@nurix/etna 0.16.0 → 0.17.1

package/data/harnesses/code-fable/agents/maintenance.md

@@ -1,6 +1,6 @@
 ---
 name: maintenance
-description: Docs-vs-code coherence audit. Detects and fixes docs drifting from code — stale docs, broken ownership, routing table drift, unowned source paths. Run weekly or after major changes. Contract violations (code drifting from docs) are handled by the `boundary` skill (`init` mode); pre-implementation impact checks by its `check` mode.
+description: Docs-vs-code coherence audit. Detects and fixes docs drifting from code — stale docs, broken ownership, routing table drift, unowned source paths. Run weekly or after major changes. Cross-cutting contract analysis is the `boundary` skill (`check` for plans, `scan` for diffs) — it derives contracts dynamically from source; there are no persisted boundary docs to audit.
 tools: Read, Glob, Grep, Edit, Write, Bash
 model: inherit
 ---
@@ -9,14 +9,14 @@ model: inherit
 
 You maintain codebase coherence by detecting drift between docs and code, and fixing it. Scope: stale feature docs, broken ownership, routing table drift, architecture drift, unowned source paths, backlog health.
 
-Out of scope (handled by the `boundary` skill):
-- **Code drifted from docs** (boundary violations in live code) → `boundary` skill, `init` mode
-- **Pre-implementation impact analysis** (checking a plan against the typed boundaries before coding) → `boundary` skill, `check` mode
+Out of scope (handled by the `boundary` skill, which derives contracts dynamically from source):
+- **Pre-implementation impact analysis** (checking a plan against cross-cutting contracts before coding) → `boundary` skill, `check` mode
+- **Diff-scoped contract analysis** (what could a change break across module edges) → `boundary` skill, `scan` mode
 
 ## Before Starting
 
 1. If `./docs/memory/maintenance.md` exists, read it for last review state, ownership snapshots, high-churn paths, and known failure modes.
-2. If `./docs/boundaries/` exists, read its files for context on the typed cross-module contracts the docs should reflect.
+2. If `./docs/memory/boundary.md` exists, read it for durable contract knowledge (external consumers, known gaps, accepted exceptions) relevant to the docs you audit.
 3. If `./docs/routing.md` exists, read it for the current file-pattern-to-doc mapping.
 
 ## Step 1: Build Ownership Map
@@ -25,7 +25,7 @@ Out of scope (handled by the `boundary` skill):
 2. Glob `docs/{features,modules/*/features}/**/*.md` and extract YAML frontmatter (`owns`, `touches`, `depends_on`)
 3. Build a map: glob pattern → owning doc
 
-**Boundary-first fallback.** If that glob yields **no `owns` frontmatter at all** (a real possibility — a boundary-first repo can carry thousands of LOC, a populated `docs/boundaries/`, and zero feature docs) **but `docs/boundaries/**` exists**, drive this pass's ownership/drift surface off the boundaries instead: each boundary's `Bounds`/`Shape` referents (the modules/paths it names) plus `docs/architecture/**` file-references become the **primary** ownership map for Steps 2–5. Feature-`owns` stays primary the moment any appears — this is a fallback, not a replacement. Don't re-mechanize the named-referent / path checks here; Step 2 already resolves boundary referents and Step 5 already greps architecture paths — this clause just promotes them to primary when feature-owns is empty. **Exempt the pre-code markers:** a referent a boundary marks `planned`/`point*`/`transcribe*` is intentionally not-yet-landed — never flag it absent (that is the greenfield contract, not drift); only a referent whose target *has* landed fires, via Step 2's planned-landed / transcribe-landed checks.
+**Architecture-first fallback.** If that glob yields **no `owns` frontmatter at all** (a fresh-baseline repo can carry thousands of LOC and zero feature docs), drive this pass's ownership/drift surface off `docs/architecture/**` file-references instead — they become the **primary** ownership map for Steps 2–5. Feature-`owns` stays primary the moment any appears — this is a fallback, not a replacement.
 
 ## Step 2: Validate Ownership
 
@@ -38,17 +38,9 @@ For each code symbol or path a doc explicitly **names** (function/export/route/t
 - Flag unresolved named referents as drift, phrased as a question (e.g. `docs/x.md:NN names fn() — no static definition found; confirm it is not generated/re-exported before treating as stale`)
 - On codegen/reflection/DI/barrel stacks where static resolution is unreliable, skip — yielding nothing is correct
 
-Also resolve **`point`-mode boundary pointers** in `docs/boundaries/**/*.md` — a boundary whose `Bounds`/`Shape` carries a `file:line` pointer (e.g. `self-locating in lib/db.js:14`):
-- Verify the named path still exists; a rename (e.g. `lib/db.js`→`lib/store.js`) leaves a stale pointer that **distill② can never repair — boundary docs are write-protected** — so this pass is where it surfaces, as a question
-- If the boundary carries a literal **`planned`** marker (or "pointer lands at implementation") on a named target **and that target now resolves to real code**, the pointer has gone stale the other way — the code landed but the doc still says planned. Raise it as a question (e.g. `db-schema.md is marked planned but packages/api/src/db/schema.ts now exists — confirm and convert the pointer to file:line`). A barrel/re-export at the named path counts as landed.
-- Same skip rule on unreliable-resolution stacks
-
-Also handle **`transcribe`-mode boundaries** — a boundary whose `Shape` transcribes a contract (an event/wire/config shape copied from doctrine) **until** the owning module lands, typically with a checklist line like *"replace this transcription when X lands"*:
-- If **X now exists**, the transcribed shape can have silently diverged from the real one — and a transcription names fields, so the divergence is field-level, not path-level (e.g. an event transcribed as `{ entity, event_kind, … }` against a landed module that uses `eventKind`). Raise it as a question that the transcribed shape be reconciled against the real one — or handed to a proposed `boundary init` run for that file (e.g. `outbox-events.md transcribes event_kind but the landed outbox module uses eventKind — confirm the transcription should be reconciled to the real shape`). Question-phrased, never asserted; never rewrite the boundary doc yourself (write-protected).
-
-Also check **`env-var-contract` boundaries** — a boundary whose job is to assert the env contract (typically *"every variable the code reads appears in `.env.example`"*). The named-referent check above covers code symbols and paths but not env vars, which live in a separate canonical file:
-- Extract the `UPPER_SNAKE` tokens the boundary names in its `Shape` (allow a trailing `*` glob, e.g. `MASTER_KEK*` matching `MASTER_KEK`, `MASTER_KEK_ID`). Grep each against the declared canonical `.env`/`.env.example` (the boundary names which file is canonical).
-- Raise any absence as a question (e.g. `env-vars.md names MASTER_KEK* but no MASTER_KEK* appears in .env.example — confirm the contract still holds`). Same skip rule when the canonical file isn't declared or doesn't exist.
+Also check the **env contract** when the repo declares a canonical `.env.example` (or equivalent). The named-referent check above covers code symbols and paths but not env vars, which live in a separate canonical file:
+- Extract the `UPPER_SNAKE` env keys the code reads (`process.env.X` and the deploy scripts' generated env). Grep each against the canonical `.env.example`.
+- Raise any absence as a question (e.g. `server reads MASTER_KEK but no MASTER_KEK appears in .env.example — confirm the contract still holds`). Skip when no canonical file exists.
 
 ## Step 3: Detect Doc Drift
 
@@ -108,7 +100,7 @@ If `qmd` is absent (`command -v qmd` finds nothing), **skip this whole step sile
 
 This catches **doc-area drift** — the subject the doc abstracts moving or vanishing from the indexed corpus. It does **not** catch a pure code rename that leaves the doc's prose unchanged: the anchor query semantically matches the doc's own text, so the result set doesn't shift. Code-symbol drift is Step 2's named-referent check, not this one — the two are complementary, not redundant.
 
-Glob `docs/{features,modules/*/features}/**/*.md`, `docs/boundaries/**/*.md`, `docs/architecture/**/*.md`, and `docs/operations/**/*.md` for docs carrying `anchors:` frontmatter. For each anchor query on such a doc, resolve it with `qmd query --format json -c <collection> "<query>"` — repeat `-c` per relevant `{repo}-*` collection (no comma lists; the collection set is what `qmd collection list` shows). If a query resolves to **nothing**, or to a result set that has **radically shifted** away from the area the doc describes, raise it as a drift finding **phrased as a question** — e.g. `docs/x.md anchors "<query>" — resolves to nothing; confirm the area moved before treating the doc as stale` — and ask the user. On **yes**, dispatch the remediation sub-agent (the same yes-branch as Step 6). On **decline or no action**, append it to `docs/history/backlog.md` at the finding's own P0–P3 severity per the **Declined realignment** branch in Step 6 — same scale, deduped, never a gate.
+Glob `docs/{features,modules/*/features}/**/*.md`, `docs/architecture/**/*.md`, and `docs/operations/**/*.md` for docs carrying `anchors:` frontmatter. For each anchor query on such a doc, resolve it with `qmd query --format json -c <collection> "<query>"` — repeat `-c` per relevant `{repo}-*` collection (no comma lists; the collection set is what `qmd collection list` shows). If a query resolves to **nothing**, or to a result set that has **radically shifted** away from the area the doc describes, raise it as a drift finding **phrased as a question** — e.g. `docs/x.md anchors "<query>" — resolves to nothing; confirm the area moved before treating the doc as stale` — and ask the user. On **yes**, dispatch the remediation sub-agent (the same yes-branch as Step 6). On **decline or no action**, append it to `docs/history/backlog.md` at the finding's own P0–P3 severity per the **Declined realignment** branch in Step 6 — same scale, deduped, never a gate.
 
 ---
 

package/data/harnesses/code-fable/harness.json

@@ -1,7 +1,12 @@
 {
   "harness": "code-fable",
   "name": "code-fable",
-  "version": "0.15.3",
-  "epoch": 13,
-  "digest": "30d4aa84ee01"
+  "version": "0.17.0",
+  "epoch": 14,
+  "files": [
+    ".prettierrc.json",
+    ".prettierignore",
+    ".vscode/settings.json"
+  ],
+  "digest": "c62c79b3aff1"
 }

package/data/harnesses/code-fable/hooks/hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/session-reflect.js\"",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/session-reflect.mjs\"",
             "async": true
           }
         ]
@@ -18,7 +18,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/prompt-recall.js\""
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/prompt-recall.mjs\""
           }
         ]
       }

package/data/harnesses/code-fable/hooks/lib/{redact.js → redact.mjs}

@@ -1,6 +1,4 @@
-// harness/code/hooks/lib/redact.js — shared privacy filter: redacts secret shapes before ledger append.
-
-"use strict";
+// harness/code/hooks/lib/redact.mjs — shared privacy filter: redacts secret shapes before ledger append.
 
 // Patterns ordered most-specific first; each replaces a match with [redacted:{kind}].
 const RULES = [
@@ -34,4 +32,4 @@ function redact(text) {
   return out;
 }
 
-module.exports = { redact };
+export { redact };

package/data/harnesses/{code/hooks/prompt-recall.js → code-fable/hooks/prompt-recall.mjs}

@@ -1,11 +1,9 @@
-// plugins/code/hooks/prompt-recall.js — UserPromptSubmit hook: surface fact-cards relevant to the prompt via qmd BM25; stdout is injected as context.
+// plugins/code/hooks/prompt-recall.mjs — UserPromptSubmit hook: surface fact-cards relevant to the prompt via qmd BM25; stdout is injected as context.
 
-"use strict";
-
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-const { execFileSync } = require("child_process");
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
 
 const MIN_PROMPT_CHARS = 24;
 const MIN_SCORE = 0.45;

package/data/harnesses/{code/hooks/session-reflect.js → code-fable/hooks/session-reflect.mjs}

@@ -1,12 +1,14 @@
-// plugins/code/hooks/session-reflect.js — SessionEnd hook: reflect the session into durable lessons (headless haiku pass) appended to the actor's memory inbox.
+// plugins/code/hooks/session-reflect.mjs — SessionEnd hook: reflect the session into durable lessons (headless haiku pass) appended to the actor's memory inbox.
 
-"use strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync, spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { redact } from "./lib/redact.mjs";
 
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-const { execFileSync, spawn } = require("child_process");
-const { redact } = require("./lib/redact.js");
+// ESM has no __filename; derive it from this module's URL for the detached worker re-spawn.
+const __filename = fileURLToPath(import.meta.url);
 
 // A session below all three thresholds carries no lesson worth a model call.
 const MIN_TURNS = 8;

package/data/harnesses/code-fable/rules/general.md

@@ -1,23 +1,14 @@
----
-applyTo: "**"
----
+# General Standards
 
-# Technology Choices & Standards
-
-Opinionated technology stack and implementation standards.
-
-## Environment & Versions
-
-### Runtime Versions
+## Runtime Versions
 
 - **Node.js:** 22 LTS (latest)
-- **Package manager:** project-determined — detect from lockfile (`pnpm-lock.yaml` → pnpm, `yarn.lock` → yarn, `package-lock.json` → npm). Use the matching command in scripts; don't hardcode a specific manager.
-- **PostgreSQL:** 17
-- **Redis:** 7.x (latest)
+- **Package manager:** detect from lockfile (`pnpm-lock.yaml` → pnpm, `yarn.lock` → yarn, `package-lock.json` → npm). Don't hardcode one.
+- **PostgreSQL:** 17 · **Redis:** 7.x (latest)
 
-### Recommended Packages
+## Recommended Packages
 
-No alternatives. No explanations for obvious choices. Just use these.
+No alternatives. Just use these.
 
 | Package                  | Version   | Use                    | Don't use               |
 | ------------------------ | --------- | ---------------------- | ----------------------- |
@@ -36,8 +27,8 @@ No alternatives. No explanations for obvious choices. Just use these.
 | react-window             | ^2.2.3    | List virtualization    | react-virtualized       |
 | nanoid                   | ^5.1.6    | ID generation          | uuid                    |
 | express                  | ^5.2.1    | HTTP server            | fastify, koa            |
-| prisma                   | ^7.2.0    | Database ORM           | sequelize, typeorm      |
-| @prisma/client           | ^7.2.0    | Database queries       | -                       |
+| drizzle-orm              | latest    | Database ORM           | prisma, sequelize, typeorm |
+| drizzle-kit              | latest    | Schema tooling         | -                       |
 | zod                      | ^4.2.1    | Schema validation      | yup, joi                |
 | jose                     | ^6.1.3    | JWT handling           | jsonwebtoken            |
 | microdiff                | ^1.5.0    | JSON object diffing    | deep-diff, just-diff    |
@@ -49,15 +40,24 @@ No alternatives. No explanations for obvious choices. Just use these.
 | cmdk                     | ^1.1.1    | Command palette        | kbar, ninja-keys        |
 | @monaco-editor/react     | ^4.7.0    | Code editor            | codemirror, ace         |
 | localforage              | ^1.10.0   | Client-side storage    | idb, dexie              |
-| socket.io-client         | ^4.7.0    | WebSocket client       | native WebSocket, ws    |
 | react-markdown           | ^10.1.0   | Markdown rendering     | marked, markdown-it     |
 | fast-deep-equal          | ^3.1.3    | Deep equality checks   | lodash.isEqual          |
 | @ngneat/falso            | latest    | Fake data generation   | @faker-js/faker, chance |
 | pino                     | ^10.1.0   | Logging                | winston                 |
 
----
+## Frontend
+
+Tailwind v4 + shadcn-based UI; conventions below.
+
+- **@nurix/components** — the UI component library (linked, pre-built); import by subpath, e.g. `@nurix/components/button`.
+- No components.json / shadcn CLI scaffold (.tsx, not .jsx) — consume the prebuilt library; never `npx shadcn add`.
+- Vite: `@tailwindcss/vite` + `@vitejs/plugin-react-swc`. Pin react / react-dom / react/jsx-runtime / react/jsx-dev-runtime to the app's single copy via `resolve.alias` (linked @nurix/* ship nested react — keep one hook dispatcher).
+- Tailwind v4, CSS-only (no tailwind.config.js, no PostCSS): styling runs through the `@tailwindcss/vite` plugin.
+- CSS entry `globals.css`, imports in order — `@import "./personality.css"` (token source) → `@import "tailwindcss"` → the library's `styles.css` — then `@theme inline {…}` mapping vars to tokens.
+- Tokens: CSS vars in `:root, :root[data-theme="light"]` + the archetype selector `[data-style="…"]` (personality.css), consumed as semantic Tailwind tokens (bg-card, text-foreground). Honor the archetype's radius/theme decisions (e.g. re-assert `--radius-*` to 0 for a flat archetype; add `@custom-variant dark` only if the project supports dark mode). The library bundles class-variance-authority, clsx, tailwind-merge.
+- Plus general styling rules (spacing in 2/4/6/8, object-cover, truncate, motion, color tokens — never hardcoded hex in components).
 
-## Express 5.x Setup
+## Express 5.x
 
 ```javascript
 app.use(cors({ origin: process.env.FRONTEND_URL }));
@@ -66,31 +66,14 @@ app.use(express.json({ limit: "10mb" }));
 app.use(rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }));
 ```
 
-- Middleware order: body parsers, custom middleware, routes, error handlers
-- Use Express Router for modular routes
-- Centralized error handler as last middleware
-- Use middleware for auth
-
----
+- Middleware order: body parsers → custom middleware → routes → error handlers (centralized, last). Auth via middleware. Use Express Router for modular routes.
 
 ## API Response Format
 
 ```json
-{
-    "status": 1,
-    "message": "Message sent successfully",
-    "data": { "delivered": [{ "user@example.com": 2 }] }
-}
+{ "status": 1, "message": "Message sent successfully", "data": { "delivered": [{ "user@example.com": 2 }] } }
 ```
 
-**Error:**
-
-```json
-{
-    "status": 0,
-    "message": "Error description",
-    "data": null
-}
-```
+Error: `{ "status": 0, "message": "Error description", "data": null }`
 
 HTTP codes: `200`, `201` (created), `400`, `401` (not authenticated), `403` (not authorized), `404`, `500`

package/data/harnesses/code-fable/rules/nomenclature.md

@@ -1,7 +1,3 @@
----
-applyTo: "**"
----
-
 # Nomenclature Guidelines
 
 ## Naming Guidelines

package/data/harnesses/code-fable/rules/typescript.md

@@ -0,0 +1,19 @@
+# TypeScript
+
+TypeScript conventions. Compiles under `strict: true` and `noUncheckedIndexedAccess: true`.
+
+## Type Safety
+
+- Never `any` to silence the checker. Unknown value → type `unknown`, then narrow (type guard / `zod` parse).
+- Never weaken strictness. No `// @ts-nocheck`; `// @ts-expect-error` only with a same-line reason.
+- Infer locals & return types; annotate at boundaries (exports, props, contracts).
+
+## Generics
+
+Shared libraries (`@nurix/components`, etc.) are generic on purpose — that's what types `cell(row)`, checks `slug` against `keyof TData`, and ties `data`/`columns` together. Keep the safety; never widen to `any` to dodge it. State the row type **once per file**, then let inference carry it:
+
+- **Bind a repeated factory once** (preferred): `const col = defineColumn<BriefRow>;` → `col({...})`. No `<T>` per call; `row` stays typed. Canonical: `modules/briefs/BriefsListPage.tsx`.
+- **Infer JSX type args from props:** `<Table data={rows} columns={columns} />`, not `<Table<BriefRow> …>`.
+- **Anchor with a collection annotation** when nothing else can: `const columns: ColumnDefinition<BriefRow>[] = [...]`.
+
+Don't repeat `fn<Type>(…)` / `<Comp<Type>>` at every call site — cosmetic only (same safety, same emitted JS).

package/data/harnesses/code-fable/skills/boundary/SKILL.md

@@ -1,262 +1,76 @@
 ---
 name: boundary
-description: The single home for a repo's typed application boundaries — the cross-cutting contracts (db-schema, wire envelope, store shape, auth, tenancy, event schemas, edge bindings, …) where editing one module silently breaks another. One skill, four modes — `generate` (baseline all boundaries from the detected stack + IA), `create` (add/update one boundary), `check` (pre-implementation: does this plan touch a boundary? severity-ranked impact), `init` (reconcile: ensure files exist, scan live code for violations + drift, backfill new catalog types). All four read one shared knowledge root, `references/boundary-taxonomy.md`, so they can never drift apart. Triggers on "application boundary", "baseline boundaries", "map boundaries", "generate boundaries", "create a boundary", "introspect", "check this plan", "impact analysis", "what could break", "scan for boundary violations", "boundary drift", "/boundary".
+description: Boundary diagnostic for implementation plans. Given a plan file, reads the source files the plan touches, identifies the application boundaries they participate in — the cross-cutting contracts (db schema, wire envelope, auth, events, env/config, …) where editing one side silently breaks the other — and reports whether the planned changes would violate any of them, severity-ranked, with suggested plan amendments. Read-only; the report lands in chat. Can also run against a diff or named code area instead of a plan. Triggers on "boundary check", "check this plan", "what could break", "impact analysis", "/boundary".
 ---
 
-# Application Boundary Skill
+# Boundary Diagnostic
 
-The one place a repo's **typed application boundaries** are produced, checked, and
-maintained. A boundary is a horizontal cross-cutting contract — an *edge* between
-modules, layers, services, or deploy units — where editing one side silently
-breaks another. They live as one file per boundary in `docs/boundaries/`.
+You diagnose whether a plan's changes would break an application boundary.
 
-This skill merges what used to be three components — `boundary-mapper` (produce),
-`introspect` (pre-impl check), `contract-monitor` (post-impl scan) — into one
-skill with four modes. The reason they're one skill: **all four share a single
-knowledge root** — [`references/boundary-taxonomy.md`](references/boundary-taxonomy.md),
-the exhaustive catalog of *what an application boundary is* and *which kinds
-exist* (≈170 types across persistence, wire/API, frontend, auth/tenancy,
-async/messaging, config/build, runtime/infra). Three separate components meant
-three copies of that mental model that drifted apart. One skill, one catalog,
-zero drift.
+A boundary is a contract between two pieces of code (or code and infra) that
+share an assumption with **no compile-time link** between them: the column a raw
+SQL string names, the JSON envelope a client unwraps, the event string a
+dispatcher parses, the env var a deploy script writes. Changing one side ships
+green and breaks the other silently. Your job is to find those edges in the
+plan's path *before* execution.
 
-> **Read [`references/boundary-taxonomy.md`](references/boundary-taxonomy.md)
-> first, in every mode.** It carries the boundary-file anatomy, the
-> `point`-vs-`transcribe` doc-mode, the technology/domain split, the per-type
-> severities, and the safe-change checklists. This SKILL.md only orchestrates the
-> four verbs over that knowledge.
+[`references/boundary-taxonomy.md`](references/boundary-taxonomy.md) is the
+catalog of boundary types (~170 across persistence, wire/API, frontend,
+auth/tenancy, async/messaging, config/build, runtime/infra), with per-type
+severities and safe-change checklists. Read it first — it tells you what to
+look for; the code tells you what exists.
 
----
-
-## Picking a mode
-
-| You want to… | Mode | Old component |
-|---|---|---|
-| Baseline a repo — generate every boundary that exists from the stack + IA | **`generate`** | boundary-mapper (baseline) |
-| Add or update **one** boundary file | **`create`** | boundary-mapper (create/update) |
-| Before coding: does this **plan** touch a boundary? Severity-ranked impact | **`check`** | introspect |
-| Reconcile: do files exist? scan **live code** for violations + drift; backfill new catalog types | **`init`** | contract-monitor + drift + catalog-sync |
-
-If the user's intent is ambiguous, ask which mode. `generate` and `create` are the
-same writer at different scope (`generate` = `create` over every detected
-boundary).
-
-## Execution model — pure skill
-
-This skill runs **in the main session** — no standing sub-agents. `check` and
-`create` are light and always run inline. `generate` and `init` sweep the
-codebase; run that sweep inline too. **Only** for an unusually large repo (where
-an inline full-codebase sweep would blow the context budget) may you dispatch a
-**one-shot scan worker** sub-agent that reads this same taxonomy reference and
-returns structured findings — the knowledge still lives in exactly one place.
-Default to inline; reach for a worker only when the repo's size forces it.
-
-## Before any mode
-
-1. Read [`references/boundary-taxonomy.md`](references/boundary-taxonomy.md) — the
-   boundary types, doc-modes, default severities, and safe-change checklists for
-   the stack you're about to touch.
-2. If `docs/memory/boundary.md` exists, read it for project-specific
-   boundary exceptions, known violations the user chose not to fix, where the IA
-   model actually lives, and stack quirks that change a doc-mode.
-3. If `docs/routing.md` exists, read it for module-ownership context.
-
----
-
-## Mode: `generate` (baseline)
-
-No `docs/boundaries/` yet (or a from-scratch re-baseline). Detect the stack + IA,
-instantiate one file per boundary that actually exists.
-
-1. **Detect the stack** — read `package.json` (deps), the lockfile, and skim the
-   source tree. Map detected technologies to their boundary types via the
-   taxonomy. (Detect the package manager from the lockfile; don't assume.)
-2. **Detect the information architecture** — read `docs/architecture/`
-   (domain-model, ADRs), doctrine in any `docs/modules/*/pillars/`, and the
-   entity/contract definitions (a `@org/contracts` package, `schema.ts`,
-   `models.py`). The IA entity model is the flagship `domain` boundary
-   (`information-architecture`).
-3. **For each boundary the repo exhibits**, write one file to `docs/boundaries/`
-   using the boundary-file anatomy. Decide `point` vs `transcribe` per the
-   taxonomy: `point` boundaries get a `file:line` pointer + invariants +
-   checklist (never a transcribed copy — it rots); `transcribe` boundaries (the
-   composed store tree, the response envelope, the IA topology, tenancy) get the
-   contract canonically in the file.
-   - **Greenfield branch — contract decided, no code yet.** If the repo is
-     pre-code (ADRs/domain-model decide the contract but the source module isn't
-     scaffolded), a `point` boundary has no `file:line` to mirror. Don't skip it
-     and don't fabricate a pointer — per the taxonomy's *Greenfield / pre-code
-     boundaries*, emit it as **conventions-with-planned-pointer**: record the
-     decided conventions inline, carry a `planned <path>` pointer, mark it `point*`
-     (a pre-code `transcribe` source is `transcribe*`), and make the last
-     safe-change item "replace the planned pointer with the real `file:line` once
-     code lands." Link any item that hinges on an unresolved decision to its
-     open-question/ADR.
-4. **Set severity** from the taxonomy default, adjusted by the concrete repo +
-   project memory. Severity is load-bearing — it drives `check` review depth and
-   `init` scan priority.
-5. **Name the bounding code units** (paths / package names) in every `Bounds`
-   line. The distinct vertices named across all `Bounds` lines are the
-   **module-discovery feed** `harness-manager` reads to propose modules — name
-   them precisely.
-6. **Write `docs/boundaries/README.md`** as the index per the taxonomy's index
-   spec: a table with a **Doc-mode column**
-   (`| Boundary | Type | Severity | Doc-mode | Bounds (summary) |`), then the
-   standing blocks — **Active technology packs**, **Folds applied** (which catalog
-   types collapsed into which file — surface the per-entry fold-notes as a ledger),
-   and **Skipped** (types omitted + one-line reason each). Add the `point*`/`transcribe*`
-   footnote if any boundary is pre-code.
-7. **Don't invent boundaries the repo doesn't have.** Only instantiate types the
-   detected stack/IA actually exhibits; `log()` what you skipped and why.
-
-Write only under `docs/boundaries/` and `docs/memory/boundary.md`.
-Read-only on production code.
+## Run
 
-## Mode: `create` (targeted)
+**Input:** a plan path (given, or the newest in `docs/history/plans/`) — or a
+diff / named code area for non-plan work. Everything below is identical either
+way; a diff's hunks stand in for the plan's steps.
 
-Add or update a single boundary file (e.g. a new contract surfaced by `check`, or
-a boundary the author asks for by name).
+1. **Build the touch list.** Parse the plan's Proposed Changes: files to be
+   created or modified, entities/state added or changed, API changes, anything
+   the author flags as a cross-module contract. Note missing subsections.
 
-1. Identify the boundary type from the taxonomy; confirm the repo exhibits it.
-2. Write/update the one file with the full anatomy (Bounds, Shape, Invariants,
-   Blast radius, Safe-change checklist), `point` or `transcribe` per the taxonomy.
-3. Update `docs/boundaries/README.md` (add/refresh the index row).
-4. For an **update** that fixes drift (the `maintenance` agent flags a boundary
-   file drifted from its source): re-read the source, refresh the `Shape` pointer
-   or transcription, leave invariants/checklist intact unless they changed.
+2. **Identify the boundaries in the touched code.** Read each touched file (and
+   its immediate imports). Against the taxonomy, list the contracts this code
+   participates in — the schema it queries, the envelope it emits, the events
+   it publishes or parses, the auth checks it sits behind, the env it reads.
 
-## Mode: `check` (pre-implementation)
+3. **Trace the other side.** A boundary has two sides; the danger lives on the
+   one the plan *doesn't* mention. For each contract, grep the shared name or
+   shape across the repo — the column name in other SQL strings, the response
+   field in client unwrappers, the event kind in subscribers, the route in
+   fetch calls and scripts, the env key in deploy tooling. Record consumers as
+   `file:line`.
 
-Read-only. Intersect a plan's proposed changes with the documented boundaries and
-surface cascading risk *before* coding. (This is the old `introspect`.)
+4. **Judge each intersection.** Does the planned change alter a shape a traced
+   consumer depends on, break an invariant the code establishes (append-only
+   vocabularies, idempotency keys, fail-closed checks, ordering guarantees), or
+   add a new cross-module edge? Severity:
+   - **CRITICAL** — can corrupt persisted data, or open an auth/money path.
+   - **HIGH** — silent cross-module breakage that would ship green.
+   - **MEDIUM** — drift-prone coupling (string-matched, duplicated constants).
+   - **LOW** — smell. Loud, immediately-visible breakage caps at HIGH.
 
-**Inputs.** Plan path (user-provided; else newest in `docs/history/plans/`). Every
-file in `docs/boundaries/` is mandatory input — if the folder is missing/empty,
-stop and tell the user to run `generate` first. Source files read on demand to
-verify — never guess from plan text alone.
-
-1. **Load.** Resolve + read the plan; confirm it has a `Status:` (warn if
-   `Complete`/`Abandoned`). Read every boundary file; parse the
-   `[BOUNDARY: type · severity]` header + Bounds / Shape / Invariants / Blast
-   radius / Safe-change checklist. Severity sets review depth.
-2. **Parse proposed changes.** The plan template's **Proposed Changes**
-   subsections are load-bearing: New Files / Modified Files (check against the
-   modules each boundary **Bounds** and any `Shape` `file:line`) · New Entities /
-   State (vs `information-architecture` + `db-schema`) · API Changes (vs
-   `wire-response-envelope` / `rest-endpoint-shape` / `graphql-schema`) ·
-   Cross-Module Contracts Affected (the author's own admission — start there,
-   then verify). Note any missing subsection.
-3. **Analyze each boundary × change pair** for: **Bounds overlap** (touches a
-   bounded module or a `Shape` pointer), **Invariant overlap** (introduces a
-   shape the invariants prohibit — raw literal where a shared constant is
-   required, entity type not in the canonical array, persisted field without
-   fallback), **Shape overlap** (modifies the canonical Shape). Read the actual
-   source to verify any plausible intersection.
-4. **Assign severity.** Anchor to the boundary's own severity (the floor),
-   adjust by the concrete change. Critical = silent data loss / corrupted
-   persistence / broken cross-entity refs; High = stale state / broken lookups /
-   schema selectors without fallbacks; Medium = likely-to-drift string-coupling;
-   Low = code smell.
-5. **Report** (in chat — never written to disk):
+5. **Report in chat:**
 
    ```
-   # Application Boundary — check — {plan filename}
-
-   Plan: {path}
-   Boundaries: {N} files evaluated
-   Intersections: {N} ({critical}/{high}/{medium}/{low})
+   # Boundary check — {plan}
 
-   ## Violations
-   | # | Boundary | Risk | Severity | Plan step |
+   Touched files read: {N} · Boundaries identified: {N}
+   Violations: {N} ({critical}/{high}/{medium}/{low})
 
-   ## Suggested Plan Additions
-   - Violation #1 → add step X to Implementation Steps / Done Criteria …
+   | # | Boundary | Planned change | Other side (file:line) | Severity |
 
-   ## Missing Subsections
-   ## New Cross-Module Contracts Detected
-   {describe the proposed boundary (type, Bounds, Shape, suggested severity) and
-    recommend running `create` to formalize it — do not write the file from check}
+   ## Suggested plan amendments
+   ## Missing plan subsections
    ```
 
-The severity-ranked table is the load-bearing output. Suggestions are advisory —
-the user folds them back into the plan; **`check` never edits the plan or code.**
-
-## Mode: `init` (reconcile — ensure, scan, backfill)
-
-Ensure boundaries are initialized and current. Three jobs in one pass:
-
-1. **Ensure exist.** If `docs/boundaries/` is missing/empty → this is really a
-   baseline; run `generate` instead and stop.
-2. **Scan live code for violations** (the old `contract-monitor`). For each
-   boundary file, parse its header + invariants, then scan the codebase for
-   violations of *that* boundary. Categories: **unregistered entity types**
-   (strings used as entity-type ids not in the canonical array) · **string-coupled
-   constants** (raw literals where a shared constant import is required) ·
-   **cross-entity references without propagation** (storing entity A's
-   slug/name/id by value in B with no documented propagation) · **schema
-   mismatches** (selectors hitting persisted fields without a fallback default) ·
-   **undocumented endpoints** (routes with no feature-doc / `api` boundary entry).
-   Verify by reading actual source — never guess.
-3. **Detect drift + backfill the catalog.** (a) Flag any boundary file whose
-   `Shape` has drifted from its source (refresh it via `create`/update). (b)
-   Compare the taxonomy's boundary *types* against what the repo now exhibits —
-   if the repo gained a technology (or the catalog gained a type) that the repo
-   exhibits but `docs/boundaries/` lacks, surface it and offer to `generate` that
-   one boundary.
-
-**Act on violations.** Mechanical fix (missing constant import, missing fallback,
-missing canonical-array entry) → fix directly with an Edit. Design-decision fix
-(new entity-type registration, new propagation mechanism, schema migration) →
-append to `docs/history/backlog.md` as P0/P1 with the specific boundary + bounded
-modules. Pre-existing exception (in `docs/memory/boundary.md`) → skip
-silently.
-
-**Report** a table `| # | Boundary | Violation | Location | Action taken |`, then
-update `docs/memory/boundary.md` with scan date, per-boundary
-violation counts, items fixed / backlogged, new exceptions, and any
-newly-exhibited boundary types backfilled.
-
----
-
 ## Rules
 
-- **One knowledge root.** Every mode reads `references/boundary-taxonomy.md`.
-  Extend the catalog there, never inline a divergent copy in a mode.
-- **`check` is read-only** — never edits the plan, source, boundaries, or memory.
-  The other modes write only under `docs/boundaries/`,
-  `docs/memory/boundary.md`, and (for `init` mechanical fixes) the
-  specific violating source line. Never touch frozen records
-  (`docs/history/plans/`, `docs/history/changelog/`) or feature docs.
-- **Verify against source.** Never report a violation or intersection from text
-  alone — read the files the plan/boundary names.
-- **One file per boundary.** Don't bundle unrelated boundaries.
-- **Severity is load-bearing.** It feeds `check` review depth + `init` priority.
-  Default from the taxonomy; adjust from the repo + memory.
-- **Name the bounding code units** in every `Bounds` line — they're the
-  module-discovery feed `harness-manager` reads. A workspace is *not* a module.
-- **Don't invent boundaries the repo doesn't have.** Only instantiate exhibited
-  types; `log()` skips. **A clean report is valid** — empty violations/intersections
-  means say so, don't pad.
-- **Docs never outrank code.** For `point` boundaries, mirror with `file:line`;
-  don't fork the shape. `file:line` stays primary for point-mode boundaries; an
-  `anchors:` query (see the documentation skill's frontmatter reference) MAY
-  supplement it for refactor-resilience — optional and additive, it re-resolves
-  the shape when the line moves, never replaces the pointer.
-- **Be specific** — file paths, line numbers, boundary names, the exact violating
-  string or code shape.
-
-## Strategy memory
-
-After a run you may append to `docs/memory/boundary.md` (git-tracked):
-project-specific boundary exceptions, where the IA model actually lives in this
-repo, stack quirks that change a doc-mode, recurring drift/violation zones,
-historical violation counts. Never user preferences (those are `~/.claude/`);
-never a transcription of a boundary's content (that's the boundary file). Date
-each entry `## YYYY-MM-DD — {topic}`.
-
-## Output locations
-
-- `generate`/`create`/`init` write boundary files to `docs/boundaries/` + the
-  index `docs/boundaries/README.md`; memory to `docs/memory/boundary.md`.
-- `check` returns its report in chat — never written to disk; the user folds
-  insights back into the plan.
+- **Read-only.** You never edit the plan, the code, or any doc. The user folds
+  your amendments into the plan.
+- **Verify in source.** Never flag from plan text alone — read both sides of
+  every boundary you report, and cite both as `file:line`.
+- **No consumer, no finding.** An intersection with no traced other side isn't
+  a violation; at most note it as a new edge the plan introduces.
+- **A clean report is valid.** Zero violations means say so — don't pad.