@mc-and-his-agents/loom-installer 0.1.50 → 0.1.52

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mc-and-his-agents/loom-installer",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "description": "Node installer for Loom plugin and single-skill installation surfaces.",
   "type": "module",
   "bin": {

package/payload/manifest.json

@@ -2,9 +2,9 @@
   "schema_version": "loom-installer-payload/v1",
   "loom_version": "0.4.0",
   "source_repository": "https://github.com/MC-and-his-Agents/Loom",
-  "source_commit": "e0d9542d7f67ae153e1b884c11bbc848943941cb",
+  "source_commit": "b63bb9c0ffc94f9c3f9d16d1aa8293e58e56609a",
   "source_ref": "main",
-  "built_at": "2026-04-28T11:55:17+08:00",
+  "built_at": "2026-04-28T15:13:56+08:00",
   "runtime": {
     "python_minimum": "3.10",
     "python_recommended": "3.11+"
@@ -633,8 +633,8 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_check.py",
-      "bytes": 365681,
-      "sha256": "e48281477bbb35b887e21034570ed519a40dae718ea97e99886a66b04dbd1d50"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_flow.py",
@@ -1223,8 +1223,8 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 365681,
-      "sha256": "e48281477bbb35b887e21034570ed519a40dae718ea97e99886a66b04dbd1d50"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py",
@@ -1843,8 +1843,8 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 365681,
-      "sha256": "e48281477bbb35b887e21034570ed519a40dae718ea97e99886a66b04dbd1d50"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py",
@@ -2463,8 +2463,8 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 365681,
-      "sha256": "e48281477bbb35b887e21034570ed519a40dae718ea97e99886a66b04dbd1d50"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py",
@@ -3088,8 +3088,8 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 365681,
-      "sha256": "e48281477bbb35b887e21034570ed519a40dae718ea97e99886a66b04dbd1d50"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py",
@@ -3708,8 +3708,8 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 365681,
-      "sha256": "e48281477bbb35b887e21034570ed519a40dae718ea97e99886a66b04dbd1d50"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -4328,8 +4328,8 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 365681,
-      "sha256": "e48281477bbb35b887e21034570ed519a40dae718ea97e99886a66b04dbd1d50"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py",
@@ -4948,8 +4948,8 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 365681,
-      "sha256": "e48281477bbb35b887e21034570ed519a40dae718ea97e99886a66b04dbd1d50"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py",
@@ -5568,8 +5568,8 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 365681,
-      "sha256": "e48281477bbb35b887e21034570ed519a40dae718ea97e99886a66b04dbd1d50"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -6188,8 +6188,8 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 365681,
-      "sha256": "e48281477bbb35b887e21034570ed519a40dae718ea97e99886a66b04dbd1d50"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py",

package/payload/plugin/loom/skills/shared/scripts/loom_check.py

@@ -2410,6 +2410,131 @@ def check_demo_repo_local_cli(root: Path) -> list[Failure]:
     return failures
 
 
+def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
+    failures: list[Failure] = []
+    carrier_root = root / ".loom"
+    if not carrier_root.exists():
+        return failures
+
+    required_paths = (
+        ".loom/bootstrap/manifest.json",
+        ".loom/bootstrap/init-result.json",
+        ".loom/bin/loom_init.py",
+        ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
+        ".loom/work-items/INIT-0001.md",
+        ".loom/progress/INIT-0001.md",
+        ".loom/reviews/INIT-0001.json",
+        ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
+    )
+    failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
+
+    commands = (
+        (
+            "root verify",
+            ["python3", ".loom/bin/loom_init.py", "verify", "--target", "."],
+            "loom-init-verify",
+            {"ok": True},
+        ),
+        (
+            "root governance status",
+            ["python3", ".loom/bin/loom_flow.py", "governance-profile", "status", "--target", "."],
+            "governance-status",
+            {"result": "pass"},
+        ),
+        (
+            "root runtime parity",
+            ["python3", ".loom/bin/loom_flow.py", "runtime-parity", "validate", "--target", "."],
+            "runtime-parity",
+            {"result": "pass", "schema_version": "loom-runtime-parity/v1"},
+        ),
+        (
+            "root adopt verify",
+            ["python3", ".loom/bin/loom_flow.py", "adopt", "verify", "--target", ".", "--item", "INIT-0001"],
+            "adopt-verify",
+            {"result": "pass", "schema_version": "loom-adoption-verify/v1"},
+        ),
+        (
+            "root carrier refresh",
+            ["python3", ".loom/bin/loom_flow.py", "carrier", "refresh", "--target", ".", "--dry-run"],
+            "carrier-refresh",
+            {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
+        ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
+    )
+    for label, args, kind, expected in commands:
+        payload, error = load_command_json(root, args)
+        if error:
+            failures.append(Failure("root-self-adoption", f"`{label}` failed: {error}"))
+            continue
+        for key, value in expected.items():
+            if payload.get(key) != value:
+                failures.append(Failure("root-self-adoption", f"`{label}` must report `{key}: {value}`"))
+        runtime_payload = payload.get("runtime_state")
+        if kind == "loom-init-verify":
+            runtime_payload = payload.get("runtime_state")
+        if runtime_payload is not None:
+            require_runtime_state_payload(
+                failures,
+                category="root-self-adoption",
+                context=f"`{label}`",
+                payload=runtime_payload,
+                expected_scene="installed-runtime",
+                expected_carrier="bootstrapped-target-runtime",
+                allowed_results={"pass"},
+            )
+        if kind == "governance-status":
+            maturity = payload.get("maturity")
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
+        if kind == "runtime-parity":
+            checks = payload.get("checks")
+            names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
+            if "shadow_parity_boundary" not in names or "controlled_merge_contract" not in names:
+                failures.append(Failure("root-self-adoption", "`root runtime parity` must cover shadow and controlled merge boundaries"))
+        if kind == "adopt-verify":
+            roundtrip = payload.get("producer_consumer_roundtrip")
+            if not isinstance(roundtrip, dict):
+                failures.append(Failure("root-self-adoption", "`root adopt verify` must include producer_consumer_roundtrip"))
+            elif roundtrip.get("bypass_check", {}).get("result") != "pass":
+                failures.append(Failure("root-self-adoption", "`root adopt verify` must prove required section deletion blocks"))
+        if kind == "carrier-refresh":
+            if payload.get("refresh_needed") not in ([], None):
+                failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must not report runtime provenance drift"))
+            review = payload.get("review")
+            if isinstance(review, dict):
+                head_binding = review.get("head_binding")
+                if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
+                    failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
+    return failures
+
+
 def check_deep_existing_repo_bootstrap(root: Path) -> list[Failure]:
     failures: list[Failure] = []
     with tempfile.TemporaryDirectory(prefix="loom-check-deep-existing-") as tmp:
@@ -5000,7 +5125,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"
@@ -7449,6 +7578,7 @@ def collect_failures(root: Path) -> list[Failure]:
     failures.extend(check_demo_assets(root))
     failures.extend(check_demo_fact_chain(root))
     failures.extend(check_demo_repo_local_cli(root))
+    failures.extend(check_root_self_adoption_carrier(root))
     failures.extend(check_deep_existing_repo_bootstrap(root))
     failures.extend(check_daily_execution_cli(root))
     failures.extend(check_repo_companion_interface_contracts(root))
@@ -7463,7 +7593,7 @@ def collect_failures(root: Path) -> list[Failure]:
 
 
 def print_report(root: Path, failures: list[Failure]) -> None:
-    categories_checked = 18
+    categories_checked = 19
     if not failures:
         print(f"loom_check: OK ({root})")
         print(f"checked {categories_checked} surfaces")

package/payload/skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py

@@ -2410,6 +2410,131 @@ def check_demo_repo_local_cli(root: Path) -> list[Failure]:
     return failures
 
 
+def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
+    failures: list[Failure] = []
+    carrier_root = root / ".loom"
+    if not carrier_root.exists():
+        return failures
+
+    required_paths = (
+        ".loom/bootstrap/manifest.json",
+        ".loom/bootstrap/init-result.json",
+        ".loom/bin/loom_init.py",
+        ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
+        ".loom/work-items/INIT-0001.md",
+        ".loom/progress/INIT-0001.md",
+        ".loom/reviews/INIT-0001.json",
+        ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
+    )
+    failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
+
+    commands = (
+        (
+            "root verify",
+            ["python3", ".loom/bin/loom_init.py", "verify", "--target", "."],
+            "loom-init-verify",
+            {"ok": True},
+        ),
+        (
+            "root governance status",
+            ["python3", ".loom/bin/loom_flow.py", "governance-profile", "status", "--target", "."],
+            "governance-status",
+            {"result": "pass"},
+        ),
+        (
+            "root runtime parity",
+            ["python3", ".loom/bin/loom_flow.py", "runtime-parity", "validate", "--target", "."],
+            "runtime-parity",
+            {"result": "pass", "schema_version": "loom-runtime-parity/v1"},
+        ),
+        (
+            "root adopt verify",
+            ["python3", ".loom/bin/loom_flow.py", "adopt", "verify", "--target", ".", "--item", "INIT-0001"],
+            "adopt-verify",
+            {"result": "pass", "schema_version": "loom-adoption-verify/v1"},
+        ),
+        (
+            "root carrier refresh",
+            ["python3", ".loom/bin/loom_flow.py", "carrier", "refresh", "--target", ".", "--dry-run"],
+            "carrier-refresh",
+            {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
+        ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
+    )
+    for label, args, kind, expected in commands:
+        payload, error = load_command_json(root, args)
+        if error:
+            failures.append(Failure("root-self-adoption", f"`{label}` failed: {error}"))
+            continue
+        for key, value in expected.items():
+            if payload.get(key) != value:
+                failures.append(Failure("root-self-adoption", f"`{label}` must report `{key}: {value}`"))
+        runtime_payload = payload.get("runtime_state")
+        if kind == "loom-init-verify":
+            runtime_payload = payload.get("runtime_state")
+        if runtime_payload is not None:
+            require_runtime_state_payload(
+                failures,
+                category="root-self-adoption",
+                context=f"`{label}`",
+                payload=runtime_payload,
+                expected_scene="installed-runtime",
+                expected_carrier="bootstrapped-target-runtime",
+                allowed_results={"pass"},
+            )
+        if kind == "governance-status":
+            maturity = payload.get("maturity")
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
+        if kind == "runtime-parity":
+            checks = payload.get("checks")
+            names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
+            if "shadow_parity_boundary" not in names or "controlled_merge_contract" not in names:
+                failures.append(Failure("root-self-adoption", "`root runtime parity` must cover shadow and controlled merge boundaries"))
+        if kind == "adopt-verify":
+            roundtrip = payload.get("producer_consumer_roundtrip")
+            if not isinstance(roundtrip, dict):
+                failures.append(Failure("root-self-adoption", "`root adopt verify` must include producer_consumer_roundtrip"))
+            elif roundtrip.get("bypass_check", {}).get("result") != "pass":
+                failures.append(Failure("root-self-adoption", "`root adopt verify` must prove required section deletion blocks"))
+        if kind == "carrier-refresh":
+            if payload.get("refresh_needed") not in ([], None):
+                failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must not report runtime provenance drift"))
+            review = payload.get("review")
+            if isinstance(review, dict):
+                head_binding = review.get("head_binding")
+                if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
+                    failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
+    return failures
+
+
 def check_deep_existing_repo_bootstrap(root: Path) -> list[Failure]:
     failures: list[Failure] = []
     with tempfile.TemporaryDirectory(prefix="loom-check-deep-existing-") as tmp:
@@ -5000,7 +5125,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"
@@ -7449,6 +7578,7 @@ def collect_failures(root: Path) -> list[Failure]:
     failures.extend(check_demo_assets(root))
     failures.extend(check_demo_fact_chain(root))
     failures.extend(check_demo_repo_local_cli(root))
+    failures.extend(check_root_self_adoption_carrier(root))
     failures.extend(check_deep_existing_repo_bootstrap(root))
     failures.extend(check_daily_execution_cli(root))
     failures.extend(check_repo_companion_interface_contracts(root))
@@ -7463,7 +7593,7 @@ def collect_failures(root: Path) -> list[Failure]:
 
 
 def print_report(root: Path, failures: list[Failure]) -> None:
-    categories_checked = 18
+    categories_checked = 19
     if not failures:
         print(f"loom_check: OK ({root})")
         print(f"checked {categories_checked} surfaces")

package/payload/skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py

@@ -2410,6 +2410,131 @@ def check_demo_repo_local_cli(root: Path) -> list[Failure]:
     return failures
 
 
+def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
+    failures: list[Failure] = []
+    carrier_root = root / ".loom"
+    if not carrier_root.exists():
+        return failures
+
+    required_paths = (
+        ".loom/bootstrap/manifest.json",
+        ".loom/bootstrap/init-result.json",
+        ".loom/bin/loom_init.py",
+        ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
+        ".loom/work-items/INIT-0001.md",
+        ".loom/progress/INIT-0001.md",
+        ".loom/reviews/INIT-0001.json",
+        ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
+    )
+    failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
+
+    commands = (
+        (
+            "root verify",
+            ["python3", ".loom/bin/loom_init.py", "verify", "--target", "."],
+            "loom-init-verify",
+            {"ok": True},
+        ),
+        (
+            "root governance status",
+            ["python3", ".loom/bin/loom_flow.py", "governance-profile", "status", "--target", "."],
+            "governance-status",
+            {"result": "pass"},
+        ),
+        (
+            "root runtime parity",
+            ["python3", ".loom/bin/loom_flow.py", "runtime-parity", "validate", "--target", "."],
+            "runtime-parity",
+            {"result": "pass", "schema_version": "loom-runtime-parity/v1"},
+        ),
+        (
+            "root adopt verify",
+            ["python3", ".loom/bin/loom_flow.py", "adopt", "verify", "--target", ".", "--item", "INIT-0001"],
+            "adopt-verify",
+            {"result": "pass", "schema_version": "loom-adoption-verify/v1"},
+        ),
+        (
+            "root carrier refresh",
+            ["python3", ".loom/bin/loom_flow.py", "carrier", "refresh", "--target", ".", "--dry-run"],
+            "carrier-refresh",
+            {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
+        ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
+    )
+    for label, args, kind, expected in commands:
+        payload, error = load_command_json(root, args)
+        if error:
+            failures.append(Failure("root-self-adoption", f"`{label}` failed: {error}"))
+            continue
+        for key, value in expected.items():
+            if payload.get(key) != value:
+                failures.append(Failure("root-self-adoption", f"`{label}` must report `{key}: {value}`"))
+        runtime_payload = payload.get("runtime_state")
+        if kind == "loom-init-verify":
+            runtime_payload = payload.get("runtime_state")
+        if runtime_payload is not None:
+            require_runtime_state_payload(
+                failures,
+                category="root-self-adoption",
+                context=f"`{label}`",
+                payload=runtime_payload,
+                expected_scene="installed-runtime",
+                expected_carrier="bootstrapped-target-runtime",
+                allowed_results={"pass"},
+            )
+        if kind == "governance-status":
+            maturity = payload.get("maturity")
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
+        if kind == "runtime-parity":
+            checks = payload.get("checks")
+            names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
+            if "shadow_parity_boundary" not in names or "controlled_merge_contract" not in names:
+                failures.append(Failure("root-self-adoption", "`root runtime parity` must cover shadow and controlled merge boundaries"))
+        if kind == "adopt-verify":
+            roundtrip = payload.get("producer_consumer_roundtrip")
+            if not isinstance(roundtrip, dict):
+                failures.append(Failure("root-self-adoption", "`root adopt verify` must include producer_consumer_roundtrip"))
+            elif roundtrip.get("bypass_check", {}).get("result") != "pass":
+                failures.append(Failure("root-self-adoption", "`root adopt verify` must prove required section deletion blocks"))
+        if kind == "carrier-refresh":
+            if payload.get("refresh_needed") not in ([], None):
+                failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must not report runtime provenance drift"))
+            review = payload.get("review")
+            if isinstance(review, dict):
+                head_binding = review.get("head_binding")
+                if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
+                    failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
+    return failures
+
+
 def check_deep_existing_repo_bootstrap(root: Path) -> list[Failure]:
     failures: list[Failure] = []
     with tempfile.TemporaryDirectory(prefix="loom-check-deep-existing-") as tmp:
@@ -5000,7 +5125,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"
@@ -7449,6 +7578,7 @@ def collect_failures(root: Path) -> list[Failure]:
     failures.extend(check_demo_assets(root))
     failures.extend(check_demo_fact_chain(root))
     failures.extend(check_demo_repo_local_cli(root))
+    failures.extend(check_root_self_adoption_carrier(root))
     failures.extend(check_deep_existing_repo_bootstrap(root))
     failures.extend(check_daily_execution_cli(root))
     failures.extend(check_repo_companion_interface_contracts(root))
@@ -7463,7 +7593,7 @@ def collect_failures(root: Path) -> list[Failure]:
 
 
 def print_report(root: Path, failures: list[Failure]) -> None:
-    categories_checked = 18
+    categories_checked = 19
     if not failures:
         print(f"loom_check: OK ({root})")
         print(f"checked {categories_checked} surfaces")