@nurix/etna 0.19.10 → 0.19.12

package/data/harnesses/code/skills/design/scripts/self-integrity.mjs

@@ -1,675 +0,0 @@
-// skills/design/scripts/self-integrity.mjs — the design skill's own CI check: anchor parity (rule ids and the doctrine-floor f-ids), catalog invariants, stated-count and fixture-pair validation (pairs exercised through lib/checks.mjs), the token-era net — token file-tree + goldens parity, per-artifact --check validity, and (behind --goldens) golden emission hash match — plus combination-data validation (validate-combinations.mjs); --fixture <rule-id> runs a single pair
-import { readFileSync, existsSync, readdirSync, mkdtempSync, rmSync } from "node:fs";
-import { join, dirname, resolve } from "node:path";
-import { tmpdir } from "node:os";
-import { spawn } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { runChecks } from "./lib/checks.mjs";
-import { goldenHash } from "./lib/golden.mjs";
-import { validateCombinations } from "./validate-combinations.mjs";
-
-const SCRIPTS_DIR = dirname(fileURLToPath(import.meta.url));
-const SKILL_ROOT = join(SCRIPTS_DIR, "..");
-
-const CATALOG_CSV = join(SKILL_ROOT, "data/catalog/rules.csv");
-const FIXTURES_DIR = join(SKILL_ROOT, "data/catalog/fixtures");
-const HARD_RULES_MD = join(SKILL_ROOT, "references/hard-rules.md");
-const TOKENS_DIR = join(SKILL_ROOT, "data/design-tokens");
-const COMBINATIONS_DIR = join(SKILL_ROOT, "data/combinations");
-const GOLDENS_JSON = join(TOKENS_DIR, "goldens.json");
-const DERIVE_PERSONALITY = join(SCRIPTS_DIR, "derive-personality.mjs");
-const SPAWN_LIMIT = 8;
-
-const CSV_HEADER = ["id", "dimension", "statement", "numbers", "grade", "fire_points", "detector", "scope_note", "provenance", "fixture_pair"];
-const VALID_DIMENSIONS = new Set(["P1", "P2", "P3", "P4", "P5", "P6", "P7", "S1", "S2", "S3", "S4", "B1", "B2", "B3", "B4", "B5"]);
-const ANCHOR_PREFIXES = "typ|col|spc|dep|int|mot|sta|cod|proc|inst|trust";
-const ANCHOR_TOKEN = new RegExp("`(" + ANCHOR_PREFIXES + ")-(\\d{2})`", "g");
-const ANCHOR_ID = "(?:" + ANCHOR_PREFIXES + ")-\\d{2}";
-
-const PINNED = { rows: 136, source: 70, render: 12, archetypes: 6, primitives: 27, colorTokens: 36, semanticTokens: 19, substrateTokens: 17, rampSteps: 7, elevation: 4 };
-
-// The doctrine floor's canonical ids (f01-f12) — enumerated once in hard-rules.md's Doctrine floor
-// section; every in-skill floor citation must name one of these (05-rule-amendments.md, the mapping).
-const FLOOR_IDS = Array.from({ length: 12 }, (_, i) => "f" + String(i + 1).padStart(2, "0"));
-
-// Read a UTF-8 file, returning null when it does not exist.
-function readSafe(path) {
-    return existsSync(path) ? readFileSync(path, "utf8") : null;
-}
-
-// Parse RFC4180-style CSV text into an array of field arrays (quotes + doubled-quote escapes honored).
-function parseCsv(text) {
-    const rows = [];
-    let field = "";
-    let record = [];
-    let inQuotes = false;
-    for (let i = 0; i < text.length; i++) {
-        const ch = text[i];
-        if (inQuotes) {
-            if (ch === '"') {
-                if (text[i + 1] === '"') { field += '"'; i++; }
-                else inQuotes = false;
-            } else field += ch;
-        } else if (ch === '"') inQuotes = true;
-        else if (ch === ",") { record.push(field); field = ""; }
-        else if (ch === "\n") { record.push(field); rows.push(record); record = []; field = ""; }
-        else if (ch === "\r") { /* skip */ }
-        else field += ch;
-    }
-    if (field.length > 0 || record.length > 0) { record.push(field); rows.push(record); }
-    return rows;
-}
-
-// Split a rule id into its {prefix, num} parts, or null when it is not a well-formed anchor id.
-function splitId(id) {
-    const m = /^([a-z]+)-(\d{2})$/.exec(id);
-    return m ? { prefix: m[1], num: parseInt(m[2], 10) } : null;
-}
-
-// Strip leading whitespace and a single markdown list marker from a line.
-function stripListMarker(line) {
-    return line.replace(/^\s*/, "").replace(/^[-*+]\s+/, "");
-}
-
-// Load and index the rule catalog into typed row objects plus derived counts.
-function loadCatalog() {
-    const text = readSafe(CATALOG_CSV);
-    if (text === null) throw new Error("rules.csv not found at " + CATALOG_CSV);
-    const raw = parseCsv(text).filter((r) => r.length > 1 || (r.length === 1 && r[0].trim() !== ""));
-    const header = raw[0];
-    const dataRows = raw.slice(1).map((cells) => {
-        const obj = {};
-        CSV_HEADER.forEach((k, idx) => { obj[k] = cells[idx] !== undefined ? cells[idx] : ""; });
-        obj._cells = cells;
-        return obj;
-    });
-    return { header, rows: dataRows };
-}
-
-// ── Check 1: rules.csv is well-formed ──────────────────────────────────────────
-function checkCsvWellFormed(catalog) {
-    const errors = [];
-    const { header, rows } = catalog;
-
-    if (header.length !== CSV_HEADER.length || CSV_HEADER.some((h, i) => header[i] !== h))
-        errors.push(`header mismatch: expected [${CSV_HEADER.join(",")}] got [${header.join(",")}]`);
-
-    const seen = new Map();
-    const byPrefix = new Map();
-    for (const row of rows) {
-        if (row._cells.length !== CSV_HEADER.length)
-            errors.push(`${row.id || "?"}: has ${row._cells.length} columns, expected ${CSV_HEADER.length}`);
-
-        const parts = splitId(row.id);
-        if (!parts) { errors.push(`malformed id "${row.id}" (want <prefix>-NN)`); }
-        else {
-            if (seen.has(row.id)) errors.push(`duplicate id ${row.id}`);
-            seen.set(row.id, true);
-            if (!byPrefix.has(parts.prefix)) byPrefix.set(parts.prefix, []);
-            byPrefix.get(parts.prefix).push(parts.num);
-        }
-
-        if (!VALID_DIMENSIONS.has(row.dimension))
-            errors.push(`${row.id}: invalid dimension "${row.dimension}"`);
-
-        // grade/detector/fixture_pair invariants
-        if (row.detector === "source" && row.fixture_pair !== "yes")
-            errors.push(`${row.id}: detector=source must have fixture_pair=yes (got "${row.fixture_pair}")`);
-        if (row.grade === "judged" && !(row.detector === "none" || row.detector === "render"))
-            errors.push(`${row.id}: grade=judged must have detector none|render (got "${row.detector}")`);
-        if (row.grade === "procedure" && row.detector !== "procedure")
-            errors.push(`${row.id}: grade=procedure must have detector=procedure (got "${row.detector}")`);
-        if (!["machine", "judged", "procedure"].includes(row.grade))
-            errors.push(`${row.id}: invalid grade "${row.grade}"`);
-        if (!["source", "render", "procedure", "none"].includes(row.detector))
-            errors.push(`${row.id}: invalid detector "${row.detector}"`);
-        if (!["yes", "na"].includes(row.fixture_pair))
-            errors.push(`${row.id}: invalid fixture_pair "${row.fixture_pair}"`);
-    }
-
-    // Contiguous numbering per prefix: 1..N with no gaps, no duplicates.
-    for (const [prefix, nums] of byPrefix) {
-        const sorted = [...nums].sort((a, b) => a - b);
-        for (let i = 0; i < sorted.length; i++) {
-            if (sorted[i] !== i + 1) {
-                errors.push(`${prefix}-* numbering not contiguous: expected ${i + 1} at position ${i}, got ${sorted[i]} (full: ${sorted.join(",")})`);
-                break;
-            }
-        }
-    }
-
-    return { name: "rules.csv well-formed", pass: errors.length === 0, detail: errors.length ? `${errors.length} issue(s)` : `${rows.length} rows, ${byPrefix.size} prefixes`, errors };
-}
-
-// ── Check 2: anchor parity between rules.csv and hard-rules.md ──────────────────
-function checkAnchorParity(catalog) {
-    const errors = [];
-    const md = readSafe(HARD_RULES_MD);
-    if (md === null) return { name: "anchor parity (prose<->catalog)", pass: false, detail: "hard-rules.md missing", errors: ["hard-rules.md not found at " + HARD_RULES_MD] };
-
-    const lines = md.split("\n");
-    const defCounts = new Map(); // id -> { main, judged }
-    const rangeCovered = new Set();
-    const allBacktickIds = new Set();
-    const judgedHeader = /^##\s+judged dimensions/i;
-    let inJudged = false;
-
-    const bump = (id, section) => {
-        if (!defCounts.has(id)) defCounts.set(id, { main: 0, judged: 0 });
-        defCounts.get(id)[section]++;
-    };
-
-    for (const line of lines) {
-        if (judgedHeader.test(line.trim())) inJudged = true;
-
-        let m;
-        ANCHOR_TOKEN.lastIndex = 0;
-        while ((m = ANCHOR_TOKEN.exec(line)) !== null) allBacktickIds.add(`${m[1]}-${m[2]}`);
-
-        const body = stripListMarker(line);
-        const rangeMatch = new RegExp("^`(" + ANCHOR_ID + ")`\\s*[\\u2013\\u2014-]\\s*`(" + ANCHOR_ID + ")`").exec(body);
-        const defMatch = new RegExp("^`(" + ANCHOR_ID + ")`").exec(body);
-
-        if (rangeMatch) {
-            const a = splitId(rangeMatch[1]);
-            const b = splitId(rangeMatch[2]);
-            if (a && b && a.prefix === b.prefix) for (let n = a.num; n <= b.num; n++) rangeCovered.add(`${a.prefix}-${String(n).padStart(2, "0")}`);
-        }
-        if (defMatch) bump(defMatch[1], inJudged ? "judged" : "main");
-    }
-
-    const csvIds = new Set(catalog.rows.map((r) => r.id));
-    const proseCovered = new Set([...rangeCovered, ...defCounts.keys()]);
-
-    // No prose anchor without a csv row.
-    for (const id of allBacktickIds)
-        if (!csvIds.has(id)) errors.push(`prose anchor ${id} has no rules.csv row`);
-
-    for (const row of catalog.rows) {
-        const c = defCounts.get(row.id) || { main: 0, judged: 0 };
-        const total = c.main + c.judged;
-        const isInstTrust = row.id.startsWith("inst-") || row.id.startsWith("trust-");
-
-        if (row.grade === "machine" || row.grade === "procedure") {
-            if (c.main === 1 && c.judged === 0) { /* ok */ }
-            else if (total === 0) errors.push(`${row.grade} rule ${row.id} has no backticked definition line in hard-rules.md`);
-            else if (total > 1) errors.push(`${row.id} defined ${total} times (want exactly 1)`);
-            else if (c.judged > 0) errors.push(`${row.grade} rule ${row.id} is defined inside the Judged dimensions section`);
-        } else if (row.grade === "judged" && isInstTrust) {
-            if (!rangeCovered.has(row.id) && total === 0)
-                errors.push(`judged range rule ${row.id} not covered by a range pointer line`);
-        } else if (row.grade === "judged") {
-            if (c.judged === 1 && c.main === 0) { /* ok */ }
-            else if (total === 0) errors.push(`judged rule ${row.id} missing from the Judged dimensions index`);
-            else if (c.main > 0) errors.push(`judged rule ${row.id} defined outside the Judged dimensions section`);
-            else if (c.judged > 1) errors.push(`judged rule ${row.id} indexed ${c.judged} times (want exactly 1)`);
-        }
-
-        if (!proseCovered.has(row.id)) errors.push(`rules.csv row ${row.id} has no prose coverage`);
-    }
-
-    // The two collapsed range pointers must be present and complete.
-    for (let n = 1; n <= 11; n++) if (!rangeCovered.has(`inst-${String(n).padStart(2, "0")}`)) errors.push(`inst-${String(n).padStart(2, "0")} not covered by the inst range pointer`);
-    for (let n = 1; n <= 4; n++) if (!rangeCovered.has(`trust-0${n}`)) errors.push(`trust-0${n} not covered by the trust range pointer`);
-
-    const defTotal = [...defCounts.keys()].length;
-    return { name: "anchor parity (prose<->catalog)", pass: errors.length === 0, detail: errors.length ? `${errors.length} parity break(s)` : `${defTotal} definitions, ${rangeCovered.size} range-covered, all ${catalog.rows.length} rows covered`, errors };
-}
-
-// ── Check 3: every fixture_pair=yes rule ships a flag + pass fixture ────────────
-function checkFixturePresence(catalog) {
-    const errors = [];
-    const files = existsSync(FIXTURES_DIR) ? readdirSync(FIXTURES_DIR) : null;
-    if (files === null) {
-        const needed = catalog.rows.filter((r) => r.fixture_pair === "yes");
-        return { name: "fixture-pair presence", pass: false, detail: `fixtures dir missing; ${needed.length} pairs needed`, errors: ["data/catalog/fixtures/ does not exist"] };
-    }
-    const present = new Set(files);
-    const hasKind = (id, kind) => [...present].some((f) => f.startsWith(`${id}.${kind}.`));
-    let ok = 0;
-    for (const row of catalog.rows) {
-        if (row.fixture_pair !== "yes") continue;
-        const hasFlag = hasKind(row.id, "flag");
-        const hasPass = hasKind(row.id, "pass");
-        if (!hasFlag) errors.push(`${row.id}: missing ${row.id}.flag.*`);
-        if (!hasPass) errors.push(`${row.id}: missing ${row.id}.pass.*`);
-        if (hasFlag && hasPass) ok++;
-    }
-    const total = catalog.rows.filter((r) => r.fixture_pair === "yes").length;
-    return { name: "fixture-pair presence", pass: errors.length === 0, detail: `${ok}/${total} pairs present`, errors };
-}
-
-// Run the check engine (lib/checks.mjs) on one fixture file and return the set of anchor ids it reports.
-function runEngine(file) {
-    // Scan the leading comment block for a `// detector-args:` directive (the mandatory file-path
-    // comment occupies line 1, so the directive cannot be line 0). Relative paths in it (e.g. a
-    // --manifest sibling) resolve against FIXTURES_DIR, matching each fixture's documented verify command.
-    let extra = [];
-    for (const line of (readSafe(file) || "").split("\n")) {
-        const t = line.trim();
-        if (t !== "" && !t.startsWith("//")) break;
-        const argMatch = /^\/\/\s*detector-args:\s*(.+)$/.exec(t);
-        if (argMatch) { extra = argMatch[1].trim().split(/\s+/); break; }
-    }
-    let manifestPath = null;
-    const extraFiles = [];
-    for (let i = 0; i < extra.length; i++) {
-        const a = extra[i];
-        if (a === "--manifest") manifestPath = resolve(FIXTURES_DIR, extra[++i] || "");
-        else if (a.startsWith("--manifest=")) manifestPath = resolve(FIXTURES_DIR, a.slice("--manifest=".length));
-        else if (!a.startsWith("--")) extraFiles.push(resolve(FIXTURES_DIR, a));
-    }
-    try {
-        const findings = runChecks([file, ...extraFiles], { manifestPath });
-        return { ids: new Set(findings.map((f) => f.rule)) };
-    } catch (e) {
-        return { ids: new Set(), error: String(e) };
-    }
-}
-
-// ── Check 4: contrastive validity — flag fires the rule, pass does not ──────────
-function checkContrastiveValidity(catalog, onlyId = null) {
-    const errors = [];
-    if (!existsSync(FIXTURES_DIR)) return { name: "contrastive fixture validity", pass: false, detail: "fixtures dir missing", errors: ["data/catalog/fixtures/ does not exist"] };
-    const files = readdirSync(FIXTURES_DIR);
-    const findFile = (id, kind) => files.find((f) => f.startsWith(`${id}.${kind}.`));
-    let checked = 0;
-    for (const row of catalog.rows) {
-        if (row.fixture_pair !== "yes") continue;
-        if (onlyId && row.id !== onlyId) continue;
-        const flag = findFile(row.id, "flag");
-        const pass = findFile(row.id, "pass");
-        if (!flag || !pass) continue; // absence is check 3's job
-        checked++;
-        const flagRes = runEngine(join(FIXTURES_DIR, flag));
-        if (flagRes.error) { errors.push(`${row.id}: check engine threw on flag (${flagRes.error})`); continue; }
-        if (!flagRes.ids.has(row.id)) errors.push(`${row.id}: flag fixture did not report ${row.id} (reported: ${[...flagRes.ids].join(",") || "none"})`);
-        const passRes = runEngine(join(FIXTURES_DIR, pass));
-        if (passRes.error) { errors.push(`${row.id}: check engine threw on pass (${passRes.error})`); continue; }
-        if (passRes.ids.has(row.id)) errors.push(`${row.id}: pass fixture wrongly reported ${row.id}`);
-    }
-    return { name: "contrastive fixture validity", pass: errors.length === 0, detail: `${checked} pair(s) exercised`, errors };
-}
-
-// Recursively collect prose/data files (.md/.csv/.tsx/.json) under a dir for the floor-citation scan.
-function walkTextFiles(dir, acc = []) {
-    if (!existsSync(dir)) return acc;
-    for (const ent of readdirSync(dir, { withFileTypes: true })) {
-        if (ent.name.startsWith(".") || ent.name === "node_modules") continue;
-        const full = join(dir, ent.name);
-        if (ent.isDirectory()) walkTextFiles(full, acc);
-        else if (/\.(md|csv|tsx|json)$/.test(ent.name)) acc.push(full);
-    }
-    return acc;
-}
-
-// ── Check 2b: doctrine-floor anchor parity (f-ids) ─────────────────────────────
-// Same mechanism as rule-id parity: hard-rules.md's Doctrine floor section is the canonical
-// enumeration (exactly f01-f12, once each); every f-id cited anywhere in the skill's prose/data
-// names an enumerated id, and the retired "floor P<n>" numbering is gone.
-function checkFloorParity() {
-    const errors = [];
-    const md = readSafe(HARD_RULES_MD);
-    if (md === null) return { name: "floor parity (f-ids)", pass: false, detail: "hard-rules.md missing", errors: ["hard-rules.md not found at " + HARD_RULES_MD] };
-
-    const section = /^##\s+Doctrine floor\s*$([\s\S]*?)(?=^##\s)/m.exec(md);
-    const enumerated = new Map();
-    if (!section) errors.push('hard-rules.md has no "## Doctrine floor" section (the canonical f01-f12 enumeration)');
-    else {
-        for (const m of section[1].matchAll(/`(f\d{2})`/g)) enumerated.set(m[1], (enumerated.get(m[1]) || 0) + 1);
-        for (const id of FLOOR_IDS) {
-            const n = enumerated.get(id) || 0;
-            if (n === 0) errors.push(`doctrine floor enumeration is missing ${id}`);
-            else if (n > 1) errors.push(`${id} enumerated ${n} times (want exactly 1)`);
-        }
-        for (const id of enumerated.keys()) if (!FLOOR_IDS.includes(id)) errors.push(`enumeration carries unknown floor id ${id} (legal: f01-f12)`);
-    }
-
-    const targets = [join(SKILL_ROOT, "SKILL.md"), ...walkTextFiles(join(SKILL_ROOT, "references")), ...walkTextFiles(join(SKILL_ROOT, "data"))];
-    let cited = 0;
-    for (const file of targets) {
-        const text = readSafe(file);
-        if (text === null) continue;
-        const rel = file.replace(SKILL_ROOT + "/", "");
-        text.split("\n").forEach((line, i) => {
-            for (const m of line.matchAll(/(?:\bfloor\s+|[(`/]\s?)(f\d{2})\b/g)) {
-                cited++;
-                if (!FLOOR_IDS.includes(m[1])) errors.push(`${rel}:${i + 1}: cites unknown floor id ${m[1]} (legal: f01-f12)`);
-            }
-            const stale = /\bfloor\s+P\d+\b/.exec(line);
-            if (stale) errors.push(`${rel}:${i + 1}: retired P-numbered floor citation "${stale[0]}" — rename to its f-id (05-rule-amendments.md mapping)`);
-        });
-    }
-    return { name: "floor parity (f-ids)", pass: errors.length === 0, detail: errors.length ? `${errors.length} parity break(s)` : `${enumerated.size} enumerated, ${cited} citation(s) checked`, errors };
-}
-
-const NUMBER_WORDS = { one: 1, two: 2, three: 3, four: 4, five: 5, six: 6, seven: 7, eight: 8, nine: 9, ten: 10, eleven: 11, twelve: 12, thirteen: 13, fourteen: 14, fifteen: 15, sixteen: 16, seventeen: 17, eighteen: 18, nineteen: 19, twenty: 20, "twenty-six": 26 };
-
-// Resolve a numeric token (digits or an English number word) to a number, or NaN.
-function toNumber(tok) {
-    if (/^\d+$/.test(tok)) return parseInt(tok, 10);
-    return NUMBER_WORDS[tok.toLowerCase()] ?? NaN;
-}
-
-// ── Check 5: stated counts in prose match the ground truth ─────────────────────
-function checkStatedCounts(catalog, ground) {
-    const errors = [];
-    // Ground truth drift guard: derived counts (CSV rows; the token surface counted off the Nurix
-    // default artifact) must match the pinned numbers.
-    if (ground.rows !== PINNED.rows) errors.push(`derived row count ${ground.rows} != pinned ${PINNED.rows}`);
-    if (ground.source !== PINNED.source) errors.push(`derived source count ${ground.source} != pinned ${PINNED.source}`);
-    if (ground.render !== PINNED.render) errors.push(`derived machine-render count ${ground.render} != pinned ${PINNED.render}`);
-    if (ground.primitives !== null && ground.primitives !== PINNED.primitives) errors.push(`derived primitive count ${ground.primitives} != pinned ${PINNED.primitives}`);
-    if (ground.colorTokens !== null && ground.colorTokens !== PINNED.colorTokens) errors.push(`derived color-token count ${ground.colorTokens} != pinned ${PINNED.colorTokens}`);
-    if (ground.rampSteps !== null && ground.rampSteps !== PINNED.rampSteps) errors.push(`derived ramp-step count ${ground.rampSteps} != pinned ${PINNED.rampSteps}`);
-    if (ground.elevation !== null && ground.elevation !== PINNED.elevation) errors.push(`derived elevation count ${ground.elevation} != pinned ${PINNED.elevation}`);
-
-    const gtMap = {
-        rules: ground.rows, rule: ground.rows, rows: ground.rows, row: ground.rows,
-        source: ground.source, render: ground.render,
-        archetypes: PINNED.archetypes, archetype: PINNED.archetypes,
-        primitives: PINNED.primitives, primitive: PINNED.primitives,
-        "color-tokens": PINNED.colorTokens, "color tokens": PINNED.colorTokens, colortokens: PINNED.colorTokens,
-        "semantic-tokens": PINNED.semanticTokens, "substrate-tokens": PINNED.substrateTokens,
-        "ramp-steps": PINNED.rampSteps, rampsteps: PINNED.rampSteps, elevation: PINNED.elevation,
-    };
-
-    const targets = [join(SKILL_ROOT, "SKILL.md"), ...(existsSync(join(SKILL_ROOT, "references")) ? readdirSync(join(SKILL_ROOT, "references")).filter((f) => f.endsWith(".md")).map((f) => join(SKILL_ROOT, "references", f)) : [])];
-    let commentClaims = 0;
-    let bareClaims = 0;
-    for (const file of targets) {
-        const text = readSafe(file);
-        if (text === null) continue;
-        const rel = file.replace(SKILL_ROOT + "/", "");
-        const linesArr = text.split("\n");
-        linesArr.forEach((line, i) => {
-            // (a) machine-readable HTML comment claims: <!-- count:<name>=<n> -->
-            const cmt = /<!--\s*count:([a-z0-9 _-]+)=(\d+)\s*-->/gi;
-            let cm;
-            while ((cm = cmt.exec(line)) !== null) {
-                commentClaims++;
-                const name = cm[1].trim().toLowerCase().replace(/\s+/g, "-");
-                const val = parseInt(cm[2], 10);
-                const expected = gtMap[name] ?? gtMap[name.replace(/-/g, " ")];
-                if (expected === undefined) errors.push(`${rel}:${i + 1}: count comment names unknown quantity "${cm[1].trim()}"`);
-                else if (expected !== val) errors.push(`${rel}:${i + 1}: count:${cm[1].trim()}=${val} but ground truth is ${expected}`);
-            }
-            // (b) bare claims of the exact named forms. Require adjacency (number immediately
-            // before the noun) so qualified subset phrases ("24 static primitives", "one layout
-            // primitive") are not misread as grand-total claims.
-            const bare = /\b(\d+|[a-z]+)\s+(rules?|archetypes?|primitives?)\b/gi;
-            let bm;
-            while ((bm = bare.exec(line)) !== null) {
-                const n = toNumber(bm[1]);
-                if (Number.isNaN(n)) continue;
-                const key = bm[2].toLowerCase();
-                const expected = gtMap[key];
-                if (expected === undefined) continue;
-                bareClaims++;
-                if (n !== expected) errors.push(`${rel}:${i + 1}: bare claim "${bm[0].trim()}" (=${n}) contradicts ground truth ${expected}`);
-            }
-        });
-    }
-    return { name: "stated-count integrity", pass: errors.length === 0, detail: `${commentClaims} comment + ${bareClaims} bare claim(s) checked`, errors };
-}
-
-// ── Check 6: every brief-pinned path exists ────────────────────────────────────
-function checkFileTree() {
-    const errors = [];
-    const files = [
-        "SKILL.md",
-        "references/hard-rules.md", "references/create.md", "references/improve.md", "references/introspect.md",
-        "references/diagnosis.md", "references/structure.md", "references/personality.md", "references/interaction.md", "references/lifecycle.md",
-        "data/catalog/rules.csv",
-        "data/catalog/fixtures/cod-02.manifest.tokens.json",
-        "data/design-md/SCHEMA.md", "data/design-md/nurix.md",
-        "data/operator-pack/surface-catalog.md", "data/operator-pack/fixtures.md", "data/operator-pack/trust-rubric.md",
-        "data/operator-pack/exemplars/list-detail.tsx", "data/operator-pack/exemplars/dashboard.tsx",
-        "data/operator-pack/exemplars/entity-detail.tsx", "data/operator-pack/exemplars/create-edit.tsx",
-        "data/operator-pack/exemplars/log-stream.tsx", "data/operator-pack/exemplars/command-center.tsx",
-        "scripts/lib/checks.mjs", "scripts/phase-gate.mjs", "scripts/preship-sweep.mjs", "scripts/render-rung.mjs",
-        "scripts/scaffold.mjs", "scripts/derive-personality.mjs", "scripts/generate-fixtures.mjs",
-        "scripts/self-integrity.mjs",
-    ];
-    for (const rel of files) if (!existsSync(join(SKILL_ROOT, rel))) errors.push(`missing ${rel}`);
-
-    const dirs = ["data/catalog/fixtures", "data/design-md/library"];
-    for (const rel of dirs) {
-        const abs = join(SKILL_ROOT, rel);
-        if (!existsSync(abs)) errors.push(`missing dir ${rel}/`);
-        else if (readdirSync(abs).length === 0) errors.push(`empty dir ${rel}/`);
-    }
-    const found = files.length - errors.filter((e) => e.startsWith("missing ")).length;
-    return { name: "file-tree presence", pass: errors.length === 0, detail: `${found}/${files.length} files present`, errors };
-}
-
-// Every artifact directory under data/design-tokens/ (a directory holding design.tokens.json), sorted by slug.
-function listArtifactSlugs() {
-    if (!existsSync(TOKENS_DIR)) return [];
-    return readdirSync(TOKENS_DIR, { withFileTypes: true })
-        .filter((d) => d.isDirectory() && existsSync(join(TOKENS_DIR, d.name, "design.tokens.json")))
-        .map((d) => d.name)
-        .sort();
-}
-
-// Parse goldens.json into its entry slugs (every key except "_meta"), or null when absent/unparseable.
-function readGoldenSlugs() {
-    const text = readSafe(GOLDENS_JSON);
-    if (text === null) return null;
-    try { return Object.keys(JSON.parse(text)).filter((k) => k !== "_meta").sort(); }
-    catch { return null; }
-}
-
-// Run an async worker over items with at most `limit` in flight; results keep item order.
-async function runPool(items, limit, worker) {
-    const results = new Array(items.length);
-    let next = 0;
-    const lane = async () => {
-        while (next < items.length) {
-            const i = next++;
-            results[i] = await worker(items[i], i);
-        }
-    };
-    await Promise.all(Array.from({ length: Math.min(limit, items.length) || 1 }, lane));
-    return results;
-}
-
-// Spawn `node <args>` and resolve with { status, stdout, stderr } (never rejects; a spawn error surfaces as status -1).
-function execNode(args) {
-    return new Promise((resolveExec) => {
-        const child = spawn(process.execPath, args, { stdio: ["ignore", "pipe", "pipe"] });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.on("data", (d) => { stdout += d; });
-        child.stderr.on("data", (d) => { stderr += d; });
-        child.on("error", (e) => resolveExec({ status: -1, stdout, stderr: stderr + String(e) }));
-        child.on("close", (status) => resolveExec({ status, stdout, stderr }));
-    });
-}
-
-// First non-empty line of a child process's output, for one-line error reporting.
-function firstLine(text) {
-    return (text || "").split("\n").find((l) => l.trim() !== "") || "(no output)";
-}
-
-// ── Check 7: token-era file tree + goldens<->artifact parity ───────────────────
-function checkTokenFileTree() {
-    const errors = [];
-    const pins = [
-        "data/design-tokens/SCHEMA.md",
-        "data/design-tokens/goldens.json",
-        "scripts/convert-design-md.mjs",
-        "scripts/snapshot-goldens.mjs",
-        "scripts/lib/golden.mjs",
-    ];
-    for (const rel of pins) if (!existsSync(join(SKILL_ROOT, rel))) errors.push(`missing ${rel}`);
-    const pinsFound = pins.length - errors.length;
-
-    const diskSlugs = listArtifactSlugs();
-    const goldenSlugs = readGoldenSlugs();
-    if (goldenSlugs === null) {
-        errors.push("goldens.json missing or does not parse as JSON");
-    } else {
-        const goldenSet = new Set(goldenSlugs);
-        for (const slug of goldenSlugs) {
-            if (!existsSync(join(TOKENS_DIR, slug, "design.tokens.json")))
-                errors.push(`goldens.json entry "${slug}" has no data/design-tokens/${slug}/design.tokens.json on disk`);
-            else if (!existsSync(join(TOKENS_DIR, slug, "design.resolver.json")))
-                errors.push(`goldens.json entry "${slug}": data/design-tokens/${slug}/ is missing design.resolver.json`);
-        }
-        for (const slug of diskSlugs) {
-            if (!goldenSet.has(slug)) errors.push(`artifact dir data/design-tokens/${slug}/ has no goldens.json entry`);
-            else if (!existsSync(join(TOKENS_DIR, slug, "design.resolver.json")) && !errors.some((e) => e.includes(`"${slug}"`)))
-                errors.push(`artifact dir data/design-tokens/${slug}/ is missing design.resolver.json`);
-        }
-    }
-    const goldenCount = goldenSlugs === null ? 0 : goldenSlugs.length;
-    return { name: "token file-tree + goldens parity", pass: errors.length === 0, detail: errors.length ? `${errors.length} issue(s)` : `${pinsFound}/${pins.length} pins, goldens<->artifacts ${goldenCount}<->${diskSlugs.length}`, errors };
-}
-
-// ── Check 8: every design-tokens artifact passes derive-personality --check ────
-async function checkArtifactValidity() {
-    const slugs = listArtifactSlugs();
-    if (slugs.length === 0) return { name: "artifact validity (--check)", pass: false, detail: "no artifact dirs found", errors: [`no design.tokens.json dirs under ${TOKENS_DIR}`] };
-    const runs = await runPool(slugs, SPAWN_LIMIT, (slug) => execNode([DERIVE_PERSONALITY, join(TOKENS_DIR, slug), "--check"]));
-    const errors = [];
-    runs.forEach((res, i) => {
-        if (res.status !== 0) errors.push(`${slugs[i]}: --check exited ${res.status}: ${firstLine(res.stderr || res.stdout)}`);
-    });
-    return { name: "artifact validity (--check)", pass: errors.length === 0, detail: `${slugs.length - errors.length}/${slugs.length} artifacts pass --check`, errors };
-}
-
-// ── Check 9: emitted CSS hashes match goldens.json (slow; gated behind --goldens) ──
-async function checkGoldenMatch(enabled) {
-    if (!enabled) return { name: "golden emission match", pass: true, skip: true, detail: "skipped (slow) — run with --goldens to verify emitted hashes against goldens.json", errors: [] };
-    const goldenSlugs = readGoldenSlugs();
-    if (goldenSlugs === null) return { name: "golden emission match", pass: false, detail: "goldens.json missing/unparseable", errors: ["goldens.json missing or does not parse as JSON"] };
-    const goldens = JSON.parse(readSafe(GOLDENS_JSON));
-    const emitRoot = mkdtempSync(join(tmpdir(), "design-self-integrity-"));
-    let matched = 0;
-    const errors = [];
-    try {
-        // Each worker returns its slug's error list; flattening after the pool keeps report order deterministic.
-        const perSlug = await runPool(goldenSlugs, SPAWN_LIMIT, async (slug) => {
-            const slugErrors = [];
-            const outdir = join(emitRoot, slug);
-            const res = await execNode([DERIVE_PERSONALITY, join(TOKENS_DIR, slug), "--emit", outdir, "--provisional"]);
-            if (res.status !== 0) {
-                slugErrors.push(`${slug}: --emit exited ${res.status}: ${firstLine(res.stderr || res.stdout)}`);
-                return slugErrors;
-            }
-            for (const [key, fileName] of [["personality", "personality.css"], ["globals", "globals.css"]]) {
-                const css = readSafe(join(outdir, "src/styles", fileName));
-                if (css === null) { slugErrors.push(`${slug}: emit produced no src/styles/${fileName}`); continue; }
-                const actual = goldenHash(css);
-                const expected = goldens[slug] && goldens[slug][key];
-                if (actual === expected) matched++;
-                else slugErrors.push(`${slug}: ${fileName} hash ${actual} != golden ${expected ?? "(missing key)"}`);
-            }
-            return slugErrors;
-        });
-        for (const slugErrors of perSlug) errors.push(...slugErrors);
-    } finally {
-        rmSync(emitRoot, { recursive: true, force: true });
-    }
-    return { name: "golden emission match", pass: errors.length === 0, detail: `${matched}/${goldenSlugs.length * 2} hashes match goldens.json`, errors };
-}
-
-// Derive the ground-truth counts: rule counts from the catalog itself; the token-surface counts
-// (primitives, color roles, ramp steps, elevation levels) from the Nurix default artifact, the
-// schema's worked example. null when the artifact is unreadable (check 8 reports that separately).
-function deriveGround(catalog) {
-    const ground = {
-        rows: catalog.rows.length,
-        source: catalog.rows.filter((r) => r.detector === "source").length,
-        render: catalog.rows.filter((r) => r.detector === "render" && r.grade === "machine").length,
-        primitives: null, colorTokens: null, rampSteps: null, elevation: null,
-    };
-    try {
-        const nurix = JSON.parse(readFileSync(join(TOKENS_DIR, "nurix", "design.tokens.json"), "utf8"));
-        const count = (group) => Object.keys(group || {}).filter((k) => !k.startsWith("$")).length;
-        ground.primitives = count(nurix.primitive);
-        ground.colorTokens = count(nurix.color);
-        ground.rampSteps = count(nurix.typography && nurix.typography.ramp);
-        ground.elevation = count(nurix.elevation);
-    } catch { /* artifact validity is check 8's job */ }
-    return ground;
-}
-
-// Run one rule's contrastive fixture pair through the check engine and exit 0/1 on its result.
-function runSingleFixture(catalog, ruleId) {
-    const row = catalog.rows.find((r) => r.id === ruleId);
-    if (!row) { console.error(`--fixture: no rules.csv row with id "${ruleId}"`); process.exit(2); }
-    if (row.fixture_pair !== "yes") { console.error(`--fixture: ${ruleId} has fixture_pair=${row.fixture_pair}; no contrastive pair to run`); process.exit(2); }
-    const r = checkContrastiveValidity(catalog, ruleId);
-    if (r.errors.length === 0 && r.detail.startsWith("0 ")) {
-        console.error(`--fixture: ${ruleId}.flag.* / ${ruleId}.pass.* not found in data/catalog/fixtures/`);
-        process.exit(2);
-    }
-    if (r.pass) { console.log(`PASS  fixture pair ${ruleId} — flag reports ${ruleId}, pass reports zero.`); process.exit(0); }
-    console.error(`FAIL  fixture pair ${ruleId}`);
-    for (const e of r.errors) console.error(`   - ${e}`);
-    process.exit(1);
-}
-
-// Run every check, print the summary table, and exit non-zero on any failure.
-async function main() {
-    const args = process.argv.slice(2);
-    let fixtureId = null;
-    let runGoldens = false;
-    for (let i = 0; i < args.length; i++) {
-        if (args[i] === "--fixture") fixtureId = args[++i] || null;
-        else if (args[i].startsWith("--fixture=")) fixtureId = args[i].slice("--fixture=".length);
-        else if (args[i] === "--goldens") runGoldens = true;
-    }
-
-    const results = [];
-    let catalog = null;
-    try { catalog = loadCatalog(); } catch (e) {
-        console.error("FATAL: " + e.message);
-        process.exit(2);
-    }
-
-    if (fixtureId) runSingleFixture(catalog, fixtureId);
-
-    const ground = deriveGround(catalog);
-
-    const runners = [
-        () => checkCsvWellFormed(catalog),
-        () => checkAnchorParity(catalog),
-        () => checkFloorParity(),
-        () => checkFixturePresence(catalog),
-        () => checkContrastiveValidity(catalog),
-        () => checkStatedCounts(catalog, ground),
-        () => checkFileTree(),
-        () => checkTokenFileTree(),
-        () => checkArtifactValidity(),
-        () => checkGoldenMatch(runGoldens),
-        () => validateCombinations(COMBINATIONS_DIR),
-    ];
-    for (const run of runners) {
-        try { results.push(await run()); }
-        catch (e) { results.push({ name: run.name || "check", pass: false, detail: "threw", errors: [e.stack || String(e)] }); }
-    }
-
-    for (const r of results) {
-        if (r.errors && r.errors.length) {
-            console.log(`\n[${r.pass ? "PASS" : "FAIL"}] ${r.name}`);
-            for (const e of r.errors) console.log(`   - ${e}`);
-        }
-    }
-
-    console.log("\n" + "=".repeat(60));
-    console.log("self-integrity — design skill");
-    console.log("=".repeat(60));
-    const pad = (s, n) => (s + " ".repeat(n)).slice(0, n);
-    for (const r of results) console.log(`${r.skip ? "SKIP" : r.pass ? "PASS" : "FAIL"}  ${pad(r.name, 34)} ${r.detail}`);
-    console.log("=".repeat(60));
-
-    const failed = results.filter((r) => !r.pass);
-    if (failed.length) { console.log(`${failed.length} check(s) failed.`); process.exit(1); }
-    console.log("all checks passed.");
-    process.exit(0);
-}
-
-main().catch((e) => { console.error("FATAL: " + (e.stack || String(e))); process.exit(2); });