@mstar-harness/cli 2.3.0 → 2.4.1

package/dist/mstar-harness.js

@@ -2344,9 +2344,9 @@ var require_commander = __commonJS((exports) => {
 });
 
 // src/index.ts
-import { execFileSync as execFileSync7 } from "child_process";
-import fs7 from "fs";
-import path11 from "path";
+import { execFileSync as execFileSync8 } from "child_process";
+import fs8 from "fs";
+import path12 from "path";
 
 // ../../node_modules/@inquirer/core/dist/lib/key.js
 var keybindings = ["emacs", "vim"];
@@ -4016,6 +4016,8 @@ import { mkdirSync as mkdirSync5, readdirSync as readdirSync4, readFileSync as r
 import { join as join7, resolve as resolve7 } from "node:path";
 import { existsSync as existsSync5, readdirSync as readdirSync5, readFileSync as readFileSync7 } from "node:fs";
 import { basename as basename4, isAbsolute as isAbsolute5, join as join8, relative as relative2, resolve as resolve8, sep } from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
+import { join as join9 } from "node:path";
 var SEVERITY_ORDER = ["critical", "high", "medium", "low", "nit"];
 function readJson(filePath) {
   if (!existsSync(filePath))
@@ -4161,9 +4163,49 @@ function hasFiles(dir) {
     return false;
   }
 }
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function violation(severity, code, message, fix) {
+  return { ok: false, severity, code, message, fix };
+}
+function validateNonEmptyString(violations, value, field, missingCode, invalidCode) {
+  if (value === undefined) {
+    violations.push(violation("high", missingCode, `missing required field: ${field}`));
+  } else if (typeof value !== "string" || value.trim() === "") {
+    violations.push(violation("medium", invalidCode, `${field} must be a non-empty string`));
+  }
+}
 var DATE_PART = String.raw`\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])`;
 var RFC3339_Z_RE = new RegExp(String.raw`^${DATE_PART}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$`);
 var DATE_ONLY_RE = new RegExp(String.raw`^${DATE_PART}$`);
+function isValidClaimedAt(value) {
+  return typeof value === "string" && (RFC3339_Z_RE.test(value) || DATE_ONLY_RE.test(value));
+}
+function validateIntegrationMergeLease(lease) {
+  const violations = [];
+  if (!isPlainObject2(lease)) {
+    return {
+      ok: false,
+      violations: [
+        violation("high", "lease.merge-lease.invalid", "integration_merge_lease must be an object \u2014 absent means unclaimed; null and tombstone objects are invalid; writers delete the key on release")
+      ]
+    };
+  }
+  validateNonEmptyString(violations, lease.holder, "holder", "lease.merge-lease.missing-holder", "lease.merge-lease.invalid-holder");
+  if (lease.claimed_at === undefined) {
+    violations.push(violation("high", "lease.merge-lease.missing-claimed-at", "missing required field: claimed_at"));
+  } else if (!isValidClaimedAt(lease.claimed_at)) {
+    violations.push(violation("medium", "lease.merge-lease.invalid-claimed-at", "claimed_at must be an RFC 3339 UTC timestamp with explicit Z (e.g. 2026-07-22T04:00:00Z) or a YYYY-MM-DD date"));
+  }
+  validateNonEmptyString(violations, lease.plan_id, "plan_id", "lease.merge-lease.missing-plan-id", "lease.merge-lease.invalid-plan-id");
+  validateNonEmptyString(violations, lease.source_branch, "source_branch", "lease.merge-lease.missing-source-branch", "lease.merge-lease.invalid-source-branch");
+  validateNonEmptyString(violations, lease.target_branch, "target_branch", "lease.merge-lease.missing-target-branch", "lease.merge-lease.invalid-target-branch");
+  if (lease.session_label !== undefined && typeof lease.session_label !== "string") {
+    violations.push(violation("medium", "lease.merge-lease.invalid-session-label", "session_label must be a string (display only \u2014 never used for ownership comparison)"));
+  }
+  return { ok: violations.length === 0, violations };
+}
 var STATUS_WRITE_LOCKDIR = ".status-write.lockdir";
 var LOCKDIR_HOLDER_PID = "holder.pid";
 var heldLockDirs = new AsyncLocalStorage2;
@@ -4376,7 +4418,8 @@ var DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 var PLAN_STATUSES = ["Todo", "InProgress", "InReview", "Blocked", "Done"];
 var RESIDUAL_DECISIONS = ["defer", "accept", "risk-accepted"];
 var RESIDUAL_LIFECYCLES = ["open", "resolved", "waived", "superseded", "duplicate"];
-function isPlainObject2(value) {
+var ROLLUP_FIELDS = ["total_open", "by_severity", "by_target", "by_plan"];
+function isPlainObject22(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function violation3(severity, code, message, fix) {
@@ -4388,6 +4431,13 @@ function todayString() {
   const day = String(now.getDate()).padStart(2, "0");
   return `${now.getFullYear()}-${month}-${day}`;
 }
+function normalizeSeverity(value) {
+  if (value === "warning")
+    return "low";
+  if (value === null || value === "")
+    return "medium";
+  return value;
+}
 function isOpenResidual(entry) {
   const lifecycle = entry.lifecycle;
   const effective = lifecycle === false || lifecycle === null || lifecycle === undefined ? "open" : lifecycle;
@@ -4402,7 +4452,7 @@ function validateNonEmptyString2(violations, value, field, missingCode, invalidC
 }
 function validatePlanRow(row) {
   const violations = [];
-  if (!isPlainObject2(row)) {
+  if (!isPlainObject22(row)) {
     return { ok: false, violations: [violation3("high", "status.plan-row.invalid", "plan row must be an object")] };
   }
   const { id, plan_id: planId, title, file, status, metadata, execution_lease } = row;
@@ -4426,10 +4476,10 @@ function validatePlanRow(row) {
   } else if (typeof status !== "string" || !PLAN_STATUSES.includes(status)) {
     violations.push(violation3("medium", "status.plan-row.invalid-status", `status must be one of ${PLAN_STATUSES.join(" | ")} \u2014 got ${JSON.stringify(status)}`));
   }
-  if (metadata !== undefined && !isPlainObject2(metadata)) {
+  if (metadata !== undefined && !isPlainObject22(metadata)) {
     violations.push(violation3("medium", "status.plan-row.invalid-metadata", "metadata must be an object"));
   }
-  if (execution_lease !== undefined && !isPlainObject2(execution_lease)) {
+  if (execution_lease !== undefined && !isPlainObject22(execution_lease)) {
     violations.push(violation3("medium", "status.plan-row.invalid-execution-lease", "execution_lease must be an object"));
   }
   if (status === "Done" && execution_lease !== undefined) {
@@ -4439,7 +4489,7 @@ function validatePlanRow(row) {
 }
 function validateResidual(entry) {
   const violations = [];
-  if (!isPlainObject2(entry)) {
+  if (!isPlainObject22(entry)) {
     return { ok: false, violations: [violation3("high", "status.residual.invalid", "residual entry must be an object")] };
   }
   const { id, title, severity, source, scope, decision, owner, target, tracking, detail_doc, lifecycle, closed_at } = entry;
@@ -4529,7 +4579,7 @@ function validateStatus(docOrPath) {
   }
   if (residual_findings === undefined) {
     violations.push(violation3("high", "status.missing-residual-findings", "missing required field: residual_findings (root-only canonical)"));
-  } else if (!isPlainObject2(residual_findings)) {
+  } else if (!isPlainObject22(residual_findings)) {
     violations.push(violation3("high", "status.invalid-residual-findings", "residual_findings must be an object at root"));
   } else {
     for (const [planId, list] of Object.entries(residual_findings)) {
@@ -4546,7 +4596,7 @@ function validateStatus(docOrPath) {
   }
   if (metadata === undefined) {
     violations.push(violation3("high", "status.missing-metadata", "missing required field: metadata"));
-  } else if (!isPlainObject2(metadata)) {
+  } else if (!isPlainObject22(metadata)) {
     violations.push(violation3("high", "status.invalid-metadata", "metadata must be an object"));
   } else if (Object.prototype.hasOwnProperty.call(metadata, "residual_findings")) {
     violations.push(violation3("medium", "status.dual-write-residuals", "residual_findings must be root-only \u2014 metadata.residual_findings is legacy read-only; remove it (no dual-write)", "move entries to root residual_findings and delete metadata.residual_findings"));
@@ -4565,7 +4615,7 @@ async function archiveResiduals(planId, harnessDir) {
   }
   return withStatusWriteLock(statusPath, () => {
     const doc = readJson(statusPath);
-    if (!isPlainObject2(doc.residual_findings)) {
+    if (!isPlainObject22(doc.residual_findings)) {
       throw new Error(`status.json residual_findings must be an object: ${statusPath}`);
     }
     const open = doc.residual_findings[planId];
@@ -4575,10 +4625,10 @@ async function archiveResiduals(planId, harnessDir) {
     }
     const archive = readJson(archivePath);
     const existing = Array.isArray(archive.entries) ? archive.entries : [];
-    const existingIds = new Set(existing.map((e) => isPlainObject2(e) && typeof e.id === "string" ? e.id : undefined).filter((id) => id !== undefined));
+    const existingIds = new Set(existing.map((e) => isPlainObject22(e) && typeof e.id === "string" ? e.id : undefined).filter((id) => id !== undefined));
     const today = todayString();
     const moved = open.filter((entry) => {
-      if (!isPlainObject2(entry) || typeof entry.id !== "string")
+      if (!isPlainObject22(entry) || typeof entry.id !== "string")
         return true;
       return !existingIds.has(entry.id);
     }).map((entry) => ({ ...entry, archived_at: today }));
@@ -4591,6 +4641,105 @@ async function archiveResiduals(planId, harnessDir) {
     return { planId, archived: moved.length, archivePath };
   });
 }
+function planFindingsCleanup(doc, planId) {
+  if (!Array.isArray(doc.plans))
+    return;
+  for (const row of doc.plans) {
+    if (!isPlainObject22(row))
+      continue;
+    const rowId = row.id ?? row.plan_id;
+    if (rowId !== planId)
+      continue;
+    if (!isPlainObject22(row.metadata))
+      return;
+    const mode = row.metadata.findings_cleanup;
+    if (mode === "zero-residual" || mode === "allow-residual")
+      return mode;
+    return;
+  }
+  return;
+}
+function openResidualsOf(doc, planId) {
+  if (!isPlainObject22(doc.residual_findings))
+    return [];
+  const list = doc.residual_findings[planId];
+  if (!Array.isArray(list))
+    return [];
+  return list.filter((entry) => isPlainObject22(entry) && isOpenResidual(entry));
+}
+function findingsCleanupGate(doc, planId, opts) {
+  const mode = opts?.mode ?? planFindingsCleanup(doc, planId) ?? "allow-residual";
+  const violations = [];
+  const residuals = openResidualsOf(doc, planId);
+  for (const entry of residuals) {
+    const id = typeof entry.id === "string" ? entry.id : "<unnamed>";
+    const label = `R#${id}`;
+    if (mode === "zero-residual") {
+      if (entry.severity === "nit") {
+        violations.push(violation3("medium", "findings.zero-residual-nit", `${label}: style-only nits must be fixed in-session or dropped \u2014 never left open under zero-residual`));
+      } else if (entry.decision === "risk-accepted" || entry.lifecycle === "waived") {
+        violations.push(violation3("medium", "findings.zero-residual-risk-accepted", `${label}: waived/risk-accepted findings must be closed/archived, not left open under zero-residual`));
+      } else if (entry.decision === "defer") {
+        if (typeof entry.target !== "string" || entry.target.trim() === "") {
+          violations.push(violation3("medium", "findings.zero-residual-defer-no-target", `${label}: blocker-defer requires a target (next iteration/milestone) under zero-residual`));
+        }
+      } else {
+        violations.push(violation3("medium", "findings.zero-residual-open-fixable", `${label}: fixable finding must not remain open under zero-residual \u2014 fix now or convert to a blocker-defer`));
+      }
+    } else if (normalizeSeverity(entry.severity) === "critical") {
+      violations.push(violation3("high", "findings.allow-residual-critical", `${label}: unresolved critical blocks Approve with residuals`));
+    }
+  }
+  return { ok: violations.length === 0, violations };
+}
+function groupCount(values) {
+  const counts = new Map;
+  for (const value of values) {
+    const key = typeof value === "string" ? value : String(value);
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+  }
+  return Object.fromEntries([...counts.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+}
+function techDebtRollup(docOrPath) {
+  const doc = typeof docOrPath === "string" ? readJson(docOrPath) : docOrPath;
+  const canonical = isPlainObject22(doc.residual_findings) ? doc.residual_findings : {};
+  const metadata = isPlainObject22(doc.metadata) ? doc.metadata : {};
+  const legacy = isPlainObject22(metadata.residual_findings) ? metadata.residual_findings : {};
+  const merged = { ...canonical, ...legacy };
+  const items = [];
+  for (const [plan, list] of Object.entries(merged)) {
+    if (!Array.isArray(list))
+      continue;
+    for (const value of list) {
+      if (!isPlainObject22(value) || !isOpenResidual(value))
+        continue;
+      items.push({ plan, entry: value });
+    }
+  }
+  const bySeverity = {};
+  for (const severity of SEVERITY_ORDER) {
+    bySeverity[severity] = items.filter(({ entry }) => normalizeSeverity(entry.severity) === severity).length;
+  }
+  const computed = {
+    total_open: items.length,
+    by_severity: bySeverity,
+    by_target: groupCount(items.map(({ entry }) => entry.target ?? "unspecified")),
+    by_plan: groupCount(items.map(({ plan }) => plan))
+  };
+  const storedRaw = metadata.tech_debt_summary ?? null;
+  const stored = storedRaw === null ? null : storedRaw;
+  const checks = ROLLUP_FIELDS.map((field) => {
+    const computedField = computed[field];
+    if (stored === null)
+      return { field, status: "DRIFT" };
+    const storedField = stored[field];
+    const storedCompared = storedField === false ? null : storedField ?? null;
+    const status = JSON.stringify(computedField) === JSON.stringify(storedCompared) ? "PASS" : "DRIFT";
+    return { field, status };
+  });
+  const overall = checks.every((check) => check.status === "PASS") ? "PASS" : "DRIFT";
+  return { computed, stored, checks, overall };
+}
 var DEFAULT_PROBE_TIMEOUT_MS = 1e4;
 function probeTimeoutMs() {
   const raw = process.env.MSTAR_GIT_PROBE_TIMEOUT_MS;
@@ -4691,6 +4840,22 @@ function l2PreDispatchCheck(input, opts = {}) {
   });
   return gate(violations);
 }
+var QC_ALIGNMENT_FIELDS = [
+  { key: "planId", label: "plan_id" },
+  { key: "reviewRange", label: "Review range" },
+  { key: "diffBasis", label: "Diff basis" }
+];
+function assertQcAlignment(assignments) {
+  const violations = [];
+  const list = assignments ?? [];
+  for (const { key, label } of QC_ALIGNMENT_FIELDS) {
+    const distinct = [...new Set(list.map((a) => a[key]))];
+    if (distinct.length > 1) {
+      violations.push(violation4("high", "qc.alignment.mismatch", `QC/QA alignment field "${label}" is not byte-identical across ${list.length} assignments: ${distinct.map((v) => `"${v}"`).join(" vs ")}`, `copy the same ${label} value verbatim into every QC tri and QA Assignment`));
+    }
+  }
+  return gate(violations);
+}
 class SddScriptError extends Error {
   exitCode;
   constructor(message, exitCode) {
@@ -6322,6 +6487,156 @@ function lintStrategySections(docText) {
   }
   return { ok: violations.length === 0, violations };
 }
+function violation10(severity, code, message, fix) {
+  return { ok: false, severity, code, message, fix };
+}
+var ROLE_MAPPING = [
+  { agentId: "project-manager", reference: "references/project-manager.md" },
+  { agentId: "product-manager", reference: "references/product-manager.md" },
+  { agentId: "architect", reference: "references/architect.md" },
+  { agentId: "code-reviewer", reference: "references/code-reviewer.md" },
+  { agentId: "fullstack-dev", reference: "references/fullstack-dev-shared.md" },
+  { agentId: "fullstack-dev-2", reference: "references/fullstack-dev-shared.md" },
+  { agentId: "frontend-dev", reference: "references/frontend-dev.md" },
+  { agentId: "qa-engineer", reference: "references/qa-engineer.md" },
+  { agentId: "qc-specialist", reference: "references/qc-specialist-shared.md" },
+  { agentId: "qc-specialist-2", reference: "references/qc-specialist-shared.md" },
+  { agentId: "qc-specialist-3", reference: "references/qc-specialist-shared.md" },
+  { agentId: "ops-engineer", reference: "references/ops-engineer.md" },
+  { agentId: "writing-specialist", reference: "references/writing-specialist.md" },
+  { agentId: "prompt-engineer", reference: "references/prompt-engineer.md" }
+];
+var SHARED_FAMILIES = [
+  { family: "fullstack-dev", memberIds: ["fullstack-dev", "fullstack-dev-2"] },
+  { family: "qc-specialist", memberIds: ["qc-specialist", "qc-specialist-2", "qc-specialist-3"] }
+];
+var DEV_TRACK_PARAMS = [
+  { roleId: "fullstack-dev", track: "primary" },
+  { roleId: "fullstack-dev-2", track: "parallel_secondary" }
+];
+var QC_REVIEWER_PARAMS = [
+  {
+    roleId: "qc-specialist",
+    reviewerIndex: 1,
+    focus: "Architecture coherence and maintainability risk",
+    reportSuffix: "qc1"
+  },
+  {
+    roleId: "qc-specialist-2",
+    reviewerIndex: 2,
+    focus: "Security and correctness risk",
+    reportSuffix: "qc2"
+  },
+  {
+    roleId: "qc-specialist-3",
+    reviewerIndex: 3,
+    focus: "Performance and reliability risk",
+    reportSuffix: "qc3"
+  }
+];
+function validateRoleMapping(rolesDir, options = {}) {
+  const mapping = options.mapping ?? ROLE_MAPPING;
+  const families = options.families ?? SHARED_FAMILIES;
+  const devTrack = options.devTrack ?? DEV_TRACK_PARAMS;
+  const qcReviewers = options.qcReviewers ?? QC_REVIEWER_PARAMS;
+  const violations = [];
+  const referenceById = new Map(mapping.map((m) => [m.agentId, m.reference]));
+  for (const { agentId, reference } of mapping) {
+    if (!existsSync6(join9(rolesDir, reference))) {
+      violations.push(violation10("medium", "roles.mapping.reference.missing", `role "${agentId}" maps to ${reference} which does not exist under ${rolesDir} (mstar-roles \u00a7 Role Reference Mapping)`, `create ${join9(rolesDir, reference)} or fix the mapping row`));
+    }
+  }
+  for (const { family, memberIds } of families) {
+    const absent = memberIds.filter((id) => !referenceById.has(id));
+    for (const id of absent) {
+      violations.push(violation10("medium", "roles.mapping.family.member.missing", `shared family "${family}" member "${id}" is absent from the role mapping (mstar-roles \u00a7 Role Reference Mapping)`, `add "${id}" to the mapping`));
+    }
+    if (absent.length === 0) {
+      const refs = new Set(memberIds.map((id) => referenceById.get(id)));
+      if (refs.size !== 1) {
+        violations.push(violation10("medium", "roles.mapping.family.shared", `shared family "${family}" (${memberIds.join(", ")}) must resolve to ONE shared reference file \u2014 got ${[...refs].join(", ")} (mstar-roles \u00a7 Maintenance Rules: "Keep shared-family roles on one shared reference file")`, `point every "${family}" member at the same references/<role>-shared.md`));
+      }
+    }
+  }
+  const tableByRole = new Map;
+  const checkParamRoles = (rows, table) => {
+    for (const row of rows) {
+      const existing = tableByRole.get(row.roleId);
+      if (existing !== undefined) {
+        violations.push(violation10("medium", "roles.param.role.duplicate", `role "${row.roleId}" appears in both the ${existing} and ${table} parameter rows (mstar-roles \u00a7 Parameter Table (SSOT))`, "remove the duplicate row"));
+      } else {
+        tableByRole.set(row.roleId, table);
+      }
+      if (!referenceById.has(row.roleId)) {
+        violations.push(violation10("medium", "roles.param.role.missing", `${table} parameter row references unknown role "${row.roleId}" (mstar-roles \u00a7 Parameter Table (SSOT))`, `add "${row.roleId}" to the role mapping or drop the row`));
+      }
+    }
+  };
+  checkParamRoles(devTrack, "dev track");
+  checkParamRoles(qcReviewers, "QC reviewer");
+  for (const row of devTrack) {
+    if (row.track !== "primary" && row.track !== "parallel_secondary") {
+      violations.push(violation10("medium", "roles.param.track", `dev track for "${row.roleId}" is "${String(row.track)}" \u2014 must be primary or parallel_secondary (mstar-roles \u00a7 Parameter Table (SSOT))`, 'set track to "primary" or "parallel_secondary"'));
+    }
+  }
+  const indices = qcReviewers.map((r) => r.reviewerIndex).sort((a, b) => a - b);
+  const unique = new Set(indices);
+  if (indices.length !== 3 || unique.size !== 3 || indices[0] !== 1 || indices[1] !== 2 || indices[2] !== 3) {
+    violations.push(violation10("high", "roles.param.qc.index.set", `QC reviewer_index must be exactly {1, 2, 3} across the three qc-specialist* seats \u2014 got [${indices.join(", ")}] (mstar-roles \u00a7 Parameter Table (SSOT))`, "assign reviewer_index 1/2/3 to qc-specialist / qc-specialist-2 / qc-specialist-3"));
+  }
+  for (const row of qcReviewers) {
+    if (row.focus.trim() === "") {
+      violations.push(violation10("medium", "roles.param.qc.focus.missing", `QC seat "${row.roleId}" (reviewer_index ${row.reviewerIndex}) has an empty focus (mstar-roles \u00a7 Parameter Table (SSOT))`, "add the review focus"));
+    }
+    if (row.reportSuffix !== `qc${row.reviewerIndex}`) {
+      violations.push(violation10("medium", "roles.param.qc.suffix", `QC seat "${row.roleId}" report_suffix "${row.reportSuffix}" must equal qc${row.reviewerIndex} \u2014 tri reports land at {SDD_DIR}/review/qc1.md\u2026qc3.md (mstar-roles \u00a7 Parameter Table (SSOT))`, `set report_suffix to qc${row.reviewerIndex}`));
+    }
+  }
+  return { ok: violations.length === 0, violations };
+}
+var LOAD_ORDER_HEADING_RE = /^#{1,6}\s+[^\r\n]*\b(?:load[\s-]*order|first\s+action)\b[^\r\n]*$/i;
+function extractLoadOrderSection(text) {
+  const lines = text.split(/\r?\n/);
+  let start = -1;
+  let level = 0;
+  for (let i = 0;i < lines.length; i++) {
+    const m = /^(#{1,6})\s+/.exec(lines[i]);
+    if (m === null)
+      continue;
+    if (LOAD_ORDER_HEADING_RE.test(lines[i])) {
+      start = i;
+      level = m[1].length;
+      break;
+    }
+  }
+  if (start === -1)
+    return null;
+  const section = [lines[start]];
+  for (let i = start + 1;i < lines.length; i++) {
+    const m = /^(#{1,6})\s+/.exec(lines[i]);
+    if (m !== null && m[1].length <= level)
+      break;
+    section.push(lines[i]);
+  }
+  return section.join(`
+`);
+}
+function lintLoadOrder(skillTexts) {
+  const violations = [];
+  for (const [name, text] of Object.entries(skillTexts)) {
+    if (!name.startsWith("mstar-") || name === "mstar-harness-core")
+      continue;
+    const section = extractLoadOrderSection(text);
+    if (section === null) {
+      violations.push(violation10("medium", "roles.loadorder.section.missing", `skill "${name}" has no Load Order / First action section \u2014 every mstar-* topic skill must declare its first read (mstar-harness-core \u00a7 \u52a0\u8f7d\u7ea6\u5b9a; mstar-roles \u00a7 Load Order (Required))`, `add a "## Load Order" section naming mstar-harness-core as the first read`));
+      continue;
+    }
+    if (!section.includes("mstar-harness-core")) {
+      violations.push(violation10("medium", "roles.loadorder.core.missing", `skill "${name}" Load Order section does not declare mstar-harness-core as its first dependency (mstar-harness-core \u00a7 \u52a0\u8f7d\u7ea6\u5b9a: \u51e1 mstar-*\uff08name \u2260 mstar-harness-core\uff09\u5047\u5b9a\u8bfb\u8005\u5df2 Read \u672c skill)`, "name mstar-harness-core first in the Load Order section"));
+    }
+  }
+  return { ok: violations.length === 0, violations };
+}
 function detectHost(signals2) {
   const s = new Set(signals2);
   if (s.has("subagent_type"))
@@ -6340,6 +6655,27 @@ function detectHost(signals2) {
     return "codex";
   return "ambiguous";
 }
+function resolveSkillRoot(host, paths) {
+  const { skill, rel } = paths;
+  const suffix = rel === undefined || rel === "" ? "" : `/${rel}`;
+  switch (host) {
+    case "omp":
+      return `skill://${skill}${suffix}`;
+    case "cursor":
+      return `~/.cursor/plugins/local/morning-star-harness/skills/${skill}${suffix}`;
+    case "codex":
+      return `skills/${skill}${suffix}`;
+    case "opencode":
+      return `harness-skills/${skill}${suffix}`;
+    case "kimi":
+    case "zcode":
+      return `./skills/${skill}${suffix}`;
+    case "dsh":
+      return `$DSH_BUNDLED_SKILL_DIR/${skill}${suffix}`;
+    case "pi":
+      return `deferred: pi has no plugin API in v1 \u2014 skill-root resolution lands with its adapter (roadmap \u00a78.4)`;
+  }
+}
 function violation11(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
@@ -6350,13 +6686,56 @@ var FIVE_QUESTION_SECTIONS = [
   { key: "evidence", label: "Evidence", question: "what a correct result looks like (success criteria / evidence)" },
   { key: "references", label: "References", question: "additional resources to open when the main path is not enough" }
 ];
+function stripFrontmatter(text) {
+  const lines = text.replace(/^\uFEFF/, "").split(/\r?\n/);
+  if (lines.length === 0 || lines[0].trim() !== "---")
+    return text;
+  for (let i = 1;i < lines.length; i++) {
+    if (lines[i].trim() === "---")
+      return lines.slice(i + 1).join(`
+`);
+  }
+  return text;
+}
 var HEADING_RE = /^#{1,6}\s+[^\r\n]+$/;
-function lintFiveQuestion(bodyText) {
-  const headings = bodyText.split(/\r?\n/).filter((line) => HEADING_RE.test(line)).map((line) => line.replace(/^#{1,6}\s+/, "").trim().toLowerCase());
+function collectHeadings(bodyText) {
+  const headings = [];
+  let inFence = false;
+  for (const line of bodyText.split(/\r?\n/)) {
+    if (line.startsWith("```") || line.startsWith("~~~")) {
+      inFence = !inFence;
+      continue;
+    }
+    if (!inFence && HEADING_RE.test(line)) {
+      headings.push(line.replace(/^#{1,6}\s+/, "").trim().toLowerCase());
+    }
+  }
+  return headings;
+}
+var RUNTIME_HEADING_ALIASES = {
+  workflow: ["process", "playbook"],
+  "decision-rules": [
+    "hard rules",
+    "core rules",
+    "rule",
+    "gate",
+    "not to do",
+    "red flags",
+    "\u53cd\u6a21\u5f0f",
+    "\u7ea2\u7ebf",
+    "\u89c4\u5219",
+    "\u95e8\u7981"
+  ],
+  evidence: ["output format", "\u8bc1\u636e"],
+  references: ["dependencies", "\u5173\u7cfb"]
+};
+function lintFiveQuestion(bodyText, mode = "authoring") {
+  const headings = collectHeadings(bodyText);
   const violations = [];
   for (const section of FIVE_QUESTION_SECTIONS) {
     const label = section.label.toLowerCase();
-    const covered = headings.some((heading) => heading.includes(label));
+    const aliases = mode === "runtime" ? RUNTIME_HEADING_ALIASES[section.key] ?? [] : [];
+    const covered = headings.some((heading) => heading.includes(label) || aliases.some((alias) => heading.includes(alias)));
     if (!covered) {
       violations.push(violation11("low", `skill-authoring.five-question.${section.key}`, `body does not answer "${section.question}" \u2014 no "${section.label}" section (mstar-skill-authoring \u00a7 Body \u5fc5\u987b\u56de\u7b54\u7684 5 \u95ee / \u00a7 \u9ed8\u8ba4 Body \u7ed3\u6784)`, `add a "## ${section.label}" section covering ${section.question}`));
     }
@@ -6365,14 +6744,14 @@ function lintFiveQuestion(bodyText) {
 }
 
 // ../engine/dist/engine.js
-import { existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync8, renameSync as renameSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync8, renameSync as renameSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { basename as basename5, dirname as dirname5, join as join6, resolve as resolve9 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { dirname as dirname32, isAbsolute as isAbsolute22, join as join32, resolve as resolve32 } from "node:path";
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
 function readJson2(filePath) {
-  if (!existsSync6(filePath))
+  if (!existsSync7(filePath))
     return {};
   const content = readFileSync8(filePath, "utf8").trim();
   if (!content)
@@ -6402,7 +6781,7 @@ function resolveProjectRoot(startDir = process.cwd()) {
   const start = resolve9(startDir);
   let dir = start;
   for (;; ) {
-    if (existsSync6(join6(dir, "package.json")) || existsSync6(join6(dir, "bun.lock")))
+    if (existsSync7(join6(dir, "package.json")) || existsSync7(join6(dir, "bun.lock")))
       return dir;
     const parent = dirname5(dir);
     if (parent === dir)
@@ -6471,20 +6850,20 @@ var GITIGNORE_PROCESS_ENTRIES_AGENTS2 = GITIGNORE_SNIPPET_AGENTS2.split(`
 function isPlainObject4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function violation(severity, code, message, fix) {
+function violation7(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
-function validateNonEmptyString(violations, value, field, missingCode, invalidCode) {
+function validateNonEmptyString3(violations, value, field, missingCode, invalidCode) {
   if (value === undefined) {
-    violations.push(violation("high", missingCode, `missing required field: ${field}`));
+    violations.push(violation7("high", missingCode, `missing required field: ${field}`));
   } else if (typeof value !== "string" || value.trim() === "") {
-    violations.push(violation("medium", invalidCode, `${field} must be a non-empty string`));
+    violations.push(violation7("medium", invalidCode, `${field} must be a non-empty string`));
   }
 }
 var DATE_PART2 = String.raw`\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])`;
 var RFC3339_Z_RE2 = new RegExp(String.raw`^${DATE_PART2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$`);
 var DATE_ONLY_RE2 = new RegExp(String.raw`^${DATE_PART2}$`);
-function isValidClaimedAt(value) {
+function isValidClaimedAt2(value) {
   return typeof value === "string" && (RFC3339_Z_RE2.test(value) || DATE_ONLY_RE2.test(value));
 }
 function validateExecutionLease(lease) {
@@ -6493,26 +6872,26 @@ function validateExecutionLease(lease) {
     return {
       ok: false,
       violations: [
-        violation("high", "lease.execution-lease.invalid", "execution_lease must be an object \u2014 null and tombstone objects are invalid; writers delete the key on release")
+        violation7("high", "lease.execution-lease.invalid", "execution_lease must be an object \u2014 null and tombstone objects are invalid; writers delete the key on release")
       ]
     };
   }
-  validateNonEmptyString(violations, lease.holder, "holder", "lease.execution-lease.missing-holder", "lease.execution-lease.invalid-holder");
+  validateNonEmptyString3(violations, lease.holder, "holder", "lease.execution-lease.missing-holder", "lease.execution-lease.invalid-holder");
   if (lease.claimed_at === undefined) {
-    violations.push(violation("high", "lease.execution-lease.missing-claimed-at", "missing required field: claimed_at"));
-  } else if (!isValidClaimedAt(lease.claimed_at)) {
-    violations.push(violation("medium", "lease.execution-lease.invalid-claimed-at", "claimed_at must be an RFC 3339 UTC timestamp with explicit Z (e.g. 2026-07-22T02:30:00Z) or a YYYY-MM-DD date"));
+    violations.push(violation7("high", "lease.execution-lease.missing-claimed-at", "missing required field: claimed_at"));
+  } else if (!isValidClaimedAt2(lease.claimed_at)) {
+    violations.push(violation7("medium", "lease.execution-lease.invalid-claimed-at", "claimed_at must be an RFC 3339 UTC timestamp with explicit Z (e.g. 2026-07-22T02:30:00Z) or a YYYY-MM-DD date"));
   }
   if (lease.worktree_path === undefined) {
-    violations.push(violation("high", "lease.execution-lease.missing-worktree-path", "missing required field: worktree_path"));
+    violations.push(violation7("high", "lease.execution-lease.missing-worktree-path", "missing required field: worktree_path"));
   } else if (typeof lease.worktree_path !== "string" || lease.worktree_path.trim() === "") {
-    violations.push(violation("medium", "lease.execution-lease.invalid-worktree-path", "worktree_path must be a non-empty string"));
+    violations.push(violation7("medium", "lease.execution-lease.invalid-worktree-path", "worktree_path must be a non-empty string"));
   } else if (!isAbsolute22(lease.worktree_path)) {
-    violations.push(violation("medium", "lease.execution-lease.invalid-worktree-path", "worktree_path must be an absolute path \u2014 it identifies the dedicated feature-worktree root (and MUST differ from metadata.control_worktree_path)"));
+    violations.push(violation7("medium", "lease.execution-lease.invalid-worktree-path", "worktree_path must be an absolute path \u2014 it identifies the dedicated feature-worktree root (and MUST differ from metadata.control_worktree_path)"));
   }
-  validateNonEmptyString(violations, lease.working_branch, "working_branch", "lease.execution-lease.missing-working-branch", "lease.execution-lease.invalid-working-branch");
+  validateNonEmptyString3(violations, lease.working_branch, "working_branch", "lease.execution-lease.missing-working-branch", "lease.execution-lease.invalid-working-branch");
   if (lease.session_label !== undefined && typeof lease.session_label !== "string") {
-    violations.push(violation("medium", "lease.execution-lease.invalid-session-label", "session_label must be a string (display only \u2014 never used for ownership comparison)"));
+    violations.push(violation7("medium", "lease.execution-lease.invalid-session-label", "session_label must be a string (display only \u2014 never used for ownership comparison)"));
   }
   return { ok: violations.length === 0, violations };
 }
@@ -6529,22 +6908,22 @@ function verifyPlanExecutionLease(row, planId) {
       return {
         ok: false,
         violations: [
-          violation("high", "lease.verify.orphan", "plan is InProgress without an execution_lease \u2014 orphan: STOP, no writable dispatch until recovery (status-and-residuals.md \u00a7 Orphan recovery)")
+          violation7("high", "lease.verify.orphan", "plan is InProgress without an execution_lease \u2014 orphan: STOP, no writable dispatch until recovery (status-and-residuals.md \u00a7 Orphan recovery)")
         ]
       };
     }
     return {
       ok: false,
       violations: [
-        violation("high", "lease.verify.missing", `plan ${planId} has no execution_lease (neither plans[].execution_lease nor legacy plans[].metadata.execution_lease)`)
+        violation7("high", "lease.verify.missing", `plan ${planId} has no execution_lease (neither plans[].execution_lease nor legacy plans[].metadata.execution_lease)`)
       ]
     };
   }
   const violations = [];
   if (rowLease !== undefined && metadataLease !== undefined) {
-    violations.push(violation("high", "lease.verify.dual-write", "execution_lease present in BOTH plans[].execution_lease (SSOT) and plans[].metadata.execution_lease \u2014 the row-level lease wins; delete the metadata copy to remove the dual write"));
+    violations.push(violation7("high", "lease.verify.dual-write", "execution_lease present in BOTH plans[].execution_lease (SSOT) and plans[].metadata.execution_lease \u2014 the row-level lease wins; delete the metadata copy to remove the dual write"));
   } else if (rowLease === undefined) {
-    violations.push(violation("high", "lease.verify.non-ssot-location", "execution_lease found only under plans[].metadata.execution_lease \u2014 the SSOT location is plans[].execution_lease; the metadata location is a legacy/hand-written read-compat fallback, not equivalent to SSOT success (migrate the lease to the plan row)"));
+    violations.push(violation7("high", "lease.verify.non-ssot-location", "execution_lease found only under plans[].metadata.execution_lease \u2014 the SSOT location is plans[].execution_lease; the metadata location is a legacy/hand-written read-compat fallback, not equivalent to SSOT success (migrate the lease to the plan row)"));
   }
   violations.push(...validateExecutionLease(lease).violations);
   return { ok: violations.length === 0, violations, lease };
@@ -7533,10 +7912,178 @@ var cursorAdapter = {
   }
 };
 
+// src/adapters/dsh.ts
+import { execFileSync as execFileSync6 } from "node:child_process";
+import os4 from "node:os";
+import path7 from "node:path";
+var DSH_BIN = "dsh";
+var DSH_PROFILE = "web";
+var DSH_PROFILE_FLAG = "--profile";
+var DSH_DUMP_FLAG = "--dump-config";
+var DSH_HOME_ENV = "DSH_HOME";
+var DSH_HOME_SUBDIR = ".dsh";
+var DSH_PROFILES_DIR = "profiles";
+var DSH_LOCAL_TIMEOUT_MS = 1e4;
+var DSH_ADD_TIMEOUT_MS = 300000;
+var DSH_ADD_TIMEOUT_ENV = "MSTAR_DSH_SUBPROCESS_TIMEOUT_MS";
+function addTimeoutMs() {
+  const raw = process.env[DSH_ADD_TIMEOUT_ENV];
+  if (raw === undefined || raw.trim() === "")
+    return DSH_ADD_TIMEOUT_MS;
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DSH_ADD_TIMEOUT_MS;
+}
+var DSH_PLUGIN_SPECS = ["@mstar-harness/dsh", "dsh-llm-fallbacks"];
+var DSH_FALLBACKS_SPEC = DSH_PLUGIN_SPECS[1];
+var DSH_INSTALL_HINT = "Install the DeepSeek Harness CLI (@deepseek-ai/dsh), e.g. `pnpm add -g @deepseek-ai/dsh` or `npm install -g @deepseek-ai/dsh`, then re-run init.";
+function runDsh(args, dryRun, timeoutMs) {
+  if (dryRun)
+    return "";
+  return execFileSync6(DSH_BIN, args, {
+    stdio: "pipe",
+    encoding: "utf8",
+    env: process.env,
+    timeout: timeoutMs
+  });
+}
+function dshAvailable() {
+  try {
+    runDsh(["--version"], false, DSH_LOCAL_TIMEOUT_MS);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveProfileDir() {
+  const dshHome = process.env[DSH_HOME_ENV] ?? path7.join(os4.homedir(), DSH_HOME_SUBDIR);
+  return path7.join(dshHome, DSH_PROFILES_DIR, DSH_PROFILE);
+}
+var DISABLED_MARKERS = /\b(?:disabled: true|enabled: false)\b/;
+function parseLoaderEntries(dump) {
+  const entries = [];
+  let current = null;
+  for (const line of dump.split(`
+`)) {
+    if (/^- id: /.test(line)) {
+      if (current)
+        entries.push(current);
+      current = { name: "", enabled: !DISABLED_MARKERS.test(line) };
+    } else if (current) {
+      const nameMatch = /^  name: (.+)$/.exec(line);
+      if (nameMatch) {
+        let name = nameMatch[1].trim();
+        if (DISABLED_MARKERS.test(line)) {
+          current.enabled = false;
+          name = name.replace(/\s*,?\s*(?:disabled: true|enabled: false)\s*$/, "");
+        }
+        current.name = name.replace(/^['"]|['"]$/g, "");
+      } else if (/^  disabled: true$/.test(line) || /^  enabled: false$/.test(line)) {
+        current.enabled = false;
+      } else if (line.trim() !== "" && !line.startsWith("  ")) {
+        entries.push(current);
+        current = null;
+      }
+    }
+  }
+  if (current)
+    entries.push(current);
+  if (dump.trim() !== "" && (entries.length === 0 || entries.some((entry) => !entry.name))) {
+    return null;
+  }
+  return entries;
+}
+function runInit2(scope, dryRun, initFlags) {
+  const notes = [];
+  const profileDir = resolveProfileDir();
+  if (!dryRun && !dshAvailable()) {
+    throw new Error(`${DSH_BIN} CLI not found on PATH. ${DSH_INSTALL_HINT}`);
+  }
+  const installed = new Set;
+  if (!dryRun) {
+    try {
+      const entries = parseLoaderEntries(runDsh([DSH_PROFILE_FLAG, DSH_PROFILE, DSH_DUMP_FLAG], dryRun, DSH_LOCAL_TIMEOUT_MS));
+      if (entries === null) {
+        notes.push("Warning: could not parse installed plugins from dump (unexpected format); proceeding with add (idempotent).");
+      } else {
+        for (const entry of entries)
+          installed.add(entry.name);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      notes.push(`Warning: could not probe installed plugins (${message}); proceeding with add (idempotent).`);
+    }
+  }
+  for (const spec of DSH_PLUGIN_SPECS) {
+    if (spec === DSH_FALLBACKS_SPEC && initFlags?.noFallbacks) {
+      notes.push(`skipped-by-flag: ${spec} (--no-fallbacks)`);
+      continue;
+    }
+    if (!dryRun && installed.has(spec)) {
+      notes.push(`skipped-existing: ${spec} (already installed in profile ${DSH_PROFILE})`);
+      continue;
+    }
+    const addArgs = ["plugin", DSH_PROFILE_FLAG, DSH_PROFILE, "add", spec];
+    if (dryRun) {
+      notes.push(`Would run: ${DSH_BIN} ${addArgs.join(" ")}`);
+      continue;
+    }
+    try {
+      runDsh(addArgs, dryRun, addTimeoutMs());
+      notes.push(`installed: ${spec} (${DSH_BIN} ${addArgs.join(" ")})`);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(`Failed to install ${spec} via ${DSH_BIN}: ${message}`);
+    }
+  }
+  notes.push(`Profile: ${DSH_PROFILE} at ${profileDir}`);
+  notes.push("Verify with: mstar-harness doctor --target dsh");
+  notes.push(`Alternate manual install: ${DSH_BIN} plugin ${DSH_PROFILE_FLAG} ${DSH_PROFILE} add ${DSH_PLUGIN_SPECS.join(` && ${DSH_BIN} plugin ${DSH_PROFILE_FLAG} ${DSH_PROFILE} add `)}`);
+  return { location: profileDir, notes };
+}
+function runDoctor2(scope) {
+  const errors2 = [];
+  const notes = [];
+  const profileDir = resolveProfileDir();
+  if (!dshAvailable()) {
+    errors2.push(`${DSH_BIN} CLI not found on PATH. ${DSH_INSTALL_HINT}`);
+    return { location: profileDir, errors: errors2, notes };
+  }
+  let dump;
+  try {
+    dump = runDsh([DSH_PROFILE_FLAG, DSH_PROFILE, DSH_DUMP_FLAG], false, DSH_LOCAL_TIMEOUT_MS);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    errors2.push(`Warning: could not probe installed plugins (${message}); cannot verify install state.`);
+    return { location: profileDir, errors: errors2, notes };
+  }
+  const entries = parseLoaderEntries(dump);
+  if (entries === null) {
+    errors2.push("Warning: could not parse installed plugins from dump (unexpected format); cannot verify install state.");
+    return { location: profileDir, errors: errors2, notes };
+  }
+  const byName = new Map(entries.map((entry) => [entry.name, entry]));
+  for (const spec of DSH_PLUGIN_SPECS) {
+    const entry = byName.get(spec);
+    const state = !entry ? "uninstalled" : entry.enabled ? "mounted" : "disabled";
+    notes.push(`${spec}: ${state}`);
+    if (state === "mounted")
+      continue;
+    const hint = state === "uninstalled" ? "Run: mstar-harness init --target dsh" : "Enable it (e.g. remove the disable entry from cordis.patch.yml) and re-run doctor.";
+    errors2.push(`${spec} is ${state}. ${hint}`);
+  }
+  return { location: profileDir, errors: errors2, notes };
+}
+var dshAdapter = {
+  target: "dsh",
+  mode: "install",
+  runInstallInit: (scope, dryRun, initFlags) => runInit2(scope, dryRun, initFlags),
+  runInstallDoctor: (scope) => runDoctor2(scope)
+};
+
 // src/adapters/omp.ts
 import fs5 from "node:fs";
-import path7 from "node:path";
-import { execFileSync as execFileSync6 } from "node:child_process";
+import path8 from "node:path";
+import { execFileSync as execFileSync7 } from "node:child_process";
 var OMP_PLUGIN_MARKER = ".omp-plugin/plugin.json";
 var CLAUDE_PLUGIN_MARKER = ".claude-plugin/plugin.json";
 var PACKAGE_NAMES = new Set(["morning-star", PLUGIN_NAME, "github:btspoony/mstar-harness"]);
@@ -7544,7 +8091,7 @@ var SKILL_SMOKE = ["mstar-host", "mstar-harness-core", "pm"];
 var COMMAND_SMOKE = ["iteration-start", "iteration-drive", "iteration-loop", "codebase-audit"];
 function ompAvailable() {
   try {
-    execFileSync6("omp", ["--version"], { stdio: "pipe", encoding: "utf8" });
+    execFileSync7("omp", ["--version"], { stdio: "pipe", encoding: "utf8" });
     return true;
   } catch {
     return false;
@@ -7553,11 +8100,11 @@ function ompAvailable() {
 function runOmp(args, dryRun) {
   if (dryRun)
     return;
-  execFileSync6("omp", args, { stdio: "pipe", encoding: "utf8" });
+  execFileSync7("omp", args, { stdio: "pipe", encoding: "utf8" });
 }
 function listInstalledPlugins() {
   try {
-    const raw = execFileSync6("omp", ["plugin", "list", "--json"], {
+    const raw = execFileSync7("omp", ["plugin", "list", "--json"], {
       stdio: "pipe",
       encoding: "utf8"
     });
@@ -7597,7 +8144,7 @@ function findInstalledPlugin(plugins) {
       return true;
     if (name.includes("morning-star") || manifestName.includes("morning-star"))
       return true;
-    if (pathValue.includes("mstar-harness") || pathValue.includes(`${path7.sep}morning-star`))
+    if (pathValue.includes("mstar-harness") || pathValue.includes(`${path8.sep}morning-star`))
       return true;
     return false;
   });
@@ -7605,35 +8152,35 @@ function findInstalledPlugin(plugins) {
 function validatePluginTree(pluginRoot) {
   const errors2 = [];
   for (const marker of [OMP_PLUGIN_MARKER, CLAUDE_PLUGIN_MARKER]) {
-    const markerPath = path7.join(pluginRoot, marker);
+    const markerPath = path8.join(pluginRoot, marker);
     if (!fs5.existsSync(markerPath)) {
       errors2.push(`Missing omp plugin marker: ${markerPath}`);
     }
   }
   for (const skill of SKILL_SMOKE) {
-    const skillPath = path7.join(pluginRoot, "skills", skill, "SKILL.md");
+    const skillPath = path8.join(pluginRoot, "skills", skill, "SKILL.md");
     if (!fs5.existsSync(skillPath))
       errors2.push(`Missing skill: ${skillPath}`);
   }
   for (const command of COMMAND_SMOKE) {
-    const commandPath = path7.join(pluginRoot, "commands", `${command}.md`);
+    const commandPath = path8.join(pluginRoot, "commands", `${command}.md`);
     if (!fs5.existsSync(commandPath))
       errors2.push(`Missing command: ${commandPath}`);
   }
-  const hostRef = path7.join(pluginRoot, "skills", "mstar-host", "references", "omp.md");
+  const hostRef = path8.join(pluginRoot, "skills", "mstar-host", "references", "omp.md");
   if (!fs5.existsSync(hostRef))
     errors2.push(`Missing omp host reference: ${hostRef}`);
   return errors2;
 }
-function runInit2(scope, dryRun) {
+function runInit3(scope, dryRun) {
   const notes = ensureLocalHarnessRepo(dryRun);
   const projectRoot = resolveProjectRoot2();
-  if (fs5.existsSync(path7.join(HARNESS_REPO_PATH, ".git"))) {
+  if (fs5.existsSync(path8.join(HARNESS_REPO_PATH, ".git"))) {
     if (dryRun) {
       notes.push(`Would update local harness repo: git -C ${HARNESS_REPO_PATH} pull --ff-only`);
     } else {
       try {
-        execFileSync6("git", ["-C", HARNESS_REPO_PATH, "pull", "--ff-only"], {
+        execFileSync7("git", ["-C", HARNESS_REPO_PATH, "pull", "--ff-only"], {
           stdio: "pipe",
           encoding: "utf8"
         });
@@ -7685,7 +8232,7 @@ function runInit2(scope, dryRun) {
     notes
   };
 }
-function runDoctor2(scope) {
+function runDoctor3(scope) {
   const errors2 = [];
   errors2.push(...validateLocalHarnessRepo());
   errors2.push(...validatePluginTree(HARNESS_REPO_PATH));
@@ -7702,7 +8249,7 @@ function runDoctor2(scope) {
   }
   if (scope === "project") {
     const projectRoot = resolveProjectRoot2();
-    const gitignorePath = path7.join(projectRoot, ".gitignore");
+    const gitignorePath = path8.join(projectRoot, ".gitignore");
     const gitignore = fs5.existsSync(gitignorePath) ? fs5.readFileSync(gitignorePath, "utf8") : "";
     for (const entry of missingHarnessProcessGitignoreEntries(gitignore)) {
       errors2.push(`Missing .gitignore entry: ${entry}`);
@@ -7713,13 +8260,13 @@ function runDoctor2(scope) {
 var ompAdapter = {
   target: "omp",
   mode: "install",
-  runInstallInit: (scope, dryRun) => runInit2(scope, dryRun),
-  runInstallDoctor: (scope) => runDoctor2(scope)
+  runInstallInit: (scope, dryRun) => runInit3(scope, dryRun),
+  runInstallDoctor: (scope) => runDoctor3(scope)
 };
 
 // src/adapters/opencode.ts
-import os4 from "node:os";
-import path8 from "node:path";
+import os5 from "node:os";
+import path9 from "node:path";
 var OPENCODE_CONFIG_SCHEMA = "https://opencode.ai/config.json";
 var MSTAR_OPENCODE_PLUGIN = "@mstar-harness/opencode@latest";
 function isLegacyMorningStarGitPlugin(plugin) {
@@ -7740,11 +8287,11 @@ function isAnyMstarHarnessOpencodeSlot(plugin) {
 function resolveOpencodeConfigPath(scope, outputPath) {
   if (outputPath && outputPath.trim()) {
     const raw = outputPath.trim();
-    return path8.isAbsolute(raw) ? raw : path8.join(resolveProjectRoot2(), raw);
+    return path9.isAbsolute(raw) ? raw : path9.join(resolveProjectRoot2(), raw);
   }
   if (scope === "global")
-    return path8.join(os4.homedir(), ".config", "opencode", "opencode.json");
-  return path8.join(resolveProjectRoot2(), "opencode.json");
+    return path9.join(os5.homedir(), ".config", "opencode", "opencode.json");
+  return path9.join(resolveProjectRoot2(), "opencode.json");
 }
 function ensureConfigSchema(config) {
   const next = ensureObject(config);
@@ -7838,8 +8385,8 @@ var opencodeAdapter = {
 
 // src/adapters/zcode.ts
 import fs6 from "node:fs";
-import os5 from "node:os";
-import path9 from "node:path";
+import os6 from "node:os";
+import path10 from "node:path";
 var MARKETPLACE_ID = "mstar-local";
 var MARKETPLACE_NAME2 = "mstar-local";
 var MARKETPLACE_DESCRIPTION = "Morning Star harness marketplace (GitHub source).";
@@ -7850,10 +8397,10 @@ var GITHUB_REF = "main";
 var ZCODE_PLUGIN_MARKER = ".zcode-plugin/plugin.json";
 var ZCODE_PLUGIN_CHECKOUT_PROJECT = ".zcode/plugin-checkout";
 var ZCODE_AGENT_SMOKE_NAMES = ["fullstack-dev", "qc-specialist"];
-var ZCODE_PLUGINS_ROOT = path9.join(os5.homedir(), ".zcode", "cli", "plugins");
-var KNOWN_MARKETPLACES_PATH = path9.join(ZCODE_PLUGINS_ROOT, "known_marketplaces.json");
-var MARKETPLACE_DIR = path9.join(ZCODE_PLUGINS_ROOT, "marketplaces", MARKETPLACE_ID);
-var MARKETPLACE_JSON_PATH = path9.join(MARKETPLACE_DIR, "marketplace.json");
+var ZCODE_PLUGINS_ROOT = path10.join(os6.homedir(), ".zcode", "cli", "plugins");
+var KNOWN_MARKETPLACES_PATH = path10.join(ZCODE_PLUGINS_ROOT, "known_marketplaces.json");
+var MARKETPLACE_DIR = path10.join(ZCODE_PLUGINS_ROOT, "marketplaces", MARKETPLACE_ID);
+var MARKETPLACE_JSON_PATH = path10.join(MARKETPLACE_DIR, "marketplace.json");
 var GITHUB_SOURCE = { source: "github", repo: GITHUB_REPO, ref: GITHUB_REF };
 function nowIso() {
   return new Date().toISOString();
@@ -7961,13 +8508,13 @@ function validateKnownMarketplaces() {
 }
 function validatePluginAgents2(pluginRoot) {
   const errors2 = [];
-  const agentsDir = path9.join(pluginRoot, "agents");
+  const agentsDir = path10.join(pluginRoot, "agents");
   if (!fs6.existsSync(agentsDir)) {
     errors2.push(`Missing plugin agents directory: ${agentsDir}`);
     return errors2;
   }
   for (const agentName of ZCODE_AGENT_SMOKE_NAMES) {
-    const agentPath = path9.join(agentsDir, `${agentName}.md`);
+    const agentPath = path10.join(agentsDir, `${agentName}.md`);
     if (!fs6.existsSync(agentPath)) {
       errors2.push(`Missing plugin agent file: ${agentPath}`);
     }
@@ -7981,11 +8528,11 @@ function buildMarketplaceJson() {
     plugins: [marketplacePluginEntry()]
   };
 }
-function runInit3(scope, dryRun) {
+function runInit4(scope, dryRun) {
   const notes = ensureLocalHarnessRepo(dryRun);
   const projectRoot = resolveProjectRoot2();
   if (scope === "project") {
-    const checkoutPath = path9.join(projectRoot, ZCODE_PLUGIN_CHECKOUT_PROJECT);
+    const checkoutPath = path10.join(projectRoot, ZCODE_PLUGIN_CHECKOUT_PROJECT);
     notes.push(...ensureGitCheckout(REPO_URL, checkoutPath, dryRun));
     notes.push(...appendGitignore(projectRoot, [ZCODE_PLUGIN_CHECKOUT_PROJECT], dryRun));
     notes.push(...appendHarnessProjectGitignore(projectRoot, dryRun));
@@ -8008,14 +8555,14 @@ function runInit3(scope, dryRun) {
     notes
   };
 }
-function runDoctor3(scope) {
+function runDoctor4(scope) {
   const errors2 = [];
   errors2.push(...validateLocalHarnessRepo());
   if (scope === "project") {
     const projectRoot = resolveProjectRoot2();
-    const checkoutPath = path9.join(projectRoot, ZCODE_PLUGIN_CHECKOUT_PROJECT);
+    const checkoutPath = path10.join(projectRoot, ZCODE_PLUGIN_CHECKOUT_PROJECT);
     errors2.push(...validateGitCheckout(checkoutPath, ZCODE_PLUGIN_MARKER));
-    const gitignorePath = path9.join(projectRoot, ".gitignore");
+    const gitignorePath = path10.join(projectRoot, ".gitignore");
     const gitignore = fs6.existsSync(gitignorePath) ? fs6.readFileSync(gitignorePath, "utf8") : "";
     if (!gitignore.split(/\r?\n/).includes(ZCODE_PLUGIN_CHECKOUT_PROJECT)) {
       errors2.push(`Missing .gitignore entry: ${ZCODE_PLUGIN_CHECKOUT_PROJECT}`);
@@ -8034,8 +8581,8 @@ function runDoctor3(scope) {
 var zcodeAdapter = {
   target: "zcode",
   mode: "install",
-  runInstallInit: (scope, dryRun) => runInit3(scope, dryRun),
-  runInstallDoctor: (scope) => runDoctor3(scope)
+  runInstallInit: (scope, dryRun) => runInit4(scope, dryRun),
+  runInstallDoctor: (scope) => runDoctor4(scope)
 };
 
 // src/adapters/index.ts
@@ -8044,7 +8591,8 @@ var adapters = {
   cursor: cursorAdapter,
   codex: codexAdapter,
   zcode: zcodeAdapter,
-  omp: ompAdapter
+  omp: ompAdapter,
+  dsh: dshAdapter
 };
 function getAdapter(target) {
   const adapter = adapters[target];
@@ -8054,10 +8602,11 @@ function getAdapter(target) {
 }
 
 // src/types.ts
-var SUPPORTED_TARGETS = ["opencode", "cursor", "codex", "zcode", "omp"];
+var SUPPORTED_TARGETS = ["opencode", "cursor", "codex", "zcode", "omp", "dsh"];
 
 // src/utils.ts
-import path10 from "node:path";
+import fs7 from "node:fs";
+import path11 from "node:path";
 function parseCsv(raw) {
   if (!raw)
     return;
@@ -8066,9 +8615,43 @@ function parseCsv(raw) {
 function resolveProjectRoot3() {
   const candidate = process.env.MSTAR_CLI_PROJECT_ROOT || process.env.INIT_CWD || process.env.PWD;
   if (candidate && candidate.trim())
-    return path10.resolve(candidate);
+    return path11.resolve(candidate);
   return resolveProjectRoot();
 }
+function findUpPackageRoot(startDir, predicate) {
+  let dir = path11.resolve(startDir);
+  for (;; ) {
+    try {
+      const manifest = JSON.parse(fs7.readFileSync(path11.join(dir, "package.json"), "utf8"));
+      if (predicate(manifest))
+        return dir;
+    } catch {}
+    const parent = path11.dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function declaresWorkspaces(manifest) {
+  return Array.isArray(manifest.workspaces) || typeof manifest.workspaces === "string" || manifest.workspaces !== undefined && manifest.workspaces !== null && typeof manifest.workspaces === "object";
+}
+function resolveCliProjectRoot() {
+  const override = process.env.MSTAR_CLI_PROJECT_ROOT;
+  if (override && override.trim())
+    return path11.resolve(override);
+  const monorepoRoot = findUpPackageRoot(process.cwd(), declaresWorkspaces);
+  if (monorepoRoot)
+    return monorepoRoot;
+  const packageRoot = findUpPackageRoot(process.cwd(), () => true);
+  if (packageRoot)
+    return packageRoot;
+  return process.cwd();
+}
+function resolveCliPath(userPath) {
+  if (path11.isAbsolute(userPath))
+    return userPath;
+  return path11.resolve(resolveCliProjectRoot(), userPath);
+}
 
 // src/index.ts
 var packageVersion = readHarnessVersion();
@@ -8104,7 +8687,7 @@ function resolveExplicitModelAssignments(options) {
     others: allow("other-models", parseCsv(options.otherModels), 3, true)
   });
 }
-async function runInit4(options) {
+async function runInit5(options) {
   const target = options.target || (options.yes ? "opencode" : await pickTargetInteractive());
   const scope = options.scope || "project";
   const adapter = getAdapter(target);
@@ -8113,7 +8696,7 @@ async function runInit4(options) {
   }
   if (adapter.mode === "install") {
     logStep("Step 2/2 - Run target install flow");
-    const installResult = adapter.runInstallInit?.(scope, !!options.dryRun);
+    const installResult = adapter.runInstallInit?.(scope, !!options.dryRun, { noFallbacks: options.noFallbacks });
     if (!installResult) {
       throw new Error(`Adapter ${target} does not implement install init flow.`);
     }
@@ -8167,7 +8750,7 @@ async function runInit4(options) {
     }
   }
 }
-function runDoctor4(options) {
+function runDoctor5(options) {
   const target = options.target || "opencode";
   const adapter = getAdapter(target);
   const scope = options.scope || "project";
@@ -8178,6 +8761,9 @@ function runDoctor4(options) {
       throw new Error(`Adapter ${target} does not implement install doctor flow.`);
     }
     console.log(`Install location: ${result.location}`);
+    for (const note of result.notes ?? []) {
+      console.log(`  - ${note}`);
+    }
     if (!result.errors.length) {
       console.log(import_picocolors.default.green("Doctor result: healthy"));
       return;
@@ -8212,10 +8798,10 @@ function runDoctor4(options) {
 }
 function resolvePluginRoot(options) {
   if (options.root)
-    return path11.resolve(options.root);
+    return path12.resolve(options.root);
   let candidate = resolveProjectRoot3();
-  while (!fs7.existsSync(path11.join(candidate, "plugin.json"))) {
-    const parent = path11.dirname(candidate);
+  while (!fs8.existsSync(path12.join(candidate, "plugin.json"))) {
+    const parent = path12.dirname(candidate);
     if (parent === candidate)
       break;
     candidate = parent;
@@ -8238,11 +8824,11 @@ function runPluginValidate(options) {
   process.exitCode = 1;
 }
 program2.name("mstar-harness").description("Morning Star harness CLI for target-based agent bootstrap").version(packageVersion);
-program2.command("init").description("Interactive/non-interactive setup for target agent bootstrap").option("-y, --yes", "Non-interactive mode").option("--target <target>", "Install target", "opencode").option("--scope <scope>", "Config scope: global|project (default: project)").option("--output <path>", "Config file path override, relative to project root").option("--dry-run", "Preview result without writing config").option("--pm-model <model>", "Optional: model for project-manager (advanced override)").option("--strategic-models <a,b,c>", "Optional: models for architect/product-manager/prompt-engineer").option("--dev-models <a,b,c>", "Optional: models for fullstack-dev/fullstack-dev-2/frontend-dev").option("--qc-models <a,b,c>", "Optional: models for qc trio").option("--other-models <a,b,c>", "Optional: models for remaining roles").action(async (options) => {
-  await runInit4(options);
+program2.command("init").description("Interactive/non-interactive setup for target agent bootstrap").option("-y, --yes", "Non-interactive mode").option("--target <target>", "Install target", "opencode").option("--scope <scope>", "Config scope: global|project (default: project)").option("--output <path>", "Config file path override, relative to project root").option("--dry-run", "Preview result without writing config").option("--no-fallbacks", "Skip installing the dsh-llm-fallbacks plugin (dsh target only)").option("--pm-model <model>", "Optional: model for project-manager (advanced override)").option("--strategic-models <a,b,c>", "Optional: models for architect/product-manager/prompt-engineer").option("--dev-models <a,b,c>", "Optional: models for fullstack-dev/fullstack-dev-2/frontend-dev").option("--qc-models <a,b,c>", "Optional: models for qc trio").option("--other-models <a,b,c>", "Optional: models for remaining roles").action(async (options) => {
+  await runInit5({ ...options, noFallbacks: options.fallbacks === false });
 });
 program2.command("doctor").description("Validate Morning Star setup for a target agent config").option("--target <target>", "Target agent for doctor checks", "opencode").option("--scope <scope>", "Config scope: global|project", "project").option("--output <path>", "Config file path override, relative to project root").action((options) => {
-  runDoctor4(options);
+  runDoctor5(options);
 });
 var pluginCommand = program2.command("plugin").description("Agent Plugins v1.0.0 portable package commands");
 pluginCommand.command("validate").description("Validate a plugin package against Agent Plugins v1.0.0").option("--root <path>", "Plugin root directory to validate (default: project root)").action((options) => {
@@ -8250,7 +8836,7 @@ pluginCommand.command("validate").description("Validate a plugin package against
 });
 var pathCommand = program2.command("path").description("harness/specs dir resolution checks (engine-backed)");
 pathCommand.command("resolve").description("Resolve {HARNESS_DIR} + {SPECS_DIR} from a start dir (exit 1 when no harness dir resolves)").argument("[path]", "Start dir to resolve from (default: cwd)").option("--json", "Machine-readable JSON output (ok, harnessDir, specsDir, guidance on failure)").action((pathArg, options) => {
-  const startDir = pathArg ? path11.resolve(pathArg) : process.cwd();
+  const startDir = pathArg ? path12.resolve(pathArg) : process.cwd();
   const harnessDir = resolveHarnessDir(startDir);
   if (!harnessDir) {
     const guidance = "no harness dir found \u2014 the bounded probe (.mstar/, .agents/, .plans/, plans/) walked up from " + `${startDir} only within the workspace root (git top-level of the start dir; non-git start probes only itself) \u2014 run \`mstar init\` to bootstrap, or pass a start dir inside a harness-enabled project`;
@@ -8274,18 +8860,18 @@ pathCommand.command("resolve").description("Resolve {HARNESS_DIR} + {SPECS_DIR}
 var statusCommand = program2.command("status").description("status.json schema + residual lifecycle checks (engine-backed)");
 function resolveStatusFilePath(pathArg) {
   if (pathArg)
-    return path11.resolve(pathArg);
+    return path12.resolve(pathArg);
   const harnessDir = resolveHarnessDir();
   if (!harnessDir) {
     throw new Error(`harness dir not found from ${process.cwd()} \u2014 pass a status.json path or set MSTAR_HARNESS_DIR`);
   }
-  return path11.join(harnessDir, "status.json");
+  return path12.join(harnessDir, "status.json");
 }
 statusCommand.command("validate").description("Validate status.json (schema, severity enum, root-only residual_findings)").argument("[path]", "status.json path (default: {HARNESS_DIR}/status.json)").action((pathArg) => {
   let statusPath;
   try {
     statusPath = resolveStatusFilePath(pathArg);
-    if (!fs7.existsSync(statusPath)) {
+    if (!fs8.existsSync(statusPath)) {
       throw new Error(`status file not found: ${statusPath}`);
     }
     const gate2 = validateStatus(statusPath);
@@ -8295,10 +8881,10 @@ statusCommand.command("validate").description("Validate status.json (schema, sev
     }
     const count = gate2.violations.length;
     console.error(import_picocolors.default.red(`${statusPath}: FAIL (${count} violation${count === 1 ? "" : "s"})`));
-    for (const violation7 of gate2.violations) {
-      console.error(`  - [${violation7.severity}] ${violation7.code}: ${violation7.message}`);
-      if (violation7.fix)
-        console.error(`    fix: ${violation7.fix}`);
+    for (const violation12 of gate2.violations) {
+      console.error(`  - [${violation12.severity}] ${violation12.code}: ${violation12.message}`);
+      if (violation12.fix)
+        console.error(`    fix: ${violation12.fix}`);
     }
     process.exitCode = 1;
   } catch (error) {
@@ -8323,10 +8909,54 @@ statusCommand.command("archive-residuals").description("Archive a plan's open re
     process.exitCode = 1;
   }
 });
-var leaseCommand = program2.command("lease").description("execution_lease checks (engine-backed) \u2014 integration_merge_lease validation stays import-only via @mstar-harness/engine until a dedicated subcommand exists");
+statusCommand.command("tech-debt").description("Print the residual tech-debt rollup (total_open / by_severity / by_target / by_plan) and PASS/DRIFT vs stored " + "metadata.tech_debt_summary (exit 1 on DRIFT \u2014 refresh the stored summary to clear)").argument("[path]", "status.json path (default: {HARNESS_DIR}/status.json)").action((pathArg) => {
+  try {
+    const statusPath = resolveStatusFilePath(pathArg);
+    if (!fs8.existsSync(statusPath)) {
+      throw new Error(`status file not found: ${statusPath}`);
+    }
+    const rollup = techDebtRollup(statusPath);
+    console.log(`status tech-debt: ${statusPath}`);
+    console.log(`total_open: ${rollup.computed.total_open}`);
+    console.log(`by_severity: ${JSON.stringify(rollup.computed.by_severity)}`);
+    console.log(`by_target: ${JSON.stringify(rollup.computed.by_target)}`);
+    console.log(`by_plan: ${JSON.stringify(rollup.computed.by_plan)}`);
+    if (rollup.overall === "PASS") {
+      console.log(import_picocolors.default.green("tech_debt_summary: PASS (all 4 fields match stored)"));
+      return;
+    }
+    const drifts = rollup.checks.filter((check) => check.status === "DRIFT").map((check) => check.field);
+    const note = rollup.stored === null ? " (no stored metadata.tech_debt_summary)" : "";
+    console.error(import_picocolors.default.red(`tech_debt_summary: DRIFT (${drifts.length}/4 fields: ${drifts.join(", ")})${note}`));
+    process.exitCode = 1;
+  } catch (error) {
+    console.error(import_picocolors.default.red(`status tech-debt failed: ${error.message}`));
+    process.exitCode = 1;
+  }
+});
+statusCommand.command("findings-cleanup").description("Enforce a plan's findings-cleanup mode on its open residuals (zero-residual via Assignment/metadata, else " + "allow-residual; exit 1 on violations)").argument("<plan-id>", "Plan id whose open residuals are checked against the cleanup mode").option("--harness <path>", "Harness dir override (default: resolved {HARNESS_DIR})").action((planId, options) => {
+  try {
+    const statusPath = options.harness ? path12.join(path12.resolve(options.harness), "status.json") : resolveStatusFilePath();
+    if (!fs8.existsSync(statusPath)) {
+      throw new Error(`status file not found: ${statusPath}`);
+    }
+    const doc = readJson2(statusPath);
+    const gate2 = findingsCleanupGate(doc, planId);
+    if (gate2.ok) {
+      console.log(import_picocolors.default.green(`findings-cleanup ${planId}: OK`));
+      return;
+    }
+    printChecklist(`findings-cleanup ${planId}`, gate2);
+    process.exitCode = 1;
+  } catch (error) {
+    console.error(import_picocolors.default.red(`status findings-cleanup failed: ${error.message}`));
+    process.exitCode = 1;
+  }
+});
+var leaseCommand = program2.command("lease").description("execution_lease / integration_merge_lease checks (engine-backed)");
 function resolveLeaseHarnessDir(harnessArg) {
   if (harnessArg)
-    return path11.resolve(harnessArg);
+    return path12.resolve(harnessArg);
   const harnessDir = resolveHarnessDir();
   if (!harnessDir) {
     throw new Error(`harness dir not found from ${process.cwd()} \u2014 pass --harness or set MSTAR_HARNESS_DIR`);
@@ -8336,8 +8966,8 @@ function resolveLeaseHarnessDir(harnessArg) {
 leaseCommand.command("verify").description("Verify a plan's execution_lease (missing/invalid/non-SSOT location \u2192 exit 1 with violations)").argument("<plan-id>", "Plan id whose execution_lease is verified").option("--harness <path>", "Harness dir override (default: resolved {HARNESS_DIR})").action((planId, options) => {
   try {
     const harnessDir = resolveLeaseHarnessDir(options.harness);
-    const statusPath = path11.join(harnessDir, "status.json");
-    if (!fs7.existsSync(statusPath)) {
+    const statusPath = path12.join(harnessDir, "status.json");
+    if (!fs8.existsSync(statusPath)) {
       throw new Error(`status file not found: ${statusPath}`);
     }
     const doc = readJson2(statusPath);
@@ -8363,10 +8993,10 @@ leaseCommand.command("verify").description("Verify a plan's execution_lease (mis
     }
     const count = result.violations.length;
     console.error(import_picocolors.default.red(`${statusPath}: FAIL plan ${planId} (${count} violation${count === 1 ? "" : "s"})`));
-    for (const violation7 of result.violations) {
-      console.error(`  - [${violation7.severity}] ${violation7.code}: ${violation7.message}`);
-      if (violation7.fix)
-        console.error(`    fix: ${violation7.fix}`);
+    for (const violation12 of result.violations) {
+      console.error(`  - [${violation12.severity}] ${violation12.code}: ${violation12.message}`);
+      if (violation12.fix)
+        console.error(`    fix: ${violation12.fix}`);
     }
     process.exitCode = 1;
   } catch (error) {
@@ -8374,6 +9004,32 @@ leaseCommand.command("verify").description("Verify a plan's execution_lease (mis
     process.exitCode = 1;
   }
 });
+leaseCommand.command("verify-integration").description("Verify the root metadata.integration_merge_lease when present (absent/unclaimed \u2192 OK; invalid lease \u2192 exit 1)").option("--harness <path>", "Harness dir override (default: resolved {HARNESS_DIR})").action((options) => {
+  try {
+    const harnessDir = resolveLeaseHarnessDir(options.harness);
+    const statusPath = path12.join(harnessDir, "status.json");
+    if (!fs8.existsSync(statusPath)) {
+      throw new Error(`status file not found: ${statusPath}`);
+    }
+    const doc = readJson2(statusPath);
+    const metadata = doc.metadata ?? {};
+    if (metadata.integration_merge_lease === undefined) {
+      console.log(import_picocolors.default.green(`${statusPath}: OK \u2014 no integration_merge_lease (unclaimed)`));
+      return;
+    }
+    const gate2 = validateIntegrationMergeLease(metadata.integration_merge_lease);
+    if (gate2.ok) {
+      const lease = metadata.integration_merge_lease;
+      console.log(import_picocolors.default.green(`${statusPath}: OK \u2014 integration_merge_lease valid (holder ${String(lease.holder ?? "")})`));
+      return;
+    }
+    printChecklist("lease verify-integration", gate2);
+    process.exitCode = 1;
+  } catch (error) {
+    console.error(import_picocolors.default.red(`lease verify-integration failed: ${error.message}`));
+    process.exitCode = 1;
+  }
+});
 function failScript(error, context) {
   if (error instanceof SddScriptError) {
     console.error(import_picocolors.default.red(`${context} failed: ${error.message}`));
@@ -8426,19 +9082,19 @@ function printChecklist(label, gate2) {
   }
   const count = gate2.violations.length;
   console.error(import_picocolors.default.red(`${label}: FAIL (${count} violation${count === 1 ? "" : "s"})`));
-  for (const violation7 of gate2.violations) {
-    console.error(`  - [${violation7.severity}] ${violation7.code}: ${violation7.message}`);
-    if (violation7.fix)
-      console.error(`    fix: ${violation7.fix}`);
+  for (const violation12 of gate2.violations) {
+    console.error(`  - [${violation12.severity}] ${violation12.code}: ${violation12.message}`);
+    if (violation12.fix)
+      console.error(`    fix: ${violation12.fix}`);
   }
 }
 iterationCommand.command("gate").description("Evaluate the phase-transition gate: prints the transition (phase-2-execute / phase-3-close / phase-4-pr-delivery) " + "plus the \xA73.1 entry and \xA73.5 exit checklists. Exit 1 when the gate verdict fails \u2014 during the Phase-3 window " + "(transition: phase-3-close) exit 1 is EXPECTED until the \xA73.4 close items (status: completed + end_date) are " + "written: the exit checklist gates Phase 4, not the Phase-3 entry (qc2 F-003)").requiredOption("--status <path>", "status.json path").requiredOption("--compass <path>", "delivery-compass.md path").option("--branch <branch>", "Current branch probe (exit \xA73.5 item 5)").option("--integration <branch>", "Spec integration branch probe (exit \xA73.5 item 5)").option("--target <branch>", "PR base branch probe (exit \xA73.5 item 6)").action((options) => {
   try {
-    const statusPath = path11.resolve(options.status);
-    const compassPath = path11.resolve(options.compass);
-    if (!fs7.existsSync(statusPath))
+    const statusPath = path12.resolve(options.status);
+    const compassPath = path12.resolve(options.compass);
+    if (!fs8.existsSync(statusPath))
       throw new Error(`status file not found: ${statusPath}`);
-    if (!fs7.existsSync(compassPath))
+    if (!fs8.existsSync(compassPath))
       throw new Error(`compass file not found: ${compassPath}`);
     const result = evaluatePhaseGate(readJson2(statusPath), parseCompassFrontmatter(compassPath), {
       currentBranch: options.branch,
@@ -8463,10 +9119,10 @@ iterationCommand.command("push-cadence").description("\xA75.1a push-cadence prob
   }
   const count = result.violations.length;
   console.error(import_picocolors.default.red(`push blocked (${count} violation${count === 1 ? "" : "s"})`));
-  for (const violation7 of result.violations) {
-    console.error(`  - [${violation7.severity}] ${violation7.code}: ${violation7.message}`);
-    if (violation7.fix)
-      console.error(`    fix: ${violation7.fix}`);
+  for (const violation12 of result.violations) {
+    console.error(`  - [${violation12.severity}] ${violation12.code}: ${violation12.message}`);
+    if (violation12.fix)
+      console.error(`    fix: ${violation12.fix}`);
   }
   process.exitCode = 1;
 });
@@ -8476,11 +9132,11 @@ dispatchCommand.command("validate").description("Validate an Assignment markdown
     if (!assignmentFile) {
       throw new SddScriptError("usage: dispatch validate <assignment-file> [--branch <branch>]", 2);
     }
-    const file = path11.resolve(assignmentFile);
-    if (!fs7.existsSync(file)) {
+    const file = resolveCliPath(assignmentFile);
+    if (!fs8.existsSync(file)) {
       throw new Error(`assignment file not found: ${file}`);
     }
-    const text = fs7.readFileSync(file, "utf8");
+    const text = fs8.readFileSync(file, "utf8");
     const readOnly = isReadOnlyAssignmentRole(parseAssignmentFields(text).executeAs ?? "");
     const violations = [...validateAssignmentFields(text, { writable: readOnly ? false : undefined }).violations];
     if (!readOnly) {
@@ -8535,8 +9191,8 @@ worktreeCommand.command("check").description("L1: verify the plan's execution_le
     if (!plan) {
       throw new SddScriptError("usage: worktree check <plan-id> [--status <path>] [--control <path>] (or --plan <plan-id>)", 2);
     }
-    const statusPath = options.status ? path11.resolve(options.status) : resolveStatusFilePath();
-    if (!fs7.existsSync(statusPath)) {
+    const statusPath = options.status ? path12.resolve(options.status) : resolveStatusFilePath();
+    if (!fs8.existsSync(statusPath)) {
       throw new Error(`status file not found: ${statusPath}`);
     }
     const doc = readJson2(statusPath);
@@ -8558,7 +9214,7 @@ worktreeCommand.command("check").description("L1: verify the plan's execution_le
     const lease = row.execution_lease ?? {};
     const metadata = doc.metadata ?? {};
     const input = {
-      controlWorktreePath: options.control ? path11.resolve(options.control) : String(metadata.control_worktree_path ?? ""),
+      controlWorktreePath: options.control ? path12.resolve(options.control) : String(metadata.control_worktree_path ?? ""),
       leaseWorktreePath: String(lease.worktree_path ?? ""),
       leaseWorkingBranch: String(lease.working_branch ?? ""),
       planId: plan
@@ -8571,6 +9227,61 @@ worktreeCommand.command("check").description("L1: verify the plan's execution_le
     failScript(error, "worktree check");
   }
 });
+function parseAssignmentHeaderField(assignmentText, label) {
+  const escaped = label.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const boldRe = new RegExp(`^[ \\t]*(?:[-*][ \\t]+)?\\*\\*\\s*${escaped}\\s*\\*\\*\\s*:\\s*(.*)$`);
+  const plainRe = new RegExp(`^[ \\t]*(?:[-*][ \\t]+)?${escaped}\\s*:\\s*(.*)$`);
+  for (const line of assignmentText.split(/\r?\n/)) {
+    const match = line.match(boldRe) ?? line.match(plainRe);
+    if (match)
+      return match[1].trim();
+  }
+  return "";
+}
+var QC_ALIGNMENT_FIELDS2 = [
+  { key: "planId", label: "plan_id" },
+  { key: "reviewRange", label: "Review range" },
+  { key: "diffBasis", label: "Diff basis" }
+];
+worktreeCommand.command("qc-alignment").description("Assert the QC/QA alignment fields (plan_id / Review range / Diff basis) are byte-identical across the given " + "Assignment files (separate or combined `Review range / Diff basis` labels; exit 1 on mismatch or missing field, 2 on usage)").argument("[assignment-files...]", "QC tri + QA Assignment markdown files (at least one required)").action((files) => {
+  try {
+    if (files.length === 0) {
+      throw new SddScriptError("usage: worktree qc-alignment <assignment-file>...", 2);
+    }
+    const assignments = [];
+    for (const fileArg of files) {
+      const file = path12.resolve(fileArg);
+      if (!fs8.existsSync(file)) {
+        throw new Error(`assignment file not found: ${file}`);
+      }
+      const text = fs8.readFileSync(file, "utf8");
+      const combinedRange = parseAssignmentHeaderField(text, "Review range / Diff basis");
+      const planId = parseAssignmentHeaderField(text, "plan_id");
+      const reviewRange = parseAssignmentHeaderField(text, "Review range") || combinedRange;
+      const diffBasis = parseAssignmentHeaderField(text, "Diff basis") || combinedRange;
+      const values = { planId, reviewRange, diffBasis };
+      const missing = QC_ALIGNMENT_FIELDS2.filter((field) => values[field.key] === "");
+      if (missing.length > 0) {
+        console.error(import_picocolors.default.red(`worktree qc-alignment: FAIL ${file}`));
+        for (const field of missing) {
+          console.error(`  - [high] qc.alignment.field.missing: missing "${field.label}" header field`);
+        }
+        process.exitCode = 1;
+        return;
+      }
+      assignments.push({ planId, reviewRange, diffBasis });
+    }
+    const gate2 = assertQcAlignment(assignments);
+    if (gate2.ok) {
+      console.log(import_picocolors.default.green(`worktree qc-alignment: OK (${assignments.length} assignment${assignments.length === 1 ? "" : "s"}, ` + `${QC_ALIGNMENT_FIELDS2.length} fields byte-identical)`));
+      return;
+    }
+    printChecklist("worktree qc-alignment", gate2);
+    process.exitCode = 1;
+  } catch (error) {
+    failScript(error, "worktree qc-alignment");
+  }
+});
 var reviewCommand = program2.command("review").description("QC seat-mapping checks (engine-backed)");
 function parseAssignmentExecutionMode(assignmentText) {
   for (const line of assignmentText.split(/\r?\n/)) {
@@ -8585,11 +9296,11 @@ reviewCommand.command("seats").description("Map an Assignment's execution mode t
     if (!assignmentFile) {
       throw new SddScriptError("usage: review seats <assignment-file> [--mode sdd|inline|targeted] [--reviewers <role1,role2,...>]", 2);
     }
-    const file = path11.resolve(assignmentFile);
-    if (!fs7.existsSync(file)) {
+    const file = path12.resolve(assignmentFile);
+    if (!fs8.existsSync(file)) {
       throw new Error(`assignment file not found: ${file}`);
     }
-    const text = fs7.readFileSync(file, "utf8");
+    const text = fs8.readFileSync(file, "utf8");
     const mode = options.mode ?? parseAssignmentExecutionMode(text);
     const reviewers = (options.reviewers ?? "").split(",").map((role) => role.trim()).filter((role) => role !== "");
     const result = executionModeToN(mode, { seats: reviewers });
@@ -8646,31 +9357,31 @@ var LINT_CODE_EXTENSIONS = {
   ".swift": true
 };
 function lintTargetType(filePath) {
-  const base = path11.basename(filePath);
+  const base = path12.basename(filePath);
   if (base === "STRATEGY.md")
     return "strategy";
   if (base === "SKILL.md")
     return "skill";
   if (/^task-\d+-report\.md$/i.test(base))
     return "report";
-  const dir = path11.dirname(filePath);
-  if (dir.includes(`${path11.sep}plans${path11.sep}`) || dir.endsWith(`${path11.sep}plans`))
+  const dir = path12.dirname(filePath);
+  if (dir.includes(`${path12.sep}plans${path12.sep}`) || dir.endsWith(`${path12.sep}plans`))
     return "plan";
   if (/^\d{8}-[a-z0-9.-]+\.md$/i.test(base))
     return "plan";
-  if (LINT_CODE_EXTENSIONS[path11.extname(base).toLowerCase()] === true)
+  if (LINT_CODE_EXTENSIONS[path12.extname(base).toLowerCase()] === true)
     return "code";
   return null;
 }
 function collectLintTargets(dir) {
   const targets = [];
   const walk = (current) => {
-    for (const entry of fs7.readdirSync(current, { withFileTypes: true })) {
+    for (const entry of fs8.readdirSync(current, { withFileTypes: true })) {
       if (entry.isDirectory()) {
         if (LINT_SKIP_DIRS[entry.name] !== true)
-          walk(path11.join(current, entry.name));
-      } else if (entry.isFile() && lintTargetType(path11.join(current, entry.name)) !== null) {
-        targets.push(path11.join(current, entry.name));
+          walk(path12.join(current, entry.name));
+      } else if (entry.isFile() && lintTargetType(path12.join(current, entry.name)) !== null) {
+        targets.push(path12.join(current, entry.name));
       }
     }
   };
@@ -8678,8 +9389,8 @@ function collectLintTargets(dir) {
   return targets;
 }
 function lintOneFile(filePath) {
-  const abs = path11.resolve(filePath);
-  const text = fs7.readFileSync(abs, "utf8");
+  const abs = path12.resolve(filePath);
+  const text = fs8.readFileSync(abs, "utf8");
   const violations = [];
   const markers = [];
   switch (lintTargetType(abs)) {
@@ -8708,7 +9419,7 @@ function lintOneFile(filePath) {
       break;
     }
     default:
-      throw new SddScriptError(`usage: lint <target> \u2014 unsupported file type "${path11.basename(abs)}" (lintable: plan files, SKILL.md, STRATEGY.md, task-N-report.md, code files)`, 2);
+      throw new SddScriptError(`usage: lint <target> \u2014 unsupported file type "${path12.basename(abs)}" (lintable: plan files, SKILL.md, STRATEGY.md, task-N-report.md, code files)`, 2);
   }
   return { violations, markers };
 }
@@ -8717,10 +9428,10 @@ lintCommand.description("Lint <target> (file or dir) \u2014 exit 1 on violations
   try {
     if (!target)
       throw new SddScriptError("usage: lint <target> (file or dir)", 2);
-    const abs = path11.resolve(target);
-    if (!fs7.existsSync(abs))
+    const abs = resolveCliPath(target);
+    if (!fs8.existsSync(abs))
       throw new Error(`lint target not found: ${abs}`);
-    const targets = fs7.statSync(abs).isDirectory() ? collectLintTargets(abs) : [abs];
+    const targets = fs8.statSync(abs).isDirectory() ? collectLintTargets(abs) : [abs];
     if (targets.length === 0) {
       console.log(import_picocolors.default.yellow(`lint: no lintable files under ${target}`));
       return;
@@ -8747,10 +9458,10 @@ lintCommand.description("Lint <target> (file or dir) \u2014 exit 1 on violations
       violations += result.violations.length;
       const count = result.violations.length;
       console.error(import_picocolors.default.red(`${label}: FAIL (${count} violation${count === 1 ? "" : "s"})`));
-      for (const violation7 of result.violations) {
-        console.error(`  - [${violation7.severity}] ${violation7.code}: ${violation7.message}`);
-        if (violation7.fix)
-          console.error(`    fix: ${violation7.fix}`);
+      for (const violation12 of result.violations) {
+        console.error(`  - [${violation12.severity}] ${violation12.code}: ${violation12.message}`);
+        if (violation12.fix)
+          console.error(`    fix: ${violation12.fix}`);
       }
     }
     if (violations > 0)
@@ -8759,34 +9470,23 @@ lintCommand.description("Lint <target> (file or dir) \u2014 exit 1 on violations
     failScript(error, "lint");
   }
 });
-function stripFrontmatter(text) {
-  const lines = text.replace(/^\uFEFF/, "").split(/\r?\n/);
-  if (lines.length === 0 || lines[0].trim() !== "---")
-    return text;
-  for (let i = 1;i < lines.length; i++) {
-    if (lines[i].trim() === "---")
-      return lines.slice(i + 1).join(`
-`);
-  }
-  return text;
-}
 var designMdCommand = program2.command("design-md").description("DESIGN.md token frontmatter / light-dark parity / completeness checks (engine-backed)");
 designMdCommand.command("validate").description("Validate DESIGN.md in <dir>: token frontmatter, light/dark parity when DESIGN.dark.md exists, " + "and the completeness level (exit 1 on violations, 2 on usage)").argument("[dir]", "Directory containing DESIGN.md").action((dir) => {
   try {
     if (!dir)
       throw new SddScriptError("usage: design-md validate <dir>", 2);
-    const abs = path11.resolve(dir);
-    const lightPath = path11.join(abs, "DESIGN.md");
-    if (!fs7.existsSync(lightPath))
+    const abs = resolveCliPath(dir);
+    const lightPath = path12.join(abs, "DESIGN.md");
+    if (!fs8.existsSync(lightPath))
       throw new Error(`design file not found: ${lightPath}`);
-    const light = fs7.readFileSync(lightPath, "utf8");
+    const light = fs8.readFileSync(lightPath, "utf8");
     const violations = [];
     const tokens = validateDesignTokenFrontmatter(light);
     printChecklist("design-md validate (tokens)", tokens);
     violations.push(...tokens.violations);
-    const darkPath = path11.join(abs, "DESIGN.dark.md");
-    if (fs7.existsSync(darkPath)) {
-      const parity = assertLightDarkParity(light, fs7.readFileSync(darkPath, "utf8"));
+    const darkPath = path12.join(abs, "DESIGN.dark.md");
+    if (fs8.existsSync(darkPath)) {
+      const parity = assertLightDarkParity(light, fs8.readFileSync(darkPath, "utf8"));
       printChecklist("design-md validate (light/dark parity)", parity);
       violations.push(...parity.violations);
     }
@@ -8861,7 +9561,7 @@ function resolveAuditShortSha(cwd, override) {
   if (override !== undefined && override !== "")
     return override;
   try {
-    const out = execFileSync7("git", ["rev-parse", "--short", "HEAD"], {
+    const out = execFileSync8("git", ["rev-parse", "--short", "HEAD"], {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -8875,8 +9575,8 @@ auditCommand.command("scaffold").description("Scaffold an audit-<date>/ plan dir
   try {
     if (!findingsFile)
       throw new SddScriptError("usage: audit scaffold <findings-file> [--dir <out-dir>]", 2);
-    const abs = path11.resolve(findingsFile);
-    if (!fs7.existsSync(abs))
+    const abs = resolveCliPath(findingsFile);
+    if (!fs8.existsSync(abs))
       throw new Error(`findings file not found: ${abs}`);
     if (options.date !== undefined && !/^\d{4}-\d{2}-\d{2}$/.test(options.date)) {
       throw new SddScriptError("usage: audit scaffold \u2014 --date must be YYYY-MM-DD", 2);
@@ -8885,8 +9585,8 @@ auditCommand.command("scaffold").description("Scaffold an audit-<date>/ plan dir
       throw new SddScriptError("usage: audit scaffold \u2014 --sha must be a 7-40 char hex commit SHA", 2);
     }
     const date = options.date ?? new Date().toISOString().slice(0, 10);
-    const outDir = options.dir !== undefined ? path11.resolve(options.dir) : path11.resolve(`audit-${date}`);
-    const findings = parseAuditFindings(fs7.readFileSync(abs, "utf8"));
+    const outDir = options.dir !== undefined ? resolveCliPath(options.dir) : resolveCliPath(`audit-${date}`);
+    const findings = parseAuditFindings(fs8.readFileSync(abs, "utf8"));
     const sha = resolveAuditShortSha(process.cwd(), options.sha);
     const result = scaffoldAuditPlan(outDir, findings, { date, repoName: options.repo, repoShortSha: sha });
     const count = result.files.length;
@@ -8902,16 +9602,16 @@ compoundCommand.command("validate").description("Validate a knowledge doc frontm
   try {
     if (!docPath)
       throw new SddScriptError("usage: compound validate <doc-path> [--knowledge-dir <dir>]", 2);
-    const abs = path11.resolve(docPath);
-    if (!fs7.existsSync(abs))
+    const abs = resolveCliPath(docPath);
+    if (!fs8.existsSync(abs))
       throw new Error(`knowledge doc not found: ${abs}`);
-    const text = fs7.readFileSync(abs, "utf8");
+    const text = fs8.readFileSync(abs, "utf8");
     const violations = [];
     const schema = validateSchemaYaml(text);
     printChecklist("compound validate (schema)", schema);
     violations.push(...schema.violations);
     if (options.knowledgeDir !== undefined) {
-      const knowledgeDir = path11.resolve(options.knowledgeDir);
+      const knowledgeDir = resolveCliPath(options.knowledgeDir);
       const index = assertIndexRows(knowledgeDir);
       printChecklist("compound validate (index rows)", index);
       violations.push(...index.violations);
@@ -8947,6 +9647,8 @@ var HOST_SIGNALS = [
   "tool_search"
 ];
 var HOST_SIGNAL_LOOKUP = lookupTable(HOST_SIGNALS);
+var HOST_IDS = ["opencode", "omp", "pi", "dsh", "cursor", "codex", "kimi", "zcode"];
+var HOST_ID_LOOKUP = lookupTable(HOST_IDS);
 var hostCommand = program2.command("host").description("host detection from session tool shapes (engine-backed)");
 hostCommand.command("detect").description("Detect the active host from --signals (comma-separated tool-shape tokens): prints the host id or " + "'ambiguous' (exit 2 on usage)").option("--signals <list>", "Comma-separated tool-shape signals (e.g. question,ask,hub)").action((options) => {
   try {
@@ -8970,22 +9672,47 @@ hostCommand.command("detect").description("Detect the active host from --signals
     failScript(error, "host detect");
   }
 });
+hostCommand.command("skill-root").description("Resolve the loaded skill root for a host (mstar-host \xA7 Resolve loaded skill root): prints the canonical " + "skill-root string for --host / --skill (exit 1 on missing required options, 2 on usage errors)").requiredOption("--host <id>", "Host id (opencode | omp | pi | dsh | cursor | codex | kimi | zcode)").requiredOption("--skill <name>", "Skill name to resolve").option("--rel <path>", "Optional skill-relative path suffix").action((options) => {
+  try {
+    if (HOST_ID_LOOKUP[options.host] !== true) {
+      throw new SddScriptError(`usage: host skill-root \u2014 unknown host "${options.host}" (valid: ${HOST_IDS.join(", ")})`, 2);
+    }
+    if (options.skill.trim() === "") {
+      throw new SddScriptError("usage: host skill-root \u2014 --skill must be a non-empty skill name", 2);
+    }
+    const root = resolveSkillRoot(options.host, { skill: options.skill, rel: options.rel });
+    if (options.host === "pi") {
+      console.log(import_picocolors.default.yellow(root));
+    } else {
+      console.log(import_picocolors.default.green(root));
+    }
+  } catch (error) {
+    failScript(error, "host skill-root");
+  }
+});
 var skillCommand = program2.command("skill").description("skill-authoring lints (engine-backed)");
 skillCommand.command("lint").description("Lint <skill-dir>/SKILL.md: frontmatter contract (name lowercase-hyphen, description trigger contract) " + "+ the five-question body + ephemeral-citation scan (task-<digits>-* artifacts and .mstar/sdd/\u2026 deeplinks \u2014 " + "exit 1 on violations, 2 on usage)").argument("[skill-dir]", "Skill directory containing SKILL.md").action((skillDir) => {
   try {
     if (!skillDir)
       throw new SddScriptError("usage: skill lint <skill-dir>", 2);
-    const skillFile = path11.join(path11.resolve(skillDir), "SKILL.md");
-    if (!fs7.existsSync(skillFile))
+    const skillFile = path12.join(resolveCliPath(skillDir), "SKILL.md");
+    if (!fs8.existsSync(skillFile))
       throw new Error(`SKILL.md not found: ${skillFile}`);
-    const text = fs7.readFileSync(skillFile, "utf8");
+    const text = fs8.readFileSync(skillFile, "utf8");
     const violations = [];
     const frontmatter = lintSkillFrontmatter(text);
     printChecklist("skill lint (frontmatter)", frontmatter);
     violations.push(...frontmatter.violations);
-    const fiveQuestion = lintFiveQuestion(stripFrontmatter(text));
-    printChecklist("skill lint (five questions)", fiveQuestion);
-    violations.push(...fiveQuestion.violations);
+    const skillBase = path12.basename(path12.dirname(skillFile));
+    const isCore = skillBase === "mstar-harness-core";
+    const fiveQuestionMode = skillBase.startsWith("mstar-") && !isCore && skillBase !== "mstar-skill-authoring" ? "runtime" : "authoring";
+    if (isCore) {
+      console.log(import_picocolors.default.yellow("skill lint (five questions): EXEMPT \u2014 mstar-harness-core is exempt by design (hub headings)"));
+    } else {
+      const fiveQuestion = lintFiveQuestion(stripFrontmatter(text), fiveQuestionMode);
+      printChecklist("skill lint (five questions)", fiveQuestion);
+      violations.push(...fiveQuestion.violations);
+    }
     const ephemeral = findEphemeralCitations(text);
     const ephemeralGate = {
       ok: ephemeral.length === 0,
@@ -9005,6 +9732,40 @@ skillCommand.command("lint").description("Lint <skill-dir>/SKILL.md: frontmatter
     failScript(error, "skill lint");
   }
 });
+var rolesCommand = program2.command("roles").description("mstar-roles mapping / load-order checks (engine-backed)");
+rolesCommand.command("validate").description("Validate the mstar-roles skill-dir state: role mapping / parameter tables against the on-disk " + "references layout plus load-order declarations across sibling mstar-* skills " + "(exit 1 on violations)").option("--roles-dir <dir>", "mstar-roles skill directory (default: skills/mstar-roles, resolved against the project root)").option("--skills-dir <dir>", "Skills root scanned for sibling mstar-* skills (default: parent of the roles dir)").action((options) => {
+  try {
+    const rolesDir = resolveCliPath(options.rolesDir ?? "skills/mstar-roles");
+    const skillsRoot = options.skillsDir ? resolveCliPath(options.skillsDir) : path12.dirname(rolesDir);
+    const violations = [];
+    const mapping = validateRoleMapping(rolesDir);
+    printChecklist("roles validate (mapping)", mapping);
+    violations.push(...mapping.violations);
+    const skillTexts = {};
+    for (const entry of fs8.readdirSync(skillsRoot, { withFileTypes: true })) {
+      if (!entry.isDirectory() || !entry.name.startsWith("mstar-"))
+        continue;
+      const skillFile = path12.join(skillsRoot, entry.name, "SKILL.md");
+      if (!fs8.existsSync(skillFile))
+        continue;
+      try {
+        skillTexts[entry.name] = fs8.readFileSync(skillFile, "utf8");
+      } catch {}
+    }
+    const loadOrder = lintLoadOrder(skillTexts);
+    printChecklist("roles validate (load order)", loadOrder);
+    violations.push(...loadOrder.violations);
+    const total = violations.length;
+    const siblingCount = Object.keys(skillTexts).length;
+    const loadOrderChecked = Object.keys(skillTexts).filter((name) => name !== "mstar-harness-core").length;
+    const coreExempt = loadOrderChecked !== siblingCount;
+    console.log(`roles validate: ${total === 0 ? "OK" : "FAIL"} (${total} violation${total === 1 ? "" : "s"}, ` + `${siblingCount} sibling skill${siblingCount === 1 ? "" : "s"} scanned; ` + `load-order over ${loadOrderChecked}${coreExempt ? ", core exempt" : ""})`);
+    if (total > 0)
+      process.exitCode = 1;
+  } catch (error) {
+    failScript(error, "roles validate");
+  }
+});
 program2.parseAsync(process.argv).catch((error) => {
   console.error(import_picocolors.default.red(`Setup failed: ${error.message}`));
   process.exitCode = 1;