@mstar-harness/dsh 3.6.3 → 3.7.1

package/dist/index.js

@@ -1122,8 +1122,8 @@ var require_lib2 = __commonJS(function(exports, module) {
 });
 
 // src/index.ts
-import { existsSync as existsSync21, readFileSync as readFileSync18, readdirSync as readdirSync14 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync18, readdirSync as readdirSync14 } from "node:fs";
+import { join as join24 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import {
   apply as applySkillLocal,
@@ -1147,15 +1147,15 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync as readdirSync3, realpathSync } from "node:fs";
 import { dirname as dirname4, join as join7, resolve as resolve5, sep } from "node:path";
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync7 } from "node:fs";
-import { isAbsolute as isAbsolute5, resolve as resolve8 } from "node:path";
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { mkdirSync as mkdirSync6, readdirSync as readdirSync6, readFileSync as readFileSync7, realpathSync as realpathSync3, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { basename as basename4, dirname as dirname6, isAbsolute as isAbsolute6, join as join10, resolve as resolve9 } from "node:path";
-import { existsSync as existsSync9, readdirSync as readdirSync9, readFileSync as readFileSync10 } from "node:fs";
-import { basename as basename6, isAbsolute as isAbsolute8, join as join13, relative as relative4, resolve as resolve12, sep as sep4 } from "node:path";
-import { existsSync as existsSync10 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync7, realpathSync as realpathSync3 } from "node:fs";
+import { isAbsolute as isAbsolute5, join as join10, resolve as resolve8 } from "node:path";
+import { execFileSync as execFileSync3, spawn } from "node:child_process";
+import { mkdirSync as mkdirSync6, readdirSync as readdirSync6, readFileSync as readFileSync7, realpathSync as realpathSync4, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { basename as basename4, dirname as dirname6, isAbsolute as isAbsolute6, join as join11, relative as relative3, resolve as resolve9 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync9, readFileSync as readFileSync10 } from "node:fs";
+import { basename as basename7, isAbsolute as isAbsolute8, join as join15, relative as relative6, resolve as resolve13, sep as sep4 } from "node:path";
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join16 } from "node:path";
 var SEVERITY_ORDER = ["critical", "high", "medium", "low", "nit"];
 function applyEnforcement(gate, opts) {
   return { ...gate, hardBlocked: opts.hard && gate.violations.length > 0 };
@@ -2467,6 +2467,25 @@ function assertSafePathComponent(value, what) {
     throw new Error(`${what} must be a single safe path component ([A-Za-z0-9._-]+; not "", ".", "..", or containing "/" or "\\") — got ${JSON.stringify(value)}`);
   }
 }
+function canonicalizeNearestExisting(path) {
+  const abs = resolve7(path);
+  let dir = abs;
+  const tail = [];
+  for (;; ) {
+    if (existsSync6(dir)) {
+      try {
+        return join9(realpathSync2(dir), ...tail);
+      } catch {
+        return abs;
+      }
+    }
+    const parent = dirname5(dir);
+    if (parent === dir)
+      return abs;
+    tail.unshift(basename3(dir));
+    dir = parent;
+  }
+}
 function resolveSddDir(harnessDir, planId) {
   assertSafePathComponent(planId, "planId");
   const base = resolve7(harnessDir);
@@ -2564,6 +2583,28 @@ function probeBranch(worktreePath, opts) {
     return { error: detail };
   }
 }
+function probeCheckout(worktreePath, opts) {
+  const timeout = opts.timeoutMs ?? probeTimeoutMs();
+  try {
+    const stdout = execFileSync2(opts.gitPath ?? "git", ["-C", worktreePath, "rev-parse", "--git-dir"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout
+    });
+    const raw = stdout.trim();
+    if (raw === "")
+      return { error: `no git dir reported at "${worktreePath}"` };
+    const abs = isAbsolute5(raw) ? raw : join10(worktreePath, raw);
+    return { gitDir: realpathSync3(abs) };
+  } catch (err) {
+    const e = err;
+    if (e.killed === true || e.signal !== undefined) {
+      return { error: `git probe timed out after ${timeout}ms (killed by ${e.signal ?? "SIGTERM"})` };
+    }
+    const detail = (e.stderr !== undefined ? e.stderr.toString().trim() : "") || e.message || "git probe failed";
+    return { error: detail };
+  }
+}
 function l1PreDispatchCheck(input, opts = {}) {
   const violations = [];
   const { controlWorktreePath, leaseWorktreePath, leaseWorkingBranch, planId } = input;
@@ -2576,8 +2617,20 @@ function l1PreDispatchCheck(input, opts = {}) {
   if (leaseWorkingBranch.trim() === "") {
     violations.push(violation7("high", "worktree.l1.lease-branch-missing", `execution_lease.working_branch is empty for plan "${planId}"`, "record the lease working_branch before dispatch"));
   }
-  if (controlWorktreePath !== "" && leaseWorktreePath !== "" && resolve8(controlWorktreePath) === resolve8(leaseWorktreePath)) {
-    violations.push(violation7("critical", "worktree.l1.lease-equals-control", `execution_lease.worktree_path "${leaseWorktreePath}" equals metadata.control_worktree_path — the feature worktree MUST differ from the control worktree (L1 isolation; product edits never land in the control checkout)`, "use a distinct feature worktree for the plan (git worktree add <path> <branch>) and update the lease"));
+  if (controlWorktreePath !== "" && leaseWorktreePath !== "") {
+    if (resolve8(controlWorktreePath) === resolve8(leaseWorktreePath)) {
+      violations.push(violation7("critical", "worktree.l1.lease-equals-control", `execution_lease.worktree_path "${leaseWorktreePath}" equals metadata.control_worktree_path — the feature worktree MUST differ from the control worktree (L1 isolation; product edits never land in the control checkout)`, "use a distinct feature worktree for the plan (git worktree add <path> <branch>) and update the lease"));
+    } else if (existsSync7(leaseWorktreePath)) {
+      const controlProbe = probeCheckout(controlWorktreePath, opts);
+      const leaseProbe = probeCheckout(leaseWorktreePath, opts);
+      if ("error" in controlProbe) {
+        violations.push(violation7("high", "worktree.l1.checkout-probe-failed", `cannot establish the lease worktree "${leaseWorktreePath}" is a distinct Git checkout from the control worktree "${controlWorktreePath}" for plan "${planId}": ${controlProbe.error}`, "verify the control worktree path is a git checkout (integration-branch checkout)"));
+      } else if ("error" in leaseProbe) {
+        violations.push(violation7("high", "worktree.l1.checkout-probe-failed", `cannot establish the lease worktree "${leaseWorktreePath}" is a distinct Git checkout from the control worktree "${controlWorktreePath}" for plan "${planId}": ${leaseProbe.error}`, "verify the lease worktree path is a git checkout (git worktree add <path> <branch>)"));
+      } else if (controlProbe.gitDir === leaseProbe.gitDir) {
+        violations.push(violation7("critical", "worktree.l1.lease-equals-control", `execution_lease.worktree_path "${leaseWorktreePath}" is the same Git checkout as metadata.control_worktree_path "${controlWorktreePath}" — a plain subdirectory or symlink alias of the control checkout is not isolation; the feature worktree MUST be a distinct checkout`, "use a distinct feature worktree for the plan (git worktree add <path> <branch>) and update the lease"));
+      }
+    }
   }
   if (leaseWorktreePath !== "" && !existsSync7(leaseWorktreePath)) {
     violations.push(violation7("high", "worktree.l1.feature-missing", `feature worktree directory "${leaseWorktreePath}" does not exist for plan "${planId}"`, `create it before dispatch: git worktree add ${leaseWorktreePath} <working-branch>`));
@@ -2626,6 +2679,16 @@ function l2PreDispatchCheck(input, opts = {}) {
   });
   return gate(violations);
 }
+function assertBranchAlignment(worktreePath, expectedBranch, opts = {}) {
+  const violations = [];
+  const probe = probeBranch(worktreePath, opts);
+  if ("error" in probe) {
+    violations.push(violation7("high", "worktree.branch-probe-failed", `cannot probe branch at "${worktreePath}": ${probe.error}`, "verify the path is a git worktree checkout on the expected branch (not detached)"));
+  } else if (probe.branch !== expectedBranch) {
+    violations.push(violation7("high", "worktree.branch-mismatch", `worktree "${worktreePath}" is on branch "${probe.branch}", expected "${expectedBranch}" (Assignment Working branch)`, `checkout ${expectedBranch} in that worktree`));
+  }
+  return gate(violations);
+}
 class SddScriptError extends Error {
   exitCode;
   constructor(message, exitCode) {
@@ -2662,14 +2725,14 @@ function gitOut(cwd, args) {
   }
 }
 function probeHarnessWithStatus(root) {
-  if (isFile2(join10(root, ".mstar", "status.json")))
-    return join10(root, ".mstar");
-  if (isFile2(join10(root, ".agents", "status.json")))
-    return join10(root, ".agents");
-  if (hasWorkflowSnapshot(join10(root, ".mstar")))
-    return join10(root, ".mstar");
-  if (hasWorkflowSnapshot(join10(root, ".agents")))
-    return join10(root, ".agents");
+  if (isFile2(join11(root, ".mstar", "status.json")))
+    return join11(root, ".mstar");
+  if (isFile2(join11(root, ".agents", "status.json")))
+    return join11(root, ".agents");
+  if (hasWorkflowSnapshot(join11(root, ".mstar")))
+    return join11(root, ".mstar");
+  if (hasWorkflowSnapshot(join11(root, ".agents")))
+    return join11(root, ".agents");
   return null;
 }
 function hasWorkflowSnapshot(harnessDir) {
@@ -2677,13 +2740,13 @@ function hasWorkflowSnapshot(harnessDir) {
   try {
     workflowsDir = resolveWorkflowDir(harnessDir, { harnessDir });
   } catch {
-    workflowsDir = join10(harnessDir, "workflows");
+    workflowsDir = join11(harnessDir, "workflows");
   }
   if (!isDirectory2(workflowsDir))
     return false;
   try {
     for (const entry of readdirSync6(workflowsDir, { withFileTypes: true })) {
-      if (entry.isDirectory() && isFile2(join10(workflowsDir, entry.name, "snapshot.json")))
+      if (entry.isDirectory() && isFile2(join11(workflowsDir, entry.name, "snapshot.json")))
         return true;
     }
   } catch {
@@ -2696,14 +2759,14 @@ function isLinkedWorktree(root) {
   const commonRaw = gitOut(root, ["rev-parse", "--git-common-dir"]);
   if (gitDirRaw === null || commonRaw === null)
     return false;
-  const gitDir = isAbsolute6(gitDirRaw) ? gitDirRaw : join10(root, gitDirRaw);
-  const common = isAbsolute6(commonRaw) ? commonRaw : join10(root, commonRaw);
+  const gitDir = isAbsolute6(gitDirRaw) ? gitDirRaw : join11(root, gitDirRaw);
+  const common = isAbsolute6(commonRaw) ? commonRaw : join11(root, commonRaw);
   if (gitDir.includes("/.git/worktrees/") || gitDir.includes("/worktrees/"))
     return true;
   try {
-    const gdParent = realpathSync3(dirname6(gitDir));
-    const cmAbs = realpathSync3(common);
-    return join10(gdParent, basename4(gitDir)) !== cmAbs && gitDir !== cmAbs;
+    const gdParent = realpathSync4(dirname6(gitDir));
+    const cmAbs = realpathSync4(common);
+    return join11(gdParent, basename4(gitDir)) !== cmAbs && gitDir !== cmAbs;
   } catch {
     return false;
   }
@@ -2720,10 +2783,10 @@ function sddWorkspace(planId, opts = {}) {
     if (!isDirectory2(controlRoot)) {
       throw new SddScriptError(`mstar sdd workspace: CONTROL_ROOT / MSTAR_CONTROL_ROOT is not a directory: ${controlRoot}`, 1);
     }
-    root = realpathSync3(controlRoot);
+    root = realpathSync4(controlRoot);
   } else {
     const topLevel = gitOut(cwd, ["rev-parse", "--show-toplevel"]);
-    root = realpathSync3(topLevel ?? cwd);
+    root = realpathSync4(topLevel ?? cwd);
   }
   if (!controlRoot && isLinkedWorktree(root)) {
     throw new SddScriptError(`mstar sdd workspace: linked worktree at ${root} has no {HARNESS_DIR}/status.json (default gitignore).
@@ -2744,25 +2807,35 @@ function sddWorkspace(planId, opts = {}) {
       const probed = probeHarnessWithStatus(root);
       if (probed) {
         harnessDir = probed;
-      } else if (isDirectory2(join10(root, ".mstar"))) {
-        harnessDir = join10(root, ".mstar");
-      } else if (isDirectory2(join10(root, ".agents"))) {
-        harnessDir = join10(root, ".agents");
+      } else if (isDirectory2(join11(root, ".mstar"))) {
+        harnessDir = join11(root, ".mstar");
+      } else if (isDirectory2(join11(root, ".agents"))) {
+        harnessDir = join11(root, ".agents");
       } else {
-        harnessDir = join10(root, ".mstar");
+        harnessDir = join11(root, ".mstar");
       }
     }
   }
   const sddDir = resolveSddDir(harnessDir, planId);
   mkdirSync6(sddDir, { recursive: true });
-  writeFileSync4(join10(sddDir, ".gitignore"), `*
+  writeFileSync4(join11(sddDir, ".gitignore"), `*
 `);
-  return realpathSync3(sddDir);
+  return realpathSync4(sddDir);
 }
 function taskBrief(planFile, taskN, outFile, opts = {}) {
   if (!planFile || !Number.isInteger(taskN) || taskN < 1) {
     throw new SddScriptError("usage: mstar sdd task-brief PLAN_FILE TASK_NUMBER [OUTFILE]", 2);
   }
+  const bound = opts.context;
+  const observedCwd = opts.cwd ?? process.cwd();
+  if (bound) {
+    const inputPlan = canonicalizeNearestExisting(resolve9(observedCwd, planFile));
+    if (inputPlan !== canonicalizeNearestExisting(bound.planFile)) {
+      throwGateFail([
+        contextViolation("high", "sdd.context.plan-file-mismatch", `plan file "${planFile}" does not match the bound context plan file "${bound.planFile}" — ` + "bound mode extracts only the resolved context's plan; refused before any read or write")
+      ]);
+    }
+  }
   let content;
   try {
     content = readFileSync7(planFile, "utf8");
@@ -2770,15 +2843,26 @@ function taskBrief(planFile, taskN, outFile, opts = {}) {
     throw new SddScriptError(`no such plan file: ${planFile}`, 2);
   }
   let out;
+  let mkdirAfterGate = null;
   if (outFile) {
-    out = outFile;
+    out = bound ? resolve9(observedCwd, outFile) : outFile;
+  } else if (bound) {
+    out = join11(bound.sddDir, `task-${taskN}-brief.md`);
+    mkdirAfterGate = bound.sddDir;
   } else {
     const sddDir = opts.sddDir ?? process.env.SDD_DIR;
     if (!sddDir) {
       throw new SddScriptError("mstar sdd task-brief: set SDD_DIR or pass OUTFILE (run mstar sdd workspace PLAN_ID first)", 2);
     }
     mkdirSync6(sddDir, { recursive: true });
-    out = join10(sddDir, `task-${taskN}-brief.md`);
+    out = join11(sddDir, `task-${taskN}-brief.md`);
+  }
+  if (bound) {
+    const gate2 = checkSddAction(bound, { kind: "artifact", cwd: observedCwd, target: out });
+    if (!gate2.ok)
+      throwGateFail(gate2.violations);
+    if (mkdirAfterGate !== null)
+      mkdirSync6(mkdirAfterGate, { recursive: true });
   }
   const records = content.endsWith(`
 `) ? content.split(`
@@ -2804,7 +2888,98 @@ function taskBrief(planFile, taskN, outFile, opts = {}) {
   if (printed.length === 0) {
     throw new SddScriptError(`task ${taskN} not found in ${planFile} (no heading matching Task ${taskN})`, 3);
   }
-  return out;
+  return bound ? resolve9(observedCwd, out) : out;
+}
+function isInside(child, ancestor) {
+  const rel = relative3(ancestor, child);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute6(rel);
+}
+function canonicalDir(path) {
+  try {
+    return statSync4(path).isDirectory() ? realpathSync4(path) : null;
+  } catch {
+    return null;
+  }
+}
+function contextViolation(severity, code, message, fix) {
+  return { ok: false, severity, code, message, fix };
+}
+function throwGateFail(violations) {
+  const detail = violations.map((v) => `${v.code}: ${v.message}${v.fix ? ` (fix: ${v.fix})` : ""}`).join(`
+  `);
+  throw new SddScriptError(`SDD execution context rejected:
+  ${detail}`, 1);
+}
+function checkSddAction(context, action) {
+  const violations = [];
+  const add = (code, message, fix) => {
+    violations.push(contextViolation("high", code, message, fix));
+  };
+  if (action.kind !== "source" && action.kind !== "artifact" && action.kind !== "launch") {
+    add("sdd.context.kind-unknown", `unknown action kind ${JSON.stringify(action.kind)} — expected "source" | "artifact" | "launch"`);
+    return { ok: false, violations };
+  }
+  if (typeof action.cwd !== "string" || action.cwd.trim() === "") {
+    add("sdd.context.cwd-missing", "action.cwd (the observed invocation cwd) is required — never an Assignment echo");
+    return { ok: false, violations };
+  }
+  const featureReal = canonicalDir(context.featureCwd);
+  const canonicalSddDir = canonicalizeNearestExisting(context.sddDir);
+  const canonicalPlanFile = canonicalizeNearestExisting(context.planFile);
+  const cwdResolved = resolve9(action.cwd);
+  const checkTarget = (baseDir, target, kind) => {
+    if (featureReal === null)
+      return;
+    const targetAbs = resolve9(baseDir, target);
+    const canonical = canonicalizeNearestExisting(targetAbs);
+    if (!isInside(canonical, featureReal)) {
+      const declaredPrefix = targetAbs === featureReal || targetAbs.startsWith(`${featureReal}/`);
+      if (declaredPrefix) {
+        add("sdd.context.target-symlink-escape", `${kind} target "${target}" canonicalizes to "${canonical}", outside the feature worktree — symlink escape refused before mutation`);
+      } else {
+        add(`sdd.context.${kind}-target-outside-feature`, `${kind} target "${target}" resolves to "${targetAbs}", outside the feature worktree "${featureReal}" — refused before mutation`);
+      }
+    }
+  };
+  if (action.kind === "source") {
+    const cwdReal = canonicalDir(cwdResolved);
+    if (cwdReal === null) {
+      add("sdd.context.cwd-missing", `observed source cwd "${action.cwd}" does not exist or is not a directory`);
+      return { ok: false, violations };
+    }
+    if (featureReal === null || !isInside(cwdReal, featureReal)) {
+      add("sdd.context.source-cwd-outside-feature", `observed source cwd "${cwdReal}" is outside the feature worktree "${context.featureCwd}" — a declared-correct context does not make a wrong-checkout write safe (A3)`, `run the source action from inside ${context.featureCwd}`);
+      return { ok: false, violations };
+    }
+    if (action.target !== undefined)
+      checkTarget(cwdReal, action.target, "source");
+  } else if (action.kind === "artifact") {
+    if (typeof action.target !== "string" || action.target.trim() === "") {
+      add("sdd.context.target-missing", "artifact checks require the destination target");
+      return { ok: false, violations };
+    }
+    const targetAbs = resolve9(cwdResolved, action.target);
+    const canonical = canonicalizeNearestExisting(targetAbs);
+    if (!isInside(canonical, canonicalSddDir) && canonical !== canonicalPlanFile) {
+      const rawSddDir = resolve9(context.sddDir);
+      const declaredPrefix = targetAbs === rawSddDir || targetAbs.startsWith(`${rawSddDir}/`) || targetAbs === canonicalSddDir || targetAbs.startsWith(`${canonicalSddDir}/`) || targetAbs === canonicalPlanFile;
+      if (declaredPrefix) {
+        add("sdd.context.artifact-symlink-escape", `artifact target "${targetAbs}" canonicalizes to "${canonical}", outside the plan's control sddDir — symlink escape refused before write`);
+      } else {
+        add("sdd.context.artifact-outside-plan", `artifact target "${targetAbs}" is outside the plan's control sddDir "${context.sddDir}" and is not the declared planFile "${context.planFile}" — legitimate control artifact edits stay inside the plan's artifacts; arbitrary control source edits are not allowed (A3)`);
+      }
+    }
+  } else {
+    if (featureReal === null) {
+      add("sdd.context.launch-cwd-missing", `feature worktree "${context.featureCwd}" does not exist or is not a directory — cannot bind the child's starting cwd`);
+    } else {
+      violations.push(...assertBranchAlignment(featureReal, context.workingBranch).violations);
+    }
+    if (action.target !== undefined && action.target.trim() !== "" && featureReal !== null) {
+      checkTarget(featureReal, action.target, "launch");
+    }
+  }
+  return { ok: violations.length === 0, violations };
 }
 function violation8(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
@@ -3547,7 +3722,7 @@ function referenceExists(repoRoot, docText) {
           break;
         if (entry.isDirectory()) {
           if (!WALK_SKIP_DIRS.has(entry.name))
-            stack.push(join13(dir, entry.name));
+            stack.push(join15(dir, entry.name));
         } else if (!entry.isSymbolicLink()) {
           const base = entry.name.replace(/\.(?:ts|tsx|js|jsx|mjs|cjs)$/, "");
           if (moduleNames.has(base))
@@ -3559,7 +3734,7 @@ function referenceExists(repoRoot, docText) {
   for (const { ref, isSymbol, module } of refs) {
     if (!isSymbol || module === undefined) {
       const candidate = ref.replace(LINE_SUFFIX_RE, "").replace(ANCHOR_RE, "");
-      if (existsSync9(resolve12(repoRoot, candidate))) {
+      if (existsSync10(resolve13(repoRoot, candidate))) {
         checked++;
       } else {
         violations.push(violation10("medium", "compound.reference.missing-file", `referenced path \`${ref}\` does not exist under ${repoRoot} (compound-refresh Phase 2: referenced code still exists?)`, "update the doc to reference an existing path, or delete the stale reference"));
@@ -3586,11 +3761,11 @@ function collectKnowledgeDocs(dir) {
     for (const entry of entries) {
       if (entry.isSymbolicLink())
         continue;
-      const full = join13(current, entry.name);
+      const full = join15(current, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
       } else if (entry.name.endsWith(".md") && entry.name !== "README.md" && entry.name !== "index.md") {
-        docs.push(relative4(dir, full).split(sep4).join("/"));
+        docs.push(relative6(dir, full).split(sep4).join("/"));
       }
     }
   }
@@ -3606,8 +3781,8 @@ function normalizeIndexRef(cell) {
 }
 function assertIndexRows(knowledgeDir) {
   const violations = [];
-  const readmePath = join13(knowledgeDir, "README.md");
-  if (!existsSync9(readmePath)) {
+  const readmePath = join15(knowledgeDir, "README.md");
+  if (!existsSync10(readmePath)) {
     violations.push(violation10("medium", "compound.index.missing-readme", `missing ${readmePath} — the knowledge index is required (mstar-compound Phase 6: every doc gets a README.md row)`, "create knowledge/README.md with a Document / Source Plan / Description / Status table"));
     return { ok: false, violations };
   }
@@ -3631,12 +3806,12 @@ function assertIndexRows(knowledgeDir) {
   return { ok: violations.length === 0, violations };
 }
 function isFileLikeRoot(root) {
-  return /^[^.]*\.[A-Za-z0-9]{1,10}$/.test(basename6(root));
+  return /^[^.]*\.[A-Za-z0-9]{1,10}$/.test(basename7(root));
 }
 function scopeGuard(path, allowedRoots) {
-  const resolved = resolve12(path);
+  const resolved = resolve13(path);
   for (const root of allowedRoots) {
-    const r = resolve12(root);
+    const r = resolve13(root);
     if (isFileLikeRoot(r)) {
       if (resolved === r)
         return { ok: true, violations: [] };
@@ -3794,8 +3969,8 @@ function validateRoleMapping(rolesDir, options = {}) {
   const violations = [];
   const referenceById = new Map(mapping.map((m) => [m.agentId, m.reference]));
   for (const { agentId, reference } of mapping) {
-    if (!existsSync10(join14(rolesDir, reference))) {
-      violations.push(violation12("medium", "roles.mapping.reference.missing", `role "${agentId}" maps to ${reference} which does not exist under ${rolesDir} (mstar-roles § Role Reference Mapping)`, `create ${join14(rolesDir, reference)} or fix the mapping row`));
+    if (!existsSync11(join16(rolesDir, reference))) {
+      violations.push(violation12("medium", "roles.mapping.reference.missing", `role "${agentId}" maps to ${reference} which does not exist under ${rolesDir} (mstar-roles § Role Reference Mapping)`, `create ${join16(rolesDir, reference)} or fix the mapping row`));
     }
   }
   for (const { family, memberIds } of families) {
@@ -3847,6 +4022,14 @@ function validateRoleMapping(rolesDir, options = {}) {
   return { ok: violations.length === 0, violations };
 }
 var LOAD_ORDER_HEADING_RE = /^#{1,6}\s+[^\r\n]*\b(?:load[\s-]*order|first\s+action)\b[^\r\n]*$/i;
+var HUB_BOOTSTRAP_ASSERTIONS = [
+  { marker: "identity-first", why: "identity boundary before any skill list" },
+  { marker: "skill presets", why: "Assignment Skill presets decision field" },
+  { marker: "none", why: "explicit none => identity only, no optional topic preset" },
+  { marker: "standard", why: "omitted on a substantive round => standard preset" },
+  { marker: "role-owned", why: "role-owned methods / evidence obligations load regardless of preset" },
+  { marker: "unknown preset", why: "unknown preset / missing identity => Needs Context / Blocked, never infer PM" }
+];
 function extractLoadOrderSection(text) {
   const lines = text.split(/\r?\n/);
   let start = -1;
@@ -3880,11 +4063,22 @@ function lintLoadOrder(skillTexts) {
       continue;
     const section = extractLoadOrderSection(text);
     if (section === null) {
-      violations.push(violation12("medium", "roles.loadorder.section.missing", `skill "${name}" has no Load Order / First action section — every mstar-* topic skill must declare its first read (mstar-harness-core § 加载约定; mstar-roles § Load Order (Required))`, `add a "## Load Order" section naming mstar-harness-core as the first read`));
+      violations.push(violation12("medium", "roles.loadorder.section.missing", `skill "${name}" has no Load Order / First action section — every mstar-* topic skill must declare its first read (mstar-harness-core § 加载契约; mstar-roles § Load Order = single load-selection authority)`, `add a "## Load Order" section: topics name mstar-harness-core first; mstar-roles declares the Skill presets decision matrix`));
+      continue;
+    }
+    if (name === "mstar-roles") {
+      const lower = section.toLowerCase();
+      const missing = HUB_BOOTSTRAP_ASSERTIONS.filter((a) => !lower.includes(a.marker.toLowerCase()));
+      if (missing.length > 0) {
+        violations.push(violation12("medium", "roles.loadorder.hub.bootstrap.missing", `skill "${name}" Load Order section is missing the hub bootstrap decision matrix: ${missing.map((m) => `"${m.marker}" (${m.why})`).join("; ")} (mstar-roles § Load Order = single load-selection authority)`, "declare identity-first, the Skill presets none/standard decision, role-owned methods, and the unknown-preset / missing-identity refusal in the Load Order section"));
+      }
+      if (!section.includes("mstar-harness-core")) {
+        violations.push(violation12("medium", "roles.loadorder.core.missing", `skill "${name}" Load Order section does not point at mstar-harness-core — the hub bootstrap is exempt from core-first, but core remains the lifecycle/authorization conflict authority and global entry whenever loaded`, "keep the conditional mstar-harness-core pointer (global entry / conflict authority) in the Load Order section"));
+      }
       continue;
     }
     if (!section.includes("mstar-harness-core")) {
-      violations.push(violation12("medium", "roles.loadorder.core.missing", `skill "${name}" Load Order section does not declare mstar-harness-core as its first dependency (mstar-harness-core § 加载约定: 凡 mstar-*（name ≠ mstar-harness-core）假定读者已 Read 本 skill)`, "name mstar-harness-core first in the Load Order section"));
+      violations.push(violation12("medium", "roles.loadorder.core.missing", `skill "${name}" Load Order section does not declare mstar-harness-core as its first dependency (mstar-harness-core § 加载契约: directly-invoked topics keep core as first dependency; the mstar-roles hub bootstrap is the only exception)`, "name mstar-harness-core first in the Load Order section"));
     }
   }
   return { ok: violations.length === 0, violations };
@@ -3920,6 +4114,17 @@ var FIVE_QUESTION_SECTIONS = [
   { key: "evidence", label: "Evidence", question: "what a correct result looks like (success criteria / evidence)" },
   { key: "references", label: "References", question: "additional resources to open when the main path is not enough" }
 ];
+function stripFrontmatter(text) {
+  const lines = text.replace(/^\uFEFF/, "").split(/\r?\n/);
+  if (lines.length === 0 || lines[0].trim() !== "---")
+    return text;
+  for (let i = 1;i < lines.length; i++) {
+    if (lines[i].trim() === "---")
+      return lines.slice(i + 1).join(`
+`);
+  }
+  return text;
+}
 var HEADING_RE = /^#{1,6}\s+[^\r\n]+$/;
 function collectHeadings(bodyText) {
   const headings = [];
@@ -3935,6 +4140,16 @@ function collectHeadings(bodyText) {
   }
   return headings;
 }
+function classifySkillLint(skillId) {
+  const id = skillId ?? "";
+  if (id === "mstar-harness-core")
+    return { kind: "core", mode: null };
+  if (id === "mstar-skill-authoring")
+    return { kind: "authoring", mode: "authoring" };
+  if (id.startsWith("mstar-"))
+    return { kind: "runtime", mode: "runtime" };
+  return { kind: "authoring", mode: "authoring" };
+}
 var RUNTIME_HEADING_ALIASES = {
   workflow: ["process", "playbook"],
   "decision-rules": [
@@ -4162,12 +4377,12 @@ function skillLocalConfig(config) {
 }
 
 // src/gates/catalog.ts
-import { existsSync as existsSync13, readFileSync as readFileSync8, readdirSync as readdirSync4 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync8, readdirSync as readdirSync4 } from "node:fs";
 import { join as join8 } from "node:path";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
 
 // src/gates/agent-flow.ts
-import { appendFileSync, closeSync, existsSync as existsSync11, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync5, readSync, renameSync as renameSync2, rmdirSync, statSync as statSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { appendFileSync, closeSync, existsSync as existsSync12, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync5, readSync, renameSync as renameSync2, rmdirSync, statSync as statSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join6 } from "node:path";
 
 // src/gates/dispatch.ts
@@ -4176,7 +4391,7 @@ import { basename as basename2, join as join5, resolve as resolve6 } from "node:
 
 // src/gates/workflow-selection.ts
 import { existsSync as existsSync5, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
-import { dirname as dirname7, join as join3, relative as relative3 } from "node:path";
+import { dirname as dirname7, join as join3, relative as relative4 } from "node:path";
 var TERMINAL_STATUS_CACHE_MAX = 64;
 var terminalStatusCache = new Map;
 function terminalStatusOf(snapshotPath) {
@@ -4298,7 +4513,7 @@ function resolveReadWorkflow(harnessDir) {
     if (verdict === undefined || !verdict.terminal)
       continue;
     if (best === undefined || verdict.mtimeMs > best.mtimeMs) {
-      best = { workflowId: entry.name, dir: join3(relative3(harnessDir, workflowsDir), entry.name), mtimeMs: verdict.mtimeMs };
+      best = { workflowId: entry.name, dir: join3(relative4(harnessDir, workflowsDir), entry.name), mtimeMs: verdict.mtimeMs };
     }
   }
   for (const cachedPath of terminalStatusCache.keys()) {
@@ -5315,7 +5530,7 @@ function ledgerContent(file, n) {
 }
 function readAgentFlow(workflowDir, limit) {
   const file = join6(workflowDir, AGENT_FLOW_FILE);
-  if (!existsSync11(file)) {
+  if (!existsSync12(file)) {
     return { events: [], summary: [] };
   }
   const n = limit === undefined ? AGENT_FLOW_DEFAULT_LIMIT : Math.max(0, Math.floor(limit));
@@ -5570,7 +5785,7 @@ function harnessStateSource(harnessDir) {
   if (harnessDir === null)
     return null;
   const statusPath = join8(harnessDir, STATUS_FILE);
-  if (!existsSync13(statusPath))
+  if (!existsSync14(statusPath))
     return null;
   try {
     const selection = resolveReadWorkflow(harnessDir);
@@ -5591,7 +5806,7 @@ function harnessStateSource(harnessDir) {
     }
     const snapshotPath = join8(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
     let snapshot;
-    if (!existsSync13(snapshotPath)) {
+    if (!existsSync14(snapshotPath)) {
       return selectionErrorState({
         kind: "error",
         code: "workflow.selection.snapshot-unreadable",
@@ -5683,7 +5898,7 @@ function selectionErrorState(selection, rollup, harnessDir, compass) {
 function projectRollupSource(harnessDir, residuals) {
   const milestones = [];
   const projectsDir = resolveProjectDir(harnessDir, { harnessDir });
-  if (existsSync13(projectsDir)) {
+  if (existsSync14(projectsDir)) {
     let entries;
     try {
       entries = readdirSync4(projectsDir, { withFileTypes: true });
@@ -5694,7 +5909,7 @@ function projectRollupSource(harnessDir, residuals) {
       if (!entry.isDirectory())
         continue;
       const roadmapPath = join8(projectsDir, entry.name, PROJECT_ROADMAP_FILE);
-      if (!existsSync13(roadmapPath))
+      if (!existsSync14(roadmapPath))
         continue;
       try {
         const doc = parseCompassFrontmatterText(readFileSync8(roadmapPath, "utf8"), roadmapPath);
@@ -5759,7 +5974,7 @@ function residualRollup(harnessDir) {
 }
 function projectRegisters(harnessDir) {
   const projectsDir = resolveProjectDir(harnessDir, { harnessDir });
-  if (!existsSync13(projectsDir))
+  if (!existsSync14(projectsDir))
     return [];
   let entries;
   try {
@@ -5772,7 +5987,7 @@ function projectRegisters(harnessDir) {
     if (!entry.isDirectory())
       continue;
     const registerPath = join8(projectsDir, entry.name, PROJECT_REGISTER_FILE);
-    if (!existsSync13(registerPath))
+    if (!existsSync14(registerPath))
       continue;
     try {
       registers.push({ projectId: entry.name, doc: readJson(registerPath) });
@@ -5784,7 +5999,7 @@ function projectRegisters(harnessDir) {
 }
 function knowledgeDigest(harnessDir) {
   const indexPath = join8(harnessDir, "knowledge", "README.md");
-  if (!existsSync13(indexPath))
+  if (!existsSync14(indexPath))
     return null;
   try {
     const categories = new Set;
@@ -5829,7 +6044,7 @@ function compassDirection(compassPath) {
 }
 function steeringCompassPath(harnessDir) {
   const iterationsDir = resolveIterationDir(harnessDir);
-  if (!existsSync13(iterationsDir))
+  if (!existsSync14(iterationsDir))
     return;
   let entries;
   try {
@@ -5841,7 +6056,7 @@ function steeringCompassPath(harnessDir) {
     if (!entry.isDirectory())
       continue;
     const compassPath = join8(iterationsDir, entry.name, "delivery-compass.md");
-    if (!existsSync13(compassPath))
+    if (!existsSync14(compassPath))
       continue;
     let content;
     try {
@@ -5860,7 +6075,7 @@ function iterationGateSource(harnessDir) {
   if (harnessDir === null)
     return;
   const statusPath = join8(harnessDir, STATUS_FILE);
-  if (!existsSync13(statusPath))
+  if (!existsSync14(statusPath))
     return;
   const compass = steeringCompassPath(harnessDir);
   if (compass === undefined)
@@ -5922,15 +6137,15 @@ function agentDigestKey(agent, cwd) {
 }
 
 // src/gates/status.ts
-import { existsSync as existsSync14, readdirSync as readdirSync7 } from "node:fs";
-import { basename as basename5, join as join11, relative as relative5, resolve as resolve10 } from "node:path";
+import { existsSync as existsSync15, readdirSync as readdirSync7 } from "node:fs";
+import { basename as basename5, join as join12, relative as relative7, resolve as resolve10 } from "node:path";
 var LOGGER_NAME = "mstar/status-gate";
 function harnessDocKindOfTarget(harnessDir, targetPath) {
   const resolved = resolve10(targetPath);
   const name = basename5(resolved);
   if (name !== STATUS_FILE && name !== WORKFLOW_SNAPSHOT_FILE && name !== PROJECT_REGISTER_FILE)
     return null;
-  const rel = relative5(harnessDir, resolved);
+  const rel = relative7(harnessDir, resolved);
   if (name === STATUS_FILE && rel === STATUS_FILE)
     return "status";
   let workflowDir;
@@ -5939,12 +6154,12 @@ function harnessDocKindOfTarget(harnessDir, targetPath) {
     workflowDir = resolveWorkflowDir(harnessDir, { harnessDir });
     projectDir = resolveProjectDir(harnessDir, { harnessDir });
   } catch {
-    workflowDir = join11(harnessDir, "workflows");
-    projectDir = join11(harnessDir, "projects");
+    workflowDir = join12(harnessDir, "workflows");
+    projectDir = join12(harnessDir, "projects");
   }
-  if (name === WORKFLOW_SNAPSHOT_FILE && /^[^/]+\/snapshot\.json$/.test(relative5(workflowDir, resolved)))
+  if (name === WORKFLOW_SNAPSHOT_FILE && /^[^/]+\/snapshot\.json$/.test(relative7(workflowDir, resolved)))
     return "snapshot";
-  if (name === PROJECT_REGISTER_FILE && /^[^/]+\/residuals\.json$/.test(relative5(projectDir, resolved)))
+  if (name === PROJECT_REGISTER_FILE && /^[^/]+\/residuals\.json$/.test(relative7(projectDir, resolved)))
     return "register";
   return null;
 }
@@ -6004,8 +6219,8 @@ function projectRegisterDocs(harnessDir) {
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const registerPath = join11(projectsDir, entry.name, PROJECT_REGISTER_FILE);
-    if (!existsSync14(registerPath))
+    const registerPath = join12(projectsDir, entry.name, PROJECT_REGISTER_FILE);
+    if (!existsSync15(registerPath))
       continue;
     try {
       registers.push({ projectId: entry.name, doc: readJson(registerPath) });
@@ -6078,8 +6293,8 @@ async function editIntentListener(ctx, resolver, config, adapter, target, actor,
 }
 
 // src/gates/skill-lint.ts
-import { existsSync as existsSync15, readFileSync as readFileSync11 } from "node:fs";
-import { basename as basename7, dirname as dirname9, resolve as resolve13, sep as sep2 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync11 } from "node:fs";
+import { basename as basename8, dirname as dirname9, resolve as resolve12, sep as sep2 } from "node:path";
 var SKILL_LINT_LOGGER = "mstar/skill-lint";
 
 class SkillLintVetoError extends Error {
@@ -6093,17 +6308,6 @@ ${violations.map(formatViolation).join(`
     this.violations = violations;
   }
 }
-function stripFrontmatter(text) {
-  const lines = text.replace(/^\uFEFF/, "").split(/\r?\n/);
-  if (lines.length === 0 || lines[0].trim() !== "---")
-    return text;
-  for (let i = 1;i < lines.length; i++) {
-    if (lines[i].trim() === "---")
-      return lines.slice(i + 1).join(`
-`);
-  }
-  return text;
-}
 var EPHEMERAL_CODES = {
   "task-artifact": "skill.ephemeral.task-artifact",
   "sdd-deeplink": "skill.ephemeral.sdd-deeplink"
@@ -6116,19 +6320,23 @@ function ephemeralViolation(citation) {
     message: `ephemeral citation \`${citation.match}\` on line ${citation.line} — durable skill text must reference in-repo artifacts only (knowledge conventions/skill-content-porting-discipline.md §3)`
   };
 }
-function lintSkillDoc(doc) {
+function lintSkillDoc(doc, options = {}) {
   const violations = [];
   const frontmatter = lintSkillFrontmatter(doc);
   if (!frontmatter.ok)
     violations.push(...frontmatter.violations);
-  const body = lintFiveQuestion(stripFrontmatter(doc));
-  if (!body.ok)
-    violations.push(...body.violations);
+  const profile = classifySkillLint(options.skillId);
+  if (profile.mode !== null) {
+    const body = lintFiveQuestion(stripFrontmatter(doc), profile.mode);
+    if (!body.ok)
+      violations.push(...body.violations);
+  }
   violations.push(...findEphemeralCitations(doc).map(ephemeralViolation));
   return violations.length === 0 ? { ok: true, violations } : { ok: false, violations };
 }
 function lintSkillWrite(doc, options) {
-  const result = lintSkillDoc(doc);
+  const skillId = basename8(dirname9(resolve12(options.target)));
+  const result = lintSkillDoc(doc, { skillId });
   if (options.hard && !result.ok) {
     throw new SkillLintVetoError(options.target, result.violations);
   }
@@ -6140,13 +6348,13 @@ function skillRootsOf(config) {
   return roots.map((root) => root.trim()).filter((root) => root !== "");
 }
 function isSkillTarget(roots, target) {
-  if (basename7(target.displayPath) !== "SKILL.md")
+  if (basename8(target.displayPath) !== "SKILL.md")
     return false;
-  const resolvedPath = resolve13(target.displayPath);
-  return roots.some((root) => resolvedPath.startsWith(resolve13(root) + sep2));
+  const resolvedPath = resolve12(target.displayPath);
+  return roots.some((root) => resolvedPath.startsWith(resolve12(root) + sep2));
 }
 function skillNameOf(target) {
-  return basename7(dirname9(target.displayPath));
+  return basename8(dirname9(target.displayPath));
 }
 function skillCanonicalForm(target) {
   return resolveSkillRoot("dsh", { skill: skillNameOf(target), rel: "SKILL.md" });
@@ -6158,8 +6366,8 @@ function gateSkillIntent(ctx, harnessDir, config, target) {
       return;
     if (!isSkillTarget(roots, target))
       return;
-    const skillPath = resolve13(target.displayPath);
-    if (!existsSync15(skillPath))
+    const skillPath = resolve12(target.displayPath);
+    if (!existsSync16(skillPath))
       return;
     let doc;
     try {
@@ -6176,7 +6384,7 @@ function gateSkillIntent(ctx, harnessDir, config, target) {
       });
       return;
     }
-    const result = lintSkillDoc(doc);
+    const result = lintSkillDoc(doc, { skillId: basename8(dirname9(skillPath)) });
     if (result.ok)
       return;
     const hard = resolveSeamHard(harnessDir, config);
@@ -6210,8 +6418,8 @@ async function skillWriteIntentListener(ctx, resolver, config, target, actor, ne
 }
 
 // src/gates/seams.ts
-import { existsSync as existsSync16, readFileSync as readFileSync13, readdirSync as readdirSync10 } from "node:fs";
-import { basename as basename8, dirname as dirname10, join as join15, resolve as resolve15, sep as sep3 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync13, readdirSync as readdirSync10 } from "node:fs";
+import { basename as basename10, dirname as dirname10, join as join14, resolve as resolve14, sep as sep3 } from "node:path";
 
 // ../engine/dist/audit.js
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
@@ -6410,7 +6618,7 @@ var SEAM_LOGGERS = {
   roles: "mstar/roles-lint"
 };
 function isIndexFile(path) {
-  const base = basename8(path);
+  const base = basename10(path);
   return base === "README.md" || base === "index.md";
 }
 function isMarkdownDoc(path) {
@@ -6419,7 +6627,7 @@ function isMarkdownDoc(path) {
 function isAuditPlanTarget(path) {
   if (!isMarkdownDoc(path))
     return false;
-  const segments = resolve15(path).split(sep3);
+  const segments = resolve14(path).split(sep3);
   for (let i = 0;i < segments.length; i++) {
     if (segments[i] !== "plans")
       continue;
@@ -6430,7 +6638,7 @@ function isAuditPlanTarget(path) {
   return false;
 }
 function isRolesTarget(path) {
-  const segments = resolve15(path).split(sep3);
+  const segments = resolve14(path).split(sep3);
   const idx = segments.indexOf("mstar-roles");
   if (idx === -1)
     return false;
@@ -6440,17 +6648,17 @@ function isRolesTarget(path) {
   return rest[0] === "SKILL.md" || rest[0] === "references" && rest[rest.length - 1].endsWith(".md");
 }
 function rolesDirOf(path) {
-  const segments = resolve15(path).split(sep3);
+  const segments = resolve14(path).split(sep3);
   const idx = segments.indexOf("mstar-roles");
   if (idx === -1)
     return dirname10(path);
-  return idx === 0 ? sep3 : join15(sep3, ...segments.slice(1, idx + 1));
+  return idx === 0 ? sep3 : join14(sep3, ...segments.slice(1, idx + 1));
 }
 function isSeamTarget(seam, harnessDir, target) {
-  const path = resolve15(target.displayPath);
+  const path = resolve14(target.displayPath);
   switch (seam) {
     case "design-md": {
-      const base = basename8(path);
+      const base = basename10(path);
       return base === "DESIGN.md" || base === "DESIGN.dark.md";
     }
     case "audit":
@@ -6458,7 +6666,7 @@ function isSeamTarget(seam, harnessDir, target) {
     case "compound": {
       if (harnessDir === null)
         return false;
-      return path.startsWith(resolve15(join15(harnessDir, "knowledge")) + sep3) && isMarkdownDoc(path);
+      return path.startsWith(resolve14(join14(harnessDir, "knowledge")) + sep3) && isMarkdownDoc(path);
     }
     case "roles":
       return isRolesTarget(path);
@@ -6475,9 +6683,9 @@ function auditSecretsViolations(findings, file) {
 }
 function validateDesignDoc(doc, path) {
   const violations = [...validateDesignTokenFrontmatter(doc).violations];
-  const isDark = basename8(path) === "DESIGN.dark.md";
-  const sibling = join15(dirname10(path), isDark ? "DESIGN.md" : "DESIGN.dark.md");
-  if (existsSync16(sibling)) {
+  const isDark = basename10(path) === "DESIGN.dark.md";
+  const sibling = join14(dirname10(path), isDark ? "DESIGN.md" : "DESIGN.dark.md");
+  if (existsSync17(sibling)) {
     const light = isDark ? readFileSync13(sibling, "utf8") : doc;
     const dark = isDark ? doc : readFileSync13(sibling, "utf8");
     violations.push(...assertLightDarkParity(light, dark).violations);
@@ -6503,8 +6711,8 @@ function validateRolesState(rolesDir, skillsRoot = dirname10(rolesDir)) {
   for (const entry of readdirSync10(skillsRoot, { withFileTypes: true })) {
     if (!entry.isDirectory() || !entry.name.startsWith("mstar-"))
       continue;
-    const skillFile = join15(skillsRoot, entry.name, "SKILL.md");
-    if (!existsSync16(skillFile))
+    const skillFile = join14(skillsRoot, entry.name, "SKILL.md");
+    if (!existsSync17(skillFile))
       continue;
     try {
       skillTexts[entry.name] = readFileSync13(skillFile, "utf8");
@@ -6537,8 +6745,8 @@ function gateSeamIntent(ctx, harnessDir, config, seam, target) {
   try {
     if (!isSeamTarget(seam, harnessDir, target))
       return;
-    const path = resolve15(target.displayPath);
-    if (!existsSync16(path))
+    const path = resolve14(target.displayPath);
+    if (!existsSync17(path))
       return;
     let doc;
     try {
@@ -6554,12 +6762,12 @@ function gateSeamIntent(ctx, harnessDir, config, seam, target) {
     const hard = resolveSeamHard(harnessDir, config);
     const verdict = applyEnforcement(result, { hard });
     if (verdict.hardBlocked) {
-      logger.error(`${basename8(path)} write to ${target.displayPath} ALLOWED as repair (Enforcement: hard; the current on-disk document is already invalid — the intent carries no incoming content, so the vetoable signal is only the pre-write state):
+      logger.error(`${basename10(path)} write to ${target.displayPath} ALLOWED as repair (Enforcement: hard; the current on-disk document is already invalid — the intent carries no incoming content, so the vetoable signal is only the pre-write state):
 ${verdict.violations.map(formatViolation).join(`
 `)}`);
       emitSeamAdvisory(ctx, seam, target.displayPath, verdict, hard, { repair: true });
     } else {
-      logger.warn(`${basename8(path)} write to ${target.displayPath} (advisory):
+      logger.warn(`${basename10(path)} write to ${target.displayPath} (advisory):
 ${verdict.violations.map(formatViolation).join(`
 `)}`);
       emitSeamAdvisory(ctx, seam, target.displayPath, verdict, hard);
@@ -6608,7 +6816,7 @@ function lintRolesWrite(doc, options) {
 }
 
 // src/gates/tools.ts
-import { existsSync as existsSync17, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync14 } from "node:fs";
 import { join as join17, resolve as resolve16 } from "node:path";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 var ITERATION_VIOLATION_SCHEMA = {
@@ -6774,9 +6982,9 @@ function registerSddIterationTools(ctx, resolver) {
       presentResult: (_args, _result) => ({ card: "generic", title: "Iteration gate evaluation" }),
       isConcurrencySafe: () => false,
       async execute(args) {
-        if (!existsSync17(args.snapshot_path))
+        if (!existsSync18(args.snapshot_path))
           throw new Error(`workflow snapshot not found: ${args.snapshot_path}`);
-        if (!existsSync17(args.compass_path))
+        if (!existsSync18(args.compass_path))
           throw new Error(`compass file not found: ${args.compass_path}`);
         const snapshotDoc = readJson(args.snapshot_path);
         const compassDoc = parseCompassFrontmatter(args.compass_path);
@@ -6831,7 +7039,7 @@ function registerSeamTools(ctx, resolver) {
       async execute(args) {
         const abs = resolve16(args.dir);
         const lightPath = join17(abs, "DESIGN.md");
-        if (!existsSync17(lightPath))
+        if (!existsSync18(lightPath))
           throw new Error(`design file not found: ${lightPath}`);
         const light = readFileSync14(lightPath, "utf8");
         const result = validateDesignDoc(light, lightPath);
@@ -6884,7 +7092,7 @@ function registerSeamTools(ctx, resolver) {
       isConcurrencySafe: () => false,
       async execute(args) {
         const abs = resolve16(args.plan_path);
-        if (!existsSync17(abs))
+        if (!existsSync18(abs))
           throw new Error(`plan file not found: ${abs}`);
         const text = readFileSync14(abs, "utf8");
         const result = validateAuditDoc(text, abs);
@@ -6924,7 +7132,7 @@ function registerSeamTools(ctx, resolver) {
       isConcurrencySafe: () => false,
       async execute(args, exec) {
         const abs = resolve16(args.doc_path);
-        if (!existsSync17(abs))
+        if (!existsSync18(abs))
           throw new Error(`knowledge doc not found: ${abs}`);
         const text = readFileSync14(abs, "utf8");
         const base = validateCompoundDoc(text, abs, args.repo_root !== undefined ? null : resolver.forAgent(exec.agent));
@@ -6969,7 +7177,7 @@ function registerSeamTools(ctx, resolver) {
       isConcurrencySafe: () => false,
       async execute(args) {
         const rolesDir = resolve16(args.roles_dir);
-        if (!existsSync17(join17(rolesDir, "SKILL.md")))
+        if (!existsSync18(join17(rolesDir, "SKILL.md")))
           throw new Error(`roles dir not found: ${rolesDir}`);
         const result = validateRolesState(rolesDir, args.skills_root !== undefined ? resolve16(args.skills_root) : undefined);
         return { ok: result.ok, violations: result.violations.map(iterationViolationView) };
@@ -6979,8 +7187,8 @@ function registerSeamTools(ctx, resolver) {
 }
 
 // src/gates/adapter.ts
-import { existsSync as existsSync18 } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync19 } from "node:fs";
+import { join as join19 } from "node:path";
 import { Service as Service2 } from "@deepseek-ai/cordis";
 var HOST_LOGGER = "mstar/host-adapter";
 function mergeLeasesMatch(left, right) {
@@ -7016,7 +7224,7 @@ class DshHostAdapter extends Service2 {
     this.logSink(level, msg);
   }
   statusGate(path, kind, harnessDir) {
-    if (!existsSync18(path))
+    if (!existsSync19(path))
       return { ok: true, violations: [] };
     return validateStatusDoc(path, kind, harnessDir);
   }
@@ -7071,7 +7279,7 @@ class DshHostAdapter extends Service2 {
     if (harnessDir !== null) {
       const selection = resolveActiveWorkflow(harnessDir);
       if (selection.kind === "active") {
-        const snapshotPath = join18(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
+        const snapshotPath = join19(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
         try {
           const snapshot = readJson(snapshotPath);
           const stored = snapshot?.integration_merge_lease;
@@ -7098,7 +7306,7 @@ class DshHostAdapter extends Service2 {
 
 // src/gates/agent-personas.ts
 import { readFileSync as readFileSync15, readdirSync as readdirSync12, statSync as statSync7 } from "node:fs";
-import { join as join19, resolve as resolve17, sep as sep5 } from "node:path";
+import { join as join20, resolve as resolve17, sep as sep5 } from "node:path";
 var ROLE_ID_PATTERN = /^[a-z0-9-]{1,32}$/;
 var defaultCache = new Map;
 function personaFor(roleId, lookup, warn) {
@@ -7126,7 +7334,7 @@ function subagentRoleIds(agentsDir) {
     const roleId = name.slice(0, -3);
     let content;
     try {
-      content = readFileSync15(join19(agentsDir, name), "utf8");
+      content = readFileSync15(join20(agentsDir, name), "utf8");
     } catch {
       continue;
     }
@@ -7237,6 +7445,8 @@ function unquote(value) {
 // src/gates/role-persona.ts
 var ROLE_PERSONA_LOGGER = "mstar/role-persona";
 var SUBAGENTS_SERVICE = "subagents";
+var PERSONA_SEAM_EVENT = "internal/get";
+var ROLE_PERSONA_WRAPPER_BRAND = Symbol("mstar.role-persona.wrapper");
 var rolePersonaLogSink = () => {};
 function setRolePersonaLogger(sink) {
   const prior = rolePersonaLogSink;
@@ -7254,7 +7464,7 @@ function setRolePersonaAgentsDir(dir) {
 var wrapperCache = new WeakMap;
 function registerRolePersonaChannel(ctx, config) {
   const rolePersonas = config.rolePersonas;
-  ctx.on("internal/get", (_readCtx, name, _error, next) => {
+  ctx.on(PERSONA_SEAM_EVENT, (_readCtx, name, _error, next) => {
     const value = next();
     if (name !== SUBAGENTS_SERVICE)
       return value;
@@ -7266,6 +7476,47 @@ function registerRolePersonaChannel(ctx, config) {
     }
   });
 }
+var SEAM_WARN = `role persona channel not installed — cordis '${PERSONA_SEAM_EVENT}' seam missing or unrecognized (rolePersonas will not be merged into subagent starts)`;
+function evaluateSeamProbe({ dispatched, readError, value }) {
+  if (!dispatched)
+    return { ok: false, reason: "seam-absent" };
+  if (readError !== undefined)
+    return { ok: true, reason: "service-absent" };
+  if (typeof value === "object" && value !== null && value[ROLE_PERSONA_WRAPPER_BRAND] === true) {
+    return { ok: true };
+  }
+  return { ok: false, reason: "wrap-skipped" };
+}
+function probeRolePersonaSeam(ctx) {
+  try {
+    let dispatched = false;
+    let readError;
+    let value;
+    const disposeCanary = ctx.on(PERSONA_SEAM_EVENT, (_readCtx, _name, _error, next) => {
+      dispatched = true;
+      return next();
+    });
+    try {
+      value = ctx.subagents;
+    } catch (error) {
+      readError = error;
+    } finally {
+      disposeCanary();
+    }
+    const result = evaluateSeamProbe({ dispatched, readError, value });
+    if (!result.ok) {
+      log2("warn", `${SEAM_WARN} (reason: ${result.reason})`);
+    } else if (result.reason === "service-absent") {
+      log2("debug", `role persona seam probe: 'subagents' unresolved at apply (the apply ctx does not resolve it — cordis resolves the service in dispatch scopes, where reads are intercepted per read)`);
+    }
+    return result;
+  } catch (error) {
+    try {
+      log2("debug", `role persona seam probe failed internally — fail-open (observation only): ${errorMessage2(error)}`);
+    } catch {}
+    return { ok: true };
+  }
+}
 function wrapSubagentsService(value, rolePersonas) {
   if (typeof value !== "object" || value === null)
     return value;
@@ -7276,6 +7527,7 @@ function wrapSubagentsService(value, rolePersonas) {
   if (cached !== undefined && cached.rolePersonas === rolePersonas)
     return cached.wrapper;
   const wrapper = Object.create(value);
+  Object.defineProperty(wrapper, ROLE_PERSONA_WRAPPER_BRAND, { value: true, enumerable: false });
   wrapper.start = (name, request) => {
     let merged = request;
     try {
@@ -7344,7 +7596,7 @@ function log2(level, message) {
 
 // src/gates/workflow-ledger.ts
 import { readFileSync as readFileSync16, renameSync as renameSync3, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 var WORKFLOW_LEDGER_LOGGER = "mstar/workflow-ledger";
 var TOOL_WORKFLOW_RUN_START = "tool-workflow/run-start";
 var TOOL_WORKFLOW_AGENT_START = "tool-workflow/agent-start";
@@ -7388,7 +7640,7 @@ function loadWatermark(workflowDir, fresh = false) {
     return cached;
   const watermark = new Map;
   try {
-    const raw = readFileSync16(join20(workflowDir, WORKFLOW_LEDGER_WATERMARK_FILE), "utf8");
+    const raw = readFileSync16(join21(workflowDir, WORKFLOW_LEDGER_WATERMARK_FILE), "utf8");
     const record = asRecord(JSON.parse(raw));
     const cursors = asRecord(record?.cursors);
     if (cursors !== undefined) {
@@ -7411,7 +7663,7 @@ function loadWatermark(workflowDir, fresh = false) {
 }
 function saveWatermark(workflowDir, watermark) {
   try {
-    const file = join20(workflowDir, WORKFLOW_LEDGER_WATERMARK_FILE);
+    const file = join21(workflowDir, WORKFLOW_LEDGER_WATERMARK_FILE);
     const tmp = `${file}.tmp`;
     writeFileSync5(tmp, JSON.stringify({ v: 1, cursors: Object.fromEntries(watermark) }));
     renameSync3(tmp, file);
@@ -7627,8 +7879,8 @@ function registerWorkflowLedger(ctx, resolver, workflowAskCache) {
 }
 
 // src/gates/goal-bridge.ts
-import { existsSync as existsSync19, readFileSync as readFileSync17, readdirSync as readdirSync13 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync20, readFileSync as readFileSync17, readdirSync as readdirSync13 } from "node:fs";
+import { join as join22 } from "node:path";
 var GOAL_BRIDGE_LOGGER = "mstar/goal-bridge";
 var DEFAULT_MAX_GOAL_ROUNDS = 256;
 var FLOW_SEQUENCE = "iteration-start → per-plan cycles → iteration-close → PR delivery → merge-ready";
@@ -7655,12 +7907,12 @@ function projectRegisterPointer(harnessDir) {
     for (const entry of readdirSync13(projectsDir, { withFileTypes: true })) {
       if (!entry.isDirectory())
         continue;
-      const registerPath = join21(projectsDir, entry.name, PROJECT_REGISTER_FILE);
-      if (existsSync19(registerPath))
+      const registerPath = join22(projectsDir, entry.name, PROJECT_REGISTER_FILE);
+      if (existsSync20(registerPath))
         return registerPath;
     }
   } catch {}
-  return join21(projectsDir, _DEFAULT_PROJECT, PROJECT_REGISTER_FILE);
+  return join22(projectsDir, _DEFAULT_PROJECT, PROJECT_REGISTER_FILE);
 }
 function isRootLikeAgent(agent) {
   const header = agent?.session?.header;
@@ -7671,7 +7923,7 @@ function iterationGoalObjective(iterationId) {
 }
 function steeringCompass(harnessDir) {
   const iterationsDir = resolveIterationDir(harnessDir);
-  if (!existsSync19(iterationsDir))
+  if (!existsSync20(iterationsDir))
     return;
   let entries;
   try {
@@ -7682,8 +7934,8 @@ function steeringCompass(harnessDir) {
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const compassPath = join21(iterationsDir, entry.name, "delivery-compass.md");
-    if (!existsSync19(compassPath))
+    const compassPath = join22(iterationsDir, entry.name, "delivery-compass.md");
+    if (!existsSync20(compassPath))
       continue;
     let content;
     try {
@@ -7863,8 +8115,8 @@ function registerGoalBridge(ctx, resolver, config) {
 }
 
 // src/gates/plan-mode-bridge.ts
-import { existsSync as existsSync20 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync21 } from "node:fs";
+import { join as join23 } from "node:path";
 var PLAN_MODE_BRIDGE_LOGGER = "mstar/plan-mode-bridge";
 var PLAN_STATUS_TODO = "Todo";
 var planModeBridgeLogSink = () => {};
@@ -7880,13 +8132,13 @@ function errorMessage5(error) {
   return error instanceof Error ? error.message : String(error);
 }
 function hasPrepareWindow(harnessDir) {
-  const statusPath = join22(harnessDir, STATUS_FILE);
-  if (!existsSync20(statusPath))
+  const statusPath = join23(harnessDir, STATUS_FILE);
+  if (!existsSync21(statusPath))
     return false;
   const selection = resolveReadWorkflow(harnessDir);
   if (selection.kind === "error")
     return false;
-  const snapshotPath = join22(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
+  const snapshotPath = join23(harnessDir, selection.dir, WORKFLOW_SNAPSHOT_FILE);
   let doc;
   try {
     doc = readJson(snapshotPath);
@@ -8057,6 +8309,10 @@ function setAdvisoryLogger(sink) {
   return prior;
 }
 var ADVISORY_ID_LIST_CAP = 20;
+var advisoryAbortWarned = false;
+function resetAdvisoryAbortWarn() {
+  advisoryAbortWarned = false;
+}
 function capIdList(items) {
   if (items.length <= ADVISORY_ID_LIST_CAP)
     return items.join(", ");
@@ -8065,11 +8321,11 @@ function capIdList(items) {
 async function runFallbacksAdvisory(ctx, agentsDir) {
   try {
     if (!fallbacksMounted(ctx))
-      return false;
+      return { ran: false, converged: false };
     const config = readRowConfig(ctx);
     if (config === undefined) {
       log6("debug", "fallbacks row config unreadable (absent or non-object) — adoption advisory skipped");
-      return true;
+      return { ran: true, converged: true };
     }
     const service = fallbacksService(ctx);
     if (service !== undefined) {
@@ -8077,8 +8333,11 @@ async function runFallbacksAdvisory(ctx, agentsDir) {
     }
     return runStructuralAdvisory(config, agentsDir);
   } catch (error) {
-    log6("warn", `fallbacks adoption advisory aborted (degraded — warn-only, deployment config untouched): ${errorMessage7(error)}`);
-    return true;
+    if (!advisoryAbortWarned) {
+      advisoryAbortWarned = true;
+      log6("warn", `fallbacks adoption advisory aborted (degraded — warn-only, deployment config untouched): ${errorMessage7(error)}`);
+    }
+    return { ran: true, converged: false };
   }
 }
 async function runSeedsAdvisory(service, config, agentsDir) {
@@ -8088,12 +8347,12 @@ async function runSeedsAdvisory(service, config, agentsDir) {
   }
   if (agentsDir === undefined) {
     log6("debug", "harness-agents mirror absent — fallbacks adoption taxonomy check skipped (config-only advisory)");
-    return true;
+    return { ran: true, converged: true };
   }
   const mstarIds = subagentRoleIds(agentsDir);
   if (mstarIds.length === 0) {
     log6("debug", "harness-agents mirror has no subagent-mode shells — fallbacks adoption taxonomy check skipped");
-    return true;
+    return { ran: true, converged: true };
   }
   const seedsLog = (_level, message) => log6("debug", message);
   const view = await declareMstarSeeds(service, { agentsDir, log: seedsLog });
@@ -8102,26 +8361,26 @@ async function runSeedsAdvisory(service, config, agentsDir) {
     readback = service.getEffectiveRoles();
   } catch (error) {
     log6("warn", `fallbacks effective-state readback failed — adoption state unavailable: ${errorMessage7(error)}`);
-    return true;
+    return { ran: true, converged: true };
   }
   reportEffectiveState(mstarIds, readback);
   reportDeclareOutcome(view);
-  return true;
+  return { ran: true, converged: true };
 }
 function runStructuralAdvisory(config, agentsDir) {
   if (agentsDir === undefined) {
     log6("debug", "harness-agents mirror absent — fallbacks adoption taxonomy check skipped (config-only advisory)");
-    return true;
+    return { ran: true, converged: true };
   }
   const mstarIds = subagentRoleIds(agentsDir);
   if (mstarIds.length === 0) {
     log6("debug", "harness-agents mirror has no subagent-mode shells — fallbacks adoption taxonomy check skipped");
-    return true;
+    return { ran: true, converged: true };
   }
   const list = readRolesList(config);
   if (list === undefined) {
     log6("debug", "fallbacks roles block not structurally readable (roles.list absent or non-array) — adoption advisory skipped");
-    return true;
+    return { ran: true, converged: true };
   }
   const declared = new Map;
   for (let index = 0;index < list.length; index++) {
@@ -8146,7 +8405,7 @@ function runStructuralAdvisory(config, agentsDir) {
   if (emptyPersona.length > 0) {
     log6("warn", `fallbacks roles.list declares roles with an empty persona: ${capIdList(emptyPersona)} — declare a persona (or remove the role)`);
   }
-  return true;
+  return { ran: true, converged: true };
 }
 function reportEffectiveState(mstarIds, readback) {
   const byId = new Map;
@@ -8363,14 +8622,22 @@ var inject = ["loader"];
 function packagedCommandsDir() {
   try {
     const dir = fileURLToPath3(new URL("../harness-commands", import.meta.url));
-    return existsSync21(dir) ? dir : undefined;
+    return existsSync22(dir) ? dir : undefined;
   } catch {
     return;
   }
 }
+var FRONTMATTER_FIELD_RE = /^[ \t]*:[ \t]*(.+)$/;
 function commandFrontmatterField(frontmatter, label) {
-  const match = new RegExp(`^${label}[ \\t]*:[ \\t]*(.+)$`, "m").exec(frontmatter);
-  return match?.[1]?.trim();
+  for (const line of frontmatter.split(`
+`)) {
+    if (!line.startsWith(label))
+      continue;
+    const match = FRONTMATTER_FIELD_RE.exec(line.slice(label.length));
+    if (match)
+      return match[1].trim();
+  }
+  return;
 }
 function unquote2(value) {
   return value.length >= 2 && value.startsWith('"') && value.endsWith('"') ? value.slice(1, -1) : value;
@@ -8411,7 +8678,7 @@ function registerMstarCommands(ctx) {
     for (const file of readdirSync14(dir).sort()) {
       if (!file.endsWith(".md"))
         continue;
-      const parsed = parseCommandMarkdown(readFileSync18(join23(dir, file), "utf8"));
+      const parsed = parseCommandMarkdown(readFileSync18(join24(dir, file), "utf8"));
       if (parsed === undefined)
         continue;
       commandsCtx.commands.register({
@@ -8477,6 +8744,7 @@ function apply(ctx, config) {
     else
       logger.warn(message);
   });
+  resetAdvisoryAbortWarn();
   let advisoryPassed = false;
   let advisoryPassInFlight = false;
   let advisoryGeneration = 0;
@@ -8485,8 +8753,8 @@ function apply(ctx, config) {
       return;
     advisoryPassInFlight = true;
     const generation = advisoryGeneration;
-    runFallbacksAdvisory(ctx, packagedAgentsDir()).then((ran) => {
-      if (ran && generation === advisoryGeneration)
+    runFallbacksAdvisory(ctx, packagedAgentsDir()).then((report) => {
+      if (report.ran && report.converged && generation === advisoryGeneration)
         advisoryPassed = true;
     }).finally(() => {
       advisoryPassInFlight = false;
@@ -8500,23 +8768,43 @@ function apply(ctx, config) {
     const service = fallbacksService(serviceCtx);
     if (service === undefined)
       return;
-    declareMstarSeeds(service, {
-      agentsDir: packagedAgentsDir(),
-      log: (level, message) => {
-        const logger = ctx.logger(SEEDS_LOGGER);
-        if (level === "warn")
-          logger.warn(message);
-        else if (level === "error")
-          logger.error(message);
-        else
-          logger.debug(message);
-      }
-    }).catch((error) => {
-      ctx.logger(SEEDS_LOGGER).error(`mstar seeds declaration failed (contained — fallbacks taxonomy unchanged): ${error instanceof Error ? error.message : String(error)}`);
-    });
+    let disposed = false;
+    const retryTimers = [];
+    const declareAttempt = (attempt) => {
+      declareMstarSeeds(service, {
+        agentsDir: packagedAgentsDir(),
+        log: (level, message) => {
+          const logger = ctx.logger(SEEDS_LOGGER);
+          if (level === "warn")
+            logger.warn(message);
+          else if (level === "error")
+            logger.error(message);
+          else
+            logger.debug(message);
+        }
+      }).catch((error) => {
+        if (disposed)
+          return;
+        const message = error instanceof Error ? error.message : String(error);
+        if (attempt >= 3) {
+          ctx.logger(SEEDS_LOGGER).error(`mstar seeds declaration failed (contained — fallbacks taxonomy unchanged): ${message}`);
+          return;
+        }
+        ctx.logger(SEEDS_LOGGER).debug(`seeds declare attempt ${attempt}/3 failed: ${message}`);
+        retryTimers.push(setTimeout(() => {
+          if (!disposed)
+            declareAttempt(attempt + 1);
+        }, attempt === 1 ? 50 : 250));
+      });
+    };
+    declareAttempt(1);
     return () => {
+      disposed = true;
+      for (const timer of retryTimers)
+        clearTimeout(timer);
       advisoryPassed = false;
       advisoryGeneration += 1;
+      resetAdvisoryAbortWarn();
     };
   });
   registerSettleListener(ctx, config, pairing);
@@ -8575,6 +8863,7 @@ function apply(ctx, config) {
   }
   ctx.on("tools/pre-execute", (exec, next) => preExecuteListener(ctx, resolver, config, adapter, exec, next), { prepend: true });
   registerRolePersonaChannel(ctx, config);
+  probeRolePersonaSeam(ctx);
   ctx.events.on("subagent/start", () => {
     runAdvisoryPass();
   });