@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/cli/doctor/index.js

@@ -5,37 +5,21 @@ import { parseProbedVersion, compareVersionFloor } from "../../io/version-compar
 import { resolveGeneratedDir } from "../../io/generated-dir.js";
 import { inspectMemory, projectRejectionWarns } from "../../probes/memory.js";
 import { RealMcpProbe, probeAll, } from "../../probes/mcp.js";
+import { formatPostureWarning, } from "../../schema/index.js";
 import { EVIDENCE_LEDGER_DB_ENV, GROUNDING_MCP_SERVER_NAME, } from "../apply/generate-settings.js";
 import { parsePackSource } from "../../policy-packs/source.js";
 import { resolveBuiltin } from "../../policy-packs/registry.js";
-import { expandPolicyPacks } from "../../policy-packs/index.js";
 import { checkPolicyPackConfigs } from "../../policy-packs/config-check.js";
 import { checkPolicyPackVersions } from "../../policy-packs/version-check.js";
 import { checkPolicyPackUxDrift } from "../../policy-packs/ux-drift-check.js";
 import { selectRuntime } from "../apply/apply.js";
 import { lastApplyPath, readLastApply } from "../../io/last-apply.js";
-import { checkHookBudgetLedgerMargin, checkPolicyRiskWithoutEnvScope, checkSolutionAcceptanceKnobIgnored, checkSolutionAcceptanceProducer, checkTemplatePolicyDrift, checkTriggerBoundaryDrift, checkWorkflows, createDefaultGitIgnoreProbe, } from "../validate/checks.js";
-import { isDerivedPolicy } from "../../runtime/workflow-policies.js";
-import { resolveScopedProjectName } from "../../runtime/git-context.js";
-import { loadManifest, resolvePaths } from "../loader.js";
+import { loadManifest } from "../loader.js";
 import { countCodexDiagnostics, findOnPath, runCodexTargetChecks, } from "./codex.js";
 import { countOpencodeDiagnostics, runOpencodeTargetChecks, } from "./opencode.js";
 import { checkNpmBinPath } from "./npm-bin-path.js";
-import { scanForRogueLedgers } from "./rogue-ledger.js";
 import { buildClaudeMcpRegistration } from "./claude-mcp.js";
-import { checkUnderstandingModeEnvDivergence, isUnderstandingPackEnabled, } from "./understanding-mode-env.js";
-import { checkAutoApproveMode } from "./auto-approve-mode.js";
-import { checkExpireOnToolMatch } from "./expire-on-tool-match.js";
-import { checkBypassWithoutAutoApprove } from "./bypass-without-auto-approve.js";
-import { checkSessionStartPreflightSetupVersion, } from "./session-start-preflight-setup-version.js";
-import { SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION } from "../../schema/session-start-preflight.js";
-import { runDoctorToolchainParity, } from "./toolchain-parity.js";
-import { buildUgAutoApprovals, DEFAULT_RECENT_SESSIONS } from "./ug-auto-approvals.js";
-import { buildUgDelegations } from "./ug-delegations.js";
-import { buildUgInflight } from "./ug-inflight.js";
-import { buildSettingsDrift } from "./settings-drift.js";
-import { buildCodexConfigDrift, isCodexOptedIntoAutoApprove } from "./codex-config-drift.js";
-import { LOCK_BASENAME } from "../../io/harness-lock.js";
+import { buildHookLiveness, countHookLiveness, livenessRuntimes } from "./hook-liveness.js";
 import { isDoctorTarget, KNOWN_DOCTOR_TARGETS, } from "./types.js";
 export { isDoctorTarget, KNOWN_DOCTOR_TARGETS };
 const HOME_PLACEHOLDER = "~";
@@ -342,8 +326,7 @@ function checkHookVersion(hook, versionProbe) {
 /**
  * Wraps a version probe with a per-full-argv cache, keyed on
  * `JSON.stringify(cmd)` so two commands sharing only `cmd[0]` (e.g.
- * `["understanding-gate", "--version"]` vs. `["understanding-gate",
- * "--check"]`) are never conflated into the same cache slot; only a
+ * `["some-bin", "--version"]` vs. `["some-bin", "--check"]`) are never conflated into the same cache slot; only a
  * byte-identical argv array is deduped. Exported standalone (task
  * ab634898) so this caching contract has its own focused
  * unit test independent of any particular pack's hook shape.
@@ -357,62 +340,6 @@ export function memoizeVersionProbe(probe) {
         return cache.get(key) ?? null;
     };
 }
-/**
- * Hook-level `min_version` floor on policy-pack-expanded hooks (task
- * ab634898). `checkHooks` above only walks `manifest.hooks[]`, but the
- * hooks Claude Code actually runs also include whatever
- * `expandPolicyPacks` contributes, e.g. understanding-before-execution's
- * UserPromptSubmit/Stop hooks, floored at understanding-gate 0.5.0
- * (see `src/policy-packs/builtin/understanding-before-execution.ts`).
- * Those pack-expanded hooks never reached `checkHookVersion`, so an
- * operator on an older understanding-gate saw a clean doctor report
- * even though the pause wiring (or the Understanding Report's 10th
- * section) was silently degraded below the declared floor.
- *
- * Reuses `checkHookVersion` verbatim so the warning wording matches the
- * manifest-hook case exactly. `versionProbe` is wrapped with a
- * per-command cache so two hooks that share one `version_command` (the
- * common case: user-prompt-submit and stop both probe
- * `understanding-gate --version`) spawn the underlying binary once, not
- * twice. Only below-floor / probe-failed / parse-failed results are
- * returned; a hook at or above its floor produces nothing, mirroring
- * the pack-level floor's "green ones produce nothing" contract
- * (`checkPolicyPackVersions`). Always warn, never error: the pack still
- * runs in degraded mode rather than failing outright.
- *
- * Expands against the runtime a plain `harness apply` would select
- * (`selectRuntime` in `src/cli/apply/apply.ts`: recorded in `.last-apply`,
- * inferred from its files, else the default), never `opts.target`:
- * `--target codex` / `--target opencode` additionally evaluate the
- * harness-side adapter health for that runtime, they do not change which
- * runtime is actually installed and running the hooks. Matches the
- * sibling pack-level check's `resolveBuiltin(pack, runtime)` further below
- * (task ab634898: keying this on `--target` produced a below-floor install
- * that showed no warning under `--target codex` and a spurious one under
- * `--target opencode`, where the pack never wires in the first place; task
- * 04b8abcf: expanding against the default instead of the applied runtime
- * made doctor and apply diverge on a codex-recorded machine).
- */
-function checkPolicyPackHookVersions(manifest, versionProbe, runtime) {
-    const expansion = expandPolicyPacks(manifest, runtime);
-    const dedupedProbe = memoizeVersionProbe(versionProbe);
-    const gaps = [];
-    for (const hook of expansion.hooks) {
-        const version = checkHookVersion(hook, dedupedProbe);
-        if (version && version.status === "warn" && hook.min_version) {
-            gaps.push({
-                name: hook.name,
-                event: hook.event,
-                declaredMinVersion: hook.min_version,
-                kind: version.kind,
-                actualVersion: version.actualVersion ?? null,
-                versionCommand: hook.version_command ?? [],
-                message: version.message,
-            });
-        }
-    }
-    return gaps;
-}
 function checkHooks(manifest, home, opts) {
     const versionProbe = opts.versionProbe ?? (() => null);
     return manifest.hooks.map((hook) => {
@@ -443,89 +370,15 @@ function checkHooks(manifest, home, opts) {
         return base({ status: "ok" });
     });
 }
-/** The literal prefix of a ledger tag — the part before the first `:`. */
-function ledgerTagPrefix(ledgerTag) {
-    const colon = ledgerTag.indexOf(":");
-    return colon === -1 ? ledgerTag : ledgerTag.slice(0, colon);
-}
-/**
- * Does any manifest hook plausibly *produce* `prefix`-tagged ledger
- * entries? The policy's own consumer hook (`policy.hook`) is excluded:
- * a gate that reads the tag cannot also be what satisfies it.
- *
- * "Plausibly produces" is a coarse substring match of the tag prefix
- * against the hook command — a producer is typically a SessionStart
- * runner like `agent-preflight` whose command names the domain. The
- * match is prefix-granular by necessity: the command is an opaque
- * shell string, and the full `preflight:${BRANCH}` tag never appears
- * in it literally. So the signal is asymmetric. "No producer found"
- * is reliable. "Producer found" is a heuristic that can give false
- * reassurance: a hook producing `preflight:${REPO}` will mask a
- * `preflight:${BRANCH}` gap, and a once-per-session producer will mask
- * a `within: 10m` window it cannot actually keep fresh. This check is
- * therefore a floor (it catches the total-absence case), not a proof
- * of satisfiability.
- */
-function hasProducerHook(manifest, policy, prefix) {
-    // An empty prefix (a leading-colon tag like `:foo`) would
-    // substring-match every hook command. Treat it as "no producer
-    // identifiable" so the gap is surfaced rather than silently
-    // suppressed by a vacuous match.
-    if (prefix === "")
-        return false;
-    return manifest.hooks.some((h) => h.name !== policy.hook && h.command.includes(prefix));
-}
-function buildPolicies(manifest) {
-    return manifest.policies.map((p) => {
-        const report = {
-            name: p.name,
-            schemaValid: true,
-            caveat: "schema valid; last-evaluated tracking ships in Phase 4",
-            // F7 (review round 2): mark provenance so the rendered list can
-            // append "(derived from workflows[])" instead of listing a
-            // workflow-derived policy indistinguishably from a hand-authored
-            // one. `doctor` loads via `loadManifest`, which now folds derived
-            // policies in via `withDerivedPolicies` (F2), so this manifest's
-            // `policies[]` already contains them.
-            ...(isDerivedPolicy(p) ? { derived: true } : {}),
-        };
-        // Producer-gap check (task ce50df99): a `block` policy whose
-        // required tag carries a `within` freshness window cannot stay
-        // satisfied by a one-time action — it needs a recurring producer.
-        // If no manifest hook produces the tag, the gate silently walls
-        // off whatever it triggers on (the founding-incident lockout:
-        // `preflight-before-investigation` blocking every `git status`).
-        // Policies without `within` only need the tag to exist once, which
-        // the normal review / PR workflow supplies, so they are not
-        // flagged.
-        //
-        // Refinement (task f97e152f): a non-empty `producers:` array on
-        // the policy itself is the schema's way of declaring the recovery
-        // path. For example `dogfood-before-release` deliberately wants
-        // the operator to record a manual smoke summary; an automatic
-        // SessionStart producer would defeat the gate's purpose. When that
-        // documented producer exists the warning would be a false positive
-        // and is suppressed. The check still fires when both kinds are
-        // absent. The `length === 0` clause is defensive: the schema
-        // already enforces `producers: .min(1).optional()`, so a defined
-        // array is guaranteed non-empty for any manifest that loaded.
-        if (p.enforcement === "block" &&
-            // operator_only: true (task 2cc73f55) policies declare no
-            // requires: at all — there is no ledger_tag/within to go stale, so
-            // there is nothing for a producer to keep fresh.
-            p.requires !== undefined &&
-            p.requires.within !== undefined &&
-            (p.producers === undefined || p.producers.length === 0)) {
-            const prefix = ledgerTagPrefix(p.requires.ledger_tag);
-            if (!hasProducerHook(manifest, p, prefix)) {
-                report.producerGap = {
-                    ledgerTag: p.requires.ledger_tag,
-                    within: p.requires.within,
-                };
-            }
-        }
-        return report;
-    });
+function packExpansionRuntimeReport(selection, warning) {
+    return {
+        ...(warning !== undefined ? { warning } : {}),
+        runtime: selection.runtime,
+        source: selection.runtimeSource,
+        ...(selection.previousRuntime !== undefined
+            ? { previousRuntime: selection.previousRuntime }
+            : {}),
+    };
 }
 /**
  * Declared-but-not-live policy pack check. `expandPolicyPacks` silently
@@ -537,37 +390,7 @@ function buildPolicies(manifest) {
  * Skipped (`enabled: false`) packs are NOT checked: they're not
  * expected to be live, and flagging them would flood the report.
  */
-/**
- * Sentinel "cannot tell" probe: shallow runs answer every ignoredness
- * question with `null` instead of spawning `git check-ignore`. Exported
- * (with the resolver below) so a test can pin the no-spawn contract by
- * identity instead of mocking `node:child_process`.
- */
-export const NULL_GIT_IGNORE_PROBE = () => null;
-/**
- * Probe resolution order: an explicit (test) probe always wins; `shallow`
- * degrades to the no-spawn sentinel, mirroring how the npm-bin probe and
- * MCP probes degrade; otherwise the real `git check-ignore` probe runs
- * against the process cwd.
- */
-export function resolveGitIgnoreProbe(opts) {
-    if (opts.gitIgnoreProbe)
-        return opts.gitIgnoreProbe;
-    if (opts.shallow)
-        return NULL_GIT_IGNORE_PROBE;
-    return createDefaultGitIgnoreProbe();
-}
-function packExpansionRuntimeReport(selection, warning) {
-    return {
-        ...(warning !== undefined ? { warning } : {}),
-        runtime: selection.runtime,
-        source: selection.runtimeSource,
-        ...(selection.previousRuntime !== undefined
-            ? { previousRuntime: selection.previousRuntime }
-            : {}),
-    };
-}
-function buildPolicyPacks(manifest, versionProbe, gitIgnoreProbe, runtime) {
+function buildPolicyPacks(manifest, runtime) {
     const unresolved = [];
     for (const pack of manifest.policy_packs) {
         if (!pack.enabled)
@@ -597,10 +420,10 @@ function buildPolicyPacks(manifest, versionProbe, gitIgnoreProbe, runtime) {
         configPath: issue.configPath,
         message: issue.message,
     }));
-    const versionGaps = checkPolicyPackVersions(manifest, versionProbe).map((gap) => ({
+    const versionGaps = checkPolicyPackVersions(manifest).map((gap) => ({
         name: gap.packName,
         declaredMinVersion: gap.declaredMinVersion,
-        actualVersion: gap.actualVersion,
+        actualVersion: null,
         message: gap.message,
     }));
     const uxDrift = checkPolicyPackUxDrift(manifest).map((drift) => ({
@@ -608,129 +431,7 @@ function buildPolicyPacks(manifest, versionProbe, gitIgnoreProbe, runtime) {
         fields: drift.fields,
         message: drift.message,
     }));
-    // Same array as the producer check on purpose: countDiagnostics and the
-    // renderers already tally / print `solutionAcceptance` by severity, so
-    // the knob-ignored warning (task 24f6ceb9) inherits doctor parity with
-    // `harness validate` for free — the #308 pattern.
-    const solutionAcceptance = [
-        ...checkSolutionAcceptanceProducer(manifest),
-        ...checkSolutionAcceptanceKnobIgnored(manifest, gitIgnoreProbe),
-    ];
-    return { unresolved, configIssues, versionGaps, uxDrift, solutionAcceptance };
-}
-function buildWorkflows(manifest) {
-    const entries = manifest.workflows.map((wf) => {
-        const review = wf.steps.find((s) => s.kind === "review_subagent");
-        const merge = wf.steps.find((s) => s.kind === "merge");
-        return {
-            name: wf.name,
-            steps: wf.steps.length,
-            reviewSpawn: review?.kind === "review_subagent" ? review.spawn : null,
-            reviewTemplate: review?.kind === "review_subagent" ? (review.template ?? null) : null,
-            mergeGate: merge?.kind === "merge" ? merge.gate : null,
-            taskLabels: wf.when.task_label ?? [],
-        };
-    });
-    // F3 (review round 2, 99f47307 Slice 1): doctor previously imported
-    // validate's workflow-gate check nowhere, so a spawn: "required"
-    // workflow with the merge gate unwired (or wired to the wrong hook
-    // trigger, F5) showed green here even though `harness validate` errors
-    // on it. Delegates to the shared `checkWorkflows` aggregate (review
-    // round 3: the one list validate runs too, so the two cannot drift
-    // again), mirroring `buildTemplateDrift` / `buildTriggerBoundaryDrift`.
-    const workflowChecks = partitionDiagnosticsBySeverity(checkWorkflows(manifest));
-    return {
-        declared: manifest.workflows.length,
-        templates: Object.keys(manifest.review_templates).length,
-        entries,
-        errors: workflowChecks.errors,
-        warnings: workflowChecks.warnings,
-    };
-}
-/**
- * Phase 7 #6 — Risk Gate wiring health. Counts the three Risk Gate
- * surfaces and flags the misconfigurations that make the gate inert or
- * silently fail-closed. Pure: manifest in, section out, no I/O.
- */
-function buildRiskGate(manifest) {
-    const classifiers = manifest.risk.classifiers.length;
-    const resolvers = manifest.environments.resolvers.length;
-    const whenPolicies = manifest.policies.filter((p) => p.when !== undefined).length;
-    const warnings = [];
-    if (whenPolicies > 0 && classifiers === 0) {
-        warnings.push(`${whenPolicies} policy(ies) declare \`when:\` but no \`risk.classifiers[]\` are declared; ` +
-            `every action classifies as unclassified, so \`risk.*\` clauses match fail-closed ("unknown is not safe")`);
-    }
-    if (whenPolicies > 0 && resolvers === 0) {
-        warnings.push(`${whenPolicies} policy(ies) declare \`when:\` but no \`environments.resolvers[]\` are declared; ` +
-            `every action resolves to environment \`unknown\``);
-    }
-    if (whenPolicies === 0 && (classifiers > 0 || resolvers > 0)) {
-        warnings.push("risk classifiers / environment resolvers are declared but no policy consumes them via `when:` — the Risk Gate is inert");
-    }
-    // Risk-clause policies that forgot to scope via `environment.name`.
-    // Delegate to the shared validate check so doctor and `harness validate`
-    // stay in parity (same logic, same clauses, same thresholds). The check
-    // covers risk.severity_at_least, risk.category_in, AND action.reversible:
-    // all three clauses fail-closed to matched=true on an unclassified action
-    // per `runtime/when-eval.ts`. Map each Diagnostic message into a warning
-    // string, mirroring the checkSolutionAcceptanceProducer pattern above.
-    for (const diag of checkPolicyRiskWithoutEnvScope(manifest)) {
-        warnings.push(diag.message);
-    }
-    return { classifiers, resolvers, whenPolicies, warnings };
-}
-/**
- * Template-policy drift (task adf037c1): shipped operator_only security
- * policies missing from an aged installed manifest. Delegates to the
- * shared validate check so `harness doctor` and `harness validate` stay
- * in parity. Each Diagnostic is a missing kill-switch defense and maps to
- * errorCount (see countDiagnostics), the doctor-convention signal that a
- * dogfood/CI run should fail until the manifest is caught up or the name
- * is explicitly acknowledged under doctor.ignore_template_drift.
- */
-/**
- * Splits a `Diagnostic[]` into the `{ errors, warnings }` message-array
- * shape every drift-style doctor section uses (task 037cfb7c review round
- * 3: `buildTemplateDrift` and `buildTriggerBoundaryDrift` had become
- * byte-identical bodies around two different `checkX(manifest)` calls;
- * this is the one place that split lives now).
- */
-function partitionDiagnosticsBySeverity(diags) {
-    return {
-        errors: diags.filter((d) => d.severity === "error").map((d) => d.message),
-        warnings: diags.filter((d) => d.severity === "warning").map((d) => d.message),
-    };
-}
-function buildTemplateDrift(manifest) {
-    return partitionDiagnosticsBySeverity(checkTemplatePolicyDrift(manifest));
-}
-/**
- * Trigger-boundary drift (task 037cfb7c): shipped-by-name `bash_match`
- * triggers (hook- and policy-level) missing a boundary alternative the
- * template has, or missing a boundary group entirely. Doctor-only, like
- * `checkTemplatePolicyDrift` immediately above: `checkTriggerBoundaryDrift`
- * is deliberately not wired into validate's `runAssetChecks`, so
- * `harness validate` does not run it (only `harness doctor` does). Uses
- * the same `partitionDiagnosticsBySeverity` split as `buildTemplateDrift`
- * above: `checkTriggerBoundaryDrift` only emits `error`-severity
- * diagnostics today, but a future non-`error` diagnostic now surfaces in
- * `warnings` instead of being silently dropped.
- */
-function buildTriggerBoundaryDrift(manifest) {
-    return partitionDiagnosticsBySeverity(checkTriggerBoundaryDrift(manifest));
-}
-/**
- * Hook-budget-vs-ledger-timeout margin (task d20a7e0c). Delegates to the
- * shared validate check so `harness doctor` and `harness validate` stay
- * in parity, mirroring `buildTemplateDrift` immediately above.
- * `checkHookBudgetLedgerMargin` only ever emits `error`-severity
- * diagnostics (an under-budgeted blocking hook is always a real
- * fail-open gap, never a stylistic warning), so every message maps
- * straight to `errors`.
- */
-function buildHookBudgetLedgerMargin(manifest) {
-    return { errors: checkHookBudgetLedgerMargin(manifest).map((d) => d.message) };
+    return { unresolved, configIssues, versionGaps, uxDrift };
 }
 /**
  * Grounding wiring health (task 129e1b94). Only meaningful when an enabled
@@ -782,22 +483,16 @@ function buildGrounding(manifest, server, home) {
     catch {
         ledgerPathWritable = false;
         warnings.push(`evidence-ledger path ${ledgerPath} is not writable (and not creatable) — ` +
-            `grounding-mcp cannot persist evidence; warn policies degrade non-blocking, ` +
-            `block/require_approval policies DENY matching events (deny-degraded) while ` +
-            `their evidence is unreadable (risk.degraded_fail_posture: fail_open restores ` +
-            `the availability-first behaviour)`);
+            `grounding-mcp cannot persist evidence`);
     }
     return { ledgerPath, ledgerPathWritable, envOverride, warnings };
 }
-function manifestSection(manifest) {
+function manifestSection(manifest, postureWarnings) {
     const topLevelKeys = [
         "grounding",
         "tools",
         "memory",
         "hooks",
-        "policies",
-        "workflows",
-        "review_templates",
     ];
     const present = topLevelKeys.filter((k) => manifest[k] !== undefined).length;
     // Note: a corrupt manifest never reaches this point; loadManifest exits
@@ -806,7 +501,10 @@ function manifestSection(manifest) {
     // dropped. The exit-66-on-load path is the canonical signal.
     return {
         topLevelKeysPresent: present,
-        warnings: [],
+        // Removed manifest keys / removed packs the load stripped and ignored,
+        // and sites that still call a removed command
+        // (src/schema/removed-keys.ts): each one is a warning here.
+        warnings: postureWarnings.map(formatPostureWarning),
     };
 }
 function countDiagnostics(report) {
@@ -845,57 +543,24 @@ function countDiagnostics(report) {
         if (h.version?.status === "warn")
             warningCount++;
     }
-    for (const p of report.policies) {
-        if (p.producerGap)
-            warningCount++;
+    if (report.hookLiveness !== undefined) {
+        const liveness = countHookLiveness(report.hookLiveness);
+        errorCount += liveness.errorCount;
+        warningCount += liveness.warningCount;
     }
     errorCount += report.policyPacks.unresolved.length;
     errorCount += report.policyPacks.configIssues.length;
-    // Pack-level min_version gaps are warn-not-error: the pack still
-    // functions in degraded mode; only features gated on the newer
-    // release are lost. Parallel to the hook-level version probe's
+    // Pack-level min_version gaps are warn-not-error: the pack itself works,
+    // only the declared floor cannot be enforced. Builtin packs ship with
+    // harness and have no probe, so today every gap is a
+    // `no_probe_registered` one. Parallel to the hook-level version probe's
     // `status: warn`.
     warningCount += report.policyPacks.versionGaps.length;
-    // Hook-level min_version gaps on pack-expanded hooks (task ab634898):
-    // always warn-not-error, mirroring both the pack-level floor above
-    // and the manifest-declared hook floor in the `report.hooks` loop.
-    warningCount += report.policyPackHookVersions.length;
-    // Ux/producers drift is always warn: the pack still functions with the
+    // Ux drift is always warn: the pack still functions with the
     // stale wording, the operator is just missing a wording improvement.
     // Fix is opt-in (`harness pack reseed <name>`), so this never escalates
     // to an error the way an unresolved pack or a rejected config value does.
     warningCount += report.policyPacks.uxDrift.length;
-    for (const d of report.policyPacks.solutionAcceptance) {
-        if (d.severity === "error")
-            errorCount++;
-        else if (d.severity === "warning")
-            warningCount++;
-    }
-    warningCount += report.riskGate.warnings.length;
-    // Workflow gate wiring (F3) + weak-overlap (F1), review round 2,
-    // 99f47307 Slice 1: an unwired/mis-wired merge gate is a real
-    // silent-non-enforcement gap → errorCount; a weaker hand-authored
-    // policy sharing the derived gate's surface is informational →
-    // warningCount.
-    errorCount += report.workflows.errors.length;
-    warningCount += report.workflows.warnings.length;
-    // Template-policy drift: each missing-or-downgraded shipped operator_only
-    // security policy is a real defense gap → errorCount; stale opt-out
-    // entries are warn-only (task adf037c1).
-    errorCount += report.templateDrift.errors.length;
-    warningCount += report.templateDrift.warnings.length;
-    // Trigger-boundary drift (task 037cfb7c): every entry is a measured,
-    // exploitable gate bypass (see checkTriggerBoundaryDrift's header),
-    // mapped to errorCount, mirroring templateDrift.errors immediately
-    // above; warnings mirrors templateDrift.warnings the same way (no
-    // warning-severity diagnostic exists today, but the pathway is wired
-    // so one would count instead of vanishing).
-    errorCount += report.triggerBoundaryDrift.errors.length;
-    warningCount += report.triggerBoundaryDrift.warnings.length;
-    // Hook-budget-vs-ledger-timeout margin (task d20a7e0c): every entry is
-    // a real fail-open gap, mirroring templateDrift.errors immediately
-    // above.
-    errorCount += report.hookBudgetLedgerMargin.errors.length;
     if (report.grounding !== undefined) {
         warningCount += report.grounding.warnings.length;
     }
@@ -910,58 +575,6 @@ function countDiagnostics(report) {
     }
     if (report.npmGlobalBin?.status === "warn")
         warningCount++;
-    // Toolchain-parity drift (task 13919613): advisory-only, ALWAYS a
-    // warning, never an error — a machine running a different Node/OW-Kit/
-    // npm-global/MCP-set than a peer is a real drift signal worth flagging,
-    // but never a hard failure the way a broken MCP server or a missing
-    // required CLI is. `"skipped"` (--shallow) and `"no-peers"` (nothing to
-    // compare yet) are informational states and contribute nothing here.
-    if (report.toolchainParity) {
-        for (const p of report.toolchainParity.peers) {
-            if (p.status === "drift")
-                warningCount++;
-        }
-    }
-    // Understanding-gate mode env/config divergence (task 24abdecb):
-    // always advisory, never an error — see understanding-mode-env.ts.
-    if (report.understandingModeEnv)
-        warningCount++;
-    // ugAutoApprovals is informational only (ℹ), never contributes here.
-    // ugDelegations is informational (ℹ) UNLESS it found an unreadable
-    // file, in which case it rolls exactly one warning (ug-delegations.ts,
-    // agent-tasks 37ad0b05), not one per unreadable file.
-    if (report.ugDelegations && report.ugDelegations.unreadable > 0)
-        warningCount++;
-    // auto_approve configured outside grill_me (agent-tasks abfad738):
-    // always advisory, never an error, see auto-approve-mode.ts.
-    if (report.ugAutoApproveMode)
-        warningCount++;
-    // Explicit expire_on_tool_match with task_finish but without task_merge
-    // (task 0c6b2cb9): always advisory, never an error, see
-    // expire-on-tool-match.ts.
-    if (report.ugExpireOnToolMatch)
-        warningCount++;
-    // bypassPermissions observed, auto_approve missing/mismatched (task
-    // 8f637efd): always advisory, never an error, see
-    // bypass-without-auto-approve.ts.
-    if (report.ugBypassWithoutAutoApprove)
-        warningCount++;
-    // session_start_preflight.setup below the build-capable preflight
-    // floor (task 6993d9b5): always advisory, never an error, see
-    // session-start-preflight-setup-version.ts.
-    if (report.sessionStartPreflightSetupVersion)
-        warningCount++;
-    // ugInflight is informational only (ℹ) and never contributes here: a
-    // stale or skipped record is exactly what `harness gc` sweeps, not a
-    // tampering signal (see ug-inflight.ts / types.ts). Placed after every
-    // line this function's own docs citation anchors rather than beside
-    // its ugDelegations sibling above, for the same reason format.ts's
-    // ugInflight local moved: docs/decisions/2026-08-27-ug-auto-mode-approval.md
-    // cites a line here by exact number.
-    if (report.settingsDrift)
-        warningCount += report.settingsDrift.warnings.length;
-    if (report.codexConfigDrift)
-        warningCount += report.codexConfigDrift.warnings.length;
     if (report.memory.routerExecutable && !report.memory.routerExecutable.exists)
         errorCount++;
     if (!report.memory.routerExecutable)
@@ -986,26 +599,18 @@ function countDiagnostics(report) {
         errorCount += opencodeCounts.errorCount;
         warningCount += opencodeCounts.warningCount;
     }
-    warningCount += report.rogueLedgerDbs.length;
     return { errorCount, warningCount };
 }
 export async function doctor(opts = {}) {
-    // PLAIN load (task c88461c1, review round 3, decision D-028): every
+    // PLAIN load (task c88461c1): every
     // check this report builds from `manifest` below -- MCP/CLI/hook
-    // probes, memory, policies, policy packs, workflows, the risk gate,
-    // template and trigger-boundary drift, grounding, and everything
-    // else -- reads the base/machine/explicit-`--project` manifest only,
+    // probes, memory, policy packs,
+    // grounding, and everything else -- reads the base/machine/explicit-`--project` manifest only,
     // an explicit `opts.project` still wins outright but NOTHING is
-    // derived from cwd here. This mirrors `harness policy intercept`
-    // (src/cli/policy/intercept.ts) and `harness dry-run`
-    // (src/cli/dry-run.ts), which never consult a derived project layer
-    // either, so `doctor` never reports this repo healthier or unhealthier
-    // than what actually enforces. Only `checkSessionStartPreflightSetupVersion`
-    // further down gets a project-scoped SECOND load: routing a derived
-    // layer through THIS one, unrelated load would let it silently reach
-    // every other check in this report, for zero benefit to the one key
-    // that needs it.
-    const { manifest, resolved } = loadManifest(opts);
+    // derived from cwd here, so `doctor` reports the same manifest from any
+    // directory and never reports this repo healthier or unhealthier than the
+    // machine-level install it describes.
+    const { manifest, resolved, warnings: postureWarnings } = loadManifest(opts);
     const home = opts.homeOverride ?? opts.homeDir ?? os.homedir();
     const probe = opts.mcpProbe ?? new RealMcpProbe();
     // Resolved ahead of the MCP / CLI checks (moved up from its previous
@@ -1064,160 +669,14 @@ export async function doctor(opts = {}) {
         ...(opts.pathEnv !== undefined ? { pathEnv: opts.pathEnv } : {}),
         ...(opts.versionProbe !== undefined ? { versionProbe: opts.versionProbe } : {}),
     });
-    // One memoized probe shared across every doctor check that spawns
-    // `<binary> --version` (task 6993d9b5, round 2 F3/F4): `checkHooks`,
-    // `buildPolicyPacks`, the policy-pack-expanded hook walk
-    // (`checkPolicyPackHookVersions`, which already deduped internally but
-    // started from its own fresh cache) and the new
-    // session_start_preflight.setup check below all probe the same
-    // `["preflight", "--version"]` argv on a `min_version: 0.6.0` manifest.
-    // Without a shared cache that argv would spawn once per caller, per
-    // `doctor` run. `memoizeVersionProbe` (above) already existed for
-    // this; it just was not wired to the callers that predate the new
-    // check.
+    // One memoized probe for `checkHooks`: two manifest hooks that share one
+    // `version_command` spawn the underlying binary once per `doctor` run
+    // (task 6993d9b5, task ab634898).
     const dedupedVersionProbe = memoizeVersionProbe(opts.versionProbe ?? (() => null));
     const hooks = checkHooks(manifest, home, { versionProbe: dedupedVersionProbe });
-    // task 6993d9b5: independent of the generic hooks[] min_version walk
-    // above, see session-start-preflight-setup-version.ts for why.
-    //
-    // Per-repo scoping (task c88461c1, review round 2, decision D-021b;
-    // scope narrowed to THIS check only, review round 3, decision D-028):
-    // an explicit `opts.project` still wins outright; otherwise derive
-    // the project name from `opts.cwd` (defaulting to `process.cwd()`)
-    // via the SAME shared `deriveProjectName` helper `harness
-    // session-start preflight` and `harness explain-policy` feed their
-    // own SECOND load from. Without this, the check judged only the
-    // base/machine-override value, so it could warn (or stay silent)
-    // against the WRONG effective value for a repo whose cwd-derived
-    // project layer flips `setup` the other way, the exact drift the
-    // producer (src/cli/session-start/index.ts) and `explain-policy` do
-    // not have, since both already derive from cwd for this same key.
-    // Deliberately a SEPARATE load from `manifest` above, not a reuse:
-    // that load feeds every OTHER check in this report and must stay
-    // project-unaware (see the doctor() top comment); folding a derived
-    // layer into it would let it silently reach checks it was never
-    // meant to touch.
-    //
-    // `sessionStartPreflightProjectName` (task c88461c1, review round 3
-    // residual; narrowed by task 1c4eb3ea's round 2, D-027 item 2) is
-    // carried onto the finding ONLY when the scoped load below actually
-    // RESOLVED a project layer file (`resolved.projectLayer !== null`,
-    // the same signal `resolvePaths` already returns), not merely
-    // whenever `deriveProjectName`/`opts.project` produced a name to
-    // TRY. Round 1 set this to the attempted name unconditionally, so
-    // the `(project: X)` suffix `format.ts` renders was byte-identical
-    // whether or not a layer actually existed on disk: `projectName` is
-    // present for every cwd inside any git work tree, layer or no
-    // layer, which made docs/CLI.md's "distinguishable from a
-    // base/machine-decided value" claim false. This version instead
-    // only names the project when the base/machine value was genuinely
-    // overridden by (or the failed load genuinely attempted) that
-    // project's own layer file.
-    //
-    // Best-effort: a config/parse failure here degrades to `setup:
-    // false` (review round 3 residual; task `1c4eb3ea`), matching the
-    // producer's own `setupEnabled` catch (`src/cli/session-start/
-    // index.ts`). Task 1c4eb3ea's round 2 (D-027 item 3) additionally
-    // reports this failure as its own `layer_unresolvable` warning
-    // (below) instead of going fully silent, but ONLY when a project
-    // layer FILE actually exists to be unresolvable about; a failure
-    // that instead comes from the base/machine layers (no project layer
-    // on disk for this cwd at all) stays silent here exactly as before,
-    // since attributing it to "the project layer" would be wrong and
-    // `doctor()`'s own top-level `loadManifest(opts)` call above already
-    // surfaces a genuine base/machine parse failure by throwing before
-    // this point is ever reached.
-    const attemptedSessionStartPreflightProjectName = resolveScopedProjectName({
-        project: opts.project,
-        cwd: opts.cwd ?? process.cwd(),
-        fallback: null,
-    });
-    const scopedLoadOpts = {
-        ...opts,
-        project: attemptedSessionStartPreflightProjectName ?? undefined,
-    };
-    let sessionStartPreflightManifest = manifest;
-    let sessionStartPreflightProjectName = null;
-    let sessionStartPreflightLayerUnresolvable;
-    try {
-        const scopedLoad = loadManifest(scopedLoadOpts);
-        sessionStartPreflightManifest = scopedLoad.manifest;
-        if (scopedLoad.resolved.projectLayer !== null) {
-            sessionStartPreflightProjectName = attemptedSessionStartPreflightProjectName;
-        }
-    }
-    catch (err) {
-        // This catch itself IS reached in every shipped run with a malformed
-        // (or unreadable) project layer for the attempted name; what is
-        // actually UNREACHABLE TODAY is only the `unresolvableLayerPath ===
-        // null` sub-path below (task `1c4eb3ea`, round 2 mutation-probe
-        // replay found the round-1 probe on that line now SURVIVES, traced
-        // to this invariant): `doctor()`'s own PLAIN, unscoped
-        // `loadManifest(opts)` call at the very top of this function already
-        // reads the base manifest and every applicable machine-override
-        // layer `scopedLoadOpts` below ALSO reads (`scopedLoadOpts` differs
-        // from `opts` ONLY by adding `project`); that call has already
-        // succeeded by the time this line runs (a base/machine parse failure
-        // would have made `doctor()` itself reject before this point), so a
-        // throw reaching this catch can only come from the project layer
-        // `scopedLoadOpts.project` adds. `resolvePaths(scopedLoadOpts).projectLayer`
-        // therefore always resolves non-null here in every real invocation;
-        // the null-check below exists only so a FUTURE change to that "plain
-        // load first" invariant fails safe (silent, matching the producer's
-        // own `setupEnabled` catch) instead of leaking a stale pre-failure
-        // value, not because any fixture in this task's own suite can
-        // exercise it: constructing one would require the scoped load to
-        // fail for a reason the already-successful plain load could not also
-        // have hit, which is structurally impossible given the two calls
-        // read the identical base/machine layers.
-        //
-        // The assignment right below is itself UNOBSERVABLE today, in BOTH
-        // sub-paths: whenever `unresolvableLayerPath !== null` (every real
-        // invocation, per the invariant above), this degraded value is
-        // discarded outright by the `??` below, in favor of
-        // `sessionStartPreflightLayerUnresolvable`; the currently-
-        // unreachable `unresolvableLayerPath === null` sub-path never even
-        // runs to consume it either. It stays as a best-effort fallback for
-        // that future-invariant-change case, matching the producer's own
-        // `setupEnabled` catch, not because any path today actually reads it.
-        sessionStartPreflightManifest = {
-            ...manifest,
-            session_start_preflight: { ...manifest.session_start_preflight, setup: false },
-        };
-        // Same call the producer's own diagnostic makes
-        // (src/cli/session-start/index.ts): only names/warns about the
-        // project layer when `resolvePaths` itself can resolve one for
-        // this attempted name; otherwise the thrown error came from the
-        // base/machine layers, unrelated to project scoping, and this
-        // scoped-load catch stays silent about it (see the comment above).
-        // Deliberately unguarded, unlike the producer's copy: `resolvePaths`
-        // throws only on the HARNESS_ALLOW_REAL_GENERATED_DIR test-safety
-        // path, which the plain load at the top of doctor() has already
-        // passed; if that plain-load-first invariant ever moves, this line
-        // throws instead of degrading silently, and the producer's try/catch
-        // is the shape to copy.
-        const unresolvableLayerPath = resolvePaths(scopedLoadOpts).projectLayer;
-        if (unresolvableLayerPath !== null) {
-            sessionStartPreflightProjectName = attemptedSessionStartPreflightProjectName;
-            const errMessage = err instanceof Error ? err.message : String(err);
-            const errFirstLine = errMessage.split("\n")[0];
-            sessionStartPreflightLayerUnresolvable = {
-                kind: "layer_unresolvable",
-                actualVersion: null,
-                requiredVersion: SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION,
-                message: `session_start_preflight.setup: the project-scoped manifest load failed ` +
-                    `(${errFirstLine}); the effective setup value for this repo could not be ` +
-                    `determined (project layer: ${unresolvableLayerPath})`,
-                projectName: sessionStartPreflightProjectName,
-            };
-        }
-    }
-    const sessionStartPreflightSetupVersion = sessionStartPreflightLayerUnresolvable ??
-        checkSessionStartPreflightSetupVersion(sessionStartPreflightManifest, dedupedVersionProbe, sessionStartPreflightProjectName);
     // generatedDir resolved the same way apply.ts / interactive.ts resolve
-    // it, so buildClaudeMcpRegistration's
-    // desired projection carries SOLUTION_VERDICT_SIGNING_KEY too, and so
-    // the runtime below is read from the very `.last-apply` apply reads.
+    // it, so the runtime below is read from the very `.last-apply` apply
+    // reads.
     const generatedDir = resolveGeneratedDir({
         ...(opts.homeDir !== undefined ? { homeDir: opts.homeDir } : {}),
         manifestPath: resolved.base,
@@ -1225,10 +684,9 @@ export async function doctor(opts = {}) {
     });
     // The runtime a plain `harness apply` would select, through apply's own
     // `selectRuntime` (recorded, inferred or default; `--target` is an
-    // apply flag, not a doctor input). Pack expansion below uses it, so
-    // doctor checks the hooks the machine actually gets (task 04b8abcf).
-    // A malformed `.last-apply` must not kill doctor (base doctor never read
-    // it unless the understanding pack was declared): fall back to the
+    // apply flag, not a doctor input). The declared-but-not-live pack check
+    // below resolves packs against it (task 04b8abcf).
+    // A malformed `.last-apply` must not kill doctor: fall back to the
     // default selection and warn, naming the file.
     let lastApplyRecord = null;
     let lastApplyWarning;
@@ -1241,14 +699,7 @@ export async function doctor(opts = {}) {
                 "expanding policy packs against the default runtime";
     }
     const applyRuntime = selectRuntime(undefined, lastApplyRecord, false);
-    const policies = buildPolicies(manifest);
-    const policyPacks = buildPolicyPacks(manifest, dedupedVersionProbe, resolveGitIgnoreProbe(opts), applyRuntime.runtime);
-    const policyPackHookVersions = checkPolicyPackHookVersions(manifest, dedupedVersionProbe, applyRuntime.runtime);
-    const workflows = buildWorkflows(manifest);
-    const riskGate = buildRiskGate(manifest);
-    const templateDrift = buildTemplateDrift(manifest);
-    const triggerBoundaryDrift = buildTriggerBoundaryDrift(manifest);
-    const hookBudgetLedgerMargin = buildHookBudgetLedgerMargin(manifest);
+    const policyPacks = buildPolicyPacks(manifest, applyRuntime.runtime);
     const groundingServer = manifest.tools.mcp.find((m) => m.name === GROUNDING_MCP_SERVER_NAME && m.enabled !== false) ?? null;
     const grounding = groundingServer !== null
         ? buildGrounding(manifest, groundingServer, home)
@@ -1262,108 +713,21 @@ export async function doctor(opts = {}) {
     const claudeMcp = manifest.tools.mcp.length > 0
         ? await buildClaudeMcpRegistration(manifest, {
             home,
-            generatedDir,
             shallow: !!opts.shallow,
             ...(opts.claudeMcpExec !== undefined ? { claudeMcpExec: opts.claudeMcpExec } : {}),
             ...(opts.envOverride !== undefined ? { env: opts.envOverride } : {}),
         })
         : undefined;
-    const understandingModeEnv = checkUnderstandingModeEnvDivergence(manifest, opts.envOverride ?? process.env);
-    const ugAutoApproveMode = checkAutoApproveMode(manifest);
-    const ugExpireOnToolMatch = checkExpireOnToolMatch(manifest);
-    // ADR docs/decisions/2026-08-27-ug-auto-mode-approval.md slice 1
-    // (agent-tasks 74b4b17d), "Audit and doctor": the auto-approval
-    // listing + last-N metric, and the settings-drift compensating
-    // control for threat model (c)'s defaultMode/hook-roster plant. Both
-    // gated on the pack being declared and enabled (same gate as
-    // `understandingModeEnv` above) — a manifest that never uses the pack
-    // has no auto-approval markers or auto-approve config to drift.
-    const recentSessionsWindow = opts.recentSessions ?? DEFAULT_RECENT_SESSIONS;
-    if (!Number.isInteger(recentSessionsWindow) || recentSessionsWindow < 1) {
-        throw new Error(`doctor: recentSessions must be an integer >= 1, got ${JSON.stringify(opts.recentSessions)}`);
-    }
-    const understandingPackEnabled = isUnderstandingPackEnabled(manifest);
-    const ugAutoApprovals = understandingPackEnabled
-        ? buildUgAutoApprovals(generatedDir, { recentSessions: recentSessionsWindow })
-        : undefined;
-    // Slice 3 (agent-tasks 37ad0b05), same "Audit and doctor"
-    // section: delegations-on-disk metric from `.delegations/`, gated on
-    // the same pack-enabled check, computed even when the directory is
-    // absent (`delegationsDirPresent: false`, `total: 0`), the render
-    // layer (format.ts) is what stays silent for that case, mirroring
-    // `ugAutoApprovals`'s own `approvalsDirPresent` gate; see
-    // ug-delegations.ts.
-    const ugDelegations = understandingPackEnabled
-        ? buildUgDelegations(generatedDir, { ...(opts.now !== undefined ? { now: opts.now } : {}) })
-        : undefined;
-    // Subagent-gate slice 1: in-flight-records-on-disk metric from
-    // `.inflight/`, same gate and "computed even when the directory is
-    // absent" posture as `ugDelegations` immediately above; see
-    // ug-inflight.ts.
-    const ugInflight = understandingPackEnabled
-        ? buildUgInflight(generatedDir, { ...(opts.now !== undefined ? { now: opts.now } : {}) })
-        : undefined;
-    // Task 8f637efd ("Amendment: install default"): bypassPermissions
-    // observed (hook-side) but auto_approve missing/mismatched. Same gate
-    // and same recentSessions window as ugAutoApprovals, reading a
-    // different on-disk directory (.permission-mode-observations/, not
-    // .approvals/).
-    const ugBypassWithoutAutoApprove = understandingPackEnabled
-        ? checkBypassWithoutAutoApprove(manifest, generatedDir, {
-            recentSessions: recentSessionsWindow,
-        })
-        : undefined;
-    // Shared option shape both drift checks below take (same manifest,
-    // same generated dir, same lock, same cwd/home/env resolution), one
-    // literal instead of two near-identical ones (`buildSettingsDrift` and
-    // `buildCodexConfigDrift` both accept exactly this shape).
-    const driftCheckOpts = {
-        generatedDir,
-        lockPath: path.join(path.dirname(resolved.base), LOCK_BASENAME),
-        cwd: opts.cwd ?? process.cwd(),
-        home,
-        env: opts.envOverride ?? process.env,
-    };
-    // Settings-drift additionally requires `harness.generated/` to exist:
-    // without at least one prior `harness apply`, there is no baseline to
-    // compare against and nothing this check owns an opinion about (a
-    // fresh manifest that declares the pack but has never been applied
-    // must stay exactly as quiet as today — see the doctor-understanding-
-    // mode-env fixture that already asserts a bare "Environment"-less
-    // report for that exact shape).
-    const settingsDrift = understandingPackEnabled && fs.existsSync(generatedDir)
-        ? buildSettingsDrift(driftCheckOpts)
-        : undefined;
-    // Codex counterpart of `settingsDrift` (follow-up of slice 2 of the
-    // same ADR, agent-tasks f59ea0eb). Gated on the pack's
-    // `auto_approve.harnesses` actually listing `codex` rather than on
-    // `understandingPackEnabled` alone, and NOT gated on
-    // `harness.generated/` existing: unlike `permissions.defaultMode`,
-    // `approval_policy = "never"` is a live risk the moment it is present,
-    // whether or not a `harness apply` has ever run for this manifest (see
-    // codex-config-drift.ts's module header).
-    const codexConfigDrift = isCodexOptedIntoAutoApprove(manifest)
-        ? buildCodexConfigDrift(driftCheckOpts)
-        : undefined;
-    // Toolchain-parity on-demand comparison (task 13919613). Gated purely on
-    // `toolchain_parity.enabled` — mirrors `grounding`'s "only when the
-    // feature is actually in use" gating, so a manifest that never opted
-    // into the SessionStart companion sees no section at all here either.
-    const toolchainParity = manifest.toolchain_parity.enabled
-        ? await runDoctorToolchainParity(manifest, {
-            shallow: !!opts.shallow,
-            ...(opts.now !== undefined ? { now: opts.now } : {}),
-            ...opts.toolchainParityOptions,
+    const manifestSec = manifestSection(manifest, postureWarnings);
+    const livenessTargets = livenessRuntimes(applyRuntime.runtime, opts.target);
+    const hookLiveness = livenessTargets.length > 0
+        ? buildHookLiveness(manifest, {
+            home,
+            env: opts.envOverride ?? process.env,
+            runtimes: livenessTargets,
+            ...(opts.codexLiveConfigPath !== undefined ? { codexConfigPath: opts.codexLiveConfigPath } : {}),
         })
         : undefined;
-    const manifestSec = manifestSection(manifest);
-    const rogueLedgerDbs = scanForRogueLedgers({
-        homeDir: opts.rogueLedgerScanOptions?.homeDir ?? home,
-        cwd: opts.rogueLedgerScanOptions?.cwd ?? process.cwd(),
-        ...(opts.rogueLedgerScanOptions?.fsInterface !== undefined
-            ? { fsInterface: opts.rogueLedgerScanOptions.fsInterface }
-            : {}),
-    });
     const partial = {
         manifestPath: resolved.base,
         manifestVersion: manifest.version,
@@ -1373,32 +737,12 @@ export async function doctor(opts = {}) {
         tools,
         memory,
         hooks,
-        policies,
+        ...(hookLiveness !== undefined ? { hookLiveness } : {}),
         policyPacks,
-        policyPackHookVersions,
         packExpansionRuntime: packExpansionRuntimeReport(applyRuntime, lastApplyWarning),
-        workflows,
-        riskGate,
-        templateDrift,
-        triggerBoundaryDrift,
-        hookBudgetLedgerMargin,
         ...(grounding !== undefined ? { grounding } : {}),
         ...(claudeMcp !== undefined ? { claudeMcp } : {}),
-        ...(toolchainParity !== undefined ? { toolchainParity } : {}),
-        rogueLedgerDbs,
         ...(npmGlobalBin !== undefined ? { npmGlobalBin } : {}),
-        ...(understandingModeEnv !== undefined ? { understandingModeEnv } : {}),
-        ...(ugAutoApprovals !== undefined ? { ugAutoApprovals } : {}),
-        ...(ugDelegations !== undefined ? { ugDelegations } : {}),
-        ...(ugInflight !== undefined ? { ugInflight } : {}),
-        ...(ugBypassWithoutAutoApprove !== undefined ? { ugBypassWithoutAutoApprove } : {}),
-        ...(sessionStartPreflightSetupVersion !== undefined
-            ? { sessionStartPreflightSetupVersion }
-            : {}),
-        ...(ugAutoApproveMode !== undefined ? { ugAutoApproveMode } : {}),
-        ...(ugExpireOnToolMatch !== undefined ? { ugExpireOnToolMatch } : {}),
-        ...(settingsDrift !== undefined ? { settingsDrift } : {}),
-        ...(codexConfigDrift !== undefined ? { codexConfigDrift } : {}),
     };
     if (opts.target === "codex") {
         const manifestDir = path.dirname(resolved.base);