@moretea-labs/forge 1.5.0-rc.1

package/scripts/check-deploy-sql-order.sh

@@ -0,0 +1,117 @@
+#!/bin/bash
+set -euo pipefail
+
+usage() {
+  cat <<'USAGE_EOF'
+Usage: scripts/check-deploy-sql-order.sh [--quiet] [--root deploy/sql]
+
+Validates deployment SQL assets:
+- deployment SQL files must live directly under deploy/sql/
+- filenames must start with a 4-digit numeric prefix
+- prefixes must be strictly ascending in filename order
+- if tests/sql/control_plane_invariants.sql exists, it must reference every deployment SQL file
+
+Example: deploy/sql/0001_create_tables.sql
+USAGE_EOF
+}
+
+quiet=0
+sql_root="deploy/sql"
+invariant_file="tests/sql/control_plane_invariants.sql"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --quiet)
+      quiet=1
+      shift
+      ;;
+    --root)
+      sql_root="${2:-}"
+      if [[ -z "$sql_root" ]]; then
+        echo "--root requires a path" >&2
+        exit 1
+      fi
+      shift 2
+      ;;
+    --help|-h)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage
+      exit 1
+      ;;
+  esac
+done
+
+sql_root="${sql_root%/}"
+deploy_root="${sql_root%%/sql}"
+issues=0
+
+report_issue() {
+  echo "[deploy-sql] $1"
+  issues=$((issues + 1))
+}
+
+if [[ "$sql_root" != "deploy/sql" ]]; then
+  report_issue "SQL root must be deploy/sql; got: $sql_root"
+fi
+
+if [[ ! -d "$sql_root" ]]; then
+  report_issue "Missing SQL directory: $sql_root"
+else
+  if [[ -d "$deploy_root" ]]; then
+    while IFS= read -r file; do
+      [[ -z "$file" ]] && continue
+      if [[ "$file" != "$sql_root/"* ]]; then
+        report_issue "Deploy SQL file must live under $sql_root/: $file"
+        continue
+      fi
+
+      rel="${file#"$sql_root"/}"
+      if [[ "$rel" == */* ]]; then
+        report_issue "SQL file must be a direct child of $sql_root/: $file"
+      fi
+    done < <(find "$deploy_root" -type f -name '*.sql' | sort)
+  fi
+
+  previous_number=-1
+  previous_file=""
+  while IFS= read -r file; do
+    [[ -z "$file" ]] && continue
+    base="$(basename "$file")"
+
+    if [[ ! "$base" =~ ^([0-9]{4})[_-].+\.sql$ ]]; then
+      report_issue "SQL filename must start with a 4-digit prefix: $file (example: deploy/sql/0001_create_tables.sql)"
+      continue
+    fi
+
+    number="${BASH_REMATCH[1]}"
+    number_value=$((10#$number))
+    if (( previous_number >= 0 && number_value <= previous_number )); then
+      report_issue "SQL prefixes must be strictly ascending: $previous_file before $file"
+    fi
+
+    previous_number="$number_value"
+    previous_file="$file"
+  done < <(find "$sql_root" -maxdepth 1 -type f -name '*.sql' | sort)
+
+  if [[ -f "$invariant_file" ]]; then
+    while IFS= read -r file; do
+      [[ -z "$file" ]] && continue
+      base="$(basename "$file")"
+      if ! grep -Fq "$file" "$invariant_file" && ! grep -Fq "$base" "$invariant_file"; then
+        report_issue "SQL migration must be referenced by $invariant_file: $file"
+      fi
+    done < <(find "$sql_root" -maxdepth 1 -type f -name '*.sql' | sort)
+  fi
+fi
+
+if (( issues > 0 )); then
+  exit 1
+fi
+
+if (( quiet == 0 )); then
+  echo "[deploy-sql] OK"
+fi

package/scripts/check-mcp-compatibility.ts

@@ -0,0 +1,93 @@
+import { FORGE_TOOL_SURFACE, FORGE_VERSION, forgeToolSurfaceFingerprint } from '../src/cli/controller/runtime-config';
+import { runtimePolicy } from '../src/cli/mcp/multi-repository';
+import { buildMcpToolDefinitions } from '../src/cli/mcp/tools';
+import { accessToolDefinitions } from '../src/cli/mcp/access-tools';
+import { repositoryToolDefinitions } from '../src/cli/mcp/repository-tools';
+import { runtimeToolDefinitions } from '../src/runtime/gateway/mcp/runtime-tools';
+import { executionToolDefinitions } from '../src/runtime/gateway/mcp/execution-tools';
+import { processToolDefinitions } from '../src/runtime/gateway/mcp/process-tools';
+import {
+  ADVANCED_CONTROLLER_TOOL_NAMES,
+  CORE_CONTROLLER_TOOL_NAMES,
+  DEFAULT_CONTROLLER_TOOL_NAMES,
+  PREFERRED_FACADE_TOOL_NAMES,
+  STABLE_CONTROLLER_TOOL_NAMES,
+} from '../src/cli/mcp/toolset';
+
+// The served ChatGPT schema is intentionally much smaller than the exhaustive
+// compatibility catalog. Keep a tight budget so accidental tool additions are
+// caught before they become discovery latency and schema-cache churn.
+const MAX_DEFAULT_TOOL_COUNT = 24;
+
+const policy = runtimePolicy(process.cwd(), {
+  profile: 'controller',
+  enableDevRunner: true,
+  devRunnerAgents: 'codex,claude',
+});
+
+const sourceGroups = {
+  runtime: runtimeToolDefinitions.map((tool) => tool.name),
+  execution: executionToolDefinitions.map((tool) => tool.name),
+  process: processToolDefinitions.map((tool) => tool.name),
+  access: accessToolDefinitions.map((tool) => tool.name),
+  repository: repositoryToolDefinitions.map((tool) => tool.name),
+  legacyCompatibility: buildMcpToolDefinitions(policy).map((tool) => tool.name),
+};
+const fullNames = [...new Set(Object.values(sourceGroups).flat())];
+const defaultNames: string[] = [...DEFAULT_CONTROLLER_TOOL_NAMES];
+const coreNames: string[] = [...CORE_CONTROLLER_TOOL_NAMES];
+const advancedNames: string[] = [...ADVANCED_CONTROLLER_TOOL_NAMES];
+const catalogNames: string[] = [...STABLE_CONTROLLER_TOOL_NAMES];
+const preferredNames: string[] = [...PREFERRED_FACADE_TOOL_NAMES];
+const defaultFingerprint = forgeToolSurfaceFingerprint(defaultNames);
+const catalogFingerprint = forgeToolSurfaceFingerprint(catalogNames);
+const fullFingerprint = forgeToolSurfaceFingerprint(fullNames);
+const duplicateDefault = defaultNames.filter((name, index) => defaultNames.indexOf(name) !== index);
+const missingDefault = defaultNames.filter((name) => !fullNames.includes(name));
+const missingCatalog = catalogNames.filter((name) => !fullNames.includes(name));
+const sourceCollisions = Object.entries(sourceGroups).flatMap(([group, names], groupIndex, entries) =>
+  names.filter((name) => entries.slice(0, groupIndex).some(([, earlier]) => earlier.includes(name)))
+    .map((name) => `${group}:${name}`));
+
+const failures: string[] = [];
+if (defaultNames.length > MAX_DEFAULT_TOOL_COUNT) {
+  failures.push(`default ChatGPT tools/list exceeds the schema budget: ${defaultNames.length} > ${MAX_DEFAULT_TOOL_COUNT}`);
+}
+if (duplicateDefault.length) failures.push(`default duplicate names: ${[...new Set(duplicateDefault)].join(', ')}`);
+if (missingDefault.length) failures.push(`default tools missing from registered definitions: ${missingDefault.join(', ')}`);
+if (missingCatalog.length) failures.push(`compatibility catalog tools missing from registered definitions: ${missingCatalog.join(', ')}`);
+if (coreNames.join('\n') !== defaultNames.join('\n')) {
+  failures.push('core surface must alias the bounded default ChatGPT surface');
+}
+if (advancedNames.join('\n') !== defaultNames.join('\n')) {
+  failures.push('advanced surface must alias the bounded default ChatGPT surface');
+}
+for (const name of ['rh_access', 'rh_status', 'rh_inbox', 'rh_context', 'rh_work']) {
+  if (!preferredNames.includes(name)) failures.push(`preferred facade surface missing: ${name}`);
+  if (!defaultNames.includes(name)) failures.push(`default surface missing facade tool: ${name}`);
+}
+if (fullNames.length < defaultNames.length) {
+  failures.push(`full compatibility surface is smaller than default surface: ${fullNames.length} < ${defaultNames.length}`);
+}
+
+if (failures.length) {
+  console.error('[mcp-compatibility] FAILED');
+  for (const failure of failures) console.error(`- ${failure}`);
+  process.exit(1);
+}
+
+console.log(JSON.stringify({
+  status: 'ok',
+  toolSurface: FORGE_TOOL_SURFACE,
+  version: FORGE_VERSION,
+  stableToolCount: defaultNames.length,
+  stableFingerprint: defaultFingerprint,
+  defaultToolBudget: MAX_DEFAULT_TOOL_COUNT,
+  compatibilityCatalogToolCount: catalogNames.length,
+  compatibilityCatalogFingerprint: catalogFingerprint,
+  fullCompatibilityToolCount: fullNames.length,
+  fullCompatibilityFingerprint: fullFingerprint,
+  sourceToolCounts: Object.fromEntries(Object.entries(sourceGroups).map(([name, tools]) => [name, tools.length])),
+  sourceCollisions: [...new Set(sourceCollisions)].sort(),
+  accessModeChangesSchema: false,
+}, null, 2));

package/scripts/check-npm-release.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+PACKAGE_NAME="$(bun -e 'const pkg = await Bun.file("package.json").json(); console.log(pkg.name)')"
+PACKAGE_VERSION="$(bun -e 'const pkg = await Bun.file("package.json").json(); console.log(pkg.version)')"
+NPM_RELEASE_REGISTRY="${NPM_RELEASE_REGISTRY:-https://registry.npmjs.org/}"
+LOOKUP_STDERR="$(mktemp)"
+trap 'rm -f "$LOOKUP_STDERR"' EXIT
+
+node scripts/check-package-identity.mjs
+node scripts/check-third-party-notices.mjs
+
+echo "[release] package: ${PACKAGE_NAME}@${PACKAGE_VERSION}"
+echo "[release] registry: ${NPM_RELEASE_REGISTRY}"
+if npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" version --json --registry "$NPM_RELEASE_REGISTRY" >/dev/null 2>"$LOOKUP_STDERR"; then
+  echo "[release] ERROR: ${PACKAGE_NAME}@${PACKAGE_VERSION} already exists on npm." >&2
+  echo "[release] Bump package.json, CLI version, status version, and tests before publishing." >&2
+  exit 1
+fi
+
+if ! grep -Eq 'E404|404 Not Found|No match found|not in this registry' "$LOOKUP_STDERR"; then
+  echo "[release] ERROR: unable to prove ${PACKAGE_NAME}@${PACKAGE_VERSION} is unpublished." >&2
+  cat "$LOOKUP_STDERR" >&2
+  exit 1
+fi
+
+bun run check:release
+
+echo "[release] OK: npm package gate passed."

package/scripts/check-open-source-tracked-surface.sh

@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+# Audit tracked files for open-source release hygiene.
+# Reports path + finding class only. Never prints secret values or full match bodies.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+ALLOWLIST_FILE="${FORGE_OPEN_SOURCE_ALLOWLIST:-scripts/open-source-audit-allowlist.txt}"
+STRICT="${FORGE_OPEN_SOURCE_AUDIT_STRICT:-1}"
+
+echo "[open-source-audit] scanning tracked files (values redacted)"
+
+declare -a TRACKED=()
+while IFS= read -r tracked_path; do
+  TRACKED+=("$tracked_path")
+done < <(git ls-files)
+if [[ ${#TRACKED[@]} -eq 0 ]]; then
+  echo "[open-source-audit] ERROR: no tracked files" >&2
+  exit 1
+fi
+
+declare -a ALLOWLIST=()
+if [[ -f "$ALLOWLIST_FILE" ]]; then
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    line="${line%%#*}"
+    line="$(printf '%s' "$line" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+    [[ -z "$line" ]] && continue
+    ALLOWLIST+=("$line")
+  done <"$ALLOWLIST_FILE"
+fi
+
+is_allowlisted() {
+  local path="$1"
+  local entry
+  for entry in "${ALLOWLIST[@]:-}"; do
+    if [[ "$path" == "$entry" || "$path" == $entry ]]; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Runtime / credential-like paths that should not be tracked in a public surface.
+declare -a FORBIDDEN_PATH_GLOBS=(
+  '_ops/*'
+  '.ai/local/*'
+  '.ai/harness/jobs/*'
+  '.ai/harness/local-jobs/*'
+  '.ai/harness/runs/*'
+  '.ai/harness/artifacts/*'
+  '.ai/harness/worktrees/*'
+  '.ai/harness/edit-sessions/*'
+  'artifacts/*'
+  'coverage/*'
+  'tmp/*'
+  'cache/*'
+  '*.log'
+  '**/*.log'
+  '*.out'
+  '**/*.out'
+  '*.pid'
+  '**/*.pid'
+  '*.trace'
+  '**/*.trace'
+  '.env'
+  '.env.*'
+  '*.pem'
+  '*.key'
+  '*.p12'
+  '*.pfx'
+  '**/mcp.local.json'
+  '**/mcp.tokens.json'
+  '**/mcp.oauth.json'
+  '**/mcp.oauth-tokens.json'
+  '**/mcp.runtime.json'
+  '**/*tokens*.json'
+  '**/*secret*'
+  '**/external-filesystem-grants.json'
+  '**/.forge/plugins/*.json'
+)
+
+path_forbidden=0
+for path in "${TRACKED[@]}"; do
+  for glob in "${FORBIDDEN_PATH_GLOBS[@]}"; do
+    if [[ "$path" == $glob ]]; then
+      if is_allowlisted "$path"; then
+        continue
+      fi
+      echo "BLOCK path-runtime: $path"
+      path_forbidden=$((path_forbidden + 1))
+    fi
+  done
+done
+
+# Content patterns. Match lines are never printed — only path + class + line number.
+content_hits=0
+scan_content() {
+  local class="$1"
+  local pattern="$2"
+  local path line_no
+  # Use rg for speed; silence if no matches.
+  while IFS= read -r match; do
+    path="${match%%:*}"
+    rest="${match#*:}"
+    line_no="${rest%%:*}"
+    if is_allowlisted "$path"; then
+      continue
+    fi
+    # Skip binary-ish / lock noise.
+    case "$path" in
+      bun.lock|package-lock.json|*.png|*.svg|*.jpg|*.jpeg|*.gif|*.webp|*.pdf) continue ;;
+    esac
+    echo "BLOCK content-${class}: ${path}:${line_no}"
+    content_hits=$((content_hits + 1))
+  done < <(git grep -n -I -E -e "$pattern" -- . || true)
+}
+
+# Personal absolute paths (common maintainer home roots). Placeholder hosts with example/your-machine are still scanned;
+# real usernames beyond generic placeholders are the concern.
+scan_content "personal-macos-path" '/Users/[A-Za-z0-9._-]+/'
+scan_content "personal-linux-path" '/home/[A-Za-z0-9._-]+/'
+scan_content "repo-id" 'repo_[0-9a-f]{24,}'
+scan_content "checkout-id" 'checkout_[0-9a-f]{16,}'
+scan_content "tailscale-host" '[a-z0-9-]+\.ts\.net'
+scan_content "cg-nat" '100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\.[0-9]{1,3}\.[0-9]{1,3}'
+# Credential markers only — do not print match text.
+scan_content "private-key-marker" '-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----'
+scan_content "aws-access-key" 'AKIA[0-9A-Z]{16}'
+scan_content "github-token" 'gh[pousr]_[A-Za-z0-9_]{20,}'
+scan_content "openai-style-secret" '(^|[^A-Za-z0-9])sk-[A-Za-z0-9_-]{20,}'
+
+total=$((path_forbidden + content_hits))
+echo "[open-source-audit] findings: path=${path_forbidden} content=${content_hits} total=${total}"
+
+if [[ "$total" -gt 0 ]]; then
+  echo "[open-source-audit] FAIL: tracked surface still contains personal/runtime/sensitive markers." >&2
+  echo "[open-source-audit] Add justified paths to ${ALLOWLIST_FILE} or untrack/sanitize the files." >&2
+  if [[ "$STRICT" == "1" ]]; then
+    exit 1
+  fi
+  echo "[open-source-audit] STRICT=0 — continuing with warnings only."
+  exit 0
+fi
+
+echo "[open-source-audit] OK"

package/scripts/check-package-identity.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const root = resolve(scriptDir, "..");
+const pkg = JSON.parse(readFileSync(resolve(root, "package.json"), "utf8"));
+const lock = JSON.parse(readFileSync(resolve(root, "package-lock.json"), "utf8"));
+const skill = JSON.parse(readFileSync(resolve(root, "assets/skill-version.json"), "utf8"));
+
+const expectedName = "@moretea-labs/forge";
+const requiredFiles = [
+  "LICENSE",
+  "CHANGELOG.md",
+  "CONTRIBUTING.md",
+  "SECURITY.md",
+  "SUPPORT.md",
+  "CODE_OF_CONDUCT.md",
+  "NOTICE",
+  "THIRD_PARTY_NOTICES.md",
+  "README.md",
+  "README.en.md",
+  "README.zh-CN.md",
+  "install.sh",
+  "install.ps1",
+  "docs/README.md",
+  "docs/tutorials/",
+  "docs/operations/",
+  "docs/wiki/",
+];
+const forbiddenPackageEntries = [
+  "ARCHITECTURE_MIGRATION_REPORT.md",
+  "OPTIMIZATION_REPORT.md",
+];
+
+function fail(message) {
+  console.error(`[package-identity] ERROR: ${message}`);
+  process.exit(1);
+}
+
+function requireReleaseScript(name, channel) {
+  const script = pkg.scripts?.[name];
+  const expected = `bash scripts/publish-release-tarball.sh ${channel}`;
+  if (script !== expected) fail(`${name} must delegate to the reusable tarball publisher for ${channel}`);
+}
+
+function requireReusableTarballPublisher() {
+  const path = resolve(root, "scripts/publish-release-tarball.sh");
+  if (!existsSync(path)) fail("reusable tarball publisher is missing");
+  const script = readFileSync(path, "utf8");
+  for (const required of [
+    "node scripts/check-release-version.mjs --channel \"$CHANNEL\" --require-tag",
+    "bash scripts/check-npm-release.sh",
+    "npm publish \"$TARBALL_PATH\" --tag \"$CHANNEL\" --access public",
+  ]) {
+    if (!script.includes(required)) fail(`reusable tarball publisher missing: ${required}`);
+  }
+}
+
+if (pkg.name !== expectedName) fail(`package.json name is ${pkg.name}`);
+const versionMatch = String(pkg.version ?? "").match(/^(\d+\.\d+\.\d+)(?:-rc\.(\d+))?$/);
+if (!versionMatch) fail(`package.json version is not a stable or rc semantic version: ${pkg.version}`);
+const coreVersion = versionMatch[1];
+if (coreVersion !== skill.version || coreVersion !== skill.templateVersion) {
+  fail(`package core version ${coreVersion} must match workflow versions ${skill.version}/${skill.templateVersion}`);
+}
+if (pkg.publishConfig?.access !== "public") fail("publishConfig.access must be public");
+if (pkg.publishConfig?.provenance !== true) fail("publishConfig.provenance must be true");
+if (pkg.publishConfig?.tag !== undefined) fail("publishConfig.tag must be omitted");
+if (pkg.private !== undefined) fail("package must not declare private");
+if (pkg.author !== "Moretea Labs contributors") fail(`unexpected package author: ${pkg.author}`);
+if (!String(pkg.repository?.url ?? "").includes("moretea-labs/forge")) {
+  fail("repository URL must target the canonical Forge repository");
+}
+
+const bin = pkg.bin ?? {};
+const expectedBins = {
+  forge: "bin/forge.mjs",
+  "forge-hook": "bin/forge-hook.mjs",
+  "forge-runtime": "bin/forge-runtime.mjs",
+};
+if (JSON.stringify(Object.keys(bin).sort()) !== JSON.stringify(Object.keys(expectedBins).sort())) {
+  fail(`package bin surface must be Forge-only: ${Object.keys(bin).sort().join(", ")}`);
+}
+for (const [name, target] of Object.entries(expectedBins)) {
+  if (bin[name] !== target) fail(`${name} bin mapping changed`);
+}
+for (const forbidden of ["matea", "matea-hook", "repo-harness", "repo-harness-hook", "repo-harness-runtime"]) {
+  if (Object.prototype.hasOwnProperty.call(bin, forbidden)) fail(`forbidden compatibility bin remains: ${forbidden}`);
+}
+if (pkg.scripts?.prepublishOnly !== undefined) fail("prepublishOnly must remain unset; explicit release scripts own publication gating");
+if (pkg.scripts?.["check:release-version"] !== "node scripts/check-release-version.mjs") {
+  fail("release version check changed");
+}
+requireReleaseScript("release:rc", "next");
+requireReleaseScript("release:stable", "latest");
+requireReusableTarballPublisher();
+
+const files = new Set(pkg.files ?? []);
+for (const required of requiredFiles) {
+  if (!files.has(required)) fail(`package files missing ${required}`);
+  if (!existsSync(resolve(root, required))) fail(`repository file missing ${required}`);
+}
+for (const forbidden of forbiddenPackageEntries) {
+  if (files.has(forbidden)) fail(`internal report must not be packed: ${forbidden}`);
+}
+
+if (lock.name !== pkg.name || lock.version !== pkg.version) {
+  fail("package-lock root identity differs from package.json");
+}
+if (lock.packages?.[""]?.name !== pkg.name || lock.packages?.[""]?.version !== pkg.version) {
+  fail("package-lock root package identity differs from package.json");
+}
+
+console.log(`[package-identity] OK: ${pkg.name}@${pkg.version}`);

package/scripts/check-platform-support.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { findWindowsIncompatiblePaths } from "./windows-paths.mjs";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const failures = [];
+
+function text(path) {
+  const absolute = resolve(root, path);
+  if (!existsSync(absolute)) {
+    failures.push(`missing ${path}`);
+    return "";
+  }
+  return readFileSync(absolute, "utf8");
+}
+
+function requireText(path, value) {
+  if (!text(path).includes(value)) failures.push(`${path} must contain ${JSON.stringify(value)}`);
+}
+
+try {
+  const trackedPaths = execFileSync("git", ["ls-files", "-z"], { cwd: root, encoding: "utf8" })
+    .split("\0")
+    .filter(Boolean);
+  for (const entry of findWindowsIncompatiblePaths(trackedPaths)) {
+    failures.push(`Windows-incompatible tracked path ${JSON.stringify(entry.path)}: ${entry.problems.join("; ")}`);
+  }
+} catch (error) {
+  failures.push(`unable to inspect tracked paths: ${error instanceof Error ? error.message : String(error)}`);
+}
+
+const pkg = JSON.parse(text("package.json") || "{}");
+if (pkg.engines?.node !== ">=20.10.0") failures.push("package.json engines.node must be >=20.10.0");
+if (!pkg.engines?.bun) failures.push("package.json must document the supported Bun runtime");
+if (!pkg.scripts?.["check:platform-support"]) failures.push("package.json is missing check:platform-support");
+
+requireText("bin/forge.mjs", "#!/usr/bin/env node");
+for (const path of ["install.sh", "install.ps1"]) {
+  requireText(path, "FORGE_INSTALL_RUNTIME");
+  requireText(path, "FORGE_INSTALL_RUNTIME");
+  requireText(path, "Node.js 20.10");
+  requireText(path, "Git is required");
+  requireText(path, "forge install --no-cli");
+}
+requireText("install.sh", "npm install -g");
+requireText("install.ps1", "npm install -g");
+requireText("docs/operations/platform-support.md", "Native Windows");
+requireText("docs/operations/platform-support.md", "WSL2");
+requireText("docs/operations/features.md", "Core features");
+requireText("docs/tutorials/01-install-and-start.md", "Node.js 20.10");
+requireText("docs/tutorials/01-install-and-start.zh-CN.md", "Node.js 20.10");
+requireText(".github/workflows/windows-smoke.yml", "windows-latest");
+requireText(".github/workflows/windows-smoke.yml", "-DryRun");
+
+const publicDocs = [
+  "README.md",
+  "README.en.md",
+  "README.zh-CN.md",
+  "README.es.md",
+  "README.fr.md",
+  "README.ja.md",
+  "docs/public-usage-guide.md",
+  "docs/public-usage-guide.zh-CN.md",
+];
+const retiredPersonalRepositoryUrl = ["github.com", "greysonOuyang"].join("/") + "/";
+for (const path of publicDocs) {
+  const content = text(path);
+  if (content.includes(retiredPersonalRepositoryUrl)) failures.push(`${path} contains the retired personal repository URL`);
+}
+
+if (failures.length > 0) {
+  console.error("[platform-support] FAIL");
+  for (const failure of failures) console.error(`- ${failure}`);
+  process.exit(1);
+}
+console.log("[platform-support] OK");