@massu/core 2.5.1 → 2.5.3

package/CHANGELOG.md

@@ -10,6 +10,246 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 > redistributed under the **Apache License 2.0**. Full license + NOTICE:
 > `packages/core/assets/embedder/MODEL-LICENSE`.
 
+## [2.5.3] - 2026-11-08
+
+### Added
+
+- **Installed commands and agents now match your stack, not massu's own.** massu detected a
+  project's stack correctly and then installed the same TypeScript-shaped command set into every
+  repository, so a Python project's checks ran `npm test` and `npx tsc --noEmit` against a tree
+  that has neither, found nothing, and reported clean. The shipped assets now render the
+  toolchain from `massu.config.yaml`: measured on a python-fastapi fixture, the 83 `npm test`
+  references became `pytest`, and `npx tsc --noEmit` became `mypy`. Stack capabilities are
+  resolved once and all 13 shipped templates are held to that contract.
+- **`paths.tests` config key.** About 25 assets told every project its tests belong in massu's
+  own `packages/core/src/__tests__/`. The test directory is now a config property. It is
+  optional, so every existing config keeps working.
+- **`{{> name}}` fragments in templates.** Block-level, stack-specific content (for example the
+  "where a new feature goes" section of `/massu-new-feature`) now lives in one shared body with a
+  per-stack fragment, instead of telling a FastAPI user to edit `tools.ts`.
+
+### Fixed
+
+- **`massu show-template` printed the raw template while the installer wrote rendered bytes.**
+  The diff the installer suggests (`diff <target> <(npx massu show-template <base>)`) therefore
+  reported differences that did not exist. It now prints what would be installed.
+- **The template-syntax README was silently dropped from every install since 1.3.0.** It
+  documents `{{variable.path}}` literally, the renderer tried to resolve it, and the error was
+  counted as "skipped" with exit 0. Documentation is no longer rendered.
+- **The knowledge index read about half of a project's canonical rules.** The CR-table parser's
+  `[^|]+` matched newlines, so in a three-column table each row consumed the next: 21 of 41
+  rules were indexed in this repository, for the life of the feature. Every row is now read.
+- **The fix detector cried wolf on English.** `auth`, `lock` and `rate.limit` matched inside
+  "author", "blocked" and "corporate_limits". Every heuristic is now word-bounded,
+  `method_name_correction` (which fired on any two differently named method calls) is retired,
+  and a numbered Markdown heading is no longer read as an incident title.
+- **The security gate flagged its own documentation.** `os.system() — shell injection risk`
+  fired on a comment quoting the call and on a test fixture holding it as a string. Python
+  content is now judged on code, not on prose that mentions the pattern.
+- **`corrections.md` has one owner.** Its filename, path and placement were rebuilt in five
+  places. One module now owns them, so a hook and the indexer cannot disagree about where it is.
+- **`zod` moves to 4 (GHSA-mrhx-c7xc-m3w5, high, covers every zod 3 release).** Config parsing is
+  unchanged. zod 4's `.default()` no longer parses its value, so every object-level config default
+  now uses `.prefault()`; without that, a section left out of `massu.config.yaml` would have come
+  back empty instead of filled with its defaults.
+- **Dependency advisories cleared** (`smol-toml` ^1.8.0, `vitest` ^4.1.12).
+- **The auto-learning Stop hook no longer counts keywords inside strings and comments, and no
+  longer repeats itself.** It matched fix keywords (`try`, `catch`, `raise`, …) against raw diff
+  text, so `"The catch"` in a Python string counted as error handling, and it re-read the working
+  tree on every Stop with no record of what it had already shown. One false positive repeated
+  after every reply until the file was committed. Added lines are now scored on their CODE spans by
+  a per-language lexer (`hooks/lib/code-spans.ts`: escapes, triple quotes, template literals,
+  block comments, regex literals), which the per-edit fix detector now shares. Languages without a
+  lexer are judged as before and named in the hook's debug output. The hook keeps a per-session
+  record of the matched lines it has shown and speaks again only when a new one appears. Diff file
+  headers (`--- a/src/error.ts`) are no longer scored as removed lines.
+
+- **The release ceremony contained a step it could not reach.** CR-64 makes a published
+  version immutable: once `X.Y.Z` is on npm, HEAD must be exactly the `vX.Y.Z` tag, so any
+  further commit at that version cannot be pushed. The ceremony nonetheless listed the
+  `.mcp.json` pin update (step 8) and the master-plan row (step 10) *after* `npm publish`
+  (step 6) — two commits at a version that forbids commits. Unreachable by construction, and
+  only visible at the moment someone tried to perform them.
+
+  The step order now matches what has always actually worked: every repository commit lands
+  first, the tag is placed at the final tip, and publishing happens last. Nothing about the
+  invariant changed; the written order was wrong.
+
+- **`.mcp.json` pin drift is now caught on the commit that causes it, not at the next
+  release.** A drive-by edit in an unrelated commit had replaced the pin with a machine-local
+  path and a stale version, breaking the publish path for two days while every commit, push
+  and CI run stayed green — the only check that catches it runs at publish time.
+
+## [2.5.2] - 2026-08-14
+
+### Fixed
+
+- **The code-intelligence index was empty, and an empty index looked exactly like a project
+  with no imports.** Ten places across seven modules each answered "where does this project's
+  source live?" with the literal `src/`. In any layout that is not single-package every one of
+  them matched nothing: the import index consumed **0 of 1266** indexed files, the page index
+  found **0 of 69** real pages, cross-domain analysis saw one package of four, and two hooks
+  exited silently on every edit and every deletion. Nothing reported it, because a builder that
+  reads no rows returns `0` and the caller prints that as a normal result.
+
+  The layout now declares itself in `massu.config.yaml` and every consumer asks one module.
+  Everything is derived from declarations that already existed — `paths.source`,
+  `paths.monorepo_roots`, `framework.languages.*.source_dirs`, `paths.pages`,
+  `paths.components` — and one definition feeds both the SQL predicates and the in-JS path
+  guards, so widening a query cannot leave its recursion guard behind. A builder whose declared
+  source dirs match **0 rows of a non-empty** file table now raises an error naming the
+  denominator, the declaration, and the prefixes actually present. The contract is `0-of-N`,
+  never `0`: a repo with an empty or not-yet-built index legitimately matches nothing and must
+  not trip it.
+
+  Measured after, on the same corpus: 1128 of 1266 files consumed, 1096 import edges where the
+  table had been empty, 69 pages indexed, and every downstream read site non-empty.
+
+- **A failed knowledge re-index was indistinguishable from a successful one.** The helper that
+  refreshes the markdown corpus caught every exception without binding it and returned a boolean
+  the only call site discarded. A corrupt database, a permissions error and a search-index
+  failure therefore produced byte-identical output to a healthy rebuild: the tool answered from
+  whatever the index held before and said nothing.
+
+  The error is now bound and recorded, and a failed refresh prepends a notice to the response so
+  the caller knows the answer may be stale. Loud is not fatal — the tool still answers from the
+  index it has, because turning a degradation into an outage for all twelve knowledge tools is
+  what the "degrade gracefully" contract exists to avoid.
+
+  The rebuild itself is no longer a side effect of dispatching. It cost 677 documents / 11,954
+  chunks on any file-modification under four scanned roots, and no caller had asked for it;
+  callers now state their intent explicitly, with no default, so an unrequested full rebuild
+  cannot happen by omission.
+
+- **The session-end fix reminder fired on other sessions' work, and could not be discharged.**
+  Three defects compounded. Documentation was excluded from two of the three git reads but not
+  from the one whose text is actually scored, so the exclusion held only when a diff was
+  documentation-only — change any code file and prose was scored as code again. The diff was
+  read over the whole working tree with no notion of who made the changes, so on a machine where
+  several sessions hold one repository at once the reminder routinely demanded an artifact for
+  work the blocked session had not done. And the `autoLearning.fixDetection.enabled` switch,
+  which reads as the control for fix detection, never reached this reminder at all.
+
+  All three git reads now carry the documentation exclusion; the scan is intersected with files
+  the acting session actually touched, including the body read and not merely the gate; and the
+  switch gates both halves. When the actor cannot be established the reminder stays **silent** —
+  a demand that no legal action can discharge is one people route around, after which nothing is
+  enforced. The verdict carries a reason and a scanned-file count, so a negative result is never
+  an unexplained silence.
+
+- **The reality gate's hook check was red forever, and the only way to green it was to
+  destroy its own evidence.** R-3 failed on the LIFETIME row count of
+  `.massu/hook-failures.jsonl`, an append-only log retained on purpose. From the first
+  failure ever recorded the gate stayed red permanently — at 11,116 rows it had long since
+  stopped carrying information, and a gate whose sole remedy is deleting its input is one
+  people learn to route around.
+
+  The predicate is now RECENCY: the check fails when a failure lies inside a bounded window
+  (default 24h, `MASSU_HOOK_FAILURE_WINDOW_HOURS`) and names the offending row's timestamp
+  and hook, while the historical backlog is reported as context and never truncated. The
+  denominator prints on every run, so "scanned 0 rows, found 0 failures" can never be
+  mistaken for a clean log.
+
+  An absent log is no longer collapsed into either answer. It is corroborated against the
+  independent `hook_health` table the same writer populates: rows there prove failures were
+  recorded in this checkout, so a missing file means the evidence was destroyed and the gate
+  fails; no rows means there is nothing to measure and the check skips with the reason
+  named. Treating absence as an error — as originally specified — would have made the
+  nightly gate permanently red in CI, where the log is gitignored, and on every fresh
+  install, where it is created lazily on first failure.
+
+  Not a package change: `scripts/` is not in the published `files` array.
+  Plan `plan-2026-08-11-hook-failure-signal-truthfulness`.
+
+- **The release verifier reported FAIL on a publish that had fully succeeded.** It slept two
+  seconds, read the npm registry once, and treated "the replica has not caught up" and "the
+  publish did not land" as the same answer. npm is read-after-write eventually consistent, so
+  both states produce the identical value.
+
+  This is the blind-gate law with the polarity flipped: usually absence reads as PASS, here it
+  read as FAIL — the same defect, a check that cannot distinguish *not yet* from *not ever*.
+  The flipped polarity is what makes it dangerous, because a false FAIL on a release tool
+  invites a re-publish or a version bump against a registry where versions are immutable.
+
+  Replaced with a deadline-bounded poll (90s, 3s interval, overridable) that reports how long
+  it waited and, on failure, states plainly that the absence is not propagation lag. The
+  demand itself was correct and is unchanged — `+ @massu/core@x.y.z` on stdout is not a
+  receipt; only the timeout was wrong.
+
+  Not a package change: `scripts/` is not in the published `files` array.
+
+- **`require()` of a TypeScript specifier held CI red in both repos for two days.** A
+  `require()` is resolved by whatever loader is running — not by `tsc`, and not by the vitest
+  transform. Node only gained require-of-TypeScript in 22.18; `packages/core` declares
+  `engines.node >= 22.16.0` and CI pins exactly that floor, so three such calls in
+  `hooks-stdout-convention.test.ts` passed on a Node 26 dev machine and threw
+  `SyntaxError: Unexpected identifier 'as'` on every runner. Replaced with a static ESM import
+  and guarded by a new drift-guard, which is a static property of the source and so goes red on
+  any Node version. A fourth call site in production code was found by enumerating the tree
+  rather than the failure, and stays: `require()` defers evaluation while a static import is
+  eager, and that laziness is what keeps a database load failure from silencing the hook-failure
+  signal it records.
+
+- **Publication to the public mirror now goes through a pull request.** A direct push to the
+  mirror's `main` cannot be gated by its required status checks — checks have not run on a
+  commit that does not exist yet — so every sync reported `Bypassed rule violations` and landed
+  regardless. That is what hid the above for two days. `scripts/ops/publish-public-mirror.sh`
+  derives the required contexts from the live ruleset, polls each to a deadline, treats a
+  cancelled or missing verdict as *not* a pass, and merges by rebase only when every one is
+  SUCCESS. It enforces the verdict itself rather than relying on the ruleset, because the
+  ruleset grants the pushing account a standing bypass.
+
+- **A bcrypt cost factor was a wall-clock budget in disguise.** `generateApiKey()` hashes at
+  cost 12 — ~350ms of deliberate CPU — in three tests that do not test hashing, which blew
+  vitest's 5000ms timeout under the concurrent coverage run while passing in isolation. Lowering
+  the cost factor would have been a security regression with nothing in the tree to catch it, so
+  `BCRYPT_COST` is now named and the property is asserted directly: the configured cost reaches
+  bcrypt, with the full key and never the plaintext-stored prefix.
+
+- **Importing any of 18 hook modules executed the hook.** A bare `main()` at module scope means
+  importing the module reads stdin, does its work, and exits the host process. Enumerating the
+  tree found 15 with no guard and 2 more guarded by a filename suffix — invisible to a sweep for
+  "unguarded", and disarmed silently by a rename. All 18 now share one
+  `isDirectInvocation(import.meta.url)` helper, proven behaviourally against the built bundles.
+
+- **A live destructive-path defect was hiding behind a permanently-red CI job.** Three sites in a
+  test harness widened to the filesystem root when a variable was empty, one of them under the
+  memory-store tree. The guard had been reporting it correctly on every run for long enough that
+  its redness stopped carrying information. Destructive paths there now go through a chokepoint
+  that cannot express the unsafe form. (Plan
+  `plan-2026-08-08-incident-coverage-range-discharge`: the CR-62 linkage ratchet shipped
+  2026-08-09 gains its real-history differential, which shows all 10 post-ratchet obligated
+  commits discharging via containment or citation and none via the legacy fallback.)
+
+  None of these are package changes: `scripts/` and `__tests__/` are not in the published
+  `files` array, and `website/` is not published.
+
+- **`massu watch` could start a file watcher that was dead for its entire lifetime.** chokidar
+  can return a watcher that emits `ready`, emits no `error`, and then delivers nothing, ever.
+  Interleaved A/B in a single load window: fsevents **8 of 60** dead against **0 of 60** for the
+  same directories with polling (Fisher's exact ≈ 0.006). The consequence for a user is silent
+  staleness — `.claude/` stops refreshing, `massu watch --status` looks healthy, and nothing is
+  logged. Nothing in the daemon would ever have noticed: its only reconcile trigger was a tick
+  gap over 30s, whose predicate is *"did the clock jump?"* while the property is *"might we have
+  missed events?"*, and a watcher dead from birth produces no tick gap at all.
+
+  The tick now writes a sentinel the watcher itself must echo back. Silence is treated as death:
+  log loudly, reconcile, and after two consecutive dead intervals close and re-watch. Escalation
+  fires on powers of two of the dead streak, so a permanently dead watcher cannot trade a
+  silent-staleness bug for a full refresh plus a watcher rebuild every ten seconds forever.
+  Polling was rejected as the fix — it trades a correctness bug for a battery-life bug.
+
+  Two constants here are claims about the outside world and were measured rather than assumed.
+  The canary shares ONE recursive FSEvents stream with the watched source directories (verified
+  by recording the paths streams are actually opened on — a canary on its own stream could have
+  been alive while the source watcher was dead), and its grace floor is set from measured echo
+  latency: ~48ms median, but a tail to 941ms under contention.
+  `scripts/ops/measure-canary-echo-latency.mjs` ships so the number can be re-checked instead of
+  trusted. Plan `plan-2026-08-12-watch-daemon-silent-dead-watcher`.
+
+  This one IS a package change: `packages/core/src/watch/daemon.ts` and the new
+  `packages/core/src/watch/canary.ts` are published.
+
 ## [2.5.1] - 2026-08-09
 
 ### Fixed

package/agents/massu-output-scorer.md

@@ -73,7 +73,7 @@ Input: List of files changed, plan document path, feature description.
 #### Dimension 5: Test Coverage
 - Check: test files exist for new features
 - Check: critical paths have test coverage
-- Run `npm test` to verify passing
+- Run `{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}` to verify passing
 - 1=no tests, 3=basic tests pass, 5=comprehensive coverage
 
 ### Step 3: Generate Scorecard
@@ -86,7 +86,7 @@ Input: List of files changed, plan document path, feature description.
 | Pattern Compliance | X/5 | pattern-scanner exit code | |
 | Error Handling | X/5 | [grep results for error states] | |
 | UX Quality | X/5 | [responsive/a11y checks] | |
-| Test Coverage | X/5 | npm test result | |
+| Test Coverage | X/5 | {{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} result | |
 
 ### Summary
 - Average: X.X/5

package/agents/massu-plan-auditor.md

@@ -129,7 +129,7 @@ grep -rn "[old-pattern]" src/
 ### Step 7: Pattern Compliance
 ```bash
 ./scripts/pattern-scanner.sh
-npx tsc --noEmit
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}
 ```
 
 ### Step 8: Generate Structured Audit Report

package/commands/_shared-references/test-first-protocol.md

@@ -40,7 +40,7 @@ it('should serialize BigInt fields to Number', () => {
 Run the test and confirm it fails for the expected reason:
 
 ```bash
-npm test -- -t "should serialize BigInt"
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} -- -t "should serialize BigInt"
 # Expected: FAIL with the specific assertion error
 # Note: This project uses Vitest. Use -t (--testNamePattern) for filtering, NOT --grep.
 ```
@@ -57,14 +57,14 @@ Now fix the source code. The fix should be minimal and targeted.
 ### Step 4: Verify Test Passes
 
 ```bash
-npm test -- -t "should serialize BigInt"
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} -- -t "should serialize BigInt"
 # Expected: PASS
 ```
 
 Run the full test suite to check for regressions:
 
 ```bash
-npm test
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}
 # Expected: ALL pass
 ```
 
@@ -77,7 +77,7 @@ TEST-FIRST PROTOCOL for: [finding description]
   Step 1: Test written → [file:line]
   Step 2: Test fails → [error message confirming the bug]
   Step 3: Fix applied → [file:line, description]
-  Step 4: Test passes → [npm test output showing pass]
+  Step 4: Test passes → [{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} output showing pass]
   TEST_FIRST_GATE: PASS
 ```
 

package/commands/_shared-references/verification-table.md

@@ -10,9 +10,9 @@
 
 | Type | Command | Expected | Use When |
 |------|---------|----------|----------|
-| VR-BUILD | `npm run build` | Exit 0 | Claiming production ready |
-| VR-TYPE | `npx tsc --noEmit` | 0 errors | Claiming type safety |
-| VR-TEST | `npm test` | ALL pass (MANDATORY) | ALWAYS before claiming complete |
+| VR-BUILD | `{{verify.build | default("(this stack declares no build step)")}}` | Exit 0 | Claiming production ready |
+| VR-TYPE | `{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}` | 0 errors | Claiming type safety |
+| VR-TEST | `{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}` | ALL pass (MANDATORY) | ALWAYS before claiming complete |
 | VR-SCHEMA-PRE | `SELECT column_name FROM information_schema.columns WHERE table_name = 'X'` | All columns exist | BEFORE writing ANY query |
 | VR-NEGATIVE | `grep -rn "[old]" src/` | 0 matches | Claiming removal |
 | VR-GREP | `grep "[pattern]" [file]` | Match found | Claiming code added |
@@ -35,8 +35,8 @@
 | Gate | Command | Must |
 |------|---------|------|
 | 1. Pattern Scanner | `./scripts/pattern-scanner.sh` | Exit 0 |
-| 2. Type Safety | `npx tsc --noEmit` | 0 errors |
-| 3. Build | `npm run build` | Exit 0 |
+| 2. Type Safety | `{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}` | 0 errors |
+| 3. Build | `{{verify.build | default("(this stack declares no build step)")}}` | Exit 0 |
 | 4. Lint | `npm run lint` | Exit 0 |
 | 5. Schema | `npx prisma validate` | Exit 0 |
 | 6. Secrets Staged | `git diff --cached --name-only \| grep -E '\.(env\|pem\|key\|secret)'` | 0 files |

package/commands/massu-audit-deps.md

@@ -144,8 +144,8 @@ cat package.json | node -e "
 ```bash
 # Check if each dependency is actually imported in source
 for dep in $(node -e "const p=require('./package.json'); Object.keys(p.dependencies||{}).forEach(d=>console.log(d))"); do
-  count=$(grep -rn "from ['\"]$dep" packages/core/src/ --include="*.ts" 2>/dev/null | wc -l | tr -d ' ')
-  count2=$(grep -rn "require(['\"]$dep" packages/core/src/ --include="*.ts" 2>/dev/null | wc -l | tr -d ' ')
+  count=$(grep -rn "from ['\"]$dep" {{paths.source}}/ --include="*.ts" 2>/dev/null | wc -l | tr -d ' ')
+  count2=$(grep -rn "require(['\"]$dep" {{paths.source}}/ --include="*.ts" 2>/dev/null | wc -l | tr -d ' ')
   total=$((count + count2))
   if [ "$total" -eq 0 ]; then
     echo "UNUSED: $dep (0 imports found)"

package/commands/massu-batch.md

@@ -191,7 +191,7 @@ FOR each batch (IN PARALLEL):
       After ALL files are modified:
       7. Run: ./scripts/pattern-scanner.sh --single-file [file] for each changed file
       8. If pattern-scanner finds violations, fix them
-      9. Run: NODE_OPTIONS='--max-old-space-size=8192' npx tsc --noEmit
+      9. Run: NODE_OPTIONS='--max-old-space-size=8192' {{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}
       10. If tsc finds errors in your changed files, fix them
 
       ## Output Format (MANDATORY)
@@ -240,10 +240,10 @@ Run on the consolidated result:
 ./scripts/pattern-scanner.sh
 
 # Full type check
-NODE_OPTIONS="--max-old-space-size=8192" npx tsc --noEmit
+NODE_OPTIONS="--max-old-space-size=8192" {{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}
 
 # Build check
-npm run build
+{{verify.build | default("(this stack declares no build step)")}}
 ```
 
 ### Step 8: Output Structured Result

package/commands/massu-checkpoint.md

@@ -265,16 +265,16 @@ Then manual checks (all expect 0):
 ### Step 6: RUN Build Verification (VR-BUILD)
 
 ```bash
-npm run build
+{{verify.build | default("(this stack declares no build step)")}}
 ```
 
 ### Step 6.5: Additional Verification Gates
 
 ```bash
-npx tsc --noEmit        # VR-TYPE: 0 errors
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}        # VR-TYPE: 0 errors
 npm run lint             # VR-LINT: Exit 0
 npx prisma validate     # VR-SCHEMA-VALIDATE: Exit 0
-npm test                # VR-TEST: MANDATORY, ALL pass
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}                # VR-TEST: MANDATORY, ALL pass
 ./scripts/pre-deploy-check.sh 2>/dev/null || echo "No pre-deploy script"
 ```
 
@@ -282,10 +282,10 @@ npm test                # VR-TEST: MANDATORY, ALL pass
 ### Additional Gates
 | Gate | Command | Result | Status |
 |------|---------|--------|--------|
-| Type Safety | npx tsc --noEmit | 0 errors | PASS/FAIL |
+| Type Safety | {{verify.type | default("declare verification.LANG.type in massu.config.yaml")}} | 0 errors | PASS/FAIL |
 | Lint | npm run lint | Exit 0 | PASS/FAIL |
 | Prisma Validate | npx prisma validate | Valid | PASS/FAIL |
-| Tests | npm test | ALL Pass | PASS/FAIL |
+| Tests | {{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} | ALL Pass | PASS/FAIL |
 | Pre-deploy | pre-deploy-check.sh | Pass/N/A | PASS/FAIL/N/A |
 ```
 
@@ -566,9 +566,9 @@ Checkpoint MUST abort if: pattern scanner fails, security violation detected, bu
 ## PARALLEL EXECUTION
 
 Independent checks can run simultaneously via Task agents:
-- Agent 1: `npx tsc --noEmit`
+- Agent 1: `{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}`
 - Agent 2: `./scripts/pattern-scanner.sh`
-- Agent 3: `npm run build`
+- Agent 3: `{{verify.build | default("(this stack declares no build step)")}}`
 - Agent 4: `npm run test:run`
 
 ---

package/commands/massu-ci-fix.md

@@ -59,7 +59,7 @@ Map the failure to a known pattern:
 2. Run the same check locally to verify:
    ```bash
    # Run the specific check that failed
-   npm run build  # or whatever CI step failed
+   {{verify.build | default("(this stack declares no build step)")}}  # or whatever CI step failed
    ```
 3. Verify fix passes locally
 

package/commands/massu-cleanup.md

@@ -48,7 +48,7 @@ Capture the behavioral baseline BEFORE making any changes:
 ### 1a. Test Baseline
 
 ```bash
-npm test 2>&1
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} 2>&1
 ```
 
 Record:
@@ -64,7 +64,7 @@ Record:
 ### 1b. Type Check Baseline
 
 ```bash
-cd packages/core && npx tsc --noEmit 2>&1
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}} 2>&1
 ```
 
 Record:
@@ -90,20 +90,20 @@ Scan all categories in parallel. Do NOT remove anything yet.
 
 ```bash
 # TypeScript unused imports (ts error 6133)
-cd packages/core && npx tsc --noEmit 2>&1 | grep "is declared but"
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}} 2>&1 | grep "is declared but"
 
 # ESLint-style: imports never referenced in file body
-grep -rn "^import" packages/core/src/ --include="*.ts" | head -50
+grep -rn "^import" {{paths.source}}/ --include="*.ts" | head -50
 ```
 
 ### 2b. Dead Exports
 
 ```bash
 # Exported symbols with zero external references
-grep -rn "^export " packages/core/src/ --include="*.ts" | grep -v "__tests__" | while IFS=: read file line content; do
+grep -rn "^export " {{paths.source}}/ --include="*.ts" | grep -v "__tests__" | while IFS=: read file line content; do
   name=$(echo "$content" | grep -oP '(?<=export (function|const|class|type|interface|enum) )\w+' | head -1)
   if [ -n "$name" ]; then
-    count=$(grep -rn "$name" packages/core/src/ --include="*.ts" | grep -v "^$file:" | grep -v "__tests__" | wc -l)
+    count=$(grep -rn "$name" {{paths.source}}/ --include="*.ts" | grep -v "^$file:" | grep -v "__tests__" | wc -l)
     if [ "$count" -eq 0 ]; then
       echo "DEAD EXPORT: $name in $file"
     fi
@@ -121,7 +121,7 @@ for f in packages/core/src/*.ts; do
   if [[ "$base" == "server" || "$base" == "index" || "$f" == *"__tests__"* ]]; then
     continue
   fi
-  count=$(grep -rn "from.*['\"]\./${base}" packages/core/src/ --include="*.ts" | grep -v "__tests__" | wc -l)
+  count=$(grep -rn "from.*['\"]\./${base}" {{paths.source}}/ --include="*.ts" | grep -v "__tests__" | wc -l)
   if [ "$count" -eq 0 ]; then
     echo "POSSIBLY ORPHANED: $f"
   fi
@@ -135,15 +135,15 @@ done
 cat packages/core/package.json | grep -A 50 '"dependencies"'
 
 # Check each dependency usage
-grep -rn "from.*'better-sqlite3'\|require.*better-sqlite3" packages/core/src/ --include="*.ts" | wc -l
-grep -rn "from.*'yaml'\|require.*yaml" packages/core/src/ --include="*.ts" | wc -l
+grep -rn "from.*'better-sqlite3'\|require.*better-sqlite3" {{paths.source}}/ --include="*.ts" | wc -l
+grep -rn "from.*'yaml'\|require.*yaml" {{paths.source}}/ --include="*.ts" | wc -l
 ```
 
 ### 2e. TODO/FIXME/HACK Comments
 
 ```bash
 # Enumerate all stale markers — informational only (no auto-removal)
-grep -rn "TODO\|FIXME\|HACK\|XXX\|DEPRECATED" packages/core/src/ --include="*.ts" | grep -v "__tests__"
+grep -rn "TODO\|FIXME\|HACK\|XXX\|DEPRECATED" {{paths.source}}/ --include="*.ts" | grep -v "__tests__"
 ```
 
 ---
@@ -180,9 +180,9 @@ CLEANUP LOOP:
     1. Select all REMOVE items in this category
     2. Apply removals
     3. Run type check:
-         cd packages/core && npx tsc --noEmit 2>&1
+         {{verify.type | default("declare verification.LANG.type in massu.config.yaml")}} 2>&1
     4. Run tests:
-         npm test 2>&1
+         {{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} 2>&1
     5. Compare against baseline:
          - Type errors must be <= baseline
          - Passing tests must be >= baseline
@@ -218,11 +218,11 @@ For every removed item, confirm it is gone:
 
 ```bash
 # Unused import removed
-grep -rn "[import_name]" packages/core/src/ --include="*.ts"
+grep -rn "[import_name]" {{paths.source}}/ --include="*.ts"
 # MUST return 0 matches (or only in unrelated contexts)
 
 # Dead export removed
-grep -rn "export.*[export_name]" packages/core/src/ --include="*.ts"
+grep -rn "export.*[export_name]" {{paths.source}}/ --include="*.ts"
 # MUST return 0 matches
 
 # Orphaned file removed
@@ -253,13 +253,13 @@ bash scripts/massu-pattern-scanner.sh
 
 ### Gate 2: Type Check (VR-TYPE)
 ```bash
-cd packages/core && npx tsc --noEmit
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}
 # MUST show 0 errors (or <= baseline)
 ```
 
 ### Gate 3: All Tests (VR-TEST)
 ```bash
-npm test
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}
 # MUST exit 0, all tests pass
 ```
 

package/commands/massu-commit.md

@@ -64,7 +64,7 @@ grep -n "name:" packages/core/src/[module]-tools.ts
 grep -n "case " packages/core/src/[module]-tools.ts
 
 # Verify config keys match getConfig() usage
-grep -rn "getConfig()" packages/core/src/ | head -20
+grep -rn "getConfig()" {{paths.source}}/ | head -20
 ```
 
 ---
@@ -276,13 +276,13 @@ bash scripts/massu-pattern-scanner.sh
 
 ### Gate 2: Type Safety (VR-TYPE)
 ```bash
-cd packages/core && npx tsc --noEmit
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}
 # MUST show 0 errors
 ```
 
 ### Gate 3: All Tests Pass (VR-TEST)
 ```bash
-npm test
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}
 # MUST exit 0, all vitest tests pass
 ```
 
@@ -306,9 +306,9 @@ echo "PASS: No secrets staged"
 
 ### Gate 7: Security - No Credentials in Code
 ```bash
-# Check packages/core/src/ for hardcoded credentials
+# Check {{paths.source}}/ for hardcoded credentials
 grep -rn 'sk-[a-zA-Z0-9]\{20,\}\|password.*=.*["\x27][^"\x27]\{8,\}' --include="*.ts" --include="*.tsx" \
-  packages/core/src/ 2>/dev/null \
+  {{paths.source}}/ 2>/dev/null \
   | grep -v "process.env" \
   | grep -v 'RegExp\|regex\|REDACT\|redact\|sanitize\|mask' \
   | grep -v '\.test\.ts:' \
@@ -355,7 +355,7 @@ npm audit --audit-level=high  # 0 high/critical vulnerabilities
 |------|---------|--------|--------|
 | 1. Pattern Scanner | massu-pattern-scanner.sh | Exit [X] | PASS/FAIL |
 | 2. Type Safety | tsc --noEmit | [X] errors | PASS/FAIL |
-| 3. Tests | npm test | [X] pass, [X] fail | PASS/FAIL |
+| 3. Tests | {{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} | [X] pass, [X] fail | PASS/FAIL |
 | 4. Hook Build | build:hooks | Exit [X] | PASS/FAIL |
 | 5. Generalization | massu-generalization-scanner.sh | Exit [X] | PASS/FAIL |
 | 6. No Secrets Staged | git diff --cached check | [result] | PASS/FAIL |
@@ -465,7 +465,7 @@ Analyze `git diff --cached --name-only` to determine scope:
 
 | Changed Files Location | Suggested Scope |
 |------------------------|-----------------|
-| All in `packages/core/src/` | `core` |
+| All in `{{paths.source}}/` | `core` |
 | All in `website/` | `website` |
 | All in `.claude/commands/` | `commands` |
 | All in `scripts/` | `tooling` |

package/commands/massu-create-plan.md

@@ -330,13 +330,13 @@ Proceed directly to PHASE 1 (Feature Understanding) as normal. Not every request
 
 ```bash
 # Search for similar features in codebase
-grep -rn "[feature_keyword]" packages/core/src/ --include="*.ts" | head -20
+grep -rn "[feature_keyword]" {{paths.source}}/ --include="*.ts" | head -20
 
 # Find similar tool modules
 ls -la packages/core/src/*-tools.ts
 
 # Find similar tests
-ls -la packages/core/src/__tests__/
+ls -la {{paths.tests | default("tests")}}/
 ```
 
 **Document findings:**
@@ -429,7 +429,7 @@ ls packages/core/src/__tests__/*.test.ts | wc -l
 
 ```bash
 # Check if target directories exist
-ls -la packages/core/src/
+ls -la {{paths.source}}/
 
 # Check if files to modify exist
 ls -la [file_path]
@@ -692,7 +692,7 @@ Update coverage map: mark D6, D7, D8, D10 as `done`.
 - **File**: packages/core/src/__tests__/[module].test.ts
 - **Action**: CREATE
 - **Covers**: Tool definitions, handlers, edge cases
-- **Verification**: VR-TEST (npm test)
+- **Verification**: VR-TEST ({{verify.test | default("declare verification.LANG.test in massu.config.yaml")}})
 
 ---
 
@@ -713,7 +713,7 @@ Update coverage map: mark D6, D7, D8, D10 as `done`.
 |------|------|---------------------|
 | P1-001 | MODULE | `ls -la packages/core/src/[module].ts` |
 | P1-002 | TOOL_WIRE | `grep "getXToolDefinitions" packages/core/src/tools.ts` |
-| P2-001 | TEST | `npm test` |
+| P2-001 | TEST | `{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}` |
 | P3-001 | CONFIG | Parse config without error |
 
 ---
@@ -780,8 +780,8 @@ Update coverage map: mark D6, D7, D8, D10 as `done`.
 #### Build Feasibility
 | Check | Command | Result | Status |
 |-------|---------|--------|--------|
-| TypeScript compiles | cd packages/core && npx tsc --noEmit | 0 errors | PASS/FAIL |
-| Tests pass | npm test | All pass | PASS/FAIL |
+| TypeScript compiles | {{verify.type | default("declare verification.LANG.type in massu.config.yaml")}} | 0 errors | PASS/FAIL |
+| Tests pass | {{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} | All pass | PASS/FAIL |
 | Hooks compile | cd packages/core && npm run build:hooks | Exit 0 | PASS/FAIL |
 
 **FEASIBILITY GATE: PASS / FAIL**