@pieai/pro-gov 0.3.6 → 0.3.8

package/dist/cli.js

@@ -422,6 +422,7 @@ function listFiles3(absolutePath) {
   if (stats.isFile()) return [absolutePath];
   const files = [];
   for (const entry of readdirSync4(absolutePath, { withFileTypes: true })) {
+    if (shouldIgnoreAssetHashEntry(entry.name)) continue;
     const entryPath = join5(absolutePath, entry.name);
     if (entry.isDirectory()) {
       files.push(...listFiles3(entryPath));
@@ -431,6 +432,9 @@ function listFiles3(absolutePath) {
   }
   return files.sort();
 }
+function shouldIgnoreAssetHashEntry(name) {
+  return name === "__pycache__" || name === ".DS_Store" || name === "Thumbs.db" || name === "node_modules" || name.endsWith(".pyc") || name.endsWith(".pyo");
+}
 function toUnixPath3(path) {
   return path.replaceAll("\\", "/");
 }
@@ -532,8 +536,8 @@ function resolveSafePath(root, sourcePath) {
 }
 
 // src/asset-targets/apply.ts
-import { existsSync as existsSync7, lstatSync as lstatSync2, mkdirSync as mkdirSync2, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname as dirname3, join as join7, resolve } from "node:path";
+import { existsSync as existsSync7, lstatSync as lstatSync2, mkdirSync as mkdirSync2, realpathSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname as dirname3, join as join7, relative as relative4, resolve } from "node:path";
 function applyAssetInstallPlan(plan) {
   const appliedActions = [];
   for (const action of plan.actions) {
@@ -555,15 +559,16 @@ function applyAction(targetDir, action) {
   }
   mkdirSync2(dirname3(targetAbsolutePath), { recursive: true });
   const sourceAbsolutePath = resolve(action.sourcePath);
+  const symlinkTarget = relative4(realpathSync(dirname3(targetAbsolutePath)), realpathSync(sourceAbsolutePath)) || ".";
   if (action.type === "symlink") {
     if (pathExistsEvenIfDanglingSymlink2(targetAbsolutePath)) {
       throw new Error(`Refusing to overwrite unmanaged target: ${action.targetPath}`);
     }
-    symlinkSync(sourceAbsolutePath, targetAbsolutePath);
+    symlinkSync(symlinkTarget, targetAbsolutePath);
     return;
   }
   if (!pathExistsEvenIfDanglingSymlink2(targetAbsolutePath)) {
-    symlinkSync(sourceAbsolutePath, targetAbsolutePath);
+    symlinkSync(symlinkTarget, targetAbsolutePath);
     return;
   }
   const stats = lstatSync2(targetAbsolutePath);
@@ -571,7 +576,7 @@ function applyAction(targetDir, action) {
     throw new Error(`Refusing to overwrite unmanaged target: ${action.targetPath}`);
   }
   unlinkSync(targetAbsolutePath);
-  symlinkSync(sourceAbsolutePath, targetAbsolutePath);
+  symlinkSync(symlinkTarget, targetAbsolutePath);
 }
 function pathExistsEvenIfDanglingSymlink2(path) {
   try {
@@ -601,20 +606,19 @@ function checkInstalledAssets(options) {
   const registryById = new Map(options.registry.assets.map((asset) => [asset.id, asset]));
   const lockfile = JSON.parse(readFileSync4(lockfilePath, "utf8"));
   const issues = [];
+  const strictRegistry = options.strictRegistry ?? false;
   for (const entry of lockfile.assets ?? []) {
     const asset = registryById.get(entry.id);
     const targetAbsolutePath = join8(options.targetDir, entry.targetPath);
-    const sourceAbsolutePath = join8(options.agentAssetsDir, entry.sourcePath);
-    if (!asset) {
+    if (!asset && strictRegistry) {
       issues.push({
         type: "unknown-asset",
         id: entry.id,
         targetPath: entry.targetPath,
         message: `Lockfile references unknown asset: ${entry.id}`
       });
-      continue;
     }
-    if (asset.kind === "skill" && asset.defaultScope === "user") {
+    if (asset?.kind === "skill" && asset.defaultScope === "user") {
       issues.push({
         type: "user-scoped-asset-in-project-lock",
         id: entry.id,
@@ -622,13 +626,15 @@ function checkInstalledAssets(options) {
         message: `User-scoped skill is still locked into this project; move it to the user skill roots: ${entry.id}`
       });
     }
-    const hostFolderIssue = checkHostFolder(lockfile.host, asset.kind, entry.targetPath, entry.id);
-    if (hostFolderIssue) {
-      issues.push(hostFolderIssue);
-    }
-    const placementDriftIssue = checkRegistryPlacement(lockfile, asset, entry.targetPath);
-    if (placementDriftIssue) {
-      issues.push(placementDriftIssue);
+    if (asset) {
+      const hostFolderIssue = checkHostFolder(lockfile.host, asset.kind, entry.targetPath, entry.id);
+      if (hostFolderIssue) {
+        issues.push(hostFolderIssue);
+      }
+      const placementDriftIssue = checkRegistryPlacement(lockfile, asset, entry.targetPath);
+      if (placementDriftIssue) {
+        issues.push(placementDriftIssue);
+      }
     }
     if (!pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
       issues.push({
@@ -658,6 +664,18 @@ function checkInstalledAssets(options) {
       });
       continue;
     }
+    const currentTargetHash = hashAssetPathContent(targetAbsolutePath);
+    const targetHashMatchesLock = currentTargetHash === entry.contentHash;
+    if (!targetHashMatchesLock) {
+      issues.push({
+        type: "hash-drift",
+        id: entry.id,
+        targetPath: entry.targetPath,
+        message: `Managed asset hash drifted: ${entry.id}`
+      });
+    }
+    if (!asset || !strictRegistry) continue;
+    const sourceAbsolutePath = join8(options.agentAssetsDir, asset.sourcePath);
     if (!existsSync8(sourceAbsolutePath)) {
       issues.push({
         type: "missing-source",
@@ -667,8 +685,8 @@ function checkInstalledAssets(options) {
       });
       continue;
     }
-    const currentHash = hashAgentAssetContent(asset, options.agentAssetsDir);
-    if (currentHash !== entry.contentHash) {
+    const currentSourceHash = hashAgentAssetContent(asset, options.agentAssetsDir);
+    if (targetHashMatchesLock && currentSourceHash !== entry.contentHash) {
       issues.push({
         type: "hash-drift",
         id: entry.id,
@@ -1145,7 +1163,8 @@ function runAssetsCheck(args) {
   const result = checkInstalledAssets({
     targetDir: options.value.targetDir,
     agentAssetsDir: loaded.agentAssetsDir,
-    registry: loaded.registry
+    registry: loaded.registry,
+    strictRegistry: options.value.strictRegistry
   });
   if (options.value.json) {
     console.log(JSON.stringify(result, null, 2));
@@ -1300,6 +1319,8 @@ function parseTargetJsonOptions(args) {
       if (!targetDir) return { ok: false, error: "Expected --target <path>" };
       options.targetDir = targetDir;
       index += 1;
+    } else if (arg === "--strict-registry") {
+      options.strictRegistry = true;
     } else if (arg === "--json") {
       options.json = true;
     } else {
@@ -1580,6 +1601,10 @@ function resolveDocGovDependencyCli() {
   }
 }
 
+// src/commands/init.ts
+import { existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "node:fs";
+import { basename as basename3, dirname as dirname7, join as join13 } from "node:path";
+
 // src/commands/shared.ts
 function planStarterFiles(profile) {
   return listAssets().flatMap((asset) => {
@@ -1590,11 +1615,21 @@ function planStarterFiles(profile) {
       {
         sourcePath: asset.path,
         targetPath,
-        absoluteSourcePath: asset.absolutePath
+        absoluteSourcePath: asset.absolutePath,
+        ownership: classifyOwnership(targetPath)
       }
     ];
   }).sort((a, b) => a.targetPath.localeCompare(b.targetPath));
 }
+function classifyOwnership(targetPath) {
+  if (targetPath === "lefthook.yml" || targetPath === ".github/workflows/docs-check.yml") {
+    return "optional-guardrail";
+  }
+  if (targetPath === "AGENTS.md" || targetPath === "CLAUDE.md" || targetPath === "docs/policy/best-practice-for-this-project.md" || targetPath === "docs/reference/documentation-map.md" || targetPath === "docs/reference/execution/current-work.md") {
+    return "project-local-seed";
+  }
+  return "shared";
+}
 function isOtherProfileRouting(targetPath, profile) {
   return targetPath.startsWith("docs/governance/agents-routing/") && targetPath !== `docs/governance/agents-routing/${profile}-v0.9.md`;
 }
@@ -1610,8 +1645,9 @@ function starterTargetPath(sourcePath) {
 function runInit(args) {
   const profile = readFlag(args, "--profile");
   const dryRun = args.includes("--dry-run");
-  if (!dryRun) {
-    console.error("pro-gov init requires --dry-run in this first read-only release.");
+  const apply = args.includes("--apply");
+  if (dryRun === apply) {
+    console.error("pro-gov init requires exactly one of --dry-run or --apply.");
     return 1;
   }
   if (!profile) {
@@ -1622,15 +1658,50 @@ function runInit(args) {
     console.error(`Invalid profile: ${profile}`);
     return 1;
   }
+  const files = planStarterFiles(profile).filter((file) => file.ownership !== "optional-guardrail");
+  if (apply) return applyStarterFiles(files, profile);
   console.log("pro-gov init DRY RUN");
   console.log(`profile: ${profile}`);
   console.log("");
   console.log("Planned starter files:");
-  for (const file of planStarterFiles(profile)) {
+  for (const file of files) {
     console.log(`  ${file.targetPath} <- ${file.sourcePath}`);
   }
   return 0;
 }
+function applyStarterFiles(files, profile) {
+  const root = process.cwd();
+  const conflicts = files.filter((file) => existsSync13(join13(root, file.targetPath)));
+  if (conflicts.length > 0) {
+    console.error("pro-gov init is refusing to overwrite existing project files:");
+    for (const file of conflicts) console.error(`  ${file.targetPath}`);
+    console.error("No files were written. Use --dry-run and migrate existing files deliberately.");
+    return 1;
+  }
+  for (const file of files) {
+    const targetPath = join13(root, file.targetPath);
+    mkdirSync4(dirname7(targetPath), { recursive: true });
+    const source = readFileSync8(file.absoluteSourcePath);
+    const content = file.targetPath === "AGENTS.md" ? renderAgentsTemplate(source.toString("utf8"), basename3(root), profile) : source;
+    writeFileSync3(targetPath, content);
+  }
+  console.log("pro-gov init APPLIED");
+  console.log(`profile: ${profile}`);
+  console.log(`created-files: ${files.length}`);
+  console.log("Existing project files were not overwritten.");
+  console.log("Next: customize project-local policy/current-work, run doc-gov scan, then run doc-gov doctor.");
+  return 0;
+}
+function renderAgentsTemplate(template, projectName, profile) {
+  const selectedRoute = `docs/governance/agents-routing/${profile}-v0.9.md`;
+  return template.replace("# PROJECT_NAME AI Router", `# ${projectName} AI Router`).replace(
+    /6\. The selected agents routing file:\n   - `docs\/governance\/agents-routing\/engineering-runtime-v0\.9\.md`, or\n   - `docs\/governance\/agents-routing\/doc-only-v0\.9\.md`/,
+    `6. The selected agents routing file: \`${selectedRoute}\``
+  ).replace(
+    "- Name this project's adopted profile: `engineering-runtime` or `doc-only`.",
+    `- This project adopts the \`${profile}\` profile.`
+  );
+}
 function readFlag(args, flag) {
   const index = args.indexOf(flag);
   if (index === -1) return null;
@@ -1640,8 +1711,282 @@ function readFlag(args, flag) {
 }
 
 // src/commands/lens.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname7 } from "node:path";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname9 } from "node:path";
+
+// src/lens/audit.ts
+import { existsSync as existsSync14, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
+import { basename as basename4, dirname as dirname8, join as join14 } from "node:path";
+var REQUIRED_ARTIFACTS = [
+  "manifest.md",
+  "raw/project-lens/architecture-lens.md",
+  "raw/project-lens/truth-surface-audit.md",
+  "raw/project-lens/technology-strategy.md",
+  "raw/ponytail/ponytail-audit.md",
+  "raw/ponytail/ponytail-debt.md",
+  "raw/ponytail/ponytail-gain.md",
+  "raw/target/target-state.md",
+  "raw/target/commands.md",
+  "raw/target/sources.md",
+  "synthesis/decision-index.md",
+  "synthesis/handoff-for-implementation-ai.md"
+];
+function createProjectLensAuditPackage(targetDir, auditDir) {
+  const contract = {
+    version: 1,
+    target: {
+      path: targetDir,
+      name: basename4(targetDir) || "target"
+    },
+    requiredArtifacts: [...REQUIRED_ARTIFACTS]
+  };
+  mkdirSync5(auditDir, { recursive: true });
+  writeJson(join14(auditDir, "audit.contract.json"), contract);
+  for (const artifactPath of REQUIRED_ARTIFACTS) {
+    writeTemplate(join14(auditDir, artifactPath), renderArtifactTemplate(artifactPath, contract));
+  }
+  return contract;
+}
+function checkProjectLensAuditPackage(auditDir, options = {}) {
+  const contractPath = join14(auditDir, "audit.contract.json");
+  if (!existsSync14(contractPath)) {
+    return {
+      ok: false,
+      auditDir,
+      issues: [
+        {
+          type: "missing-contract",
+          path: "audit.contract.json"
+        }
+      ]
+    };
+  }
+  let contract;
+  try {
+    contract = JSON.parse(readFileSync9(contractPath, "utf8"));
+  } catch (error) {
+    return {
+      ok: false,
+      auditDir,
+      issues: [
+        {
+          type: "invalid-contract",
+          path: "audit.contract.json",
+          message: error instanceof Error ? error.message : "Invalid JSON"
+        }
+      ]
+    };
+  }
+  const issues = [];
+  if (contract.version !== 1 || !Array.isArray(contract.requiredArtifacts)) {
+    issues.push({
+      type: "invalid-contract",
+      path: "audit.contract.json",
+      message: "Expected version 1 and requiredArtifacts array"
+    });
+  } else {
+    for (const artifactPath of REQUIRED_ARTIFACTS) {
+      if (!contract.requiredArtifacts.includes(artifactPath)) {
+        issues.push({
+          type: "invalid-contract",
+          path: "audit.contract.json",
+          message: `Missing required artifact in contract: ${artifactPath}`
+        });
+      }
+    }
+  }
+  for (const artifactPath of REQUIRED_ARTIFACTS) {
+    const absolutePath = join14(auditDir, artifactPath);
+    if (!existsSync14(absolutePath)) {
+      issues.push({ type: "missing-required-artifact", path: artifactPath });
+      continue;
+    }
+    const content = readFileSync9(absolutePath, "utf8");
+    if (isPendingArtifact(content)) {
+      issues.push({ type: "artifact-not-complete", path: artifactPath });
+    } else if (hasTemplateBody(content)) {
+      issues.push({ type: "artifact-template-not-replaced", path: artifactPath });
+    } else {
+      issues.push(...checkArtifactGuardrails(artifactPath, content, options.mode));
+    }
+  }
+  return {
+    ok: issues.length === 0,
+    auditDir,
+    issues
+  };
+}
+function writeJson(path, value) {
+  mkdirSync5(dirname8(path), { recursive: true });
+  writeFileSync4(path, `${JSON.stringify(value, null, 2)}
+`);
+}
+function writeTemplate(path, content) {
+  mkdirSync5(dirname8(path), { recursive: true });
+  writeFileSync4(path, content);
+}
+function renderArtifactTemplate(artifactPath, contract) {
+  const title = artifactPath.replace(/\.md$/, "").split("/").map((part) => part.replaceAll("-", " ")).join(" / ");
+  const producer = artifactProducer(artifactPath);
+  return `${[
+    "---",
+    "status: pending",
+    `producer: ${producer}`,
+    `target: ${contract.target.path}`,
+    `artifact: ${artifactPath}`,
+    "---",
+    "",
+    `# ${title}`,
+    "",
+    "Replace this template with the raw audit output for this producer.",
+    ...renderArtifactGuardrailHint(artifactPath),
+    "",
+    "Required completion marker:",
+    "",
+    "```text",
+    "status: complete",
+    "```"
+  ].join("\n")}
+`;
+}
+function renderArtifactGuardrailHint(artifactPath) {
+  const rules = REQUIRED_METHOD_RECORDS[artifactPath];
+  if (!rules) return [];
+  const lines = [
+    "",
+    "Required audit method records. Keep these labels at the start of their own lines:",
+    "",
+    ...rules.map((rule) => `${rule.label} <replace with evidence>`)
+  ];
+  if (artifactPath === "manifest.md") {
+    lines.push(
+      "",
+      "For --mode fresh, also keep these labels at the start of their own lines:",
+      "",
+      "Audit run mode: <replace with fresh>",
+      "Current session id: <replace with current Codex thread id, or unknown plus reason>",
+      "Fresh run evidence: <replace with current-run raw pass and subagent evidence>",
+      "",
+      "For --mode reuse, use these labels instead of the fresh-mode labels:",
+      "",
+      "Audit run mode: <replace with reuse>",
+      "Reuse source audit: <replace with reused audit package path>",
+      "Reuse justification: <replace with same target commit, clean status, and check result>",
+      "No new subagents were run: <replace with true and explanation>"
+    );
+  }
+  return lines;
+}
+function artifactProducer(artifactPath) {
+  if (artifactPath.startsWith("raw/project-lens/")) return "project-lens";
+  if (artifactPath.startsWith("raw/ponytail/")) return "ponytail";
+  if (artifactPath.startsWith("raw/target/")) return "target-evidence";
+  if (artifactPath.startsWith("synthesis/")) return "synthesis";
+  return "audit";
+}
+function isPendingArtifact(content) {
+  const frontmatter = content.match(/^---\n([\s\S]*?)\n---\n/);
+  if (!frontmatter) return true;
+  return !/^status:\s*complete\s*$/m.test(frontmatter[1]);
+}
+function hasTemplateBody(content) {
+  return content.includes("Replace this template with the raw audit output for this producer.");
+}
+var REQUIRED_METHOD_RECORDS = {
+  "manifest.md": [
+    {
+      label: "Read-only boundary:",
+      match: /^Read-only boundary:/im
+    },
+    {
+      label: "Agent execution record:",
+      match: /^Agent execution record:/im
+    },
+    {
+      label: "Subagent trace:",
+      match: /^Subagent trace:/im
+    }
+  ],
+  "raw/target/commands.md": [
+    {
+      label: "Project Lens method source:",
+      match: /^Project Lens method source:/im
+    },
+    {
+      label: "Ponytail method source:",
+      match: /^Ponytail method source:/im
+    }
+  ],
+  "synthesis/decision-index.md": [
+    {
+      label: "Target repository final status:",
+      match: /^Target repository final status:/im
+    },
+    {
+      label: "Audit package final status:",
+      match: /^Audit package final status:/im
+    }
+  ]
+};
+var RUN_MODE_METHOD_RECORDS = {
+  fresh: [
+    {
+      label: "Audit run mode: fresh",
+      match: /^Audit run mode:\s*fresh\b/im
+    },
+    {
+      label: "Current session id:",
+      match: /^Current session id:/im
+    },
+    {
+      label: "Fresh run evidence:",
+      match: /^Fresh run evidence:/im
+    }
+  ],
+  reuse: [
+    {
+      label: "Audit run mode: reuse",
+      match: /^Audit run mode:\s*reuse\b/im
+    },
+    {
+      label: "Reuse source audit:",
+      match: /^Reuse source audit:/im
+    },
+    {
+      label: "Reuse justification:",
+      match: /^Reuse justification:/im
+    },
+    {
+      label: "No new subagents were run:",
+      match: /^No new subagents were run:/im
+    }
+  ]
+};
+function checkArtifactGuardrails(artifactPath, content, mode) {
+  const rules = [
+    ...REQUIRED_METHOD_RECORDS[artifactPath] ?? [],
+    ...artifactPath === "manifest.md" && mode ? RUN_MODE_METHOD_RECORDS[mode] : []
+  ];
+  if (!rules) return [];
+  return rules.filter((rule) => !hasCompletedMethodRecord(rule, content)).map((rule) => ({
+    type: "audit-method-not-recorded",
+    path: artifactPath,
+    message: `Missing required audit method record: ${rule.label}`
+  }));
+}
+function hasCompletedMethodRecord(rule, content) {
+  return content.split(/\r?\n/).some((line) => rule.match.test(line) && !line.includes("<replace with"));
+}
+function formatProjectLensAuditCheckText(result) {
+  if (result.ok) return `audit package ok: ${result.auditDir}`;
+  return [
+    `audit package failed: ${result.auditDir}`,
+    ...result.issues.map((issue) => {
+      const message = issue.message ? `: ${issue.message}` : "";
+      return `- ${issue.type}: ${issue.path}${message}`;
+    })
+  ].join("\n");
+}
 
 // src/lens/report.ts
 function formatProjectLensInspection(report) {
@@ -1716,8 +2061,8 @@ function bulletList(values) {
 
 // src/lens/scan.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync13, readdirSync as readdirSync6, readFileSync as readFileSync8, statSync as statSync3 } from "node:fs";
-import { join as join13, relative as relative4 } from "node:path";
+import { existsSync as existsSync15, readdirSync as readdirSync6, readFileSync as readFileSync10, statSync as statSync3 } from "node:fs";
+import { join as join15, relative as relative5 } from "node:path";
 var ignoredDirectories = /* @__PURE__ */ new Set([
   ".git",
   ".next",
@@ -1734,24 +2079,24 @@ function scanProjectLensTarget(targetDir, options = {}) {
   return {
     targetDir,
     aiEntryFiles: ["AGENTS.md", "CLAUDE.md"].filter(
-      (file) => existsSync13(join13(targetDir, file))
+      (file) => existsSync15(join15(targetDir, file))
     ),
     aiConfigFiles: [],
     packageJson,
     docs: {
-      hasDocsDirectory: existsSync13(join13(targetDir, "docs")),
+      hasDocsDirectory: existsSync15(join15(targetDir, "docs")),
       markdownFileCount: markdownFiles.length,
       governanceFiles: markdownFiles.filter((file) => file.startsWith("docs/governance/") || file.startsWith("docs/policy/")).sort()
     },
     git: readGitState(targetDir),
-    largeFiles: files.map((file) => ({ path: file, bytes: statSync3(join13(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
+    largeFiles: files.map((file) => ({ path: file, bytes: statSync3(join15(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
   };
 }
 function readPackageJson(targetDir) {
-  const packageJsonPath = join13(targetDir, "package.json");
-  if (!existsSync13(packageJsonPath)) return void 0;
+  const packageJsonPath = join15(targetDir, "package.json");
+  if (!existsSync15(packageJsonPath)) return void 0;
   try {
-    const packageJson = JSON.parse(readFileSync8(packageJsonPath, "utf8"));
+    const packageJson = JSON.parse(readFileSync10(packageJsonPath, "utf8"));
     return {
       scripts: Object.keys(packageJson.scripts ?? {}).sort(),
       dependencies: Object.keys(packageJson.dependencies ?? {}).sort(),
@@ -1786,13 +2131,13 @@ function listProjectFiles(targetDir) {
   return files.sort();
 }
 function collectFiles2(rootDir, currentDir, files) {
-  if (!existsSync13(currentDir)) return;
+  if (!existsSync15(currentDir)) return;
   for (const entry of readdirSync6(currentDir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
       if (ignoredDirectories.has(entry.name)) continue;
-      collectFiles2(rootDir, join13(currentDir, entry.name), files);
+      collectFiles2(rootDir, join15(currentDir, entry.name), files);
     } else if (entry.isFile()) {
-      files.push(toUnixPath4(relative4(rootDir, join13(currentDir, entry.name))));
+      files.push(toUnixPath4(relative5(rootDir, join15(currentDir, entry.name))));
     }
   }
 }
@@ -1809,6 +2154,9 @@ function runLens(args) {
   if (subcommand2 === "report") {
     return runLensReport(rest);
   }
+  if (subcommand2 === "audit") {
+    return runLensAudit(rest);
+  }
   printUsage2();
   return 1;
 }
@@ -1841,11 +2189,52 @@ function runLensReport(args) {
   }
   const report = scanProjectLensTarget(options.value.targetDir);
   const markdown = renderProjectLensMarkdownReport(report);
-  mkdirSync4(dirname7(options.value.outPath), { recursive: true });
-  writeFileSync3(options.value.outPath, markdown);
+  mkdirSync6(dirname9(options.value.outPath), { recursive: true });
+  writeFileSync5(options.value.outPath, markdown);
   console.log(`report: ${options.value.outPath}`);
   return 0;
 }
+function runLensAudit(args) {
+  const [auditSubcommand, ...rest] = args;
+  if (auditSubcommand === "init") {
+    const options = parseLensOptions(rest, "audit init");
+    if (!options.ok) {
+      console.error(options.error);
+      printUsage2();
+      return 1;
+    }
+    if (!options.value.outPath) {
+      console.error("Expected --out <path>");
+      printUsage2();
+      return 1;
+    }
+    createProjectLensAuditPackage(options.value.targetDir, options.value.outPath);
+    console.log(`audit: ${options.value.outPath}`);
+    return 0;
+  }
+  if (auditSubcommand === "check") {
+    const options = parseLensOptions(rest, "audit check");
+    if (!options.ok) {
+      console.error(options.error);
+      printUsage2();
+      return 1;
+    }
+    if (!options.value.auditDir) {
+      console.error("Expected --dir <path>");
+      printUsage2();
+      return 1;
+    }
+    const result = checkProjectLensAuditPackage(options.value.auditDir, { mode: options.value.auditMode });
+    if (options.value.json || options.value.format === "json") {
+      console.log(JSON.stringify(result, null, 2));
+    } else {
+      console.log(formatProjectLensAuditCheckText(result));
+    }
+    return result.ok ? 0 : 1;
+  }
+  printUsage2();
+  return 1;
+}
 function parseLensOptions(args, subcommand2) {
   const options = {
     targetDir: process.cwd(),
@@ -1874,6 +2263,21 @@ function parseLensOptions(args, subcommand2) {
       if (!outPath) return { ok: false, error: "Expected --out <path>" };
       options.outPath = outPath;
       index += 1;
+    } else if (arg === "--dir") {
+      const auditDir = args[index + 1];
+      if (!auditDir) return { ok: false, error: "Expected --dir <path>" };
+      options.auditDir = auditDir;
+      index += 1;
+    } else if (arg === "--mode") {
+      if (subcommand2 !== "audit check") {
+        return { ok: false, error: `Unknown lens ${subcommand2} option: ${arg}` };
+      }
+      const auditMode = args[index + 1];
+      if (auditMode !== "fresh" && auditMode !== "reuse") {
+        return { ok: false, error: "Expected --mode fresh|reuse" };
+      }
+      options.auditMode = auditMode;
+      index += 1;
     } else {
       return { ok: false, error: `Unknown lens ${subcommand2} option: ${arg}` };
     }
@@ -1884,14 +2288,21 @@ function printUsage2() {
   console.error("Usage: pro-gov lens scan [--target <path>] [--json]");
   console.error("Usage: pro-gov lens inspect [--target <path>] [--format text|json]");
   console.error("Usage: pro-gov lens report --target <path> --out <path>");
+  console.error("Usage: pro-gov lens audit init --target <path> --out <path>");
+  console.error("Usage: pro-gov lens audit check --dir <path> [--mode fresh|reuse] [--json]");
 }
 
+// src/commands/portfolio.ts
+import { existsSync as existsSync17 } from "node:fs";
+import { join as join16 } from "node:path";
+
 // src/portfolio/manifest.ts
-import { existsSync as existsSync14, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync11 } from "node:fs";
+import { dirname as dirname10, isAbsolute as isAbsolute3, resolve as resolve2 } from "node:path";
 function loadPortfolioManifest(configPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync9(configPath, "utf8"));
+    parsed = JSON.parse(readFileSync11(configPath, "utf8"));
   } catch (error) {
     return {
       configPath,
@@ -1903,13 +2314,29 @@ function loadPortfolioManifest(configPath) {
       ]
     };
   }
-  const issues = validatePortfolioManifest(parsed);
+  const normalized = resolveManifestPaths(parsed, dirname10(resolve2(configPath)));
+  const issues = validatePortfolioManifest(normalized);
   return {
     configPath,
-    manifest: issues.length === 0 ? parsed : void 0,
+    manifest: issues.length === 0 ? normalized : void 0,
     issues
   };
 }
+function resolveManifestPaths(value, configDir) {
+  if (!isRecord(value)) return value;
+  const resolveEndpoint = (endpoint) => {
+    if (!isRecord(endpoint) || typeof endpoint.path !== "string" || isAbsolute3(endpoint.path)) {
+      return endpoint;
+    }
+    return { ...endpoint, path: resolve2(configDir, endpoint.path) };
+  };
+  return {
+    ...value,
+    controlPlane: resolveEndpoint(value.controlPlane),
+    executionEngine: resolveEndpoint(value.executionEngine),
+    targets: Array.isArray(value.targets) ? value.targets.map(resolveEndpoint) : value.targets
+  };
+}
 function validatePortfolioManifest(value) {
   const issues = [];
   if (!isRecord(value)) {
@@ -1935,6 +2362,7 @@ function validatePortfolioManifest(value) {
       message: "Portfolio manifest portfolioId must be a non-empty string."
     });
   }
+  validateAllowedFields(value, "root", ["schemaVersion", "portfolioId", "controlPlane", "executionEngine", "targets"], issues);
   validateEndpoint(value.controlPlane, "controlPlane", issues);
   validateEndpoint(value.executionEngine, "executionEngine", issues);
   if (!Array.isArray(value.targets)) {
@@ -1956,6 +2384,7 @@ function validatePortfolioManifest(value) {
       continue;
     }
     validateEndpoint(target, "targets", issues);
+    validateAllowedFields(target, "target", ["id", "path", "profile", "assetBundles"], issues);
     if (typeof target.id === "string") {
       if (seenTargetIds.has(target.id)) {
         issues.push({
@@ -1966,14 +2395,41 @@ function validatePortfolioManifest(value) {
       }
       seenTargetIds.add(target.id);
     }
+    if (target.profile !== void 0 && (typeof target.profile !== "string" || !isValidProfile(target.profile))) {
+      issues.push({
+        type: "invalid-field",
+        id: typeof target.id === "string" ? target.id : void 0,
+        field: "profile",
+        message: "Portfolio target profile must be engineering-runtime or doc-only."
+      });
+    }
     validateOptionalStringArray(target.assetBundles, target.id, "assetBundles", issues);
-    validateOptionalStringArray(target.sharedRules, target.id, "sharedRules", issues);
+    if ("sharedRules" in target) {
+      issues.push({
+        type: "invalid-field",
+        id: typeof target.id === "string" ? target.id : void 0,
+        field: "sharedRules",
+        message: "Portfolio target sharedRules is not managed yet; remove it until plan/check supports it."
+      });
+    }
   }
   return issues;
 }
 function getDefaultPortfolioTargets(manifest) {
   return manifest?.targets ?? [];
 }
+function validateAllowedFields(value, location, allowedFields, issues) {
+  const allowed = new Set(allowedFields);
+  for (const field of Object.keys(value)) {
+    if (allowed.has(field)) continue;
+    issues.push({
+      type: "invalid-field",
+      id: typeof value.id === "string" ? value.id : void 0,
+      field,
+      message: `Unknown portfolio ${location} field: ${field}`
+    });
+  }
+}
 function validateEndpoint(value, field, issues) {
   if (value === void 0) return;
   if (!isRecord(value)) {
@@ -2000,7 +2456,7 @@ function validateEndpoint(value, field, issues) {
     });
     return;
   }
-  if (!existsSync14(value.path)) {
+  if (!existsSync16(value.path)) {
     issues.push({
       type: "missing-path",
       id: typeof value.id === "string" ? value.id : void 0,
@@ -2029,6 +2485,7 @@ function runPortfolio(args) {
   const [subcommand2, ...rest] = args;
   if (subcommand2 === "check") return runPortfolioCheck(rest);
   if (subcommand2 === "plan") return runPortfolioPlan(rest);
+  if (subcommand2 === "assets-check") return runPortfolioAssetsCheck(rest);
   printUsage3();
   return 1;
 }
@@ -2085,7 +2542,9 @@ function runPortfolioPlan(args) {
     console.error(`Unknown portfolio target: ${options.value.targetId}`);
     return 1;
   }
-  const loadedAssets = loadAgentAssetRegistry();
+  const loadedAssets = loadAgentAssetRegistry({
+    agentAssetsDir: findPortfolioAgentAssetsDir(loaded.manifest)
+  });
   if (loadedAssets.issues.length > 0) {
     for (const issue of loadedAssets.issues) {
       console.error(`${issue.type}: ${issue.message}`);
@@ -2136,6 +2595,106 @@ function runPortfolioPlan(args) {
     return 1;
   }
 }
+function runPortfolioAssetsCheck(args) {
+  const options = parsePortfolioOptions(args);
+  if (!options.ok) {
+    console.error(options.error);
+    printUsage3();
+    return 1;
+  }
+  const loaded = loadPortfolioManifest(options.value.configPath);
+  if (loaded.issues.length > 0 || !loaded.manifest) {
+    if (options.value.json) {
+      console.log(
+        JSON.stringify(
+          {
+            ok: false,
+            configPath: loaded.configPath,
+            issues: loaded.issues,
+            targets: []
+          },
+          null,
+          2
+        )
+      );
+    } else {
+      for (const issue of loaded.issues) {
+        console.error(`${issue.type}: ${issue.message}`);
+      }
+    }
+    return 1;
+  }
+  const targets = getDefaultPortfolioTargets(loaded.manifest).filter(
+    (target) => !options.value.targetId || options.value.targetId === "all" || target.id === options.value.targetId
+  );
+  if (targets.length === 0) {
+    console.error(`Unknown portfolio target: ${options.value.targetId}`);
+    return 1;
+  }
+  const loadedAssets = loadAgentAssetRegistry({
+    agentAssetsDir: findPortfolioAgentAssetsDir(loaded.manifest)
+  });
+  if (loadedAssets.issues.length > 0) {
+    if (options.value.json) {
+      console.log(
+        JSON.stringify(
+          {
+            ok: false,
+            configPath: loaded.configPath,
+            portfolioId: loaded.manifest.portfolioId,
+            registryIssues: loadedAssets.issues,
+            targets: []
+          },
+          null,
+          2
+        )
+      );
+    } else {
+      for (const issue of loadedAssets.issues) {
+        console.error(`${issue.type}: ${issue.message}`);
+      }
+    }
+    return 1;
+  }
+  const targetResults = targets.map((target) => {
+    const result = checkInstalledAssets({
+      targetDir: target.path,
+      agentAssetsDir: loadedAssets.agentAssetsDir,
+      registry: loadedAssets.registry,
+      strictRegistry: true
+    });
+    return {
+      id: target.id,
+      path: target.path,
+      issues: result.issues
+    };
+  });
+  const ok = targetResults.every((target) => target.issues.length === 0);
+  if (options.value.json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok,
+          configPath: loaded.configPath,
+          portfolioId: loaded.manifest.portfolioId,
+          agentAssetsDir: loadedAssets.agentAssetsDir,
+          targets: targetResults
+        },
+        null,
+        2
+      )
+    );
+  } else if (ok) {
+    console.log(`portfolio assets check passed (${targetResults.length} targets)`);
+  } else {
+    for (const target of targetResults) {
+      for (const issue of target.issues) {
+        console.log(`${target.id}	${issue.type}: ${issue.message}`);
+      }
+    }
+  }
+  return ok ? 0 : 1;
+}
 function parsePortfolioOptions(args) {
   const options = {
     configPath: "",
@@ -2171,31 +2730,56 @@ function parsePortfolioOptions(args) {
 function isHost2(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
+function findPortfolioAgentAssetsDir(manifest) {
+  const agentAssetsDir = manifest?.executionEngine?.path ? join16(manifest.executionEngine.path, "agent-assets") : void 0;
+  return agentAssetsDir && existsSync17(join16(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
+}
 function printUsage3() {
   console.error("Usage:");
   console.error("  pro-gov portfolio check --config <path> [--json]");
   console.error("  pro-gov portfolio plan --config <path> [--target <id|all>] [--host codex|claude-code|gemini-cli|antigravity] [--json]");
+  console.error("  pro-gov portfolio assets-check --config <path> [--target <id|all>] [--json]");
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync15, readFileSync as readFileSync10 } from "node:fs";
-import { join as join14 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync12 } from "node:fs";
+import { join as join17 } from "node:path";
 function runSync(args) {
   if (!args.includes("--check")) {
-    console.error("pro-gov sync requires --check in this first read-only release.");
+    console.error("pro-gov sync is read-only and requires --check.");
+    return 1;
+  }
+  const requestedProfile = readFlag2(args, "--profile");
+  let profile;
+  if (requestedProfile) {
+    if (!isValidProfile(requestedProfile)) {
+      console.error(`Invalid profile: ${requestedProfile}`);
+      return 1;
+    }
+    profile = requestedProfile;
+  } else {
+    profile = inferInstalledProfile(process.cwd());
+  }
+  if (!profile) {
+    console.error(
+      "Cannot infer one installed profile. Pass --profile <engineering-runtime|doc-only>."
+    );
     return 1;
   }
   let differences = 0;
   console.log("pro-gov sync check");
-  for (const file of planStarterFiles()) {
-    const targetPath = join14(process.cwd(), file.targetPath);
-    if (!existsSync15(targetPath)) {
+  console.log(`profile: ${profile}`);
+  for (const file of planStarterFiles(profile)) {
+    const targetPath = join17(process.cwd(), file.targetPath);
+    if (!existsSync18(targetPath)) {
+      if (file.ownership === "optional-guardrail") continue;
       console.log(`missing: ${file.targetPath}`);
       differences += 1;
       continue;
     }
-    const source = readFileSync10(file.absoluteSourcePath, "utf8");
-    const target = readFileSync10(targetPath, "utf8");
+    if (file.ownership === "project-local-seed") continue;
+    const source = readFileSync12(file.absoluteSourcePath, "utf8");
+    const target = readFileSync12(targetPath, "utf8");
     if (source !== target) {
       console.log(`different: ${file.targetPath}`);
       differences += 1;
@@ -2208,6 +2792,17 @@ function runSync(args) {
   console.log("sync check passed: starter files match packaged assets.");
   return 0;
 }
+function inferInstalledProfile(root) {
+  const installed = ["engineering-runtime", "doc-only"].filter(
+    (profile) => existsSync18(join17(root, `docs/governance/agents-routing/${profile}-v0.9.md`))
+  );
+  return installed.length === 1 ? installed[0] : void 0;
+}
+function readFlag2(args, flag) {
+  const index = args.indexOf(flag);
+  const value = index >= 0 ? args[index + 1] : void 0;
+  return value && !value.startsWith("--") ? value : void 0;
+}
 
 // src/cli.ts
 var COMMANDS = [
@@ -2216,16 +2811,19 @@ var COMMANDS = [
   "assets recommend [--target <path>] [--json]",
   "assets plan --bundle <bundle-id> [--target <path>] [--json]",
   "assets apply --plan <path>",
-  "assets check [--target <path>] [--json]",
+  "assets check [--target <path>] [--strict-registry] [--json]",
   "assets public-check [--public-root <path>] [--private-root <path>] [--json]",
   "assets npx add|update ... --plan",
   "portfolio check --config <path> [--json]",
   "portfolio plan --config <path> [--target <id|all>] [--json]",
+  "portfolio assets-check --config <path> [--target <id|all>] [--json]",
   "lens scan [--target <path>] [--json]",
   "lens inspect [--target <path>] [--format text|json]",
   "lens report --target <path> --out <path>",
-  "init --profile <engineering-runtime|doc-only> --dry-run",
-  "sync --check",
+  "lens audit init --target <path> --out <path>",
+  "lens audit check --dir <path> [--json]",
+  "init --profile <engineering-runtime|doc-only> <--dry-run|--apply>",
+  "sync --check [--profile <engineering-runtime|doc-only>]",
   "doctor"
 ];
 var [command, subcommand] = process.argv.slice(2);