@mc-and-his-agents/loom-installer 0.1.51 → 0.1.53

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mc-and-his-agents/loom-installer",
-  "version": "0.1.51",
+  "version": "0.1.53",
   "description": "Node installer for Loom plugin and single-skill installation surfaces.",
   "type": "module",
   "bin": {

package/payload/manifest.json

@@ -2,9 +2,9 @@
   "schema_version": "loom-installer-payload/v1",
   "loom_version": "0.4.0",
   "source_repository": "https://github.com/MC-and-his-Agents/Loom",
-  "source_commit": "25dcc71b214c7243c36a46a126de9239c6a06c00",
+  "source_commit": "544fa797c5cb4ddc5754050239ef3fb22e136726",
   "source_ref": "main",
-  "built_at": "2026-04-28T13:55:40+08:00",
+  "built_at": "2026-04-28T16:53:46+08:00",
   "runtime": {
     "python_minimum": "3.10",
     "python_recommended": "3.11+"
@@ -633,8 +633,8 @@
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 378826,
+      "sha256": "89158e15ce752ae1c4a3dc9edeaa2452954346ef8573a75f6e6b56dc5478e924"
     },
     {
       "path": "plugin/loom/skills/shared/scripts/loom_flow.py",
@@ -1223,8 +1223,8 @@
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 378826,
+      "sha256": "89158e15ce752ae1c4a3dc9edeaa2452954346ef8573a75f6e6b56dc5478e924"
     },
     {
       "path": "skills/loom-adopt/.loom-runtime/shared/scripts/loom_flow.py",
@@ -1843,8 +1843,8 @@
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 378826,
+      "sha256": "89158e15ce752ae1c4a3dc9edeaa2452954346ef8573a75f6e6b56dc5478e924"
     },
     {
       "path": "skills/loom-handoff/.loom-runtime/shared/scripts/loom_flow.py",
@@ -2463,8 +2463,8 @@
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 378826,
+      "sha256": "89158e15ce752ae1c4a3dc9edeaa2452954346ef8573a75f6e6b56dc5478e924"
     },
     {
       "path": "skills/loom-init/.loom-runtime/shared/scripts/loom_flow.py",
@@ -3088,8 +3088,8 @@
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 378826,
+      "sha256": "89158e15ce752ae1c4a3dc9edeaa2452954346ef8573a75f6e6b56dc5478e924"
     },
     {
       "path": "skills/loom-merge-ready/.loom-runtime/shared/scripts/loom_flow.py",
@@ -3708,8 +3708,8 @@
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 378826,
+      "sha256": "89158e15ce752ae1c4a3dc9edeaa2452954346ef8573a75f6e6b56dc5478e924"
     },
     {
       "path": "skills/loom-pre-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -4328,8 +4328,8 @@
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 378826,
+      "sha256": "89158e15ce752ae1c4a3dc9edeaa2452954346ef8573a75f6e6b56dc5478e924"
     },
     {
       "path": "skills/loom-resume/.loom-runtime/shared/scripts/loom_flow.py",
@@ -4948,8 +4948,8 @@
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 378826,
+      "sha256": "89158e15ce752ae1c4a3dc9edeaa2452954346ef8573a75f6e6b56dc5478e924"
     },
     {
       "path": "skills/loom-retire/.loom-runtime/shared/scripts/loom_flow.py",
@@ -5568,8 +5568,8 @@
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 378826,
+      "sha256": "89158e15ce752ae1c4a3dc9edeaa2452954346ef8573a75f6e6b56dc5478e924"
     },
     {
       "path": "skills/loom-review/.loom-runtime/shared/scripts/loom_flow.py",
@@ -6188,8 +6188,8 @@
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_check.py",
-      "bytes": 370455,
-      "sha256": "1d60fbb276d1ba43c22823adbd6c570fde5730e23e61167f26c815b729fb0cc8"
+      "bytes": 378826,
+      "sha256": "89158e15ce752ae1c4a3dc9edeaa2452954346ef8573a75f6e6b56dc5478e924"
     },
     {
       "path": "skills/loom-spec-review/.loom-runtime/shared/scripts/loom_flow.py",

package/payload/plugin/loom/skills/shared/scripts/loom_check.py

@@ -2417,14 +2417,20 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
         return failures
 
     required_paths = (
+        ".agents/plugins/marketplace.json",
         ".loom/bootstrap/manifest.json",
         ".loom/bootstrap/init-result.json",
         ".loom/bin/loom_init.py",
         ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
         ".loom/work-items/INIT-0001.md",
         ".loom/progress/INIT-0001.md",
         ".loom/reviews/INIT-0001.json",
         ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
     )
     failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
 
@@ -2459,6 +2465,12 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             "carrier-refresh",
             {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
         ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
     )
     for label, args, kind, expected in commands:
         payload, error = load_command_json(root, args)
@@ -2483,8 +2495,8 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             )
         if kind == "governance-status":
             maturity = payload.get("maturity")
-            if not isinstance(maturity, dict) or maturity.get("current") not in {"light", "standard", "strong"}:
-                failures.append(Failure("root-self-adoption", "`root governance status` must report adopted maturity"))
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
         if kind == "runtime-parity":
             checks = payload.get("checks")
             names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
@@ -2504,6 +2516,162 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
                 head_binding = review.get("head_binding")
                 if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
                     failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
+    failures.extend(check_root_self_plugin_install(root))
+    return failures
+
+
+def check_root_self_plugin_install(root: Path) -> list[Failure]:
+    failures: list[Failure] = []
+    marketplace_path = root / ".agents/plugins/marketplace.json"
+    if not marketplace_path.exists():
+        return failures
+    try:
+        marketplace = load_json_file(marketplace_path)
+    except json.JSONDecodeError as exc:
+        return [Failure("root-self-plugin", f"`.agents/plugins/marketplace.json` is invalid JSON: {exc.msg}")]
+    if not isinstance(marketplace, dict):
+        return [Failure("root-self-plugin", "`.agents/plugins/marketplace.json` must contain a JSON object")]
+    plugins = marketplace.get("plugins")
+    if not isinstance(plugins, list):
+        failures.append(Failure("root-self-plugin", "`marketplace.plugins` must be a list"))
+        plugins = []
+    loom_entry = next(
+        (
+            entry
+            for entry in plugins
+            if isinstance(entry, dict) and entry.get("name") == "loom"
+        ),
+        None,
+    )
+    if not isinstance(loom_entry, dict):
+        failures.append(Failure("root-self-plugin", "Codex marketplace must declare the `loom` plugin"))
+    else:
+        source = loom_entry.get("source")
+        if not isinstance(source, dict) or source.get("source") != "local":
+            failures.append(Failure("root-self-plugin", "Codex marketplace `loom` entry must use a local source"))
+        if not isinstance(source, dict) or source.get("path") != "./plugins/loom":
+            failures.append(Failure("root-self-plugin", "Codex marketplace `loom` entry must point to `./plugins/loom`"))
+
+    package_root = root / "packages/loom-installer"
+    cli_entry = package_root / "dist/src/cli.js"
+    package_json = package_root / "package.json"
+    if not package_json.exists():
+        failures.append(Failure("root-self-plugin", "installer package must exist for self-plugin verification"))
+        return failures
+
+    with tempfile.TemporaryDirectory(prefix="loom-root-self-plugin-") as tmp:
+        tmp_root = Path(tmp)
+        target = tmp_root / "target"
+        home = tmp_root / "home"
+        target.mkdir(parents=True, exist_ok=True)
+        home.mkdir(parents=True, exist_ok=True)
+        env = {
+            "HOME": str(home),
+            "CODEX_HOME": str(home / ".codex"),
+            "LOOM_INSTALLER_BUILD_TIMESTAMP": "2026-01-01T00:00:00.000Z",
+        }
+        commands: list[tuple[str, list[str], Path]] = []
+        if not (package_root / "node_modules/.bin/tsc").exists():
+            commands.append(
+                (
+                    "install self-plugin build dependencies",
+                    ["npm", "ci", "--prefix", str(package_root)],
+                    root,
+                )
+            )
+        commands.extend(
+            (
+                (
+                    "build self-plugin installer",
+                    ["npm", "--prefix", str(package_root), "run", "build"],
+                    root,
+                ),
+                (
+                    "install self-plugin payload",
+                    [
+                        "node",
+                        str(cli_entry),
+                        "add",
+                        "plugin",
+                        "--host",
+                        "codex",
+                        "--target",
+                        str(target),
+                        "--force",
+                        "--json",
+                    ],
+                    root,
+                ),
+            )
+        )
+        for label, args, cwd in commands:
+            try:
+                result = run_command(root, args, cwd=cwd, env=env, timeout_seconds=300)
+            except subprocess.TimeoutExpired:
+                failures.append(Failure("root-self-plugin", f"`{label}` timed out"))
+                return failures
+            if result.returncode != 0:
+                detail = result.stderr.strip() or result.stdout.strip() or "command failed without output"
+                failures.append(Failure("root-self-plugin", f"`{label}` failed: {detail}"))
+                return failures
+
+        installed_marketplace = target / ".agents/plugins/marketplace.json"
+        plugin_root = target / "plugins/loom"
+        expected_paths = (
+            plugin_root / ".codex-plugin/plugin.json",
+            plugin_root / "skills/registry.json",
+            plugin_root / "skills/install-layout.json",
+            plugin_root / "skills/shared/scripts/loom_init.py",
+            plugin_root / "skills/loom-init/SKILL.md",
+        )
+        for path in expected_paths:
+            if not path.exists():
+                failures.append(Failure("root-self-plugin", f"self-plugin install is missing `{path.relative_to(target).as_posix()}`"))
+        try:
+            installed = load_json_file(installed_marketplace)
+        except (FileNotFoundError, json.JSONDecodeError) as exc:
+            failures.append(Failure("root-self-plugin", f"installed marketplace is unreadable: {exc}"))
+        else:
+            installed_plugins = installed.get("plugins") if isinstance(installed, dict) else None
+            installed_entry = None
+            if isinstance(installed_plugins, list):
+                installed_entry = next(
+                    (
+                        entry
+                        for entry in installed_plugins
+                        if isinstance(entry, dict) and entry.get("name") == "loom"
+                    ),
+                    None,
+                )
+            installed_source = installed_entry.get("source") if isinstance(installed_entry, dict) else None
+            if not isinstance(installed_source, dict) or installed_source.get("path") != "./plugins/loom":
+                failures.append(Failure("root-self-plugin", "installed marketplace must point `loom` to `./plugins/loom`"))
+        if plugin_root.exists():
+            generated_cache = [
+                path.relative_to(target).as_posix()
+                for path in plugin_root.rglob("*")
+                if "__pycache__" in path.parts or path.suffix == ".pyc"
+            ]
+            if generated_cache:
+                preview = ", ".join(generated_cache[:5])
+                failures.append(Failure("root-self-plugin", f"self-plugin payload must exclude Python cache artifacts: {preview}"))
     return failures
 
 
@@ -5097,7 +5265,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"
@@ -7561,7 +7733,7 @@ def collect_failures(root: Path) -> list[Failure]:
 
 
 def print_report(root: Path, failures: list[Failure]) -> None:
-    categories_checked = 19
+    categories_checked = 20
     if not failures:
         print(f"loom_check: OK ({root})")
         print(f"checked {categories_checked} surfaces")

package/payload/skills/loom-adopt/.loom-runtime/shared/scripts/loom_check.py

@@ -2417,14 +2417,20 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
         return failures
 
     required_paths = (
+        ".agents/plugins/marketplace.json",
         ".loom/bootstrap/manifest.json",
         ".loom/bootstrap/init-result.json",
         ".loom/bin/loom_init.py",
         ".loom/bin/loom_flow.py",
+        ".loom/companion/README.md",
+        ".loom/companion/manifest.json",
+        ".loom/companion/repo-interface.json",
+        ".loom/companion/interop.json",
         ".loom/work-items/INIT-0001.md",
         ".loom/progress/INIT-0001.md",
         ".loom/reviews/INIT-0001.json",
         ".loom/status/current.md",
+        "docs/evidence/validations/validation-loom-self-governance-adoption.md",
     )
     failures.extend(check_required_paths(root, "root-self-adoption", required_paths))
 
@@ -2459,6 +2465,12 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             "carrier-refresh",
             {"result": "pass", "schema_version": "loom-carrier-refresh/v1"},
         ),
+        (
+            "root shadow parity",
+            ["python3", ".loom/bin/loom_flow.py", "shadow-parity", "--target", "."],
+            "shadow-parity",
+            {"result": "pass"},
+        ),
     )
     for label, args, kind, expected in commands:
         payload, error = load_command_json(root, args)
@@ -2483,8 +2495,8 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
             )
         if kind == "governance-status":
             maturity = payload.get("maturity")
-            if not isinstance(maturity, dict) or maturity.get("current") not in {"light", "standard", "strong"}:
-                failures.append(Failure("root-self-adoption", "`root governance status` must report adopted maturity"))
+            if not isinstance(maturity, dict) or maturity.get("current") != "strong":
+                failures.append(Failure("root-self-adoption", "`root governance status` must report strong maturity after self-management binding"))
         if kind == "runtime-parity":
             checks = payload.get("checks")
             names = {check.get("name") for check in checks if isinstance(check, dict)} if isinstance(checks, list) else set()
@@ -2504,6 +2516,162 @@ def check_root_self_adoption_carrier(root: Path) -> list[Failure]:
                 head_binding = review.get("head_binding")
                 if isinstance(head_binding, dict) and head_binding.get("status") == "stale":
                     failures.append(Failure("root-self-adoption", "`root carrier refresh --dry-run` must detect stale review head binding"))
+        if kind == "shadow-parity":
+            reports = payload.get("reports")
+            report_surfaces = {
+                report.get("surface")
+                for report in reports
+                if isinstance(report, dict)
+            } if isinstance(reports, list) else set()
+            if report_surfaces != {"admission", "review", "merge_ready", "closeout"}:
+                failures.append(Failure("root-self-adoption", "`root shadow parity` must cover admission, review, merge_ready, and closeout"))
+            surface = payload.get("governance_surface")
+            if isinstance(surface, dict):
+                repo_interface = surface.get("repo_interface")
+                repo_interop = surface.get("repo_interop")
+                if not isinstance(repo_interface, dict) or repo_interface.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo companion interface"))
+                if not isinstance(repo_interop, dict) or repo_interop.get("availability") != "present":
+                    failures.append(Failure("root-self-adoption", "`root shadow parity` must consume the root repo interop contract"))
+    failures.extend(check_root_self_plugin_install(root))
+    return failures
+
+
+def check_root_self_plugin_install(root: Path) -> list[Failure]:
+    failures: list[Failure] = []
+    marketplace_path = root / ".agents/plugins/marketplace.json"
+    if not marketplace_path.exists():
+        return failures
+    try:
+        marketplace = load_json_file(marketplace_path)
+    except json.JSONDecodeError as exc:
+        return [Failure("root-self-plugin", f"`.agents/plugins/marketplace.json` is invalid JSON: {exc.msg}")]
+    if not isinstance(marketplace, dict):
+        return [Failure("root-self-plugin", "`.agents/plugins/marketplace.json` must contain a JSON object")]
+    plugins = marketplace.get("plugins")
+    if not isinstance(plugins, list):
+        failures.append(Failure("root-self-plugin", "`marketplace.plugins` must be a list"))
+        plugins = []
+    loom_entry = next(
+        (
+            entry
+            for entry in plugins
+            if isinstance(entry, dict) and entry.get("name") == "loom"
+        ),
+        None,
+    )
+    if not isinstance(loom_entry, dict):
+        failures.append(Failure("root-self-plugin", "Codex marketplace must declare the `loom` plugin"))
+    else:
+        source = loom_entry.get("source")
+        if not isinstance(source, dict) or source.get("source") != "local":
+            failures.append(Failure("root-self-plugin", "Codex marketplace `loom` entry must use a local source"))
+        if not isinstance(source, dict) or source.get("path") != "./plugins/loom":
+            failures.append(Failure("root-self-plugin", "Codex marketplace `loom` entry must point to `./plugins/loom`"))
+
+    package_root = root / "packages/loom-installer"
+    cli_entry = package_root / "dist/src/cli.js"
+    package_json = package_root / "package.json"
+    if not package_json.exists():
+        failures.append(Failure("root-self-plugin", "installer package must exist for self-plugin verification"))
+        return failures
+
+    with tempfile.TemporaryDirectory(prefix="loom-root-self-plugin-") as tmp:
+        tmp_root = Path(tmp)
+        target = tmp_root / "target"
+        home = tmp_root / "home"
+        target.mkdir(parents=True, exist_ok=True)
+        home.mkdir(parents=True, exist_ok=True)
+        env = {
+            "HOME": str(home),
+            "CODEX_HOME": str(home / ".codex"),
+            "LOOM_INSTALLER_BUILD_TIMESTAMP": "2026-01-01T00:00:00.000Z",
+        }
+        commands: list[tuple[str, list[str], Path]] = []
+        if not (package_root / "node_modules/.bin/tsc").exists():
+            commands.append(
+                (
+                    "install self-plugin build dependencies",
+                    ["npm", "ci", "--prefix", str(package_root)],
+                    root,
+                )
+            )
+        commands.extend(
+            (
+                (
+                    "build self-plugin installer",
+                    ["npm", "--prefix", str(package_root), "run", "build"],
+                    root,
+                ),
+                (
+                    "install self-plugin payload",
+                    [
+                        "node",
+                        str(cli_entry),
+                        "add",
+                        "plugin",
+                        "--host",
+                        "codex",
+                        "--target",
+                        str(target),
+                        "--force",
+                        "--json",
+                    ],
+                    root,
+                ),
+            )
+        )
+        for label, args, cwd in commands:
+            try:
+                result = run_command(root, args, cwd=cwd, env=env, timeout_seconds=300)
+            except subprocess.TimeoutExpired:
+                failures.append(Failure("root-self-plugin", f"`{label}` timed out"))
+                return failures
+            if result.returncode != 0:
+                detail = result.stderr.strip() or result.stdout.strip() or "command failed without output"
+                failures.append(Failure("root-self-plugin", f"`{label}` failed: {detail}"))
+                return failures
+
+        installed_marketplace = target / ".agents/plugins/marketplace.json"
+        plugin_root = target / "plugins/loom"
+        expected_paths = (
+            plugin_root / ".codex-plugin/plugin.json",
+            plugin_root / "skills/registry.json",
+            plugin_root / "skills/install-layout.json",
+            plugin_root / "skills/shared/scripts/loom_init.py",
+            plugin_root / "skills/loom-init/SKILL.md",
+        )
+        for path in expected_paths:
+            if not path.exists():
+                failures.append(Failure("root-self-plugin", f"self-plugin install is missing `{path.relative_to(target).as_posix()}`"))
+        try:
+            installed = load_json_file(installed_marketplace)
+        except (FileNotFoundError, json.JSONDecodeError) as exc:
+            failures.append(Failure("root-self-plugin", f"installed marketplace is unreadable: {exc}"))
+        else:
+            installed_plugins = installed.get("plugins") if isinstance(installed, dict) else None
+            installed_entry = None
+            if isinstance(installed_plugins, list):
+                installed_entry = next(
+                    (
+                        entry
+                        for entry in installed_plugins
+                        if isinstance(entry, dict) and entry.get("name") == "loom"
+                    ),
+                    None,
+                )
+            installed_source = installed_entry.get("source") if isinstance(installed_entry, dict) else None
+            if not isinstance(installed_source, dict) or installed_source.get("path") != "./plugins/loom":
+                failures.append(Failure("root-self-plugin", "installed marketplace must point `loom` to `./plugins/loom`"))
+        if plugin_root.exists():
+            generated_cache = [
+                path.relative_to(target).as_posix()
+                for path in plugin_root.rglob("*")
+                if "__pycache__" in path.parts or path.suffix == ".pyc"
+            ]
+            if generated_cache:
+                preview = ", ".join(generated_cache[:5])
+                failures.append(Failure("root-self-plugin", f"self-plugin payload must exclude Python cache artifacts: {preview}"))
     return failures
 
 
@@ -5097,7 +5265,11 @@ def check_daily_execution_cli(root: Path) -> list[Failure]:
         except subprocess.TimeoutExpired:
             gh_auth_probe = None
     gh_auth_ready = gh_auth_probe is not None and gh_auth_probe.returncode == 0
-    if gh_auth_ready:
+    # GitHub Actions' ephemeral token is enough for self-governance host binding
+    # reads, but it is not a stable authority for historical live issue/PR/project
+    # samples. Keep those samples as local authenticated coverage instead of
+    # making CI depend on mutable host permissions.
+    if gh_auth_ready and os.environ.get("GITHUB_ACTIONS") != "true":
         with tempfile.TemporaryDirectory(prefix="loom-check-installed-post-merge-") as tmp:
             tmp_root = Path(tmp)
             install_root = tmp_root / "installed" / "skills"
@@ -7561,7 +7733,7 @@ def collect_failures(root: Path) -> list[Failure]:
 
 
 def print_report(root: Path, failures: list[Failure]) -> None:
-    categories_checked = 19
+    categories_checked = 20
     if not failures:
         print(f"loom_check: OK ({root})")
         print(f"checked {categories_checked} surfaces")