@kontourai/flow-agents 3.3.0 → 3.4.1

package/src/cli/skill-drift-check.ts

@@ -0,0 +1,196 @@
+import { createRequire } from "node:module";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs, flagBool, flagString } from "../lib/args.js";
+import { skillsManifestPath } from "../lib/local-artifact-root.js";
+import { root } from "../tools/common.js";
+import { globalDest, ensureBundle } from "./init.js";
+
+type DriftState = "in_sync" | "kit_updated" | "user_modified" | "unbaselined" | "missing_install" | "kit_removed";
+
+type DriftFileEntry = {
+  path: string;
+  state: DriftState;
+  installedHash: string | null;
+  kitHash: string | null;
+  manifestHash: string | null;
+};
+
+type DriftReport = {
+  checkedAt: string;
+  installedDir: string;
+  kitSourceDir: string;
+  manifestFound: boolean;
+  files: DriftFileEntry[];
+  summary: {
+    total: number;
+    inSync: number;
+    kitUpdated: number;
+    userModified: number;
+    unbaselined: number;
+    missingInstall: number;
+    kitRemoved: number;
+  };
+  hasDrift: boolean;
+};
+
+type SkillDriftLib = {
+  loadManifest: (manifestPath: string) => unknown;
+  compareSkillDrift: (params: { installedDir: string; kitSourceDir: string; manifest: unknown }) => DriftReport;
+};
+
+const REFRESH_COMMAND_LINE =
+  "Run `flow-agents init --runtime claude-code --global` to refresh drifted or missing skill copies " +
+  "(user-modified files are reported here, not overwritten — review them before refreshing).";
+
+function usage(): void {
+  console.log(`usage: flow-agents skill-drift-check [options]
+
+Read-only comparison of installed Claude Code skill files against the current
+kit/bundle source and the last-recorded install manifest. Never writes under
+the installed skills directory or the kit source directory.
+
+Options:
+  --dest PATH             Installed Claude Code global destination (contains
+                           skills/ and .flow-agents/skills-manifest.json).
+                           Defaults to the global claude-code destination
+                           (honors FLOW_AGENTS_USER_CLAUDE_SETTINGS).
+  --kit-source-dir PATH   Kit/bundle skills source directory to compare
+                           against. Defaults to the current built bundle's
+                           .claude/skills directory.
+  --json                  Emit the machine-readable drift report as JSON.
+  --help, -h              Show this help.
+
+Exit codes:
+  0   Clean — every checked file is in_sync, no unbaselined/missing entries.
+  1   Drift found — at least one file is not in_sync (kit_updated,
+      user_modified, unbaselined, missing_install, or kit_removed).
+  2   Cannot fully check — no manifest exists yet, or <dest>/skills is
+      missing. Reported with guidance, not a stack trace.
+`);
+}
+
+function loadSkillDriftLib(): SkillDriftLib {
+  const skillDriftLibPath = path.join(root, "scripts", "hooks", "lib", "skill-drift.js");
+  const _require = createRequire(import.meta.url);
+  return _require(skillDriftLibPath) as SkillDriftLib;
+}
+
+function printStatePaths(report: DriftReport, state: DriftState, label: string): void {
+  const paths = report.files.filter((entry) => entry.state === state).map((entry) => entry.path);
+  if (!paths.length) return;
+  console.log(`  ${label}:`);
+  for (const p of paths) console.log(`    - ${p}`);
+}
+
+function printReport(report: DriftReport): void {
+  const s = report.summary;
+  console.log(`Skill drift check: ${report.installedDir}`);
+  console.log(`  kit source: ${report.kitSourceDir}`);
+  console.log(`  manifest found: ${report.manifestFound ? "yes" : "no"}`);
+  console.log(
+    `  total ${s.total} — in_sync ${s.inSync}, kit_updated ${s.kitUpdated}, user_modified ${s.userModified}, ` +
+      `unbaselined ${s.unbaselined}, missing_install ${s.missingInstall}, kit_removed ${s.kitRemoved}`
+  );
+  printStatePaths(report, "kit_updated", "kit_updated (installed matches last recorded baseline; kit source has changed)");
+  printStatePaths(report, "user_modified", "user_modified (installed bytes changed locally since last recorded install)");
+  printStatePaths(report, "unbaselined", "unbaselined (no recorded baseline for this file yet)");
+  printStatePaths(report, "missing_install", "missing_install (present in kit source, not installed yet)");
+  printStatePaths(report, "kit_removed", "kit_removed (installed file no longer present in current kit source)");
+  if (report.hasDrift) {
+    console.log("");
+    console.log(REFRESH_COMMAND_LINE);
+  } else {
+    console.log("");
+    console.log("All installed skill files are in sync with the current kit source.");
+  }
+  if (s.kitRemoved > 0) {
+    console.log("");
+    console.log(
+      "kit_removed files were removed from the current kit source; refresh will NOT delete them " +
+        "— review and remove them manually if appropriate."
+    );
+  }
+}
+
+export async function main(argv: string[] = process.argv.slice(2)): Promise<number> {
+  // Whole-body error containment (#439 review fix): any unexpected error (a bug in this CLI, a
+  // filesystem error not already handled below, etc.) must never surface as a raw stack trace to
+  // the user — print one stderr line and exit 2 ("cannot fully check"), same exit code already
+  // used for the other known cannot-check conditions below.
+  try {
+    const args = parseArgs(argv);
+    if (flagBool(args.flags, "help") || flagBool(args.flags, "h")) {
+      usage();
+      return 0;
+    }
+
+    const dest = path.resolve(flagString(args.flags, "dest") ?? globalDest("claude-code"));
+    const installedDir = path.join(dest, "skills");
+
+    let kitSourceDir: string;
+    const kitSourceOverride = flagString(args.flags, "kit-source-dir");
+    if (kitSourceOverride) {
+      kitSourceDir = path.resolve(kitSourceOverride);
+    } else {
+      try {
+        kitSourceDir = path.join(ensureBundle("claude-code"), ".claude", "skills");
+      } catch (error) {
+        console.error(`flow-agents skill-drift-check: could not resolve current kit source: ${(error as Error).message}`);
+        console.error("Pass --kit-source-dir explicitly, or build the bundle first.");
+        return 2;
+      }
+    }
+
+    const { loadManifest, compareSkillDrift } = loadSkillDriftLib();
+    const manifestPath = skillsManifestPath(dest);
+    const manifest = loadManifest(manifestPath);
+    const installedDirExists = fs.existsSync(installedDir);
+
+    // Cannot fully check when there is no recorded baseline manifest at all yet, OR the installed
+    // skills directory itself does not exist — reported explicitly with guidance, never silently
+    // mis-reported as in_sync and never a stack trace (plan's exit-code-2 contract; see also the
+    // "drifted-but-never-manifested install" stop-short risk).
+    if (!manifest || !installedDirExists) {
+      const reasons: string[] = [];
+      if (!manifest) reasons.push(`no manifest found at ${manifestPath}`);
+      if (!installedDirExists) reasons.push(`installed skills directory does not exist at ${installedDir}`);
+      if (flagBool(args.flags, "json")) {
+        console.log(JSON.stringify({ ok: false, reason: reasons.join("; "), manifestFound: Boolean(manifest), installedDirExists, manifestPath, installedDir, kitSourceDir }, null, 2));
+      } else {
+        console.error(`flow-agents skill-drift-check: cannot fully check — ${reasons.join("; ")}.`);
+        console.error("Run this once to establish or refresh a baseline, then re-run skill-drift-check:");
+        console.error(REFRESH_COMMAND_LINE);
+      }
+      return 2;
+    }
+
+    const report = compareSkillDrift({ installedDir, kitSourceDir, manifest });
+
+    if (flagBool(args.flags, "json")) {
+      console.log(JSON.stringify(report, null, 2));
+    } else {
+      printReport(report);
+    }
+
+    // Exit 1 iff any file is not in_sync — kit_updated, user_modified, unbaselined,
+    // missing_install, and kit_removed are ALL drift (plan's five/six-state exit-code contract;
+    // previously only kit_updated/user_modified tripped this, silently exiting 0 for
+    // unbaselined/missing_install/kit_removed despite printing drift guidance).
+    if (report.hasDrift) return 1;
+    return 0;
+  } catch (error) {
+    console.error(`flow-agents skill-drift-check: unexpected error: ${(error as Error).message}`);
+    return 2;
+  }
+}
+
+// Use process.exitCode (not process.exit) to allow stdout to be flushed before exit.
+// Resolve real paths to handle symlinks (e.g. /tmp -> /private/tmp on macOS) so the
+// entry-point guard fires correctly when the module is loaded directly as a script.
+const _selfRealPath = (() => { try { return fs.realpathSync(fileURLToPath(import.meta.url)); } catch { return fileURLToPath(import.meta.url); } })();
+const _argv1RealPath = (() => { try { return fs.realpathSync(process.argv[1]); } catch { return process.argv[1]; } })();
+if (_selfRealPath === _argv1RealPath) {
+  main().then((code) => { process.exitCode = code; }).catch((err) => { console.error(err); process.exitCode = 1; });
+}

package/src/cli/telemetry-doctor.test.mjs

@@ -0,0 +1,53 @@
+// Unit tests for the hosted-Console reachability carve-out in
+// src/cli/telemetry-doctor.ts (AC3, install-flow-foundations Thread C):
+// endpointAllowed's known-hosted-console hostname carve-out.
+//
+// Loaded from the built JS (mirrors src/cli/init.test.mjs's import-from-build
+// convention). Run: `npm run test:unit`, or directly after `npm run build`:
+//   node --test src/cli/telemetry-doctor.test.mjs
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { endpointAllowed } from "../../build/src/cli/telemetry-doctor.js";
+
+test("endpointAllowed: known hosted Console (console.kontourai.io) is allowed without --allow-network", () => {
+  assert.equal(endpointAllowed("https://console.kontourai.io/api/telemetry/records", false), true);
+});
+
+test("endpointAllowed: known hosted Console still allowed with --allow-network (unchanged)", () => {
+  assert.equal(endpointAllowed("https://console.kontourai.io/api/telemetry/records", true), true);
+});
+
+test("endpointAllowed: generic non-local https endpoint still requires --allow-network", () => {
+  assert.equal(endpointAllowed("https://console.example.test/api/telemetry/records", false), false);
+  assert.equal(endpointAllowed("https://console.example.test/api/telemetry/records", true), true);
+});
+
+test("endpointAllowed: FLOW_AGENTS_KONTOUR_CLOUD_CONSOLE_URL override is honored for the carve-out, scoped to that one hostname only", async () => {
+  const previous = process.env.FLOW_AGENTS_KONTOUR_CLOUD_CONSOLE_URL;
+  process.env.FLOW_AGENTS_KONTOUR_CLOUD_CONSOLE_URL = "https://synthetic-hosted.example.test";
+  try {
+    // Re-import isn't needed: isKnownHostedConsoleHostname reads process.env
+    // at call time, not at module-load time.
+    assert.equal(endpointAllowed("https://synthetic-hosted.example.test/x", false), true);
+    // A DIFFERENT non-local hostname under the same override must remain
+    // blocked without --allow-network -- proves the carve-out is
+    // hostname-scoped, not "any https".
+    assert.equal(endpointAllowed("https://a-different-host.example.test/x", false), false);
+  } finally {
+    if (previous === undefined) delete process.env.FLOW_AGENTS_KONTOUR_CLOUD_CONSOLE_URL;
+    else process.env.FLOW_AGENTS_KONTOUR_CLOUD_CONSOLE_URL = previous;
+  }
+});
+
+test("endpointAllowed: local endpoints remain allowed by default (unchanged)", () => {
+  assert.equal(endpointAllowed("http://127.0.0.1:3737/api/telemetry/records", false), true);
+  assert.equal(endpointAllowed("http://localhost:3737/api/telemetry/records", false), true);
+});
+
+test("endpointAllowed: malformed/credentialed/control-char endpoints remain rejected (unchanged)", () => {
+  assert.equal(endpointAllowed("https://bad host", false), false);
+  assert.equal(endpointAllowed("https://user:pass@console.kontourai.io/x", false), false);
+  assert.equal(endpointAllowed("https://console.kontourai.io/x\n", false), false);
+  assert.equal(endpointAllowed("", false), false);
+});

package/src/cli/telemetry-doctor.ts

@@ -1,6 +1,7 @@
 import * as fs from "node:fs";
 import * as http from "node:http";
 import * as https from "node:https";
+import * as os from "node:os";
 import * as path from "node:path";
 import { parseArgs, flagBool, flagString } from "../lib/args.js";
 import { telemetryDataDir as defaultTelemetryDataDir } from "../lib/local-artifact-root.js";
@@ -14,7 +15,7 @@ type Reachability = {
   error?: string;
 };
 
-type DoctorReport = {
+export type DoctorReport = {
   ok: boolean;
   destination: string;
   telemetry: {
@@ -95,12 +96,24 @@ function deriveConsoleEndpoint(consoleUrl: string, explicitEndpoint: string): st
   return `${base}/api/telemetry/records`;
 }
 
-function endpointAllowed(endpointUrl: string, allowNetwork = false): boolean {
+// The one known hosted Kontour Console host is reachability-checkable by
+// default (no --allow-network): reuses the exact override knob
+// scripts/telemetry/console-presets.sh already defines
+// (FLOW_AGENTS_KONTOUR_CLOUD_CONSOLE_URL / https://console.kontourai.io), so
+// it self-corrects if that default ever changes rather than drifting via a
+// second hardcoded literal. Scoped to this one hostname only -- a generic
+// non-local HTTPS endpoint still requires --allow-network exactly as today.
+function isKnownHostedConsoleHostname(hostname: string): boolean {
+  const hostedUrl = parseUrl(process.env["FLOW_AGENTS_KONTOUR_CLOUD_CONSOLE_URL"] ?? "https://console.kontourai.io");
+  return hostedUrl !== null && hostname === hostedUrl.hostname;
+}
+
+export function endpointAllowed(endpointUrl: string, allowNetwork = false): boolean {
   if (!endpointUrl || endpointUrl.includes("\n") || endpointUrl.includes("\r") || endpointUrl.includes('"')) return false;
   const url = parseUrl(endpointUrl);
   if (!url) return false;
   if (url.username || url.password) return false;
-  if (url.protocol === "https:") return allowNetwork || isLocalHostname(url.hostname);
+  if (url.protocol === "https:") return allowNetwork || isLocalHostname(url.hostname) || isKnownHostedConsoleHostname(url.hostname);
   return url.protocol === "http:" && isLocalHostname(url.hostname);
 }
 
@@ -152,6 +165,27 @@ function isLocalHostname(hostname: string): boolean {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname.endsWith(".localhost");
 }
 
+// TS mirror of scripts/telemetry/lib/config.sh's telemetry_conf_trusted
+// (mode-600 + owner-uid + no-symlink gate). Used only to WARN that a
+// candidate telemetry-console.conf exists but would be silently ignored by
+// the real bash runtime pipeline -- this doctor still reads the shipped
+// scripts/telemetry/telemetry.conf default for its own report (accepted,
+// explicitly out-of-scope gap; see install-flow-foundations plan Thread C).
+// Symlink-then-existence guard order mirrors console-learning-projection.ts
+// and workflow-sidecar.ts's existing lstatSync-before-statSync precedent.
+function isConfTrusted(file: string): boolean {
+  try {
+    if (fs.lstatSync(file).isSymbolicLink()) return false;
+    const stat = fs.statSync(file);
+    if (!stat.isFile()) return false;
+    if ((stat.mode & 0o777) !== 0o600) return false;
+    if (typeof process.getuid === "function" && stat.uid !== process.getuid()) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function safeReportUrl(value: string): string | undefined {
   if (!value) return undefined;
   const parsed = parseUrl(value);
@@ -164,7 +198,7 @@ function safeReportUrl(value: string): string | undefined {
   return parsed.toString();
 }
 
-async function buildReport(argv: string[]): Promise<DoctorReport> {
+export async function buildReport(argv: string[]): Promise<DoctorReport> {
   const args = parseArgs(argv);
   const allowNetwork = flagBool(args.flags, "allow-network");
   const dest = path.resolve(flagString(args.flags, "dest", process.cwd()) ?? process.cwd());
@@ -187,7 +221,7 @@ async function buildReport(argv: string[]): Promise<DoctorReport> {
   const allowed = endpointAllowed(endpointUrl, allowNetwork);
   const timeoutMs = Number.parseInt(flagString(args.flags, "timeout-ms", "2000") ?? "2000", 10);
   const reachability = await checkConsoleReachability(endpointUrl, Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : 2000, allowNetwork);
-  const warnings = reportWarnings(configFile, endpointUrl, allowed, allowNetwork);
+  const warnings = reportWarnings(configFile, endpointUrl, allowed, allowNetwork, dest);
   return {
     ok: enabled && (!endpointUrl || (allowed && reachability.ok !== false)),
     destination: dest,
@@ -213,10 +247,19 @@ async function buildReport(argv: string[]): Promise<DoctorReport> {
   };
 }
 
-function reportWarnings(configFile: string, endpointUrl: string, allowed: boolean, allowNetwork: boolean): string[] {
+function reportWarnings(configFile: string, endpointUrl: string, allowed: boolean, allowNetwork: boolean, dest: string): string[] {
   const warnings: string[] = [];
   if (!fs.existsSync(configFile)) warnings.push("telemetry.conf was not found under destination scripts/telemetry");
-  if (endpointUrl && !allowed) warnings.push(allowNetwork ? "Console endpoint is malformed or contains credentials" : "Console endpoint is not allowed without --allow-network; local http(s) endpoints are allowed by default");
+  if (endpointUrl && !allowed) warnings.push(allowNetwork ? "Console endpoint is malformed or contains credentials" : "Console endpoint is not allowed without --allow-network; local http(s) endpoints and the known hosted Console host are allowed by default");
+  // Mirrors config.sh's local-before-global precedence for the warning only
+  // (see isConfTrusted's doc comment for the accepted config-resolution-parity gap).
+  const localConf = path.join(dest, ".kontourai", "telemetry-console.conf");
+  const globalConf = path.join(os.homedir(), ".flow-agents", "telemetry-console.conf");
+  if (fs.existsSync(localConf) && !isConfTrusted(localConf)) {
+    warnings.push(`Untrusted telemetry console conf at ${localConf} (must be mode 600, owned by the current user, and not a symlink); it is being ignored and telemetry stays fail-open`);
+  } else if (fs.existsSync(globalConf) && !isConfTrusted(globalConf)) {
+    warnings.push(`Untrusted telemetry console conf at ${globalConf} (must be mode 600, owned by the current user, and not a symlink); it is being ignored and telemetry stays fail-open`);
+  }
   return warnings;
 }
 

package/src/cli/validate-hook-influence.ts

@@ -1,20 +1,50 @@
 import * as fs from "node:fs";
 import { fileURLToPath } from "node:url";
+import { readKitInventory } from "../runtime-adapters.js";
+import { root } from "../tools/common.js";
 
 const validTiers = new Set(["adapter", "design-target", "installed-command", "live-acceptance", "documented-runtime-gap"]);
 const validRuntimes = new Set(["codex", "claude-code", "kiro-cli"]);
 const validHooks = new Set(["workflow-steering", "stop-goal-fit"]);
 const validEvents = new Set(["UserPromptSubmit", "PostToolUse", "Stop"]);
-const requiredCases: Record<string, { description: string; tier: string; hook?: string; event?: string; must_include?: string[]; agent_must_do?: string[] }> = {
-  "dev-builder-build-requires-pickup-probe-before-plan": { description: "missing pickup Probe before plan", tier: "design-target", must_include: ["design-probe", "accepted gaps", "provider_state", "conflict_risks"], agent_must_do: ["route decision_gap back to design-probe/pickup Probe"] },
-  "dev-builder-review-before-verify-after-execute": { description: "review-before-verify after execute", tier: "adapter", event: "PostToolUse", must_include: ["Next: review", "then verify", "report only"], agent_must_do: ["review-work for report-only critique before verify-work", "not count critique.json as verification evidence"] },
-  "dev-builder-route-fresh-coding-prompt": { description: "fresh coding prompt routes into Builder workflow", tier: "adapter", event: "UserPromptSubmit", must_include: ["BUILDER WORKFLOW ROUTE", "activate `deliver`", "--flow-id builder.build", "plan-work -> execute-plan -> review-work -> verify-work", "publish/release-readiness and learning-review"], agent_must_do: ["activate Builder Kit delivery workflow before source edits", "use deliver by default for coding/build work", "do not bypass plan-work -> execute-plan -> review-work -> verify-work", "publish, release readiness, and learning feedback"] },
+const engineRequiredCases: Record<string, { description: string; tier: string; hook?: string; event?: string; must_include?: string[]; agent_must_do?: string[] }> = {
   "dev-verify-fail-preserves-trace-before-rework": { description: "verify failure route-back with preserved FAIL evidence", tier: "design-target", must_include: ["If verdict=FAIL: record the FAIL artifact"], agent_must_do: ["write the FAIL artifact before routing back", "route to plan"] },
   "codex-claude-strict-stop-adapter-contract": { description: "Goal Fit stop adapter behavior", tier: "adapter", hook: "stop-goal-fit", event: "Stop", must_include: ["Goal Fit warning"], agent_must_do: ["treat strict Stop guidance as a blocker"] },
   "codex-live-context-gap": { description: "Codex documented runtime gap", tier: "documented-runtime-gap", must_include: ["STATE:", "not_verified"], agent_must_do: ["record NOT_VERIFIED for live influence"] },
   "installed-command-protocol-guidance": { description: "installed-command evidence lane", tier: "installed-command", must_include: ["STATE:", "CRITIQUE:", "CONTEXT MAP:"], agent_must_do: ["treat hook guidance as additional context"] },
 };
 
+function requiredCases(): Record<string, { description: string; tier: string; hook?: string; event?: string; must_include?: string[]; agent_must_do?: string[] }> {
+  const dest = process.env.FLOW_AGENTS_HOOK_INFLUENCE_DEST ?? root;
+  const sourceRoot = process.env.FLOW_AGENTS_HOOK_INFLUENCE_SOURCE_ROOT ?? root;
+  const inventory = readKitInventory(sourceRoot, dest);
+  if (inventory.errors.length) {
+    fail(`kit hook influence metadata is invalid:\n${inventory.errors.join("\n")}`);
+  }
+  const kitCases: Record<string, { description: string; tier: string; hook?: string; event?: string; must_include?: string[]; agent_must_do?: string[] }> = {};
+  for (const expectation of inventory.hook_influence_expectations) {
+    const namespacedId = `kit:${expectation.kit_id}:${expectation.id}`;
+    if (engineRequiredCases[expectation.id]) {
+      fail(`${expectation.kit_id}: hook influence expectation id collides with engine-required case id: ${expectation.id}`);
+    }
+    if (engineRequiredCases[namespacedId]) {
+      fail(`${expectation.kit_id}: namespaced hook influence expectation id collides with engine-required case id: ${namespacedId}`);
+    }
+    if (kitCases[namespacedId]) {
+      fail(`${expectation.kit_id}: duplicate namespaced hook influence expectation id: ${namespacedId}`);
+    }
+    kitCases[namespacedId] = {
+      description: expectation.description,
+      tier: expectation.tier,
+      ...(expectation.hook ? { hook: expectation.hook } : {}),
+      ...(expectation.event ? { event: expectation.event } : {}),
+      must_include: expectation.must_include_guidance,
+      agent_must_do: expectation.must_include_actions,
+    };
+  }
+  return { ...engineRequiredCases, ...kitCases };
+}
+
 function fail(message: string): never {
   throw new Error(message);
 }
@@ -57,6 +87,7 @@ function validateEvidenceCommand(caseId: string, runtimes: string[], evidence: R
 export function main(argv = process.argv.slice(2)): number {
   try {
     const file = argv[0] ?? "evals/fixtures/hook-influence/cases.json";
+    const required = requiredCases();
     const data = JSON.parse(fs.readFileSync(file, "utf8")) as Record<string, unknown>;
     if (data.schema_version !== "1.0") fail("schema_version must be 1.0");
     if (!Array.isArray(data.cases) || !data.cases.length) fail("cases must be a non-empty list");
@@ -88,7 +119,7 @@ export function main(argv = process.argv.slice(2)): number {
       byTier.add(tier);
       ["command", "status"].forEach((key) => { if (typeof evidence[key] !== "string" || !String(evidence[key]).trim()) fail(`${caseId}: evidence.${key} must be a non-empty string`); });
       validateEvidenceCommand(caseId, runtimes, evidence);
-      const req = requiredCases[caseId];
+      const req = required[caseId];
       if (req) {
         if (tier !== req.tier) fail(`${caseId}: ${req.description} must use ${req.tier} evidence tier`);
         if (req.hook && item.hook !== req.hook) fail(`${caseId}: ${req.description} must use ${req.hook} hook`);
@@ -104,7 +135,7 @@ export function main(argv = process.argv.slice(2)): number {
     const missingRuntimes = [...validRuntimes].filter((runtime) => !runtimeCoverage.has(runtime)).sort();
     if (missingRuntimes.length) fail(`missing runtime coverage: ${missingRuntimes.join(", ")}`);
     for (const tier of ["adapter", "installed-command", "live-acceptance", "documented-runtime-gap"]) if (!byTier.has(tier)) fail(`missing required #62 evidence tier(s): ${tier}`);
-    for (const id of Object.keys(requiredCases)) if (!casesById.has(id)) fail(`missing required #62 case for ${requiredCases[id].description}: ${id}`);
+    for (const id of Object.keys(required)) if (!casesById.has(id)) fail(`missing required #62 case for ${required[id].description}: ${id}`);
     const codexGap = casesById.get("codex-live-context-gap")!;
     const codexRuntimes = codexGap.runtime_scope as string[];
     const codexEvidence = codexGap.evidence as Record<string, unknown>;