@indigoai-us/hq-cli 5.345.118 → 5.345.119

package/dist/commands/core-pipeline-driver-process.d.ts

@@ -0,0 +1,4 @@
+export declare function extractWindowsDriverIdentityFunction(source: string): string;
+/** Preserve the pinned driver's liveness-then-identity lock check. */
+export declare function isPipelineDriverProcess(pid: number, platform?: NodeJS.Platform): boolean;
+//# sourceMappingURL=core-pipeline-driver-process.d.ts.map

package/dist/commands/core-pipeline-driver-process.js

@@ -0,0 +1,68 @@
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { BUNDLED_ASSET_DIR, packageRoot } from "../utils/hq-roots.js";
+import { resolveWindowsBash } from "../utils/run-bundled-script.js";
+const DRIVER_MARKER = "pipeline-driver";
+const WINDOWS_DRIVER_IDENTITY_SIGNATURE = "is_driver() { # pid -> 0 when that pid is alive and is a pipeline-driver";
+function isAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function extractWindowsDriverIdentityFunction(source) {
+    const escapedSignature = WINDOWS_DRIVER_IDENTITY_SIGNATURE.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+    const functionSource = source.match(new RegExp(`^${escapedSignature}\\n[\\s\\S]*?^\\}`, "mu"))?.[0];
+    if (!functionSource)
+        throw new Error(`Bundled pipeline-driver.sh must define '${WINDOWS_DRIVER_IDENTITY_SIGNATURE}'`);
+    return functionSource;
+}
+function isWindowsPipelineDriverProcess(pid) {
+    const bash = resolveWindowsBash(process.env).executable;
+    if (!bash)
+        return false;
+    const scriptPath = path.join(packageRoot(), BUNDLED_ASSET_DIR, "core", "scripts", "pipeline-driver.sh");
+    const source = fs.readFileSync(scriptPath, "utf8");
+    const functionSource = extractWindowsDriverIdentityFunction(source);
+    // Windows intentionally runs the pinned Git Bash implementation because its
+    // lock format uses both MSYS and Win32 PIDs. This keeps native checks aligned
+    // with the shell's liveness-then-identity order and process-table lookup.
+    const result = spawnSync(bash, ["-c", `${functionSource}\nis_driver "$1"`, "pipeline-driver-lock-check", String(pid)], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        windowsHide: true,
+    });
+    if (result.error)
+        throw result.error;
+    return result.status === 0;
+}
+/** Preserve the pinned driver's liveness-then-identity lock check. */
+export function isPipelineDriverProcess(pid, platform = process.platform) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return false;
+    if (platform === "win32")
+        return isWindowsPipelineDriverProcess(pid);
+    if (!isAlive(pid))
+        return false;
+    if (platform === "linux") {
+        try {
+            return fs.readFileSync(`/proc/${pid}/cmdline`).toString("utf8").includes(DRIVER_MARKER);
+        }
+        catch {
+            return false;
+        }
+    }
+    const args = platform === "darwin"
+        ? ["-ww", "-o", "args=", "-p", String(pid)]
+        : ["-p", String(pid), "-o", "args="];
+    const result = spawnSync("ps", args, {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    });
+    return result.status === 0 && String(result.stdout ?? "").includes(DRIVER_MARKER);
+}
+//# sourceMappingURL=core-pipeline-driver-process.js.map

package/dist/commands/core-pipeline-envelope-native.d.ts

@@ -0,0 +1,4 @@
+type EnvelopeKind = "envelope" | "handoff";
+export declare function validatePipelinePhaseFile(filePath: string, kind: EnvelopeKind): [boolean, string];
+export {};
+//# sourceMappingURL=core-pipeline-envelope-native.d.ts.map

package/dist/commands/core-pipeline-envelope-native.js

@@ -0,0 +1,87 @@
+import * as fs from "node:fs";
+export function validatePipelinePhaseFile(filePath, kind) {
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(fs.readFileSync(filePath));
+        if (text.charCodeAt(0) === 0xfeff)
+            text = text.slice(1);
+        text = text.replace(/\r\n?/g, "\n");
+    }
+    catch (error) {
+        const message = error && typeof error === "object" && "message" in error ? String(error.message) : String(error);
+        return [false, "pipeline-envelope: cannot read input: " + message];
+    }
+    if (!text.trim())
+        return [false, "invalid: empty input"];
+    let doc;
+    try {
+        doc = JSON.parse(text);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return [false, "invalid: unparseable JSON (" + message + ")"];
+    }
+    if (!isObject(doc)) {
+        const typeName = doc === null ? "NoneType" : Array.isArray(doc) ? "list" : typeof doc === "string" ? "str"
+            : typeof doc === "boolean" ? "bool" : Number.isInteger(doc) ? "int" : "float";
+        return [false, "invalid: top level must be a JSON object, got " + typeName];
+    }
+    const problems = [];
+    const schemas = { envelope: "hq-phase-envelope/v1", handoff: "hq-phase-handoff/v1" };
+    if (Object.hasOwn(doc, "schema") && doc.schema !== schemas[kind])
+        problems.push("wrong type: schema (want " + schemas[kind] + ")");
+    else if (!Object.hasOwn(doc, "schema"))
+        problems.push("missing field: schema");
+    const isString = (value) => typeof value === "string";
+    const isNonEmpty = (value) => isString(value) && value !== "";
+    const stringList = (value) => Array.isArray(value) && value.every(isString);
+    const check = (name, predicate, want, required = true) => {
+        if (!Object.hasOwn(doc, name)) {
+            if (required)
+                problems.push("missing field: " + name);
+            return;
+        }
+        if (!predicate(doc[name]))
+            problems.push("wrong type: " + name + " (want " + want + ")");
+    };
+    if (kind === "envelope") {
+        for (const field of ["story_id", "phase", "worker_id"])
+            check(field, isNonEmpty, "non-empty string");
+        check("worktree", isNonEmpty, "string path");
+        check("incoming_handoff", (value) => value === null || isNonEmpty(value), "string path or null");
+        check("acceptance_criteria", stringList, "array of strings");
+        check("deadline", (value) => isString(value) && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]00:?00)\n?$/.test(value), "ISO8601 UTC string");
+        check("fresh_call", (value) => typeof value === "boolean", "boolean");
+        for (const field of ["project", "engine", "result_path", "story_title", "story_description", "reopen_note", "repo", "branch", "prior_handoff"])
+            check(field, isString, "string", false);
+        check("resumed_after_interrupt", (value) => typeof value === "boolean", "boolean", false);
+        check("constraints", stringList, "array of strings", false);
+    }
+    else {
+        for (const field of ["story_id", "phase", "worker_id"])
+            check(field, isNonEmpty, "non-empty string");
+        check("status", (value) => value === "passed" || value === "failed" || value === "blocked", "one of passed|failed|blocked");
+        check("summary", isString, "string");
+        check("files_changed", stringList, "array of strings");
+        check("commits", stringList, "array of strings");
+        if (!Object.hasOwn(doc, "back_pressure"))
+            problems.push("missing field: back_pressure");
+        else if (!isObject(doc.back_pressure))
+            problems.push("wrong type: back_pressure (want object)");
+        else
+            for (const group of ["tests", "lint", "typecheck", "build"]) {
+                if (!Object.hasOwn(doc.back_pressure, group))
+                    problems.push("missing field: back_pressure." + group);
+                else if (!["pass", "fail", "skip"].includes(String(doc.back_pressure[group])))
+                    problems.push("wrong type: back_pressure." + group + " (want one of pass|fail|skip)");
+            }
+        check("context_for_next", isString, "string");
+        for (const field of ["engine", "notes"])
+            check(field, isString, "string", false);
+    }
+    return problems.length ? [false, problems.join("\n")] : [true, "valid " + kind];
+}
+function isObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//# sourceMappingURL=core-pipeline-envelope-native.js.map

package/dist/commands/core-policy.js

@@ -772,6 +772,8 @@ function autoRetire(options, root, cwd, env, now) {
         reportText += `# Automatic policy retirement — ${today}\n\nMode: human on the loop. Each policy below was retired by \`policy-retire.sh --auto\` with the reason shown.\nReverse any wrong call with \`bash core/scripts/policy-retire.sh <slug> --restore\` and fix the rule that produced it.\n\n`;
     }
     reportText += `## Run ${now.toISOString().slice(11, 19)}Z — dirs: ${dirs.join(' ')}\n\n`;
+    // Match the shell's preflight: fail to create the report temp before any
+    // policy can be retired, then replace it with the complete run section.
     fs.writeFileSync(tempPath, reportText);
     let retired = 0;
     let failed = 0;
@@ -847,6 +849,7 @@ function autoRetire(options, root, cwd, env, now) {
         stdout += `policy-retire --auto: ${wouldRetire} of ${candidates.length} candidates would be retired (dry run)\n`;
     }
     else if (retired > 0 || failed > 0 || needfix > 0) {
+        fs.writeFileSync(tempPath, reportText);
         fs.appendFileSync(outputPath, fs.readFileSync(tempPath));
         fs.rmSync(tempPath, { force: true });
         stdout += `policy-retire --auto: ${retired} retired, ${failed} failed, ${needfix} need a fix; report ${displayPolicyPath(outputPath, root)}\n`;

package/dist/commands/core-worker-lint-native.d.ts

@@ -1,4 +1,3 @@
 import { type WorkerSkillDependencies, type WorkerSkillResult } from "./core-worker-skills-runtime.js";
-export declare const WORKER_SKILL_LINT_ASSET = "core/scripts/lint-shared-worker-skills.sh";
 export declare function runWorkerSkillLint(args: string[], dependencies: WorkerSkillDependencies): WorkerSkillResult;
 //# sourceMappingURL=core-worker-lint-native.d.ts.map

package/dist/commands/core-worker-lint-native.js

@@ -2,7 +2,6 @@
 import * as crypto from "node:crypto";
 import * as path from "node:path";
 import { errorCode, isDirectory, missingOrUnreadable, resolveWorkerCallerRoot, } from "./core-worker-skills-runtime.js";
-export const WORKER_SKILL_LINT_ASSET = "core/scripts/lint-shared-worker-skills.sh";
 const DEFAULT_ROOTS = ["core/workers", "core/packages"];
 const USAGE = "Usage: lint-shared-worker-skills.sh [root ...]\nDefault roots: core/workers core/packages\n";
 function joinFindPath(parent, child) {

package/dist/commands/core-worker-share-native.js

@@ -1,6 +1,6 @@
 /** Native port of share-worker-skill.sh. */
 import * as path from "node:path";
-import { resolveBundledAsset } from "../utils/hq-roots.js";
+import { BUNDLED_ASSET_DIR, packageRoot } from "../utils/hq-roots.js";
 import { existsFollowingLinks, isDirectory, isSymlink, resolveWorkerCallerRoot, runGit, errorCode, } from "./core-worker-skills-runtime.js";
 export const WORKER_SKILL_SHARE_ASSET = "core/scripts/share-worker-skill.sh";
 const WORKER_SKILL_SHARE_USAGE = "usage: $0 [--apply] [--force] <scope-dir> <skill-name> <worker-skill-path>...\n";
@@ -88,7 +88,7 @@ function forceSymlink(target, filePath, fileSystem) {
     fileSystem.symlinkSync(target, filePath);
 }
 function runtimeScriptPath(dependencies) {
-    return dependencies.scriptPath ?? resolveBundledAsset(WORKER_SKILL_SHARE_ASSET);
+    return dependencies.scriptPath ?? path.join(packageRoot(), BUNDLED_ASSET_DIR, WORKER_SKILL_SHARE_ASSET);
 }
 export function runWorkerSkillShare(argv, dependencies) {
     let apply = false;

package/dist/commands/core-worker-skills-command.d.ts

@@ -3,6 +3,6 @@ export type WorkerSkillCommandContext = {
     cwd: string;
     hqRoot?: string;
 };
-/** Keep the shell rollback route byte-transparent while the family flag is off. */
+/** Run the native implementation for the worker-skills family. */
 export declare function runWorkerSkillCommand(name: WorkerSkillCommandName, args: string[], context: WorkerSkillCommandContext): Promise<number>;
 //# sourceMappingURL=core-worker-skills-command.d.ts.map

package/dist/commands/core-worker-skills-command.js

@@ -1,24 +1,7 @@
-import { runBundledScript } from "../utils/run-bundled-script.js";
-import { coreNativeWorkerSkillsEnabled } from "./core-native-worker-skills-flag.js";
-import { runWorkerSkillLint, WORKER_SKILL_LINT_ASSET } from "./core-worker-lint-native.js";
-import { runWorkerSkillShare, WORKER_SKILL_SHARE_ASSET } from "./core-worker-share-native.js";
-const assets = {
-    lint: WORKER_SKILL_LINT_ASSET,
-    share: WORKER_SKILL_SHARE_ASSET,
-};
-/** Keep the shell rollback route byte-transparent while the family flag is off. */
+import { runWorkerSkillLint } from "./core-worker-lint-native.js";
+import { runWorkerSkillShare } from "./core-worker-share-native.js";
+/** Run the native implementation for the worker-skills family. */
 export async function runWorkerSkillCommand(name, args, context) {
-    if (!(await coreNativeWorkerSkillsEnabled())) {
-        const result = runBundledScript({
-            asset: assets[name],
-            args,
-            cwd: context.cwd,
-            hqRoot: context.hqRoot,
-        });
-        if (result.code !== 0)
-            process.exit(result.code);
-        return result.code;
-    }
     const result = name === "lint"
         ? runWorkerSkillLint(args, { cwd: context.cwd })
         : runWorkerSkillShare(args, { cwd: context.cwd });

package/dist/commands/core.d.ts

@@ -75,9 +75,13 @@ export type RebuildIndexTarget = {
     /** One-line summary, shown in `hq core --help`. */
     summary: string;
 };
-export type WorkerSubcommand = ScaffoldAsset & {
+export type WorkerSubcommand = {
     /** Subcommand name under the `worker` group — `hq core worker <name>`. */
     name: string;
+    /** Caller-relative root used by the native command. */
+    root: "cwd";
+    /** One-line summary, shown in `hq core --help`. */
+    summary: string;
 };
 /**
  * Native commands that still claim a scaffold forwarder asset. The forwarder

package/dist/commands/core.js

@@ -51,6 +51,7 @@ import { DERIVE_TRIGGER_FACTS_ASSET } from "./core-derive-trigger-facts-native.j
 import { registerCoreHookStateHelpers } from "./core-hook-state-helpers-native.js";
 import { registerCoreHookBatchCommand } from "./core-hook-batch-command.js";
 import { registerCorePipelineWorkerTableCommand } from "./core-pipeline-workers-command.js";
+import { registerCorePipelineRuntimeCommands } from "./core-pipeline-conductor-command.js";
 import { resolveLiveRoot } from "../utils/hq-roots.js";
 import { interpreterFor, runBundledScript } from "../utils/run-bundled-script.js";
 import { CompanyIndexUserError, renderIndexTarget } from "../lib/index-render/index.js";
@@ -132,13 +133,11 @@ export const NATIVE_SCAFFOLD_COMMANDS = [
 export const WORKER_SUBCOMMANDS = [
     {
         name: "lint",
-        asset: "core/scripts/lint-shared-worker-skills.sh",
         root: "cwd",
         summary: "Fail on worker-scoped skills duplicated by copy instead of single-sourced",
     },
     {
         name: "share",
-        asset: "core/scripts/share-worker-skill.sh",
         root: "cwd",
         summary: "Migrate duplicated worker skills onto one canonical file + relative symlinks",
     },
@@ -307,6 +306,10 @@ export const SCAFFOLD_ONLY_ASSETS = [
     { asset: "core/scripts/handoff-post.sh", root: "live", summary: "Rollback shell for native handoff post" },
     { asset: "core/scripts/handoff-open-steps.sh", root: "live", summary: "Rollback shell for native handoff open-steps" },
     { asset: "core/scripts/qmd-reindex-bg.sh", root: "live", summary: "Rollback handoff reindex forwarder" },
+    // Pipeline rollback companions remain bundled until the family removal PR.
+    { asset: "core/scripts/pipeline-conductor.sh", root: "live", summary: "Rollback shell for native pipeline conductor" },
+    { asset: "core/scripts/pipeline-driver.sh", root: "live", summary: "Rollback shell for native pipeline driver" },
+    { asset: "core/scripts/pipeline-envelope.sh", root: "live", summary: "Validation helper for the pipeline shell rollback companions" },
     { asset: "core/scripts/lib/portable.sh", root: "live", summary: "Shared portable helpers sourced by bundled scripts" },
     ...NATIVE_UTILITY_COMMANDS.map(({ asset, root, summary }) => ({
         asset,
@@ -324,7 +327,6 @@ export const SCAFFOLD_ASSETS = [
     ...SCAFFOLD_COMMANDS,
     ...NATIVE_SCAFFOLD_COMMANDS,
     ...SCAFFOLD_ONLY_ASSETS,
-    ...WORKER_SUBCOMMANDS,
 ];
 /**
  * Resolve the tree an entry runs against, and the cwd to run it in.
@@ -404,6 +406,7 @@ export function registerCoreCommands(program) {
     registerCoreDeriveTriggerFactsCommand(core);
     registerCoreHookStateHelpers(core);
     registerCoreHookBatchCommand(core);
+    registerCorePipelineRuntimeCommands(core);
     const sessionHelperCommands = [
         {
             name: "session-journal", asset: "core/scripts/session-journal.sh", root: "live",
@@ -555,7 +558,7 @@ export function registerCoreCommands(program) {
         const command = worker
             .command(entry.name)
             .description(entry.summary)
-            // Pure passthrough: the wrapped script owns its own argument grammar.
+            // Pure passthrough: the native handler owns the worker command grammar.
             .allowUnknownOption()
             .allowExcessArguments()
             .helpOption(false)
@@ -565,11 +568,7 @@ export function registerCoreCommands(program) {
             const operands = cmd.args.length > 0 ? cmd.args : args;
             await runWorkerSkillCommand(entry.name, operands, resolveEntryRoot(entry, scope));
         });
-        describeCoreCommand(command, {
-            execution: interpreterFor(entry.asset) === "node" ? "bundled-node" : "bundled-shell",
-            asset: entry.asset,
-            root: entry.root,
-        });
+        describeCoreCommand(command, { execution: "native", root: entry.root });
     }
     const runCommand = (entry, args = [], cmd, target) => {
         const scope = core.opts();

package/dist/commands/storage-gate.d.ts

@@ -1,9 +1,10 @@
 /**
  * Live HQ Storage gate and refusal surface for `hq storage`.
  *
- * Allowlist gate, fails closed (owner decision 2026-10-11, Indigo-only until
- * the owner widens it; see the storage-feature-flag module in src/lib). This
- * is the deliberate exception to the default-on kill-switch rule: any error,
+ * Registry gate, fails closed. The `hq-storage` registry row decides who has
+ * Storage; it defaults on for every signed-in account (widened 2026-10-13
+ * from the 2026-10-11 Indigo-only start; see the storage-feature-flag module
+ * in src/lib). The fail-closed client fallback is the deliberate exception to the default-on kill-switch rule: any error,
  * a signed-out caller, an API-key caller, a membership read failure, or an
  * unreadable registry all mean Storage is OFF.
  *

package/dist/commands/storage-gate.js

@@ -1,9 +1,10 @@
 /**
  * Live HQ Storage gate and refusal surface for `hq storage`.
  *
- * Allowlist gate, fails closed (owner decision 2026-10-11, Indigo-only until
- * the owner widens it; see the storage-feature-flag module in src/lib). This
- * is the deliberate exception to the default-on kill-switch rule: any error,
+ * Registry gate, fails closed. The `hq-storage` registry row decides who has
+ * Storage; it defaults on for every signed-in account (widened 2026-10-13
+ * from the 2026-10-11 Indigo-only start; see the storage-feature-flag module
+ * in src/lib). The fail-closed client fallback is the deliberate exception to the default-on kill-switch rule: any error,
  * a signed-out caller, an API-key caller, a membership read failure, or an
  * unreadable registry all mean Storage is OFF.
  *

package/dist/fast-scaffold.js

@@ -278,8 +278,6 @@ export const FAST_SCAFFOLD_SCRIPTS = [
         modulePath: "./commands/core-worker-lint-fast.js",
         exportName: "runWorkerSkillLintFast",
         flagKey: "hq-core-native-fast-route",
-        familyFlagKey: "core-native-worker-skills",
-        asset: "core/scripts/lint-shared-worker-skills.sh",
         root: "cwd",
         shellCwd: "caller",
         shellHqRoot: "none",

package/dist/lib/storage-feature-flag.d.ts

@@ -1,13 +1,13 @@
 /**
- * HQ Storage allowlist gate (hq-flags key `hq-storage`).
+ * HQ Storage gate (hq-flags key `hq-storage`).
  *
  * Owner decision (Corey, 2026-10-11): "let's fully ship the storage feature
- * but all behind a feature flag for indigo users only." That is an explicit
- * hold on the default-on kill-switch rule
- * (`indigo-feature-flags-default-on-as-fail-safes`): the registry row is
- * `defaultValue: false` with a company override for Indigo, so this gate is
- * an ALLOWLIST, not a kill switch. It therefore FAILS CLOSED: a missing,
- * stale, discovered, archived or unreadable value means Storage is off.
+ * but all behind a feature flag for indigo users only." The registry row
+ * started as `defaultValue: false` with a company override for Indigo. It
+ * was widened on 2026-10-13: the row now defaults to true, so Storage is on
+ * for every signed-in account and the Indigo override is redundant. The
+ * client still FAILS CLOSED: a missing, stale, discovered, archived or
+ * unreadable value means Storage is off.
  *
  * Who it is on for is decided by hq-pro's shared evaluator (person override,
  * then company override by uid, then slug, then default), resolved

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.118",
+  "version": "5.345.119",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/assets/scaffold/core/scripts/lint-shared-worker-skills.sh

@@ -1,197 +0,0 @@
-#!/usr/bin/env bash
-# lint-shared-worker-skills.sh — fail if a worker-scoped skill is duplicated by
-# copy instead of being single-sourced through the shared-skills convention.
-#
-# THE DRIFT PROBLEM this guards against: a skill used by several workers used to
-# be physically COPIED into each worker's skills/ directory. Editing one copy
-# left the others stale, so the copies drifted apart over time (e.g. a shared
-# e2e-testing skill splitting into two divergent versions). The fix is to keep
-# ONE canonical file under a scope-appropriate `_shared-skills/` store and point
-# each sharing worker's skill entry at it with a relative symlink — see
-# core/knowledge/public/hq-core/shared-worker-skills.md.
-#
-# This linter makes that convention enforceable. It flags two failure shapes:
-#
-#   DUPLICATE  — two or more NON-symlink skill files, WITHIN A SINGLE OWNERSHIP
-#                DOMAIN, whose byte content is identical. Identical bytes across
-#                two real files in the same domain is exactly an un-single-sourced
-#                copy: the moment someone edits one, they drift. (Symlinks that
-#                resolve to a shared canonical are single-sourced and are NOT
-#                flagged, even though their resolved content matches.)
-#   BROKEN     — a skill entry that is a symlink whose target does not resolve.
-#
-# It deliberately does NOT flag two same-NAMED skills whose content differs
-# (e.g. an API-level vs a browser-level e2e skill): distinct content means they
-# are distinct skills that merely share a filename, not a drifted share.
-#
-# OWNERSHIP DOMAINS — filesystem adjacency does NOT establish duplicate
-# ownership, so comparison is partitioned by the tree that OWNS a skill (policy
-# hq-lint-comparison-domains-must-match-ownership):
-#
-#   - `core/workers`            — the curated first-party worker library
-#   - `core/packages/<pack>`    — one installed pack (self-contained; may legally
-#                                 vendor a byte-identical copy of a core worker)
-#   - `companies/<co>`          — one tenant's workers
-#
-# A byte-identical file in TWO DIFFERENT domains (a pack vendoring a core skill,
-# or two packs shipping the same skill) is intentional distribution, NOT drift,
-# and is never flagged. Excluded from the scan entirely: dot-directories
-# (`.archive/`, `.git/`, …) and `._*` AppleDouble OS-metadata files — byte-
-# identical by design, and not skills.
-#
-# Usage: lint-shared-worker-skills.sh [root ...]
-#   Default roots: core/workers core/packages  (the SHIPPED hq-core scope —
-#   company workers live under companies/<co>/ and are linted per-tenant; pass
-#   them explicitly to include them).
-#
-# Exit 0 + "OK:" line when clean; exit 1 + a report naming every offending group
-# when not. Matches the loud-and-specific style of lint-skill-script-refs.sh.
-
-set -euo pipefail
-
-if [[ ${1-} == "--help" || ${1-} == "-h" ]]; then
-  printf '%s\n' \
-    'Usage: lint-shared-worker-skills.sh [root ...]' \
-    'Default roots: core/workers core/packages'
-  exit 0
-fi
-
-repo_root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
-cd "$repo_root"
-
-roots=("$@")
-if [[ ${#roots[@]} -gt 0 ]]; then
-  for root in "${roots[@]}"; do
-    if [[ ! -d "$root" ]]; then
-      printf 'lint-shared-worker-skills: root is not a directory: %s\n' "$root" >&2
-      exit 2
-    fi
-  done
-fi
-
-if [[ ${#roots[@]} -eq 0 ]]; then
-  roots=(core/workers core/packages)
-fi
-
-# Content hash of a file, portable across Linux and macOS (neither guaranteed to
-# ship the other's tool): md5sum (GNU) → md5 (BSD/macOS) → shasum (Perl, both).
-content_hash() {
-  if command -v md5sum >/dev/null 2>&1; then
-    md5sum "$1" | cut -d' ' -f1
-  elif command -v md5 >/dev/null 2>&1; then
-    md5 -q "$1"
-  else
-    shasum "$1" | cut -d' ' -f1
-  fi
-}
-
-# The ownership domain that OWNS a skill path — the boundary within which two
-# byte-identical files are a real duplicate. Across domains, identical content
-# is intentional (a pack vendoring a core skill, two packs shipping the same
-# skill), so it must never be compared. See policy header above.
-domain_of() {
-  local p="${1#./}" rest
-  case "$p" in
-    core/packages/*) rest="${p#core/packages/}"; printf 'core/packages/%s' "${rest%%/*}" ;;
-    companies/*)     rest="${p#companies/}";      printf 'companies/%s' "${rest%%/*}" ;;
-    core/workers/*|core/workers) printf 'core/workers' ;;
-    # Arbitrary root (custom scans, tests): the top path segment is the domain.
-    *) printf '%s' "${p%%/*}" ;;
-  esac
-}
-
-# Collect skill entries: regular files AND symlinks named *.md under any
-# .../skills/... path. -type l must be matched explicitly — a symlink is not a
-# -type f, so a skills symlink would otherwise be invisible to the scan.
-# EXCLUDED: any dot-directory component (`*/.*/*` — covers `.archive/`, `.git/`)
-# and `._*` AppleDouble files; both are byte-identical by design and not skills.
-mapfile -t entries < <(
-  find "${roots[@]}" \( -type f -o -type l \) -path '*/skills/*.md' \
-    -not -path '*/.*/*' -not -name '._*' 2>/dev/null | sort
-)
-
-# Empty is clean — and guards `"${entries[@]}"` under `set -u` on bash 3.2
-# (macOS), which errors on an empty array expansion.
-if [[ ${#entries[@]} -eq 0 ]]; then
-  echo "OK: worker-scoped skills are single-sourced (0 skill entries under: ${roots[*]})"
-  exit 0
-fi
-
-broken=()
-# Parallel arrays keyed by "<domain>|<content-hash>": hash_keys[i] is that
-# composite key, hash_regfiles[i] a newline-joined list of the NON-symlink files
-# carrying it. Keying on domain AS WELL AS hash is what confines a duplicate
-# finding to a single ownership tree — two identical files in different domains
-# land in different buckets and are never flagged. Bash 3.2 (macOS) has no
-# portable associative arrays, so a linear scan over parallel arrays keeps this
-# runnable everywhere HQ runs.
-hash_keys=()
-hash_regfiles=()
-
-hash_index() { # echo the index of $1 in hash_keys, or -1
-  local want="$1" i
-  for i in "${!hash_keys[@]}"; do
-    if [[ "${hash_keys[$i]}" == "$want" ]]; then
-      echo "$i"; return 0
-    fi
-  done
-  echo "-1"
-}
-
-for entry in "${entries[@]}"; do
-  if [[ -L "$entry" ]]; then
-    # Symlink: single-sourced by design. Only a DANGLING one is a problem.
-    if [[ ! -e "$entry" ]]; then
-      broken+=("$entry")
-    fi
-    continue
-  fi
-  # Regular file: bucket it by (ownership domain, byte content). Two regular
-  # files sharing a bucket are two copies of the same skill in the same tree —
-  # the drift hazard.
-  key="$(domain_of "$entry")|$(content_hash "$entry")"
-  idx="$(hash_index "$key")"
-  if [[ "$idx" == "-1" ]]; then
-    hash_keys+=("$key")
-    hash_regfiles+=("$entry")
-  else
-    hash_regfiles[$idx]="${hash_regfiles[$idx]}"$'\n'"$entry"
-  fi
-done
-
-findings=0
-
-for i in "${!hash_keys[@]}"; do
-  group="${hash_regfiles[$i]}"
-  count="$(printf '%s\n' "$group" | grep -c .)"
-  if [[ "$count" -ge 2 ]]; then
-    if [[ $findings -eq 0 ]]; then
-      echo "lint-shared-worker-skills: FAIL — duplicated worker skills (single-source these via _shared-skills/ + relative symlinks):" >&2
-    fi
-    findings=$((findings + 1))
-    domain="${hash_keys[$i]%%|*}"
-    echo "  DUPLICATE in domain '${domain}' (identical content, ${count} copies — pick one canonical and symlink the rest):" >&2
-    printf '    %s\n' "$group" >&2
-  fi
-done
-
-if [[ ${#broken[@]} -gt 0 ]]; then
-  if [[ $findings -eq 0 ]]; then
-    echo "lint-shared-worker-skills: FAIL — broken shared-skill symlink(s):" >&2
-  fi
-  findings=$((findings + ${#broken[@]}))
-  echo "  BROKEN (symlink target does not resolve):" >&2
-  printf '    %s\n' "${broken[@]}" >&2
-fi
-
-if [[ $findings -gt 0 ]]; then
-  echo "" >&2
-  echo "  Fix: keep ONE canonical file in the narrowest-scope _shared-skills/ store" >&2
-  echo "  (core/workers/_shared-skills, core/packages/<pack>/workers/_shared-skills," >&2
-  echo "  or companies/<co>/workers/_shared-skills) and replace each duplicate with a" >&2
-  echo "  relative symlink. Helper: hq core worker share" >&2
-  echo "  Doc: core/knowledge/public/hq-core/shared-worker-skills.md" >&2
-  exit 1
-fi
-
-echo "OK: worker-scoped skills are single-sourced (${#entries[@]} skill entries scanned under: ${roots[*]})"