", "stage1:human-packet": "npm run build && node scripts/run-stage1-human-packet.mjs", "stage2:human-packet": "npm run build && node scripts/run-stage2-human-packet.mjs", "test": "npm run build && node --test \"dist/**/*.test.js\"", "check:release": "node scripts/release-audit.mjs", "prepack": "npm run check:release && npm test" },
   "engines": { "node": ">=20" },
   "license": "MIT",
   "keywords": ["ai-writing", "cli", "editing", "voice", "writing"],