@pareto4/pp-core 1.12.1 → 1.17.1

package/scripts/prompt-injection-scan.sh

@@ -82,21 +82,28 @@ PATTERNS=(
 # THIS file and reads the array bash actually expands — adding, removing or
 # un-reasoning an entry here without editing the test turns the suite red.
 ALLOWLIST=(
-  'scripts/prompt-injection-scan.sh::the PATTERNS array above is the literal source of every phrase this scanner looks for, so the file matches itself by construction; measured 4 pattern hits at HEAD on 2026-10-11'
-  'scripts/base64-scan.sh::decodes base64 blobs and re-scans the recovered plaintext against the same injection vocabulary, so it names those phrases inline; measured 2 pattern hits at HEAD on 2026-10-11'
-  'scripts/secret-scan.sh::third of the three diff-mode scan scripts CI runs together in the security-scan job of .gitlab-ci.yml; measured 0 pattern hits at HEAD on 2026-10-11, retained because its own exemption list at line 223 already names security-prompt-injection.security.test.cjs and grows with that vocabulary'
-  'tests/security-scan.security.test.cjs::the behavioural suite for this very scanner, so every positive case embeds a real injection phrase as fixture input; measured 28 pattern hits at HEAD on 2026-10-11'
-  'tests/security.test.cjs::the adversarial suite for the library sanitisers, whose fixtures are real override and role-manipulation strings asserted to be neutralised; measured 54 pattern hits at HEAD on 2026-10-11'
-  'tests/prompt-injection-scan.security.test.cjs::drives scanForInjection in the compiled security library with crafted payloads, and carries a second allowlist of its own for that separate scanner; measured 11 pattern hits at HEAD on 2026-10-11'
-  'tests/vault-security.test.cjs::the vault fencing suite plants an instruction-override heading in a fixture vault file and asserts SUMMARY.md fences and defangs it rather than passing it to the agent as instructions; measured 1 pattern hit at HEAD on 2026-10-11'
-  'tests/verify.test.cjs::the verification suite plants an instruction-override line in a phase artifact and asserts it is rejected, so the line is present as a negative fixture; measured 1 pattern hit at HEAD on 2026-10-11'
-  'pp-core/bin/lib/security.cjs::gitignored build output compiled from src/security.cts per .gitignore line 117, so it is unreachable in diff mode and matters only to a local dir-mode run; it carries the library injection patterns inline; measured 8 pattern hits at HEAD on 2026-10-11'
-  'tests/read-injection-scanner.security.test.cjs::exercises the read-time injection scanner hook with the payloads a hostile file would carry, each asserted to be blocked rather than obeyed; measured 14 pattern hits at HEAD on 2026-10-11'
-  'tests/security-prompt-injection.security.test.cjs::carries two deliberate NUL bytes at lines 631 and 881 so grep classifies it as binary and reports whole-file matches with no line numbers; 10 binary pattern matches measured at HEAD on 2026-10-11'
-  'tests/fixtures/adversarial/security/::a directory of adversarial corpus files whose entire purpose is to BE injection payloads for the suites above; measured 20 pattern hits across its 7 tracked files at HEAD on 2026-10-11'
-  'SECURITY.md::the substring rule makes this exempt every path ending in SECURITY.md, including pp-core/templates/SECURITY.md and every per-phase threat register generated from that template; the breadth is accepted because a security policy is exactly where injection phrasing is legitimately quoted; measured 1 pattern hit across all 13 such files on disk at HEAD on 2026-10-11, a quoted attack shape in a phase threat register'
-  'TEST-EXAMPLES.md::documentation that demonstrates injection examples in order to explain what these scanners catch, so the example text is the point of the file rather than an attack; measured 1 pattern hit at HEAD on 2026-10-11'
-  'explanation/security-model.md::matches docs/explanation/security-model.md through the substring rule; it is the prose that explains the injection threat model and quotes the attack shapes pp-core defends against; measured 2 pattern hits at HEAD on 2026-10-11'
+  'scripts/prompt-injection-scan.sh::the PATTERNS array above is the literal source of every phrase this scanner looks for, so the file matches itself by construction; measured 4 pattern hits at HEAD on 2026-09-19'
+  'scripts/base64-scan.sh::decodes base64 blobs and re-scans the recovered plaintext against the same injection vocabulary, so it names those phrases inline; measured 2 pattern hits at HEAD on 2026-09-19'
+  'scripts/secret-scan.sh::third of the three diff-mode scan scripts CI runs together in the security_scan job of .github/workflows/ci.yml; measured 0 pattern hits at HEAD on 2026-09-19, retained because its own exemption list at line 223 already names security-prompt-injection.security.test.cjs and grows with that vocabulary'
+  'tests/security-scan.security.test.cjs::the behavioural suite for this very scanner, so every positive case embeds a real injection phrase as fixture input; measured 28 pattern hits at HEAD on 2026-09-19'
+  'tests/security.test.cjs::the adversarial suite for the library sanitisers, whose fixtures are real override and role-manipulation strings asserted to be neutralised; measured 54 pattern hits at HEAD on 2026-09-19'
+  'tests/prompt-injection-scan.security.test.cjs::drives scanForInjection in the compiled security library with crafted payloads, and carries a second allowlist of its own for that separate scanner; measured 11 pattern hits at HEAD on 2026-09-19'
+  'tests/verify.test.cjs::the verification suite plants an instruction-override line in a phase artifact and asserts it is rejected, so the line is present as a negative fixture; measured 1 pattern hit at HEAD on 2026-09-19'
+  'pp-core/bin/lib/security.cjs::gitignored build output compiled from src/security.cts per .gitignore line 117, so it is unreachable in diff mode and matters only to a local dir-mode run; it carries the library injection patterns inline; measured 8 pattern hits at HEAD on 2026-09-19'
+  'tests/read-injection-scanner.security.test.cjs::exercises the read-time injection scanner hook with the payloads a hostile file would carry, each asserted to be blocked rather than obeyed; measured 14 pattern hits at HEAD on 2026-09-19'
+  'tests/security-prompt-injection.security.test.cjs::carries two deliberate NUL bytes at lines 631 and 881 so grep classifies it as binary and reports whole-file matches with no line numbers; 10 binary pattern matches measured at HEAD on 2026-09-19'
+  'tests/fixtures/adversarial/security/::a directory of adversarial corpus files whose entire purpose is to BE injection payloads for the suites above; measured 20 pattern hits across its 7 tracked files at HEAD on 2026-09-19'
+  'tests/discovery-vault-context.test.cjs::the DISCO-03/SC4 suite plants a real role-manipulation line (the PLANTED constant) into a fixture vault document and asserts the shipped scanner FINDS it, which is the non-vacuity partner for the assertion that the subflow itself scans clean; the payload has to be a literal for that half to mean anything, so the file matches the vocabulary it exists to prove is caught'
+  'tests/vault-status-check.test.cjs::sanitisation seeds for the vault status message carry a real instruction and a real control character on purpose, each paired with a non-vacuity assertion that the RENDERED message does not carry it intact; measured 5 pattern hits at HEAD on 2026-09-19'
+  'tests/vault-practices-matcher.test.cjs::the CR-01 fence-spoof suite plants a real instruction-override line and a forged end-fence marker inside practice bodies on purpose, each paired with an assertion that the RENDERED practices block keeps the planted text inside the fence and leaves exactly one genuine closer, so the payload must be a literal for the defang proof to mean anything; measured 3 pattern hits at HEAD b4dd6b3 on 2026-10-04'
+  'tests/vault-review.security.test.cjs::the CR-02 suite seeds a practice body with directive-shaped text aimed at the practice judge (the DIRECTIVE_TEXT constant) and asserts the rendered review entry carries it only between the fence markers, after the reference-data preamble, so the judge reads it as data; the text must be a literal for that assertion to mean anything; measured 1 pattern hit at HEAD b4dd6b3 on 2026-10-04'
+  'tests/practices-review-check-property.test.cjs::a false positive rather than a payload, since the fence-parsing invariance property builds a never-closed fence whose second-opener line is ordinary English about whether the client line becomes a cut point, and one role-pattern regex matches that plain wording; the fixture text stays as written; measured 1 pattern hit at HEAD b4dd6b3 on 2026-10-04'
+  'tests/vault-index.integration.test.cjs::the fence-spoof suite seeds a vault document heading and an INDEX description that carry a forged end-fence marker followed by an instruction-override phrase, and asserts the rendered SUMMARY keeps exactly one live end marker with the planted line defanged inside the fence, so the phrase must be a literal for the defang proof to mean anything; measured 4 pattern hits at HEAD 5ddb0b3 on 2026-10-12'
+  'tests/vault-seal.integration.test.cjs::the uncovered-commit suite builds a commit whose subject is an instruction-override phrase padded past the cap, modelling a hostile commit message, and asserts the subject leaving the seal leaf is controls-collapsed and bounded to SEAL_SUBJECT_CAP before it can reach a record; measured 1 pattern hit at HEAD 5ddb0b3 on 2026-10-12'
+  'tests/vault-standards.integration.test.cjs::the D-14 suites plant instruction-override lines in a standards document and in its INDEX description, each tagged with a random token, and assert that neither the token nor the phrase appears in any output of vault standards block or consulted, so the phrase must be a literal for the absence proof to mean anything; measured 6 pattern hits at HEAD 5ddb0b3 on 2026-10-12'
+  'SECURITY.md::the substring rule makes this exempt every path ending in SECURITY.md, including pp-core/templates/SECURITY.md and every per-phase threat register generated from that template; the breadth is accepted because a security policy is exactly where injection phrasing is legitimately quoted; measured 0 pattern hits across all 16 such files on disk at HEAD on 2026-09-19'
+  'TEST-EXAMPLES.md::documentation that demonstrates injection examples in order to explain what these scanners catch, so the example text is the point of the file rather than an attack; measured 1 pattern hit at HEAD on 2026-09-19'
+  'explanation/security-model.md::matches docs/explanation/security-model.md through the substring rule; it is the prose that explains the injection threat model and quotes the attack shapes pp-core defends against; measured 2 pattern hits at HEAD on 2026-09-19'
 )
 
 is_allowlisted() {

package/scripts/record-vault-mode-golden.cjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * scripts/record-vault-mode-golden.cjs — the vault-mode golden recorder
+ * (Vault Assurance v1.2, phase 13; MODE-01, PARK-04; D-01).
+ *
+ *   --write   record every enablement cell (key absent — the canonical
+ *             recording), normalise, and write tests/fixtures/vault-mode-golden/<cell>.json
+ *   --check   record the same and compare against the committed files; print
+ *             every differing path and exit 1 on any difference
+ *
+ * Neither or both flags: usage, exit 2. No path argument: the golden directory
+ * is the harness's `GOLDEN_DIR`, so the recorder and the test cannot disagree
+ * about where the goldens live.
+ *
+ * A THIN CLI. Every fixture, capture, normalisation and comparison rule lives in
+ * the shared harness module required below, which the golden test requires too.
+ * This script is never run by the test suite: a re-record is a deliberate,
+ * reviewable re-baseline (D-01), and it must run on a tree whose practices-mode
+ * behaviour is the one being pinned.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const harness = require('../tests/helpers/vault-mode-golden-harness.cjs');
+
+const ROOT = path.resolve(__dirname, '..');
+const USAGE = 'usage: record-vault-mode-golden.cjs (--write | --check)';
+
+function describeDiff(d) {
+  const at = d.firstDiffAt === undefined ? '' : ` (first differing byte at ${d.firstDiffAt})`;
+  const show = (v) => (v === undefined ? '<absent>' : JSON.stringify(v).slice(0, 200));
+  return `  ${d.path}${at}\n    expected: ${show(d.expected)}\n    actual:   ${show(d.actual)}`;
+}
+
+function main() {
+  const write = process.argv.includes('--write');
+  const check = process.argv.includes('--check');
+  if (write === check) {
+    console.error(USAGE);
+    process.exitCode = 2;
+    return;
+  }
+
+  let failed = 0;
+  for (const cell of harness.ENABLEMENT_CELLS) {
+    const raw = harness.recordCell({ cell: cell.name, modeKey: harness.KEY_CONFIGS.absent });
+    const normalised = harness.normaliseRecording(raw);
+    const count = Object.keys(normalised.commands).length;
+    const dropped = Object.entries(raw.meta.droppedHookCounts)
+      .map(([id, n]) => `${id}=${n}`)
+      .join(' ');
+    const target = harness.goldenPathFor(cell.name);
+    const rel = path.relative(ROOT, target);
+    console.log(`${cell.name}: ${count} commands recorded (render-hooks projection dropped: ${dropped})`);
+
+    if (write) {
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.writeFileSync(target, harness.serialise(normalised), 'utf8');
+      console.log(`  wrote ${rel}`);
+      continue;
+    }
+
+    let expected;
+    try {
+      expected = JSON.parse(fs.readFileSync(target, 'utf8'));
+    } catch (e) {
+      console.error(`  FAIL: ${rel} could not be read as JSON (${e.message})`);
+      failed++;
+      continue;
+    }
+    const { equal, diffs } = harness.compareRecordings(expected, normalised);
+    if (equal) {
+      console.log(`  matches ${rel}`);
+    } else {
+      failed++;
+      console.error(`  FAIL: ${rel} differs at ${diffs.length} path(s):`);
+      for (const d of diffs) console.error(describeDiff(d));
+    }
+  }
+
+  if (check && failed > 0) {
+    console.error(`\nFAIL: ${failed} golden cell(s) differ from a fresh recording.`);
+    process.exitCode = 1;
+  }
+}
+
+main();

package/scripts/sync-manifest-versions.cjs

@@ -11,10 +11,11 @@
  *   - VERSIONED_MANIFESTS — JSON runtime-integration manifests whose top-level
  *     `version` field MUST track the package version.
  *   - VERSIONED_TEXT_FILES — plain-text manifests whose ENTIRE content is the
- *     version followed by one newline.  Root `VERSION` is the repo layout's
- *     version source for `resolveCreatedWith` (src/compose-bindings.cts), so a
- *     repo build stamps `createdWith` from it.  As a plain-text file it could not
- *     join the JSON loop, so nothing kept it in step with package.json.
+ *     version followed by one newline.  Root `VERSION` is the repo layout's only
+ *     version source for `resolveCreatedWithFrom` (src/compose-bindings.cts), so a
+ *     repo build stamps `createdWith` and the practices block from it.  It drifted
+ *     from 1.11.1 through three releases because a plain-text file could not join
+ *     the JSON loop (quick 261003-kmd closed the todo).
  *
  * Usage:
  *   node scripts/sync-manifest-versions.cjs           # stamp + report

package/scripts/sync-rulesets.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-REPO="${REPO:-open-gsd/gsd-core}"
+REPO="${REPO:-pareto000/pp-core}"
 ENFORCEMENT="${ENFORCEMENT:-evaluate}"
 
 case "$ENFORCEMENT" in

package/scripts/update-size-baseline.cjs

@@ -4,309 +4,65 @@
 /**
  * @file update-size-baseline.cjs
  *
- * Regenerates the committed per-file size baselines
- * (`tests/workflow-size-baseline.json`, `tests/agent-size-baseline.json`) from
- * the current files.
+ * Regenerates the committed per-file workflow size baseline
+ * (`tests/workflow-size-baseline.json`) from the current workflow files.
  *
- * Workflow size budget policy (2026-10-11; per commit since pack 9): the guards
- * allow each commit a small DELTA BUDGET (config size_budget.*, see
- * scripts/lib/size-budget.cjs), so plans never run this script. It runs once per
- * phase, in the phase's closing commit (`--reason "phase NN close"`, from
- * execute-phase), and otherwise only when one commit must grow past the budget.
- * Because a raise is the review record of growth, RAISING any entry requires a
- * reason:
+ * Run via `npm run size:baseline` whenever a workflow file legitimately grows
+ * or shrinks.  Growth must still be justified in the PR; this script only
+ * records the new reality so the CI guard (issue #1074) can diff against it.
  *
- *   npm run size:baseline                         # lower / add / remove only
- *   npm run size:baseline -- --reason "<why>"     # also allowed to raise
- *
- * Without `--reason`, a run that would raise any entry is REFUSED: it exits
- * non-zero and writes nothing (neither baseline). With a reason, every raise is
- * recorded in the baseline file's `_rebaselines` array (newest last) as
- * `{ date, reason, deltas: [{ file, from, to, delta }] }` — the committed
- * review record of a deliberate growth.
- *
- * Idempotent: running it twice with no file changes produces no diff (a run
- * with nothing to raise never appends a `_rebaselines` entry).
+ * Idempotent: running it twice with no file changes produces no diff.
  */
 
 const fs = require('fs');
 const path = require('path');
-const { measureMdFiles, measureMdTree, WORKFLOWS_DIR } = require('./workflow-size.cjs');
+const { measureMdFiles, WORKFLOWS_DIR } = require('./workflow-size.cjs');
 
 const BASELINE_PATH = path.join(__dirname, '..', 'tests', 'workflow-size-baseline.json');
 const AGENTS_DIR = path.join(__dirname, '..', 'agents');
 const AGENT_BASELINE_PATH = path.join(__dirname, '..', 'tests', 'agent-size-baseline.json');
-const isPpAgent = (f) => f.startsWith('pp-');
-
-/** Key of the raise log inside a baseline file. Never a measured filename. */
-const REBASELINES_KEY = '_rebaselines';
-
-/**
- * Split a parsed baseline file into its size entries and its raise log.
- * Size entries are the numeric values; metadata keys (`_rebaselines`) are not
- * sizes and must never reach a guard as one.
- *
- * @param {object|null} raw - Parsed baseline JSON (null when absent).
- * @returns {{ sizes: Object<string, number>, rebaselines: Array<object> }}
- */
-function splitBaseline(raw) {
-  const sizes = {};
-  let rebaselines = [];
-  if (raw && typeof raw === 'object') {
-    for (const [key, value] of Object.entries(raw)) {
-      if (key === REBASELINES_KEY) rebaselines = value;
-      else sizes[key] = value;
-    }
-  }
-  return { sizes, rebaselines };
-}
-
-/**
- * Read and parse a baseline file; `null` when it does not exist.
- *
- * @param {string} filePath
- * @returns {object|null}
- */
-function readBaseline(filePath) {
-  let text;
-  try {
-    text = fs.readFileSync(filePath, 'utf-8');
-  } catch (err) {
-    if (err.code === 'ENOENT') return null;
-    throw err;
-  }
-  return JSON.parse(text);
-}
+const isGsdAgent = (f) => f.startsWith('pp-');
 
 /**
- * Serialize to the on-disk baseline format: size keys sorted, then the
- * `_rebaselines` log last; 2-space indent, trailing newline (a stable,
- * minimal-diff artifact).
+ * Serialize a size map to the on-disk baseline format: keys sorted, 2-space
+ * indent, trailing newline (so the file is a stable, minimal-diff artifact).
  *
  * @param {Object<string, number>} sizes
- * @param {Array<object>} [rebaselines]
  * @returns {string}
  */
-function serializeBaseline(sizes, rebaselines = []) {
+function serializeBaseline(sizes) {
   const sorted = {};
   for (const key of Object.keys(sizes).sort()) sorted[key] = sizes[key];
-  sorted[REBASELINES_KEY] = rebaselines;
   return JSON.stringify(sorted, null, 2) + '\n';
 }
 
 /**
- * Classify the difference between an old and a new size map.
- *
- * @param {Object<string, number>} oldSizes
- * @param {Object<string, number>} newSizes
- * @returns {{ raised: Array<{file:string,from:number,to:number,delta:number}>,
- *             lowered: Array<{file:string,from:number,to:number,delta:number}>,
- *             added: string[], removed: string[] }}
- */
-function diffSizes(oldSizes, newSizes) {
-  const raised = [];
-  const lowered = [];
-  const added = [];
-  for (const file of Object.keys(newSizes).sort()) {
-    if (!(file in oldSizes)) {
-      added.push(file);
-      continue;
-    }
-    const from = oldSizes[file];
-    const to = newSizes[file];
-    if (to > from) raised.push({ file, from, to, delta: to - from });
-    else if (to < from) lowered.push({ file, from, to, delta: from - to });
-  }
-  const removed = Object.keys(oldSizes).filter((f) => !(f in newSizes)).sort();
-  return { raised, lowered, added, removed };
-}
-
-/**
- * Validate a `_rebaselines` log. Returns a list of problems (empty = valid).
- * Every entry must carry an ISO date, a non-empty reason and a non-empty list
- * of positive deltas whose arithmetic holds; dates must be non-decreasing
- * (newest last).
- *
- * @param {unknown} log
- * @returns {string[]}
- */
-function validateRebaselineLog(log) {
-  if (!Array.isArray(log)) return [`${REBASELINES_KEY} must be an array, got ${JSON.stringify(log)}`];
-  const problems = [];
-  const isSize = (n) => Number.isInteger(n) && n >= 0;
-  let prevDate = '';
-  log.forEach((entry, i) => {
-    const at = `${REBASELINES_KEY}[${i}]`;
-    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
-      problems.push(`${at} must be an object`);
-      return;
-    }
-    if (typeof entry.date !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(entry.date)) {
-      problems.push(`${at}.date must be YYYY-MM-DD, got ${JSON.stringify(entry.date)}`);
-    } else {
-      if (entry.date < prevDate) problems.push(`${at}.date ${entry.date} is older than the entry before it (newest must be last)`);
-      prevDate = entry.date;
-    }
-    if (typeof entry.reason !== 'string' || entry.reason.trim() === '') {
-      problems.push(`${at}.reason must be a non-empty string`);
-    }
-    if (!Array.isArray(entry.deltas) || entry.deltas.length === 0) {
-      problems.push(`${at}.deltas must be a non-empty array`);
-      return;
-    }
-    entry.deltas.forEach((d, j) => {
-      const dat = `${at}.deltas[${j}]`;
-      if (!d || typeof d.file !== 'string' || d.file === '') problems.push(`${dat}.file must be a non-empty string`);
-      if (!d || !isSize(d.from) || !isSize(d.to)) problems.push(`${dat}.from/.to must be non-negative integers`);
-      else if (!Number.isInteger(d.delta) || d.delta <= 0 || d.delta !== d.to - d.from) {
-        problems.push(`${dat}.delta must be the positive difference to - from (${d.to - d.from}), got ${JSON.stringify(d.delta)}`);
-      }
-    });
-  });
-  return problems;
-}
-
-/**
- * Compute (but do not write) a regenerated baseline.
+ * Write a baseline file from the measured `.md` sizes in a directory.
  *
  * @param {object} [opts]
  * @param {string} [opts.dir]       - Directory to measure (default: workflows).
- * @param {string} [opts.outPath]   - Baseline file (default: workflow baseline).
- * @param {function(string): boolean} [opts.predicate] - File filter.
- * @param {function(string, function): Object<string, number>} [opts.measure] -
- *        Measurer (default: recursive `measureMdTree`; agents pass `measureMdFiles`).
- * @param {string} [opts.reason]    - Justification; required to raise any entry.
- * @param {string} [opts.today]     - Date stamp for a raise (default: today, UTC).
- * @returns {{ outPath: string, refused: boolean, count: number, content: string|null,
- *             change: ReturnType<typeof diffSizes> }}
+ * @param {string} [opts.outPath]   - Baseline file to write (default: workflow).
+ * @param {function(string): boolean} [opts.predicate] - Filename filter.
+ * @returns {{ outPath: string, count: number, content: string }}
  */
-function planBaseline({
-  dir = WORKFLOWS_DIR,
-  outPath = BASELINE_PATH,
-  predicate,
-  measure = measureMdTree,
-  reason,
-  today = new Date().toISOString().slice(0, 10),
-} = {}) {
-  const sizes = measure(dir, predicate);
-  const { sizes: oldSizes, rebaselines: oldLog } = splitBaseline(readBaseline(outPath));
-  const change = diffSizes(oldSizes, sizes);
-  const count = Object.keys(sizes).length;
-  const hasReason = typeof reason === 'string' && reason.trim() !== '';
-  if (change.raised.length > 0 && !hasReason) {
-    return { outPath, refused: true, count, content: null, change };
-  }
-  const log = Array.isArray(oldLog) ? [...oldLog] : [];
-  if (change.raised.length > 0) {
-    log.push({ date: today, reason: reason.trim(), deltas: change.raised });
-  }
-  return { outPath, refused: false, count, content: serializeBaseline(sizes, log), change };
-}
-
-/**
- * Regenerate one baseline file. A refused plan (a raise without a reason)
- * writes nothing.
- *
- * @param {Parameters<typeof planBaseline>[0]} [opts]
- * @returns {ReturnType<typeof planBaseline>}
- */
-function generateBaseline(opts = {}) {
-  const plan = planBaseline(opts);
-  if (!plan.refused) fs.writeFileSync(plan.outPath, plan.content);
-  return plan;
-}
-
-/**
- * Parse CLI arguments: only `--reason <text>` / `--reason=<text>`.
- *
- * @param {string[]} argv
- * @returns {{ reason?: string }}
- */
-function parseArgs(argv) {
-  const out = {};
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === '--reason') {
-      out.reason = argv[++i];
-      if (out.reason === undefined) throw new Error('--reason needs a value');
-    } else if (arg.startsWith('--reason=')) {
-      out.reason = arg.slice('--reason='.length);
-    } else {
-      throw new Error(`unknown argument: ${arg} (only --reason "<text>" is accepted)`);
-    }
-  }
-  if (out.reason !== undefined && out.reason.trim() === '') throw new Error('--reason must not be empty');
-  return out;
+function generateBaseline({ dir = WORKFLOWS_DIR, outPath = BASELINE_PATH, predicate } = {}) {
+  const sizes = measureMdFiles(dir, predicate);
+  const content = serializeBaseline(sizes);
+  fs.writeFileSync(outPath, content);
+  return { outPath, count: Object.keys(sizes).length, content };
 }
 
-const TARGETS = [
-  { label: 'workflow', dir: WORKFLOWS_DIR, outPath: BASELINE_PATH, measure: measureMdTree },
-  { label: 'agent', dir: AGENTS_DIR, outPath: AGENT_BASELINE_PATH, predicate: isPpAgent, measure: measureMdFiles },
-];
-
-/**
- * CLI entry. Plans every target first and writes only when none is refused,
- * so a refusal leaves BOTH baselines untouched.
- *
- * @param {string[]} argv
- * @param {object} [io]
- * @param {Array<object>} [io.targets]
- * @param {string} [io.today]
- * @param {NodeJS.WritableStream} [io.stdout]
- * @param {NodeJS.WritableStream} [io.stderr]
- * @returns {number} exit code
- */
-function main(argv, { targets = TARGETS, today, stdout = process.stdout, stderr = process.stderr } = {}) {
-  let args;
-  try {
-    args = parseArgs(argv);
-  } catch (err) {
-    stderr.write(`size:baseline: ${err.message}\n`);
-    return 2;
-  }
-  const plans = targets.map((t) => ({ t, plan: planBaseline({ ...t, reason: args.reason, today }) }));
-  const refused = plans.filter((p) => p.plan.refused);
-  if (refused.length > 0) {
-    const lines = refused.flatMap(({ t, plan }) =>
-      plan.change.raised.map((r) => `  - ${t.label}: ${r.file}: ${r.from} → ${r.to} (+${r.delta})`)
-    );
-    stderr.write(
-      'size:baseline: REFUSED — this run would RAISE baseline entries, which needs a reason:\n' +
-        `${lines.join('\n')}\n` +
-        'Shrink the file(s), or re-run with: npm run size:baseline -- --reason "<why this growth is needed>"\n' +
-        'Nothing was written.\n'
-    );
-    return 1;
-  }
-  for (const { t, plan } of plans) {
-    fs.writeFileSync(plan.outPath, plan.content);
-    const c = plan.change;
-    stdout.write(
-      `Wrote ${plan.count} ${t.label} sizes to ${path.relative(process.cwd(), plan.outPath)} ` +
-        `(raised ${c.raised.length}, lowered ${c.lowered.length}, added ${c.added.length}, removed ${c.removed.length})\n`
+if (require.main === module) {
+  const targets = [
+    { label: 'workflow', dir: WORKFLOWS_DIR, outPath: BASELINE_PATH },
+    { label: 'agent', dir: AGENTS_DIR, outPath: AGENT_BASELINE_PATH, predicate: isGsdAgent },
+  ];
+  for (const t of targets) {
+    const { outPath, count } = generateBaseline(t);
+    process.stdout.write(
+      `Wrote ${count} ${t.label} sizes to ${path.relative(process.cwd(), outPath)}\n`
     );
   }
-  if (args.reason !== undefined && plans.every((p) => p.plan.change.raised.length === 0)) {
-    stdout.write('Note: nothing was raised, so --reason was not recorded.\n');
-  }
-  return 0;
-}
-
-if (require.main === module) {
-  process.exitCode = main(process.argv.slice(2));
 }
 
-module.exports = {
-  generateBaseline,
-  planBaseline,
-  serializeBaseline,
-  splitBaseline,
-  readBaseline,
-  diffSizes,
-  validateRebaselineLog,
-  parseArgs,
-  main,
-  REBASELINES_KEY,
-  BASELINE_PATH,
-  AGENT_BASELINE_PATH,
-};
+module.exports = { generateBaseline, serializeBaseline, BASELINE_PATH, AGENT_BASELINE_PATH };