@moretea-labs/forge 1.5.0-rc.1

package/assets/AGENTS.md

@@ -0,0 +1,68 @@
+# Functional Block Agent Context
+
+Keep this file focused on the local contract for this primary functional block.
+
+<!-- BEGIN CAPABILITY CONTEXT -->
+## Capability Context
+
+- Capability ID: `workflow-engine-contract-assets`
+- Domain: `workflow-engine`
+- Name: `contract-assets`
+- Primary prefix: `assets/workflow-contract.v1.json`
+- Architecture module: `docs/architecture/modules/workflow-engine/contract-assets.md`
+- Workstream: `tasks/workstreams/workflow-engine/contract-assets`
+
+## Positioning
+
+Owns the workflow-engine-contract-assets capability boundary declared in .ai/context/capabilities.json.
+
+## Source Map
+
+- Primary prefix: `assets/workflow-contract.v1.json` (entrypoint)
+- Architecture module: `docs/architecture/modules/workflow-engine/contract-assets.md` (design-source)
+- Workstream: `tasks/workstreams/workflow-engine/contract-assets` (durable-progress)
+
+## Refresh Hints
+
+- `bun test tests/workflow-contract.test.ts tests/scaffold-parity.test.ts`
+- `bun scripts/capability-resolver.ts validate --format text`
+<!-- END CAPABILITY CONTEXT -->
+
+<!-- BEGIN ARCHITECTURE CONTRACT -->
+## Architecture Contract
+
+- Functional block: `.ai/harness/policy.json`
+- Capability ID: `workflow-engine-contract-assets`
+- Matched prefix: `.ai/harness/policy.json`
+- Architecture domain: `workflow-engine`
+- Architecture capability: `contract-assets`
+- Architecture module: `docs/architecture/modules/workflow-engine/contract-assets.md`
+- Last architecture event: 2026-05-29T02:15:07+0800
+- Last changed path: `tasks/workstreams/workflow-engine/contract-assets/cleanup-script-policy.md`
+- Severity: medium
+- Change type: workstream-sync
+- Module responsibility: Keep this block aligned with the local boundary described by surrounding human-owned context.
+- Entrypoints: `.ai/harness/policy.json`
+- Allowed dependencies: Follow root `AGENTS.md` / `CLAUDE.md` and this local contract.
+- Forbidden dependencies: Do not cross sibling app/service/package boundaries without an architecture snapshot or explicit plan.
+- Runtime path: `.ai/harness/policy.json`
+- LSP/tooling profile: `typescript-lsp`
+- Verification: Use root required checks plus local commands recorded in this capability contract.
+- Latest snapshot: `(none yet)`
+- Semantic diagram source: `docs/architecture/modules/workflow-engine/contract-assets.md`
+- Latest human diagram: `(none yet)`
+- Pending architecture request: `(none)`
+
+## Active Workstreams
+
+- `tasks/workstreams/workflow-engine/contract-assets/cleanup-script-policy.md`
+  - status: completed
+  - current_slice: todo-01
+  - source_plan: (none)
+
+## Current Session Projection
+
+- Durable progress lives under `tasks/workstreams/workflow-engine/contract-assets`.
+- `tasks/current.md` is a tracked derived status snapshot, not a live lock or task source.
+- `tasks/todos.md` is the deferred-goal ledger; current execution slices stay in the active plan's `## Task Breakdown`.
+<!-- END ARCHITECTURE CONTRACT -->

package/assets/CLAUDE.md

@@ -0,0 +1,68 @@
+# Functional Block Agent Context
+
+Keep this file focused on the local contract for this primary functional block.
+
+<!-- BEGIN CAPABILITY CONTEXT -->
+## Capability Context
+
+- Capability ID: `workflow-engine-contract-assets`
+- Domain: `workflow-engine`
+- Name: `contract-assets`
+- Primary prefix: `assets/workflow-contract.v1.json`
+- Architecture module: `docs/architecture/modules/workflow-engine/contract-assets.md`
+- Workstream: `tasks/workstreams/workflow-engine/contract-assets`
+
+## Positioning
+
+Owns the workflow-engine-contract-assets capability boundary declared in .ai/context/capabilities.json.
+
+## Source Map
+
+- Primary prefix: `assets/workflow-contract.v1.json` (entrypoint)
+- Architecture module: `docs/architecture/modules/workflow-engine/contract-assets.md` (design-source)
+- Workstream: `tasks/workstreams/workflow-engine/contract-assets` (durable-progress)
+
+## Refresh Hints
+
+- `bun test tests/workflow-contract.test.ts tests/scaffold-parity.test.ts`
+- `bun scripts/capability-resolver.ts validate --format text`
+<!-- END CAPABILITY CONTEXT -->
+
+<!-- BEGIN ARCHITECTURE CONTRACT -->
+## Architecture Contract
+
+- Functional block: `.ai/harness/policy.json`
+- Capability ID: `workflow-engine-contract-assets`
+- Matched prefix: `.ai/harness/policy.json`
+- Architecture domain: `workflow-engine`
+- Architecture capability: `contract-assets`
+- Architecture module: `docs/architecture/modules/workflow-engine/contract-assets.md`
+- Last architecture event: 2026-05-29T02:15:07+0800
+- Last changed path: `tasks/workstreams/workflow-engine/contract-assets/cleanup-script-policy.md`
+- Severity: medium
+- Change type: workstream-sync
+- Module responsibility: Keep this block aligned with the local boundary described by surrounding human-owned context.
+- Entrypoints: `.ai/harness/policy.json`
+- Allowed dependencies: Follow root `AGENTS.md` / `CLAUDE.md` and this local contract.
+- Forbidden dependencies: Do not cross sibling app/service/package boundaries without an architecture snapshot or explicit plan.
+- Runtime path: `.ai/harness/policy.json`
+- LSP/tooling profile: `typescript-lsp`
+- Verification: Use root required checks plus local commands recorded in this capability contract.
+- Latest snapshot: `(none yet)`
+- Semantic diagram source: `docs/architecture/modules/workflow-engine/contract-assets.md`
+- Latest human diagram: `(none yet)`
+- Pending architecture request: `(none)`
+
+## Active Workstreams
+
+- `tasks/workstreams/workflow-engine/contract-assets/cleanup-script-policy.md`
+  - status: completed
+  - current_slice: todo-01
+  - source_plan: (none)
+
+## Current Session Projection
+
+- Durable progress lives under `tasks/workstreams/workflow-engine/contract-assets`.
+- `tasks/current.md` is a tracked derived status snapshot, not a live lock or task source.
+- `tasks/todos.md` is the deferred-goal ledger; current execution slices stay in the active plan's `## Task Breakdown`.
+<!-- END ARCHITECTURE CONTRACT -->

package/assets/branding/README.md

@@ -0,0 +1,10 @@
+# Forge Brand Assets
+
+These files are the maintained, public-safe, first-party branding assets for **Forge**.
+
+- `docs/images/forge-banner.svg`: English README and social-share banner.
+- `docs/images/forge-banner-cn.svg`: Simplified Chinese README and social-share banner.
+- `docs/images/forge-controller-flow.svg`: current Forge controller and Runtime architecture diagram.
+- `forge-controller-flow.mmd`: editable Mermaid source for the architecture diagram.
+
+Use **Forge** in prose and lowercase `forge` only for commands, package paths, protocol identifiers, state paths, filenames, or code symbols. Do not add previous-product branding, compatibility messaging, third-party logos, trademarks, or stock illustrations.

package/assets/branding/forge-controller-flow.mmd

@@ -0,0 +1,8 @@
+flowchart LR
+  Client[ChatGPT / CLI / Local UI] --> Runtime[forge-runtime]
+  Runtime --> Gateway[MCP Gateway Adapter]
+  Runtime --> Scheduler[Global Scheduler]
+  Scheduler --> Actor[Per-Repository Actor]
+  Actor --> Process[Process Runtime / bounded Worker]
+  Process --> Evidence[Evidence and Receipts]
+  Runtime --> Recovery[Standalone Recovery diagnostics]

package/assets/hooks/AGENTS.md

@@ -0,0 +1,75 @@
+# Functional Block Agent Context
+
+Keep this file focused on the local contract for this primary functional block.
+
+## Local Context Contract
+
+- Describe only the ownership, boundaries, stable entrypoints, and local verification commands for this functional block.
+- Keep sibling `CLAUDE.md` and `AGENTS.md` files aligned. Claude Code consumes `CLAUDE.md`; Codex consumes `AGENTS.md`.
+- Record the local LSP/tooling profile here when it differs from the repo default.
+- Route deep implementation detail into nearby docs instead of inflating root agent context files.
+- Treat `.ai/context/context-map.json` as the index of discoverable context files.
+- Do not keep pushing context files deeper by default; add lower-level files only for a separately owned functional block with its own commands and invariants.
+- Prefer repo-local workflow artifacts over tool-specific chat memory.
+
+<!-- BEGIN CAPABILITY CONTEXT -->
+## Capability Context
+
+- Capability ID: `runtime-harness-hook-adapters`
+- Domain: `runtime-harness`
+- Name: `hook-adapters`
+- Primary prefix: `assets/hooks`
+- Architecture module: `docs/architecture/modules/runtime-harness/hook-adapters.md`
+- Workstream: `tasks/workstreams/runtime-harness/hook-adapters`
+
+## Positioning
+
+Owns the runtime-harness-hook-adapters capability boundary declared in .ai/context/capabilities.json.
+
+## Source Map
+
+- Primary prefix: `assets/hooks` (entrypoint)
+- Architecture module: `docs/architecture/modules/runtime-harness/hook-adapters.md` (design-source)
+- Workstream: `tasks/workstreams/runtime-harness/hook-adapters` (durable-progress)
+
+## Refresh Hints
+
+- `bun test tests/hook-runtime.test.ts tests/hook-contracts.test.ts tests/workflow-contract.test.ts`
+- `bash scripts/check-task-workflow.sh --strict`
+<!-- END CAPABILITY CONTEXT -->
+
+<!-- BEGIN ARCHITECTURE CONTRACT -->
+## Architecture Contract
+
+- Functional block: `.ai/hooks`
+- Capability ID: `runtime-harness-hook-adapters`
+- Matched prefix: `.ai/hooks`
+- Architecture domain: `runtime-harness`
+- Architecture capability: `hook-adapters`
+- Architecture module: `docs/architecture/modules/runtime-harness/hook-adapters.md`
+- Last architecture event: 2026-06-13T00:04:13+0800
+- Last changed path: `.ai/hooks/post-tool-observer.sh`
+- Severity: high
+- Change type: workflow-surface
+- Module responsibility: Keep this block aligned with the local boundary described by surrounding human-owned context.
+- Entrypoints: `.ai/hooks`
+- Allowed dependencies: Follow root `AGENTS.md` / `CLAUDE.md` and this local contract.
+- Forbidden dependencies: Do not cross sibling app/service/package boundaries without an architecture snapshot or explicit plan.
+- Runtime path: `.ai/hooks`
+- LSP/tooling profile: `typescript-lsp`
+- Verification: Use root required checks plus local commands recorded in this capability contract.
+- Latest snapshot: `(none yet)`
+- Semantic diagram source: `docs/architecture/modules/runtime-harness/hook-adapters.md`
+- Latest human diagram: `(none yet)`
+- Pending architecture request: `(none)`
+
+## Active Workstreams
+
+- (none yet)
+
+## Current Session Projection
+
+- Durable progress lives under `tasks/workstreams/runtime-harness/hook-adapters`.
+- `tasks/current.md` is the tracked derived status snapshot; it is not a live lock or task source.
+- `tasks/todos.md` is the deferred-goal ledger; current execution slices stay in the active plan's `## Task Breakdown`.
+<!-- END ARCHITECTURE CONTRACT -->

package/assets/hooks/CLAUDE.md

@@ -0,0 +1,75 @@
+# Functional Block Agent Context
+
+Keep this file focused on the local contract for this primary functional block.
+
+## Local Context Contract
+
+- Describe only the ownership, boundaries, stable entrypoints, and local verification commands for this functional block.
+- Keep sibling `CLAUDE.md` and `AGENTS.md` files aligned. Claude Code consumes `CLAUDE.md`; Codex consumes `AGENTS.md`.
+- Record the local LSP/tooling profile here when it differs from the repo default.
+- Route deep implementation detail into nearby docs instead of inflating root agent context files.
+- Treat `.ai/context/context-map.json` as the index of discoverable context files.
+- Do not keep pushing context files deeper by default; add lower-level files only for a separately owned functional block with its own commands and invariants.
+- Prefer repo-local workflow artifacts over tool-specific chat memory.
+
+<!-- BEGIN CAPABILITY CONTEXT -->
+## Capability Context
+
+- Capability ID: `runtime-harness-hook-adapters`
+- Domain: `runtime-harness`
+- Name: `hook-adapters`
+- Primary prefix: `assets/hooks`
+- Architecture module: `docs/architecture/modules/runtime-harness/hook-adapters.md`
+- Workstream: `tasks/workstreams/runtime-harness/hook-adapters`
+
+## Positioning
+
+Owns the runtime-harness-hook-adapters capability boundary declared in .ai/context/capabilities.json.
+
+## Source Map
+
+- Primary prefix: `assets/hooks` (entrypoint)
+- Architecture module: `docs/architecture/modules/runtime-harness/hook-adapters.md` (design-source)
+- Workstream: `tasks/workstreams/runtime-harness/hook-adapters` (durable-progress)
+
+## Refresh Hints
+
+- `bun test tests/hook-runtime.test.ts tests/hook-contracts.test.ts tests/workflow-contract.test.ts`
+- `bash scripts/check-task-workflow.sh --strict`
+<!-- END CAPABILITY CONTEXT -->
+
+<!-- BEGIN ARCHITECTURE CONTRACT -->
+## Architecture Contract
+
+- Functional block: `.ai/hooks`
+- Capability ID: `runtime-harness-hook-adapters`
+- Matched prefix: `.ai/hooks`
+- Architecture domain: `runtime-harness`
+- Architecture capability: `hook-adapters`
+- Architecture module: `docs/architecture/modules/runtime-harness/hook-adapters.md`
+- Last architecture event: 2026-06-13T00:04:13+0800
+- Last changed path: `.ai/hooks/post-tool-observer.sh`
+- Severity: high
+- Change type: workflow-surface
+- Module responsibility: Keep this block aligned with the local boundary described by surrounding human-owned context.
+- Entrypoints: `.ai/hooks`
+- Allowed dependencies: Follow root `AGENTS.md` / `CLAUDE.md` and this local contract.
+- Forbidden dependencies: Do not cross sibling app/service/package boundaries without an architecture snapshot or explicit plan.
+- Runtime path: `.ai/hooks`
+- LSP/tooling profile: `typescript-lsp`
+- Verification: Use root required checks plus local commands recorded in this capability contract.
+- Latest snapshot: `(none yet)`
+- Semantic diagram source: `docs/architecture/modules/runtime-harness/hook-adapters.md`
+- Latest human diagram: `(none yet)`
+- Pending architecture request: `(none)`
+
+## Active Workstreams
+
+- (none yet)
+
+## Current Session Projection
+
+- Durable progress lives under `tasks/workstreams/runtime-harness/hook-adapters`.
+- `tasks/current.md` is the tracked derived status snapshot; it is not a live lock or task source.
+- `tasks/todos.md` is the deferred-goal ledger; current execution slices stay in the active plan's `## Task Breakdown`.
+<!-- END ARCHITECTURE CONTRACT -->

package/assets/hooks/anti-simplification.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+# Compatibility wrapper for the renamed First-Principles Guard.
+
+set -eo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+if [[ -f "$SCRIPT_DIR/first-principles-guard.sh" ]]; then
+  exec bash "$SCRIPT_DIR/first-principles-guard.sh" "$@"
+fi
+
+exit 0

package/assets/hooks/changelog-guard.sh

@@ -0,0 +1,80 @@
+#!/bin/bash
+# Changelog Guard Hook — PostToolUse on Bash
+# Soft reminder to update CHANGELOG before releasing.
+
+set -eo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+. "$SCRIPT_DIR/hook-input.sh"
+
+get_tool_command() {
+  local parsed=""
+
+  parsed="$(hook_json_get '.tool_input.command' '')"
+  if [[ -n "$parsed" ]]; then
+    printf '%s' "$parsed"
+    return
+  fi
+
+  parsed="$(hook_json_get '.tool_input.raw_command' '')"
+  if [[ -n "$parsed" ]]; then
+    printf '%s' "$parsed"
+    return
+  fi
+
+  if [[ -n "${TOOL_INPUT:-}" ]] && command -v jq >/dev/null 2>&1 && printf '%s' "$TOOL_INPUT" | jq -e . >/dev/null 2>&1; then
+    parsed="$(printf '%s' "$TOOL_INPUT" | jq -r '.command // .raw_command // empty' 2>/dev/null || true)"
+    if [[ -n "$parsed" ]]; then
+      printf '%s' "$parsed"
+      return
+    fi
+  fi
+
+  printf '%s' "${TOOL_COMMAND:-}"
+}
+
+TOOL_COMMAND="$(get_tool_command)"
+
+# Only trigger on release/tag-related commands.
+if ! echo "$TOOL_COMMAND" | grep -Eiq '(npm version|git tag|bun version|pnpm version|yarn version)'; then
+  exit 0
+fi
+
+CHANGELOG="docs/CHANGELOG.md"
+
+# If no changelog file exists, remind and exit.
+if [[ ! -f "$CHANGELOG" ]]; then
+  echo "[ChangelogGuard] ⚠ Release command detected but $CHANGELOG not found. Consider creating one before releasing."
+  exit 0
+fi
+
+# Check if [Unreleased] section has meaningful content (not just template placeholders).
+unreleased_content=""
+if command -v awk >/dev/null 2>&1; then
+  unreleased_content="$(awk '
+    /^\#\# \[Unreleased\]/ { found=1; next }
+    found && /^\#\# \[/ { exit }
+    found { print }
+  ' "$CHANGELOG" | sed '/^$/d' | sed '/^---/d' | sed '/^\*Format based on/d')"
+fi
+
+# Check via git diff as a secondary signal.
+has_diff=false
+if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  if ! git diff --quiet -- "$CHANGELOG" 2>/dev/null || ! git diff --cached --quiet -- "$CHANGELOG" 2>/dev/null; then
+    has_diff=true
+  fi
+fi
+
+# If there's meaningful content or recent changes, stay silent.
+if [[ -n "$unreleased_content" ]] && echo "$unreleased_content" | grep -Eiq '(^### |^- )'; then
+  exit 0
+fi
+
+if [[ "$has_diff" == "true" ]]; then
+  exit 0
+fi
+
+echo "[ChangelogGuard] ⚠ Release command detected but $CHANGELOG [Unreleased] section appears empty. Consider updating before releasing."
+exit 0

package/assets/hooks/codex.hooks.template.json

@@ -0,0 +1,60 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          { "type": "command", "command": "repo=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0; HOOK_HOST=codex HOOK_REPO_ROOT=\"$repo\" bash \"$repo/.ai/hooks/run-hook.sh\" session-start-context.sh", "timeout": 30 },
+          { "type": "command", "command": "repo=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0; HOOK_HOST=codex HOOK_REPO_ROOT=\"$repo\" bash \"$repo/.ai/hooks/run-hook.sh\" security-sentinel.sh", "timeout": 30 }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          { "type": "command", "command": "repo=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0; HOOK_HOST=codex HOOK_REPO_ROOT=\"$repo\" bash \"$repo/.ai/hooks/run-hook.sh\" worktree-guard.sh", "timeout": 30 },
+          { "type": "command", "command": "repo=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0; HOOK_HOST=codex HOOK_REPO_ROOT=\"$repo\" bash \"$repo/.ai/hooks/run-hook.sh\" pre-edit-guard.sh", "timeout": 30 }
+        ]
+      },
+      {
+        "matcher": "Task|Agent|SendUserMessage",
+        "hooks": [
+          { "type": "command", "command": "repo=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0; HOOK_HOST=codex HOOK_REPO_ROOT=\"$repo\" bash \"$repo/.ai/hooks/run-hook.sh\" subagent-return-channel-guard.sh", "timeout": 30 }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          { "type": "command", "command": "repo=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0; HOOK_HOST=codex HOOK_REPO_ROOT=\"$repo\" bash \"$repo/.ai/hooks/run-hook.sh\" post-edit-guard.sh", "timeout": 30 }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          { "type": "command", "command": "repo=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0; HOOK_HOST=codex HOOK_REPO_ROOT=\"$repo\" bash \"$repo/.ai/hooks/run-hook.sh\" post-bash.sh", "timeout": 30 }
+        ]
+      },
+      {
+        "hooks": [
+          { "type": "command", "command": "repo=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0; HOOK_HOST=codex HOOK_REPO_ROOT=\"$repo\" bash \"$repo/.ai/hooks/run-hook.sh\" post-tool-observer.sh", "timeout": 30 }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          { "type": "command", "command": "repo=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0; HOOK_HOST=codex HOOK_REPO_ROOT=\"$repo\" bash \"$repo/.ai/hooks/run-hook.sh\" prompt-guard.sh", "timeout": 30 }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          { "type": "command", "command": "repo=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0; HOOK_HOST=codex HOOK_REPO_ROOT=\"$repo\" bash \"$repo/.ai/hooks/run-hook.sh\" stop-orchestrator.sh", "timeout": 30 }
+        ]
+      }
+    ]
+  }
+}

package/assets/hooks/first-principles-guard.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+# First-Principles Guard — PostToolUse on Edit|Write
+# Warns when diffs add likely overengineering. Advisory only.
+
+set -eo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+. "$SCRIPT_DIR/hook-input.sh"
+
+FILE_PATH="$(hook_get_file_path "${1:-}")"
+[[ -z "$FILE_PATH" ]] && exit 0
+
+if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  exit 0
+fi
+
+DIFF_CONTENT="$(git diff -- "$FILE_PATH" 2>/dev/null || true)"
+[[ -z "$DIFF_CONTENT" ]] && exit 0
+
+ADDED_LINES="$(printf '%s\n' "$DIFF_CONTENT" | grep -E '^\+[^+]' | sed 's/^+//' || true)"
+[[ -z "$ADDED_LINES" ]] && exit 0
+
+warned=0
+
+count_matches() {
+  local pattern="$1"
+  { printf '%s\n' "$ADDED_LINES" | grep -Ei "$pattern" || true; } | wc -l | tr -d ' '
+}
+
+emit_warning() {
+  local category="$1"
+  local detail="$2"
+  warned=1
+  echo "[FirstPrinciples] ${category} in $FILE_PATH"
+  echo "  Re-check: must this exist, does platform/stdlib/current dependency already cover it, can the diff collapse?"
+  [[ -n "$detail" ]] && echo "  Trigger: $detail"
+}
+
+compat_count="$(count_matches '(^|[^[:alnum:]_])(legacy|compat|backward|polyfill|shim)([^[:alnum:]_]|$)')"
+if [[ "$compat_count" -gt 0 ]]; then
+  emit_warning "Compatibility debt additions detected" "${compat_count} compatibility-like line(s)"
+fi
+
+branch_count="$(count_matches '(^|[^[:alnum:]_])(if|else[[:space:]]+if|switch|case)([^[:alnum:]_]|$)')"
+if [[ "$branch_count" -ge 4 ]]; then
+  emit_warning "Branch-heavy additions detected" "${branch_count} new branch/control-flow line(s)"
+fi
+
+abstraction_count="$(count_matches '(^|[^[:alnum:]_])(interface|abstract[[:space:]]+class|factory|adapter|provider|strategy|manager|orchestrator|dispatcher|registry)([^[:alnum:]_]|$)')"
+if [[ "$abstraction_count" -gt 0 ]]; then
+  emit_warning "Abstraction-heavy additions detected" "${abstraction_count} abstraction-like line(s)"
+fi
+
+dependency_count="$(count_matches '(^|[[:space:]])(import[[:space:]].*from[[:space:]]*["'\''][^./]|import[[:space:]]*["'\''][^./]|require\(["'\''][^./]|"(dependencies|devDependencies|peerDependencies|optionalDependencies)"[[:space:]]*:|"[@A-Za-z0-9._/-]+"[[:space:]]*:[[:space:]]*"[~^0-9])')"
+if [[ "$dependency_count" -gt 0 ]]; then
+  emit_warning "Dependency-surface additions detected" "${dependency_count} dependency/import line(s)"
+fi
+
+config_count="$(count_matches '(^|[^[:alnum:]_])(process\.env|import\.meta\.env|feature[-_ ]?flag|FEATURE_|Config|config|Settings|settings)([^[:alnum:]_]|$)')"
+if [[ "$config_count" -gt 1 ]]; then
+  emit_warning "Config-surface additions detected" "${config_count} config/env/flag line(s)"
+fi
+
+state_machine_count="$(count_matches '(^|[^[:alnum:]_])(state[[:space:]_-]?machine|lifecycle|workflow|route|routing|registry|orchestrator)([^[:alnum:]_]|$)')"
+if [[ "$state_machine_count" -gt 1 ]]; then
+  emit_warning "Local orchestration additions detected" "${state_machine_count} orchestration-like line(s)"
+fi
+
+if [[ "$warned" -eq 1 ]]; then
+  echo "  Boundary: keep trust-boundary validation, data-loss prevention, security, accessibility, and explicit user-requested behavior."
+fi