@mc-and-his-agents/loom-installer 0.1.51 → 0.1.52

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mc-and-his-agents/loom-installer",
-  "version": "0.1.51",
+  "version": "0.1.52",
   "description": "Node installer for Loom plugin and single-skill installation surfaces.",
   "type": "module",
   "bin": {

package/payload/manifest.json

@@ -2,9 +2,9 @@
   "schema_version": "loom-installer-payload/v1",
   "loom_version": "0.4.0",
   "source_repository": "https://github.com/MC-and-his-Agents/Loom",
-  "source_commit": "25dcc71b214c7243c36a46a126de9239c6a06c00",
+  "source_commit": "b63bb9c0ffc94f9c3f9d16d1aa8293e58e56609a",
   "source_ref": "main",
-  "built_at": "2026-04-28T13:55:40+08:00",
+  "built_at": "2026-04-28T15:13:56+08:00",
   "runtime": {
     "python_minimum": "3.10",
     "python_recommended": "3.11+"
@@ -633,8 +633,8 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_flow.py",
@@ -1223,8 +1223,8 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py",
@@ -1843,8 +1843,8 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py",
@@ -2463,8 +2463,8 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py",
@@ -3088,8 +3088,8 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py",
@@ -3708,8 +3708,8 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -4328,8 +4328,8 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py",
@@ -4948,8 +4948,8 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py",
@@ -5568,8 +5568,8 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -6188,8 +6188,8 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 372465,
+      "sha256": "c9dc22036e5b4ce50f3b434136d6398334a3845b9b705aa8746fc0049186bdff"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py",

package/payload/plugin/loom/skills/shared/scripts/loom_check.py

@@ -2421,10 +2421,15 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
         ".loom/bootstrap/init-result.json",
         ".loom/bin/loom_init.py",
         ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
         ".loom/work-items/INIT-0001.md",
         ".loom/progress/INIT-0001.md",
         ".loom/reviews/INIT-0001.json",
         ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
     )
     failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
 
@@ -2459,6 +2464,12 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             "carrier-refresh",
             {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
         ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
     )
     for label, args, kind, expected in commands:
         payload, error = load_command_json(root, args)
@@ -2483,8 +2494,8 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             )
         if kind == "governance-status":
             maturity = payload.get("maturity")
-            if not isinstance(maturity, dict) or maturity.get("current") not in {"light", "standard", "strong"}:
-                failures.append(Failure("root-self-adoption", "`root governance status` must report adopted maturity"))
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
         if kind == "runtime-parity":
             checks = payload.get("checks")
             names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
@@ -2504,6 +2515,23 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
                 head_binding = review.get("head_binding")
                 if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
                     failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
     return failures
 
 
@@ -5097,7 +5125,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"

package/payload/skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py

@@ -2421,10 +2421,15 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
         ".loom/bootstrap/init-result.json",
         ".loom/bin/loom_init.py",
         ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
         ".loom/work-items/INIT-0001.md",
         ".loom/progress/INIT-0001.md",
         ".loom/reviews/INIT-0001.json",
         ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
     )
     failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
 
@@ -2459,6 +2464,12 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             "carrier-refresh",
             {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
         ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
     )
     for label, args, kind, expected in commands:
         payload, error = load_command_json(root, args)
@@ -2483,8 +2494,8 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             )
         if kind == "governance-status":
             maturity = payload.get("maturity")
-            if not isinstance(maturity, dict) or maturity.get("current") not in {"light", "standard", "strong"}:
-                failures.append(Failure("root-self-adoption", "`root governance status` must report adopted maturity"))
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
         if kind == "runtime-parity":
             checks = payload.get("checks")
             names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
@@ -2504,6 +2515,23 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
                 head_binding = review.get("head_binding")
                 if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
                     failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
     return failures
 
 
@@ -5097,7 +5125,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"

package/payload/skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py

@@ -2421,10 +2421,15 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
         ".loom/bootstrap/init-result.json",
         ".loom/bin/loom_init.py",
         ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
         ".loom/work-items/INIT-0001.md",
         ".loom/progress/INIT-0001.md",
         ".loom/reviews/INIT-0001.json",
         ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
     )
     failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
 
@@ -2459,6 +2464,12 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             "carrier-refresh",
             {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
         ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
     )
     for label, args, kind, expected in commands:
         payload, error = load_command_json(root, args)
@@ -2483,8 +2494,8 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             )
         if kind == "governance-status":
             maturity = payload.get("maturity")
-            if not isinstance(maturity, dict) or maturity.get("current") not in {"light", "standard", "strong"}:
-                failures.append(Failure("root-self-adoption", "`root governance status` must report adopted maturity"))
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
         if kind == "runtime-parity":
             checks = payload.get("checks")
             names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
@@ -2504,6 +2515,23 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
                 head_binding = review.get("head_binding")
                 if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
                     failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
     return failures
 
 
@@ -5097,7 +5125,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"

package/payload/skills/loom-init/.loom-runtime/shared/scripts/loom_check.py

@@ -2421,10 +2421,15 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
         ".loom/bootstrap/init-result.json",
         ".loom/bin/loom_init.py",
         ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
         ".loom/work-items/INIT-0001.md",
         ".loom/progress/INIT-0001.md",
         ".loom/reviews/INIT-0001.json",
         ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
     )
     failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
 
@@ -2459,6 +2464,12 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             "carrier-refresh",
             {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
         ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
     )
     for label, args, kind, expected in commands:
         payload, error = load_command_json(root, args)
@@ -2483,8 +2494,8 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             )
         if kind == "governance-status":
             maturity = payload.get("maturity")
-            if not isinstance(maturity, dict) or maturity.get("current") not in {"light", "standard", "strong"}:
-                failures.append(Failure("root-self-adoption", "`root governance status` must report adopted maturity"))
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
         if kind == "runtime-parity":
             checks = payload.get("checks")
             names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
@@ -2504,6 +2515,23 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
                 head_binding = review.get("head_binding")
                 if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
                     failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
     return failures
 
 
@@ -5097,7 +5125,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"

package/payload/skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py

@@ -2421,10 +2421,15 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
         ".loom/bootstrap/init-result.json",
         ".loom/bin/loom_init.py",
         ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
         ".loom/work-items/INIT-0001.md",
         ".loom/progress/INIT-0001.md",
         ".loom/reviews/INIT-0001.json",
         ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
     )
     failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
 
@@ -2459,6 +2464,12 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             "carrier-refresh",
             {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
         ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
     )
     for label, args, kind, expected in commands:
         payload, error = load_command_json(root, args)
@@ -2483,8 +2494,8 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             )
         if kind == "governance-status":
             maturity = payload.get("maturity")
-            if not isinstance(maturity, dict) or maturity.get("current") not in {"light", "standard", "strong"}:
-                failures.append(Failure("root-self-adoption", "`root governance status` must report adopted maturity"))
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
         if kind == "runtime-parity":
             checks = payload.get("checks")
             names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
@@ -2504,6 +2515,23 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
                 head_binding = review.get("head_binding")
                 if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
                     failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
     return failures
 
 
@@ -5097,7 +5125,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"

package/payload/skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py

@@ -2421,10 +2421,15 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
         ".loom/bootstrap/init-result.json",
         ".loom/bin/loom_init.py",
         ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
         ".loom/work-items/INIT-0001.md",
         ".loom/progress/INIT-0001.md",
         ".loom/reviews/INIT-0001.json",
         ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
     )
     failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
 
@@ -2459,6 +2464,12 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             "carrier-refresh",
             {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
         ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
     )
     for label, args, kind, expected in commands:
         payload, error = load_command_json(root, args)
@@ -2483,8 +2494,8 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             )
         if kind == "governance-status":
             maturity = payload.get("maturity")
-            if not isinstance(maturity, dict) or maturity.get("current") not in {"light", "standard", "strong"}:
-                failures.append(Failure("root-self-adoption", "`root governance status` must report adopted maturity"))
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
         if kind == "runtime-parity":
             checks = payload.get("checks")
             names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
@@ -2504,6 +2515,23 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
                 head_binding = review.get("head_binding")
                 if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
                     failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
     return failures
 
 
@@ -5097,7 +5125,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"

package/payload/skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py

@@ -2421,10 +2421,15 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
         ".loom/bootstrap/init-result.json",
         ".loom/bin/loom_init.py",
         ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
         ".loom/work-items/INIT-0001.md",
         ".loom/progress/INIT-0001.md",
         ".loom/reviews/INIT-0001.json",
         ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
     )
     failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
 
@@ -2459,6 +2464,12 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             "carrier-refresh",
             {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
         ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
     )
     for label, args, kind, expected in commands:
         payload, error = load_command_json(root, args)
@@ -2483,8 +2494,8 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             )
         if kind == "governance-status":
             maturity = payload.get("maturity")
-            if not isinstance(maturity, dict) or maturity.get("current") not in {"light", "standard", "strong"}:
-                failures.append(Failure("root-self-adoption", "`root governance status` must report adopted maturity"))
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
         if kind == "runtime-parity":
             checks = payload.get("checks")
             names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
@@ -2504,6 +2515,23 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
                 head_binding = review.get("head_binding")
                 if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
                     failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
     return failures
 
 
@@ -5097,7 +5125,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"

package/payload/skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py

@@ -2421,10 +2421,15 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
         ".loom/bootstrap/init-result.json",
         ".loom/bin/loom_init.py",
         ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
         ".loom/work-items/INIT-0001.md",
         ".loom/progress/INIT-0001.md",
         ".loom/reviews/INIT-0001.json",
         ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
     )
     failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
 
@@ -2459,6 +2464,12 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             "carrier-refresh",
             {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
         ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
     )
     for label, args, kind, expected in commands:
         payload, error = load_command_json(root, args)
@@ -2483,8 +2494,8 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             )
         if kind == "governance-status":
             maturity = payload.get("maturity")
-            if not isinstance(maturity, dict) or maturity.get("current") not in {"light", "standard", "strong"}:
-                failures.append(Failure("root-self-adoption", "`root governance status` must report adopted maturity"))
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
         if kind == "runtime-parity":
             checks = payload.get("checks")
             names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
@@ -2504,6 +2515,23 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
                 head_binding = review.get("head_binding")
                 if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
                     failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
     return failures
 
 
@@ -5097,7 +5125,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"

package/payload/skills/loom-review/.loom-runtime/shared/scripts/loom_check.py

@@ -2421,10 +2421,15 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
         ".loom/bootstrap/init-result.json",
         ".loom/bin/loom_init.py",
         ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
         ".loom/work-items/INIT-0001.md",
         ".loom/progress/INIT-0001.md",
         ".loom/reviews/INIT-0001.json",
         ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
     )
     failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
 
@@ -2459,6 +2464,12 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             "carrier-refresh",
             {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
         ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
     )
     for label, args, kind, expected in commands:
         payload, error = load_command_json(root, args)
@@ -2483,8 +2494,8 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             )
         if kind == "governance-status":
             maturity = payload.get("maturity")
-            if not isinstance(maturity, dict) or maturity.get("current") not in {"light", "standard", "strong"}:
-                failures.append(Failure("root-self-adoption", "`root governance status` must report adopted maturity"))
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
         if kind == "runtime-parity":
             checks = payload.get("checks")
             names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
@@ -2504,6 +2515,23 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
                 head_binding = review.get("head_binding")
                 if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
                     failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
     return failures
 
 
@@ -5097,7 +5125,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"

package/payload/skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py

@@ -2421,10 +2421,15 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
         ".loom/bootstrap/init-result.json",
         ".loom/bin/loom_init.py",
         ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
         ".loom/work-items/INIT-0001.md",
         ".loom/progress/INIT-0001.md",
         ".loom/reviews/INIT-0001.json",
         ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
     )
     failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
 
@@ -2459,6 +2464,12 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             "carrier-refresh",
             {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
         ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
     )
     for label, args, kind, expected in commands:
         payload, error = load_command_json(root, args)
@@ -2483,8 +2494,8 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             )
         if kind == "governance-status":
             maturity = payload.get("maturity")
-            if not isinstance(maturity, dict) or maturity.get("current") not in {"light", "standard", "strong"}:
-                failures.append(Failure("root-self-adoption", "`root governance status` must report adopted maturity"))
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
         if kind == "runtime-parity":
             checks = payload.get("checks")
             names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
@@ -2504,6 +2515,23 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
                 head_binding = review.get("head_binding")
                 if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
                     failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
     return failures
 
 
@@ -5097,7 +5125,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"