@mrciphersmith/keryx 0.2.96 → 0.2.98

package/src/gdskills/bundled/rules/core/skills-storage-workflow.mdc

@@ -18,7 +18,11 @@ Before creating or editing a skill, ask and confirm:
 3. Agent profile scope (`Cursor`, `Codex`, `Zed`, `OpenCode`, or all)
 
 ## Source of Truth
-`.metaproject/skills/gdskills/<skill-name>/`
+- Shipped skill: `src/gdskills/bundled/skills/<category>/<skill-name>/` in the
+  keryx repository. `.metaproject/skills/gdskills/<category>/<skill-name>/`
+  is an installed mirror, regenerated by `keryx init`/`keryx update` — never
+  edit it directly, edits there are overwritten on the next run.
+- Project-local skill: `.metaproject/project-skills/<skill-name>/`.
 
 ## Required Source Layout
 - `SKILL.md` — canonical source of truth
@@ -66,26 +70,41 @@ back toward the spec:
   to address.
 
 ## Global Sync Mapping
-- `SKILL.cursor.md` (or `SKILL.md`) → `~/.cursor/skills/<skill-name>/SKILL.md`
-- `SKILL.codex.md` (or `SKILL.md`) → `${CODEX_HOME:-~/.codex}/skills/<skill-name>/SKILL.md`
-- `SKILL.antigravity.md` (or `SKILL.md`) → `~/.antigravity/skills/<skill-name>/SKILL.md`
-- `SKILL.zed.md` (or `SKILL.md`) → `~/.config/zed/skills/<skill-name>/SKILL.md`
-- `SKILL.opencode.md` (or `SKILL.md`) → `~/.config/opencode/skills/<skill-name>/SKILL.md`
+Global sync only ever reaches a **project-local skill**
+(`.metaproject/project-skills/<skill-name>/`) that has first been exported for
+that runtime with `keryx skills export <skill-name> --runtime <runtime>`
+(this writes `.metaproject/runtime/skills/<runtime>/<module>-<skill-name>/`).
+A **shipped** skill (`src/gdskills/bundled/skills/<category>/<skill-name>/`)
+cannot be exported — `keryx skills export` resolves project skills only and
+reports `Project skill not found for: <name>` for a shipped one — so it has no
+global-sync route today. A shipped skill reaches a runtime only through the
+project-local installed mirror (`.metaproject/skills/gdskills/<category>/<skill-name>/`,
+written by `keryx init`/`keryx update`), which stays inside the project.
+
+Once a project skill is exported for a runtime, `keryx skills sync --runtime
+<runtime> --global` copies it from `.metaproject/runtime/skills/<runtime>/` to:
+- `cursor` → `~/.cursor/skills/<module>-<skill-name>/SKILL.md` (built from `SKILL.cursor.md`, or `SKILL.md` as fallback)
+- `codex` → `${CODEX_HOME:-~/.codex}/skills/<module>-<skill-name>/SKILL.md` (built from `SKILL.codex.md`, or `SKILL.md` as fallback)
+- `zed` → `~/.config/zed/skills/<module>-<skill-name>/SKILL.md` (built from `SKILL.zed.md`, or `SKILL.md` as fallback)
+- `opencode` → `~/.config/opencode/skills/<module>-<skill-name>/SKILL.md` (built from `SKILL.opencode.md`, or `SKILL.md` as fallback)
+
+These four global destinations are written only by the explicit, opt-in
+`keryx skills sync --runtime <runtime> --global` command — never as a side
+effect of `keryx update`/`keryx init`. `claude` and `plugin` have no global
+destination; use `keryx skills sync --runtime <runtime> --target <dir>` for
+those instead.
 
 ## Mandatory Behavior
 1. Always create/update `SKILL.md` as the canonical source.
 2. Create platform variants only when platform-specific adaptations are needed; otherwise `SKILL.md` serves all platforms via fallback.
 3. Keep all profiles aligned in structure and intent.
-3. Validate skills before sync.
-4. Sync both global destinations after source update.
-5. Ensure `agents/openai.yaml` exists where required by the target agent UI.
-6. For create/update/sync workflows, produce a machine-readable final result for orchestrators.
+4. Validate skills before sync.
+5. For a **project-local** skill only: export it per runtime first (`keryx skills export <skill-name> --runtime <runtime>`), then sync every global destination that applies (`cursor`, `codex`, `zed`, `opencode` — four in total) with `keryx skills sync --runtime <runtime> --global`, run once per runtime that needs it. A shipped skill cannot be exported and has no global-sync route — it reaches a runtime only via the project-local installed mirror (`keryx update`/`keryx init`).
+6. Ensure `agents/openai.yaml` exists where required by the target agent UI.
+7. For create/update/sync workflows, produce a machine-readable final result for orchestrators.
 
 ## Machine-Readable Contract
-Use canonical schema:
-- `.metaproject/rules/schemas/skill-workflow-result.schema.json`
-
-Contract requirements:
+No canonical schema file exists for this result yet. Contract requirements:
 - One top-level JSON object only.
 - Stable required keys.
 - Closed objects (`additionalProperties: false`).
@@ -105,12 +124,27 @@ Run before syncing skills:
 keryx skills verify --all
 ```
 
-Then run sync:
+Then regenerate the project-local installed mirror
+(`.metaproject/skills/gdskills/<category>/<skill-name>/`) from the bundled
+source:
 
 ```bash
 keryx update
 ```
 
+`keryx update` never writes outside the project, and it is the only route a
+**shipped** skill has to reach a runtime — a shipped skill cannot be exported
+and has no global-sync destination.
+
+To push a **project-local** skill (`.metaproject/project-skills/<skill-name>/`)
+to a harness's own global directory (opt-in, outside the project), export it
+for that runtime first, then sync:
+
+```bash
+keryx skills export <skill-name> --runtime <runtime>
+keryx skills sync --runtime <runtime> --global
+```
+
 If validation fails, do not sync.
 
 ## Naming
@@ -121,4 +155,13 @@ If validation fails, do not sync.
 - Do not create skills in `~/.cursor/skills-cursor/`.
 
 ## Apply Changes Workflow
-Changes under `.metaproject/skills/gdskills/*` should be synced to tool directories using `keryx update`.
+Edit skills under `src/gdskills/bundled/skills/<category>/<skill-name>/`
+(shipped) or `.metaproject/project-skills/<skill-name>/` (project-local).
+`keryx init`/`keryx update` regenerate the installed mirror at
+`.metaproject/skills/gdskills/<category>/<skill-name>/` — this stays inside
+the project, and is the only way a shipped skill reaches a runtime. For a
+project-local skill only, run `keryx skills export <skill-name> --runtime
+<runtime>` then `keryx skills sync --runtime <runtime> --global` separately to
+push it to a harness's own global directory outside the project; shipped
+skills cannot be exported (`keryx skills export` resolves project skills
+only) and have no global-sync route.

package/src/gdskills/bundled/rules/core/storybook-guidelines.mdc

@@ -4,6 +4,7 @@ alwaysApply: false
 globs:
   - ".storybook/**"
   - "**/*.stories.tsx"
+stack_requires: "react"
 ---
 
 # Storybook Guidelines

package/src/gdskills/bundled/skills/orchestration/code-verifier/SKILL.codex.md

@@ -12,9 +12,9 @@ triggers:
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
-  category: "verification"
+  category: "orchestration"
   agent_worthy: true
-  compatible_harnesses: "cursor,codex,zed,opencode"
+  compatible_harnesses: "cursor,codex,zed,opencode,claude"
 license: "MIT"
 ---
 
@@ -61,56 +61,43 @@ Code Verifier Progress:
 
 ### Phase 1: DETECT
 
-Auto-detect the project stack and available verification tools.
+Determine scope. Stack and tool discovery is delegated to `keryx health run`
+and `keryx test run` — do NOT hand-roll package-manager or
+lint/type-check/test tool detection here.
 
-**1.1 Package manager and runner:**
-
-```bash
-cd <codebase_path>
-
-if   [ -f bun.lock ] || [ -f bun.lockb ]; then PM=bun;    RUNNER="bun run"
-elif [ -f pnpm-lock.yaml ];    then PM=pnpm;   RUNNER="pnpm run"
-elif [ -f yarn.lock ];         then PM=yarn;   RUNNER="yarn"
-elif [ -f package-lock.json ]; then PM=npm;    RUNNER="npm run"
-elif [ -f pyproject.toml ] || [ -f requirements.txt ]; then PM=python; RUNNER=""
-elif [ -f go.mod ];            then PM=go;     RUNNER=""
-else PM=unknown; RUNNER=""
-fi
-```
-
-**1.2 Detect available check commands:**
-
-| Check | How to detect | Command |
-|---|---|---|
-| Lint | `package.json` has `"lint"` script | `$RUNNER lint` |
-| Lint (auto) | `eslint.config.*` or `.eslintrc*` present | `npx eslint . --max-warnings 0` |
-| Biome | `biome.json` present | `npx biome check .` |
-| Type-check | `package.json` has `"type-check"` or `"typecheck"` script | `$RUNNER type-check` |
-| Type-check (auto) | `tsconfig.json` present | `npx tsc --noEmit` |
-| Tests | `package.json` has `"test"` script | `$RUNNER test --run` (vitest) or `$RUNNER test` |
-| pytest | `pytest` in `pyproject.toml` or `requirements.txt` | `pytest --tb=short -q` |
-| Go tests | `go.mod` present | `go test ./...` |
-| Circular imports | `madge` in devDependencies | `npx madge --circular src/` |
-
-**1.3 Determine scope:**
+**1.1 Determine scope:**
 
 ```
 IF scope = "changed" (default when dispatched by orchestrator):
   FILES = git diff --name-only <base_branch>...HEAD
-  Run tests only for files related to changed code
-  Run lint only on changed files: npx eslint <changed_files>
-  Run type-check on full project (tsc doesn't support file-level scope)
+  Pass --changed to keryx health run and keryx test run below.
 
 IF scope = "full":
-  Run all checks on full project
+  Run all checks on the full project (omit --changed).
 ```
 
+**1.2 Checks used:**
+
+| Check | Command |
+|---|---|
+| Lint + type-check | `keryx health run --changed --source eslint,typescript` (drop `--changed` for full scope) |
+| Tests | `keryx test run --changed --strict` (drop `--changed` for full scope) |
+| Circular imports | the project's own package-manager runner + `madge --circular --extensions ts,tsx src/`, if `madge` is a devDependency — optional; not covered by `keryx health run` / `keryx test run` |
+
+`src/health/sources/eslint.ts` and `src/health/sources/typescript.ts` resolve
+the real lint/type-check invocation for the project; `src/testing/service.ts`
+detects `bun` / `pnpm` / `yarn` / `npm` from the lockfile and builds the test
+invocation from the project's own test script. Do NOT hard-code a package
+manager, linter, type-checker, or test binary here — that is the if-chain
+these commands already resolve. On a project with no keryx health/testing
+config, fall back to the project's own configured lint/type-check/test
+command (discovered from its `package.json` scripts or equivalent, not a
+hardcoded tool).
+
 **Output of Phase 1:**
 ```
 TOOLING:
-  pm: bun | pnpm | yarn | npm | python | go | unknown
-  runner: "bun run" | ...
-  checks_available: [lint, type-check, tests, circular-imports]
+  checks_available: [lint+type-check, tests, circular-imports]
   checks_skipped: [<reason>]
   scope: changed | full
   changed_files: [<paths>]
@@ -120,54 +107,44 @@ TOOLING:
 
 ### Phase 2: RUN
 
-Execute each available check in order. Capture full output.
+Execute each available check. Capture full output.
 
-**Execution order:** lint → type-check → tests → import-check
+**Execution order:** lint+type-check → tests → import-check
 
 **Do NOT abort early** — run all checks even if one fails. The orchestrator needs the complete picture.
 
-**2.1 Lint:**
+**2.1 Lint + type-check:**
 ```bash
-# Changed files only (faster, more actionable)
-npx eslint <changed_files> --format=json --max-warnings 0
-# OR if lint script exists:
-$RUNNER lint
+keryx health run --changed --source eslint,typescript
+# OR, full scope:
+keryx health run --source eslint,typescript
 ```
 
-Capture:
-- Exit code (0 = pass, non-zero = fail)
+Read the result with `keryx health status` (or the report path the command
+prints). Capture:
+- Gate status (pass/fail) per source
 - Number of errors and warnings
-- Per-file error list (file path, line, column, rule, message)
-
-**2.2 Type-check:**
-```bash
-npx tsc --noEmit 2>&1
-# OR:
-$RUNNER type-check
-```
+- Per-finding: file, line, column, rule/TS code, message
 
-Capture:
-- Exit code
-- Number of errors
-- Per-error: file, line, column, message, TS error code
-
-**2.3 Tests:**
+**2.2 Tests:**
 ```bash
-$RUNNER test --run 2>&1        # vitest
-# OR: npx jest --ci 2>&1
-# OR: pytest --tb=short -q 2>&1
-# OR: go test ./... 2>&1
+keryx test run --changed --strict
+# OR, full scope:
+keryx test run --strict
 ```
 
 Capture:
-- Exit code
+- Report status / exit code
 - Tests passed / failed / skipped counts
 - Per-failure: test name, file, error message, stack (first 5 lines)
 
-**2.4 Circular import check (if madge available):**
+**2.3 Circular import check (if madge available):**
 ```bash
-npx madge --circular --extensions ts,tsx src/ 2>&1
+<pm> exec madge --circular --extensions ts,tsx src/ 2>&1
 ```
+`<pm>` is the project's own package-manager runner for devDependency
+binaries (`pnpm exec`, `yarn`, or the npm-based equivalent), resolved the
+same way `keryx test run` resolves it from the lockfile — not hardcoded.
 
 Capture:
 - Exit code
@@ -298,7 +275,7 @@ code-verifier:
 code-verifier:
   codebase_path: <worktree_path>
   scope: changed
-→ If gate still FAIL after 2 iterations → report as BLOCKED, skip to report
+→ If gate still FAIL after 3 iterations → report as BLOCKED, skip to report
 → If gate: PASS → proceed to report
 ```
 

package/src/gdskills/bundled/skills/orchestration/code-verifier/SKILL.cursor.md

@@ -12,9 +12,9 @@ triggers:
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
-  category: "verification"
+  category: "orchestration"
   agent_worthy: true
-  compatible_harnesses: "cursor,codex,zed,opencode"
+  compatible_harnesses: "cursor,codex,zed,opencode,claude"
 license: "MIT"
 ---
 
@@ -61,56 +61,43 @@ Code Verifier Progress:
 
 ### Phase 1: DETECT
 
-Auto-detect the project stack and available verification tools.
+Determine scope. Stack and tool discovery is delegated to `keryx health run`
+and `keryx test run` — do NOT hand-roll package-manager or
+lint/type-check/test tool detection here.
 
-**1.1 Package manager and runner:**
-
-```bash
-cd <codebase_path>
-
-if   [ -f bun.lock ] || [ -f bun.lockb ]; then PM=bun;    RUNNER="bun run"
-elif [ -f pnpm-lock.yaml ];    then PM=pnpm;   RUNNER="pnpm run"
-elif [ -f yarn.lock ];         then PM=yarn;   RUNNER="yarn"
-elif [ -f package-lock.json ]; then PM=npm;    RUNNER="npm run"
-elif [ -f pyproject.toml ] || [ -f requirements.txt ]; then PM=python; RUNNER=""
-elif [ -f go.mod ];            then PM=go;     RUNNER=""
-else PM=unknown; RUNNER=""
-fi
-```
-
-**1.2 Detect available check commands:**
-
-| Check | How to detect | Command |
-|---|---|---|
-| Lint | `package.json` has `"lint"` script | `$RUNNER lint` |
-| Lint (auto) | `eslint.config.*` or `.eslintrc*` present | `npx eslint . --max-warnings 0` |
-| Biome | `biome.json` present | `npx biome check .` |
-| Type-check | `package.json` has `"type-check"` or `"typecheck"` script | `$RUNNER type-check` |
-| Type-check (auto) | `tsconfig.json` present | `npx tsc --noEmit` |
-| Tests | `package.json` has `"test"` script | `$RUNNER test --run` (vitest) or `$RUNNER test` |
-| pytest | `pytest` in `pyproject.toml` or `requirements.txt` | `pytest --tb=short -q` |
-| Go tests | `go.mod` present | `go test ./...` |
-| Circular imports | `madge` in devDependencies | `npx madge --circular src/` |
-
-**1.3 Determine scope:**
+**1.1 Determine scope:**
 
 ```
 IF scope = "changed" (default when dispatched by orchestrator):
   FILES = git diff --name-only <base_branch>...HEAD
-  Run tests only for files related to changed code
-  Run lint only on changed files: npx eslint <changed_files>
-  Run type-check on full project (tsc doesn't support file-level scope)
+  Pass --changed to keryx health run and keryx test run below.
 
 IF scope = "full":
-  Run all checks on full project
+  Run all checks on the full project (omit --changed).
 ```
 
+**1.2 Checks used:**
+
+| Check | Command |
+|---|---|
+| Lint + type-check | `keryx health run --changed --source eslint,typescript` (drop `--changed` for full scope) |
+| Tests | `keryx test run --changed --strict` (drop `--changed` for full scope) |
+| Circular imports | the project's own package-manager runner + `madge --circular --extensions ts,tsx src/`, if `madge` is a devDependency — optional; not covered by `keryx health run` / `keryx test run` |
+
+`src/health/sources/eslint.ts` and `src/health/sources/typescript.ts` resolve
+the real lint/type-check invocation for the project; `src/testing/service.ts`
+detects `bun` / `pnpm` / `yarn` / `npm` from the lockfile and builds the test
+invocation from the project's own test script. Do NOT hard-code a package
+manager, linter, type-checker, or test binary here — that is the if-chain
+these commands already resolve. On a project with no keryx health/testing
+config, fall back to the project's own configured lint/type-check/test
+command (discovered from its `package.json` scripts or equivalent, not a
+hardcoded tool).
+
 **Output of Phase 1:**
 ```
 TOOLING:
-  pm: bun | pnpm | yarn | npm | python | go | unknown
-  runner: "bun run" | ...
-  checks_available: [lint, type-check, tests, circular-imports]
+  checks_available: [lint+type-check, tests, circular-imports]
   checks_skipped: [<reason>]
   scope: changed | full
   changed_files: [<paths>]
@@ -120,54 +107,44 @@ TOOLING:
 
 ### Phase 2: RUN
 
-Execute each available check in order. Capture full output.
+Execute each available check. Capture full output.
 
-**Execution order:** lint → type-check → tests → import-check
+**Execution order:** lint+type-check → tests → import-check
 
 **Do NOT abort early** — run all checks even if one fails. The orchestrator needs the complete picture.
 
-**2.1 Lint:**
+**2.1 Lint + type-check:**
 ```bash
-# Changed files only (faster, more actionable)
-npx eslint <changed_files> --format=json --max-warnings 0
-# OR if lint script exists:
-$RUNNER lint
+keryx health run --changed --source eslint,typescript
+# OR, full scope:
+keryx health run --source eslint,typescript
 ```
 
-Capture:
-- Exit code (0 = pass, non-zero = fail)
+Read the result with `keryx health status` (or the report path the command
+prints). Capture:
+- Gate status (pass/fail) per source
 - Number of errors and warnings
-- Per-file error list (file path, line, column, rule, message)
-
-**2.2 Type-check:**
-```bash
-npx tsc --noEmit 2>&1
-# OR:
-$RUNNER type-check
-```
+- Per-finding: file, line, column, rule/TS code, message
 
-Capture:
-- Exit code
-- Number of errors
-- Per-error: file, line, column, message, TS error code
-
-**2.3 Tests:**
+**2.2 Tests:**
 ```bash
-$RUNNER test --run 2>&1        # vitest
-# OR: npx jest --ci 2>&1
-# OR: pytest --tb=short -q 2>&1
-# OR: go test ./... 2>&1
+keryx test run --changed --strict
+# OR, full scope:
+keryx test run --strict
 ```
 
 Capture:
-- Exit code
+- Report status / exit code
 - Tests passed / failed / skipped counts
 - Per-failure: test name, file, error message, stack (first 5 lines)
 
-**2.4 Circular import check (if madge available):**
+**2.3 Circular import check (if madge available):**
 ```bash
-npx madge --circular --extensions ts,tsx src/ 2>&1
+<pm> exec madge --circular --extensions ts,tsx src/ 2>&1
 ```
+`<pm>` is the project's own package-manager runner for devDependency
+binaries (`pnpm exec`, `yarn`, or the npm-based equivalent), resolved the
+same way `keryx test run` resolves it from the lockfile — not hardcoded.
 
 Capture:
 - Exit code
@@ -298,7 +275,7 @@ code-verifier:
 code-verifier:
   codebase_path: <worktree_path>
   scope: changed
-→ If gate still FAIL after 2 iterations → report as BLOCKED, skip to report
+→ If gate still FAIL after 3 iterations → report as BLOCKED, skip to report
 → If gate: PASS → proceed to report
 ```
 

package/src/gdskills/bundled/skills/orchestration/code-verifier/SKILL.md

@@ -12,9 +12,9 @@ triggers:
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
-  category: "verification"
+  category: "orchestration"
   agent_worthy: true
-  compatible_harnesses: "cursor,codex,zed,opencode"
+  compatible_harnesses: "cursor,codex,zed,opencode,claude"
 license: "MIT"
 ---
 
@@ -61,56 +61,43 @@ Code Verifier Progress:
 
 ### Phase 1: DETECT
 
-Auto-detect the project stack and available verification tools.
+Determine scope. Stack and tool discovery is delegated to `keryx health run`
+and `keryx test run` — do NOT hand-roll package-manager or
+lint/type-check/test tool detection here.
 
-**1.1 Package manager and runner:**
-
-```bash
-cd <codebase_path>
-
-if   [ -f bun.lock ] || [ -f bun.lockb ]; then PM=bun;    RUNNER="bun run"
-elif [ -f pnpm-lock.yaml ];    then PM=pnpm;   RUNNER="pnpm run"
-elif [ -f yarn.lock ];         then PM=yarn;   RUNNER="yarn"
-elif [ -f package-lock.json ]; then PM=npm;    RUNNER="npm run"
-elif [ -f pyproject.toml ] || [ -f requirements.txt ]; then PM=python; RUNNER=""
-elif [ -f go.mod ];            then PM=go;     RUNNER=""
-else PM=unknown; RUNNER=""
-fi
-```
-
-**1.2 Detect available check commands:**
-
-| Check | How to detect | Command |
-|---|---|---|
-| Lint | `package.json` has `"lint"` script | `$RUNNER lint` |
-| Lint (auto) | `eslint.config.*` or `.eslintrc*` present | `npx eslint . --max-warnings 0` |
-| Biome | `biome.json` present | `npx biome check .` |
-| Type-check | `package.json` has `"type-check"` or `"typecheck"` script | `$RUNNER type-check` |
-| Type-check (auto) | `tsconfig.json` present | `npx tsc --noEmit` |
-| Tests | `package.json` has `"test"` script | `$RUNNER test --run` (vitest) or `$RUNNER test` |
-| pytest | `pytest` in `pyproject.toml` or `requirements.txt` | `pytest --tb=short -q` |
-| Go tests | `go.mod` present | `go test ./...` |
-| Circular imports | `madge` in devDependencies | `npx madge --circular src/` |
-
-**1.3 Determine scope:**
+**1.1 Determine scope:**
 
 ```
 IF scope = "changed" (default when dispatched by orchestrator):
   FILES = git diff --name-only <base_branch>...HEAD
-  Run tests only for files related to changed code
-  Run lint only on changed files: npx eslint <changed_files>
-  Run type-check on full project (tsc doesn't support file-level scope)
+  Pass --changed to keryx health run and keryx test run below.
 
 IF scope = "full":
-  Run all checks on full project
+  Run all checks on the full project (omit --changed).
 ```
 
+**1.2 Checks used:**
+
+| Check | Command |
+|---|---|
+| Lint + type-check | `keryx health run --changed --source eslint,typescript` (drop `--changed` for full scope) |
+| Tests | `keryx test run --changed --strict` (drop `--changed` for full scope) |
+| Circular imports | the project's own package-manager runner + `madge --circular --extensions ts,tsx src/`, if `madge` is a devDependency — optional; not covered by `keryx health run` / `keryx test run` |
+
+`src/health/sources/eslint.ts` and `src/health/sources/typescript.ts` resolve
+the real lint/type-check invocation for the project; `src/testing/service.ts`
+detects `bun` / `pnpm` / `yarn` / `npm` from the lockfile and builds the test
+invocation from the project's own test script. Do NOT hard-code a package
+manager, linter, type-checker, or test binary here — that is the if-chain
+these commands already resolve. On a project with no keryx health/testing
+config, fall back to the project's own configured lint/type-check/test
+command (discovered from its `package.json` scripts or equivalent, not a
+hardcoded tool).
+
 **Output of Phase 1:**
 ```
 TOOLING:
-  pm: bun | pnpm | yarn | npm | python | go | unknown
-  runner: "bun run" | ...
-  checks_available: [lint, type-check, tests, circular-imports]
+  checks_available: [lint+type-check, tests, circular-imports]
   checks_skipped: [<reason>]
   scope: changed | full
   changed_files: [<paths>]
@@ -120,54 +107,44 @@ TOOLING:
 
 ### Phase 2: RUN
 
-Execute each available check in order. Capture full output.
+Execute each available check. Capture full output.
 
-**Execution order:** lint → type-check → tests → import-check
+**Execution order:** lint+type-check → tests → import-check
 
 **Do NOT abort early** — run all checks even if one fails. The orchestrator needs the complete picture.
 
-**2.1 Lint:**
+**2.1 Lint + type-check:**
 ```bash
-# Changed files only (faster, more actionable)
-npx eslint <changed_files> --format=json --max-warnings 0
-# OR if lint script exists:
-$RUNNER lint
+keryx health run --changed --source eslint,typescript
+# OR, full scope:
+keryx health run --source eslint,typescript
 ```
 
-Capture:
-- Exit code (0 = pass, non-zero = fail)
+Read the result with `keryx health status` (or the report path the command
+prints). Capture:
+- Gate status (pass/fail) per source
 - Number of errors and warnings
-- Per-file error list (file path, line, column, rule, message)
-
-**2.2 Type-check:**
-```bash
-npx tsc --noEmit 2>&1
-# OR:
-$RUNNER type-check
-```
+- Per-finding: file, line, column, rule/TS code, message
 
-Capture:
-- Exit code
-- Number of errors
-- Per-error: file, line, column, message, TS error code
-
-**2.3 Tests:**
+**2.2 Tests:**
 ```bash
-$RUNNER test --run 2>&1        # vitest
-# OR: npx jest --ci 2>&1
-# OR: pytest --tb=short -q 2>&1
-# OR: go test ./... 2>&1
+keryx test run --changed --strict
+# OR, full scope:
+keryx test run --strict
 ```
 
 Capture:
-- Exit code
+- Report status / exit code
 - Tests passed / failed / skipped counts
 - Per-failure: test name, file, error message, stack (first 5 lines)
 
-**2.4 Circular import check (if madge available):**
+**2.3 Circular import check (if madge available):**
 ```bash
-npx madge --circular --extensions ts,tsx src/ 2>&1
+<pm> exec madge --circular --extensions ts,tsx src/ 2>&1
 ```
+`<pm>` is the project's own package-manager runner for devDependency
+binaries (`pnpm exec`, `yarn`, or the npm-based equivalent), resolved the
+same way `keryx test run` resolves it from the lockfile — not hardcoded.
 
 Capture:
 - Exit code
@@ -298,7 +275,7 @@ code-verifier:
 code-verifier:
   codebase_path: <worktree_path>
   scope: changed
-→ If gate still FAIL after 2 iterations → report as BLOCKED, skip to report
+→ If gate still FAIL after 3 iterations → report as BLOCKED, skip to report
 → If gate: PASS → proceed to report
 ```