@mindrian_os/cli 2.0.0-beta.3 → 2.0.0-beta.33

package/scripts/verify-release

@@ -0,0 +1,744 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# verify-release: Pre-release verification for MindrianOS plugin
+# Tests everything that can break for users: validation, visuals, onboarding, colors, marketplace sync.
+# Run this BEFORE every release. Fails loud on any issue.
+#
+# Usage: bash scripts/verify-release
+# Exit code 0 = all clear, non-zero = DO NOT RELEASE
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PLUGIN_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+MARKETPLACE_DIR="$HOME/mindrian-marketplace"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+NC='\033[0m'
+BOLD='\033[1m'
+
+PASS=0
+FAIL=0
+WARN=0
+
+pass() { PASS=$((PASS + 1)); echo -e "  ${GREEN}✓${NC} $1"; }
+fail() { FAIL=$((FAIL + 1)); echo -e "  ${RED}✗${NC} $1"; }
+warn() { WARN=$((WARN + 1)); echo -e "  ${YELLOW}⚠${NC} $1"; }
+
+echo -e "${CYAN}${BOLD}=== MindrianOS Pre-Release Verification ===${NC}"
+echo ""
+
+# ============================================================
+# 1. PLUGIN VALIDATION (Claude Code's own validator)
+# ============================================================
+echo -e "${BOLD}1. Plugin Validation${NC}"
+
+VALIDATION=$(claude plugin validate "$PLUGIN_ROOT" 2>&1 || true)
+if echo "$VALIDATION" | grep -q "Validation passed"; then
+  pass "Plugin validation passed (0 errors)"
+else
+  fail "Plugin validation FAILED:"
+  echo "$VALIDATION" | grep -E "error|Error" | head -5
+fi
+
+# ============================================================
+# 2. MARKETPLACE VALIDATION
+# ============================================================
+echo -e "\n${BOLD}2. Marketplace Validation${NC}"
+
+if [ -d "$MARKETPLACE_DIR" ]; then
+  MVAL=$(claude plugin validate "$MARKETPLACE_DIR" 2>&1 || true)
+  if echo "$MVAL" | grep -q "Validation failed"; then
+    fail "Marketplace validation FAILED"
+  else
+    pass "Marketplace validation passed"
+  fi
+else
+  warn "Marketplace directory not found at $MARKETPLACE_DIR"
+fi
+
+# ============================================================
+# 3. VERSION SYNC (plugin.json == marketplace.json)
+# ============================================================
+echo -e "\n${BOLD}3. Version Sync${NC}"
+
+PLUGIN_VER=$(python3 -c "import json; print(json.load(open('$PLUGIN_ROOT/.claude-plugin/plugin.json'))['version'])" 2>/dev/null || echo "MISSING")
+
+if [ -f "$MARKETPLACE_DIR/.claude-plugin/marketplace.json" ]; then
+  MARKET_VER=$(python3 -c "import json; print(json.load(open('$MARKETPLACE_DIR/.claude-plugin/marketplace.json'))['plugins'][0]['version'])" 2>/dev/null || echo "MISSING")
+  if [ "$PLUGIN_VER" = "$MARKET_VER" ]; then
+    pass "Versions match: plugin=$PLUGIN_VER marketplace=$MARKET_VER"
+  else
+    # Two-commit steady state (release.sh Step 7.5 design): after a release the
+    # catalog stays at the released vN while plugin.json carries the NEXT
+    # pre-release placeholder (inc(vN)). That mismatch is HEALTHY, not a drift.
+    #
+    # Found + fixed 2026-07-31 (v1.15.0 Gate-0 finalize -> v1.16.0-beta.1 start):
+    # semver.inc(vN, 'prerelease', 'beta') always yields '.beta.0' for a bare
+    # stable vN, but release.sh's own finalize step (Step 7.5) hardcodes
+    # '.beta.1' as the next placeholder -- confirmed live via its own commit
+    # message ("chore: bump to v1.15.4-beta.1"). An EXACT-counter comparison
+    # against semver.inc's independent computation false-fails on every
+    # finalize's real output. The check's actual intent (per the comment
+    # above) is "same base version, one patch ahead, carrying ANY prerelease
+    # tag" -- not "matches this one library call's specific counter value".
+    # Compare bases with the prerelease suffix stripped instead.
+    PLUGIN_BASE=$(echo "$PLUGIN_VER" | cut -d- -f1)
+    EXPECTED_BASE=$(node -e "try{console.log(require('semver').inc(process.argv[1],'patch'))}catch(e){console.log('ERR')}" "$MARKET_VER" 2>/dev/null || echo "ERR")
+    if [ "$PLUGIN_BASE" = "$EXPECTED_BASE" ] && echo "$PLUGIN_VER" | grep -q -- "-beta\."; then
+      pass "Two-commit steady state: marketplace=$MARKET_VER (released), plugin=$PLUGIN_VER (next placeholder)"
+    else
+      fail "Version MISMATCH: plugin=$PLUGIN_VER marketplace=$MARKET_VER (neither equal nor the documented next-placeholder state -- expected base $EXPECTED_BASE with a -beta.N suffix)"
+    fi
+  fi
+else
+  warn "Marketplace.json not found"
+fi
+
+# ============================================================
+# 4. COMMAND COUNT + CRITICAL COMMANDS
+# ============================================================
+echo -e "\n${BOLD}4. Commands${NC}"
+
+CMD_COUNT=$(ls "$PLUGIN_ROOT/commands/"*.md 2>/dev/null | wc -l)
+if [ "$CMD_COUNT" -ge 60 ]; then
+  pass "Command count: $CMD_COUNT (>= 60)"
+else
+  fail "Command count: $CMD_COUNT (expected >= 60)"
+fi
+
+CRITICAL_CMDS=(new-project onboard help setup status room splash update diagnose act export present dashboard wiki visualize)
+for cmd in "${CRITICAL_CMDS[@]}"; do
+  if [ -f "$PLUGIN_ROOT/commands/$cmd.md" ]; then
+    # Verify frontmatter has name field
+    if head -5 "$PLUGIN_ROOT/commands/$cmd.md" | grep -q "name: $cmd"; then
+      : # ok
+    else
+      fail "commands/$cmd.md missing 'name: $cmd' in frontmatter"
+    fi
+  else
+    fail "CRITICAL command missing: commands/$cmd.md"
+  fi
+done
+pass "All ${#CRITICAL_CMDS[@]} critical commands present with valid frontmatter"
+
+# ============================================================
+# 5. AGENTS (all must have frontmatter)
+# ============================================================
+echo -e "\n${BOLD}5. Agents${NC}"
+
+AGENT_COUNT=$(ls "$PLUGIN_ROOT/agents/"*.md 2>/dev/null | wc -l)
+AGENTS_NO_FM=0
+for agent in "$PLUGIN_ROOT/agents/"*.md; do
+  if ! head -1 "$agent" | grep -q "^---"; then
+    AGENTS_NO_FM=$((AGENTS_NO_FM + 1))
+    fail "Agent missing frontmatter: $(basename "$agent")"
+  fi
+done
+if [ "$AGENTS_NO_FM" -eq 0 ]; then
+  pass "All $AGENT_COUNT agents have valid frontmatter"
+fi
+
+# ============================================================
+# 6. ALLOWED-TOOLS VALIDATION (the Amnon bug)
+# ============================================================
+echo -e "\n${BOLD}6. Allowed-Tools Integrity${NC}"
+
+BAD_TOOLS=0
+for file in "$PLUGIN_ROOT/commands/"*.md "$PLUGIN_ROOT/agents/"*.md; do
+  # Extract ONLY the YAML frontmatter (between --- markers), then check allowed-tools
+  FRONTMATTER=$(sed -n '1,/^---$/p' "$file" 2>/dev/null | tail -n +2 | sed '$d')
+  if echo "$FRONTMATTER" | grep -A 50 "^allowed-tools:" 2>/dev/null | grep -E "^\s*-.*\(or |^\s*-.*fallback:|^\s*-.*\). If " > /dev/null 2>&1; then
+    BAD_TOOLS=$((BAD_TOOLS + 1))
+    fail "Invalid allowed-tools in $(basename "$file") (inline comments in frontmatter)"
+  fi
+done
+if [ "$BAD_TOOLS" -eq 0 ]; then
+  pass "All allowed-tools entries are plain strings (no inline comments)"
+fi
+
+# ============================================================
+# 7. VISUAL ELEMENTS
+# ============================================================
+echo -e "\n${BOLD}7. Visual Elements${NC}"
+
+# Banner script exists and produces ANSI output
+if [ -x "$PLUGIN_ROOT/scripts/banner" ]; then
+  BANNER_OUT=$(bash "$PLUGIN_ROOT/scripts/banner" "$PLUGIN_VER" 2>&1)
+  if echo "$BANNER_OUT" | grep -q "\[48;2;"; then
+    pass "Banner renders with ANSI 24-bit color codes"
+  else
+    fail "Banner output missing ANSI color codes"
+  fi
+  if echo "$BANNER_OUT" | grep -q "$PLUGIN_VER"; then
+    pass "Banner shows version $PLUGIN_VER"
+  else
+    fail "Banner does not show current version"
+  fi
+else
+  fail "scripts/banner not found or not executable"
+fi
+
+# Help command has ANSI color definitions
+# Note (2026-05-19): Phase 121.5-07 ("bulletproof ASCII /mos:help renderer") moved
+# the De Stijl ANSI palette from commands/help.md to scripts/help-renderer.cjs --
+# the markdown command file now delegates rendering to the renderer module. This
+# check follows the move.
+HELP_RENDERER="$PLUGIN_ROOT/scripts/help-renderer.cjs"
+if [ -f "$HELP_RENDERER" ] && grep -q '38;2;166;61;47' "$HELP_RENDERER" 2>/dev/null; then
+  pass "/mos:help has De Stijl ANSI color codes (red, blue, yellow, green, amethyst, teal) -- in scripts/help-renderer.cjs"
+else
+  fail "/mos:help renderer missing ANSI color code definitions (looked in scripts/help-renderer.cjs)"
+fi
+
+# Help has all 6 color blocks defined
+HELP_COLORS=0
+for hex in "166;61;47" "30;58;110" "107;78;139" "200;164;60" "45;107;74" "42;107;94"; do
+  if grep -q "$hex" "$HELP_RENDERER" 2>/dev/null; then
+    HELP_COLORS=$((HELP_COLORS + 1))
+  fi
+done
+if [ "$HELP_COLORS" -eq 6 ]; then
+  pass "/mos:help defines all 6 De Stijl color categories (in scripts/help-renderer.cjs)"
+else
+  fail "/mos:help only has $HELP_COLORS/6 color definitions (looked in scripts/help-renderer.cjs)"
+fi
+
+# visual-ops.cjs exists (dependency for status line)
+if [ -f "$PLUGIN_ROOT/lib/core/visual-ops.cjs" ]; then
+  pass "visual-ops.cjs exists (status line dependency)"
+else
+  fail "visual-ops.cjs MISSING (status line will break)"
+fi
+
+# ============================================================
+# 7b. COMMAND REGISTRATION PRECONDITIONS
+# ============================================================
+# Quick task 260705-jeq: the static precondition sweep catches the authoring
+# mistakes that make Claude Code SILENTLY skip a command file (broken frontmatter
+# fence, a tab in the YAML block, an illegal name, a case-insensitive collision).
+# A FAIL here blocks the release the same way it blocks a commit -- one sweep,
+# lib/core/command-registration-check.cjs, shared with the pre-commit hook.
+echo -e "\n${BOLD}7b. Command Registration Preconditions${NC}"
+
+REG_OUT=$(node "$PLUGIN_ROOT/lib/core/command-registration-check.cjs" 2>&1) && REG_CODE=0 || REG_CODE=$?
+if [ "$REG_CODE" -ne 0 ]; then
+  fail "Command-registration precondition sweep FAILED (a command would silently not register):"
+  echo "$REG_OUT" | grep '^FAIL' | head -10
+else
+  REG_WARNS=$(echo "$REG_OUT" | grep -c '^WARN' || true)
+  if [ "$REG_WARNS" -gt 0 ]; then
+    warn "Command-registration preconditions clean; $REG_WARNS render-quality warning(s) (over-long / missing description)"
+  else
+    pass "Command-registration preconditions clean (every command will register)"
+  fi
+fi
+
+# ============================================================
+# 8. ONBOARDING FLOW
+# ============================================================
+echo -e "\n${BOLD}8. Onboarding${NC}"
+
+# Onboard command exists and has the right structure
+if [ -f "$PLUGIN_ROOT/commands/onboard.md" ]; then
+  if grep -q "name: onboard" "$PLUGIN_ROOT/commands/onboard.md"; then
+    pass "/mos:onboard exists with valid frontmatter"
+  else
+    fail "/mos:onboard has wrong frontmatter"
+  fi
+else
+  fail "/mos:onboard MISSING"
+fi
+
+# New-project command exists
+if [ -f "$PLUGIN_ROOT/commands/new-project.md" ]; then
+  pass "/mos:new-project exists"
+else
+  fail "/mos:new-project MISSING"
+fi
+
+# Session-start hook mentions onboarding detection
+if grep -q "mindrian-onboarded\|onboard\|first.time\|NEW_USER" "$PLUGIN_ROOT/scripts/session-start" 2>/dev/null; then
+  pass "session-start detects new users for onboarding"
+else
+  warn "session-start may not detect new users"
+fi
+
+# ============================================================
+# 9. HOOKS + SETTINGS
+# ============================================================
+echo -e "\n${BOLD}9. Hooks + Settings${NC}"
+
+# hooks.json is valid JSON
+if python3 -c "import json; json.load(open('$PLUGIN_ROOT/hooks/hooks.json'))" 2>/dev/null; then
+  pass "hooks.json is valid JSON"
+else
+  fail "hooks.json is INVALID JSON"
+fi
+
+# settings.json has statusLine
+if grep -q "statusLine" "$PLUGIN_ROOT/settings.json" 2>/dev/null; then
+  pass "settings.json has statusLine configuration"
+else
+  fail "settings.json MISSING statusLine (no status bar for users)"
+fi
+
+# settings.json has larry-extended as default agent
+if grep -q "larry-extended" "$PLUGIN_ROOT/settings.json" 2>/dev/null; then
+  pass "settings.json defaults to larry-extended agent"
+else
+  fail "settings.json missing larry-extended default"
+fi
+
+# context-monitor script exists and is executable
+if [ -x "$PLUGIN_ROOT/scripts/context-monitor" ]; then
+  pass "context-monitor script exists (status line)"
+else
+  fail "context-monitor MISSING or not executable"
+fi
+
+# ============================================================
+# 10. SKILLS
+# ============================================================
+echo -e "\n${BOLD}10. Skills${NC}"
+
+REQUIRED_SKILLS=(larry-personality pws-methodology ui-system room-passive room-proactive context-engine brain-connector)
+for skill in "${REQUIRED_SKILLS[@]}"; do
+  if [ -f "$PLUGIN_ROOT/skills/$skill/SKILL.md" ]; then
+    : # ok
+  else
+    fail "Skill MISSING: skills/$skill/SKILL.md"
+  fi
+done
+pass "All ${#REQUIRED_SKILLS[@]} required skills present"
+
+# ============================================================
+# 10b. SKILL MIRRORS
+# ============================================================
+# Quick task 260705-sy9: every command is mirrored into skills/ as the Windows
+# registration workaround (260705-ob7). A stale mirror ships a wrong command
+# body to affected machines, so drift blocks the release. The check also
+# verifies the SKIP_LIST skill (trending-to-absurd) is present and still
+# genuinely divergent from its command.
+echo -e "\n${BOLD}10b. Skill Mirrors${NC}"
+
+MIRROR_OUT=$(node "$PLUGIN_ROOT/scripts/build-skill-mirrors.cjs" --check 2>&1) && MIRROR_CODE=0 || MIRROR_CODE=$?
+if [ "$MIRROR_CODE" -ne 0 ]; then
+  fail "Skill-mirror check FAILED (stale/missing mirror or broken skip-list skill):"
+  echo "$MIRROR_OUT" | head -10
+else
+  pass "Skill mirrors in sync with commands/ (build-skill-mirrors --check)"
+fi
+
+# ============================================================
+# 10c. PLUGIN PATH ANCHORING
+# ============================================================
+# Phase 271: a bare plugin-relative path in command, skill, agent or pipeline
+# markdown (Read `references/foo.md`) resolves against the SESSION'S CURRENT
+# WORKING DIRECTORY, not the plugin install directory, so it works by pure
+# coincidence in this dev repo (whose root happens to contain references/) and
+# fails in every real Data Room a user installs into, on all three surfaces.
+# The anchored form is ${CLAUDE_PLUGIN_ROOT}/references/... for commands,
+# agents and pipelines, and the fail-closed
+# ${MINDRIAN_OS_ROOT:-${CLAUDE_PLUGIN_ROOT:?...}}/ wrapper for hand-authored
+# skills, which a foreign Agent-Skills host can load with no plugin root set.
+#
+# This gate exists because the originating RCA,
+# .planning/debug/resolved/file-meeting-missing-reference-files.md, fixed
+# exactly ONE file (commands/file-meeting.md) and named the structural,
+# repo-wide guard as missing work in its own Non-Code Follow-ups section. A
+# one-file fix with no gate is how this class came back: the SAME disease was
+# already fixed once for `bash scripts/<name>` call sites
+# (.planning/debug/resolved/intern-w1-rooms-skill-script-path.md) and the
+# references/ pattern survived that sweep untouched, because both fixes were
+# scoped by grep pattern instead of by resolution mechanism. A sweep cleans the
+# tree once; only a release gate keeps it clean.
+#
+# Fail-closed on purpose. The gate is the phase's own oracle, and an advisory
+# WARN here would let 30-plus unanchored citations ship in a release while the
+# board still reads green.
+echo -e "\n${BOLD}10c. Plugin Path Anchoring${NC}"
+
+ANCHOR_OUT=$(node "$PLUGIN_ROOT/scripts/check-plugin-path-anchoring.cjs" --check 2>&1) && ANCHOR_CODE=0 || ANCHOR_CODE=$?
+if [ "$ANCHOR_CODE" -ne 0 ]; then
+  fail "Plugin path anchoring FAILED (bare references/ citations resolve against user cwd, not the plugin install dir):"
+  echo "$ANCHOR_OUT" | tail -12
+  echo "  Known open blocker as of Phase 271 close: 30 sites across 16 commands are ALREADY FIXED"
+  echo "  in the working tree but cannot be committed until Phase 267.3 lands (they lack the"
+  echo "  interactive_first_reward declaration the mva-rule-linter requires), plus"
+  echo "  commands/doctor.md:262. See .planning/phases/271-*/deferred-items.md (DEFERRED-271-D1)."
+else
+  pass "Every plugin-relative references/ citation is anchored (check-plugin-path-anchoring --check)"
+fi
+
+# ============================================================
+# 10d. FIRST-REWARD SURFACE DECLARATIONS
+# ============================================================
+# Phase 267.3 (ruling D-A, GUARD-04). The reward-before-investment guard reads
+# `interactive_first_reward` out of commands/*.md frontmatter. A bash hook has
+# no frontmatter block, so scripts/session-start -- which emits the very first
+# prose any user ever sees -- had nowhere to declare anything and sat outside
+# the guard entirely (GAP G-1). The declaration now lives in the sibling
+# registry data/first-reward-surfaces.json, validated by the SAME closed
+# vocabulary the frontmatter path uses.
+#
+# This gate makes the registry load-bearing. Without it the registry is a text
+# file: a record could name a deleted surface, carry a value outside the
+# vocabulary, duplicate an id, or lose its `why`, and a release would still cut
+# clean. --surfaces fails closed on every one of those (exit 0 clean, 1
+# violation, 2 ungateable), and its companion tripwire
+# tests/test-267.3-session-start-declaration.cjs additionally proves each
+# record's `anchor` still points at a live literal inside the file it names.
+#
+# WHAT IS DELIBERATELY NOT WIRED HERE, and why, so a later reader does not
+# "fix" the omission: the whole-tree commands/ audit (the CLI's default mode,
+# `node scripts/check-reward-before-investment.cjs` with no flag). It reads 67
+# missing today and it is SUPPOSED to. Wiring it now would turn every release
+# red for work this plan does not do, which produces a bypass habit rather than
+# a gate. Ruling D-C part 3 assigns that promotion to plan 267.3-08, after
+# plans 04, 06 and 07 land the 67 declarations and it genuinely reads zero.
+# Wire the gate, do not relax it, and do not turn it on before the work that
+# makes it green is done (the 271-05 discipline).
+echo -e "\n${BOLD}10d. First-Reward Surface Declarations${NC}"
+
+SURFACES_OUT=$(node "$PLUGIN_ROOT/scripts/check-reward-before-investment.cjs" --surfaces "$PLUGIN_ROOT" 2>&1) && SURFACES_CODE=0 || SURFACES_CODE=$?
+if [ "$SURFACES_CODE" -ne 0 ]; then
+  fail "First-reward surface declarations FAILED (a declared surface is missing, invalid, or points at a file that no longer exists):"
+  echo "$SURFACES_OUT" | tail -20
+  echo "  Fix the offending record in data/first-reward-surfaces.json, or restore the surface it names."
+  echo "  Legal values are the REWARD_TYPES closed vocabulary; a new term is a canon amendment,"
+  echo "  never a registry-local invention. See docs/reward-before-investment-rule.md."
+else
+  SURFACES_COUNT=$(echo "$SURFACES_OUT" | sed -n 's/^mva-rule-linter: scanning \([0-9]*\) declared surfaces$/\1/p' | head -1)
+  pass "All ${SURFACES_COUNT:-0} declared first-reward surfaces are valid (check-reward-before-investment --surfaces)"
+fi
+
+# ============================================================
+# 10e. WHOLE-TREE FIRST-REWARD DECLARATIONS
+# ============================================================
+# Phase 267.3 (ruling D-C part 3, GUARD-08). Gate 10d above only proves the
+# SIBLING REGISTRY (data/first-reward-surfaces.json) is internally valid; it
+# says nothing about the 113 commands/*.md files themselves. The commit-time
+# hook only ever sees STAGED commands/*.md (scripts/hooks/pre-commit-room-
+# minto-guard.sh:300), so a file that is never staged again after the rule
+# shipped stays invisible forever -- this is exactly the debt-ratchet
+# DEFERRED-271-D1 measured: 67 of 113 commands went undeclared for three
+# months because no commit happened to touch them. A staged-scoped gate
+# cannot measure a repo-wide gap; only a whole-tree audit can.
+#
+# This gate runs the CLI's own full-audit default mode (no flag, no
+# --staged, no --surfaces) against the real commands/ directory and fails
+# the release closed on any missing or invalid declaration. It was left
+# deliberately unwired until now (see gate 10d's own comment above) because
+# wiring it before the 67 declarations landed would have turned every
+# release red for work still in flight, which produces a bypass habit
+# rather than a gate (the 271-05 discipline: wire the gate, do not relax
+# it, and do not turn it on before the work that makes it green is done).
+# Plans 267.3-04, 06 and 07 landed all 67 declarations; the audit now reads
+# zero missing and zero invalid over all 113 files, so this promotion is
+# safe. Do not relax, allowlist or soften this gate, and do not remove
+# gate 10d above -- the two reward gates are complementary, not redundant:
+# 10d proves the registry is valid, 10e proves the commands/ tree is valid.
+echo -e "\n${BOLD}10e. Whole-Tree First-Reward Declarations${NC}"
+
+FULL_AUDIT_OUT=$(node "$PLUGIN_ROOT/scripts/check-reward-before-investment.cjs" "$PLUGIN_ROOT/commands" 2>&1) && FULL_AUDIT_CODE=0 || FULL_AUDIT_CODE=$?
+if [ "$FULL_AUDIT_CODE" -ne 0 ]; then
+  fail "Whole-tree first-reward audit FAILED (a commands/*.md file is missing or carries an invalid interactive_first_reward):"
+  echo "$FULL_AUDIT_OUT" | tail -20
+  echo "  Fix: declare interactive_first_reward in the frontmatter of each missing/invalid command."
+  echo "  See docs/reward-before-investment-rule.md."
+else
+  FULL_AUDIT_COMPLIANT=$(echo "$FULL_AUDIT_OUT" | sed -n 's/^  compliant: \([0-9]*\)$/\1/p' | head -1)
+  pass "All ${FULL_AUDIT_COMPLIANT:-0} commands/*.md carry a valid interactive_first_reward declaration (check-reward-before-investment, full audit)"
+fi
+
+# ============================================================
+# 10f. PLUGIN SCRIPT-INVOCATION ANCHORING
+# ============================================================
+# Phase 274, the sibling of gate 10c. A bare `bash scripts/<name>` or
+# `node scripts/<name>` line in command, skill, agent or pipeline markdown
+# resolves against the SESSION'S CURRENT WORKING DIRECTORY, exactly the same
+# defect class 10c already gates for references/ citations, but this one
+# dies LOUDLY at runtime: exit 127 from bash, MODULE_NOT_FOUND from node, in
+# the user's face mid-command, unlike the citation class's silent degraded
+# read. See .planning/phases/274-bare-scripts-invocation-anchoring-the-
+# adjacent-class-phase-2/ for the full research and sweep record: this is
+# the FOURTH pass at one disease class in this repo (intern-w1's
+# bash-scripts-in-skills fix, the file-meeting RCA's references-only fix,
+# Phase 271's references-repo-wide sweep, and this phase's scripts-repo-wide
+# sweep), each of the first three scoped by grep pattern instead of
+# resolution mechanism, which is why each left the sibling pattern standing.
+#
+# Two tiers, two verdicts, on purpose (D-01). A Read citation and a Bash
+# invocation fail differently and need different recovery text, so folding
+# them into one exit code would make the failure output unreadable.
+#
+# Fail-closed, zero-tolerance, no grandfather clause: Phase 274 cleared all
+# known sites (verified live, sites=156 anchored=154 allowlisted=2
+# violations=0) before this gate was wired, so there is nothing to
+# grandfather. Wire the gate, do not relax it (the 271-05 discipline).
+echo -e "\n${BOLD}10f. Plugin Script-Invocation Anchoring${NC}"
+
+SCRIPTANCHOR_OUT=$(node "$PLUGIN_ROOT/scripts/check-plugin-path-anchoring.cjs" --check-scripts 2>&1) && SCRIPTANCHOR_CODE=0 || SCRIPTANCHOR_CODE=$?
+if [ "$SCRIPTANCHOR_CODE" -ne 0 ]; then
+  fail "Script-invocation anchoring FAILED (bare scripts/ invocations resolve against user cwd, not the plugin install dir):"
+  echo "$SCRIPTANCHOR_OUT" | tail -12
+  echo "  Recovery: prefix with \"\${CLAUDE_PLUGIN_ROOT}/\" (commands, agents, pipelines) or the"
+  echo "  fail-closed \"\${MINDRIAN_OS_ROOT:-\${CLAUDE_PLUGIN_ROOT:?...}}/\" form (hand-authored skills),"
+  echo "  then regenerate mirrors with build-skill-mirrors.cjs, or add a reasoned ALLOWLIST entry."
+else
+  pass "Every plugin-relative scripts/ invocation is anchored or allowlisted (check-plugin-path-anchoring --check-scripts)"
+fi
+
+# ============================================================
+# 11. SCRIPTS EXECUTABLE
+# ============================================================
+echo -e "\n${BOLD}11. Script Permissions${NC}"
+
+CRITICAL_SCRIPTS=(banner session-start context-monitor check-update self-update resolve-room)
+NOT_EXEC=0
+for script in "${CRITICAL_SCRIPTS[@]}"; do
+  if [ -f "$PLUGIN_ROOT/scripts/$script" ] && [ ! -x "$PLUGIN_ROOT/scripts/$script" ]; then
+    NOT_EXEC=$((NOT_EXEC + 1))
+    fail "scripts/$script exists but is NOT executable"
+  fi
+done
+if [ "$NOT_EXEC" -eq 0 ]; then
+  pass "All critical scripts are executable"
+fi
+
+# ============================================================
+# 12. GIT STATE
+# ============================================================
+echo -e "\n${BOLD}12. Git State${NC}"
+
+cd "$PLUGIN_ROOT"
+# Plan 123-06 release-flight hot-patch (2026-05-13): `grep -v "^??"` exits 1 when
+# the working tree has only untracked files (no tracked uncommitted changes); under
+# `set -e` that kills the script silently. Wrap with `|| true` so a clean repo is
+# correctly counted as 0.
+UNCOMMITTED=$(git status --porcelain 2>/dev/null | { grep -v "^??" || true; } | wc -l)
+if [ "$UNCOMMITTED" -eq 0 ]; then
+  pass "No uncommitted changes in plugin repo"
+else
+  warn "$UNCOMMITTED uncommitted changes in plugin repo"
+fi
+
+if [ -d "$MARKETPLACE_DIR" ]; then
+  cd "$MARKETPLACE_DIR"
+  UNCOMMITTED_M=$(git status --porcelain 2>/dev/null | { grep -v "^??" || true; } | wc -l)
+  if [ "$UNCOMMITTED_M" -eq 0 ]; then
+    pass "No uncommitted changes in marketplace repo"
+  else
+    warn "$UNCOMMITTED_M uncommitted changes in marketplace repo"
+  fi
+fi
+
+# ============================================================
+# 13. CHANGELOG HAS CURRENT VERSION
+# ============================================================
+echo -e "\n${BOLD}13. Changelog${NC}"
+
+if [ -f "$PLUGIN_ROOT/CHANGELOG.md" ]; then
+  if grep -q "\[$PLUGIN_VER\]" "$PLUGIN_ROOT/CHANGELOG.md"; then
+    pass "CHANGELOG.md has entry for v$PLUGIN_VER"
+  else
+    warn "CHANGELOG.md has no entry for v$PLUGIN_VER"
+  fi
+else
+  fail "CHANGELOG.md MISSING"
+fi
+
+# ============================================================
+# 14. MCP CONFIG
+# ============================================================
+echo -e "\n${BOLD}14. MCP Config${NC}"
+
+if [ -f "$PLUGIN_ROOT/.mcp.json" ]; then
+  if python3 -c "import json; json.load(open('$PLUGIN_ROOT/.mcp.json'))" 2>/dev/null; then
+    pass ".mcp.json is valid JSON"
+  else
+    fail ".mcp.json is INVALID JSON"
+  fi
+  if grep -q "mindrian-brain" "$PLUGIN_ROOT/.mcp.json"; then
+    pass ".mcp.json has Brain MCP server configured"
+  else
+    warn ".mcp.json missing Brain MCP server"
+  fi
+else
+  fail ".mcp.json MISSING"
+fi
+
+# ============================================================
+# 15. WINDOWS-UNSAFE RENAME PRIMITIVE
+# ============================================================
+# RCA windows-os-rename-registry-wedge (2026-07-23): Python's os.rename() is
+# NOT POSIX rename(2) on Windows -- it raises FileExistsError [WinError 183]
+# when the destination exists, instead of overwriting. Every atomic-write
+# tmp-swap in scripts/ (Python heredocs in bash) must use os.replace()
+# instead. This bit the room-registry family silently for weeks on a real
+# Windows install (first write always succeeds -> looks healthy; every write
+# after that wedges) precisely because this repo's own test suite runs only
+# under WSL/Linux, where os.rename() already overwrites happily and never
+# surfaces the gap. There is no legitimate use of a bare os.rename( for an
+# atomic write anywhere in this repo -- ban it outright, same shape as the
+# check-shape-declaration.cjs gate.
+echo -e "\n${BOLD}15. Windows-Unsafe Rename Primitive${NC}"
+
+RENAME_HITS=$(grep -rn "os\.rename(" "$PLUGIN_ROOT/scripts/" 2>/dev/null | grep -v "\.pyc$" | grep -v "^$PLUGIN_ROOT/scripts/verify-release:" || true)
+if [ -z "$RENAME_HITS" ]; then
+  pass "No bare os.rename( in scripts/ (os.replace is the only overwrite-safe primitive on Windows)"
+else
+  fail "Found bare os.rename( in scripts/ -- Windows-unsafe (raises FileExistsError if dst exists; use os.replace instead). Sites:
+$RENAME_HITS"
+fi
+
+# ============================================================
+# 16. STOP HOOK hookSpecificOutput SCHEMA GATE
+# ============================================================
+# RCA stop-hook-invalid-hookspecificoutput-schema (2026-07-23, 4th occurrence of
+# this defect class): Claude Code's Stop-hook output schema does not define a
+# Stop variant of hookSpecificOutput at all (the union covers only PreToolUse,
+# UserPromptSubmit, PostToolUse); including the key on a Stop envelope rejects
+# the WHOLE envelope (additionalProperties: false), replacing a hook's calm
+# systemMessage/reason text with a raw "Hook JSON output validation failed"
+# dump on every single turn. Fixed once (scripts/on-stop, 2026-04-15) and
+# reintroduced twice more before this gate existed -- same "fix it once, ban
+# the anti-pattern repo-wide" reasoning as the os.rename gate above.
+# scripts/check-hook-schema-compatibility.cjs enumerates every script Claude
+# Code registers as a Stop hook straight off hooks/hooks.json's Stop array
+# (never hand-guessed), follows one level of subprocess invocation, and greps
+# for the literal forbidden pattern.
+echo -e "\n${BOLD}16. Stop Hook hookSpecificOutput Schema Gate${NC}"
+
+STOP_SCHEMA_OUT=$(node "$PLUGIN_ROOT/scripts/check-hook-schema-compatibility.cjs" 2>&1) && STOP_SCHEMA_CODE=0 || STOP_SCHEMA_CODE=$?
+if [ "$STOP_SCHEMA_CODE" -eq 0 ]; then
+  pass "No Stop-hook-reachable script emits a Stop-shaped hookSpecificOutput"
+else
+  fail "Stop-hook schema gate FAILED (see .planning/debug/resolved/stop-hook-invalid-hookspecificoutput-schema.md):"
+  echo "$STOP_SCHEMA_OUT"
+fi
+
+# ============================================================
+# 17. KUZU REINTRODUCTION GATE
+# ============================================================
+# The local per-room graph moved off KuzuDB to node:sqlite on 2026-06-14 (see
+# the correction banner at the top of docs/MOAT-MANDATE.md). Until Phase 242,
+# that file's PR checklist still asked reviewers to judge the point by eye
+# against a database this repo no longer has, which is an unfalsifiable
+# question, not a control. This gate replaces that prose with a deterministic
+# scan: dependency-manifest keys in package.json and package-lock.json (so a
+# transitive reintroduction that never touches package.json is still caught)
+# plus live require/import statements across every .cjs/.js/.mjs file.
+# Historical migration comments, the buildGraphFromKuzu back-compat alias, and
+# the build-kuzu subcommand label are exempt by design, which is why the scan
+# is scoped to statements and manifest keys rather than the bare string kuzu.
+echo -e "\n${BOLD}17. Kuzu Reintroduction Gate${NC}"
+
+KUZU_GATE_OUT=$(node "$PLUGIN_ROOT/scripts/check-kuzu-reintroduction.cjs" 2>&1) && KUZU_GATE_CODE=0 || KUZU_GATE_CODE=$?
+if [ "$KUZU_GATE_CODE" -eq 0 ]; then
+  pass "No live kuzu dependency or require/import re-entered the tree"
+else
+  fail "Kuzu reintroduction gate FAILED (the retired KuzuDB engine is back in the dependency surface):"
+  echo "$KUZU_GATE_OUT"
+fi
+
+# ============================================================
+# 18. GATE LEDGER SEAM GATE
+# ============================================================
+# Phase 238 (GATE-01, D-08): a gate kind minted by some call site in this
+# repo (lib/mcp/tools/gate.cjs, lib/mcp/tools/chain.cjs) must have a
+# reachable ratifier, or the gate that kind raises can never be cleared --
+# the dead-seam shape lib/core/seam-liveness.cjs (Phase 235) was built to
+# catch. That helper had zero production consumers until this gate existed;
+# a seam-liveness call living only inside a test file is the exact "wired
+# at one end, inert at the other" shape this milestone exists to close.
+# scripts/check-gate-seam.cjs drives the real mint call sites, reads the
+# shared ledger's own declared vocabulary back, and checks it against the
+# frozen ratifiable-kinds list via checkMintRatifierLiveness -- exit 1 on a
+# dead seam OR an empty claim set (D-13 vacuity), exit 2 on a scanner
+# failure, never a silent 0.
+echo -e "\n${BOLD}18. Gate Ledger Seam Gate${NC}"
+
+GATE_SEAM_OUT=$(node "$PLUGIN_ROOT/scripts/check-gate-seam.cjs" 2>&1) && GATE_SEAM_CODE=0 || GATE_SEAM_CODE=$?
+if [ "$GATE_SEAM_CODE" -eq 0 ]; then
+  pass "Every minted gate kind has a reachable ratifier (mint-to-ratifier seam live)"
+else
+  fail "Gate ledger seam gate FAILED (a minted gate kind has no reachable ratifier, or the check itself could not run):"
+  echo "$GATE_SEAM_OUT"
+fi
+
+# ============================================================
+# 19. BRAIN TOOL LIVENESS GATE
+# ============================================================
+# Phase 239 (BRAIN-01, threat T-239-T1): Claude Code evaluates a hook
+# matcher per tool-call event and NEVER validates it against a live tool
+# registry -- a matcher naming a tool that no longer exists does not warn
+# and does not error, it silently stops firing, forever. Before Phase 239
+# this repo's two Part-8 hook matchers read "mcp__brain_.*" while the live
+# registered names were mcp__plugin_<plugin>_<server>__<tool>, so the Canon
+# Part 8 egress guard and the PII sanitizer had both been dead for the
+# entire period the plugin shipped through the marketplace. The official
+# Claude Code plugins reference states plainly that a matcher written
+# against the bare server key never fires. This gate checks two claim
+# sources -- hook matchers (each must match at least one live name; an
+# empty claim set reads as vacuously live per lib/core/seam-liveness.cjs's
+# own contract and is therefore treated as a FAILURE here, not a pass) and
+# agent allowed-tools exact names -- against a real stdio tools/list
+# handshake, never a hand-typed list. Requirement BRAIN-01, threat T1.
+#
+# NOTE ON SECTION NUMBERING: Phase 238 (GATE-01) landed section 18 "Gate
+# Ledger Seam Gate" first. This section is numbered 19, the next free
+# integer, per this plan's collision-resolution rule (whichever phase
+# executes second renumbers; section 18 is untouched).
+echo -e "\n${BOLD}19. Brain Tool Liveness Gate${NC}"
+
+BRAIN_LIVENESS_OUT=$(node "$PLUGIN_ROOT/scripts/check-brain-tool-liveness.cjs" 2>&1) && BRAIN_LIVENESS_CODE=0 || BRAIN_LIVENESS_CODE=$?
+if [ "$BRAIN_LIVENESS_CODE" -eq 0 ]; then
+  pass "Every Brain hook matcher and agent allowed-tools entry names a live MCP tool"
+elif [ "$BRAIN_LIVENESS_CODE" -eq 1 ]; then
+  fail "Brain tool liveness gate FAILED (a hook matcher or agent allowed-tools entry names a Brain tool that does not exist):"
+  echo "$BRAIN_LIVENESS_OUT"
+else
+  fail "Brain tool liveness gate could not run (probe failure):"
+  echo "$BRAIN_LIVENESS_OUT"
+fi
+
+# ============================================================
+# PACKAGE-LOCK SYNC (vendored-node_modules lockstep)
+# ============================================================
+# Debug session mcp-servers-cache-missing-node-modules: release.sh Step 6.7
+# vendors production node_modules built via `npm ci --omit=dev`, which REQUIRES
+# package-lock.json to be in sync with package.json. A stale lock means the
+# release aborts at Step 6.7 -- catch it here, earlier, with a clear message.
+echo ""
+echo -e "${BOLD}Package-lock sync (vendored-deps lockstep)${NC}"
+if [ -f "$PLUGIN_ROOT/package-lock.json" ]; then
+  if ( cd "$PLUGIN_ROOT" && npm ci --dry-run --omit=dev --no-audit --no-fund >/dev/null 2>&1 ); then
+    pass "package-lock.json is in sync with package.json (npm ci can run)"
+  else
+    fail "package-lock.json is OUT OF SYNC with package.json -- run 'npm install' to resync the lock, commit it (the vendored node_modules tree is built from this lock and must never drift from it)"
+  fi
+else
+  fail "package-lock.json MISSING -- required for the vendored-node_modules release lockstep"
+fi
+
+# ============================================================
+# SUMMARY
+# ============================================================
+echo ""
+echo -e "${BOLD}═══════════════════════════════════════════════${NC}"
+TOTAL=$((PASS + FAIL + WARN))
+echo -e "  ${GREEN}✓ $PASS passed${NC}  ${RED}✗ $FAIL failed${NC}  ${YELLOW}⚠ $WARN warnings${NC}  ($TOTAL checks)"
+
+if [ "$FAIL" -gt 0 ]; then
+  echo -e "\n  ${RED}${BOLD}DO NOT RELEASE. Fix $FAIL failures first.${NC}"
+  echo -e "${BOLD}═══════════════════════════════════════════════${NC}"
+  exit 1
+else
+  echo -e "\n  ${GREEN}${BOLD}CLEAR TO RELEASE v$PLUGIN_VER${NC}"
+  echo -e "${BOLD}═══════════════════════════════════════════════${NC}"
+  exit 0
+fi