@pieai/pro-gov 0.4.8 → 0.5.0

package/dist/cli.js

@@ -1654,9 +1654,9 @@ import { createRequire } from "node:module";
 import { dirname as dirname6, join as join12 } from "node:path";
 var REQUIRED_ASSETS = [
   "starter/AGENTS.template.md",
-  "starter/docs/governance/ssot-v0.9.md",
-  "starter/docs/governance/agents-routing/engineering-runtime-v0.9.md",
-  "starter/docs/governance/agents-routing/doc-only-v0.9.md",
+  "starter/docs/governance/ssot-v1.0.md",
+  "starter/docs/governance/agents-routing/engineering-runtime-v1.0.md",
+  "starter/docs/governance/agents-routing/doc-only-v1.0.md",
   "profiles/engineering-runtime/profile.md",
   "profiles/doc-only/profile.md"
 ];
@@ -1738,7 +1738,7 @@ function classifyOwnership(targetPath) {
   return "shared";
 }
 function isOtherProfileRouting(targetPath, profile) {
-  return targetPath.startsWith("docs/governance/agents-routing/") && targetPath !== `docs/governance/agents-routing/${profile}-v0.9.md`;
+  return targetPath.startsWith("docs/governance/agents-routing/") && targetPath !== `docs/governance/agents-routing/${profile}-v1.0.md`;
 }
 function starterTargetPath(sourcePath) {
   if (sourcePath === "starter/AGENTS.template.md") return "AGENTS.md";
@@ -1800,7 +1800,7 @@ function applyStarterFiles(files, profile) {
   return 0;
 }
 function renderAgentsTemplate(template, projectName, profile) {
-  const selectedRoute = `docs/governance/agents-routing/${profile}-v0.9.md`;
+  const selectedRoute = `docs/governance/agents-routing/${profile}-v1.0.md`;
   return template.replace("# PROJECT_NAME AI Router", `# ${projectName} AI Router`).replace("`PROFILE_NAME`", `\`${profile}\``).replace("`PROFILE_ROUTE`", `\`${selectedRoute}\``).replace(/\n{3,}/g, "\n\n");
 }
 function readFlag(args, flag) {
@@ -1834,18 +1834,22 @@ function recallLearnings(root, options) {
   return { query, hits };
 }
 function loadLearningRecords(root) {
-  const records = [];
-  const solutionsDir = join14(root, "docs/solutions");
-  if (existsSync14(solutionsDir)) {
-    for (const path of listMarkdownFiles(solutionsDir)) {
-      records.push(readLearningRecord(root, path));
+  const recordsByTitle = /* @__PURE__ */ new Map();
+  for (const relativeDir of ["docs/reference/learnings", "docs/solutions"]) {
+    const learningDir = join14(root, relativeDir);
+    if (!existsSync14(learningDir)) continue;
+    for (const path of listMarkdownFiles(learningDir)) {
+      const record = readLearningRecord(root, path);
+      const key = record.title.trim().toLowerCase();
+      if (!recordsByTitle.has(key)) recordsByTitle.set(key, record);
     }
   }
   const conceptsPath = join14(root, "CONCEPTS.md");
   if (existsSync14(conceptsPath)) {
-    records.push(readLearningRecord(root, conceptsPath));
+    const record = readLearningRecord(root, conceptsPath);
+    recordsByTitle.set(`concepts:${record.title.toLowerCase()}`, record);
   }
-  return records;
+  return [...recordsByTitle.values()];
 }
 function listMarkdownFiles(dir) {
   const files = [];
@@ -1944,7 +1948,7 @@ function cleanMarkdownLine(input) {
 
 // src/learning/capture.ts
 import { existsSync as existsSync15, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join15, relative as relative6 } from "node:path";
+import { basename as basename5, join as join15, relative as relative6 } from "node:path";
 function captureLearning(root, options) {
   const title = options.title.trim();
   const summary = options.summary.trim();
@@ -1952,10 +1956,11 @@ function captureLearning(root, options) {
   if (!summary) throw new Error("summary is required");
   const category = slugify(options.category ?? "workflow-issues") || "workflow-issues";
   const moduleName = options.module?.trim() || "PGS learning capture";
-  const dir = join15(root, "docs/solutions", category);
+  const dir = join15(root, "docs/reference/learnings", category);
   mkdirSync5(dir, { recursive: true });
   const path = uniquePath(dir, slugify(title) || "learning");
-  writeFileSync4(path, renderLearning({ title, summary, category, moduleName }));
+  const idSlug = basename5(path, ".md");
+  writeFileSync4(path, renderLearning({ title, summary, category, moduleName, idSlug }));
   return {
     relativePath: normalizePath2(relative6(root, path)),
     title,
@@ -1965,12 +1970,23 @@ function captureLearning(root, options) {
 function renderLearning(options) {
   return [
     "---",
+    `id: REF-LEARNING-${upperSlug(options.category)}-${upperSlug(options.idSlug)}`,
     `title: ${yamlString(options.title)}`,
-    `date: ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`,
+    "type: reference",
+    "status: stable",
+    "canonical: true",
+    "owner: ai-assisted",
+    `created: ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`,
+    `last_reviewed: ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`,
+    "domain: learning",
+    "tags:",
+    "  - learning-recall",
+    `  - ${options.category}`,
+    "pinned: false",
+    "related: []",
     `category: ${options.category}`,
     `module: ${yamlString(options.moduleName)}`,
     "capture_mode: pgs-native",
-    "tags: [learning-recall]",
     "---",
     "",
     `# ${options.title}`,
@@ -2004,6 +2020,9 @@ function yamlString(input) {
 function normalizePath2(path) {
   return path.split("\\").join("/");
 }
+function upperSlug(input) {
+  return slugify(input).toUpperCase() || "LEARNING";
+}
 
 // src/commands/learn.ts
 function runLearn(args) {
@@ -2173,7 +2192,7 @@ import { dirname as dirname9 } from "node:path";
 
 // src/lens/audit.ts
 import { existsSync as existsSync16, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
-import { basename as basename5, dirname as dirname8, join as join16 } from "node:path";
+import { basename as basename6, dirname as dirname8, join as join16 } from "node:path";
 var REQUIRED_ARTIFACTS = [
   "manifest.md",
   "raw/project-lens/architecture-lens.md",
@@ -2191,7 +2210,7 @@ function createProjectLensAuditPackage(targetDir, auditDir) {
     version: 1,
     target: {
       path: targetDir,
-      name: basename5(targetDir) || "target"
+      name: basename6(targetDir) || "target"
     },
     requiredArtifacts: [...REQUIRED_ARTIFACTS]
   };
@@ -2824,6 +2843,7 @@ function resolveManifestPaths(value, configDir) {
   };
   return {
     ...value,
+    technologyGovernance: isRecord(value.technologyGovernance) && typeof value.technologyGovernance.strategySource === "string" && !isAbsolute3(value.technologyGovernance.strategySource) ? { ...value.technologyGovernance, strategySource: resolve3(configDir, value.technologyGovernance.strategySource) } : value.technologyGovernance,
     controlPlane: resolveEndpoint(value.controlPlane),
     executionEngine: resolveEndpoint(value.executionEngine),
     targets: Array.isArray(value.targets) ? value.targets.map(resolveEndpoint) : value.targets
@@ -2857,11 +2877,12 @@ function validatePortfolioManifest(value) {
   validateAllowedFields(
     value,
     "root",
-    ["schemaVersion", "portfolioId", "controlPlane", "executionEngine", "hostTooling", "targets"],
+    ["schemaVersion", "portfolioId", "technologyGovernance", "controlPlane", "executionEngine", "hostTooling", "targets"],
     issues
   );
-  validateEndpoint(value.controlPlane, "controlPlane", issues);
-  validateEndpoint(value.executionEngine, "executionEngine", issues);
+  const technologyCatalog = validateTechnologyGovernance(value.technologyGovernance, issues);
+  validateEndpoint(value.controlPlane, "controlPlane", issues, technologyCatalog);
+  validateEndpoint(value.executionEngine, "executionEngine", issues, technologyCatalog);
   validateHostTooling(value.hostTooling, issues);
   if (!Array.isArray(value.targets)) {
     issues.push({
@@ -2881,8 +2902,8 @@ function validatePortfolioManifest(value) {
       });
       continue;
     }
-    validateEndpoint(target, "targets", issues);
-    validateAllowedFields(target, "target", ["id", "path", "profile", "assetBundles"], issues);
+    validateEndpoint(target, "targets", issues, technologyCatalog);
+    validateAllowedFields(target, "target", ["id", "path", "profile", "assetBundles", "projectType", "capabilities", "boundary", "technologyExceptions"], issues);
     if (typeof target.id === "string") {
       if (seenTargetIds.has(target.id)) {
         issues.push({
@@ -2928,7 +2949,7 @@ function validateAllowedFields(value, location, allowedFields, issues) {
     });
   }
 }
-function validateEndpoint(value, field, issues) {
+function validateEndpoint(value, field, issues, technologyCatalog) {
   if (value === void 0) return;
   if (!isRecord(value)) {
     issues.push({
@@ -2938,6 +2959,12 @@ function validateEndpoint(value, field, issues) {
     });
     return;
   }
+  validateAllowedFields(
+    value,
+    field,
+    field === "targets" ? ["id", "path", "profile", "assetBundles", "projectType", "capabilities", "boundary", "technologyExceptions"] : ["id", "path", "projectType", "capabilities", "boundary", "technologyExceptions"],
+    issues
+  );
   if (typeof value.id !== "string" || value.id.length === 0) {
     issues.push({
       type: "invalid-field",
@@ -2962,6 +2989,7 @@ function validateEndpoint(value, field, issues) {
       message: `Portfolio ${field} path does not exist: ${value.path}`
     });
   }
+  validateRepositoryGovernance(value, field, technologyCatalog, issues);
 }
 function validateOptionalStringArray(value, id, field, issues) {
   if (value === void 0) return;
@@ -2974,6 +3002,118 @@ function validateOptionalStringArray(value, id, field, issues) {
     });
   }
 }
+function validateTechnologyGovernance(value, issues) {
+  const technologies = /* @__PURE__ */ new Set();
+  const projectTypes = /* @__PURE__ */ new Map();
+  if (value === void 0) return { technologies, projectTypes };
+  if (!isRecord(value)) {
+    issues.push({ type: "invalid-field", field: "technologyGovernance", message: "Portfolio technologyGovernance must be an object." });
+    return { technologies, projectTypes };
+  }
+  validateAllowedFields(value, "technologyGovernance", ["strategySource", "technologies", "projectTypes"], issues);
+  if (value.strategySource !== void 0 && (typeof value.strategySource !== "string" || value.strategySource.length === 0)) {
+    issues.push({ type: "invalid-field", field: "technologyGovernance.strategySource", message: "Technology strategySource must be a non-empty string." });
+  }
+  if (!Array.isArray(value.technologies)) {
+    issues.push({ type: "invalid-field", field: "technologyGovernance.technologies", message: "Technology definitions must be an array." });
+  } else {
+    for (const technology of value.technologies) {
+      if (!isRecord(technology)) {
+        issues.push({ type: "invalid-field", field: "technologyGovernance.technologies", message: "Technology definition must be an object." });
+        continue;
+      }
+      validateAllowedFields(technology, "technology", ["id", "label", "packages", "files"], issues);
+      if (typeof technology.id !== "string" || technology.id.length === 0 || technologies.has(technology.id)) {
+        issues.push({ type: "invalid-field", field: "technologyGovernance.technologies.id", message: `Technology id must be non-empty and unique: ${String(technology.id)}` });
+      } else technologies.add(technology.id);
+      if (typeof technology.label !== "string" || technology.label.length === 0) {
+        issues.push({ type: "invalid-field", field: "technologyGovernance.technologies.label", message: "Technology label must be a non-empty string." });
+      }
+      validateOptionalStringArray(technology.packages, technology.id, "technology.packages", issues);
+      validateOptionalStringArray(technology.files, technology.id, "technology.files", issues);
+      if (Array.isArray(technology.files)) {
+        for (const file of technology.files) {
+          if (typeof file === "string" && !isRepositoryRelativePath(file)) {
+            issues.push({
+              type: "invalid-field",
+              id: typeof technology.id === "string" ? technology.id : void 0,
+              field: "technology.files",
+              message: `Technology file signal must stay inside the repository: ${file}`
+            });
+          }
+        }
+      }
+    }
+  }
+  if (!Array.isArray(value.projectTypes)) {
+    issues.push({ type: "invalid-field", field: "technologyGovernance.projectTypes", message: "Project type definitions must be an array." });
+  } else {
+    for (const projectType of value.projectTypes) {
+      if (!isRecord(projectType)) {
+        issues.push({ type: "invalid-field", field: "technologyGovernance.projectTypes", message: "Project type definition must be an object." });
+        continue;
+      }
+      validateAllowedFields(projectType, "projectType", ["id", "title", "summary", "baseline", "optionalCapabilities"], issues);
+      const id = typeof projectType.id === "string" ? projectType.id : "";
+      if (!id || projectTypes.has(id)) {
+        issues.push({ type: "invalid-field", field: "technologyGovernance.projectTypes.id", message: `Project type id must be non-empty and unique: ${String(projectType.id)}` });
+      }
+      if (typeof projectType.title !== "string" || typeof projectType.summary !== "string") {
+        issues.push({ type: "invalid-field", field: "technologyGovernance.projectTypes", message: `Project type ${id || "(unknown)"} requires title and summary.` });
+      }
+      validateOptionalStringArray(projectType.baseline, id, "projectType.baseline", issues);
+      validateOptionalStringArray(projectType.optionalCapabilities, id, "projectType.optionalCapabilities", issues);
+      if (id && typeof projectType.title === "string" && typeof projectType.summary === "string" && Array.isArray(projectType.baseline) && Array.isArray(projectType.optionalCapabilities)) {
+        projectTypes.set(id, projectType);
+      }
+    }
+  }
+  for (const projectType of projectTypes.values()) {
+    for (const technology of [...projectType.baseline, ...projectType.optionalCapabilities]) {
+      if (!technologies.has(technology)) issues.push({ type: "invalid-field", field: "technologyGovernance.projectTypes", message: `Project type ${projectType.id} references unknown technology: ${technology}` });
+    }
+  }
+  return { technologies, projectTypes };
+}
+function isRepositoryRelativePath(value) {
+  if (value.length === 0 || isAbsolute3(value)) return false;
+  const segments = value.replaceAll("\\", "/").split("/");
+  return !segments.includes("..");
+}
+function validateRepositoryGovernance(value, field, catalog, issues) {
+  const id = typeof value.id === "string" ? value.id : void 0;
+  if (value.projectType !== void 0 && (typeof value.projectType !== "string" || !catalog.projectTypes.has(value.projectType))) {
+    issues.push({ type: "invalid-field", id, field: `${field}.projectType`, message: `Repository projectType is not defined: ${String(value.projectType)}` });
+  }
+  validateOptionalStringArray(value.capabilities, id, "capabilities", issues);
+  if (Array.isArray(value.capabilities) && typeof value.projectType === "string") {
+    const allowed = new Set(catalog.projectTypes.get(value.projectType)?.optionalCapabilities ?? []);
+    for (const capability of value.capabilities) {
+      if (typeof capability === "string" && !allowed.has(capability)) issues.push({ type: "invalid-field", id, field: `${field}.capabilities`, message: `Capability ${capability} is not optional for project type ${value.projectType}.` });
+    }
+  }
+  if (value.boundary !== void 0) {
+    if (!isRecord(value.boundary)) issues.push({ type: "invalid-field", id, field: `${field}.boundary`, message: "Repository boundary must be an object." });
+    else {
+      validateAllowedFields(value.boundary, "boundary", ["owns", "doesNotOwn"], issues);
+      validateOptionalStringArray(value.boundary.owns, id, "boundary.owns", issues);
+      validateOptionalStringArray(value.boundary.doesNotOwn, id, "boundary.doesNotOwn", issues);
+    }
+  }
+  if (value.technologyExceptions !== void 0) {
+    if (!Array.isArray(value.technologyExceptions)) issues.push({ type: "invalid-field", id, field: `${field}.technologyExceptions`, message: "Technology exceptions must be an array." });
+    else for (const exception of value.technologyExceptions) {
+      if (!isRecord(exception)) {
+        issues.push({ type: "invalid-field", id, field: `${field}.technologyExceptions`, message: "Technology exception must be an object." });
+        continue;
+      }
+      validateAllowedFields(exception, "technologyException", ["technology", "classification", "reason"], issues);
+      if (typeof exception.technology !== "string" || !catalog.technologies.has(exception.technology)) issues.push({ type: "invalid-field", id, field: `${field}.technologyExceptions.technology`, message: `Technology exception references unknown technology: ${String(exception.technology)}` });
+      if (!["acceptable-exception", "observe", "scheduled-migration", "urgent-drift", "bad-standard"].includes(String(exception.classification))) issues.push({ type: "invalid-field", id, field: `${field}.technologyExceptions.classification`, message: `Unsupported technology exception classification: ${String(exception.classification)}` });
+      if (typeof exception.reason !== "string" || exception.reason.length === 0) issues.push({ type: "invalid-field", id, field: `${field}.technologyExceptions.reason`, message: "Technology exception reason must be non-empty." });
+    }
+  }
+}
 function validateHostTooling(value, issues) {
   if (value === void 0) return;
   if (!Array.isArray(value)) {
@@ -3390,7 +3530,7 @@ import {
   statSync as statSync4,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname12, join as join20, relative as relative8, resolve as resolve4 } from "node:path";
+import { dirname as dirname12, join as join20, relative as relative8, resolve as resolve4, sep } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function inspectPortfolioAiHealth(options) {
   const endpoints = collectEndpoints(options.manifest);
@@ -3399,7 +3539,7 @@ function inspectPortfolioAiHealth(options) {
   const executionEngineRoot = options.manifest.executionEngine?.path;
   const skillRegistry = inspectSkillRegistry(executionEngineRoot);
   const expectedPackageVersion = packageVersion(join20(executionEngineRoot ?? "", "packages/pro-gov/package.json"));
-  const repositories = endpoints.map(({ endpoint, role }) => inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion));
+  const repositories = endpoints.map(({ endpoint, role }) => inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion, options.manifest.technologyGovernance));
   const summary = { healthy: 0, attention: 0, unhealthy: 0 };
   for (const repository of repositories) summary[repository.status] += 1;
   return {
@@ -3410,6 +3550,11 @@ function inspectPortfolioAiHealth(options) {
     secretsRoot: inspectSecretsRoot(secretsRoot),
     userMcp: inspectUserMcp(homeDir),
     skillRegistry,
+    technologyGovernance: {
+      strategySource: options.manifest.technologyGovernance?.strategySource,
+      projectTypes: options.manifest.technologyGovernance?.projectTypes.length ?? 0,
+      technologies: options.manifest.technologyGovernance?.technologies.length ?? 0
+    },
     summary,
     repositories
   };
@@ -3443,19 +3588,20 @@ function collectEndpoints(manifest) {
     return true;
   });
 }
-function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion) {
+function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion, technologyGovernance) {
   const root = endpoint.path;
   const git = inspectGit2(root);
   const entries = inspectEntries(root);
   const skills = inspectSkills(root);
   const hooks = inspectHooks(root);
-  const docs = inspectDocs(root, expectedPackageVersion);
+  const docs = inspectDocs(root, role === "execution-engine" ? void 0 : expectedPackageVersion);
   const mcp = {
     root: jsonObjectKeys(join20(root, ".mcp.json"), "mcpServers"),
     claudeCode: jsonObjectKeys(join20(root, ".claude/settings.json"), "mcpServers"),
     codex: tomlMcpNames(join20(root, ".codex/config.toml"))
   };
   const secrets = inspectRepositorySecrets(root, endpoint.id, secretsRoot, git.isRepository);
+  const projectModel = inspectProjectModel(root, endpoint, technologyGovernance);
   const recommendations = [];
   if (!git.isRepository) recommendations.push("\u8BE5\u8DEF\u5F84\u4E0D\u662F Git \u4ED3\u5E93\uFF1B\u786E\u8BA4\u6E05\u5355\u8DEF\u5F84\u662F\u5426\u6B63\u786E\u3002");
   if (git.unmergedBranches.length > 0) recommendations.push(`\u6709 ${git.unmergedBranches.length} \u6761\u5206\u652F\u5C1A\u672A\u5408\u5165\u5F53\u524D HEAD\uFF1A${git.unmergedBranches.join(", ")}\u3002`);
@@ -3475,17 +3621,24 @@ function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion)
   if (skills.claudeCompatibility === "duplicate-directory") recommendations.push("`.claude/skills` \u662F\u72EC\u7ACB\u526F\u672C\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 `.agents/skills`\uFF0C\u907F\u514D\u53CC\u4EFD\u6280\u80FD\u6F02\u79FB\u3002");
   if (skills.claudeCompatibility === "dangling-symlink") recommendations.push("`.claude/skills` \u662F\u65AD\u5F00\u7684\u94FE\u63A5\u3002");
   if (hasWorkflowReminderHooks(hooks)) recommendations.push("\u53D1\u73B0 Stop/SubagentStop hook\uFF1B\u786E\u8BA4\u5B83\u662F\u5426\u4ECD\u6709\u9879\u76EE\u4E13\u5C5E\u7528\u9014\uFF0C\u5E76\u79FB\u9664\u9000\u4F11\u7684 PGS \u5DE5\u4F5C\u6D41\u63D0\u9192\u3002");
-  const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template);
+  const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
   if (liveEnv.some((file) => file.tracked)) recommendations.push("\u53D1\u73B0\u88AB Git \u8DDF\u8E2A\u7684\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\uFF1B\u5E94\u7ACB\u5373\u786E\u8BA4\u5176\u4E2D\u662F\u5426\u5305\u542B\u51ED\u636E\u5E76\u8FC1\u51FA\u4ED3\u5E93\u3002");
-  else if (liveEnv.length > 0 && secrets.centralDirectory === "absent") recommendations.push("\u4ED3\u5E93\u6709\u672C\u5730\u73AF\u5883\u6587\u4EF6\uFF0C\u4F46\u4E2D\u592E `.secrets` \u4E2D\u6CA1\u6709\u5BF9\u5E94\u76EE\u5F55\uFF1B\u786E\u8BA4\u662F\u5426\u9700\u8981\u7EB3\u5165\u5206\u5C42\u7BA1\u7406\u3002");
+  if (liveEnv.length > 0 && secrets.centralDirectory === "absent") recommendations.push("\u4ED3\u5E93\u6709\u672C\u5730\u73AF\u5883\u6587\u4EF6\uFF0C\u4F46\u4E2D\u592E `.secrets` \u4E2D\u6CA1\u6709\u5BF9\u5E94\u76EE\u5F55\uFF1B\u786E\u8BA4\u662F\u5426\u9700\u8981\u7EB3\u5165\u5206\u5C42\u7BA1\u7406\u3002");
+  else if (liveEnv.some((file) => !file.centralized)) recommendations.push("\u53D1\u73B0\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\u5C1A\u672A\u8FDE\u63A5\u5230\u672C\u9879\u76EE\u7684\u4E2D\u592E `.secrets` \u76EE\u5F55\uFF1B\u533A\u5206\u53EF\u4E22\u5F03\u751F\u6210\u7269\u4E0E\u672C\u5730\u4E3B\u6765\u6E90\uFF0C\u9700\u4FDD\u7559\u7684\u6765\u6E90\u5E94\u96C6\u4E2D\u540E\u518D\u63A5\u56DE\u9879\u76EE\u3002");
+  if (hasUnsafeCentralSecretPermissions(secrets)) recommendations.push("\u4E2D\u592E\u5BC6\u94A5\u76EE\u5F55\u6216\u6587\u4EF6\u6743\u9650\u8FC7\u5BBD\uFF1B\u76EE\u5F55\u5E94\u4E3A 0700\uFF0C\u914D\u7F6E\u6587\u4EF6\u5E94\u4E3A 0600\u3002");
   if (!docs.packages.aligned) recommendations.push(`PGS \u5305\u7248\u672C\u672A\u4E0E\u6267\u884C\u5F15\u64CE ${docs.packages.expected ?? "\u672A\u77E5\u7248\u672C"} \u5BF9\u9F50\uFF1B\u53D1\u5E03\u4E0A\u6E38\u540E\u518D\u540C\u6B65\u76EE\u6807\u4ED3\u5E93\u3002`);
   if (role === "target" && !docs.manifest) recommendations.push("\u7F3A\u5C11 docs/governance/MANIFEST.yml\uFF1B\u6587\u6863\u6E05\u5355\u65E0\u6CD5\u8BC1\u660E\u5DF2\u540C\u6B65\u3002");
+  if (technologyGovernance && !projectModel.projectType) recommendations.push("\u672A\u58F0\u660E\u9879\u76EE\u7C7B\u578B\uFF1B\u65E0\u6CD5\u628A\u5B9E\u9645\u6280\u672F\u4E0E\u4EA7\u54C1\u7EBF\u57FA\u7EBF\u8FDB\u884C\u6BD4\u8F83\u3002");
+  const missingBaseline = projectModel.baseline.filter((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
+  if (missingBaseline.length > 0) recommendations.push(`\u6280\u672F\u57FA\u7EBF\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingBaseline.map((technology) => technology.label).join("\u3001")}\u3002`);
+  const missingSelected = projectModel.optionalCapabilities.filter((technology) => technology.selected && !technology.detected);
+  if (missingSelected.length > 0) recommendations.push(`\u5DF2\u9009\u80FD\u529B\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingSelected.map((technology) => technology.label).join("\u3001")}\u3002`);
   return {
     id: endpoint.id,
     role,
     path: root,
     profile: "profile" in endpoint ? endpoint.profile : void 0,
-    status: deriveStatus(entries, git, hooks, skills, secrets),
+    status: deriveStatus(entries, git, hooks, skills, secrets, projectModel, Boolean(technologyGovernance)),
     recommendations,
     git,
     entries,
@@ -3493,14 +3646,62 @@ function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion)
     mcp,
     skills,
     secrets,
-    docs
+    docs,
+    projectModel
   };
 }
-function deriveStatus(entries, git, hooks, skills, secrets) {
-  if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || skills.canonical.some((item) => item.kind === "dangling-symlink") || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template)) return "unhealthy";
-  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0) return "attention";
+function deriveStatus(entries, git, hooks, skills, secrets, projectModel, technologyGovernanceConfigured) {
+  if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || skills.canonical.some((item) => item.kind === "dangling-symlink") || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets)) return "unhealthy";
+  const missingBaseline = projectModel.baseline.some((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
+  const missingSelected = projectModel.optionalCapabilities.some((technology) => technology.selected && !technology.detected);
+  const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
+  const secretMaterializationNeedsReview = liveEnv.some((file) => !file.centralized);
+  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected) return "attention";
   return "healthy";
 }
+function inspectProjectModel(root, endpoint, governance) {
+  const projectType = governance?.projectTypes.find((candidate) => candidate.id === endpoint.projectType);
+  const packages = collectPackageNames(root);
+  const technologyById = new Map((governance?.technologies ?? []).map((technology) => [technology.id, technology]));
+  const detection = (id) => {
+    const technology = technologyById.get(id);
+    const packageMatch = technology?.packages?.some((name) => packages.has(name)) ?? false;
+    const fileMatch = technology?.files?.some((path) => existsSync21(join20(root, path))) ?? false;
+    return { id, label: technology?.label ?? id, detected: packageMatch || fileMatch };
+  };
+  const selected = new Set(endpoint.capabilities ?? []);
+  return {
+    projectType: projectType ? { id: projectType.id, title: projectType.title, summary: projectType.summary } : void 0,
+    boundary: endpoint.boundary,
+    baseline: (projectType?.baseline ?? []).map(detection),
+    optionalCapabilities: (projectType?.optionalCapabilities ?? []).map((id) => ({ ...detection(id), selected: selected.has(id) })),
+    exceptions: endpoint.technologyExceptions ?? []
+  };
+}
+function hasBaselineException(projectModel, technologyId) {
+  return projectModel.exceptions.some(
+    (exception) => exception.technology === technologyId && exception.classification !== "urgent-drift"
+  );
+}
+function collectPackageNames(root) {
+  const names = /* @__PURE__ */ new Set();
+  let files = [];
+  try {
+    files = splitLines(execFileSync("git", ["ls-files", "*package.json"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }));
+  } catch {
+    if (existsSync21(join20(root, "package.json"))) files = ["package.json"];
+  }
+  for (const file of files) {
+    const packageJson = readJson3(join20(root, file));
+    if (!isRecord3(packageJson)) continue;
+    for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+      const dependencies = packageJson[section];
+      if (!isRecord3(dependencies)) continue;
+      for (const name of Object.keys(dependencies)) names.add(name);
+    }
+  }
+  return names;
+}
 function hasWorkflowReminderHooks(hooks) {
   return hooks.some((hook) => hook.events.some((event) => event.name === "Stop" || event.name === "SubagentStop"));
 }
@@ -3617,11 +3818,14 @@ function inspectClaudeSkillRoot(root) {
 }
 function inspectRepositorySecrets(root, id, secretsRoot, isRepository) {
   const centralPath = join20(secretsRoot, id);
+  const centralRealPath = safeRealpath(centralPath);
   const envFiles = collectEnvironmentFiles(root).map((path) => ({
     path,
     tracked: isRepository ? gitTracks(root, path) : false,
-    template: /(?:example|sample|template|defaults?)$/i.test(basenameOnly(path)),
-    symlink: lstatSync6(join20(root, path)).isSymbolicLink()
+    template: isEnvironmentTemplate(path),
+    fixture: isEnvironmentFixture(path),
+    symlink: lstatSync6(join20(root, path)).isSymbolicLink(),
+    centralized: pointsInside(join20(root, path), centralRealPath)
   }));
   return {
     centralDirectory: existsSync21(centralPath) ? "present" : "absent",
@@ -3630,7 +3834,7 @@ function inspectRepositorySecrets(root, id, secretsRoot, isRepository) {
     repositoryEnvFiles: envFiles
   };
 }
-var SKIP_ENV_DIRECTORIES = /* @__PURE__ */ new Set([".git", ".next", ".nuxt", ".output", ".turbo", ".worktrees", "build", "coverage", "dist", "node_modules", "out", "target"]);
+var SKIP_ENV_DIRECTORIES = /* @__PURE__ */ new Set([".git", ".next", ".nuxt", ".output", ".turbo", ".vercel", ".worktrees", "build", "coverage", "dist", "node_modules", "out", "target"]);
 function collectEnvironmentFiles(root, current = root, depth = 0) {
   if (depth > 5) return [];
   const found = [];
@@ -3638,7 +3842,7 @@ function collectEnvironmentFiles(root, current = root, depth = 0) {
     for (const entry of readdirSync8(current, { withFileTypes: true })) {
       if (entry.isDirectory()) {
         if (!SKIP_ENV_DIRECTORIES.has(entry.name)) found.push(...collectEnvironmentFiles(root, join20(current, entry.name), depth + 1));
-      } else if (entry.name === ".env" || entry.name.startsWith(".env.")) {
+      } else if (isEnvironmentFilename(entry.name) && !isProviderGeneratedEnvironmentFile(entry.name)) {
         found.push(relative8(root, join20(current, entry.name)));
       }
     }
@@ -3665,6 +3869,35 @@ function basenameOnly(path) {
   const parts = path.split(/[\\/]/);
   return parts[parts.length - 1] ?? path;
 }
+function isEnvironmentFilename(name) {
+  return name === ".env" || name.startsWith(".env.") || name.endsWith(".env");
+}
+function isProviderGeneratedEnvironmentFile(name) {
+  return name.endsWith(".pulled");
+}
+function isEnvironmentTemplate(path) {
+  return /(^|[._-])(example|sample|template|defaults?)([._-]|$)/i.test(basenameOnly(path));
+}
+function isEnvironmentFixture(path) {
+  return /(^|[\\/])(?:tests?|__tests__)[\\/]fixtures?[\\/]/i.test(path) || /(^|[\\/])__fixtures__[\\/]/i.test(path);
+}
+function safeRealpath(path) {
+  try {
+    return realpathSync2(path);
+  } catch {
+    return void 0;
+  }
+}
+function pointsInside(path, expectedRoot) {
+  if (!expectedRoot || !lstatSync6(path).isSymbolicLink()) return false;
+  const target = safeRealpath(path);
+  if (!target) return false;
+  const fromRoot = relative8(expectedRoot, target);
+  return fromRoot === "" || fromRoot !== ".." && !fromRoot.startsWith(`..${sep}`);
+}
+function hasUnsafeCentralSecretPermissions(secrets) {
+  return secrets.centralDirectory === "present" && (secrets.centralMode !== "700" || secrets.centralFiles.some((file) => file.mode !== "600"));
+}
 function inspectSecretsRoot(path) {
   return existsSync21(path) ? { path, exists: true, mode: modeString(statSync4(path).mode) } : { path, exists: false };
 }
@@ -4293,7 +4526,7 @@ function normalizeMarkdownTableCell(cell) {
 }
 function inferInstalledProfile(root) {
   const installed = ["engineering-runtime", "doc-only"].filter(
-    (profile) => existsSync23(join22(root, `docs/governance/agents-routing/${profile}-v0.9.md`))
+    (profile) => existsSync23(join22(root, `docs/governance/agents-routing/${profile}-v1.0.md`))
   );
   return installed.length === 1 ? installed[0] : void 0;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pieai/pro-gov",
-  "version": "0.4.8",
+  "version": "0.5.0",
   "description": "Project-level distribution kit for Project Governance System.",
   "keywords": [
     "ai-agents",
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pieai/doc-gov": "^0.4.8"
+    "@pieai/doc-gov": "^0.5.0"
   },
   "devDependencies": {
     "@pieai/swimmer-ui-kit": "1.0.1",

package/assets/starter/docs/decisions/.gitkeep

@@ -1 +0,0 @@
-