@massu/core 1.15.6 → 1.15.7

package/commands/massu-deploy.python-docker.md

@@ -4,6 +4,8 @@ description: "Deploy a containerized Python service via docker compose — force
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Massu Deploy: Python Service — Docker Compose
 
 Force-recreates the Docker container for a Python service using `docker compose`. Use this variant when your service is containerized and `massu.config.yaml` declares `config.python.service_label` matching the compose service name.

package/commands/massu-deploy.python-fly.md

@@ -4,6 +4,8 @@ description: "Deploy a Python service to Fly.io — flyctl deploy, status check,
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Massu Deploy: Python Service — Fly.io
 
 Deploys a Python service to Fly.io using `flyctl deploy`. Use this variant when your project targets Fly.io and has a `fly.toml` in the repository root. The app name comes from `fly.toml` (or `config.python.service_label` as a fallback).

package/commands/massu-deploy.python-launchd.md

@@ -4,6 +4,8 @@ description: "Deploy a Python service supervised by launchd (macOS) — restart
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Massu Deploy: Python Service — launchd (macOS)
 
 Restarts a Python service running under `launchd` on macOS. Use this variant when your `massu.config.yaml` declares `config.python.service_label` and your host is macOS.

package/commands/massu-deploy.python-systemd.md

@@ -4,6 +4,8 @@ description: "Deploy a Python service supervised by systemd (Linux) — restart
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Massu Deploy: Python Service — systemd (Linux)
 
 Restarts a Python service running under a `systemd --user` unit on Linux. Use this variant when your `massu.config.yaml` declares `config.python.service_label` and your host is Linux.

package/commands/massu-full-audit.md

@@ -1,3 +1,5 @@
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 name: massu-full-audit
 
 # Massu Full Audit

package/commands/massu-golden-path/references/approval-points.md

@@ -1,5 +1,7 @@
 # Approval Points
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 There are exactly 4 approval points (5 when using `--competitive` mode) where the golden path pauses for user input. Everything else runs automatically.

package/commands/massu-golden-path/references/phase-0-requirements.md

@@ -1,5 +1,7 @@
 # Phase 0: Requirements & Context Loading
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ## 0.1 Session Context Loading

package/commands/massu-golden-path/references/phase-1-plan-creation.md

@@ -1,5 +1,7 @@
 # Phase 1: Plan Creation & Audit
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ## Phase 1A: Research & Reality Check

package/commands/massu-golden-path/references/phase-2-implementation.md

@@ -1,5 +1,7 @@
 # Phase 2: Implementation
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ## Competitive Mode Check

package/commands/massu-golden-path/references/phase-2.5-gap-analyzer.md

@@ -1,5 +1,7 @@
 # Phase 2.5: Gap & Enhancement Analyzer Loop
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ```

package/commands/massu-golden-path/references/phase-3-simplify.md

@@ -1,5 +1,7 @@
 # Phase 3: Simplification
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ```

package/commands/massu-golden-path/references/phase-3.5-security-audit.md

@@ -1,5 +1,7 @@
 # Phase 3.5: Deep Security Audit
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ```

package/commands/massu-golden-path/references/phase-4-commit.md

@@ -1,5 +1,7 @@
 # Phase 4: Pre-Commit Verification
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ```

package/commands/massu-golden-path/references/phase-5-push.md

@@ -1,5 +1,7 @@
 # Phase 5: Push Verification & Push
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ```

package/commands/massu-golden-path/references/phase-5.5-production-verify.md

@@ -1,5 +1,7 @@
 # Phase 5.5: Production Verification
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ```

package/commands/massu-golden-path/references/phase-6-completion.md

@@ -1,5 +1,7 @@
 # Phase 6: Completion
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ## 6.1 Final Report

package/commands/massu-golden-path/references/qa-evaluator-spec.md

@@ -1,5 +1,7 @@
 # QA Evaluator Specification
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path` Phase 2C. Return to `phase-2-implementation.md` for full Phase 2.
 
 ## Purpose

package/commands/massu-golden-path/references/sprint-contract-protocol.md

@@ -1,5 +1,7 @@
 # Sprint Contract Protocol
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path` Phase 2A.5. Return to `phase-2-implementation.md` for full Phase 2.
 
 ## What Is a Sprint Contract?

package/commands/massu-golden-path/references/vr-visual-calibration.md

@@ -1,5 +1,7 @@
 # VR-VISUAL Calibration Examples
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for VR-VISUAL 4-dimension weighted scoring.
 > Used by `scripts/ui-review.sh` and golden-path Phase 2.5 gap analysis.
 

package/commands/massu-guide.md

@@ -3,6 +3,8 @@ name: massu-guide
 description: "When a new user or contributor asks 'how does this work', 'give me a tour', 'onboarding', or needs an interactive walkthrough of the codebase"
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*)
 ---
+
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
 name: massu-guide
 
 # Massu Guide: Codebase Onboarding Walkthrough

package/commands/massu-hooks.md

@@ -1,3 +1,5 @@
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 name: massu-hooks
 
 # Massu Hooks: Profile & Status Dashboard

package/commands/massu-learning-audit.md

@@ -4,6 +4,8 @@ description: "When user says 'learning audit', 'check auto-learning', 'memory co
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*), ToolSearch(mcp__massu-codegraph__*)
 disable-model-invocation: true
 ---
+
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
 name: massu-learning-audit
 
 # Massu Learning Audit: Auto-Learning Effectiveness Validation

package/commands/massu-loop/references/auto-learning.md

@@ -1,5 +1,7 @@
 # Auto-Learning Protocol
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## POST-BUILD REFLECTION + MANDATORY MEMORY PERSIST (CR-38)

package/commands/massu-loop/references/checkpoint-audit.md

@@ -1,5 +1,7 @@
 # Checkpoint Audit Protocol
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## CHECKPOINT AUDIT (Phase Boundaries)

package/commands/massu-loop/references/guardrails.md

@@ -1,5 +1,7 @@
 # The 10 Accountability Safeguards
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## THE 10 ACCOUNTABILITY SAFEGUARDS

package/commands/massu-loop/references/iteration-structure.md

@@ -1,5 +1,7 @@
 # Iteration Structure
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## ITERATION STRUCTURE

package/commands/massu-loop/references/loop-controller.md

@@ -1,5 +1,7 @@
 # Loop Controller
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## MANDATORY LOOP CONTROLLER (EXECUTE THIS - DO NOT SKIP)

package/commands/massu-loop/references/plan-extraction.md

@@ -1,5 +1,7 @@
 # Plan Item Extraction
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## PLAN ITEM EXTRACTION PROTOCOL (MANDATORY - STEP 0)

package/commands/massu-loop/references/vr-plan-spec.md

@@ -1,5 +1,7 @@
 # VR-PLAN Verification Details
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## VR-PLAN: VERIFICATION PLANNING STEP

package/commands/massu-parity.md

@@ -3,6 +3,8 @@ name: massu-parity
 description: Generic feature parity check between two systems or components
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*), Write(*), Task(*)
 ---
+
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
 name: massu-parity
 
 # Massu Parity: Feature Parity Check

package/commands/massu-push.md

@@ -3,6 +3,8 @@ name: massu-push
 description: "When user says 'push', 'push to remote', 'deploy', or wants to push committed changes to the remote repository"
 allowed-tools: Bash(*), Read(*), Edit(*), Write(*), Grep(*), Glob(*)
 ---
+
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
 name: massu-push
 
 # Massu Push: Verify, Push, Monitor CI

package/commands/massu-scaffold-hook.md

@@ -4,6 +4,8 @@ description: "When user wants to create a new Claude Code hook — scaffolds the
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New Hook
 
 Creates a complete Claude Code hook following the 3-tier profile system.

package/commands/massu-scaffold-page.md

@@ -4,6 +4,8 @@ description: "When user wants to create a new page, screen, or view — asks whi
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New Page / View
 
 This default template is **framework-agnostic**. It asks the user (or, when invoked by an agent, infers from `massu.config.yaml`) which target to scaffold, then dispatches to one of the embedded patterns below.

package/commands/massu-scaffold-page.swift.md

@@ -4,6 +4,8 @@ description: "When user wants to create a new view, screen, or page in a SwiftUI
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New SwiftUI View
 
 Creates a SwiftUI View + `@MainActor` ViewModel + Decodable response model. Suitable for iOS, visionOS, or any cross-platform SwiftUI target.

package/commands/massu-scaffold-router.md

@@ -4,6 +4,8 @@ description: "When user wants to create a new tRPC router, API endpoint, or back
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New tRPC Router
 
 Creates a complete tRPC router following all project database and auth patterns.

package/commands/massu-scaffold-router.python-django.md

@@ -4,6 +4,8 @@ description: "Django-specific scaffold for {{paths.python_source | default("djan
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New Django View
 
 Creates Django views in `{{paths.python_source | default("django_app")}}` following the project's conventions. Covers function-based views (FBV), class-based views (CBV), and the corresponding `urls.py` registration. Auth guard uses `{{detected.python.auth_dep | default("login_required")}}`.

package/commands/massu-scaffold-router.python-fastapi.md

@@ -4,6 +4,8 @@ description: "FastAPI-specific scaffold for {{paths.python_source | default("app
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New FastAPI Router
 
 Creates a complete FastAPI router following the project's existing conventions in `{{paths.python_source | default("app")}}/routers/`. Auth dependency sourced from the massu introspector's `detected.python.auth_dep` (falls back to `get_current_user` if not detected).

package/commands/massu-scaffold-router.python.md

@@ -4,6 +4,8 @@ description: "When user wants to create a new FastAPI router, API endpoint, or b
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New FastAPI Router
 
 Creates a complete FastAPI router following the project's existing conventions in `${paths.python_source}/routers/` (or wherever your project's `paths.python_source` resolves).

package/dist/cli.js

@@ -4132,11 +4132,15 @@ var init_permissions = __esm({
 // src/commands/install-commands.ts
 var install_commands_exports = {};
 __export(install_commands_exports, {
+  MASSU_OWNED_PATHS: () => MASSU_OWNED_PATHS,
   buildTemplateVars: () => buildTemplateVars,
+  canonicalizeOwned: () => canonicalizeOwned,
   hashContent: () => hashContent,
   installAll: () => installAll,
   installCommands: () => installCommands,
+  isMassuOwned: () => isMassuOwned,
   loadManifest: () => loadManifest,
+  massuOwnedSourceIsValid: () => massuOwnedSourceIsValid,
   pickVariant: () => pickVariant,
   resolveAssetDir: () => resolveAssetDir,
   resolveCommandsDir: () => resolveCommandsDir,
@@ -4155,25 +4159,51 @@ import {
 import { resolve as resolve6, dirname as dirname7, join as join6 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createHash as createHash3 } from "crypto";
+function dirHoldsAssets(dir) {
+  if (!existsSync9(dir)) return false;
+  try {
+    return readdirSync3(dir).some(
+      (e2) => e2.endsWith(".md") || statSync2(resolve6(dir, e2)).isDirectory()
+    );
+  } catch {
+    return false;
+  }
+}
 function resolveAssetDir(assetName) {
   const cwd = process.cwd();
-  const nodeModulesPath = resolve6(cwd, "node_modules/@massu/core", assetName);
-  if (existsSync9(nodeModulesPath)) {
-    return nodeModulesPath;
-  }
-  const distRelPath = resolve6(__dirname, "..", assetName);
-  if (existsSync9(distRelPath)) {
-    return distRelPath;
-  }
-  const srcRelPath = resolve6(__dirname, "../..", assetName);
-  if (existsSync9(srcRelPath)) {
-    return srcRelPath;
+  const candidates = [
+    // 1. npm-installed: node_modules/@massu/core/{assetName}
+    resolve6(cwd, "node_modules/@massu/core", assetName),
+    // 2. Relative to compiled dist/cli.js → ../{assetName}
+    resolve6(__dirname, "..", assetName),
+    // 3. Relative to source src/commands/ → ../../{assetName}
+    resolve6(__dirname, "../..", assetName)
+  ];
+  for (const c2 of candidates) {
+    if (dirHoldsAssets(c2)) return c2;
   }
   return null;
 }
 function resolveCommandsDir() {
   return resolveAssetDir("commands");
 }
+function isMassuOwned(manifestKey) {
+  return MASSU_OWNED_PATHS.includes(manifestKey);
+}
+function canonicalizeOwned(content) {
+  return content.replace(/\r\n/g, "\n").split("\n").map((l2) => l2.replace(/\s+$/, "")).join("\n").trim();
+}
+function massuOwnedSourceIsValid(resolvedSourcePath, content) {
+  const sidecar = `${resolvedSourcePath}.sha256`;
+  if (!existsSync9(sidecar)) return false;
+  let expected;
+  try {
+    expected = readFileSync6(sidecar, "utf-8").trim();
+  } catch {
+    return false;
+  }
+  return hashContent(canonicalizeOwned(content)) === expected;
+}
 function hashContent(content) {
   return createHash3("sha256").update(content, "utf-8").digest("hex");
 }
@@ -4349,13 +4379,38 @@ function syncDirectory(sourceDir, targetDir, framework, manifest, manifestKeyPre
     const manifestKey = manifestKeyPrefix === "" ? targetFilename : `${manifestKeyPrefix}/${targetFilename}`;
     const lastInstalledHash = manifest.entries[manifestKey];
     if (existsSync9(targetPath)) {
-      const existingContent = readFileSync6(targetPath, "utf-8");
+      let existingContent;
+      try {
+        if (!statSync2(targetPath).isFile()) throw new Error("not a regular file");
+        existingContent = readFileSync6(targetPath, "utf-8");
+      } catch (err) {
+        process.stderr.write(
+          `massu: skipping ${manifestKey}: target is not a readable file (${err instanceof Error ? err.message : String(err)}). Remove it and re-install.
+`
+        );
+        stats.skipped++;
+        continue;
+      }
       const existingHash = hashContent(existingContent);
       if (existingHash === sourceHash) {
         manifest.entries[manifestKey] = sourceHash;
         stats.skipped++;
         continue;
       }
+      if (isMassuOwned(manifestKey)) {
+        if (!massuOwnedSourceIsValid(resolvedSourcePath, sourceContent)) {
+          process.stderr.write(
+            `massu: REFUSING to overwrite massu-owned ${manifestKey} \u2014 the source failed its integrity hash (${resolvedSourcePath}.sha256 missing or mismatched). Your installed @massu/core may be stale or tampered; run \`npm i @massu/core@latest\` and re-install. Kept the existing file.
+`
+          );
+          stats.kept++;
+          continue;
+        }
+        atomicWriteFile(targetPath, sourceContent);
+        manifest.entries[manifestKey] = sourceHash;
+        stats.updated++;
+        continue;
+      }
       if (lastInstalledHash === void 0) {
         process.stderr.write(
           `First-install: keeping existing ${targetPath} (differs from upstream, and massu has no record of writing it).
@@ -4531,7 +4586,7 @@ async function runInstallCommands() {
   console.log("  Restart your Claude Code session to use them.");
   console.log("");
 }
-var __filename, __dirname, ASSET_TYPES, MANIFEST_VERSION, MANIFEST_RELPATH, PASSTHROUGH_LANG_KEYS;
+var __filename, __dirname, ASSET_TYPES, MANIFEST_VERSION, MANIFEST_RELPATH, MASSU_OWNED_PATHS, PASSTHROUGH_LANG_KEYS;
 var init_install_commands = __esm({
   "src/commands/install-commands.ts"() {
     "use strict";
@@ -4550,6 +4605,7 @@ var init_install_commands = __esm({
     ];
     MANIFEST_VERSION = 1;
     MANIFEST_RELPATH = join6(".massu", "install-manifest.json");
+    MASSU_OWNED_PATHS = ["commands/_verification-laws.md"];
     PASSTHROUGH_LANG_KEYS = [
       "typescript",
       "javascript",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@massu/core",
-  "version": "1.15.6",
+  "version": "1.15.7",
   "type": "module",
   "description": "AI Engineering Governance MCP Server - Session memory, knowledge system, feature registry, code intelligence, rule enforcement, tiered tooling (12 free / 73 total), 56 workflow commands, 11 agents, 20+ patterns",
   "main": "./dist/cli.js",
@@ -24,14 +24,15 @@
     "start": "npx tsx src/server.ts",
     "test": "vitest run",
     "build": "tsc --noEmit && npm run build:cli && npm run build:hooks && npm run build:assets && npm run build:adapter-types && npm run build:adapter-subpath && npm run build:bundle-adapters",
-    "build:assets": "node scripts/copy-embedder-assets.mjs",
+    "build:assets": "node scripts/gen-owned-sidecars.mjs && node scripts/copy-embedder-assets.mjs",
     "build:adapter-types": "tsc -p tsconfig.adapter-types.json",
     "build:adapter-subpath": "tsx scripts/bundle-adapters.ts --subpath-only",
     "build:bundle-adapters": "tsx scripts/bundle-adapters.ts",
     "build:cli": "esbuild --bundle --platform=node --format=esm --outfile=dist/cli.js src/cli.ts --external:better-sqlite3 --external:yaml --external:zod --external:chokidar --external:proper-lockfile --external:fsevents --external:web-tree-sitter --external:tweetnacl --external:tar --external:smol-toml --external:vscode-languageserver-protocol --external:onnxruntime-web --external:@massu/adapter-rails --external:@massu/adapter-spring --banner:js='#!/usr/bin/env node\nimport{createRequire as __cr}from\"module\";const require=__cr(import.meta.url);'",
     "build:hooks": "esbuild --bundle --platform=node --format=esm --outdir=dist/hooks src/hooks/*.ts --external:better-sqlite3 --external:yaml --external:zod --external:chokidar --external:proper-lockfile --external:fsevents --external:web-tree-sitter --external:tweetnacl --external:tar --external:smol-toml --external:vscode-languageserver-protocol --external:onnxruntime-web --external:@massu/adapter-rails --external:@massu/adapter-spring --banner:js='import{createRequire as __cr}from\"module\";const require=__cr(import.meta.url);'",
     "prepublishOnly": "bash ../../scripts/prepublish-check.sh && node ../../scripts/bundle-pubkey.mjs && node ../../scripts/bundle-license-pubkey.mjs && node ../../scripts/bundle-promotion-pubkey.mjs && node ../../scripts/bundle-audit-export-pubkey.mjs && cp ../../CHANGELOG.md ./CHANGELOG.md && npm run build && bash ../../scripts/npm-publish-guard.sh",
-    "bench:watch": "tsx test/perf/watch-benchmark.ts"
+    "bench:watch": "tsx test/perf/watch-benchmark.ts",
+    "build:owned-sidecars": "node scripts/gen-owned-sidecars.mjs"
   },
   "dependencies": {
     "@clack/prompts": "^0.9.1",

package/patterns/build-patterns.md

@@ -1,5 +1,7 @@
 # Build Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Patterns for resolving build issues in Next.js applications with Prisma, native modules, and Edge Runtime.
 
 **When to Read**: When encountering build errors, hangs, or warnings. Before adding heavy dependencies.

package/patterns/component-patterns.md

@@ -1,5 +1,7 @@
 # Component Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Standard patterns for UI components, forms, search inputs, and common interactive elements.
 
 **When to Read**: Before creating or modifying UI components.

package/patterns/display-patterns.md

@@ -1,5 +1,7 @@
 # Display Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Centralized formatting functions and display conventions for data presentation.
 
 **When to Read**: Before displaying formatted data (currency, phone numbers, dates, names, file sizes).

package/patterns/form-patterns.md

@@ -1,5 +1,7 @@
 # Form Field Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Form patterns for semantic TextField types, PhoneInputField, AddressForm, react-hook-form + Zod setup, register() vs Controller, edit forms, submission patterns.
 
 **When to Read**: Before creating or modifying forms.

package/patterns/integration-testing-checklist.md

@@ -1,5 +1,7 @@
 # Integration Testing Checklist
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Router contract verification, pre-test writing steps, test templates, common anti-patterns, prevention system.
 
 **When to Read**: Before writing integration tests.

package/patterns/security-patterns.md

@@ -1,5 +1,7 @@
 # Security Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Security patterns for credential management, authentication, and code safety.
 
 **When to Read**: Before handling secrets, authentication, or security-sensitive code.

package/patterns/testing-patterns.md

@@ -1,5 +1,7 @@
 # Testing Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Testing pyramid, patterns, and best practices for unit, integration, and E2E tests.
 
 **When to Read**: Before writing tests, setting up test infrastructure, or debugging test failures.

package/patterns/tool-routing.md

@@ -1,5 +1,7 @@
 # Tool Routing Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Decision trees for selecting the correct tool/MCP for browser automation, Google services, and code search.
 
 **When to Read**: Before using any browser automation, Google service, or code search tool.

package/patterns/ui-patterns.md

@@ -1,5 +1,7 @@
 # UI Patterns
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Layout, theming, component selection, and UI quality standards.
 
 **When to Read**: Before creating or modifying UI components, pages, or styles.

package/protocols/plan-implementation.md

@@ -1,5 +1,7 @@
 # Plan Implementation Protocol
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 **Purpose**: Unified protocol for implementing and auditing multi-step plans. Merges Plan Implementation, Plan Audit, and Pre-Completion protocols.
 
 **When to Read**: When implementing any multi-step plan, before claiming a plan is complete.