@nurix/etna 0.18.20 → 0.18.22

package/data/harnesses/code/skills/design/scripts/preship-sweep.mjs

@@ -1,8 +1,8 @@
-// skills/design/scripts/preship-sweep.mjs — verification-ladder rung 1 (D21/D23): whole-app static sweep — detector relay + cross-file machine checks + mandatory-procedures checklist + scope cross-check.
+// skills/design/scripts/preship-sweep.mjs — verification-ladder rung 1 (D21/D23): static sweep — per-file catalog + manifest drift via lib/checks.mjs + cross-file machine checks + mandatory-procedures checklist + scope cross-check. --files <a> <b> … scopes the sweep (improve's end-of-run verify); no args = whole-app. --manifest <design.tokens.json | artifact dir> overrides the drift vocabulary source (default: <project>/design.tokens.json).
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, dirname, resolve, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { spawnSync } from 'node:child_process';
+import { runChecks } from './lib/checks.mjs';
 
 const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
 const CATALOG = join(SCRIPT_DIR, '..', 'data', 'catalog', 'rules.csv');
@@ -122,56 +122,27 @@ function countNav(project) {
   return (text.match(/\bpath\s*=/g) || []).length;
 }
 
-// Try to parse detector --json stdout into a flat findings array, or null.
-function parseDetectorJson(stdout) {
-  const s = (stdout || '').trim();
-  if (!s) return [];
-  try {
-    const parsed = JSON.parse(s);
-    if (Array.isArray(parsed)) return parsed;
-    if (parsed && Array.isArray(parsed.findings)) return parsed.findings;
-    if (parsed && Array.isArray(parsed.violations)) return parsed.violations;
-    return null;
-  } catch { return null; }
-}
-
-// Render one relayed detector finding as a single fix-or-classify line.
+// Render one catalog finding as a single fix-or-classify line.
 function formatFinding(f, project) {
-  const anchor = f.id || f.anchor || f.rule || f.key || '?';
+  const anchor = f.rule || '?';
   const file = f.file ? relative(project, f.file) || f.file : '';
   const loc = f.line != null ? `${file}:${f.line}` : file;
-  const evidence = f.excerpt || f.evidence || f.value || '';
-  const msg = f.message || f.statement || f.detail || f.fix || '';
-  const ev = evidence ? `  [${evidence}]` : '';
-  return `  ${red(anchor)}  ${loc}${ev}  ${msg}`.trimEnd();
+  const ev = f.excerpt ? `  [${f.excerpt}]` : '';
+  return `  ${red(anchor)}  ${loc}${ev}  ${f.fix || ''}`.trimEnd();
 }
 
-// Spawn detector.mjs over every source file and relay its findings; returns a violation count or -1 when unavailable.
-function runDetector(project, files, section) {
-  const detector = join(SCRIPT_DIR, 'detector.mjs');
-  if (!existsSync(detector)) {
-    section.push(yellow(`  SWEEP INCOMPLETE: detector.mjs not found at ${detector} — the per-file catalog was not run. Build it before shipping.`));
-    return -1;
-  }
+// Run the per-file catalog + manifest drift (lib/checks.mjs) over the file set; returns the violation count.
+function runCatalog(project, files, manifestPath, section) {
   if (!files.length) { section.push('  (no src/**/*.{tsx,ts,css,html} files to scan)'); return 0; }
-  const args = [detector, ...files, '--json'];
-  const manifest = join(project, 'design.md');
-  if (existsSync(manifest)) args.push('--manifest', manifest);
-  const res = spawnSync(process.execPath, args, { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
-  const findings = parseDetectorJson(res.stdout);
-  if (findings) {
-    if (!findings.length) { section.push(green('  detector: no per-file violations.')); return 0; }
-    section.push(`  detector reported ${findings.length} violation(s) — fix each now, or classify why it does not apply in docs/memory/design-decay.md; never ignore silently:`);
-    for (const f of findings) section.push(formatFinding(f, project));
-    return findings.length;
-  }
-  if (res.stdout) section.push(res.stdout.replace(/\n$/, '').split('\n').map((l) => `  ${l}`).join('\n'));
-  if (res.stderr) section.push(yellow(res.stderr.replace(/\n$/, '').split('\n').map((l) => `  ${l}`).join('\n')));
-  return res.status ? 1 : 0;
+  const findings = runChecks(files, { manifestPath });
+  if (!findings.length) { section.push(green('  catalog checks: no per-file violations.')); return 0; }
+  section.push(`  catalog checks reported ${findings.length} violation(s) — fix each now, or classify why it does not apply in docs/memory/design-decay.md; never ignore silently:`);
+  for (const f of findings) section.push(formatFinding(f, project));
+  return findings.length;
 }
 
-// Run the cross-file machine checks (dep-02 one-h1 + heading skips) and the advisory nav-count.
-function crossFileChecks(project, files, catalog, section) {
+// Run the cross-file machine checks (dep-02 one-h1 + heading skips) and, on whole-app runs, the route-shell aggregate and advisory nav-count.
+function crossFileChecks(project, files, catalog, section, scoped) {
   const violations = [];
   for (const file of files) {
     if (!/\.(tsx|html)$/.test(file)) continue;
@@ -183,7 +154,7 @@ function crossFileChecks(project, files, catalog, section) {
     if (skips.length) violations.push(`  ${red('dep-02')}  ${rel}  heading level skips (${skips.join(', ')}); heading levels never skip.`);
   }
   const routesDir = join(project, 'src/routes');
-  if (existsSync(routesDir)) {
+  if (!scoped && existsSync(routesDir)) {
     for (const ent of readdirSync(routesDir, { withFileTypes: true })) {
       if (!ent.isDirectory()) continue;
       const dir = join(routesDir, ent.name);
@@ -194,12 +165,14 @@ function crossFileChecks(project, files, catalog, section) {
   if (violations.length) { section.push(...violations); }
   else section.push(green('  cross-file machine checks (dep-02 one-h1, heading-skip): clean.'));
 
-  const bounds = navBounds(catalog);
-  const nav = countNav(project);
-  if (bounds) {
-    const within = nav >= bounds.min && nav <= bounds.max;
-    const note = `  ${within ? '' : yellow('[advisory] ')}nav items: ${nav} (spc-14 advisory band ${bounds.min}-${bounds.max}${within ? ', within' : ', outside — judged, not gated'}).`;
-    section.push(note);
+  if (!scoped) {
+    const bounds = navBounds(catalog);
+    const nav = countNav(project);
+    if (bounds) {
+      const within = nav >= bounds.min && nav <= bounds.max;
+      const note = `  ${within ? '' : yellow('[advisory] ')}nav items: ${nav} (spc-14 advisory band ${bounds.min}-${bounds.max}${within ? ', within' : ', outside — judged, not gated'}).`;
+      section.push(note);
+    }
   }
   return violations.length;
 }
@@ -221,59 +194,73 @@ function procChecklist(catalog) {
   return lines;
 }
 
-// Assemble and print the whole sweep, then exit non-zero when detector or cross-file checks found violations.
+// Assemble and print the whole sweep, then exit non-zero when catalog or cross-file checks found violations.
 function main() {
   const args = process.argv.slice(2);
   let project = process.cwd();
+  let scopedFiles = null;
+  let manifestArg = null;
   for (let i = 0; i < args.length; i++) {
     if (args[i] === '--project') project = resolve(args[++i] || '.');
     else if (args[i].startsWith('--project=')) project = resolve(args[i].slice('--project='.length));
+    else if (args[i] === '--manifest') manifestArg = resolve(args[++i] || '.');
+    else if (args[i].startsWith('--manifest=')) manifestArg = resolve(args[i].slice('--manifest='.length));
+    else if (args[i] === '--files') {
+      scopedFiles = [];
+      while (i + 1 < args.length && !args[i + 1].startsWith('--')) scopedFiles.push(resolve(args[++i]));
+    }
   }
 
   const catalog = loadCatalog();
-  const files = walk(join(project, 'src'), ['.tsx', '.ts', '.css', '.html']);
+  const scoped = scopedFiles !== null;
+  const files = scoped ? scopedFiles : walk(join(project, 'src'), ['.tsx', '.ts', '.css', '.html']);
+  const defaultManifest = join(project, 'design.tokens.json');
+  const manifestPath = manifestArg || (existsSync(defaultManifest) ? defaultManifest : null);
 
-  console.log(bold(`preship-sweep — verification ladder rung 1  (project: ${project})`));
+  console.log(bold(`preship-sweep — verification ladder rung 1  (project: ${project}${scoped ? `, scoped to ${files.length} file(s) via --files` : ''})`));
   console.log('');
 
-  console.log(bold('(a) Per-file catalog — detector.mjs relay'));
+  console.log(bold('(a) Per-file catalog + manifest drift — lib/checks.mjs'));
   const secA = [];
-  const detectorCount = runDetector(project, files, secA);
+  const catalogCount = runCatalog(project, files, manifestPath, secA);
   console.log(secA.join('\n'));
   console.log('');
 
   console.log(bold('(b) Cross-file machine checks'));
   const secB = [];
-  const crossCount = crossFileChecks(project, files, catalog, secB);
+  const crossCount = crossFileChecks(project, files, catalog, secB, scoped);
   console.log(secB.join('\n'));
   console.log('');
 
-  console.log(bold('(c) Mandatory procedures — self-audit checklist (proc-*)'));
-  console.log(procChecklist(catalog).join('\n'));
-  console.log('');
+  if (!scoped) {
+    console.log(bold('(c) Mandatory procedures — self-audit checklist (proc-*)'));
+    console.log(procChecklist(catalog).join('\n'));
+    console.log('');
 
-  console.log(bold('(c) Scope cross-check (proc-14)'));
-  const surfaces = countSurfaces(project);
-  const deliverables = countDeliverables(project);
-  if (surfaces == null) {
-    console.log(`  ${yellow('no docs/design/structure.md map found — cannot cross-check scope.')}`);
+    console.log(bold('(c) Scope cross-check (proc-14)'));
+    const surfaces = countSurfaces(project);
+    const deliverables = countDeliverables(project);
+    if (surfaces == null) {
+      console.log(`  ${yellow('no docs/design/structure.md map found — cannot cross-check scope.')}`);
+    } else {
+      console.log(`  structure map declares ${surfaces} surface(s); found ${deliverables} route deliverable(s) under src/routes/.`);
+      if (surfaces !== deliverables) console.log(`  ${yellow(`[advisory] scope mismatch (${surfaces} vs ${deliverables}) — add or reconcile before responding (proc-14).`)}`);
+    }
+    console.log('');
   } else {
-    console.log(`  structure map declares ${surfaces} surface(s); found ${deliverables} route deliverable(s) under src/routes/.`);
-    if (surfaces !== deliverables) console.log(`  ${yellow(`[advisory] scope mismatch (${surfaces} vs ${deliverables}) — add or reconcile before responding (proc-14).`)}`);
+    console.log('(scoped run — the mandatory-procedures checklist and scope cross-check run on the whole-app sweep)');
+    console.log('');
   }
-  console.log('');
 
-  const detectorFailed = detectorCount === -1 || detectorCount > 0;
-  const failed = detectorFailed || crossCount > 0;
+  const failed = catalogCount > 0 || crossCount > 0;
   if (failed) {
     const reasons = [];
-    if (detectorCount === -1) reasons.push('detector.mjs unavailable (sweep incomplete)');
-    if (detectorCount > 0) reasons.push(`${detectorCount} per-file violation(s)`);
+    if (catalogCount > 0) reasons.push(`${catalogCount} per-file violation(s)`);
     if (crossCount > 0) reasons.push(`${crossCount} cross-file violation(s)`);
     console.log(red(`FAIL  preship-sweep — ${reasons.join('; ')}. Resolve, then re-run.`));
     process.exit(1);
   }
-  console.log(green('PASS  preship-sweep — no static violations; work the checklist above before ship.'));
+  console.log(green(scoped ? 'PASS  preship-sweep (scoped) — no static violations in the given files.' : 'PASS  preship-sweep — no static violations; work the checklist above before ship.'));
   process.exit(0);
 }
 

package/data/harnesses/code/skills/design/scripts/render-rung.mjs

@@ -440,7 +440,7 @@ function addFinding(findings, viewport, finding) {
   else findings.set(key, { ...finding, viewports: new Set([viewport]) });
 }
 
-// Print one finding in the detector's fix-or-classify format.
+// Print one finding in the check engine's fix-or-classify format.
 function printFinding(f) {
   const vp = [...f.viewports].sort((a, b) => a - b).join(', ');
   console.log(`[${f.severity}] ${f.anchor}  ${f.dimension} — ${f.statement}`);

package/data/harnesses/code/skills/design/scripts/scaffold.mjs

@@ -284,7 +284,7 @@ function emit(root, rel, content, written) {
 function indexHtml() {
   return `<!doctype html>
 <!-- Generated by scaffold.mjs. Personality state lives in these <html data-*> attributes (code is the cache).
-     The values below are placeholders; derive-personality.mjs --emit resolves them from the project's design.md. -->
+     The values below are placeholders; derive-personality.mjs --emit resolves them from the project's design-tokens artifact (design.tokens.json). -->
 <html
   lang="en"
   data-style="app"

package/data/harnesses/code/skills/design/scripts/self-integrity.mjs

@@ -1,8 +1,12 @@
-// skills/design/scripts/self-integrity.mjs — the design skill's own CI check: anchor parity, catalog invariants, stated-count and fixture-pair validation
-import { readFileSync, existsSync, readdirSync } from "node:fs";
-import { join, dirname, basename } from "node:path";
+// skills/design/scripts/self-integrity.mjs — the design skill's own CI check: anchor parity, catalog invariants, stated-count and fixture-pair validation (pairs exercised through lib/checks.mjs), the token-era net — token file-tree + goldens parity, per-artifact --check validity, and (behind --goldens) golden emission hash match — plus combination-data validation (validate-combinations.mjs); --fixture <rule-id> runs a single pair
+import { readFileSync, existsSync, readdirSync, mkdtempSync, rmSync } from "node:fs";
+import { join, dirname, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { spawnSync } from "node:child_process";
+import { runChecks } from "./lib/checks.mjs";
+import { goldenHash } from "./lib/golden.mjs";
+import { validateCombinations } from "./validate-combinations.mjs";
 
 const SCRIPTS_DIR = dirname(fileURLToPath(import.meta.url));
 const SKILL_ROOT = join(SCRIPTS_DIR, "..");
@@ -10,7 +14,11 @@ const SKILL_ROOT = join(SCRIPTS_DIR, "..");
 const CATALOG_CSV = join(SKILL_ROOT, "data/catalog/rules.csv");
 const FIXTURES_DIR = join(SKILL_ROOT, "data/catalog/fixtures");
 const HARD_RULES_MD = join(SKILL_ROOT, "references/hard-rules.md");
-const DETECTOR_MJS = join(SCRIPTS_DIR, "detector.mjs");
+const TOKENS_DIR = join(SKILL_ROOT, "data/design-tokens");
+const COMBINATIONS_DIR = join(SKILL_ROOT, "data/combinations");
+const GOLDENS_JSON = join(TOKENS_DIR, "goldens.json");
+const DERIVE_PERSONALITY = join(SCRIPTS_DIR, "derive-personality.mjs");
+const SPAWN_LIMIT = 8;
 
 const CSV_HEADER = ["id", "dimension", "statement", "numbers", "grade", "fire_points", "detector", "scope_note", "provenance", "fixture_pair"];
 const VALID_DIMENSIONS = new Set(["P1", "P2", "P3", "P4", "P5", "P6", "P7", "S1", "S2", "S3", "S4", "B1", "B2", "B3", "B4", "B5"]);
@@ -227,8 +235,8 @@ function checkFixturePresence(catalog) {
     return { name: "fixture-pair presence", pass: errors.length === 0, detail: `${ok}/${total} pairs present`, errors };
 }
 
-// Run detector.mjs on one fixture file and return the set of anchor ids it reports.
-function runDetector(file) {
+// Run the check engine (lib/checks.mjs) on one fixture file and return the set of anchor ids it reports.
+function runEngine(file) {
     // Scan the leading comment block for a `// detector-args:` directive (the mandatory file-path
     // comment occupies line 1, so the directive cannot be line 0). Relative paths in it (e.g. a
     // --manifest sibling) resolve against FIXTURES_DIR, matching each fixture's documented verify command.
@@ -239,46 +247,41 @@ function runDetector(file) {
         const argMatch = /^\/\/\s*detector-args:\s*(.+)$/.exec(t);
         if (argMatch) { extra = argMatch[1].trim().split(/\s+/); break; }
     }
-    const res = spawnSync("node", [DETECTOR_MJS, file, "--json", ...extra], { encoding: "utf8", timeout: 30000, cwd: FIXTURES_DIR });
-    const out = `${res.stdout || ""}\n${res.stderr || ""}`;
-    const ids = new Set();
+    let manifestPath = null;
+    const extraFiles = [];
+    for (let i = 0; i < extra.length; i++) {
+        const a = extra[i];
+        if (a === "--manifest") manifestPath = resolve(FIXTURES_DIR, extra[++i] || "");
+        else if (a.startsWith("--manifest=")) manifestPath = resolve(FIXTURES_DIR, a.slice("--manifest=".length));
+        else if (!a.startsWith("--")) extraFiles.push(resolve(FIXTURES_DIR, a));
+    }
     try {
-        const parsed = JSON.parse(res.stdout || "null");
-        const collect = (v) => {
-            if (v == null) return;
-            if (typeof v === "string") { const mm = /^(?:typ|col|spc|dep|int|mot|sta|cod|proc|inst|trust)-\d{2}$/.exec(v); if (mm) ids.add(v); return; }
-            if (Array.isArray(v)) { v.forEach(collect); return; }
-            if (typeof v === "object") Object.values(v).forEach(collect);
-        };
-        collect(parsed);
-    } catch { /* fall back to scanning raw output below */ }
-    let m;
-    ANCHOR_TOKEN.lastIndex = 0;
-    const bare = new RegExp("\\b(" + ANCHOR_PREFIXES + ")-(\\d{2})\\b", "g");
-    while ((m = bare.exec(out)) !== null) ids.add(`${m[1]}-${m[2]}`);
-    return { ids, spawnError: res.error ? String(res.error) : null };
+        const findings = runChecks([file, ...extraFiles], { manifestPath });
+        return { ids: new Set(findings.map((f) => f.rule)) };
+    } catch (e) {
+        return { ids: new Set(), error: String(e) };
+    }
 }
 
 // ── Check 4: contrastive validity — flag fires the rule, pass does not ──────────
-function checkContrastiveValidity(catalog) {
+function checkContrastiveValidity(catalog, onlyId = null) {
     const errors = [];
-    if (!existsSync(DETECTOR_MJS)) return { name: "contrastive fixture validity", pass: false, detail: "detector.mjs missing", errors: ["scripts/detector.mjs not found — cannot exercise fixtures"] };
     if (!existsSync(FIXTURES_DIR)) return { name: "contrastive fixture validity", pass: false, detail: "fixtures dir missing", errors: ["data/catalog/fixtures/ does not exist"] };
     const files = readdirSync(FIXTURES_DIR);
-    const present = new Set(files);
     const findFile = (id, kind) => files.find((f) => f.startsWith(`${id}.${kind}.`));
     let checked = 0;
     for (const row of catalog.rows) {
         if (row.fixture_pair !== "yes") continue;
+        if (onlyId && row.id !== onlyId) continue;
         const flag = findFile(row.id, "flag");
         const pass = findFile(row.id, "pass");
         if (!flag || !pass) continue; // absence is check 3's job
         checked++;
-        const flagRes = runDetector(join(FIXTURES_DIR, flag));
-        if (flagRes.spawnError) { errors.push(`${row.id}: detector spawn failed on flag (${flagRes.spawnError})`); continue; }
+        const flagRes = runEngine(join(FIXTURES_DIR, flag));
+        if (flagRes.error) { errors.push(`${row.id}: check engine threw on flag (${flagRes.error})`); continue; }
         if (!flagRes.ids.has(row.id)) errors.push(`${row.id}: flag fixture did not report ${row.id} (reported: ${[...flagRes.ids].join(",") || "none"})`);
-        const passRes = runDetector(join(FIXTURES_DIR, pass));
-        if (passRes.spawnError) { errors.push(`${row.id}: detector spawn failed on pass (${passRes.spawnError})`); continue; }
+        const passRes = runEngine(join(FIXTURES_DIR, pass));
+        if (passRes.error) { errors.push(`${row.id}: check engine threw on pass (${passRes.error})`); continue; }
         if (passRes.ids.has(row.id)) errors.push(`${row.id}: pass fixture wrongly reported ${row.id}`);
     }
     return { name: "contrastive fixture validity", pass: errors.length === 0, detail: `${checked} pair(s) exercised`, errors };
@@ -356,14 +359,15 @@ function checkFileTree() {
         "references/hard-rules.md", "references/create.md", "references/improve.md", "references/introspect.md",
         "references/diagnosis.md", "references/structure.md", "references/personality.md", "references/interaction.md", "references/lifecycle.md",
         "data/catalog/rules.csv",
+        "data/catalog/fixtures/cod-02.manifest.tokens.json",
         "data/design-md/SCHEMA.md", "data/design-md/nurix.md",
         "data/operator-pack/surface-catalog.md", "data/operator-pack/fixtures.md", "data/operator-pack/trust-rubric.md",
         "data/operator-pack/exemplars/list-detail.tsx", "data/operator-pack/exemplars/dashboard.tsx",
         "data/operator-pack/exemplars/entity-detail.tsx", "data/operator-pack/exemplars/create-edit.tsx",
         "data/operator-pack/exemplars/log-stream.tsx", "data/operator-pack/exemplars/command-center.tsx",
-        "scripts/detector.mjs", "scripts/phase-gate.mjs", "scripts/preship-sweep.mjs", "scripts/render-rung.mjs",
+        "scripts/lib/checks.mjs", "scripts/phase-gate.mjs", "scripts/preship-sweep.mjs", "scripts/render-rung.mjs",
         "scripts/scaffold.mjs", "scripts/derive-personality.mjs", "scripts/generate-fixtures.mjs",
-        "scripts/self-integrity.mjs", "scripts/hook-config.json",
+        "scripts/self-integrity.mjs",
     ];
     for (const rel of files) if (!existsSync(join(SKILL_ROOT, rel))) errors.push(`missing ${rel}`);
 
@@ -377,6 +381,138 @@ function checkFileTree() {
     return { name: "file-tree presence", pass: errors.length === 0, detail: `${found}/${files.length} files present`, errors };
 }
 
+// Every artifact directory under data/design-tokens/ (a directory holding design.tokens.json), sorted by slug.
+function listArtifactSlugs() {
+    if (!existsSync(TOKENS_DIR)) return [];
+    return readdirSync(TOKENS_DIR, { withFileTypes: true })
+        .filter((d) => d.isDirectory() && existsSync(join(TOKENS_DIR, d.name, "design.tokens.json")))
+        .map((d) => d.name)
+        .sort();
+}
+
+// Parse goldens.json into its entry slugs (every key except "_meta"), or null when absent/unparseable.
+function readGoldenSlugs() {
+    const text = readSafe(GOLDENS_JSON);
+    if (text === null) return null;
+    try { return Object.keys(JSON.parse(text)).filter((k) => k !== "_meta").sort(); }
+    catch { return null; }
+}
+
+// Run an async worker over items with at most `limit` in flight; results keep item order.
+async function runPool(items, limit, worker) {
+    const results = new Array(items.length);
+    let next = 0;
+    const lane = async () => {
+        while (next < items.length) {
+            const i = next++;
+            results[i] = await worker(items[i], i);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) || 1 }, lane));
+    return results;
+}
+
+// Spawn `node <args>` and resolve with { status, stdout, stderr } (never rejects; a spawn error surfaces as status -1).
+function execNode(args) {
+    return new Promise((resolveExec) => {
+        const child = spawn(process.execPath, args, { stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (d) => { stdout += d; });
+        child.stderr.on("data", (d) => { stderr += d; });
+        child.on("error", (e) => resolveExec({ status: -1, stdout, stderr: stderr + String(e) }));
+        child.on("close", (status) => resolveExec({ status, stdout, stderr }));
+    });
+}
+
+// First non-empty line of a child process's output, for one-line error reporting.
+function firstLine(text) {
+    return (text || "").split("\n").find((l) => l.trim() !== "") || "(no output)";
+}
+
+// ── Check 7: token-era file tree + goldens<->artifact parity ───────────────────
+function checkTokenFileTree() {
+    const errors = [];
+    const pins = [
+        "data/design-tokens/SCHEMA.md",
+        "data/design-tokens/goldens.json",
+        "scripts/convert-design-md.mjs",
+        "scripts/snapshot-goldens.mjs",
+        "scripts/lib/golden.mjs",
+    ];
+    for (const rel of pins) if (!existsSync(join(SKILL_ROOT, rel))) errors.push(`missing ${rel}`);
+    const pinsFound = pins.length - errors.length;
+
+    const diskSlugs = listArtifactSlugs();
+    const goldenSlugs = readGoldenSlugs();
+    if (goldenSlugs === null) {
+        errors.push("goldens.json missing or does not parse as JSON");
+    } else {
+        const goldenSet = new Set(goldenSlugs);
+        for (const slug of goldenSlugs) {
+            if (!existsSync(join(TOKENS_DIR, slug, "design.tokens.json")))
+                errors.push(`goldens.json entry "${slug}" has no data/design-tokens/${slug}/design.tokens.json on disk`);
+            else if (!existsSync(join(TOKENS_DIR, slug, "design.resolver.json")))
+                errors.push(`goldens.json entry "${slug}": data/design-tokens/${slug}/ is missing design.resolver.json`);
+        }
+        for (const slug of diskSlugs) {
+            if (!goldenSet.has(slug)) errors.push(`artifact dir data/design-tokens/${slug}/ has no goldens.json entry`);
+            else if (!existsSync(join(TOKENS_DIR, slug, "design.resolver.json")) && !errors.some((e) => e.includes(`"${slug}"`)))
+                errors.push(`artifact dir data/design-tokens/${slug}/ is missing design.resolver.json`);
+        }
+    }
+    const goldenCount = goldenSlugs === null ? 0 : goldenSlugs.length;
+    return { name: "token file-tree + goldens parity", pass: errors.length === 0, detail: errors.length ? `${errors.length} issue(s)` : `${pinsFound}/${pins.length} pins, goldens<->artifacts ${goldenCount}<->${diskSlugs.length}`, errors };
+}
+
+// ── Check 8: every design-tokens artifact passes derive-personality --check ────
+async function checkArtifactValidity() {
+    const slugs = listArtifactSlugs();
+    if (slugs.length === 0) return { name: "artifact validity (--check)", pass: false, detail: "no artifact dirs found", errors: [`no design.tokens.json dirs under ${TOKENS_DIR}`] };
+    const runs = await runPool(slugs, SPAWN_LIMIT, (slug) => execNode([DERIVE_PERSONALITY, join(TOKENS_DIR, slug), "--check"]));
+    const errors = [];
+    runs.forEach((res, i) => {
+        if (res.status !== 0) errors.push(`${slugs[i]}: --check exited ${res.status}: ${firstLine(res.stderr || res.stdout)}`);
+    });
+    return { name: "artifact validity (--check)", pass: errors.length === 0, detail: `${slugs.length - errors.length}/${slugs.length} artifacts pass --check`, errors };
+}
+
+// ── Check 9: emitted CSS hashes match goldens.json (slow; gated behind --goldens) ──
+async function checkGoldenMatch(enabled) {
+    if (!enabled) return { name: "golden emission match", pass: true, skip: true, detail: "skipped (slow) — run with --goldens to verify emitted hashes against goldens.json", errors: [] };
+    const goldenSlugs = readGoldenSlugs();
+    if (goldenSlugs === null) return { name: "golden emission match", pass: false, detail: "goldens.json missing/unparseable", errors: ["goldens.json missing or does not parse as JSON"] };
+    const goldens = JSON.parse(readSafe(GOLDENS_JSON));
+    const emitRoot = mkdtempSync(join(tmpdir(), "design-self-integrity-"));
+    let matched = 0;
+    const errors = [];
+    try {
+        // Each worker returns its slug's error list; flattening after the pool keeps report order deterministic.
+        const perSlug = await runPool(goldenSlugs, SPAWN_LIMIT, async (slug) => {
+            const slugErrors = [];
+            const outdir = join(emitRoot, slug);
+            const res = await execNode([DERIVE_PERSONALITY, join(TOKENS_DIR, slug), "--emit", outdir]);
+            if (res.status !== 0) {
+                slugErrors.push(`${slug}: --emit exited ${res.status}: ${firstLine(res.stderr || res.stdout)}`);
+                return slugErrors;
+            }
+            for (const [key, fileName] of [["personality", "personality.css"], ["globals", "globals.css"]]) {
+                const css = readSafe(join(outdir, "src/styles", fileName));
+                if (css === null) { slugErrors.push(`${slug}: emit produced no src/styles/${fileName}`); continue; }
+                const actual = goldenHash(css);
+                const expected = goldens[slug] && goldens[slug][key];
+                if (actual === expected) matched++;
+                else slugErrors.push(`${slug}: ${fileName} hash ${actual} != golden ${expected ?? "(missing key)"}`);
+            }
+            return slugErrors;
+        });
+        for (const slugErrors of perSlug) errors.push(...slugErrors);
+    } finally {
+        rmSync(emitRoot, { recursive: true, force: true });
+    }
+    return { name: "golden emission match", pass: errors.length === 0, detail: `${matched}/${goldenSlugs.length * 2} hashes match goldens.json`, errors };
+}
+
 // Derive the ground-truth counts from the catalog itself.
 function deriveGround(catalog) {
     return {
@@ -386,14 +522,42 @@ function deriveGround(catalog) {
     };
 }
 
+// Run one rule's contrastive fixture pair through the check engine and exit 0/1 on its result.
+function runSingleFixture(catalog, ruleId) {
+    const row = catalog.rows.find((r) => r.id === ruleId);
+    if (!row) { console.error(`--fixture: no rules.csv row with id "${ruleId}"`); process.exit(2); }
+    if (row.fixture_pair !== "yes") { console.error(`--fixture: ${ruleId} has fixture_pair=${row.fixture_pair}; no contrastive pair to run`); process.exit(2); }
+    const r = checkContrastiveValidity(catalog, ruleId);
+    if (r.errors.length === 0 && r.detail.startsWith("0 ")) {
+        console.error(`--fixture: ${ruleId}.flag.* / ${ruleId}.pass.* not found in data/catalog/fixtures/`);
+        process.exit(2);
+    }
+    if (r.pass) { console.log(`PASS  fixture pair ${ruleId} — flag reports ${ruleId}, pass reports zero.`); process.exit(0); }
+    console.error(`FAIL  fixture pair ${ruleId}`);
+    for (const e of r.errors) console.error(`   - ${e}`);
+    process.exit(1);
+}
+
 // Run every check, print the summary table, and exit non-zero on any failure.
-function main() {
+async function main() {
+    const args = process.argv.slice(2);
+    let fixtureId = null;
+    let runGoldens = false;
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === "--fixture") fixtureId = args[++i] || null;
+        else if (args[i].startsWith("--fixture=")) fixtureId = args[i].slice("--fixture=".length);
+        else if (args[i] === "--goldens") runGoldens = true;
+    }
+
     const results = [];
     let catalog = null;
     try { catalog = loadCatalog(); } catch (e) {
         console.error("FATAL: " + e.message);
         process.exit(2);
     }
+
+    if (fixtureId) runSingleFixture(catalog, fixtureId);
+
     const ground = deriveGround(catalog);
 
     const runners = [
@@ -403,9 +567,13 @@ function main() {
         () => checkContrastiveValidity(catalog),
         () => checkStatedCounts(catalog, ground),
         () => checkFileTree(),
+        () => checkTokenFileTree(),
+        () => checkArtifactValidity(),
+        () => checkGoldenMatch(runGoldens),
+        () => validateCombinations(COMBINATIONS_DIR),
     ];
     for (const run of runners) {
-        try { results.push(run()); }
+        try { results.push(await run()); }
         catch (e) { results.push({ name: run.name || "check", pass: false, detail: "threw", errors: [e.stack || String(e)] }); }
     }
 
@@ -420,7 +588,7 @@ function main() {
     console.log("self-integrity — design skill");
     console.log("=".repeat(60));
     const pad = (s, n) => (s + " ".repeat(n)).slice(0, n);
-    for (const r of results) console.log(`${r.pass ? "PASS" : "FAIL"}  ${pad(r.name, 34)} ${r.detail}`);
+    for (const r of results) console.log(`${r.skip ? "SKIP" : r.pass ? "PASS" : "FAIL"}  ${pad(r.name, 34)} ${r.detail}`);
     console.log("=".repeat(60));
 
     const failed = results.filter((r) => !r.pass);
@@ -429,4 +597,4 @@ function main() {
     process.exit(0);
 }
 
-main();
+main().catch((e) => { console.error("FATAL: " + (e.stack || String(e))); process.exit(2); });

package/data/harnesses/code/skills/design/scripts/snapshot-goldens.mjs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+// skills/design/scripts/snapshot-goldens.mjs — snapshot golden hashes of the CSS emitted for every design-tokens artifact (data/design-tokens/<slug>/) into data/design-tokens/goldens.json, the byte-match regression oracle for the emission pipeline.
+
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+import { goldenHash } from "./lib/golden.mjs";
+
+const scriptsDir = dirname(fileURLToPath(import.meta.url));
+const skillDir = dirname(scriptsDir);
+const derivePersonalityScript = join(scriptsDir, "derive-personality.mjs");
+const tokensDir = join(skillDir, "data", "design-tokens");
+const goldensJsonPath = join(tokensDir, "goldens.json");
+
+// Where full emitted outputs are kept (one subdir per slug) — GOLDENS_EMIT_ROOT to pin it, else a fresh temp dir.
+const emitRoot = process.env.GOLDENS_EMIT_ROOT || mkdtempSync(join(tmpdir(), "design-goldens-"));
+mkdirSync(emitRoot, { recursive: true });
+
+// Every artifact directory under data/design-tokens/ (a directory holding design.tokens.json).
+const entries = readdirSync(tokensDir, { withFileTypes: true })
+  .filter((d) => d.isDirectory() && existsSync(join(tokensDir, d.name, "design.tokens.json")))
+  .map((d) => ({ slug: d.name, path: join(tokensDir, d.name) }))
+  .sort((a, b) => (a.slug < b.slug ? -1 : 1));
+
+const goldens = {};
+const failures = [];
+
+for (const { slug, path } of entries) {
+  const outdir = join(emitRoot, slug);
+  const run = spawnSync(process.execPath, [derivePersonalityScript, path, "--emit", outdir], { encoding: "utf8" });
+  if (run.status !== 0) {
+    failures.push({ slug, error: (run.stderr || run.stdout || `exit status ${run.status}`).trim() });
+    console.log(`FAIL ${slug}`);
+    continue;
+  }
+  try {
+    const personalityCss = readFileSync(join(outdir, "src", "styles", "personality.css"), "utf8");
+    const globalsCss = readFileSync(join(outdir, "src", "styles", "globals.css"), "utf8");
+    goldens[slug] = { personality: goldenHash(personalityCss), globals: goldenHash(globalsCss) };
+    console.log(`OK   ${slug}`);
+  } catch (err) {
+    failures.push({ slug, error: String((err && err.message) || err) });
+    console.log(`FAIL ${slug}`);
+  }
+}
+
+// Assemble the sorted-key document; "_meta" sorts first (ASCII "_" < "a").
+const document = {
+  _meta: {
+    description: "Post-carrier golden hashes of the CSS emitted by derive-personality.mjs --emit for every design-tokens artifact (data/design-tokens/<slug>/), dark-inclusive: an artifact shipping design.tokens.dark.json hashes its emitted [data-theme=\"dark\"] block too. Each entry records the sha256 of the comment-stripped personality.css and globals.css (see scripts/lib/golden.mjs). The byte-match regression oracle for the emission pipeline.",
+    generator: "scripts/snapshot-goldens.mjs",
+    strip: "css-comments",
+  },
+};
+for (const slug of Object.keys(goldens).sort()) document[slug] = goldens[slug];
+
+mkdirSync(dirname(goldensJsonPath), { recursive: true });
+writeFileSync(goldensJsonPath, JSON.stringify(document, null, 2) + "\n");
+
+console.log(`\n${entries.length} entries: ${Object.keys(goldens).length} OK, ${failures.length} FAIL`);
+console.log(`goldens: ${goldensJsonPath}`);
+console.log(`emitted outputs: ${emitRoot}`);
+if (failures.length > 0) {
+  for (const f of failures) console.error(`\nFAIL ${f.slug}:\n${f.error}`);
+  process.exit(1);
+}