@massu/core 2.5.2 → 2.5.3

package/CHANGELOG.md

@@ -10,6 +10,76 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 > redistributed under the **Apache License 2.0**. Full license + NOTICE:
 > `packages/core/assets/embedder/MODEL-LICENSE`.
 
+## [2.5.3] - 2026-11-08
+
+### Added
+
+- **Installed commands and agents now match your stack, not massu's own.** massu detected a
+  project's stack correctly and then installed the same TypeScript-shaped command set into every
+  repository, so a Python project's checks ran `npm test` and `npx tsc --noEmit` against a tree
+  that has neither, found nothing, and reported clean. The shipped assets now render the
+  toolchain from `massu.config.yaml`: measured on a python-fastapi fixture, the 83 `npm test`
+  references became `pytest`, and `npx tsc --noEmit` became `mypy`. Stack capabilities are
+  resolved once and all 13 shipped templates are held to that contract.
+- **`paths.tests` config key.** About 25 assets told every project its tests belong in massu's
+  own `packages/core/src/__tests__/`. The test directory is now a config property. It is
+  optional, so every existing config keeps working.
+- **`{{> name}}` fragments in templates.** Block-level, stack-specific content (for example the
+  "where a new feature goes" section of `/massu-new-feature`) now lives in one shared body with a
+  per-stack fragment, instead of telling a FastAPI user to edit `tools.ts`.
+
+### Fixed
+
+- **`massu show-template` printed the raw template while the installer wrote rendered bytes.**
+  The diff the installer suggests (`diff <target> <(npx massu show-template <base>)`) therefore
+  reported differences that did not exist. It now prints what would be installed.
+- **The template-syntax README was silently dropped from every install since 1.3.0.** It
+  documents `{{variable.path}}` literally, the renderer tried to resolve it, and the error was
+  counted as "skipped" with exit 0. Documentation is no longer rendered.
+- **The knowledge index read about half of a project's canonical rules.** The CR-table parser's
+  `[^|]+` matched newlines, so in a three-column table each row consumed the next: 21 of 41
+  rules were indexed in this repository, for the life of the feature. Every row is now read.
+- **The fix detector cried wolf on English.** `auth`, `lock` and `rate.limit` matched inside
+  "author", "blocked" and "corporate_limits". Every heuristic is now word-bounded,
+  `method_name_correction` (which fired on any two differently named method calls) is retired,
+  and a numbered Markdown heading is no longer read as an incident title.
+- **The security gate flagged its own documentation.** `os.system() — shell injection risk`
+  fired on a comment quoting the call and on a test fixture holding it as a string. Python
+  content is now judged on code, not on prose that mentions the pattern.
+- **`corrections.md` has one owner.** Its filename, path and placement were rebuilt in five
+  places. One module now owns them, so a hook and the indexer cannot disagree about where it is.
+- **`zod` moves to 4 (GHSA-mrhx-c7xc-m3w5, high, covers every zod 3 release).** Config parsing is
+  unchanged. zod 4's `.default()` no longer parses its value, so every object-level config default
+  now uses `.prefault()`; without that, a section left out of `massu.config.yaml` would have come
+  back empty instead of filled with its defaults.
+- **Dependency advisories cleared** (`smol-toml` ^1.8.0, `vitest` ^4.1.12).
+- **The auto-learning Stop hook no longer counts keywords inside strings and comments, and no
+  longer repeats itself.** It matched fix keywords (`try`, `catch`, `raise`, …) against raw diff
+  text, so `"The catch"` in a Python string counted as error handling, and it re-read the working
+  tree on every Stop with no record of what it had already shown. One false positive repeated
+  after every reply until the file was committed. Added lines are now scored on their CODE spans by
+  a per-language lexer (`hooks/lib/code-spans.ts`: escapes, triple quotes, template literals,
+  block comments, regex literals), which the per-edit fix detector now shares. Languages without a
+  lexer are judged as before and named in the hook's debug output. The hook keeps a per-session
+  record of the matched lines it has shown and speaks again only when a new one appears. Diff file
+  headers (`--- a/src/error.ts`) are no longer scored as removed lines.
+
+- **The release ceremony contained a step it could not reach.** CR-64 makes a published
+  version immutable: once `X.Y.Z` is on npm, HEAD must be exactly the `vX.Y.Z` tag, so any
+  further commit at that version cannot be pushed. The ceremony nonetheless listed the
+  `.mcp.json` pin update (step 8) and the master-plan row (step 10) *after* `npm publish`
+  (step 6) — two commits at a version that forbids commits. Unreachable by construction, and
+  only visible at the moment someone tried to perform them.
+
+  The step order now matches what has always actually worked: every repository commit lands
+  first, the tag is placed at the final tip, and publishing happens last. Nothing about the
+  invariant changed; the written order was wrong.
+
+- **`.mcp.json` pin drift is now caught on the commit that causes it, not at the next
+  release.** A drive-by edit in an unrelated commit had replaced the pin with a machine-local
+  path and a stale version, breaking the publish path for two days while every commit, push
+  and CI run stayed green — the only check that catches it runs at publish time.
+
 ## [2.5.2] - 2026-08-14
 
 ### Fixed

package/agents/massu-output-scorer.md

@@ -73,7 +73,7 @@ Input: List of files changed, plan document path, feature description.
 #### Dimension 5: Test Coverage
 - Check: test files exist for new features
 - Check: critical paths have test coverage
-- Run `npm test` to verify passing
+- Run `{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}` to verify passing
 - 1=no tests, 3=basic tests pass, 5=comprehensive coverage
 
 ### Step 3: Generate Scorecard
@@ -86,7 +86,7 @@ Input: List of files changed, plan document path, feature description.
 | Pattern Compliance | X/5 | pattern-scanner exit code | |
 | Error Handling | X/5 | [grep results for error states] | |
 | UX Quality | X/5 | [responsive/a11y checks] | |
-| Test Coverage | X/5 | npm test result | |
+| Test Coverage | X/5 | {{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} result | |
 
 ### Summary
 - Average: X.X/5

package/agents/massu-plan-auditor.md

@@ -129,7 +129,7 @@ grep -rn "[old-pattern]" src/
 ### Step 7: Pattern Compliance
 ```bash
 ./scripts/pattern-scanner.sh
-npx tsc --noEmit
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}
 ```
 
 ### Step 8: Generate Structured Audit Report

package/commands/_shared-references/test-first-protocol.md

@@ -40,7 +40,7 @@ it('should serialize BigInt fields to Number', () => {
 Run the test and confirm it fails for the expected reason:
 
 ```bash
-npm test -- -t "should serialize BigInt"
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} -- -t "should serialize BigInt"
 # Expected: FAIL with the specific assertion error
 # Note: This project uses Vitest. Use -t (--testNamePattern) for filtering, NOT --grep.
 ```
@@ -57,14 +57,14 @@ Now fix the source code. The fix should be minimal and targeted.
 ### Step 4: Verify Test Passes
 
 ```bash
-npm test -- -t "should serialize BigInt"
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} -- -t "should serialize BigInt"
 # Expected: PASS
 ```
 
 Run the full test suite to check for regressions:
 
 ```bash
-npm test
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}
 # Expected: ALL pass
 ```
 
@@ -77,7 +77,7 @@ TEST-FIRST PROTOCOL for: [finding description]
   Step 1: Test written → [file:line]
   Step 2: Test fails → [error message confirming the bug]
   Step 3: Fix applied → [file:line, description]
-  Step 4: Test passes → [npm test output showing pass]
+  Step 4: Test passes → [{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} output showing pass]
   TEST_FIRST_GATE: PASS
 ```
 

package/commands/_shared-references/verification-table.md

@@ -10,9 +10,9 @@
 
 | Type | Command | Expected | Use When |
 |------|---------|----------|----------|
-| VR-BUILD | `npm run build` | Exit 0 | Claiming production ready |
-| VR-TYPE | `npx tsc --noEmit` | 0 errors | Claiming type safety |
-| VR-TEST | `npm test` | ALL pass (MANDATORY) | ALWAYS before claiming complete |
+| VR-BUILD | `{{verify.build | default("(this stack declares no build step)")}}` | Exit 0 | Claiming production ready |
+| VR-TYPE | `{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}` | 0 errors | Claiming type safety |
+| VR-TEST | `{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}` | ALL pass (MANDATORY) | ALWAYS before claiming complete |
 | VR-SCHEMA-PRE | `SELECT column_name FROM information_schema.columns WHERE table_name = 'X'` | All columns exist | BEFORE writing ANY query |
 | VR-NEGATIVE | `grep -rn "[old]" src/` | 0 matches | Claiming removal |
 | VR-GREP | `grep "[pattern]" [file]` | Match found | Claiming code added |
@@ -35,8 +35,8 @@
 | Gate | Command | Must |
 |------|---------|------|
 | 1. Pattern Scanner | `./scripts/pattern-scanner.sh` | Exit 0 |
-| 2. Type Safety | `npx tsc --noEmit` | 0 errors |
-| 3. Build | `npm run build` | Exit 0 |
+| 2. Type Safety | `{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}` | 0 errors |
+| 3. Build | `{{verify.build | default("(this stack declares no build step)")}}` | Exit 0 |
 | 4. Lint | `npm run lint` | Exit 0 |
 | 5. Schema | `npx prisma validate` | Exit 0 |
 | 6. Secrets Staged | `git diff --cached --name-only \| grep -E '\.(env\|pem\|key\|secret)'` | 0 files |

package/commands/massu-audit-deps.md

@@ -144,8 +144,8 @@ cat package.json | node -e "
 ```bash
 # Check if each dependency is actually imported in source
 for dep in $(node -e "const p=require('./package.json'); Object.keys(p.dependencies||{}).forEach(d=>console.log(d))"); do
-  count=$(grep -rn "from ['\"]$dep" packages/core/src/ --include="*.ts" 2>/dev/null | wc -l | tr -d ' ')
-  count2=$(grep -rn "require(['\"]$dep" packages/core/src/ --include="*.ts" 2>/dev/null | wc -l | tr -d ' ')
+  count=$(grep -rn "from ['\"]$dep" {{paths.source}}/ --include="*.ts" 2>/dev/null | wc -l | tr -d ' ')
+  count2=$(grep -rn "require(['\"]$dep" {{paths.source}}/ --include="*.ts" 2>/dev/null | wc -l | tr -d ' ')
   total=$((count + count2))
   if [ "$total" -eq 0 ]; then
     echo "UNUSED: $dep (0 imports found)"

package/commands/massu-batch.md

@@ -191,7 +191,7 @@ FOR each batch (IN PARALLEL):
       After ALL files are modified:
       7. Run: ./scripts/pattern-scanner.sh --single-file [file] for each changed file
       8. If pattern-scanner finds violations, fix them
-      9. Run: NODE_OPTIONS='--max-old-space-size=8192' npx tsc --noEmit
+      9. Run: NODE_OPTIONS='--max-old-space-size=8192' {{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}
       10. If tsc finds errors in your changed files, fix them
 
       ## Output Format (MANDATORY)
@@ -240,10 +240,10 @@ Run on the consolidated result:
 ./scripts/pattern-scanner.sh
 
 # Full type check
-NODE_OPTIONS="--max-old-space-size=8192" npx tsc --noEmit
+NODE_OPTIONS="--max-old-space-size=8192" {{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}
 
 # Build check
-npm run build
+{{verify.build | default("(this stack declares no build step)")}}
 ```
 
 ### Step 8: Output Structured Result

package/commands/massu-checkpoint.md

@@ -265,16 +265,16 @@ Then manual checks (all expect 0):
 ### Step 6: RUN Build Verification (VR-BUILD)
 
 ```bash
-npm run build
+{{verify.build | default("(this stack declares no build step)")}}
 ```
 
 ### Step 6.5: Additional Verification Gates
 
 ```bash
-npx tsc --noEmit        # VR-TYPE: 0 errors
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}        # VR-TYPE: 0 errors
 npm run lint             # VR-LINT: Exit 0
 npx prisma validate     # VR-SCHEMA-VALIDATE: Exit 0
-npm test                # VR-TEST: MANDATORY, ALL pass
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}                # VR-TEST: MANDATORY, ALL pass
 ./scripts/pre-deploy-check.sh 2>/dev/null || echo "No pre-deploy script"
 ```
 
@@ -282,10 +282,10 @@ npm test                # VR-TEST: MANDATORY, ALL pass
 ### Additional Gates
 | Gate | Command | Result | Status |
 |------|---------|--------|--------|
-| Type Safety | npx tsc --noEmit | 0 errors | PASS/FAIL |
+| Type Safety | {{verify.type | default("declare verification.LANG.type in massu.config.yaml")}} | 0 errors | PASS/FAIL |
 | Lint | npm run lint | Exit 0 | PASS/FAIL |
 | Prisma Validate | npx prisma validate | Valid | PASS/FAIL |
-| Tests | npm test | ALL Pass | PASS/FAIL |
+| Tests | {{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} | ALL Pass | PASS/FAIL |
 | Pre-deploy | pre-deploy-check.sh | Pass/N/A | PASS/FAIL/N/A |
 ```
 
@@ -566,9 +566,9 @@ Checkpoint MUST abort if: pattern scanner fails, security violation detected, bu
 ## PARALLEL EXECUTION
 
 Independent checks can run simultaneously via Task agents:
-- Agent 1: `npx tsc --noEmit`
+- Agent 1: `{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}`
 - Agent 2: `./scripts/pattern-scanner.sh`
-- Agent 3: `npm run build`
+- Agent 3: `{{verify.build | default("(this stack declares no build step)")}}`
 - Agent 4: `npm run test:run`
 
 ---

package/commands/massu-ci-fix.md

@@ -59,7 +59,7 @@ Map the failure to a known pattern:
 2. Run the same check locally to verify:
    ```bash
    # Run the specific check that failed
-   npm run build  # or whatever CI step failed
+   {{verify.build | default("(this stack declares no build step)")}}  # or whatever CI step failed
    ```
 3. Verify fix passes locally
 

package/commands/massu-cleanup.md

@@ -48,7 +48,7 @@ Capture the behavioral baseline BEFORE making any changes:
 ### 1a. Test Baseline
 
 ```bash
-npm test 2>&1
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} 2>&1
 ```
 
 Record:
@@ -64,7 +64,7 @@ Record:
 ### 1b. Type Check Baseline
 
 ```bash
-cd packages/core && npx tsc --noEmit 2>&1
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}} 2>&1
 ```
 
 Record:
@@ -90,20 +90,20 @@ Scan all categories in parallel. Do NOT remove anything yet.
 
 ```bash
 # TypeScript unused imports (ts error 6133)
-cd packages/core && npx tsc --noEmit 2>&1 | grep "is declared but"
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}} 2>&1 | grep "is declared but"
 
 # ESLint-style: imports never referenced in file body
-grep -rn "^import" packages/core/src/ --include="*.ts" | head -50
+grep -rn "^import" {{paths.source}}/ --include="*.ts" | head -50
 ```
 
 ### 2b. Dead Exports
 
 ```bash
 # Exported symbols with zero external references
-grep -rn "^export " packages/core/src/ --include="*.ts" | grep -v "__tests__" | while IFS=: read file line content; do
+grep -rn "^export " {{paths.source}}/ --include="*.ts" | grep -v "__tests__" | while IFS=: read file line content; do
   name=$(echo "$content" | grep -oP '(?<=export (function|const|class|type|interface|enum) )\w+' | head -1)
   if [ -n "$name" ]; then
-    count=$(grep -rn "$name" packages/core/src/ --include="*.ts" | grep -v "^$file:" | grep -v "__tests__" | wc -l)
+    count=$(grep -rn "$name" {{paths.source}}/ --include="*.ts" | grep -v "^$file:" | grep -v "__tests__" | wc -l)
     if [ "$count" -eq 0 ]; then
       echo "DEAD EXPORT: $name in $file"
     fi
@@ -121,7 +121,7 @@ for f in packages/core/src/*.ts; do
   if [[ "$base" == "server" || "$base" == "index" || "$f" == *"__tests__"* ]]; then
     continue
   fi
-  count=$(grep -rn "from.*['\"]\./${base}" packages/core/src/ --include="*.ts" | grep -v "__tests__" | wc -l)
+  count=$(grep -rn "from.*['\"]\./${base}" {{paths.source}}/ --include="*.ts" | grep -v "__tests__" | wc -l)
   if [ "$count" -eq 0 ]; then
     echo "POSSIBLY ORPHANED: $f"
   fi
@@ -135,15 +135,15 @@ done
 cat packages/core/package.json | grep -A 50 '"dependencies"'
 
 # Check each dependency usage
-grep -rn "from.*'better-sqlite3'\|require.*better-sqlite3" packages/core/src/ --include="*.ts" | wc -l
-grep -rn "from.*'yaml'\|require.*yaml" packages/core/src/ --include="*.ts" | wc -l
+grep -rn "from.*'better-sqlite3'\|require.*better-sqlite3" {{paths.source}}/ --include="*.ts" | wc -l
+grep -rn "from.*'yaml'\|require.*yaml" {{paths.source}}/ --include="*.ts" | wc -l
 ```
 
 ### 2e. TODO/FIXME/HACK Comments
 
 ```bash
 # Enumerate all stale markers — informational only (no auto-removal)
-grep -rn "TODO\|FIXME\|HACK\|XXX\|DEPRECATED" packages/core/src/ --include="*.ts" | grep -v "__tests__"
+grep -rn "TODO\|FIXME\|HACK\|XXX\|DEPRECATED" {{paths.source}}/ --include="*.ts" | grep -v "__tests__"
 ```
 
 ---
@@ -180,9 +180,9 @@ CLEANUP LOOP:
     1. Select all REMOVE items in this category
     2. Apply removals
     3. Run type check:
-         cd packages/core && npx tsc --noEmit 2>&1
+         {{verify.type | default("declare verification.LANG.type in massu.config.yaml")}} 2>&1
     4. Run tests:
-         npm test 2>&1
+         {{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} 2>&1
     5. Compare against baseline:
          - Type errors must be <= baseline
          - Passing tests must be >= baseline
@@ -218,11 +218,11 @@ For every removed item, confirm it is gone:
 
 ```bash
 # Unused import removed
-grep -rn "[import_name]" packages/core/src/ --include="*.ts"
+grep -rn "[import_name]" {{paths.source}}/ --include="*.ts"
 # MUST return 0 matches (or only in unrelated contexts)
 
 # Dead export removed
-grep -rn "export.*[export_name]" packages/core/src/ --include="*.ts"
+grep -rn "export.*[export_name]" {{paths.source}}/ --include="*.ts"
 # MUST return 0 matches
 
 # Orphaned file removed
@@ -253,13 +253,13 @@ bash scripts/massu-pattern-scanner.sh
 
 ### Gate 2: Type Check (VR-TYPE)
 ```bash
-cd packages/core && npx tsc --noEmit
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}
 # MUST show 0 errors (or <= baseline)
 ```
 
 ### Gate 3: All Tests (VR-TEST)
 ```bash
-npm test
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}
 # MUST exit 0, all tests pass
 ```
 

package/commands/massu-commit.md

@@ -64,7 +64,7 @@ grep -n "name:" packages/core/src/[module]-tools.ts
 grep -n "case " packages/core/src/[module]-tools.ts
 
 # Verify config keys match getConfig() usage
-grep -rn "getConfig()" packages/core/src/ | head -20
+grep -rn "getConfig()" {{paths.source}}/ | head -20
 ```
 
 ---
@@ -276,13 +276,13 @@ bash scripts/massu-pattern-scanner.sh
 
 ### Gate 2: Type Safety (VR-TYPE)
 ```bash
-cd packages/core && npx tsc --noEmit
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}
 # MUST show 0 errors
 ```
 
 ### Gate 3: All Tests Pass (VR-TEST)
 ```bash
-npm test
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}
 # MUST exit 0, all vitest tests pass
 ```
 
@@ -306,9 +306,9 @@ echo "PASS: No secrets staged"
 
 ### Gate 7: Security - No Credentials in Code
 ```bash
-# Check packages/core/src/ for hardcoded credentials
+# Check {{paths.source}}/ for hardcoded credentials
 grep -rn 'sk-[a-zA-Z0-9]\{20,\}\|password.*=.*["\x27][^"\x27]\{8,\}' --include="*.ts" --include="*.tsx" \
-  packages/core/src/ 2>/dev/null \
+  {{paths.source}}/ 2>/dev/null \
   | grep -v "process.env" \
   | grep -v 'RegExp\|regex\|REDACT\|redact\|sanitize\|mask' \
   | grep -v '\.test\.ts:' \
@@ -355,7 +355,7 @@ npm audit --audit-level=high  # 0 high/critical vulnerabilities
 |------|---------|--------|--------|
 | 1. Pattern Scanner | massu-pattern-scanner.sh | Exit [X] | PASS/FAIL |
 | 2. Type Safety | tsc --noEmit | [X] errors | PASS/FAIL |
-| 3. Tests | npm test | [X] pass, [X] fail | PASS/FAIL |
+| 3. Tests | {{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} | [X] pass, [X] fail | PASS/FAIL |
 | 4. Hook Build | build:hooks | Exit [X] | PASS/FAIL |
 | 5. Generalization | massu-generalization-scanner.sh | Exit [X] | PASS/FAIL |
 | 6. No Secrets Staged | git diff --cached check | [result] | PASS/FAIL |
@@ -465,7 +465,7 @@ Analyze `git diff --cached --name-only` to determine scope:
 
 | Changed Files Location | Suggested Scope |
 |------------------------|-----------------|
-| All in `packages/core/src/` | `core` |
+| All in `{{paths.source}}/` | `core` |
 | All in `website/` | `website` |
 | All in `.claude/commands/` | `commands` |
 | All in `scripts/` | `tooling` |

package/commands/massu-create-plan.md

@@ -330,13 +330,13 @@ Proceed directly to PHASE 1 (Feature Understanding) as normal. Not every request
 
 ```bash
 # Search for similar features in codebase
-grep -rn "[feature_keyword]" packages/core/src/ --include="*.ts" | head -20
+grep -rn "[feature_keyword]" {{paths.source}}/ --include="*.ts" | head -20
 
 # Find similar tool modules
 ls -la packages/core/src/*-tools.ts
 
 # Find similar tests
-ls -la packages/core/src/__tests__/
+ls -la {{paths.tests | default("tests")}}/
 ```
 
 **Document findings:**
@@ -429,7 +429,7 @@ ls packages/core/src/__tests__/*.test.ts | wc -l
 
 ```bash
 # Check if target directories exist
-ls -la packages/core/src/
+ls -la {{paths.source}}/
 
 # Check if files to modify exist
 ls -la [file_path]
@@ -692,7 +692,7 @@ Update coverage map: mark D6, D7, D8, D10 as `done`.
 - **File**: packages/core/src/__tests__/[module].test.ts
 - **Action**: CREATE
 - **Covers**: Tool definitions, handlers, edge cases
-- **Verification**: VR-TEST (npm test)
+- **Verification**: VR-TEST ({{verify.test | default("declare verification.LANG.test in massu.config.yaml")}})
 
 ---
 
@@ -713,7 +713,7 @@ Update coverage map: mark D6, D7, D8, D10 as `done`.
 |------|------|---------------------|
 | P1-001 | MODULE | `ls -la packages/core/src/[module].ts` |
 | P1-002 | TOOL_WIRE | `grep "getXToolDefinitions" packages/core/src/tools.ts` |
-| P2-001 | TEST | `npm test` |
+| P2-001 | TEST | `{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}` |
 | P3-001 | CONFIG | Parse config without error |
 
 ---
@@ -780,8 +780,8 @@ Update coverage map: mark D6, D7, D8, D10 as `done`.
 #### Build Feasibility
 | Check | Command | Result | Status |
 |-------|---------|--------|--------|
-| TypeScript compiles | cd packages/core && npx tsc --noEmit | 0 errors | PASS/FAIL |
-| Tests pass | npm test | All pass | PASS/FAIL |
+| TypeScript compiles | {{verify.type | default("declare verification.LANG.type in massu.config.yaml")}} | 0 errors | PASS/FAIL |
+| Tests pass | {{verify.test | default("declare verification.LANG.test in massu.config.yaml")}} | All pass | PASS/FAIL |
 | Hooks compile | cd packages/core && npm run build:hooks | Exit 0 | PASS/FAIL |
 
 **FEASIBILITY GATE: PASS / FAIL**

package/commands/massu-dead-code.md

@@ -85,9 +85,9 @@ If NO references found: candidate for removal.
 
 After user approval:
 1. Remove files/exports/dependencies
-2. Run `npm run build` (VR-BUILD)
-3. Run `npx tsc --noEmit` (VR-TYPE)
-4. Run `npm test` (VR-TEST)
+2. Run `{{verify.build | default("(this stack declares no build step)")}}` (VR-BUILD)
+3. Run `{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}` (VR-TYPE)
+4. Run `{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}` (VR-TEST)
 5. Run `./scripts/pattern-scanner.sh`
 
 ### Step 7: Report

package/commands/massu-debug/references/common-shortcuts.md

@@ -77,7 +77,7 @@ grep -rn "publicProcedure.mutation" src/ | wc -l  # Should be 0
 1. Check for static jsdom/cheerio imports (must use `await import()`)
 2. Check client/server boundary violations (`@/lib/db` in client components)
 3. Check `next-intl` setup (plugin + request.ts + Provider)
-4. Run `NODE_OPTIONS="--max-old-space-size=8192" npx tsc --noEmit`
+4. Run `NODE_OPTIONS="--max-old-space-size=8192" {{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}`
 5. Check for circular dependencies in import chains
 
 ---

package/commands/massu-debug/references/investigation-phases.md

@@ -66,10 +66,10 @@ git log --oneline -10
 git diff HEAD~5 --name-only | grep -E "(component|router|page)"
 
 # Check build status
-npm run build 2>&1 | tail -20
+{{verify.build | default("(this stack declares no build step)")}} 2>&1 | tail -20
 
 # Check for type errors
-npx tsc --noEmit 2>&1 | head -30
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}} 2>&1 | head -30
 ```
 
 ---
@@ -253,10 +253,10 @@ grep -n "[correct_pattern]" [file]
 # Expected: Match found
 
 # VR-BUILD: Build passes
-npm run build
+{{verify.build | default("(this stack declares no build step)")}}
 
 # VR-TYPE: Types pass
-npx tsc --noEmit
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}
 
 # Pattern scanner
 ./scripts/pattern-scanner.sh

package/commands/massu-debug/references/report-format.md

@@ -30,8 +30,8 @@ Templates for the debug report and session state update.
 ### Verification Evidence
 | Check | Command | Result | Status |
 |-------|---------|--------|--------|
-| Build | npm run build | Exit 0 | PASS |
-| Types | npx tsc --noEmit | 0 errors | PASS |
+| Build | {{verify.build | default("(this stack declares no build step)")}} | Exit 0 | PASS |
+| Types | {{verify.type | default("declare verification.LANG.type in massu.config.yaml")}} | 0 errors | PASS |
 | Patterns | ./scripts/pattern-scanner.sh | Exit 0 | PASS |
 | VR-NEGATIVE | grep [old] | 0 matches | PASS |
 

package/commands/massu-deploy.md

@@ -27,7 +27,7 @@ name: massu-deploy
 ### Pre-Flight Checks (automatic)
 1. Branch check — must be on `main` with clean working tree
 2. Project target verification — must match projectId `prj_Io7AaGCM27cwRQerAj3BdihUur1Y`
-3. Local build verification — `npm run build` must succeed
+3. Local build verification — `{{verify.build | default("(this stack declares no build step)")}}` must succeed
 4. Deploy to production — `vercel --prod --yes`
 5. Smoke tests — GET `/` and `/docs` must return 200
 6. Rollback guidance — if smoke tests fail, prints rollback command

package/commands/massu-deps.md

@@ -155,10 +155,10 @@ npm dedupe --dry-run
 npx depcheck packages/core
 
 # Verify no phantom MCP SDK references (should be 0 — raw JSON-RPC 2.0)
-grep -rn "@modelcontextprotocol/sdk" packages/core/src/ --include="*.ts" | wc -l
+grep -rn "@modelcontextprotocol/sdk" {{paths.source}}/ --include="*.ts" | wc -l
 
 # Check better-sqlite3 usage
-grep -rn "better-sqlite3\|Database" packages/core/src/ --include="*.ts" | wc -l
+grep -rn "better-sqlite3\|Database" {{paths.source}}/ --include="*.ts" | wc -l
 ```
 
 ### 3.4 Dependency Matrix
@@ -215,13 +215,13 @@ npm outdated | grep @types
 # After EACH update:
 
 # 1. Type check
-cd packages/core && npx tsc --noEmit
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}
 
 # 2. Build (includes hook compilation)
-npm run build
+{{verify.build | default("(this stack declares no build step)")}}
 
 # 3. Test
-npm test
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}
 
 # 4. Pattern scanner
 bash scripts/massu-pattern-scanner.sh

package/commands/massu-doc-gen.md

@@ -159,7 +159,7 @@ export interface MyType {
 
 ```bash
 # Verify no TypeScript errors introduced
-cd packages/core && npx tsc --noEmit 2>&1
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}} 2>&1
 # MUST show same or fewer errors than baseline
 ```
 
@@ -213,7 +213,7 @@ sectionName:
 
 ### Gate 1: Type Check (VR-TYPE)
 ```bash
-cd packages/core && npx tsc --noEmit
+{{verify.type | default("declare verification.LANG.type in massu.config.yaml")}}
 # MUST show 0 errors (or <= baseline before docs were added)
 ```
 
@@ -225,7 +225,7 @@ bash scripts/massu-pattern-scanner.sh
 
 ### Gate 3: All Tests (VR-TEST)
 ```bash
-npm test
+{{verify.test | default("declare verification.LANG.test in massu.config.yaml")}}
 # Documentation changes MUST NOT affect test results
 ```