@mnstry/atelier 0.2.0-alpha.1

package/src/project/git-ignore.mjs

@@ -0,0 +1,31 @@
+import { spawnSync } from 'node:child_process'
+
+const GIT_IGNORE_TIMEOUT_MS = 8000
+
+// One batched call per root. Per-file `git check-ignore` is correct but too slow
+// once a workspace has thousands of files, which is how adopters end up skipping
+// the check entirely and shipping a machine-dependent census.
+export function gitIgnoredPaths(root) {
+  const ignored = new Set()
+  if (!root) return ignored
+  const result = spawnSync('git', ['-C', root, 'ls-files', '--others', '--ignored', '--exclude-standard', '--directory', '-z'], {
+    encoding: 'utf8',
+    timeout: GIT_IGNORE_TIMEOUT_MS,
+  })
+  if (result.status !== 0 || !result.stdout) return ignored
+  for (const entry of result.stdout.split('\0')) {
+    if (entry) ignored.add(entry.replace(/\/+$/, ''))
+  }
+  return ignored
+}
+
+export const includeEverything = () => false
+
+// `--directory` collapses a fully ignored directory to a single entry, so callers
+// must test each directory before descending into it; a file deep inside an
+// ignored directory is not itself listed.
+export function gitIgnoreFilter(root) {
+  const ignored = gitIgnoredPaths(root)
+  if (!ignored.size) return includeEverything
+  return (rel) => ignored.has(String(rel ?? '').replace(/\/+$/, ''))
+}

package/src/project/path-match.mjs

@@ -0,0 +1,30 @@
+import path from 'node:path'
+
+export const normalizeRelPath = (value) =>
+  String(value ?? '')
+    .replaceAll('\\', '/')
+    .replace(/^\.\/+/, '')
+
+const escapeRe = (value) => String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+// Shared by the boundary policy and the file-class resolver. Both used to carry
+// their own copy; two glob dialects in one kit is exactly the drift this file exists
+// to prevent.
+export function matchesPathPattern(pattern, rel) {
+  const normalizedPattern = normalizeRelPath(pattern)
+  const normalizedRel = normalizeRelPath(rel)
+  if (normalizedPattern === normalizedRel) return true
+  if (normalizedPattern.endsWith('/**')) {
+    return normalizedRel === normalizedPattern.slice(0, -3) || normalizedRel.startsWith(normalizedPattern.slice(0, -2))
+  }
+  if (normalizedPattern.startsWith('**/')) {
+    const tail = normalizedPattern.slice(3)
+    return normalizedRel === tail || normalizedRel.endsWith(`/${tail}`) || matchesPathPattern(tail, normalizedRel)
+  }
+  if (normalizedPattern.includes('*')) {
+    return new RegExp(`^${normalizedPattern.split('*').map(escapeRe).join('.*')}$`).test(normalizedRel)
+  }
+  return false
+}
+
+export const basenameOf = (pattern) => path.posix.basename(normalizeRelPath(pattern))

package/src/project/repo-identity.mjs

@@ -0,0 +1,176 @@
+import { execFileSync } from 'node:child_process'
+import { SUPPORTED_IDENTITY_PROVIDERS, gitRemoteUrl, remoteHost } from './config.mjs'
+
+export const SUPPORTED_PROVIDERS = Object.freeze([...SUPPORTED_IDENTITY_PROVIDERS])
+
+const PROVIDER_HOSTS = Object.freeze({ 'github.com': 'github' })
+
+const lower = (value) => String(value ?? '').trim().toLowerCase()
+
+/**
+ * Parse owner/name out of a remote URL. This is the *recorded* name, which after a
+ * rename is the stale one — hosting providers redirect the old URL indefinitely, so
+ * a clone keeps fetching happily under a name that no longer exists.
+ */
+export function parseRemoteRef(url) {
+  const host = remoteHost(url)
+  if (!host) return null
+  const text = String(url).trim().replace(/\.git$/, '')
+  const tail = text.match(/^[^/@]+@[^:/]+:(.+)$/) ?? text.match(/^[a-z][a-z0-9+.-]*:\/\/[^/]+\/(.+)$/i)
+  if (!tail) return null
+  const parts = tail[1].split('/').filter(Boolean)
+  if (parts.length < 2) return null
+  return { host, provider: PROVIDER_HOSTS[host] ?? null, owner: lower(parts[0]), name: lower(parts.slice(1).join('/')) }
+}
+
+// Ask the provider to resolve the recorded ref. GitHub follows the rename redirect
+// and answers with the stable numeric id plus the current full name, which is the
+// only signal that survives a rename.
+export function githubLookup({ owner, name }) {
+  try {
+    const out = execFileSync('gh', ['api', `repos/${owner}/${name}`, '--jq', '{id: .id, fullName: .full_name}'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    })
+    const parsed = JSON.parse(out)
+    if (!parsed?.id) return null
+    return { id: String(parsed.id), fullName: lower(parsed.fullName), currentName: lower(String(parsed.fullName).split('/').pop()) }
+  } catch {
+    return null
+  }
+}
+
+const defaultLookups = { github: githubLookup }
+
+/**
+ * Resolve a clone's stable identity.
+ *
+ * Never keys on the root commit: repos created from a shared template have
+ * identical root commits, so that heuristic reports false duplicates, and it
+ * cannot see a rename at all. Never keys on the folder name either. When the
+ * provider is unreachable it falls back to the recorded identity and then to
+ * declared aliases, and says so in `source` rather than guessing.
+ */
+export function resolveRepoIdentity(cloneDir, { repo = {}, lookups = defaultLookups, remoteUrl = null } = {}) {
+  const url = remoteUrl ?? gitRemoteUrl(cloneDir)
+  const ref = parseRemoteRef(url)
+  const declared = repo.identity ?? null
+  const aliases = (Array.isArray(repo.aliases) ? repo.aliases : []).map(lower)
+  const base = {
+    path: cloneDir ?? null,
+    remoteUrl: url,
+    provider: ref?.provider ?? declared?.provider ?? null,
+    owner: ref?.owner ?? null,
+    remoteName: ref?.name ?? null,
+    declaredId: declared?.id ? String(declared.id) : null,
+    aliases,
+  }
+
+  const lookup = base.provider ? lookups[base.provider] : null
+  if (ref && lookup) {
+    const found = lookup(ref)
+    if (found) {
+      return {
+        ...base,
+        ok: true,
+        id: found.id,
+        currentName: found.currentName,
+        fullName: found.fullName,
+        renamed: Boolean(ref.name && found.currentName && ref.name !== found.currentName),
+        source: 'provider',
+        reachable: true,
+      }
+    }
+  }
+
+  if (base.declaredId) {
+    return { ...base, ok: true, id: base.declaredId, currentName: lower(repo.name) || base.remoteName, renamed: false, source: 'recorded-identity', reachable: false }
+  }
+  if (base.remoteName && aliases.includes(base.remoteName)) {
+    return { ...base, ok: true, id: null, currentName: lower(repo.name), renamed: true, source: 'alias', reachable: false }
+  }
+  if (base.remoteName) {
+    return { ...base, ok: true, id: null, currentName: base.remoteName, renamed: false, source: 'remote-url', reachable: false }
+  }
+  return { ...base, ok: false, id: null, currentName: null, renamed: false, source: 'unresolved', reachable: false }
+}
+
+export function identityKey(identity) {
+  if (identity?.id) return `${identity.provider ?? 'unknown'}:${identity.id}`
+  if (identity?.owner && identity?.currentName) return `${identity.provider ?? identity.remoteUrl ?? 'unknown'}:${identity.owner}/${identity.currentName}`
+  return null
+}
+
+/**
+ * Report identity problems a workspace cannot see on its own: stale folder names
+ * after a rename, two clones that are really the same repo, and config entries
+ * pointing at a repo the provider does not know.
+ */
+export function auditRepoIdentities(project, { lookups = defaultLookups } = {}) {
+  const findings = []
+  const byKey = new Map()
+
+  for (const repo of project.repos ?? []) {
+    if (repo.external || !repo.path) continue
+    const identity = resolveRepoIdentity(repo.path, { repo, lookups })
+
+    if (!identity.ok) {
+      findings.push({
+        severity: 'warning',
+        code: 'repo-identity-unresolved',
+        repo: repo.name,
+        message: `${repo.name}: no origin remote, so the workspace cannot tell this clone apart from any other`,
+      })
+      continue
+    }
+    if (identity.source === 'provider' && identity.renamed) {
+      findings.push({
+        severity: 'warning',
+        code: 'repo-renamed-upstream',
+        repo: repo.name,
+        message: `${repo.name}: remote still says "${identity.remoteName}" but the provider now calls it "${identity.currentName}" — a rename is a metadata update, not a new identity`,
+        details: { from: identity.remoteName, to: identity.currentName, id: identity.id },
+      })
+    }
+    if (identity.currentName && repo.name && lower(repo.name) !== identity.currentName) {
+      const viaAlias = identity.aliases.includes(lower(repo.name)) || identity.aliases.includes(identity.remoteName ?? '')
+      findings.push({
+        severity: viaAlias ? 'warning' : 'error',
+        code: viaAlias ? 'repo-name-alias-deprecated' : 'repo-folder-name-stale',
+        repo: repo.name,
+        message: viaAlias
+          ? `${repo.name}: resolved through a recorded alias; update the config name to "${identity.currentName}"`
+          : `${repo.name}: config name does not match the canonical name "${identity.currentName}"; record it under aliases if this rename is intentional`,
+        details: { configured: repo.name, canonical: identity.currentName },
+      })
+    }
+    if (identity.id && !identity.declaredId) {
+      findings.push({
+        severity: 'warning',
+        code: 'repo-identity-undeclared',
+        repo: repo.name,
+        message: `${repo.name}: record identity { provider: "${identity.provider}", id: "${identity.id}" } so this repo survives a rename while the provider is unreachable`,
+        details: { provider: identity.provider, id: identity.id },
+      })
+    }
+
+    const key = identityKey(identity)
+    if (!key) continue
+    const first = byKey.get(key)
+    if (first) {
+      // A retired clone left behind by a rename. It fetches fine through the
+      // provider redirect, which is exactly why it goes unnoticed.
+      findings.push({
+        severity: 'error',
+        code: 'repo-identity-duplicate',
+        repo: repo.name,
+        message: `${repo.name} and ${first.repo} resolve to one repository (${key}); park the retired clone instead of syncing both`,
+        details: { key, clones: [first.path, repo.path] },
+      })
+      continue
+    }
+    byKey.set(key, { repo: repo.name, path: repo.path })
+  }
+
+  return { ok: !findings.some((item) => item.severity === 'error'), findings }
+}

package/src/projection/alignment-projection.mjs

@@ -0,0 +1,169 @@
+import path from 'node:path'
+import { canProjectNode, projectGraph } from './policy.mjs'
+
+export const ALIGNMENT_PROJECTION_SCHEMA = 'mnstry.alignment-projection@v1'
+export const PROJECTION_POLICY_VERSION = 'projection-policy@v1'
+
+// Root graph names are workspace-configured via sduiMap.rootGraphs. The kit
+// ships no defaults, so name-based alignment classification stays inactive
+// until a workspace supplies its own graph names.
+export const DEFAULT_ROOT_GRAPHS = []
+
+export const DEFAULT_PROOF_GATES = [
+  'tenant-purity',
+  'token-check',
+  'sdui-check',
+  'action-check',
+  'media-check',
+  'consent-check',
+  'provider-check',
+  'browser-proof',
+  'storybook-proof',
+]
+
+function posixRelative(root, file) {
+  if (!root || !file) return file ?? null
+  return path.relative(root, file).split(path.sep).join('/')
+}
+
+function defaultSourceCommitResolver() {
+  return null
+}
+
+export function projectionRecord(node, { target = 'team', sourceCommitResolver = defaultSourceCommitResolver } = {}) {
+  const verdict = canProjectNode(node, target)
+  return {
+    target,
+    sourceKgId: node.id,
+    allowed: verdict.ok,
+    reasons: verdict.reasons,
+    policyVersion: PROJECTION_POLICY_VERSION,
+    sourceCommit: sourceCommitResolver(node),
+  }
+}
+
+export function stableProjectionForCheck(value) {
+  return {
+    ...value,
+    generatedAt: null,
+    projectionRecords: (value?.projectionRecords ?? []).map((record) => ({ ...record, sourceCommit: null })),
+  }
+}
+
+function hasAlignmentPath(node, alignmentRepo, alignmentRoot) {
+  if (!alignmentRepo || !alignmentRoot) return false
+  return node.repo === alignmentRepo && String(node.path ?? '').startsWith(alignmentRoot.replace(/\/?$/, '/'))
+}
+
+function isAlignmentNode(node, { alignmentRepo, alignmentRoot, alignmentTags, rootGraphs }) {
+  if (hasAlignmentPath(node, alignmentRepo, alignmentRoot)) return true
+  const tags = new Set(node.tags ?? [])
+  if (alignmentTags.some((tag) => tags.has(tag))) return true
+  const haystack = [node.title, node.summary, node.path].join(' ').toLowerCase()
+  return rootGraphs.some((name) => haystack.includes(name.toLowerCase()))
+}
+
+export function buildAlignmentProjection({
+  graph,
+  target = 'team',
+  workspaceRoot = null,
+  graphPath = null,
+  sduiMap = {},
+  conformance = {},
+  tenantTheme = {},
+  tokenReport = '',
+  alignmentRepo = null,
+  alignmentRoot = null,
+  alignmentTags = ['mnstry-alignment', 'sdui'],
+  rootGraphs = sduiMap.rootGraphs ?? DEFAULT_ROOT_GRAPHS,
+  proofGates = DEFAULT_PROOF_GATES,
+  previousProjection = null,
+  now = () => new Date(),
+  sourceCommitResolver = defaultSourceCommitResolver,
+  source = {},
+} = {}) {
+  const gatedGraph = projectGraph(graph ?? { nodes: [], edges: [] }, { target })
+  const alignmentNodes = (gatedGraph.nodes ?? []).filter((node) =>
+    isAlignmentNode(node, { alignmentRepo, alignmentRoot, alignmentTags, rootGraphs })
+  )
+  const alignmentIds = new Set(alignmentNodes.map((node) => node.id))
+  const alignmentEdges = (gatedGraph.edges ?? []).filter((edge) => alignmentIds.has(edge.source) || alignmentIds.has(edge.target))
+  const audienceCounts = {}
+  const statusCounts = {}
+
+  for (const node of alignmentNodes) {
+    audienceCounts[node.audience] = (audienceCounts[node.audience] ?? 0) + 1
+    statusCounts[node.status] = (statusCounts[node.status] ?? 0) + 1
+  }
+
+  const primitiveMap = sduiMap.primitiveMap ?? []
+  const gaps = []
+  for (const node of alignmentNodes) {
+    if (!node.surfaced && String(node.path ?? '').endsWith('.md')) {
+      gaps.push({ severity: 'info', type: 'unsurfaced-alignment-doc', node: node.id, path: `${node.repo}/${node.path}` })
+    }
+    if (hasAlignmentPath(node, alignmentRepo, alignmentRoot) && !Object.values(node.relations ?? {}).some((targets) => Array.isArray(targets) && targets.length)) {
+      gaps.push({ severity: 'info', type: 'missing-declared-relations', node: node.id, path: `${node.repo}/${node.path}` })
+    }
+  }
+
+  for (const diagnostic of graph?.diagnostics ?? []) {
+    gaps.push({
+      severity: diagnostic.severity ?? 'warning',
+      type: diagnostic.type ?? 'graph-diagnostic',
+      node: diagnostic.node ?? null,
+      path: diagnostic.path ? `${diagnostic.repo}/${diagnostic.path}` : null,
+      message: diagnostic.message ?? '',
+    })
+  }
+
+  const projectionRecords = (graph?.nodes ?? []).map((node) => projectionRecord(node, { target, sourceCommitResolver }))
+  const projection = {
+    schema: ALIGNMENT_PROJECTION_SCHEMA,
+    generatedAt: previousProjection?.generatedAt ?? now().toISOString(),
+    source: {
+      graph: source.graph ?? posixRelative(workspaceRoot, graphPath),
+      sduiMap: source.sduiMap ?? null,
+      conformanceContract: source.conformanceContract ?? null,
+    },
+    summary: {
+      graphNodes: graph?.nodeCount ?? graph?.nodes?.length ?? 0,
+      graphEdges: graph?.edgeCount ?? graph?.edges?.length ?? 0,
+      alignmentNodes: alignmentNodes.length,
+      alignmentEdges: alignmentEdges.length,
+      rootGraphs: rootGraphs.length,
+      sduiMappings: primitiveMap.length,
+      proofGates: proofGates.length,
+      audienceCounts,
+      statusCounts,
+      gaps: gaps.length,
+      blockedByProjection: gatedGraph.blocked.length,
+      diagnostics: (graph?.diagnostics ?? []).length,
+    },
+    projectionGate: {
+      target: gatedGraph.target,
+      blocked: gatedGraph.blocked,
+    },
+    projectionRecords,
+    rootGraphs,
+    proofGates,
+    contracts: {
+      conformanceVersion: conformance.version ?? conformance.contractVersion ?? null,
+      tenantThemeName: tenantTheme.name ?? tenantTheme.project ?? null,
+      tokenReportPresent: Boolean(String(tokenReport).trim()),
+      acceptedSduiPrimitiveCount: sduiMap.acceptedSduiPrimitives?.length ?? 0,
+    },
+    nodes: alignmentNodes,
+    edges: alignmentEdges,
+    primitiveMap,
+    gaps,
+  }
+
+  const comparableProjection = stableProjectionForCheck(projection)
+  const comparablePrevious = previousProjection ? stableProjectionForCheck(previousProjection) : null
+  if (JSON.stringify(comparableProjection) !== JSON.stringify(comparablePrevious)) {
+    projection.generatedAt = now().toISOString()
+  }
+
+  return projection
+}

package/src/projection/policy.mjs

@@ -0,0 +1,90 @@
+export const LOCAL_AUDIENCES = ['public', 'team', 'operator', 'staff', 'private', 'sensitive']
+export const RUNTIME_VISIBILITIES = ['private', 'shared', 'platform', 'public']
+export const RUNTIME_SPACE_DATA_BOUNDARIES = [
+  'public_shareable',
+  'member_shareable',
+  'client_visible',
+  'practitioner_private',
+  'specially_protected',
+]
+
+export const VALID_AUDIENCES = new Set(LOCAL_AUDIENCES)
+export const VALID_RUNTIME_VISIBILITIES = new Set(RUNTIME_VISIBILITIES)
+export const VALID_RUNTIME_SPACE_DATA_BOUNDARIES = new Set(RUNTIME_SPACE_DATA_BOUNDARIES)
+
+export const PROJECTION_TARGETS = {
+  public: new Set(['public']),
+  team: new Set(['public', 'team']),
+  operator: new Set(['public', 'team', 'operator', 'staff']),
+  local: new Set(LOCAL_AUDIENCES),
+}
+
+export function normalizeAudience(value) {
+  return typeof value === 'string' && VALID_AUDIENCES.has(value.trim()) ? value.trim() : null
+}
+
+export function projectionTarget(value = 'local') {
+  return Object.hasOwn(PROJECTION_TARGETS, value) ? value : 'local'
+}
+
+export function canProjectNode(node, target = 'local') {
+  const normalizedTarget = projectionTarget(target)
+  const audience = normalizeAudience(node?.audience)
+  const reasons = []
+  if (!audience) reasons.push('missing-or-invalid-audience')
+  if (audience && !PROJECTION_TARGETS[normalizedTarget].has(audience)) {
+    reasons.push(`audience-${audience}-blocked-for-${normalizedTarget}`)
+  }
+  return {
+    ok: reasons.length === 0,
+    audience,
+    target: normalizedTarget,
+    reasons,
+  }
+}
+
+export function projectGraph(graph, { target = 'local' } = {}) {
+  const nodes = Array.isArray(graph?.nodes) ? graph.nodes : []
+  const edges = Array.isArray(graph?.edges) ? graph.edges : []
+  const allowedNodes = []
+  const blocked = []
+  const byId = new Map()
+
+  for (const node of nodes) {
+    const verdict = canProjectNode(node, target)
+    if (verdict.ok) {
+      allowedNodes.push(node)
+      byId.set(node.id, node)
+    } else {
+      blocked.push({ id: node?.id ?? null, repo: node?.repo ?? null, path: node?.path ?? null, reasons: verdict.reasons })
+    }
+  }
+
+  const allowedEdges = []
+  for (const edge of edges) {
+    if (byId.has(edge.source) && byId.has(edge.target)) allowedEdges.push(edge)
+    else blocked.push({ edge, reasons: ['edge-endpoint-blocked'] })
+  }
+
+  return {
+    target: projectionTarget(target),
+    nodes: allowedNodes,
+    edges: allowedEdges,
+    blocked,
+  }
+}
+
+export function publicSourceVerdict(nodes, kgIds) {
+  const byId = new Map((nodes ?? []).map((node) => [node.id, node]))
+  const failures = []
+  for (const kgId of kgIds) {
+    const node = byId.get(kgId)
+    if (!node) {
+      failures.push({ kgId, reason: 'source-node-not-found' })
+      continue
+    }
+    const verdict = canProjectNode(node, 'public')
+    if (!verdict.ok) failures.push({ kgId, reason: verdict.reasons.join(','), audience: node.audience ?? null })
+  }
+  return { ok: failures.length === 0, failures }
+}

package/src/projection/project.mjs

@@ -0,0 +1,152 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { commandProject, readJson, writeJson } from '../project/config.mjs'
+import { summarizeReadinessJourney } from '../readiness-protocols/runtime.mjs'
+
+const esc = (value) => String(value ?? '').replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;')
+
+// CSS hex colors come in exactly four widths: #rgb, #rgba, #rrggbb, #rrggbbaa.
+// A bare {3,8} range also admits 5- and 7-digit strings that no browser parses.
+const HEX_COLOR = /^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/
+const THEME_TOKENS = [
+  ['background', '--atelier-bg'],
+  ['surface', '--atelier-surface'],
+  ['text', '--atelier-text'],
+  ['accent', '--atelier-accent'],
+  ['eyebrow', '--atelier-eyebrow'],
+]
+const KNOWN_THEME_TOKENS = new Set(THEME_TOKENS.map(([token]) => token))
+
+function resolveDistributionBranding(project) {
+  const distribution = project.config?.ext?.['mnstry.atelier']?.distribution ?? {}
+  const theme = distribution.theme ?? {}
+  // Theme values are interpolated into a <style> block, so the hex-only rule
+  // is the CSS-injection guard; a deterministic build must not silently vary.
+  // Unknown keys throw for the same reason: a typo that silently drops an
+  // override would make two builds of the same config disagree by accident.
+  for (const token of Object.keys(theme)) {
+    if (!KNOWN_THEME_TOKENS.has(token)) {
+      throw new Error(`unknown distribution theme key (theme.${token})`)
+    }
+    if (typeof theme[token] !== 'string' || !HEX_COLOR.test(theme[token])) {
+      throw new Error(`distribution theme values must be hex colors (theme.${token})`)
+    }
+  }
+  const overrides = THEME_TOKENS
+    .filter(([token]) => typeof theme[token] === 'string')
+    .map(([token, property]) => `${property}:${theme[token]}`)
+  return {
+    name: distribution.name || 'MNSTRY Atelier',
+    eyebrow: distribution.eyebrow || 'local projection',
+    themeCss: overrides.length ? `:root{${overrides.join(';')}}\n` : '',
+  }
+}
+
+export function buildProjectProjection(project) {
+  const graph = readJson(project.graphPath)
+  const branding = resolveDistributionBranding(project)
+  const readinessJourney = summarizeReadinessJourney(project)
+  const output = path.join(project.outputRoot, 'index.html')
+  const dimensionCards = readinessJourney.dimensions.map((item) => `<article class="readiness-card" data-protocol="${esc(item.protocolId)}">
+    <p class="eyebrow">${esc(item.label)}</p>
+    <h3>${esc(item.title)}</h3>
+    <p><strong>${esc(item.status)}</strong> · ${esc(item.score)} / 100</p>
+    <p>${esc(item.blockers[0] || 'review-ready')}</p>
+    <button type="button" data-copy="${esc(item.agentPrompt)}">Copy protocol prompt</button>
+  </article>`).join('\n')
+  const cards = graph.nodes.map((node) => `<article class="card" data-node="${esc(node.id)}">
+    <p class="eyebrow">${esc(node.repo)} · ${esc(node.type)} · ${esc(node.audience)}</p>
+    <h2>${esc(node.title || node.id)}</h2>
+    <p>${esc(node.summary || node.path)}</p>
+  </article>`).join('\n')
+  const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="mnstry:atelier" content="project-projection">
+<title>${esc(project.config.name || branding.name)}</title>
+<style>
+:root{--atelier-bg:#151312;--atelier-surface:#201a18;--atelier-text:#f4eee5;--atelier-accent:#e3b56e;--atelier-eyebrow:#c39a5b}
+body{margin:0;font:16px/1.5 ui-sans-serif,system-ui;background:var(--atelier-bg);color:var(--atelier-text)}
+main{max-width:1120px;margin:0 auto;padding:32px 20px}
+h1{font-size:clamp(2rem,4vw,4rem);margin:.2em 0}
+.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:16px}
+.card{border:1px solid #3a302b;border-radius:8px;padding:16px;background:var(--atelier-surface)}
+.readiness{margin:24px 0 32px;padding:20px;border:1px solid #463b34;border-radius:8px;background:#1c1715}
+.readiness-head{display:flex;gap:16px;align-items:flex-start;justify-content:space-between;flex-wrap:wrap}
+.readiness-score{font-size:2rem;font-weight:700;color:var(--atelier-accent)}
+.readiness-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:12px;margin-top:16px}
+.readiness-card{border:1px solid #342b26;border-radius:8px;padding:14px;background:#171312}
+.readiness-card h3{font-size:1.05rem;margin:.2rem 0}
+.readiness-card button{min-height:44px;border:1px solid #755f43;border-radius:6px;background:#241d18;color:var(--atelier-text);padding:8px 10px;cursor:pointer}
+.eyebrow{color:var(--atelier-eyebrow);text-transform:uppercase;letter-spacing:.08em;font-size:.8rem}
+a{color:var(--atelier-accent)}
+${branding.themeCss}</style>
+</head>
+<body><main>
+<p class="eyebrow">${esc(branding.name)} · ${esc(branding.eyebrow)}</p>
+<h1>${esc(project.config.name || 'Project Workspace')}</h1>
+<p>${graph.counts.nodes} graph nodes · ${graph.counts.edges} graph edges · ${graph.counts.diagnostics} diagnostics</p>
+<section class="readiness" aria-labelledby="tenant-readiness-title">
+  <div class="readiness-head">
+    <div>
+      <p class="eyebrow">MNSTRY Tenant Readiness</p>
+      <h2 id="tenant-readiness-title">Readiness Journey</h2>
+      <p>${esc(readinessJourney.dimensions.length)} dimensions · next protocol: ${esc(readinessJourney.nextProtocol || 'none')}</p>
+    </div>
+    <div class="readiness-score">${esc(readinessJourney.score)}%</div>
+  </div>
+  <div class="readiness-grid">${dimensionCards}</div>
+</section>
+<section class="grid">${cards}</section>
+<script>
+document.addEventListener('click', async (event) => {
+  const button = event.target.closest('button[data-copy]')
+  if (!button) return
+  try {
+    await navigator.clipboard.writeText(button.getAttribute('data-copy') || '')
+    button.textContent = 'Copied'
+  } catch {
+    button.textContent = 'Copy failed'
+  }
+})
+</script>
+</main></body></html>
+`
+  return { output, html, graph, readinessJourney }
+}
+
+export function runProjectCommand(argv = process.argv.slice(2)) {
+  const check = argv.includes('--check')
+  const project = commandProject({ argv })
+  const projection = buildProjectProjection(project)
+  if (check) {
+    const current = fs.existsSync(projection.output) ? fs.readFileSync(projection.output, 'utf8') : null
+    if (current !== projection.html) {
+      console.error(`project projection is stale: ${projection.output}`)
+      process.exit(1)
+    }
+  } else {
+    fs.mkdirSync(path.dirname(projection.output), { recursive: true })
+    fs.writeFileSync(projection.output, projection.html)
+    writeJson(path.join(project.outputRoot, 'atelier.manifest.json'), {
+      schema: 'mnstry.atelier-manifest@v1',
+      generatedAt: 'deterministic',
+      graphPath: project.graphPath,
+      entry: 'index.html',
+      tenantReadiness: {
+        score: projection.readinessJourney.score,
+        ready: projection.readinessJourney.ready,
+        dimensions: projection.readinessJourney.dimensions.map((item) => ({
+          key: item.key,
+          protocolId: item.protocolId,
+          status: item.status,
+          score: item.score,
+        })),
+      },
+      nodes: projection.graph.nodes.map((node) => ({ id: node.id, title: node.title, audience: node.audience, path: node.path })),
+    })
+  }
+  console.log(`project projection: ${projection.graph.counts.nodes} nodes -> ${projection.output}`)
+}