@ikon85/agent-workflow-kit 0.43.0 → 0.44.0

package/scripts/test_skill_precommit_template.py

@@ -1,30 +0,0 @@
-#!/usr/bin/env python3
-"""The shipped pre-commit template must sanitize git's hook environment.
-
-Git exports GIT_DIR/GIT_INDEX_FILE to hooks; a consumer gate that runs a test
-suite whose child tests call git in their own temp repos would otherwise
-redirect those calls onto the host repo's index (PR #121's incident)."""
-
-from __future__ import annotations
-
-import unittest
-from pathlib import Path
-
-TEMPLATE = (
-    Path(__file__).resolve().parent.parent
-    / ".claude/skills/setup-pre-commit/scripts/pre-commit.template.sh"
-)
-
-
-class PreCommitTemplateSanitizesGitEnv(unittest.TestCase):
-    def test_template_unsets_git_env_before_gate(self):
-        text = TEMPLATE.read_text(encoding="utf-8")
-        unset_pos = text.find("unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_PREFIX")
-        gate_pos = text.find(">>> your gate commands here <<<")
-        self.assertGreater(unset_pos, -1, "template must unset git's exported hook env")
-        self.assertGreater(gate_pos, -1, "template must keep the gate marker")
-        self.assertLess(unset_pos, gate_pos, "sanitize must happen before the gate runs")
-
-
-if __name__ == "__main__":
-    unittest.main()

package/scripts/test_skill_publish_audit.py

@@ -1,358 +0,0 @@
-#!/usr/bin/env python3
-"""Fail-closed publish audit for dist-kit/ (Welle 26 / Slice 6 / #990, Step 13).
-
-The scrub (scripts/lib/scrub.mjs) removes project-private tokens at build time;
-THIS audit is the BACKSTOP — it scans the assembled dist-kit/ and DENIES the
-publish if anything private survived. Scrub may be imperfect; this fails loud so
-nothing private ever ships silently.
-
-Deny classes (each with a negative fixture below):
-  - private repo slug `iKon85/Testreporter` + the bare project name
-  - board node/field IDs (`PVT…`) + status/wave/cluster option hashes
-  - private deploy domains (`*.iverra.de`), Coolify
-  - email addresses
-  - absolute home paths (`/home/<user>`)
-  - residual issue refs (`#NNN`) / hard-rule refs (`HRn`)
-  - unresolvable provenance cross-refs (`ADR-####` / `Welle N` / `Slice N`),
-    with a documented fixture/example allowlist (PROVENANCE_FIXTURE_SUFFIXES)
-  - `../` cross-skill reaches (skills/scripts/docs — except a static top-level
-    script import into the shipped `src/lib` deep-module seam, and CLI `src`
-    imports which legitimately use `../lib/…`)
-  - bare owner/maintainer names OUTSIDE the generated credit files
-  - high-entropy secrets (after exempting the manifest's own sha256 file-hashes)
-
-Allowlisted: the PUBLIC repo slug `iKon85/agent-workflow-kit`.
-File-exempt (credits legitimately name people): LICENSE, README.md, PROVENANCE.md,
-THIRD-PARTY-NOTICES.md — but these still may NOT carry board IDs / domains /
-secrets / the private repo slug.
-
-Run: python3 scripts/test_skill_publish_audit.py
-"""
-import json
-import re
-import subprocess
-import sys
-import tempfile
-import unittest
-from pathlib import Path
-
-REPO = Path(__file__).resolve().parent.parent
-PUBLIC_CENSUS_UNIT = json.loads(
-    (REPO / "test/fixtures/census-consumers/public-unit.json").read_text(encoding="utf-8")
-)["paths"]
-PUBLIC_SLUG = "iKon85/agent-workflow-kit"
-CREDIT_FILES = {"LICENSE", "README.md", "PROVENANCE.md", "THIRD-PARTY-NOTICES.md"}
-PRIVATE_SKILLS = {
-    "drizzle", "migrations", "forecast-logic", "bug-bucketing", "iverra-brand",
-    "ui-ux-pro-max",
-}
-# pin SHAs are legitimate attribution (full forms exempted from high-entropy)
-KNOWN_PIN_HASHES = {
-    "2bf70051928429983de3b5718d277150926f8c89",
-    "ba71f82e8469395d3f7c4ed824334b16676e87a0",
-}
-
-# (label, regex) — denied EVERYWHERE, even in credit files.
-HARD_DENY = [
-    ("private repo slug", re.compile(r"iKon85/Testreporter")),
-    ("board node/field id", re.compile(r"PVT(?:SSF|F)?_[A-Za-z0-9]")),
-    ("private deploy domain", re.compile(r"[A-Za-z0-9.-]*\.iverra\.de")),
-    ("Coolify reference", re.compile(r"\bCoolify\b")),
-    ("email address", re.compile(r"[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}")),
-    ("absolute home path", re.compile(r"/home/[A-Za-z0-9._-]+")),
-    ("home-encoded project slug", re.compile(r"-home-[a-z0-9]+-projects")),
-    ("issue ref", re.compile(r"#\d{3,5}\b")),
-    ("hard-rule ref", re.compile(r"\bHR\d+\b")),
-    ("project name", re.compile(r"[Tt]estreporter")),
-    ("kit issue ref", re.compile(r"\bkit#\d+\b")),
-]
-# Provenance cross-refs a kit consumer cannot resolve (no docs/adr dir, no wave
-# history). Denied EVERYWHERE except the documented fixture/example files below,
-# where a Welle/Slice/ADR token is legitimate CONTENT — synthetic PRD scenarios,
-# a template placeholder, illustrative ADR names, or board-sync's wave-prefix
-# parser examples — not project provenance. Keep in sync with scrub.mjs's PROV
-# class (which strips citation-shaped provenance from every other body/script).
-PROVENANCE_DENY = [
-    ("ADR ref", re.compile(r"\bADR-\d{3,4}\b")),
-    ("Welle ref", re.compile(r"\bWelle \d+\b")),
-    ("Slice ref", re.compile(r"\bSlice \d+[a-z]?\b")),
-]
-# Matched by dest-path SUFFIX so both surfaces (.claude/skills, .agents/skills)
-# resolve with one entry each.
-PROVENANCE_FIXTURE_SUFFIXES = (
-    "spec-self-critique/scenarios.md",        # synthetic Program-PRD fixtures
-    "to-issues/SKILL.md",                     # `Welle $WAVE / Slice 1a` title example
-    "improve-codebase-architecture/SKILL.md",  # illustrative `ADR-0007` example
-    "setup-workflow/domain.md",               # illustrative `ADR-0007` example
-    "docs/agents/wave-anchor-template.md",     # `Slice 1` / `Welle <N>` placeholders
-    "scripts/board-sync.py",                  # `Welle 7 — X` wave-prefix parser examples
-)
-# denied only OUTSIDE credit files (scrub should have neutralized these)
-BARE_PRIVATE = [
-    ("bare owner iKon85", re.compile(r"iKon85")),
-    ("maintainer name", re.compile(r"\bNiko\b")),
-]
-PARENT_REF = re.compile(r"\.\./")
-SHIPPED_SRC_IMPORT = re.compile(
-    r"^\s*import\b.*\bfrom\s+['\"]\.\./src/lib/[A-Za-z0-9-]+\.mjs['\"];\s*$"
-)
-LONG_HEX = re.compile(r"\b[0-9a-f]{40,}\b")
-GH_TOKEN = re.compile(r"\b(?:ghp|gho|ghu|ghs|github_pat)_[A-Za-z0-9_]{20,}")
-
-
-def _parent_ref_scan_text(rel: str, text: str) -> str:
-    lines = text.splitlines()
-    if rel == "scripts/loc_offender_core.py":
-        # This is the portable path-traversal guard itself, not a cross-skill reach.
-        lines = [
-            line for line in lines
-            if 'p.startswith("../")' not in line and '"/../" in p' not in line
-        ]
-    if rel.startswith("scripts/") and rel.endswith(".mjs"):
-        # Top-level shipped scripts may consume the kit's shipped deep modules.
-        # The exact static-import shape stays inside the bundle root; every other
-        # parent reach remains visible to the deny rule below.
-        lines = [line for line in lines if not SHIPPED_SRC_IMPORT.match(line)]
-    return "\n".join(lines)
-
-
-def _known_hashes(root: Path) -> set:
-    hashes = set(KNOWN_PIN_HASHES)
-    pkg = root / "agent-workflow-kit.package.json"
-    if pkg.exists():
-        data = json.loads(pkg.read_text(encoding="utf-8"))
-        for f in data.get("files", []):
-            if "sha256" in f:
-                hashes.add(f["sha256"])
-    gitleaks = root / "scripts/security/gitleaks-profile.json"
-    if gitleaks.exists():
-        data = json.loads(gitleaks.read_text(encoding="utf-8"))
-        for platform in data.get("platforms", {}).values():
-            checksum = platform.get("sha256")
-            if isinstance(checksum, str):
-                hashes.add(checksum)
-    return hashes
-
-
-def _scan_file(rel: str, text: str, known_hashes: set) -> list:
-    out = []
-    base = Path(rel).name
-    credit = base in CREDIT_FILES
-    scan = text.replace(PUBLIC_SLUG, "")  # allowlist the public slug
-    for label, pat in HARD_DENY:
-        if pat.search(scan):
-            out.append(f"{rel}: {label}")
-    if not rel.endswith(PROVENANCE_FIXTURE_SUFFIXES):
-        for label, pat in PROVENANCE_DENY:
-            if pat.search(scan):
-                out.append(f"{rel}: {label}")
-    if not credit:
-        for label, pat in BARE_PRIVATE:
-            if pat.search(scan):
-                out.append(f"{rel}: {label}")
-    if not rel.startswith("src/") and PARENT_REF.search(_parent_ref_scan_text(rel, text)):
-        out.append(f"{rel}: ../ parent reference")
-    for m in LONG_HEX.finditer(text):
-        if m.group(0) not in known_hashes:
-            out.append(f"{rel}: high-entropy hex (possible secret)")
-            break
-    if GH_TOKEN.search(text):
-        out.append(f"{rel}: GitHub-token-like string")
-    return out
-
-
-def audit_dir(root) -> list:
-    """Return a list of violation strings ([] = clean = publishable)."""
-    root = Path(root)
-    known = _known_hashes(root)
-    violations = []
-    for f in sorted(root.rglob("*")):
-        if not f.is_file():
-            continue
-        rel = f.relative_to(root).as_posix()
-        raw = f.read_bytes()
-        if b"\x00" in raw:  # binary — skip
-            continue
-        violations += _scan_file(rel, raw.decode("utf-8", errors="replace"), known)
-    # project-private skill dirs must never appear in the kit
-    for surface in (".claude/skills", ".agents/skills"):
-        d = root / surface
-        if d.is_dir():
-            for child in d.iterdir():
-                if child.is_dir() and child.name in PRIVATE_SKILLS:
-                    violations.append(f"{surface}/{child.name}: project-private skill shipped")
-    return violations
-
-
-# --------------------------------------------------------------------------- #
-class AuditCatchesEachClass(unittest.TestCase):
-    """Inject one violation per class into a clean fixture → it must be caught."""
-
-    def setUp(self):
-        self.dir = Path(tempfile.mkdtemp())
-        # a minimal CLEAN kit
-        (self.dir / "agent-workflow-kit.package.json").write_text(
-            json.dumps({"kitVersion": "0.1.0", "files": [
-                {"path": ".claude/skills/x/SKILL.md", "sha256": "a" * 64}]}),
-            encoding="utf-8")
-        self.skill = self.dir / ".claude/skills/x"
-        self.skill.mkdir(parents=True)
-        (self.skill / "SKILL.md").write_text("# clean skill\nuse `#<n>` and #0f172a\n",
-                                             encoding="utf-8")
-
-    def _body(self, content):
-        (self.skill / "SKILL.md").write_text(content, encoding="utf-8")
-        return audit_dir(self.dir)
-
-    def test_clean_passes(self):
-        self.assertEqual(audit_dir(self.dir), [])
-
-    def test_private_slug(self):
-        self.assertTrue(any("repo slug" in v for v in self._body("see iKon85/Testreporter")))
-
-    def test_board_id(self):
-        self.assertTrue(any("board" in v for v in self._body("id PVT_kwHOAuH31M4BVtcf")))
-
-    def test_domain(self):
-        self.assertTrue(any("domain" in v for v in self._body("curl testreporter.iverra.de")))
-
-    def test_email(self):
-        self.assertTrue(any("email" in v for v in self._body("ping a@b.com please")))
-
-    def test_home_path(self):
-        self.assertTrue(any("home path" in v for v in self._body("at /home/niko/x")))
-
-    def test_home_encoded_slug(self):
-        leak = '$HOME/.claude/projects/-home-niko-projects-x/memory'
-        self.assertTrue(any("home-encoded" in v for v in self._body(leak)))
-
-    def test_issue_ref(self):
-        self.assertTrue(any("issue ref" in v for v in self._body("fixed in #824 now")))
-
-    def test_hr_ref(self):
-        self.assertTrue(any("hard-rule" in v for v in self._body("per HR16 rule")))
-
-    def test_kit_issue_ref(self):
-        self.assertTrue(any("kit issue ref" in v for v in self._body("see kit#27 §2")))
-
-    def test_adr_ref(self):
-        self.assertTrue(any("ADR ref" in v for v in self._body("per ADR-0034 rule")))
-
-    def test_welle_ref(self):
-        self.assertTrue(any("Welle ref" in v for v in self._body("built in Welle 52")))
-
-    def test_slice_ref(self):
-        self.assertTrue(any("Slice ref" in v for v in self._body("done in Slice 1g")))
-
-    def test_parent_ref(self):
-        self.assertTrue(any("parent" in v for v in self._body("[x](../../other/SKILL.md)")))
-
-    def test_static_script_import_into_shipped_src_lib_is_allowed(self):
-        script = self.dir / "scripts/release.mjs"
-        script.parent.mkdir()
-        script.write_text(
-            "import { run } from '../src/lib/release-core.mjs';\nrun();\n",
-            encoding="utf-8",
-        )
-        self.assertEqual(audit_dir(self.dir), [])
-
-    def test_bare_owner_in_body(self):
-        self.assertTrue(any("iKon85" in v for v in self._body("authored by iKon85")))
-
-    def test_secret(self):
-        self.assertTrue(any("secret" in v for v in self._body("token " + "d" * 50)))
-
-    def test_gh_token(self):
-        self.assertTrue(any("token" in v for v in self._body("ghp_" + "A" * 30)))
-
-    def test_private_skill_dir_flagged(self):
-        (self.dir / ".claude/skills/drizzle").mkdir(parents=True)
-        self.assertTrue(any("project-private" in v for v in audit_dir(self.dir)))
-
-
-class Exemptions(unittest.TestCase):
-    """Public slug is allowlisted; credit files may legitimately name people."""
-
-    def setUp(self):
-        self.dir = Path(tempfile.mkdtemp())
-        (self.dir / "agent-workflow-kit.package.json").write_text(
-            '{"kitVersion":"0.1.0","files":[]}', encoding="utf-8")
-
-    def _write(self, name, content):
-        (self.dir / name).write_text(content, encoding="utf-8")
-
-    def test_public_slug_allowed(self):
-        self._write("README.md", "npx github:iKon85/agent-workflow-kit init")
-        self.assertEqual(audit_dir(self.dir), [])
-
-    def test_credit_file_may_name_maintainer(self):
-        self._write("LICENSE", "Copyright (c) 2026 Niko (iKon85)\nMatt Pocock\nChase AI")
-        self.assertEqual(audit_dir(self.dir), [])
-
-    def test_credit_file_still_denies_board_id(self):
-        self._write("LICENSE", "Niko (iKon85) PVT_leak")
-        self.assertTrue(any("board" in v for v in audit_dir(self.dir)))
-
-    def test_manifest_own_hashes_not_flagged_as_secret(self):
-        # the package manifest's 64-hex file hashes are exempt (they ARE the kit's hashes)
-        (self.dir / "agent-workflow-kit.package.json").write_text(
-            json.dumps({"kitVersion": "0.1.0", "files": [
-                {"path": "x", "sha256": "f" * 64}]}), encoding="utf-8")
-        self.assertEqual(audit_dir(self.dir), [])
-
-    def test_gitleaks_profile_checksums_are_verified_pin_metadata(self):
-        profile = self.dir / "scripts/security"
-        profile.mkdir(parents=True)
-        (profile / "gitleaks-profile.json").write_text(json.dumps({
-            "platforms": {"linux-x64": {"sha256": "e" * 64}},
-        }), encoding="utf-8")
-        self.assertEqual(audit_dir(self.dir), [])
-
-    def test_loc_offender_traversal_guard_allowed(self):
-        p = self.dir / "scripts"
-        p.mkdir()
-        (p / "loc_offender_core.py").write_text(
-            'if p == ".." or p.startswith("../") or "/../" in p or p.endswith("/.."):\n'
-            '    return None\n',
-            encoding="utf-8")
-        self.assertEqual(audit_dir(self.dir), [])
-
-    def test_top_level_script_may_import_camel_case_shipped_deep_module(self):
-        p = self.dir / "scripts"
-        p.mkdir()
-        (p / "readiness.mjs").write_text(
-            "import { load } from '../src/lib/skillRegistry.mjs';\n",
-            encoding="utf-8")
-        self.assertEqual(audit_dir(self.dir), [])
-
-
-class RealDistKitIsClean(unittest.TestCase):
-    """Build dist-kit/ from SSOT and assert the audit passes (the publish gate)."""
-
-    def test_built_dist_kit_passes_audit(self):
-        build = REPO / "scripts/build-kit.mjs"
-        try:
-            r = subprocess.run(["node", str(build)], cwd=REPO,
-                               capture_output=True, text=True, timeout=120)
-        except (FileNotFoundError, subprocess.TimeoutExpired) as e:
-            self.skipTest(f"node/build unavailable: {e}")
-        self.assertEqual(r.returncode, 0, r.stderr)
-        violations = audit_dir(REPO / "dist-kit")
-        self.assertEqual(violations, [], "\n".join(violations[:40]))
-
-    def test_built_dist_kit_contains_publishable_census_without_foreign_reach(self):
-        build = subprocess.run(
-            ["node", str(REPO / "scripts/build-kit.mjs")], cwd=REPO,
-            capture_output=True, text=True, timeout=120,
-        )
-        self.assertEqual(build.returncode, 0, build.stderr)
-        for rel in PUBLIC_CENSUS_UNIT:
-            path = REPO / "dist-kit" / rel
-            self.assertTrue(path.is_file(), f"missing published census resource: {rel}")
-            text = path.read_text(encoding="utf-8")
-            self.assertNotIn("tools/agent-workflow-kit", text)
-            self.assertNotIn("testreporter", text.lower())
-
-
-if __name__ == "__main__":
-    unittest.main(verbosity=2)

package/scripts/test_skill_readiness_contract.py

@@ -1,264 +0,0 @@
-#!/usr/bin/env python3
-"""Manifest-derived readiness declaration and marker grammar guard."""
-from __future__ import annotations
-
-import json
-import re
-import subprocess
-import unittest
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parents[1]
-MANIFEST_PATH = ROOT / ".claude/skills/skill-manifest.json"
-START = re.compile(r"^<!-- readiness:block ([a-z][A-Za-z0-9]*) -->$")
-END = "<!-- readiness:end -->"
-SURFACE = {"claude": ".claude/skills", "codex": ".agents/skills"}
-FIXTURES = ROOT / "test/fixtures/readiness"
-REQUIRED_V1 = {
-    "to-prd": ["issueTracker", "managedBoard"],
-    "to-issues": ["issueTracker", "managedBoard", "specCompleteness"],
-    "to-waves": ["issueTracker", "managedBoard", "specCompleteness"],
-    "board-to-waves": ["issueTracker", "managedBoard"],
-    "triage": ["issueTracker", "managedBoard", "triageLabels"],
-    "orchestrate-wave": ["issueTracker", "managedBoard"],
-    "local-ci": ["localCiRecipe"],
-    "project-release": ["projectReleaseProfile"],
-    "security-audit": ["securityAuditRunbook"],
-}
-OPTIONAL_V1 = {
-    "wrapup": {"deployReport": "prodTarget"},
-    "orchestrate-wave": {"projectRecipe": "orchestrateWaveRecipe"},
-    "spec-self-critique": {"projectEnrichment": "specCritiqueLayer"},
-    "code-review": {"projectEnrichment": "codeReviewLayer"},
-    "verify-spike": {"projectPlacement": "verifySpikeLayer"},
-    "audit-skills": {"projectChecks": "auditSkillsLayer"},
-    "git-worktree-recover": {"projectRecovery": "worktreeRecoveryLayer"},
-}
-COMPAT_UPDATE_SCRIPT = r"""
-import { readFile, writeFile, mkdir } from 'node:fs/promises';
-import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
-const [repo, fixturePath] = process.argv.slice(-2);
-const load = async (path) => import(pathToFileURL(join(repo, path)));
-const { init } = await load('src/commands/init.mjs');
-const { update } = await load('src/commands/update.mjs');
-const { checkSkill } = await load('scripts/readiness.mjs');
-const { makeKit, makeEmptyDir, cleanup } = await load('test/helpers.mjs');
-const { PACKAGE_MANIFEST_NAME, readManifest, writeManifest } = await load('src/lib/manifest.mjs');
-const { sha256 } = await load('src/lib/hash.mjs');
-const readinessPath = '.claude/skills/skill-manifest.json';
-const fixture = JSON.parse(await readFile(fixturePath, 'utf8'));
-const current = JSON.parse(await readFile(join(repo, readinessPath), 'utf8'));
-const previous = structuredClone(current);
-for (const skill of Object.keys(fixture.readinessFixture.skills)) {
-  previous.skills[skill].readiness = {};
-}
-const kit = await makeKit({ '.claude/skills/to-prd/SKILL.md': 'fixture\n' });
-const consumer = await makeEmptyDir();
-async function setKitReadiness(manifest) {
-  const candidateManifest = structuredClone(manifest);
-  for (const [name, declaration] of Object.entries(candidateManifest.skills)) {
-    declaration.publish = name === 'to-prd';
-    if (name === 'to-prd') declaration.surfaces = ['claude'];
-  }
-  const content = `${JSON.stringify(candidateManifest, null, 2)}\n`;
-  const path = join(kit, readinessPath);
-  await mkdir(join(kit, '.claude/skills'), { recursive: true });
-  await writeFile(path, content);
-  const pkg = await readManifest(join(kit, PACKAGE_MANIFEST_NAME));
-  const entry = pkg.files.find(({ path: candidate }) => candidate === readinessPath);
-  if (entry) entry.sha256 = sha256(content);
-  else pkg.files.push({ path: readinessPath, kind: 'doc', sha256: sha256(content), mode: 0o644, origin: 'kit' });
-  await writeManifest(join(kit, PACKAGE_MANIFEST_NAME), pkg);
-}
-try {
-  await setKitReadiness(previous);
-  await init({ kitRoot: kit, consumerRoot: consumer });
-  for (const [relative, body] of Object.entries(fixture.readinessFixture.evidence)) {
-    const path = join(consumer, relative);
-    await mkdir(join(path, '..'), { recursive: true });
-    await writeFile(path, body);
-  }
-  const manifestPath = join(consumer, 'agent-workflow-kit.json');
-  const installed = await readManifest(manifestPath);
-  await writeManifest(manifestPath, {
-    ...installed,
-    readinessDecisions: fixture.readinessDecisions ?? {},
-    readinessFixture: fixture.readinessFixture,
-  });
-  const before = {};
-  for (const skill of Object.keys(fixture.readinessFixture.skills)) {
-    before[skill] = await checkSkill({ root: consumer, skill, manifest: previous });
-  }
-  await setKitReadiness(current);
-  const identity = { name: '@ikon85/agent-workflow-kit', version: '0.1.0', tarballIntegrity: 'sha512-fixture', manifestSha256: 'fixture-manifest' };
-  const result = await update({
-    kitRoot: kit, consumerRoot: consumer,
-    releaseIdentities: { installed: { name: identity.name, version: identity.version, manifestSha256: identity.manifestSha256 }, npm: identity, github: identity },
-    verify: async () => {},
-  });
-  const afterManifest = await readManifest(manifestPath);
-  const after = {};
-  for (const skill of Object.keys(fixture.readinessFixture.skills)) {
-    after[skill] = await checkSkill({ root: consumer, skill, manifest: current });
-  }
-  console.log(JSON.stringify({ before, result, afterManifest, after }));
-} finally {
-  await cleanup(kit, consumer);
-}
-"""
-
-
-def load_manifest() -> dict:
-    return json.loads(MANIFEST_PATH.read_text(encoding="utf-8"))
-
-
-def marker_sequence(body: str, declared: set[str]) -> list[str]:
-    sequence: list[str] = []
-    active: str | None = None
-    seen: set[str] = set()
-    for number, line in enumerate(body.splitlines(), 1):
-        match = START.fullmatch(line)
-        if match:
-            block = match.group(1)
-            if active:
-                raise AssertionError(f"nested readiness block at line {number}")
-            if block in seen:
-                raise AssertionError(f"duplicate readiness block {block}")
-            if block not in declared:
-                raise AssertionError(f"unknown readiness block {block}")
-            active = block
-            seen.add(block)
-            sequence.append(block)
-        elif line == END:
-            if not active:
-                raise AssertionError(f"unbalanced readiness end at line {number}")
-            active = None
-        elif "readiness:block" in line or "readiness:end" in line:
-            raise AssertionError(f"invalid readiness marker grammar at line {number}")
-    if active:
-        raise AssertionError(f"unbalanced readiness block {active}")
-    return sequence
-
-
-def validate_surface_sequences(sequences: list[list[str]]) -> None:
-    if any(sequence != sequences[0] for sequence in sequences[1:]):
-        raise AssertionError("cross-surface readiness marker drift")
-
-
-class ReadinessContractTests(unittest.TestCase):
-    def setUp(self) -> None:
-        self.manifest = load_manifest()
-        self.catalog = self.manifest["readiness"]["capabilities"]
-        self.published = {
-            name: entry for name, entry in self.manifest["skills"].items()
-            if entry.get("publish")
-        }
-
-    def test_contract_and_skill_denominator_come_from_publish_manifest(self) -> None:
-        self.assertEqual(self.manifest["readiness"]["contractVersion"], 1)
-        manifest_source = (ROOT / "src/lib/manifest.mjs").read_text(encoding="utf-8")
-        version = re.search(r"READINESS_CONTRACT_VERSION = (\d+);", manifest_source)
-        self.assertIsNotNone(version)
-        self.assertEqual(int(version.group(1)), self.manifest["readiness"]["contractVersion"])
-        self.assertGreater(len(self.published), 0)
-        for name, entry in self.published.items():
-            self.assertTrue(entry.get("surfaces"), name)
-
-    def test_every_declaration_references_the_single_capability_catalog(self) -> None:
-        for skill, entry in self.published.items():
-            declaration = entry.get("readiness", {})
-            references = list(declaration.get("required", []))
-            references += list(declaration.get("optionalBlocks", {}).values())
-            for capability in references:
-                self.assertIn(capability, self.catalog, f"{skill}: {capability}")
-            blocks = list(declaration.get("optionalBlocks", {}))
-            self.assertEqual(len(blocks), len(set(blocks)), skill)
-
-    def test_locked_v1_policy_cannot_disappear_from_the_manifest(self) -> None:
-        actual_required = {
-            skill: entry["readiness"]["required"]
-            for skill, entry in self.published.items()
-            if entry.get("readiness", {}).get("required")
-        }
-        actual_optional = {
-            skill: entry["readiness"]["optionalBlocks"]
-            for skill, entry in self.published.items()
-            if entry.get("readiness", {}).get("optionalBlocks")
-        }
-        self.assertEqual(actual_required, REQUIRED_V1)
-        self.assertEqual(actual_optional, OPTIONAL_V1)
-
-    def test_every_declared_consumer_has_the_standard_preflight(self) -> None:
-        consumers = {
-            skill: entry for skill, entry in self.published.items()
-            if entry.get("readiness")
-        }
-        self.assertGreater(len(consumers), 0)
-        for skill, entry in consumers.items():
-            expected = f"node scripts/readiness.mjs check --skill {skill} --json"
-            for surface in entry["surfaces"]:
-                path = ROOT / SURFACE[surface] / skill / "SKILL.md"
-                body = path.read_text(encoding="utf-8")
-                self.assertEqual(body.count(expected), 1, f"{surface}:{skill}")
-
-    def test_markers_are_balanced_declared_and_surface_equal_when_activated(self) -> None:
-        for skill, entry in self.published.items():
-            declared = set(entry.get("readiness", {}).get("optionalBlocks", {}))
-            sequences: list[tuple[str, list[str]]] = []
-            for surface in entry["surfaces"]:
-                path = ROOT / SURFACE[surface] / skill / "SKILL.md"
-                self.assertTrue(path.is_file(), f"missing published surface: {path}")
-                sequence = marker_sequence(path.read_text(encoding="utf-8"), declared)
-                self.assertEqual(set(sequence), declared, f"undeclared marker coverage: {surface}:{skill}")
-                sequences.append((surface, sequence))
-            if len(sequences) > 1:
-                validate_surface_sequences([sequence for _, sequence in sequences])
-
-    def test_marker_parser_rejects_each_structural_failure(self) -> None:
-        declared = {"projectEnrichment"}
-        bad = [
-            "<!-- readiness:block projectEnrichment -->\n<!-- readiness:block projectEnrichment -->",
-            "<!-- readiness:block projectEnrichment -->\n<!-- readiness:end -->\n<!-- readiness:block projectEnrichment -->",
-            "<!-- readiness:end -->",
-            "<!-- readiness:block projectEnrichment -->",
-            "<!-- readiness:block unknownBlock -->\n<!-- readiness:end -->",
-            " <!-- readiness:block projectEnrichment -->",
-        ]
-        for body in bad:
-            with self.subTest(body=body), self.assertRaises(AssertionError):
-                marker_sequence(body, declared)
-        with self.assertRaises(AssertionError):
-            validate_surface_sequences([["projectEnrichment"], []])
-
-    def test_legacy_and_current_consumers_keep_previously_ready_skill_cores(self) -> None:
-        fixtures = sorted(FIXTURES.glob("*/agent-workflow-kit.json"))
-        self.assertEqual([path.parent.name for path in fixtures], ["current", "legacy"])
-        for fixture_path in fixtures:
-            fixture = json.loads(fixture_path.read_text(encoding="utf-8"))
-            scenario = fixture["readinessFixture"]
-            with self.subTest(fixture=fixture_path.parent.name):
-                run = subprocess.run(
-                    ["node", "--input-type=module", "-e", COMPAT_UPDATE_SCRIPT,
-                     str(ROOT), str(fixture_path)],
-                    check=True, capture_output=True, text=True,
-                )
-                proof = json.loads(run.stdout)
-                self.assertEqual(proof["result"]["state"], "applied")
-                self.assertEqual(proof["result"]["availability"]["newlyBlocked"], [])
-                for skill, expected in scenario["skills"].items():
-                    self.assertEqual(proof["before"][skill]["verdict"], "ready", skill)
-                    verdict = proof["after"][skill]
-                    self.assertNotEqual(verdict["verdict"], "blocked", skill)
-                    self.assertEqual(verdict["verdict"], expected["verdict"], skill)
-                    self.assertEqual(verdict["inactiveBlocks"], expected["inactiveBlocks"], skill)
-                self.assertEqual(
-                    proof["afterManifest"].get("readinessDecisions", {}),
-                    scenario["expectedDecisions"],
-                    "unavailable behavior must not manufacture a decision",
-                )
-                self.assertEqual(proof["afterManifest"]["readinessFixture"], scenario)
-
-
-if __name__ == "__main__":
-    unittest.main()