@mstar-harness/engine 3.6.3 → 3.7.1

package/dist/engine.js

@@ -2095,6 +2095,25 @@ function assertSafePathComponent(value, what) {
     throw new Error(`${what} must be a single safe path component ([A-Za-z0-9._-]+; not "", ".", "..", or containing "/" or "\\") — got ${JSON.stringify(value)}`);
   }
 }
+function canonicalizeNearestExisting(path) {
+  const abs = resolve7(path);
+  let dir = abs;
+  const tail = [];
+  for (;; ) {
+    if (existsSync6(dir)) {
+      try {
+        return join9(realpathSync2(dir), ...tail);
+      } catch {
+        return abs;
+      }
+    }
+    const parent = dirname5(dir);
+    if (parent === dir)
+      return abs;
+    tail.unshift(basename3(dir));
+    dir = parent;
+  }
+}
 function resolveSddDir(harnessDir, planId) {
   assertSafePathComponent(planId, "planId");
   const base = resolve7(harnessDir);
@@ -2338,8 +2357,8 @@ function hasFiles(dir) {
 }
 // src/worktree.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync7 } from "node:fs";
-import { isAbsolute as isAbsolute5, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync7, realpathSync as realpathSync3 } from "node:fs";
+import { isAbsolute as isAbsolute5, join as join10, resolve as resolve8 } from "node:path";
 var DEFAULT_PROBE_TIMEOUT_MS = 1e4;
 function probeTimeoutMs() {
   const raw = process.env.MSTAR_GIT_PROBE_TIMEOUT_MS;
@@ -2378,6 +2397,51 @@ function probeBranch(worktreePath, opts) {
     return { error: detail };
   }
 }
+function probeCheckout(worktreePath, opts) {
+  const timeout = opts.timeoutMs ?? probeTimeoutMs();
+  try {
+    const stdout = execFileSync2(opts.gitPath ?? "git", ["-C", worktreePath, "rev-parse", "--git-dir"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout
+    });
+    const raw = stdout.trim();
+    if (raw === "")
+      return { error: `no git dir reported at "${worktreePath}"` };
+    const abs = isAbsolute5(raw) ? raw : join10(worktreePath, raw);
+    return { gitDir: realpathSync3(abs) };
+  } catch (err) {
+    const e = err;
+    if (e.killed === true || e.signal !== undefined) {
+      return { error: `git probe timed out after ${timeout}ms (killed by ${e.signal ?? "SIGTERM"})` };
+    }
+    const detail = (e.stderr !== undefined ? e.stderr.toString().trim() : "") || e.message || "git probe failed";
+    return { error: detail };
+  }
+}
+function isDistinctCheckout(controlPath, candidatePath, opts = {}) {
+  const control = probeCheckout(controlPath, opts);
+  const candidate = probeCheckout(candidatePath, opts);
+  if ("error" in control || "error" in candidate)
+    return false;
+  return control.gitDir !== candidate.gitDir;
+}
+function probeCheckoutRoot(path, opts = {}) {
+  const timeout = opts.timeoutMs ?? probeTimeoutMs();
+  try {
+    const stdout = execFileSync2(opts.gitPath ?? "git", ["-C", path, "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout
+    });
+    const raw = stdout.trim();
+    if (raw === "")
+      return null;
+    return realpathSync3(raw);
+  } catch {
+    return null;
+  }
+}
 function l1PreDispatchCheck(input, opts = {}) {
   const violations = [];
   const { controlWorktreePath, leaseWorktreePath, leaseWorkingBranch, planId } = input;
@@ -2390,8 +2454,20 @@ function l1PreDispatchCheck(input, opts = {}) {
   if (leaseWorkingBranch.trim() === "") {
     violations.push(violation7("high", "worktree.l1.lease-branch-missing", `execution_lease.working_branch is empty for plan "${planId}"`, "record the lease working_branch before dispatch"));
   }
-  if (controlWorktreePath !== "" && leaseWorktreePath !== "" && resolve8(controlWorktreePath) === resolve8(leaseWorktreePath)) {
-    violations.push(violation7("critical", "worktree.l1.lease-equals-control", `execution_lease.worktree_path "${leaseWorktreePath}" equals metadata.control_worktree_path — the feature worktree MUST differ from the control worktree (L1 isolation; product edits never land in the control checkout)`, "use a distinct feature worktree for the plan (git worktree add <path> <branch>) and update the lease"));
+  if (controlWorktreePath !== "" && leaseWorktreePath !== "") {
+    if (resolve8(controlWorktreePath) === resolve8(leaseWorktreePath)) {
+      violations.push(violation7("critical", "worktree.l1.lease-equals-control", `execution_lease.worktree_path "${leaseWorktreePath}" equals metadata.control_worktree_path — the feature worktree MUST differ from the control worktree (L1 isolation; product edits never land in the control checkout)`, "use a distinct feature worktree for the plan (git worktree add <path> <branch>) and update the lease"));
+    } else if (existsSync7(leaseWorktreePath)) {
+      const controlProbe = probeCheckout(controlWorktreePath, opts);
+      const leaseProbe = probeCheckout(leaseWorktreePath, opts);
+      if ("error" in controlProbe) {
+        violations.push(violation7("high", "worktree.l1.checkout-probe-failed", `cannot establish the lease worktree "${leaseWorktreePath}" is a distinct Git checkout from the control worktree "${controlWorktreePath}" for plan "${planId}": ${controlProbe.error}`, "verify the control worktree path is a git checkout (integration-branch checkout)"));
+      } else if ("error" in leaseProbe) {
+        violations.push(violation7("high", "worktree.l1.checkout-probe-failed", `cannot establish the lease worktree "${leaseWorktreePath}" is a distinct Git checkout from the control worktree "${controlWorktreePath}" for plan "${planId}": ${leaseProbe.error}`, "verify the lease worktree path is a git checkout (git worktree add <path> <branch>)"));
+      } else if (controlProbe.gitDir === leaseProbe.gitDir) {
+        violations.push(violation7("critical", "worktree.l1.lease-equals-control", `execution_lease.worktree_path "${leaseWorktreePath}" is the same Git checkout as metadata.control_worktree_path "${controlWorktreePath}" — a plain subdirectory or symlink alias of the control checkout is not isolation; the feature worktree MUST be a distinct checkout`, "use a distinct feature worktree for the plan (git worktree add <path> <branch>) and update the lease"));
+      }
+    }
   }
   if (leaseWorktreePath !== "" && !existsSync7(leaseWorktreePath)) {
     violations.push(violation7("high", "worktree.l1.feature-missing", `feature worktree directory "${leaseWorktreePath}" does not exist for plan "${planId}"`, `create it before dispatch: git worktree add ${leaseWorktreePath} <working-branch>`));
@@ -2440,11 +2516,17 @@ function l2PreDispatchCheck(input, opts = {}) {
   });
   return gate(violations);
 }
-function assertControlVsFeaturePath(controlWorktreePath, featureWorktreePath) {
+function assertControlVsFeaturePath(controlWorktreePath, featureWorktreePath, opts = {}) {
   const violations = [];
-  const samePath = controlWorktreePath === "" && featureWorktreePath === "" || controlWorktreePath !== "" && featureWorktreePath !== "" && resolve8(controlWorktreePath) === resolve8(featureWorktreePath);
-  if (samePath) {
-    violations.push(violation7("critical", "worktree.control-feature.same", `control worktree path equals feature/lease worktree path "${controlWorktreePath}" — execution_lease.worktree_path MUST differ from metadata.control_worktree_path`, "use a distinct feature worktree for the plan's product edits"));
+  if (controlWorktreePath === "" && featureWorktreePath === "") {
+    violations.push(violation7("critical", "worktree.control-feature.same", `control worktree path and feature/lease worktree path are both empty — execution_lease.worktree_path MUST differ from metadata.control_worktree_path`, "record a distinct feature worktree path"));
+    return gate(violations);
+  }
+  if (controlWorktreePath === "" || featureWorktreePath === "") {
+    return gate(violations);
+  }
+  if (!isDistinctCheckout(controlWorktreePath, featureWorktreePath, opts)) {
+    violations.push(violation7("critical", "worktree.control-feature.same", `control worktree path "${controlWorktreePath}" and feature/lease worktree path "${featureWorktreePath}" are not distinct Git checkouts — a plain subdirectory or symlink alias of the control checkout is not isolation; execution_lease.worktree_path MUST be a distinct checkout`, "use a distinct feature worktree for the plan's product edits (git worktree add <path> <branch>)"));
   }
   return gate(violations);
 }
@@ -2489,9 +2571,10 @@ function singleReviewSnapshot(assignments) {
   return gate(violations);
 }
 // src/sdd.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { mkdirSync as mkdirSync6, readdirSync as readdirSync6, readFileSync as readFileSync7, realpathSync as realpathSync3, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { basename as basename4, dirname as dirname6, isAbsolute as isAbsolute6, join as join10, resolve as resolve9 } from "node:path";
+import { execFileSync as execFileSync3, spawn } from "node:child_process";
+import { mkdirSync as mkdirSync6, readdirSync as readdirSync6, readFileSync as readFileSync7, realpathSync as realpathSync4, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { constants as osConstants } from "node:os";
+import { basename as basename4, dirname as dirname6, isAbsolute as isAbsolute6, join as join11, relative as relative3, resolve as resolve9 } from "node:path";
 class SddScriptError extends Error {
   exitCode;
   constructor(message, exitCode) {
@@ -2528,14 +2611,14 @@ function gitOut(cwd, args) {
   }
 }
 function probeHarnessWithStatus(root) {
-  if (isFile2(join10(root, ".mstar", "status.json")))
-    return join10(root, ".mstar");
-  if (isFile2(join10(root, ".agents", "status.json")))
-    return join10(root, ".agents");
-  if (hasWorkflowSnapshot(join10(root, ".mstar")))
-    return join10(root, ".mstar");
-  if (hasWorkflowSnapshot(join10(root, ".agents")))
-    return join10(root, ".agents");
+  if (isFile2(join11(root, ".mstar", "status.json")))
+    return join11(root, ".mstar");
+  if (isFile2(join11(root, ".agents", "status.json")))
+    return join11(root, ".agents");
+  if (hasWorkflowSnapshot(join11(root, ".mstar")))
+    return join11(root, ".mstar");
+  if (hasWorkflowSnapshot(join11(root, ".agents")))
+    return join11(root, ".agents");
   return null;
 }
 function hasWorkflowSnapshot(harnessDir) {
@@ -2543,13 +2626,13 @@ function hasWorkflowSnapshot(harnessDir) {
   try {
     workflowsDir = resolveWorkflowDir(harnessDir, { harnessDir });
   } catch {
-    workflowsDir = join10(harnessDir, "workflows");
+    workflowsDir = join11(harnessDir, "workflows");
   }
   if (!isDirectory2(workflowsDir))
     return false;
   try {
     for (const entry of readdirSync6(workflowsDir, { withFileTypes: true })) {
-      if (entry.isDirectory() && isFile2(join10(workflowsDir, entry.name, "snapshot.json")))
+      if (entry.isDirectory() && isFile2(join11(workflowsDir, entry.name, "snapshot.json")))
         return true;
     }
   } catch {
@@ -2562,14 +2645,14 @@ function isLinkedWorktree(root) {
   const commonRaw = gitOut(root, ["rev-parse", "--git-common-dir"]);
   if (gitDirRaw === null || commonRaw === null)
     return false;
-  const gitDir = isAbsolute6(gitDirRaw) ? gitDirRaw : join10(root, gitDirRaw);
-  const common = isAbsolute6(commonRaw) ? commonRaw : join10(root, commonRaw);
+  const gitDir = isAbsolute6(gitDirRaw) ? gitDirRaw : join11(root, gitDirRaw);
+  const common = isAbsolute6(commonRaw) ? commonRaw : join11(root, commonRaw);
   if (gitDir.includes("/.git/worktrees/") || gitDir.includes("/worktrees/"))
     return true;
   try {
-    const gdParent = realpathSync3(dirname6(gitDir));
-    const cmAbs = realpathSync3(common);
-    return join10(gdParent, basename4(gitDir)) !== cmAbs && gitDir !== cmAbs;
+    const gdParent = realpathSync4(dirname6(gitDir));
+    const cmAbs = realpathSync4(common);
+    return join11(gdParent, basename4(gitDir)) !== cmAbs && gitDir !== cmAbs;
   } catch {
     return false;
   }
@@ -2586,10 +2669,10 @@ function sddWorkspace(planId, opts = {}) {
     if (!isDirectory2(controlRoot)) {
       throw new SddScriptError(`mstar sdd workspace: CONTROL_ROOT / MSTAR_CONTROL_ROOT is not a directory: ${controlRoot}`, 1);
     }
-    root = realpathSync3(controlRoot);
+    root = realpathSync4(controlRoot);
   } else {
     const topLevel = gitOut(cwd, ["rev-parse", "--show-toplevel"]);
-    root = realpathSync3(topLevel ?? cwd);
+    root = realpathSync4(topLevel ?? cwd);
   }
   if (!controlRoot && isLinkedWorktree(root)) {
     throw new SddScriptError(`mstar sdd workspace: linked worktree at ${root} has no {HARNESS_DIR}/status.json (default gitignore).
@@ -2610,25 +2693,35 @@ function sddWorkspace(planId, opts = {}) {
       const probed = probeHarnessWithStatus(root);
       if (probed) {
         harnessDir = probed;
-      } else if (isDirectory2(join10(root, ".mstar"))) {
-        harnessDir = join10(root, ".mstar");
-      } else if (isDirectory2(join10(root, ".agents"))) {
-        harnessDir = join10(root, ".agents");
+      } else if (isDirectory2(join11(root, ".mstar"))) {
+        harnessDir = join11(root, ".mstar");
+      } else if (isDirectory2(join11(root, ".agents"))) {
+        harnessDir = join11(root, ".agents");
       } else {
-        harnessDir = join10(root, ".mstar");
+        harnessDir = join11(root, ".mstar");
       }
     }
   }
   const sddDir = resolveSddDir(harnessDir, planId);
   mkdirSync6(sddDir, { recursive: true });
-  writeFileSync4(join10(sddDir, ".gitignore"), `*
+  writeFileSync4(join11(sddDir, ".gitignore"), `*
 `);
-  return realpathSync3(sddDir);
+  return realpathSync4(sddDir);
 }
 function taskBrief(planFile, taskN, outFile, opts = {}) {
   if (!planFile || !Number.isInteger(taskN) || taskN < 1) {
     throw new SddScriptError("usage: mstar sdd task-brief PLAN_FILE TASK_NUMBER [OUTFILE]", 2);
   }
+  const bound = opts.context;
+  const observedCwd = opts.cwd ?? process.cwd();
+  if (bound) {
+    const inputPlan = canonicalizeNearestExisting(resolve9(observedCwd, planFile));
+    if (inputPlan !== canonicalizeNearestExisting(bound.planFile)) {
+      throwGateFail([
+        contextViolation("high", "sdd.context.plan-file-mismatch", `plan file "${planFile}" does not match the bound context plan file "${bound.planFile}" — ` + "bound mode extracts only the resolved context's plan; refused before any read or write")
+      ]);
+    }
+  }
   let content;
   try {
     content = readFileSync7(planFile, "utf8");
@@ -2636,15 +2729,26 @@ function taskBrief(planFile, taskN, outFile, opts = {}) {
     throw new SddScriptError(`no such plan file: ${planFile}`, 2);
   }
   let out;
+  let mkdirAfterGate = null;
   if (outFile) {
-    out = outFile;
+    out = bound ? resolve9(observedCwd, outFile) : outFile;
+  } else if (bound) {
+    out = join11(bound.sddDir, `task-${taskN}-brief.md`);
+    mkdirAfterGate = bound.sddDir;
   } else {
     const sddDir = opts.sddDir ?? process.env.SDD_DIR;
     if (!sddDir) {
       throw new SddScriptError("mstar sdd task-brief: set SDD_DIR or pass OUTFILE (run mstar sdd workspace PLAN_ID first)", 2);
     }
     mkdirSync6(sddDir, { recursive: true });
-    out = join10(sddDir, `task-${taskN}-brief.md`);
+    out = join11(sddDir, `task-${taskN}-brief.md`);
+  }
+  if (bound) {
+    const gate2 = checkSddAction(bound, { kind: "artifact", cwd: observedCwd, target: out });
+    if (!gate2.ok)
+      throwGateFail(gate2.violations);
+    if (mkdirAfterGate !== null)
+      mkdirSync6(mkdirAfterGate, { recursive: true });
   }
   const records = content.endsWith(`
 `) ? content.split(`
@@ -2670,13 +2774,15 @@ function taskBrief(planFile, taskN, outFile, opts = {}) {
   if (printed.length === 0) {
     throw new SddScriptError(`task ${taskN} not found in ${planFile} (no heading matching Task ${taskN})`, 3);
   }
-  return out;
+  return bound ? resolve9(observedCwd, out) : out;
 }
 function reviewPackage(base, head, outFile, opts = {}) {
   if (!base || !head) {
     throw new SddScriptError("usage: mstar sdd review-package BASE HEAD [OUTFILE]", 2);
   }
-  const cwd = opts.cwd ?? process.cwd();
+  const bound = opts.context;
+  const cwd = bound && opts.cwd === undefined ? bound.featureCwd : opts.cwd ?? process.cwd();
+  const observedCwd = opts.cwd ?? process.cwd();
   const verifyRef = (ref, what) => {
     try {
       execFileSync3("git", ["rev-parse", "--verify", "--quiet", ref], { cwd, stdio: ["ignore", "pipe", "pipe"] });
@@ -2687,8 +2793,14 @@ function reviewPackage(base, head, outFile, opts = {}) {
   verifyRef(base, "BASE");
   verifyRef(head, "HEAD");
   let out;
+  let mkdirAfterGate = null;
   if (outFile) {
-    out = outFile;
+    out = bound ? resolve9(observedCwd, outFile) : outFile;
+  } else if (bound) {
+    const shortBase = gitOut(cwd, ["rev-parse", "--short", base]) ?? base;
+    const shortHead = gitOut(cwd, ["rev-parse", "--short", head]) ?? head;
+    out = join11(bound.sddDir, `review-${shortBase}..${shortHead}.diff`);
+    mkdirAfterGate = bound.sddDir;
   } else {
     const sddDir = opts.sddDir ?? process.env.SDD_DIR;
     if (!sddDir) {
@@ -2697,7 +2809,14 @@ function reviewPackage(base, head, outFile, opts = {}) {
     mkdirSync6(sddDir, { recursive: true });
     const shortBase = gitOut(cwd, ["rev-parse", "--short", base]) ?? base;
     const shortHead = gitOut(cwd, ["rev-parse", "--short", head]) ?? head;
-    out = join10(sddDir, `review-${shortBase}..${shortHead}.diff`);
+    out = join11(sddDir, `review-${shortBase}..${shortHead}.diff`);
+  }
+  if (bound) {
+    const gate2 = checkSddAction(bound, { kind: "artifact", cwd: observedCwd, target: out });
+    if (!gate2.ok)
+      throwGateFail(gate2.violations);
+    if (mkdirAfterGate !== null)
+      mkdirSync6(mkdirAfterGate, { recursive: true });
   }
   const run = (args) => execFileSync3("git", args, { cwd, maxBuffer: GIT_CAPTURE_MAX_BYTES });
   const parts = [
@@ -2716,7 +2835,7 @@ function reviewPackage(base, head, outFile, opts = {}) {
     run(["diff", "-U10", `${base}..${head}`])
   ];
   writeFileSync4(out, Buffer.concat(parts));
-  return out;
+  return bound ? resolve9(observedCwd, out) : out;
 }
 function assertBaseSha(ref, opts = {}) {
   if (typeof ref !== "string" || !/^[0-9a-f]{4,40}$/i.test(ref)) {
@@ -2733,7 +2852,7 @@ function assertBaseSha(ref, opts = {}) {
 }
 function taskReportExists(sddDir, taskN) {
   try {
-    const st = statSync4(join10(sddDir, `task-${taskN}-report.md`));
+    const st = statSync4(join11(sddDir, `task-${taskN}-report.md`));
     return st.isFile() && st.size > 0;
   } catch {
     return false;
@@ -2742,7 +2861,7 @@ function taskReportExists(sddDir, taskN) {
 function readProgressLedger(sddDir) {
   let content;
   try {
-    content = readFileSync7(join10(sddDir, "progress.md"), "utf8");
+    content = readFileSync7(join11(sddDir, "progress.md"), "utf8");
   } catch {
     return [];
   }
@@ -2774,9 +2893,535 @@ function implementerSessionStickyRules(input) {
   }
   return { resume: true, reason: `sticky resume OK: host_agent_id ${session.host_agent_id}, next task ${nextTask}` };
 }
+function isPlainObject6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isInside(child, ancestor) {
+  const rel = relative3(ancestor, child);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute6(rel);
+}
+function canonicalDir(path) {
+  try {
+    return statSync4(path).isDirectory() ? realpathSync4(path) : null;
+  } catch {
+    return null;
+  }
+}
+function contextViolation(severity, code, message, fix) {
+  return { ok: false, severity, code, message, fix };
+}
+function throwGateFail(violations) {
+  const detail = violations.map((v) => `${v.code}: ${v.message}${v.fix ? ` (fix: ${v.fix})` : ""}`).join(`
+  `);
+  throw new SddScriptError(`SDD execution context rejected:
+  ${detail}`, 1);
+}
+function throwUsage(message) {
+  throw new SddScriptError(message, 2);
+}
+function readActiveWorkflowIds(controlHarnessRoot) {
+  const statusPath = join11(controlHarnessRoot, "status.json");
+  if (!isFile2(statusPath))
+    return null;
+  let doc;
+  try {
+    doc = readJson(statusPath);
+  } catch {
+    return null;
+  }
+  if (!isPlainObject6(doc) || doc.version !== 2 || !Array.isArray(doc.workflows))
+    return null;
+  const ids = new Set;
+  for (const entry of doc.workflows) {
+    if (isPlainObject6(entry) && typeof entry.id === "string")
+      ids.add(entry.id);
+  }
+  return ids;
+}
+function findWorkflowPlanRow(controlHarnessRoot, planId) {
+  let workflowsDir;
+  try {
+    workflowsDir = resolveWorkflowDir(controlHarnessRoot, { harnessDir: controlHarnessRoot });
+  } catch {
+    return { kind: "none" };
+  }
+  if (!isDirectory2(workflowsDir))
+    return { kind: "none" };
+  let workflowIds;
+  try {
+    workflowIds = readdirSync6(workflowsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch {
+    return { kind: "none" };
+  }
+  const matches = [];
+  for (const id of workflowIds) {
+    const snapshotPath = join11(workflowsDir, id, WORKFLOW_SNAPSHOT_FILE);
+    if (!isFile2(snapshotPath))
+      continue;
+    let doc;
+    try {
+      doc = readJson(snapshotPath);
+    } catch {
+      continue;
+    }
+    const plans = doc.plans;
+    if (!Array.isArray(plans))
+      continue;
+    for (const row of plans) {
+      if (isPlainObject6(row) && (row.id === planId || row.plan_id === planId)) {
+        matches.push({ workflowId: id, row });
+        break;
+      }
+    }
+  }
+  if (matches.length === 0)
+    return { kind: "none" };
+  const registeredActive = readActiveWorkflowIds(controlHarnessRoot);
+  if (registeredActive === null) {
+    return { kind: "row", workflowId: matches[0].workflowId, row: matches[0].row };
+  }
+  const active = matches.filter((m) => registeredActive.has(m.workflowId));
+  if (active.length === 0)
+    return { kind: "none" };
+  if (active.length > 1) {
+    return { kind: "ambiguous", workflowIds: active.map((m) => m.workflowId) };
+  }
+  return { kind: "row", workflowId: active[0].workflowId, row: active[0].row };
+}
+function resolveSddExecutionContext(input) {
+  const { planId, workingBranch } = input;
+  if (typeof planId !== "string" || planId.trim() === "") {
+    throwUsage("SddExecutionContext.planId must be a non-empty string");
+  }
+  if (typeof workingBranch !== "string" || workingBranch.trim() === "") {
+    throwUsage("SddExecutionContext.workingBranch must be a non-empty string");
+  }
+  for (const field of ["controlHarnessRoot", "featureCwd", "planFile", "sddDir"]) {
+    const value = input[field];
+    if (typeof value !== "string" || value.trim() === "") {
+      throwUsage(`SddExecutionContext.${field} must be a non-empty string`);
+    }
+    if (!isAbsolute6(value)) {
+      throwUsage(`SddExecutionContext.${field} must be an absolute path (A3: all paths normalized absolute); got ${JSON.stringify(value)}`);
+    }
+  }
+  try {
+    assertSafePathComponent(planId, "SddExecutionContext.planId");
+  } catch (err) {
+    throwUsage(`SddExecutionContext rejected: ${err.message}`);
+  }
+  const canonicalControlHarnessRoot = canonicalDir(input.controlHarnessRoot);
+  if (canonicalControlHarnessRoot === null) {
+    throwGateFail([
+      contextViolation("high", "sdd.context.control-root-missing", `controlHarnessRoot "${input.controlHarnessRoot}" does not exist or is not a directory — a declared control root is authoritative and is never re-inferred from the feature cwd (A3)`)
+    ]);
+  }
+  const stem = basename4(input.planFile).replace(/\.md$/, "");
+  if (stem !== planId) {
+    throwUsage(`SddExecutionContext.planFile "${input.planFile}" does not match plan "${planId}" — the plan file must be {PLAN_DIR}/<plan-id>.md under the declared control harness`);
+  }
+  if (!isFile2(input.planFile)) {
+    throwUsage(`no such plan file: ${input.planFile}`);
+  }
+  const planGate = assertPlanWritingPath(input.planFile, input.controlHarnessRoot);
+  if (!planGate.ok) {
+    if (planGate.code === "plan-path.symlink-escape") {
+      throwGateFail([planGate]);
+    }
+    throwUsage(`SddExecutionContext.planFile rejected: ${planGate.code}: ${planGate.message}`);
+  }
+  const composedSddDir = resolveSddDir(canonicalControlHarnessRoot, planId);
+  const canonicalComposedSddDir = canonicalizeNearestExisting(composedSddDir);
+  const canonicalSddDir = canonicalizeNearestExisting(input.sddDir);
+  if (canonicalSddDir !== canonicalComposedSddDir) {
+    if (!isInside(canonicalSddDir, canonicalControlHarnessRoot)) {
+      throwGateFail([
+        contextViolation("high", "sdd.context.sdd-dir-escape", `sddDir "${input.sddDir}" canonicalizes to "${canonicalSddDir}", outside the control harness "${canonicalControlHarnessRoot}" — symlink escape refused (environmental gate failure)`)
+      ]);
+    }
+    throwUsage(`SddExecutionContext.sddDir "${input.sddDir}" does not match plan "${planId}" — expected the {SDD_DIR} composition ${composedSddDir}`);
+  }
+  const canonicalFeatureCwd = canonicalDir(input.featureCwd);
+  if (canonicalFeatureCwd === null) {
+    throwGateFail([
+      contextViolation("high", "sdd.context.feature-cwd-missing", `featureCwd "${input.featureCwd}" does not exist or is not a directory — the feature worktree is the required cwd for product edits`, `create the feature worktree first (git worktree add ${input.featureCwd} ${workingBranch})`)
+    ]);
+  }
+  if (isInside(canonicalControlHarnessRoot, canonicalFeatureCwd)) {
+    throwGateFail([
+      contextViolation("critical", "sdd.context.control-inside-feature", `controlHarnessRoot "${canonicalControlHarnessRoot}" is inside featureCwd "${canonicalFeatureCwd}" — a feature worktree's same-looking {HARNESS_DIR} is not the SSOT; the control harness must live outside the feature checkout`)
+    ]);
+  }
+  const controlCheckout = probeCheckoutRoot(canonicalControlHarnessRoot);
+  if (controlCheckout === null) {
+    throwGateFail([
+      contextViolation("high", "sdd.context.control-root-unresolvable", `cannot resolve the control checkout root for controlHarnessRoot "${canonicalControlHarnessRoot}" (git rev-parse --show-toplevel failed) — the control harness must live inside a git checkout`, "verify the control harness root is inside the control worktree checkout")
+    ]);
+  }
+  if (isInside(canonicalFeatureCwd, controlCheckout) && !isDistinctCheckout(canonicalControlHarnessRoot, canonicalFeatureCwd)) {
+    throwGateFail([
+      contextViolation("critical", "sdd.context.feature-in-control", `featureCwd "${canonicalFeatureCwd}" is inside the control checkout "${controlCheckout}" and is not a distinct Git checkout — a plain subdirectory or symlink alias of the control checkout is not isolation; product edits never land in the control checkout (execution_lease.worktree_path MUST be a distinct checkout)`, "use a distinct feature worktree for the plan (git worktree add <path> <branch>)")
+    ]);
+  }
+  const match = findWorkflowPlanRow(canonicalControlHarnessRoot, planId);
+  if (match.kind === "ambiguous") {
+    throwGateFail([
+      contextViolation("high", "sdd.context.workflow-plan-ambiguous", `plan "${planId}" appears in multiple registered active workflows (${match.workflowIds.join(", ")}) — ` + "the governing execution_lease is undecidable; resolve the duplicate registration before dispatch")
+    ]);
+  }
+  const row = match.kind === "row" ? match.row : null;
+  if (row !== null && row.execution_lease !== undefined) {
+    const leaseVerify = verifyPlanExecutionLease(row, planId);
+    if (!leaseVerify.ok)
+      throwGateFail(leaseVerify.violations);
+    const lease = leaseVerify.lease;
+    const l1 = l1PreDispatchCheck({
+      controlWorktreePath: controlCheckout,
+      leaseWorktreePath: lease.worktree_path,
+      leaseWorkingBranch: lease.working_branch,
+      planId
+    });
+    if (!l1.ok)
+      throwGateFail(l1.violations);
+    if (canonicalizeNearestExisting(lease.worktree_path) !== canonicalFeatureCwd) {
+      throwGateFail([
+        contextViolation("high", "sdd.context.lease-worktree-mismatch", `SddExecutionContext.featureCwd "${canonicalFeatureCwd}" does not match the verified execution_lease.worktree_path "${String(lease.worktree_path)}" — the context must match the verified lease (A3)`)
+      ]);
+    }
+    if (workingBranch !== lease.working_branch) {
+      throwGateFail([
+        contextViolation("high", "sdd.context.lease-branch-mismatch", `SddExecutionContext.workingBranch "${workingBranch}" does not match the verified execution_lease.working_branch "${String(lease.working_branch)}" (plan "${planId}")`)
+      ]);
+    }
+  } else if (row !== null && row.status === "InProgress") {
+    throwGateFail(verifyPlanExecutionLease(row, planId).violations);
+  } else {
+    const branchGate = assertBranchAlignment(canonicalFeatureCwd, workingBranch);
+    if (!branchGate.ok)
+      throwGateFail(branchGate.violations);
+  }
+  return {
+    planId,
+    controlHarnessRoot: canonicalControlHarnessRoot,
+    featureCwd: canonicalFeatureCwd,
+    workingBranch,
+    planFile: realpathSync4(input.planFile),
+    sddDir: canonicalSddDir
+  };
+}
+function checkSddAction(context, action) {
+  const violations = [];
+  const add = (code, message, fix) => {
+    violations.push(contextViolation("high", code, message, fix));
+  };
+  if (action.kind !== "source" && action.kind !== "artifact" && action.kind !== "launch") {
+    add("sdd.context.kind-unknown", `unknown action kind ${JSON.stringify(action.kind)} — expected "source" | "artifact" | "launch"`);
+    return { ok: false, violations };
+  }
+  if (typeof action.cwd !== "string" || action.cwd.trim() === "") {
+    add("sdd.context.cwd-missing", "action.cwd (the observed invocation cwd) is required — never an Assignment echo");
+    return { ok: false, violations };
+  }
+  const featureReal = canonicalDir(context.featureCwd);
+  const canonicalSddDir = canonicalizeNearestExisting(context.sddDir);
+  const canonicalPlanFile = canonicalizeNearestExisting(context.planFile);
+  const cwdResolved = resolve9(action.cwd);
+  const checkTarget = (baseDir, target, kind) => {
+    if (featureReal === null)
+      return;
+    const targetAbs = resolve9(baseDir, target);
+    const canonical = canonicalizeNearestExisting(targetAbs);
+    if (!isInside(canonical, featureReal)) {
+      const declaredPrefix = targetAbs === featureReal || targetAbs.startsWith(`${featureReal}/`);
+      if (declaredPrefix) {
+        add("sdd.context.target-symlink-escape", `${kind} target "${target}" canonicalizes to "${canonical}", outside the feature worktree — symlink escape refused before mutation`);
+      } else {
+        add(`sdd.context.${kind}-target-outside-feature`, `${kind} target "${target}" resolves to "${targetAbs}", outside the feature worktree "${featureReal}" — refused before mutation`);
+      }
+    }
+  };
+  if (action.kind === "source") {
+    const cwdReal = canonicalDir(cwdResolved);
+    if (cwdReal === null) {
+      add("sdd.context.cwd-missing", `observed source cwd "${action.cwd}" does not exist or is not a directory`);
+      return { ok: false, violations };
+    }
+    if (featureReal === null || !isInside(cwdReal, featureReal)) {
+      add("sdd.context.source-cwd-outside-feature", `observed source cwd "${cwdReal}" is outside the feature worktree "${context.featureCwd}" — a declared-correct context does not make a wrong-checkout write safe (A3)`, `run the source action from inside ${context.featureCwd}`);
+      return { ok: false, violations };
+    }
+    if (action.target !== undefined)
+      checkTarget(cwdReal, action.target, "source");
+  } else if (action.kind === "artifact") {
+    if (typeof action.target !== "string" || action.target.trim() === "") {
+      add("sdd.context.target-missing", "artifact checks require the destination target");
+      return { ok: false, violations };
+    }
+    const targetAbs = resolve9(cwdResolved, action.target);
+    const canonical = canonicalizeNearestExisting(targetAbs);
+    if (!isInside(canonical, canonicalSddDir) && canonical !== canonicalPlanFile) {
+      const rawSddDir = resolve9(context.sddDir);
+      const declaredPrefix = targetAbs === rawSddDir || targetAbs.startsWith(`${rawSddDir}/`) || targetAbs === canonicalSddDir || targetAbs.startsWith(`${canonicalSddDir}/`) || targetAbs === canonicalPlanFile;
+      if (declaredPrefix) {
+        add("sdd.context.artifact-symlink-escape", `artifact target "${targetAbs}" canonicalizes to "${canonical}", outside the plan's control sddDir — symlink escape refused before write`);
+      } else {
+        add("sdd.context.artifact-outside-plan", `artifact target "${targetAbs}" is outside the plan's control sddDir "${context.sddDir}" and is not the declared planFile "${context.planFile}" — legitimate control artifact edits stay inside the plan's artifacts; arbitrary control source edits are not allowed (A3)`);
+      }
+    }
+  } else {
+    if (featureReal === null) {
+      add("sdd.context.launch-cwd-missing", `feature worktree "${context.featureCwd}" does not exist or is not a directory — cannot bind the child's starting cwd`);
+    } else {
+      violations.push(...assertBranchAlignment(featureReal, context.workingBranch).violations);
+    }
+    if (action.target !== undefined && action.target.trim() !== "" && featureReal !== null) {
+      checkTarget(featureReal, action.target, "launch");
+    }
+  }
+  return { ok: violations.length === 0, violations };
+}
+function signalExitNumber(signal) {
+  return osConstants.signals[signal] ?? 0;
+}
+async function runInSddContext(context, argv) {
+  if (!Array.isArray(argv) || argv.length === 0 || typeof argv[0] !== "string" || argv[0].trim() === "") {
+    throwUsage("runInSddContext: argv must be [executable, ...args] with a non-empty executable — the array is passed to the child literally (no shell)");
+  }
+  const resolved = resolveSddExecutionContext(context);
+  const gate2 = checkSddAction(resolved, { kind: "launch", cwd: process.cwd() });
+  if (!gate2.ok)
+    throwGateFail(gate2.violations);
+  return await new Promise((settle, reject) => {
+    let child;
+    try {
+      child = spawn(argv[0], argv.slice(1), {
+        cwd: resolved.featureCwd,
+        shell: false,
+        stdio: "inherit"
+      });
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        settle(127);
+        return;
+      }
+      throw err;
+    }
+    let done = false;
+    let spawnError = null;
+    const forward = (signal) => {
+      if (!done && child.exitCode === null && child.signalCode === null)
+        child.kill(signal);
+    };
+    const cleanup = () => {
+      process.removeListener("SIGINT", forward);
+      process.removeListener("SIGTERM", forward);
+    };
+    process.on("SIGINT", forward);
+    process.on("SIGTERM", forward);
+    child.on("error", (err) => {
+      spawnError = err;
+      if (err.code !== "ENOENT" && !done) {
+        done = true;
+        cleanup();
+        reject(err);
+      }
+    });
+    child.on("close", (code, signal) => {
+      if (done)
+        return;
+      done = true;
+      cleanup();
+      if (spawnError !== null) {
+        if (spawnError.code === "ENOENT")
+          settle(127);
+        else
+          reject(spawnError);
+        return;
+      }
+      if (signal !== null)
+        settle(128 + signalExitNumber(signal));
+      else
+        settle(code ?? 0);
+    });
+  });
+}
+// src/gates.ts
+import { existsSync as existsSync8, statSync as statSync5 } from "node:fs";
+import { basename as basename5, dirname as dirname7, join as join12, relative as relative4, resolve as resolve10 } from "node:path";
+var STATUS_FILE = "status.json";
+var SNAPSHOT_FILE = "snapshot.json";
+var REGISTER_FILE = "residuals.json";
+function eventTargetPaths(input) {
+  if (typeof input !== "object" || input === null)
+    return [];
+  const record = input;
+  const paths = [];
+  const push = (value) => {
+    if (typeof value === "string" && value.trim() !== "")
+      paths.push(value);
+  };
+  push(record.path);
+  if (Array.isArray(record.paths)) {
+    for (const value of record.paths)
+      push(value);
+  }
+  return paths;
+}
+function hasEntry(dir, name) {
+  try {
+    statSync5(join12(dir, name));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function hasHarnessRootMarkers(dir) {
+  if (!hasEntry(dir, STATUS_FILE))
+    return false;
+  if (hasEntry(dir, "workflows") && hasEntry(dir, "projects"))
+    return true;
+  try {
+    return hasEntry(resolveWorkflowDir(dir, { harnessDir: dir }), "") && hasEntry(resolveProjectDir(dir, { harnessDir: dir }), "");
+  } catch {
+    return false;
+  }
+}
+function resolveHarnessRootOf(target) {
+  let dir = resolve10(target);
+  for (;; ) {
+    if (hasHarnessRootMarkers(dir))
+      return dir;
+    const parent = dirname7(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function harnessDocKindOfTarget(targetPath) {
+  if (typeof targetPath !== "string" || targetPath.trim() === "")
+    return null;
+  const resolved = resolve10(targetPath);
+  const name = basename5(resolved);
+  if (name !== STATUS_FILE && name !== SNAPSHOT_FILE && name !== REGISTER_FILE)
+    return null;
+  const classify = (harnessDir2) => {
+    const rel = relative4(harnessDir2, resolved);
+    if (name === STATUS_FILE && rel === STATUS_FILE)
+      return { harnessDir: harnessDir2, kind: "status" };
+    let workflowDir;
+    let projectDir;
+    try {
+      workflowDir = resolveWorkflowDir(harnessDir2, { harnessDir: harnessDir2 });
+      projectDir = resolveProjectDir(harnessDir2, { harnessDir: harnessDir2 });
+    } catch {
+      workflowDir = join12(harnessDir2, "workflows");
+      projectDir = join12(harnessDir2, "projects");
+    }
+    if (name === SNAPSHOT_FILE && /^[^/]+\/snapshot\.json$/.test(relative4(workflowDir, resolved))) {
+      return { harnessDir: harnessDir2, kind: "snapshot" };
+    }
+    if (name === REGISTER_FILE && /^[^/]+\/residuals\.json$/.test(relative4(projectDir, resolved))) {
+      return { harnessDir: harnessDir2, kind: "register" };
+    }
+    return null;
+  };
+  const probeRoot = resolveHarnessRootOf(dirname7(resolved));
+  const harnessDir = probeRoot ?? resolveHarnessDir(dirname7(resolved));
+  if (harnessDir === null)
+    return null;
+  const classified = classify(harnessDir);
+  if (classified !== null)
+    return classified;
+  if (probeRoot === null)
+    return null;
+  const fallbackDir = resolveHarnessDir(dirname7(resolved));
+  if (fallbackDir === null || fallbackDir === probeRoot)
+    return null;
+  return classify(fallbackDir);
+}
+function violationLine(violation8) {
+  return `[${violation8.severity}] ${violation8.code}: ${violation8.message}${violation8.fix ? ` (fix: ${violation8.fix})` : ""}`;
+}
+var MAX_STATUS_CONTENT_LENGTH = 2 * 1024 * 1024;
+function oversizedViolation(filePath) {
+  return {
+    ok: false,
+    severity: "high",
+    code: "status.oversized",
+    message: `${basename5(filePath)} exceeds the ${MAX_STATUS_CONTENT_LENGTH}-byte (2 MiB) coordination-document validation budget — repair out of band or disable for this session with MSTAR_WRITE_GATE=off`
+  };
+}
+function validateStatusWriteDoc(content, filePath, kind, options = {}) {
+  const oversized = options.oversized ?? "pass";
+  if (typeof content === "string") {
+    if (content.length > MAX_STATUS_CONTENT_LENGTH) {
+      return oversized === "violate" ? [oversizedViolation(filePath)] : [];
+    }
+    let doc2;
+    try {
+      doc2 = JSON.parse(content);
+    } catch (error) {
+      return [
+        {
+          ok: false,
+          severity: "high",
+          code: "status.invalid-json",
+          message: error.message
+        }
+      ];
+    }
+    if (doc2 === null || typeof doc2 !== "object" || Array.isArray(doc2)) {
+      return [
+        {
+          ok: false,
+          severity: "high",
+          code: "status.invalid-json",
+          message: `${basename5(filePath)} content must be a JSON object`
+        }
+      ];
+    }
+    return validateDocByKind(doc2, kind);
+  }
+  if (!existsSync8(filePath))
+    return [];
+  try {
+    if (statSync5(filePath).size > MAX_STATUS_CONTENT_LENGTH) {
+      return oversized === "violate" ? [oversizedViolation(filePath)] : [];
+    }
+  } catch {
+    return [];
+  }
+  if (kind === "status")
+    return validateStatus(filePath).violations;
+  let doc;
+  try {
+    doc = readJson(filePath);
+  } catch (error) {
+    return [
+      {
+        ok: false,
+        severity: "high",
+        code: "status.invalid-json",
+        message: error.message
+      }
+    ];
+  }
+  return validateDocByKind(doc, kind);
+}
+function validateDocByKind(doc, kind) {
+  if (kind === "snapshot")
+    return validateWorkflowSnapshot(doc).violations;
+  if (kind === "register")
+    return validateProjectRegister(doc).violations;
+  return validateStatus(doc).violations;
+}
+function formatStatusWriteBlockReason(violations, skillPointer) {
+  return violations.map((v) => `${violationLine(v)} (${skillPointer})`).join(`
+`);
+}
 // src/migrate.ts
 import { copyFileSync, mkdirSync as mkdirSync7, readFileSync as readFileSync8, readdirSync as readdirSync7, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname7, isAbsolute as isAbsolute7, join as join11, relative as relative3, resolve as resolve10, sep as sep2 } from "node:path";
+import { dirname as dirname8, isAbsolute as isAbsolute7, join as join13, relative as relative5, resolve as resolve11, sep as sep2 } from "node:path";
 var MIGRATE_STATUS_FILE = "status.json";
 var ARCHIVED_STATUS_V1_FILE = "archived/status.v1.json";
 var NOTES_LEDGER_FILE = "notes.jsonl";
@@ -2793,7 +3438,7 @@ var ROOT_METADATA_LIFT_KEYS = {
   program_roadmap: true,
   updated_at: true
 };
-function isPlainObject6(value) {
+function isPlainObject7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function dateString(value) {
@@ -2816,7 +3461,7 @@ function todayString3() {
   return `${now.getFullYear()}-${month}-${day}`;
 }
 function scanCompasses(harnessDir) {
-  const iterationsDir = join11(harnessDir, "iterations");
+  const iterationsDir = join13(harnessDir, "iterations");
   const out = [];
   let entries;
   try {
@@ -2827,7 +3472,7 @@ function scanCompasses(harnessDir) {
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const compassPath = join11(iterationsDir, entry.name, "delivery-compass.md");
+    const compassPath = join13(iterationsDir, entry.name, "delivery-compass.md");
     let content;
     try {
       content = readFileSync8(compassPath, "utf8");
@@ -2907,8 +3552,8 @@ function buildIterationSnapshot(compass, rowById, rootUpdatedAt) {
     id: compass.id,
     type: "iteration",
     status,
-    file: join11("workflows", compass.id, WORKFLOW_SNAPSHOT_FILE),
-    source: join11("iterations", compass.id, "delivery-compass.md"),
+    file: join13("workflows", compass.id, WORKFLOW_SNAPSHOT_FILE),
+    source: join13("iterations", compass.id, "delivery-compass.md"),
     data: snapshot
   };
 }
@@ -2943,7 +3588,7 @@ function buildStandaloneSnapshot(row, rootUpdatedAt, migrationNotes) {
     id,
     type: "plan",
     status,
-    file: join11("workflows", id, WORKFLOW_SNAPSHOT_FILE),
+    file: join13("workflows", id, WORKFLOW_SNAPSHOT_FILE),
     source: "status.json plans[] row",
     data: snapshot
   };
@@ -2973,10 +3618,10 @@ function applyRootMetadataLift(snapshot, metadata, migrationNotes, activeIterati
   if (typeof metadata.control_worktree_path === "string" && metadata.control_worktree_path !== "") {
     data.control_worktree_path = metadata.control_worktree_path;
   }
-  if (isPlainObject6(metadata.integration_merge_lease)) {
+  if (isPlainObject7(metadata.integration_merge_lease)) {
     data.integration_merge_lease = metadata.integration_merge_lease;
   }
-  const legacyMetadata = isPlainObject6(data.legacy_metadata) ? { ...data.legacy_metadata } : {};
+  const legacyMetadata = isPlainObject7(data.legacy_metadata) ? { ...data.legacy_metadata } : {};
   for (const [key, value] of Object.entries(metadata)) {
     if (key === "harness_root")
       continue;
@@ -3032,7 +3677,7 @@ function buildRegister(residualFindings, byPlan, projectId, migratedAt) {
     const raw = residualFindings[planId];
     if (!Array.isArray(raw))
       continue;
-    const open = raw.filter((entry) => isPlainObject6(entry) && isOpenResidual(entry)).sort((a, b) => {
+    const open = raw.filter((entry) => isPlainObject7(entry) && isOpenResidual(entry)).sort((a, b) => {
       const aId = typeof a.id === "string" ? a.id : "";
       const bId = typeof b.id === "string" ? b.id : "";
       return compareIds(aId, bId);
@@ -3051,7 +3696,7 @@ function buildRegister(residualFindings, byPlan, projectId, migratedAt) {
     return null;
   const doc = { entries };
   return {
-    file: join11("projects", projectId, PROJECT_REGISTER_FILE),
+    file: join13("projects", projectId, PROJECT_REGISTER_FILE),
     source: "status.json residual_findings",
     data: doc
   };
@@ -3082,7 +3727,7 @@ function collectNotesFiles(snapshots) {
     if (lines.length === 0)
       continue;
     out.push({
-      file: join11(dirname7(snapshot.file), NOTES_LEDGER_FILE),
+      file: join13(dirname8(snapshot.file), NOTES_LEDGER_FILE),
       source,
       lines
     });
@@ -3090,11 +3735,11 @@ function collectNotesFiles(snapshots) {
   return out;
 }
 function migrateHarnessTree(root, opts = {}) {
-  const harnessDir = resolve10(root);
+  const harnessDir = resolve11(root);
   const workflowDir = resolveWorkflowDir(harnessDir, { harnessDir });
   const projectDir = resolveProjectDir(harnessDir, { harnessDir });
   const projectId = opts.projectId ?? _DEFAULT_PROJECT;
-  const statusPath = join11(harnessDir, MIGRATE_STATUS_FILE);
+  const statusPath = join13(harnessDir, MIGRATE_STATUS_FILE);
   const legacy = readJson(statusPath);
   if (legacy.version === 2) {
     const updatedAt = typeof legacy.updated_at === "string" && legacy.updated_at !== "" ? legacy.updated_at : "1970-01-01";
@@ -3121,12 +3766,12 @@ function migrateHarnessTree(root, opts = {}) {
   if (legacy.version === undefined) {
     throw new Error(`refusing to migrate: no v1 status.json found at ${statusPath} (nothing to migrate)`);
   }
-  const rows = Array.isArray(legacy.plans) ? legacy.plans.filter(isPlainObject6) : [];
+  const rows = Array.isArray(legacy.plans) ? legacy.plans.filter(isPlainObject7) : [];
   if (Array.isArray(legacy.plans)) {
     const unLiftable = [];
     const idCounts = new Map;
     for (const row of legacy.plans) {
-      if (!isPlainObject6(row) || rowIdOf(row) === null) {
+      if (!isPlainObject7(row) || rowIdOf(row) === null) {
         unLiftable.push(row);
         continue;
       }
@@ -3142,7 +3787,7 @@ function migrateHarnessTree(root, opts = {}) {
       throw new Error(`refusing to migrate: ${duplicates.length} duplicate plan id(s) (${duplicates.join(", ")}) — every v1 row must land in exactly one snapshot`);
     }
   }
-  const metadata = isPlainObject6(legacy.metadata) ? legacy.metadata : {};
+  const metadata = isPlainObject7(legacy.metadata) ? legacy.metadata : {};
   const rootUpdatedAt = dateString(legacy.updated_at) ?? dateString(metadata.updated_at) ?? todayString3();
   const migratedAt = dateString(metadata.updated_at) ?? rootUpdatedAt;
   const migrationNotes = [];
@@ -3179,9 +3824,9 @@ function migrateHarnessTree(root, opts = {}) {
     migrationNotes.push("no active iteration snapshot found — root metadata execution-policy/branch keys have no lift home and stay unmapped (visible here, not silently dropped)");
   }
   const notesFiles = collectNotesFiles(snapshots);
-  const residualFindings = isPlainObject6(legacy.residual_findings) ? legacy.residual_findings : {};
+  const residualFindings = isPlainObject7(legacy.residual_findings) ? legacy.residual_findings : {};
   const register = buildRegister(residualFindings, byPlan, projectId, migratedAt);
-  const programRoadmap = isPlainObject6(metadata.program_roadmap) ? metadata.program_roadmap : null;
+  const programRoadmap = isPlainObject7(metadata.program_roadmap) ? metadata.program_roadmap : null;
   let roadmap = null;
   if (programRoadmap) {
     const rawTitle = typeof programRoadmap.title === "string" && programRoadmap.title !== "" ? programRoadmap.title : "Program roadmap";
@@ -3190,7 +3835,7 @@ function migrateHarnessTree(root, opts = {}) {
       migrationNotes.push(`roadmap title sanitized for frontmatter (line breaks replaced with spaces): ${JSON.stringify(rawTitle)}`);
     }
     roadmap = {
-      file: join11("projects", projectId, PROJECT_ROADMAP_FILE),
+      file: join13("projects", projectId, PROJECT_ROADMAP_FILE),
       source: "status.json metadata.program_roadmap",
       content: buildRoadmap({ ...programRoadmap, title: sanitizedTitle }, projectId, migratedAt)
     };
@@ -3239,19 +3884,19 @@ async function applyMigratePlan(plan) {
   if (plan.dryRun) {
     return { applied: false, message: `dry-run: ${plan.steps.length} steps planned (source → destination), zero writes` };
   }
-  const statusPath = join11(plan.root, MIGRATE_STATUS_FILE);
+  const statusPath = join13(plan.root, MIGRATE_STATUS_FILE);
   const current = readJson(statusPath);
   if (current.version === 2) {
     return { applied: false, message: "no-op: status.json already at schema version 2 (migrated) — nothing to do" };
   }
-  const harnessRoot = resolve10(plan.root);
-  const workflowRoot = resolve10(plan.workflowDir);
-  const projectRoot = resolve10(plan.projectDir);
+  const harnessRoot = resolve11(plan.root);
+  const workflowRoot = resolve11(plan.workflowDir);
+  const projectRoot = resolve11(plan.projectDir);
   if (!isAbsolute7(plan.workflowDir) || !isAbsolute7(plan.projectDir)) {
     throw new Error(`refusing to apply migration: plan workflowDir/projectDir must be absolute (got ${JSON.stringify(plan.workflowDir)} / ${JSON.stringify(plan.projectDir)})`);
   }
-  const workflowTargetOf = (canonicalFile) => join11(workflowRoot, relative3("workflows", canonicalFile));
-  const projectTargetOf = (canonicalFile) => join11(projectRoot, relative3("projects", canonicalFile));
+  const workflowTargetOf = (canonicalFile) => join13(workflowRoot, relative5("workflows", canonicalFile));
+  const projectTargetOf = (canonicalFile) => join13(projectRoot, relative5("projects", canonicalFile));
   const allDestinations = [
     plan.archive.file,
     ...plan.snapshots.map((snapshot) => snapshot.file),
@@ -3260,20 +3905,20 @@ async function applyMigratePlan(plan) {
     ...plan.roadmap !== null ? [plan.roadmap.file] : []
   ];
   for (const destination of allDestinations) {
-    const resolvedDest = resolve10(join11(plan.root, destination));
+    const resolvedDest = resolve11(join13(plan.root, destination));
     const inside = (dir) => resolvedDest === dir || resolvedDest.startsWith(`${dir}${sep2}`);
     if (!inside(harnessRoot) && !inside(workflowRoot) && !inside(projectRoot)) {
       throw new Error(`refusing to apply migration: destination escapes the harness dir (${JSON.stringify(destination)}) — every write must stay under ${JSON.stringify(plan.root)}, the workflow dir (${JSON.stringify(plan.workflowDir)}) or the project dir (${JSON.stringify(plan.projectDir)})`);
     }
   }
-  mkdirSync7(join11(plan.root, dirname7(plan.archive.file)), { recursive: true });
-  copyFileSync(statusPath, join11(plan.root, plan.archive.file));
+  mkdirSync7(join13(plan.root, dirname8(plan.archive.file)), { recursive: true });
+  copyFileSync(statusPath, join13(plan.root, plan.archive.file));
   for (const snapshot of plan.snapshots) {
-    await writeWorkflowSnapshot(snapshot.data, dirname7(workflowTargetOf(snapshot.file)));
+    await writeWorkflowSnapshot(snapshot.data, dirname8(workflowTargetOf(snapshot.file)));
   }
   for (const notes of plan.notesFiles) {
     const filePath = workflowTargetOf(notes.file);
-    mkdirSync7(dirname7(filePath), { recursive: true });
+    mkdirSync7(dirname8(filePath), { recursive: true });
     const content = notes.lines.length > 0 ? `${notes.lines.join(`
 `)}
 ` : "";
@@ -3286,13 +3931,13 @@ async function applyMigratePlan(plan) {
     }
     if (Object.keys(plan.register.data.entries ?? {}).length > 0) {
       const filePath = projectTargetOf(plan.register.file);
-      mkdirSync7(dirname7(filePath), { recursive: true });
+      mkdirSync7(dirname8(filePath), { recursive: true });
       writeJson(filePath, plan.register.data);
     }
   }
   if (plan.roadmap !== null) {
     const filePath = projectTargetOf(plan.roadmap.file);
-    mkdirSync7(dirname7(filePath), { recursive: true });
+    mkdirSync7(dirname8(filePath), { recursive: true });
     writeFileSync5(filePath, plan.roadmap.content, "utf8");
   }
   const rootGate = validateStatusV2(plan.rootV2.data, { harnessDir: plan.root });
@@ -3716,8 +4361,8 @@ function completenessLevel(frontmatterText, checklist) {
 }
 // src/audit.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync8, mkdirSync as mkdirSync8, readdirSync as readdirSync8, readFileSync as readFileSync9, rmdirSync as rmdirSync2, rmSync, writeFileSync as writeFileSync6 } from "node:fs";
-import { basename as basename5, join as join12, resolve as resolve11, sep as sep3 } from "node:path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readdirSync as readdirSync8, readFileSync as readFileSync9, rmdirSync as rmdirSync2, rmSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { basename as basename6, join as join14, resolve as resolve12, sep as sep3 } from "node:path";
 function violation9(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
@@ -4018,7 +4663,7 @@ function scanSecrets(files) {
       unreadableFiles++;
       continue;
     }
-    const base = basename5(file);
+    const base = basename6(file);
     for (const entry of NEVER_COMMIT_FILENAMES) {
       if (entry.re.test(base))
         findings.push({ file, line: 1, type: entry.type });
@@ -4075,7 +4720,7 @@ function rootLockfiles(root) {
     return [];
   }
   const names = new Set(LOCKFILE_NAMES);
-  const present = entries.filter((entry) => entry.isFile() && names.has(entry.name)).map((entry) => join12(root, entry.name));
+  const present = entries.filter((entry) => entry.isFile() && names.has(entry.name)).map((entry) => join14(root, entry.name));
   if (present.length === 0)
     return [];
   try {
@@ -4084,7 +4729,7 @@ function rootLockfiles(root) {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).split("\x00").filter((f) => f !== ""));
-    return present.filter((p) => tracked.has(basename5(p)));
+    return present.filter((p) => tracked.has(basename6(p)));
   } catch {
     return present;
   }
@@ -4100,7 +4745,7 @@ function supplyChainChecks(repoRoot) {
     findings.push({ kind: "lockfile-duplicate", file: lockfiles.map((f) => f.replace(`${repoRoot}/`, "")).join(", ") });
     violations.push(violation9("medium", "audit.supply.lockfile-duplicate", `multiple lockfiles at ${repoRoot}: ${lockfiles.join(", ")}`, "keep exactly one lockfile per package manager"));
   }
-  const workflowsDir = join12(repoRoot, ".github", "workflows");
+  const workflowsDir = join14(repoRoot, ".github", "workflows");
   let wfEntries = [];
   try {
     wfEntries = readdirSync8(workflowsDir, { withFileTypes: true });
@@ -4110,7 +4755,7 @@ function supplyChainChecks(repoRoot) {
   for (const entry of wfEntries) {
     if (!entry.isFile() || !/\.(?:ya?ml)$/.test(entry.name))
       continue;
-    const wfPath = join12(workflowsDir, entry.name);
+    const wfPath = join14(workflowsDir, entry.name);
     const relPath = `.github/workflows/${entry.name}`;
     let text;
     try {
@@ -4267,8 +4912,8 @@ function scaffoldAuditPlan(outDir, findings, options = {}) {
   const date = options.date ?? new Date().toISOString().slice(0, 10);
   const plannedAt = options.plannedAt ?? { commit: options.repoShortSha ?? "unknown", date };
   mkdirSync8(outDir, { recursive: true });
-  const existingReadme = join12(outDir, "README.md");
-  const carried = existsSync8(existingReadme) ? extractSecurityDispositionSections(readFileSync9(existingReadme, "utf8")) : { needsVerification: [], hardeningChecked: [] };
+  const existingReadme = join14(outDir, "README.md");
+  const carried = existsSync9(existingReadme) ? extractSecurityDispositionSections(readFileSync9(existingReadme, "utf8")) : { needsVerification: [], hardeningChecked: [] };
   const existing = readdirSync8(outDir).filter((f) => /^\d{3}-.*\.md$/.test(f));
   let next = existing.reduce((max, f) => Math.max(max, Number(f.slice(0, 3))), 0) + 1;
   const redactedFindings = findings.map(redactFinding);
@@ -4285,13 +4930,13 @@ function scaffoldAuditPlan(outDir, findings, options = {}) {
     }
     usedSlugs.add(slug);
     const file = `${num}-${slug}.md`;
-    writeFileSync6(join12(outDir, file), renderPlanFile(finding, plannedAt));
+    writeFileSync6(join14(outDir, file), renderPlanFile(finding, plannedAt));
     written.push(file);
     next++;
   }
   const all = [...existing, ...written].sort();
   const rows = all.map((file) => {
-    const summary = readPlanFileSummary(join12(outDir, file));
+    const summary = readPlanFileSummary(join14(outDir, file));
     const fields = summary.fields;
     return {
       num: file.slice(0, 3),
@@ -4325,7 +4970,7 @@ function scaffoldAuditPlan(outDir, findings, options = {}) {
   });
   const needsVerificationLines = options.needsVerification !== undefined ? options.needsVerification.map((nv) => `- ${escapeCell(redactText(nv.lead))}: ${escapeCell(redactText(nv.how))}${nv.evidence ? ` (${escapeCell(redactText(nv.evidence))})` : ""}`) : carried.needsVerification;
   const hardeningCheckedLines = options.hardeningChecked !== undefined ? options.hardeningChecked.map((hc) => `- ${hc.kind}: ${escapeCell(redactText(hc.text))}`) : carried.hardeningChecked;
-  writeFileSync6(join12(outDir, "README.md"), renderIndex({
+  writeFileSync6(join14(outDir, "README.md"), renderIndex({
     date,
     repoName: options.repoName ?? "repo",
     repoShortSha: options.repoShortSha ?? "unknown",
@@ -4334,7 +4979,7 @@ function scaffoldAuditPlan(outDir, findings, options = {}) {
     needsVerification: needsVerificationLines,
     hardeningChecked: hardeningCheckedLines
   }));
-  return { outDir: resolve11(outDir), date, files: written, nextNumber: next };
+  return { outDir: resolve12(outDir), date, files: written, nextNumber: next };
 }
 async function promoteAuditPlans(outDir, selected, options) {
   if (selected.length === 0) {
@@ -4343,19 +4988,19 @@ async function promoteAuditPlans(outDir, selected, options) {
   if (typeof options.harnessDir !== "string" || options.harnessDir.trim() === "") {
     throw new Error("promoteAuditPlans: options.harnessDir is required (must contain status.json + workflows/)");
   }
-  const workflowId = options.workflowId ?? basename5(resolve11(outDir));
+  const workflowId = options.workflowId ?? basename6(resolve12(outDir));
   assertSafePathComponent(workflowId, "workflow id");
-  const harnessDir = resolve11(options.harnessDir);
-  const statusPath = join12(harnessDir, "status.json");
-  const workflowDir = join12(harnessDir, "workflows", workflowId);
-  const snapshotPath = join12(workflowDir, WORKFLOW_SNAPSHOT_FILE);
+  const harnessDir = resolve12(options.harnessDir);
+  const statusPath = join14(harnessDir, "status.json");
+  const workflowDir = join14(harnessDir, "workflows", workflowId);
+  const snapshotPath = join14(workflowDir, WORKFLOW_SNAPSHOT_FILE);
   const planFiles = resolveSelectedPlanFiles(outDir, selected);
   const indexRows = readExecutionOrderIndex(outDir);
   const plans = planFiles.map((planFile) => {
     const stem = planFile.replace(/\.md$/, "");
     const num = stem.slice(0, 3);
     const indexRow = indexRows.get(num);
-    const title = indexRow?.title ?? readPlanFileSummary(join12(outDir, planFile)).title;
+    const title = indexRow?.title ?? readPlanFileSummary(join14(outDir, planFile)).title;
     return {
       id: stem,
       title,
@@ -4384,7 +5029,7 @@ async function promoteAuditPlans(outDir, selected, options) {
     throw new Error(`refusing to register invalid workflow entry: ${entryGate.violations.map((v) => v.message).join("; ")}`);
   }
   await withStatusWriteLock(statusPath, async () => {
-    if (existsSync8(snapshotPath)) {
+    if (existsSync9(snapshotPath)) {
       throw new Error(`refusing to promote audit plans: workflow ${JSON.stringify(workflowId)} already exists ` + `(snapshot at ${snapshotPath}) — re-promote would drop its registered plan rows; ` + `remove that workflow before promoting again`);
     }
     mkdirSync8(workflowDir, { recursive: true });
@@ -4420,7 +5065,7 @@ function resolveSelectedPlanFiles(outDir, selected) {
   for (const id of selected) {
     const file = byNum.get(id) ?? byStem.get(id) ?? byStem.get(id.replace(/\.md$/, ""));
     if (file === undefined) {
-      throw new Error(`promoteAuditPlans: selected plan ${JSON.stringify(id)} does not match any NNN-*.md file in ${resolve11(outDir)}`);
+      throw new Error(`promoteAuditPlans: selected plan ${JSON.stringify(id)} does not match any NNN-*.md file in ${resolve12(outDir)}`);
     }
     if (!seen.has(file)) {
       seen.add(file);
@@ -4430,7 +5075,7 @@ function resolveSelectedPlanFiles(outDir, selected) {
   return resolved;
 }
 function readExecutionOrderIndex(outDir) {
-  const readmePath = join12(outDir, "README.md");
+  const readmePath = join14(outDir, "README.md");
   let text;
   try {
     text = readFileSync9(readmePath, "utf8");
@@ -4459,7 +5104,7 @@ function readExecutionOrderIndex(outDir) {
   return rows;
 }
 function planFileRel(outDir, planFile) {
-  const resolved = resolve11(outDir);
+  const resolved = resolve12(outDir);
   const parts = resolved.split(sep3);
   const plansIdx = parts.lastIndexOf("plans");
   if (plansIdx >= 0) {
@@ -4468,8 +5113,8 @@ function planFileRel(outDir, planFile) {
   return planFile;
 }
 // src/compound.ts
-import { existsSync as existsSync9, readdirSync as readdirSync9, readFileSync as readFileSync10 } from "node:fs";
-import { basename as basename6, isAbsolute as isAbsolute8, join as join13, relative as relative4, resolve as resolve12, sep as sep4 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync9, readFileSync as readFileSync10 } from "node:fs";
+import { basename as basename7, isAbsolute as isAbsolute8, join as join15, relative as relative6, resolve as resolve13, sep as sep4 } from "node:path";
 function violation10(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
@@ -4764,7 +5409,7 @@ function referenceExists(repoRoot, docText) {
           break;
         if (entry.isDirectory()) {
           if (!WALK_SKIP_DIRS.has(entry.name))
-            stack.push(join13(dir, entry.name));
+            stack.push(join15(dir, entry.name));
         } else if (!entry.isSymbolicLink()) {
           const base = entry.name.replace(/\.(?:ts|tsx|js|jsx|mjs|cjs)$/, "");
           if (moduleNames.has(base))
@@ -4776,7 +5421,7 @@ function referenceExists(repoRoot, docText) {
   for (const { ref, isSymbol, module } of refs) {
     if (!isSymbol || module === undefined) {
       const candidate = ref.replace(LINE_SUFFIX_RE, "").replace(ANCHOR_RE, "");
-      if (existsSync9(resolve12(repoRoot, candidate))) {
+      if (existsSync10(resolve13(repoRoot, candidate))) {
         checked++;
       } else {
         violations.push(violation10("medium", "compound.reference.missing-file", `referenced path \`${ref}\` does not exist under ${repoRoot} (compound-refresh Phase 2: referenced code still exists?)`, "update the doc to reference an existing path, or delete the stale reference"));
@@ -4803,11 +5448,11 @@ function collectKnowledgeDocs(dir) {
     for (const entry of entries) {
       if (entry.isSymbolicLink())
         continue;
-      const full = join13(current, entry.name);
+      const full = join15(current, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
       } else if (entry.name.endsWith(".md") && entry.name !== "README.md" && entry.name !== "index.md") {
-        docs.push(relative4(dir, full).split(sep4).join("/"));
+        docs.push(relative6(dir, full).split(sep4).join("/"));
       }
     }
   }
@@ -4823,8 +5468,8 @@ function normalizeIndexRef(cell) {
 }
 function assertIndexRows(knowledgeDir) {
   const violations = [];
-  const readmePath = join13(knowledgeDir, "README.md");
-  if (!existsSync9(readmePath)) {
+  const readmePath = join15(knowledgeDir, "README.md");
+  if (!existsSync10(readmePath)) {
     violations.push(violation10("medium", "compound.index.missing-readme", `missing ${readmePath} — the knowledge index is required (mstar-compound Phase 6: every doc gets a README.md row)`, "create knowledge/README.md with a Document / Source Plan / Description / Status table"));
     return { ok: false, violations };
   }
@@ -4849,19 +5494,19 @@ function assertIndexRows(knowledgeDir) {
 }
 function compoundRefreshScope(harnessDir, projectRoot) {
   return [
-    join13(harnessDir, "knowledge"),
-    join13(harnessDir, "knowledge", "README.md"),
-    join13(projectRoot, "CONCEPTS.md"),
-    join13(harnessDir, "status.json")
+    join15(harnessDir, "knowledge"),
+    join15(harnessDir, "knowledge", "README.md"),
+    join15(projectRoot, "CONCEPTS.md"),
+    join15(harnessDir, "status.json")
   ];
 }
 function isFileLikeRoot(root) {
-  return /^[^.]*\.[A-Za-z0-9]{1,10}$/.test(basename6(root));
+  return /^[^.]*\.[A-Za-z0-9]{1,10}$/.test(basename7(root));
 }
 function scopeGuard(path, allowedRoots) {
-  const resolved = resolve12(path);
+  const resolved = resolve13(path);
   for (const root of allowedRoots) {
-    const r = resolve12(root);
+    const r = resolve13(root);
     if (isFileLikeRoot(r)) {
       if (resolved === r)
         return { ok: true, violations: [] };
@@ -4920,7 +5565,7 @@ function findTemporaryMarkers(fileText) {
     }
     markers.push({ line: i + 1, text, removalPath });
     if (removalPath === null) {
-      violations.push(violation11("medium", "lint.temporary.no-removal-path", `temporary marker at line ${i + 1} records no removal path (plan/status artifact reference) — record one before claiming the task complete (mstar-coding-behavior § Simplification markers)`, 'add a plan/status reference to the marker, e.g. "removal tracked in status.json" or "plan 20260808-slice2 removes this"'));
+      violations.push(violation11("medium", "lint.temporary.no-removal-path", `temporary marker at line ${i + 1} records no removal path (plan/status artifact reference) — record one before claiming the task complete (mstar-coding-behavior § Simplification markers)`, 'add a plan/status reference to the marker, e.g. "removal tracked in status.json" or "plan 20991231-example-plan removes this"'));
     }
   }
   return { ok: violations.length === 0, violations, markers };
@@ -5109,8 +5754,8 @@ function lintStrategySections(docText) {
   return { ok: violations.length === 0, violations };
 }
 // src/roles.ts
-import { existsSync as existsSync10 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join16 } from "node:path";
 function violation12(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
 }
@@ -5166,8 +5811,8 @@ function validateRoleMapping(rolesDir, options = {}) {
   const violations = [];
   const referenceById = new Map(mapping.map((m) => [m.agentId, m.reference]));
   for (const { agentId, reference } of mapping) {
-    if (!existsSync10(join14(rolesDir, reference))) {
-      violations.push(violation12("medium", "roles.mapping.reference.missing", `role "${agentId}" maps to ${reference} which does not exist under ${rolesDir} (mstar-roles § Role Reference Mapping)`, `create ${join14(rolesDir, reference)} or fix the mapping row`));
+    if (!existsSync11(join16(rolesDir, reference))) {
+      violations.push(violation12("medium", "roles.mapping.reference.missing", `role "${agentId}" maps to ${reference} which does not exist under ${rolesDir} (mstar-roles § Role Reference Mapping)`, `create ${join16(rolesDir, reference)} or fix the mapping row`));
     }
   }
   for (const { family, memberIds } of families) {
@@ -5219,6 +5864,14 @@ function validateRoleMapping(rolesDir, options = {}) {
   return { ok: violations.length === 0, violations };
 }
 var LOAD_ORDER_HEADING_RE = /^#{1,6}\s+[^\r\n]*\b(?:load[\s-]*order|first\s+action)\b[^\r\n]*$/i;
+var HUB_BOOTSTRAP_ASSERTIONS = [
+  { marker: "identity-first", why: "identity boundary before any skill list" },
+  { marker: "skill presets", why: "Assignment Skill presets decision field" },
+  { marker: "none", why: "explicit none => identity only, no optional topic preset" },
+  { marker: "standard", why: "omitted on a substantive round => standard preset" },
+  { marker: "role-owned", why: "role-owned methods / evidence obligations load regardless of preset" },
+  { marker: "unknown preset", why: "unknown preset / missing identity => Needs Context / Blocked, never infer PM" }
+];
 function extractLoadOrderSection(text) {
   const lines = text.split(/\r?\n/);
   let start = -1;
@@ -5252,11 +5905,22 @@ function lintLoadOrder(skillTexts) {
       continue;
     const section = extractLoadOrderSection(text);
     if (section === null) {
-      violations.push(violation12("medium", "roles.loadorder.section.missing", `skill "${name}" has no Load Order / First action section — every mstar-* topic skill must declare its first read (mstar-harness-core § 加载约定; mstar-roles § Load Order (Required))`, `add a "## Load Order" section naming mstar-harness-core as the first read`));
+      violations.push(violation12("medium", "roles.loadorder.section.missing", `skill "${name}" has no Load Order / First action section — every mstar-* topic skill must declare its first read (mstar-harness-core § 加载契约; mstar-roles § Load Order = single load-selection authority)`, `add a "## Load Order" section: topics name mstar-harness-core first; mstar-roles declares the Skill presets decision matrix`));
+      continue;
+    }
+    if (name === "mstar-roles") {
+      const lower = section.toLowerCase();
+      const missing = HUB_BOOTSTRAP_ASSERTIONS.filter((a) => !lower.includes(a.marker.toLowerCase()));
+      if (missing.length > 0) {
+        violations.push(violation12("medium", "roles.loadorder.hub.bootstrap.missing", `skill "${name}" Load Order section is missing the hub bootstrap decision matrix: ${missing.map((m) => `"${m.marker}" (${m.why})`).join("; ")} (mstar-roles § Load Order = single load-selection authority)`, "declare identity-first, the Skill presets none/standard decision, role-owned methods, and the unknown-preset / missing-identity refusal in the Load Order section"));
+      }
+      if (!section.includes("mstar-harness-core")) {
+        violations.push(violation12("medium", "roles.loadorder.core.missing", `skill "${name}" Load Order section does not point at mstar-harness-core — the hub bootstrap is exempt from core-first, but core remains the lifecycle/authorization conflict authority and global entry whenever loaded`, "keep the conditional mstar-harness-core pointer (global entry / conflict authority) in the Load Order section"));
+      }
       continue;
     }
     if (!section.includes("mstar-harness-core")) {
-      violations.push(violation12("medium", "roles.loadorder.core.missing", `skill "${name}" Load Order section does not declare mstar-harness-core as its first dependency (mstar-harness-core § 加载约定: 凡 mstar-*（name ≠ mstar-harness-core）假定读者已 Read 本 skill)`, "name mstar-harness-core first in the Load Order section"));
+      violations.push(violation12("medium", "roles.loadorder.core.missing", `skill "${name}" Load Order section does not declare mstar-harness-core as its first dependency (mstar-harness-core § 加载契约: directly-invoked topics keep core as first dependency; the mstar-roles hub bootstrap is the only exception)`, "name mstar-harness-core first in the Load Order section"));
     }
   }
   return { ok: violations.length === 0, violations };
@@ -5338,6 +6002,16 @@ function collectHeadings(bodyText) {
   }
   return headings;
 }
+function classifySkillLint(skillId) {
+  const id = skillId ?? "";
+  if (id === "mstar-harness-core")
+    return { kind: "core", mode: null };
+  if (id === "mstar-skill-authoring")
+    return { kind: "authoring", mode: "authoring" };
+  if (id.startsWith("mstar-"))
+    return { kind: "runtime", mode: "runtime" };
+  return { kind: "authoring", mode: "authoring" };
+}
 var RUNTIME_HEADING_ALIASES = {
   workflow: ["process", "playbook"],
   "decision-rules": [
@@ -5373,7 +6047,7 @@ function resolveAssetPath(skillName, relPath, host) {
 }
 // src/prreview.ts
 import { readdirSync as readdirSync10 } from "node:fs";
-import { isAbsolute as isAbsolute9, join as join15 } from "node:path";
+import { isAbsolute as isAbsolute9, join as join17 } from "node:path";
 var MERGE_CLASSES = ["must-fix", "should-fix", "nit"];
 var PR_VERDICTS = ["ship it", "needs fixes", "blocked"];
 var REVIEW_EMOJI = {
@@ -5413,7 +6087,7 @@ function computePrTally(input) {
 var REVIEW_SCHEMA_ID = "mstar.review/v1";
 var INSPECTOR_VERDICTS = ["comment", "request_changes", "approve"];
 var INSPECTOR_SEVERITIES = ["critical", "warning", "suggestion", "info"];
-function isPlainObject7(value) {
+function isPlainObject8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var TALLY_COUNT_KEYS = ["mustFix", "shouldFix", "nit", "unverified"];
@@ -5424,7 +6098,7 @@ function checkProvidedTallyShape(tally, violations) {
   if (typeof tally.scorePct !== "number" || !Number.isInteger(tally.scorePct) || tally.scorePct < 0 || tally.scorePct > 100) {
     violations.push(violation14("high", "review.tally-malformed", `tally.scorePct must be an integer in [0, 100] - got ${String(tally.scorePct)}`));
   }
-  if (!isPlainObject7(tally.tally)) {
+  if (!isPlainObject8(tally.tally)) {
     violations.push(violation14("high", "review.tally-malformed", "tally.tally must be an object carrying the four class counts"));
   } else {
     for (const key of TALLY_COUNT_KEYS) {
@@ -5440,7 +6114,7 @@ function checkProvidedTallyShape(tally, violations) {
 }
 function validateMstarReviewV1(doc) {
   const violations = [];
-  if (!isPlainObject7(doc)) {
+  if (!isPlainObject8(doc)) {
     return {
       ok: false,
       violations: [violation14("high", "review.not-object", "review document must be a JSON object")]
@@ -5467,7 +6141,7 @@ function validateMstarReviewV1(doc) {
     violations.push(violation14("high", "review.findings-not-array", "findings must be an array"));
   } else {
     doc.findings.forEach((finding, index) => {
-      if (!isPlainObject7(finding)) {
+      if (!isPlainObject8(finding)) {
         violations.push(violation14("high", "review.invalid-finding", `findings[${index}] must be an object`));
         return;
       }
@@ -5507,7 +6181,7 @@ function validateMstarReviewV1(doc) {
     });
   }
   if (doc.tally !== undefined) {
-    if (!isPlainObject7(doc.tally)) {
+    if (!isPlainObject8(doc.tally)) {
       violations.push(violation14("high", "review.invalid-tally", "tally must be a PrTallyResult object"));
     } else {
       checkProvidedTallyShape(doc.tally, violations);
@@ -5517,7 +6191,7 @@ function validateMstarReviewV1(doc) {
     }
   }
   if (doc.target !== undefined) {
-    if (!isPlainObject7(doc.target)) {
+    if (!isPlainObject8(doc.target)) {
       violations.push(violation14("high", "review.invalid-target", "target must be an object"));
     } else {
       if (doc.target.owner !== undefined && typeof doc.target.owner !== "string") {
@@ -5629,7 +6303,7 @@ function prReviewReportPath(opts) {
   }
   const revision = maxRevision + 1;
   const name = revision === 1 ? `${finalStem}.md` : `${finalStem}-r${revision}.md`;
-  return join15(opts.reportsDir, name);
+  return join17(opts.reportsDir, name);
 }
 var PR_TIERS = ["quick", "default", "deep"];
 function violation14(severity, code, message, fix) {
@@ -5946,7 +6620,7 @@ function prReviewSeatPrompt(opts) {
   lines.push("");
   lines.push("## Read first");
   lines.push("");
-  const prReviewRef = join15(skillRoot, "references", "pr-review.md");
+  const prReviewRef = join17(skillRoot, "references", "pr-review.md");
   const sections = opts.stage === 1 ? tier === "quick" ? "Scoping, Evidence rules" : "Review pipeline, Worktree isolation, Scoping, Evidence rules" : "Merge class, Attack and vet, Evidence rules, Sizing & change shape";
   lines.push(`1. \`${prReviewRef}\` — read at least these sections: ${sections}.`);
   lines.push(`2. The review worktree: \`${worktreePath}\` — your ONLY working directory this session; read-only (no edits, no fixes, no stash, no commits, no posts).`);
@@ -5954,9 +6628,9 @@ function prReviewSeatPrompt(opts) {
     lines.push(`- Read the pinned diff snapshot FIRST: \`${opts.diffFile}\` — it is the review's diff basis (already computed at setup); read it before opening files.`);
   }
   if (opts.stage === 2) {
-    lines.push(`3. \`${join15(skillRoot, "references", "finding-format.md")}\` — the template every finding follows.`);
+    lines.push(`3. \`${join17(skillRoot, "references", "finding-format.md")}\` — the template every finding follows.`);
     if (opts.securitySeat === true) {
-      lines.push(`4. \`${join15(skillRoot, "references", "security-review.md")}\` — the security lens.`);
+      lines.push(`4. \`${join17(skillRoot, "references", "security-review.md")}\` — the security lens.`);
     }
   }
   const budget = PR_REVIEW_TIER_BUDGETS[tier];
@@ -6154,6 +6828,7 @@ export {
   KNOWLEDGE_REQUIRED_FIELDS,
   KNOWLEDGE_RESOLUTION_TYPES,
   KNOWLEDGE_SEVERITIES,
+  MAX_STATUS_CONTENT_LENGTH,
   MERGE_CLASSES,
   MIGRATE_STATUS_FILE,
   MSTARC_FILE,
@@ -6198,7 +6873,10 @@ export {
   assertTriIdentity,
   assignmentHeaderRegion,
   canSteal,
+  canonicalizeNearestExisting,
+  checkSddAction,
   claimLease,
+  classifySkillLint,
   closeProjectRegisterEntry,
   completenessLevel,
   composeDispatchGate,
@@ -6209,14 +6887,18 @@ export {
   detectHost,
   emitGitignoreSnippet,
   evaluatePhaseGate,
+  eventTargetPaths,
   executionModeToN,
   findEphemeralCitations,
   findMstarc,
   findSimplifyMarkers,
   findTemporaryMarkers,
   findingsCleanupGate,
+  formatStatusWriteBlockReason,
   getArtifactStore,
+  harnessDocKindOfTarget,
   implementerSessionStickyRules,
+  isDistinctCheckout,
   isReadOnlyAssignmentRole,
   l1PreDispatchCheck,
   l2PreDispatchCheck,
@@ -6245,6 +6927,7 @@ export {
   prReviewSeatPrompt,
   prReviewSizing,
   preflightChangeset,
+  probeCheckoutRoot,
   promoteAuditPlans,
   pushCadenceProbe,
   readHarnessVersion,
@@ -6267,10 +6950,12 @@ export {
   resolveRepoEnforcement,
   resolveScaffoldDirs,
   resolveSddDir,
+  resolveSddExecutionContext,
   resolveSkillRoot,
   resolveSpecsDir,
   resolveWorkflowDir,
   reviewPackage,
+  runInSddContext,
   sameHolderResume,
   scaffoldAuditPlan,
   scaffoldHarness,
@@ -6304,9 +6989,11 @@ export {
   validateSchemaYaml,
   validateStatus,
   validateStatusV2,
+  validateStatusWriteDoc,
   validateWorkflowEntry,
   validateWorkflowSnapshot,
   verifyPlanExecutionLease,
+  violationLine,
   withStatusWriteLock,
   writeJson,
   writeWorkflowSnapshot