@pieai/pro-gov 0.4.9 → 0.5.0

package/assets/profiles/doc-only/manifest.yml

@@ -6,7 +6,7 @@ required:
   ai_in_the_loop:
     target: docs/policy/shared-rules/ai-in-the-loop.md
     source: external shared-rule SSOT
-  agents_routing: docs/governance/agents-routing/doc-only-v0.9.md
+  agents_routing: docs/governance/agents-routing/doc-only-v1.0.md
   current_work: docs/reference/execution/current-work.md
 project_local_required:
   - docs/policy/best-practice-for-this-project.md

package/assets/profiles/doc-only/profile.md

@@ -6,9 +6,9 @@ Use for non-runtime projects: IP development, AI media production, research vaul
 
 - `packages/doc-gov`
 - `packages/pro-gov`
-- `docs/governance/ssot-v0.9.md`
+- `docs/governance/ssot-v1.0.md`
 - external AI-in-the-Loop policy linked by target projects under `docs/policy/shared-rules/ai-in-the-loop.md`
-- `docs/governance/agents-routing/doc-only-v0.9.md`
+- `docs/governance/agents-routing/doc-only-v1.0.md`
 - starter `docs/governance/` and `docs/policy/` templates
 
 ## Does Not Include By Default

package/assets/profiles/engineering-runtime/manifest.yml

@@ -6,7 +6,7 @@ required:
   ai_in_the_loop:
     target: docs/policy/shared-rules/ai-in-the-loop.md
     source: external shared-rule SSOT
-  agents_routing: docs/governance/agents-routing/engineering-runtime-v0.9.md
+  agents_routing: docs/governance/agents-routing/engineering-runtime-v1.0.md
   current_work: docs/reference/execution/current-work.md
 optional:
   mattpocock_skills: integrations/mattpocock-skills.md

package/assets/profiles/engineering-runtime/profile.md

@@ -6,9 +6,9 @@ Use for code-heavy projects: apps, games, runtimes, services, browser products,
 
 - `packages/doc-gov`
 - `packages/pro-gov`
-- `docs/governance/ssot-v0.9.md`
+- `docs/governance/ssot-v1.0.md`
 - external AI-in-the-Loop policy linked by target projects under `docs/policy/shared-rules/ai-in-the-loop.md`
-- `docs/governance/agents-routing/engineering-runtime-v0.9.md`
+- `docs/governance/agents-routing/engineering-runtime-v1.0.md`
 - `integrations/mattpocock-skills.md`
 - starter `docs/governance/` and `docs/policy/` templates
 
@@ -41,6 +41,6 @@ guardrails are also consumer-owned when installed; `doc-gov doctor` checks that
 their required governance commands remain present.
 
 For non-trivial engineering work, run `pro-gov learn recall --query "<task
-summary>"` before changing files so existing `docs/solutions/**` and
+summary>"` before changing files so existing `docs/reference/learnings/**` and
 `CONCEPTS.md` lessons can shape the work. After verified work, use the
 `capture-learning` skill only when a reusable lesson exists.

package/assets/starter/AGENTS.template.md

@@ -2,7 +2,7 @@
 
 ## PGS Router Block
 
-<!-- PGS-ROUTER:BEGIN v0.9 -->
+<!-- PGS-ROUTER:BEGIN v1.0 -->
 
 ## Boundary
 
@@ -19,7 +19,7 @@
 ## Documentation Tasks
 
 When the task creates, edits, moves, deletes, or governs documentation, read
-`docs/governance/boundary.md`, `docs/governance/ssot-v0.9.md`,
+`docs/governance/boundary.md`, `docs/governance/ssot-v1.0.md`,
 `docs/governance/doc-agent-rules.md`, `docs/governance/doc-types.md`, the
 selected agents routing file, and all Markdown under `docs/policy/**/*.md`.
 That policy set includes subdirectories and symlinked shared-rule files; keep

package/assets/starter/docs/governance/agents-routing/{doc-only-v0.9.md → doc-only-v1.0.md}

@@ -1,6 +1,6 @@
 ---
-id: GOV-AGENTS-ROUTING-DOC-ONLY-V0-9
-title: Doc-Only Agents Routing v0.9
+id: GOV-AGENTS-ROUTING-DOC-ONLY-V1-0
+title: Doc-Only Agents Routing v1.0
 type: policy
 status: stable
 canonical: true
@@ -14,13 +14,13 @@ tags:
   - workflow
 pinned: true
 related:
-  - GOV-SSOT-V0-9
+  - GOV-SSOT-V1-0
   - REF-DOC-GOVERNANCE-BOUNDARY
 supersedes: []
 superseded_by: null
 ---
 
-# Doc-Only Agents Routing v0.9
+# Doc-Only Agents Routing v1.0
 
 Shared routing algorithm for non-runtime projects such as AI media, IP development, research, and asset governance workspaces.
 

package/assets/starter/docs/governance/agents-routing/{engineering-runtime-v0.9.md → engineering-runtime-v1.0.md}

@@ -1,6 +1,6 @@
 ---
-id: GOV-AGENTS-ROUTING-ENGINEERING-RUNTIME-V0-9
-title: Engineering Runtime Agents Routing v0.9
+id: GOV-AGENTS-ROUTING-ENGINEERING-RUNTIME-V1-0
+title: Engineering Runtime Agents Routing v1.0
 type: policy
 status: stable
 canonical: true
@@ -14,13 +14,13 @@ tags:
   - workflow
 pinned: true
 related:
-  - GOV-SSOT-V0-9
+  - GOV-SSOT-V1-0
   - REF-DOC-GOVERNANCE-BOUNDARY
 supersedes: []
 superseded_by: null
 ---
 
-# Engineering Runtime Agents Routing v0.9
+# Engineering Runtime Agents Routing v1.0
 
 Shared routing algorithm for app, game, runtime, and code-heavy projects.
 

package/assets/starter/docs/governance/boundary.md

@@ -53,13 +53,14 @@ project-specific AI development habits live.
 | --- | --- |
 | AI startup entry | `AGENTS.md` |
 | Agent routing algorithm | `docs/governance/agents-routing/` |
-| Governed SSOT rules | `docs/governance/ssot-v0.9.md` |
+| Governed SSOT rules | `docs/governance/ssot-v1.0.md` |
 | Project AI development practices | `docs/policy/best-practice-for-this-project.md` |
 | Current work index | `docs/reference/execution/current-work.md` |
 | Product or world truth | `docs/canon/` |
+| Durable decisions | `docs/adr/`, the single Matt-compatible decision surface |
 | Active implementation work | `docs/plans/active/` |
 | Completed proof records | `docs/plans/completed/` |
-| Reusable project learnings | `docs/solutions/**` as learning artifacts |
+| Reusable project learnings | `docs/reference/learnings/**` as governed reference documents |
 | Product artifacts outside governed docs | Project package, workbench, assets, runtime config, or source tree |
 
 When unsure, ask this question: is this rule about how the document system works,
@@ -76,5 +77,6 @@ product packages, workbenches, prompt libraries, source folders, or asset
 folders can be product artifacts. Keep those files where the product package
 expects them unless a project explicitly opts them into doc-gov.
 
-Learning artifacts under `docs/solutions/**` are not governed docs by default.
-They remain searchable project artifacts with their own lightweight metadata.
+Matt-native files under `docs/adr/**` and `docs/agents/**` are not governed docs
+by default. `docs/adr/**` is nevertheless the only durable decision surface;
+do not copy ADRs into a second PGS decision directory.

package/assets/starter/docs/governance/doc-agent-rules.md

@@ -42,7 +42,6 @@ If a canonical document exists, update it instead of creating a parallel documen
 Use only:
 
 - `policy`
-- `decision`
 - `spec`
 - `plan`
 - `canon`
@@ -57,14 +56,11 @@ Normal documents:
 draft -> active -> completed -> stable -> superseded -> archived
 ```
 
-Decision documents:
-
-```text
-proposed -> accepted -> rejected | superseded
-```
-
 `completed` is for finished execution records or specs that should no longer appear in active folders.
 
+Durable decisions belong only in `docs/adr/**`. They use Matt's concise ADR
+format and remain outside the Doc Gov status machine.
+
 ## Upstream Rule
 
 Do not locally invent doc-gov core changes. Propose core changes upstream in

package/assets/starter/docs/governance/doc-types.md

@@ -28,7 +28,6 @@ Allowed types:
 | Type | Default path |
 | --- | --- |
 | `policy` | `docs/policy/` for project policy; `docs/governance/` for doc-system policy |
-| `decision` | `docs/decisions/` |
 | `spec` | `docs/specs/active/` or `docs/specs/completed/` |
 | `plan` | `docs/plans/active/` or `docs/plans/completed/` |
 | `canon` | `docs/canon/` |
@@ -43,8 +42,5 @@ Normal documents use:
 draft -> active -> completed -> stable -> superseded -> archived
 ```
 
-Decision documents use:
-
-```text
-proposed -> accepted -> rejected | superseded
-```
+Durable decisions use the Matt-compatible `docs/adr/**` surface and stay
+outside the Doc Gov schema. Do not duplicate them in another decision folder.

package/assets/starter/docs/governance/{ssot-v0.9.md → ssot-v1.0.md}

@@ -1,6 +1,6 @@
 ---
-id: GOV-SSOT-V0-9
-title: SSOT Documentation Governance Rules v0.9
+id: GOV-SSOT-V1-0
+title: SSOT Documentation Governance Rules v1.0
 type: policy
 status: stable
 canonical: true
@@ -19,7 +19,7 @@ supersedes: []
 superseded_by: null
 ---
 
-# SSOT Documentation Governance Rules v0.9
+# SSOT Documentation Governance Rules v1.0
 
 This rule defines how projects using Project Governance System handle
 **SSOT (Single Source of Truth)** for governed documentation.
@@ -37,7 +37,7 @@ Project Governance System governs:
 - `AGENTS.md` and equivalent AI entry files.
 - Governed Markdown under `docs/**`.
 - Documentation governance rules, agent routing rules, templates, manifests,
-  plans, specs, decisions, references, canon, and archives that live under
+  plans, specs, references, canon, and archives that live under
   `docs/**`.
 
 Project Governance System does **not** automatically govern every Markdown file
@@ -50,10 +50,12 @@ Markdown.
 
 Extra governed roots are allowed only when a project explicitly opts in.
 
-Learning and optional-tool artifacts are explicitly outside the default Doc Gov
-schema:
+Matt-native and optional-tool artifacts are explicitly outside the default Doc
+Gov schema:
 
-- `docs/solutions/**`
+- `CONTEXT.md` and `CONTEXT-MAP.md`
+- `docs/adr/**`
+- `docs/agents/**`
 - `docs/brainstorms/**`
 - `docs/pulse-reports/**`
 
@@ -83,7 +85,7 @@ Before changing docs, look for project-local guidance in this order:
 
 1. `AGENTS.md`, `CLAUDE.md`, or equivalent AI router/config adapter.
 2. `docs/governance/boundary.md`.
-3. `docs/governance/ssot-v0.9.md`.
+3. `docs/governance/ssot-v1.0.md`.
 4. `docs/governance/agents-routing/` and the project's selected agents-routing file.
 5. `docs/reference/documentation-map.md`, root `README.md` for human-facing
    orientation, or another project-defined documentation index.
@@ -114,9 +116,10 @@ works for governed docs:
 | Agents-routing rules | `docs/governance/agents-routing/` |
 | Doc-system rules, templates, and manifest | `docs/governance/` |
 | Project AI/development policy | `docs/policy/` |
+| Durable decisions | `docs/adr/`, the single Matt-compatible decision surface outside Doc Gov schema |
 | Product or feature requirement | `docs/specs/` |
 | Step-by-step implementation work | `docs/plans/` |
-| Reusable learning records | `docs/solutions/**`, outside Doc Gov schema |
+| Reusable learning records | `docs/reference/learnings/**`, governed as `reference` documents and recalled on demand |
 | Durable workspace/system truth | `docs/canon/` |
 | How-to guides, architecture maps, tool notes | `docs/reference/` |
 | Retired governed history | `docs/archive/` |

package/assets/starter/docs/governance/templates/adr.md

@@ -1,23 +1,3 @@
----
-id: REPLACE-ME
-title: Replace Me
-type: decision
-status: proposed
-canonical: true
-owner: human
-created: YYYY-MM-DD
-last_reviewed: YYYY-MM-DD
-domain: meta
-tags:
-  - replace-me
-pinned: false
-related: []
----
+# Replace Me
 
-# REPLACE-ME: Replace Me
-
-## Context
-
-## Decision
-
-## Consequences
+Record the context, decision, and why in one to three sentences.

package/assets/starter/docs/reference/documentation-map.md

@@ -24,10 +24,10 @@ Use `AGENTS.md` for startup reading. It should point agents to:
 
 - `docs/policy/*.md`
 - `docs/governance/boundary.md`
-- `docs/governance/ssot-v0.9.md`
+- `docs/governance/ssot-v1.0.md`
 - `docs/governance/doc-agent-rules.md`
 - `docs/governance/doc-types.md`
-- `docs/governance/agents-routing/<selected-profile>-v0.9.md`
+- `docs/governance/agents-routing/<selected-profile>-v1.0.md`
 - `docs/reference/execution/current-work.md`
 
 ## Areas
@@ -35,12 +35,12 @@ Use `AGENTS.md` for startup reading. It should point agents to:
 | Area | Purpose |
 | --- | --- |
 | `docs/policy/` | Project policy and AI development rules |
-| `docs/decisions/` | Durable decisions |
+| `docs/adr/` | The single Matt-compatible durable decision surface, outside Doc Gov schema |
 | `docs/specs/active/` | Active requirements |
 | `docs/specs/completed/` | Completed specs |
 | `docs/plans/active/` | Active implementation plans |
 | `docs/plans/completed/` | Completed execution records |
-| `docs/solutions/` | Reusable learning records, outside Doc Gov schema |
+| `docs/reference/learnings/` | Governed reusable learning references, recalled only when relevant |
 | `docs/canon/` | Durable project truth |
 | `docs/reference/` | Guides and references |
 | `docs/archive/` | Retired history |
@@ -51,6 +51,6 @@ project-package canon, generated media notes, and source-package files stay in
 their product/workbench structure unless this project explicitly opts them into
 doc-gov.
 
-Optional skills may create `docs/solutions/**`, `docs/brainstorms/**`, or
-`docs/pulse-reports/**`. Those are external artifacts, not Doc Gov canonical
-documents.
+Optional skills may create `docs/brainstorms/**` or `docs/pulse-reports/**` as
+external artifacts. Capture Learning writes governed references under
+`docs/reference/learnings/**`.

package/cli-guide.md

@@ -48,7 +48,7 @@ commands without requiring byte-for-byte template equality. It infers the
 installed profile when exactly one route exists; `--profile` resolves an empty
 or temporarily ambiguous target. PGS does not install or modify AI-host hooks.
 
-`learn recall` searches `docs/solutions/**` and
+`learn recall` searches `docs/reference/learnings/**` and
 `CONCEPTS.md` in the target repository and returns the most relevant prior
 lessons for the current task. Use it before non-trivial implementation,
 debugging, release, architecture, or portfolio-sync work. It is read-only and
@@ -56,7 +56,7 @@ does not require a full local PGS checkout.
 
 `learn capture` is the small native capture path. Use it only after verified
 work produced a reusable lesson that is not already covered by an existing
-`docs/solutions/**` record:
+`docs/reference/learnings/**` record:
 
 ```bash
 pro-gov learn capture \

package/dist/cli.js

@@ -1654,9 +1654,9 @@ import { createRequire } from "node:module";
 import { dirname as dirname6, join as join12 } from "node:path";
 var REQUIRED_ASSETS = [
   "starter/AGENTS.template.md",
-  "starter/docs/governance/ssot-v0.9.md",
-  "starter/docs/governance/agents-routing/engineering-runtime-v0.9.md",
-  "starter/docs/governance/agents-routing/doc-only-v0.9.md",
+  "starter/docs/governance/ssot-v1.0.md",
+  "starter/docs/governance/agents-routing/engineering-runtime-v1.0.md",
+  "starter/docs/governance/agents-routing/doc-only-v1.0.md",
   "profiles/engineering-runtime/profile.md",
   "profiles/doc-only/profile.md"
 ];
@@ -1738,7 +1738,7 @@ function classifyOwnership(targetPath) {
   return "shared";
 }
 function isOtherProfileRouting(targetPath, profile) {
-  return targetPath.startsWith("docs/governance/agents-routing/") && targetPath !== `docs/governance/agents-routing/${profile}-v0.9.md`;
+  return targetPath.startsWith("docs/governance/agents-routing/") && targetPath !== `docs/governance/agents-routing/${profile}-v1.0.md`;
 }
 function starterTargetPath(sourcePath) {
   if (sourcePath === "starter/AGENTS.template.md") return "AGENTS.md";
@@ -1800,7 +1800,7 @@ function applyStarterFiles(files, profile) {
   return 0;
 }
 function renderAgentsTemplate(template, projectName, profile) {
-  const selectedRoute = `docs/governance/agents-routing/${profile}-v0.9.md`;
+  const selectedRoute = `docs/governance/agents-routing/${profile}-v1.0.md`;
   return template.replace("# PROJECT_NAME AI Router", `# ${projectName} AI Router`).replace("`PROFILE_NAME`", `\`${profile}\``).replace("`PROFILE_ROUTE`", `\`${selectedRoute}\``).replace(/\n{3,}/g, "\n\n");
 }
 function readFlag(args, flag) {
@@ -1834,18 +1834,22 @@ function recallLearnings(root, options) {
   return { query, hits };
 }
 function loadLearningRecords(root) {
-  const records = [];
-  const solutionsDir = join14(root, "docs/solutions");
-  if (existsSync14(solutionsDir)) {
-    for (const path of listMarkdownFiles(solutionsDir)) {
-      records.push(readLearningRecord(root, path));
+  const recordsByTitle = /* @__PURE__ */ new Map();
+  for (const relativeDir of ["docs/reference/learnings", "docs/solutions"]) {
+    const learningDir = join14(root, relativeDir);
+    if (!existsSync14(learningDir)) continue;
+    for (const path of listMarkdownFiles(learningDir)) {
+      const record = readLearningRecord(root, path);
+      const key = record.title.trim().toLowerCase();
+      if (!recordsByTitle.has(key)) recordsByTitle.set(key, record);
     }
   }
   const conceptsPath = join14(root, "CONCEPTS.md");
   if (existsSync14(conceptsPath)) {
-    records.push(readLearningRecord(root, conceptsPath));
+    const record = readLearningRecord(root, conceptsPath);
+    recordsByTitle.set(`concepts:${record.title.toLowerCase()}`, record);
   }
-  return records;
+  return [...recordsByTitle.values()];
 }
 function listMarkdownFiles(dir) {
   const files = [];
@@ -1944,7 +1948,7 @@ function cleanMarkdownLine(input) {
 
 // src/learning/capture.ts
 import { existsSync as existsSync15, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join15, relative as relative6 } from "node:path";
+import { basename as basename5, join as join15, relative as relative6 } from "node:path";
 function captureLearning(root, options) {
   const title = options.title.trim();
   const summary = options.summary.trim();
@@ -1952,10 +1956,11 @@ function captureLearning(root, options) {
   if (!summary) throw new Error("summary is required");
   const category = slugify(options.category ?? "workflow-issues") || "workflow-issues";
   const moduleName = options.module?.trim() || "PGS learning capture";
-  const dir = join15(root, "docs/solutions", category);
+  const dir = join15(root, "docs/reference/learnings", category);
   mkdirSync5(dir, { recursive: true });
   const path = uniquePath(dir, slugify(title) || "learning");
-  writeFileSync4(path, renderLearning({ title, summary, category, moduleName }));
+  const idSlug = basename5(path, ".md");
+  writeFileSync4(path, renderLearning({ title, summary, category, moduleName, idSlug }));
   return {
     relativePath: normalizePath2(relative6(root, path)),
     title,
@@ -1965,12 +1970,23 @@ function captureLearning(root, options) {
 function renderLearning(options) {
   return [
     "---",
+    `id: REF-LEARNING-${upperSlug(options.category)}-${upperSlug(options.idSlug)}`,
     `title: ${yamlString(options.title)}`,
-    `date: ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`,
+    "type: reference",
+    "status: stable",
+    "canonical: true",
+    "owner: ai-assisted",
+    `created: ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`,
+    `last_reviewed: ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`,
+    "domain: learning",
+    "tags:",
+    "  - learning-recall",
+    `  - ${options.category}`,
+    "pinned: false",
+    "related: []",
     `category: ${options.category}`,
     `module: ${yamlString(options.moduleName)}`,
     "capture_mode: pgs-native",
-    "tags: [learning-recall]",
     "---",
     "",
     `# ${options.title}`,
@@ -2004,6 +2020,9 @@ function yamlString(input) {
 function normalizePath2(path) {
   return path.split("\\").join("/");
 }
+function upperSlug(input) {
+  return slugify(input).toUpperCase() || "LEARNING";
+}
 
 // src/commands/learn.ts
 function runLearn(args) {
@@ -2173,7 +2192,7 @@ import { dirname as dirname9 } from "node:path";
 
 // src/lens/audit.ts
 import { existsSync as existsSync16, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
-import { basename as basename5, dirname as dirname8, join as join16 } from "node:path";
+import { basename as basename6, dirname as dirname8, join as join16 } from "node:path";
 var REQUIRED_ARTIFACTS = [
   "manifest.md",
   "raw/project-lens/architecture-lens.md",
@@ -2191,7 +2210,7 @@ function createProjectLensAuditPackage(targetDir, auditDir) {
     version: 1,
     target: {
       path: targetDir,
-      name: basename5(targetDir) || "target"
+      name: basename6(targetDir) || "target"
     },
     requiredArtifacts: [...REQUIRED_ARTIFACTS]
   };
@@ -3511,7 +3530,7 @@ import {
   statSync as statSync4,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname12, join as join20, relative as relative8, resolve as resolve4 } from "node:path";
+import { dirname as dirname12, join as join20, relative as relative8, resolve as resolve4, sep } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function inspectPortfolioAiHealth(options) {
   const endpoints = collectEndpoints(options.manifest);
@@ -3602,9 +3621,11 @@ function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion,
   if (skills.claudeCompatibility === "duplicate-directory") recommendations.push("`.claude/skills` \u662F\u72EC\u7ACB\u526F\u672C\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 `.agents/skills`\uFF0C\u907F\u514D\u53CC\u4EFD\u6280\u80FD\u6F02\u79FB\u3002");
   if (skills.claudeCompatibility === "dangling-symlink") recommendations.push("`.claude/skills` \u662F\u65AD\u5F00\u7684\u94FE\u63A5\u3002");
   if (hasWorkflowReminderHooks(hooks)) recommendations.push("\u53D1\u73B0 Stop/SubagentStop hook\uFF1B\u786E\u8BA4\u5B83\u662F\u5426\u4ECD\u6709\u9879\u76EE\u4E13\u5C5E\u7528\u9014\uFF0C\u5E76\u79FB\u9664\u9000\u4F11\u7684 PGS \u5DE5\u4F5C\u6D41\u63D0\u9192\u3002");
-  const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template);
+  const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
   if (liveEnv.some((file) => file.tracked)) recommendations.push("\u53D1\u73B0\u88AB Git \u8DDF\u8E2A\u7684\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\uFF1B\u5E94\u7ACB\u5373\u786E\u8BA4\u5176\u4E2D\u662F\u5426\u5305\u542B\u51ED\u636E\u5E76\u8FC1\u51FA\u4ED3\u5E93\u3002");
-  else if (liveEnv.length > 0 && secrets.centralDirectory === "absent") recommendations.push("\u4ED3\u5E93\u6709\u672C\u5730\u73AF\u5883\u6587\u4EF6\uFF0C\u4F46\u4E2D\u592E `.secrets` \u4E2D\u6CA1\u6709\u5BF9\u5E94\u76EE\u5F55\uFF1B\u786E\u8BA4\u662F\u5426\u9700\u8981\u7EB3\u5165\u5206\u5C42\u7BA1\u7406\u3002");
+  if (liveEnv.length > 0 && secrets.centralDirectory === "absent") recommendations.push("\u4ED3\u5E93\u6709\u672C\u5730\u73AF\u5883\u6587\u4EF6\uFF0C\u4F46\u4E2D\u592E `.secrets` \u4E2D\u6CA1\u6709\u5BF9\u5E94\u76EE\u5F55\uFF1B\u786E\u8BA4\u662F\u5426\u9700\u8981\u7EB3\u5165\u5206\u5C42\u7BA1\u7406\u3002");
+  else if (liveEnv.some((file) => !file.centralized)) recommendations.push("\u53D1\u73B0\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\u5C1A\u672A\u8FDE\u63A5\u5230\u672C\u9879\u76EE\u7684\u4E2D\u592E `.secrets` \u76EE\u5F55\uFF1B\u533A\u5206\u53EF\u4E22\u5F03\u751F\u6210\u7269\u4E0E\u672C\u5730\u4E3B\u6765\u6E90\uFF0C\u9700\u4FDD\u7559\u7684\u6765\u6E90\u5E94\u96C6\u4E2D\u540E\u518D\u63A5\u56DE\u9879\u76EE\u3002");
+  if (hasUnsafeCentralSecretPermissions(secrets)) recommendations.push("\u4E2D\u592E\u5BC6\u94A5\u76EE\u5F55\u6216\u6587\u4EF6\u6743\u9650\u8FC7\u5BBD\uFF1B\u76EE\u5F55\u5E94\u4E3A 0700\uFF0C\u914D\u7F6E\u6587\u4EF6\u5E94\u4E3A 0600\u3002");
   if (!docs.packages.aligned) recommendations.push(`PGS \u5305\u7248\u672C\u672A\u4E0E\u6267\u884C\u5F15\u64CE ${docs.packages.expected ?? "\u672A\u77E5\u7248\u672C"} \u5BF9\u9F50\uFF1B\u53D1\u5E03\u4E0A\u6E38\u540E\u518D\u540C\u6B65\u76EE\u6807\u4ED3\u5E93\u3002`);
   if (role === "target" && !docs.manifest) recommendations.push("\u7F3A\u5C11 docs/governance/MANIFEST.yml\uFF1B\u6587\u6863\u6E05\u5355\u65E0\u6CD5\u8BC1\u660E\u5DF2\u540C\u6B65\u3002");
   if (technologyGovernance && !projectModel.projectType) recommendations.push("\u672A\u58F0\u660E\u9879\u76EE\u7C7B\u578B\uFF1B\u65E0\u6CD5\u628A\u5B9E\u9645\u6280\u672F\u4E0E\u4EA7\u54C1\u7EBF\u57FA\u7EBF\u8FDB\u884C\u6BD4\u8F83\u3002");
@@ -3630,10 +3651,12 @@ function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion,
   };
 }
 function deriveStatus(entries, git, hooks, skills, secrets, projectModel, technologyGovernanceConfigured) {
-  if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || skills.canonical.some((item) => item.kind === "dangling-symlink") || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template)) return "unhealthy";
+  if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || skills.canonical.some((item) => item.kind === "dangling-symlink") || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets)) return "unhealthy";
   const missingBaseline = projectModel.baseline.some((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
   const missingSelected = projectModel.optionalCapabilities.some((technology) => technology.selected && !technology.detected);
-  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected) return "attention";
+  const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
+  const secretMaterializationNeedsReview = liveEnv.some((file) => !file.centralized);
+  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected) return "attention";
   return "healthy";
 }
 function inspectProjectModel(root, endpoint, governance) {
@@ -3795,11 +3818,14 @@ function inspectClaudeSkillRoot(root) {
 }
 function inspectRepositorySecrets(root, id, secretsRoot, isRepository) {
   const centralPath = join20(secretsRoot, id);
+  const centralRealPath = safeRealpath(centralPath);
   const envFiles = collectEnvironmentFiles(root).map((path) => ({
     path,
     tracked: isRepository ? gitTracks(root, path) : false,
-    template: /(?:example|sample|template|defaults?)$/i.test(basenameOnly(path)),
-    symlink: lstatSync6(join20(root, path)).isSymbolicLink()
+    template: isEnvironmentTemplate(path),
+    fixture: isEnvironmentFixture(path),
+    symlink: lstatSync6(join20(root, path)).isSymbolicLink(),
+    centralized: pointsInside(join20(root, path), centralRealPath)
   }));
   return {
     centralDirectory: existsSync21(centralPath) ? "present" : "absent",
@@ -3816,7 +3842,7 @@ function collectEnvironmentFiles(root, current = root, depth = 0) {
     for (const entry of readdirSync8(current, { withFileTypes: true })) {
       if (entry.isDirectory()) {
         if (!SKIP_ENV_DIRECTORIES.has(entry.name)) found.push(...collectEnvironmentFiles(root, join20(current, entry.name), depth + 1));
-      } else if (entry.name === ".env" || entry.name.startsWith(".env.")) {
+      } else if (isEnvironmentFilename(entry.name) && !isProviderGeneratedEnvironmentFile(entry.name)) {
         found.push(relative8(root, join20(current, entry.name)));
       }
     }
@@ -3843,6 +3869,35 @@ function basenameOnly(path) {
   const parts = path.split(/[\\/]/);
   return parts[parts.length - 1] ?? path;
 }
+function isEnvironmentFilename(name) {
+  return name === ".env" || name.startsWith(".env.") || name.endsWith(".env");
+}
+function isProviderGeneratedEnvironmentFile(name) {
+  return name.endsWith(".pulled");
+}
+function isEnvironmentTemplate(path) {
+  return /(^|[._-])(example|sample|template|defaults?)([._-]|$)/i.test(basenameOnly(path));
+}
+function isEnvironmentFixture(path) {
+  return /(^|[\\/])(?:tests?|__tests__)[\\/]fixtures?[\\/]/i.test(path) || /(^|[\\/])__fixtures__[\\/]/i.test(path);
+}
+function safeRealpath(path) {
+  try {
+    return realpathSync2(path);
+  } catch {
+    return void 0;
+  }
+}
+function pointsInside(path, expectedRoot) {
+  if (!expectedRoot || !lstatSync6(path).isSymbolicLink()) return false;
+  const target = safeRealpath(path);
+  if (!target) return false;
+  const fromRoot = relative8(expectedRoot, target);
+  return fromRoot === "" || fromRoot !== ".." && !fromRoot.startsWith(`..${sep}`);
+}
+function hasUnsafeCentralSecretPermissions(secrets) {
+  return secrets.centralDirectory === "present" && (secrets.centralMode !== "700" || secrets.centralFiles.some((file) => file.mode !== "600"));
+}
 function inspectSecretsRoot(path) {
   return existsSync21(path) ? { path, exists: true, mode: modeString(statSync4(path).mode) } : { path, exists: false };
 }
@@ -4471,7 +4526,7 @@ function normalizeMarkdownTableCell(cell) {
 }
 function inferInstalledProfile(root) {
   const installed = ["engineering-runtime", "doc-only"].filter(
-    (profile) => existsSync23(join22(root, `docs/governance/agents-routing/${profile}-v0.9.md`))
+    (profile) => existsSync23(join22(root, `docs/governance/agents-routing/${profile}-v1.0.md`))
   );
   return installed.length === 1 ? installed[0] : void 0;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pieai/pro-gov",
-  "version": "0.4.9",
+  "version": "0.5.0",
   "description": "Project-level distribution kit for Project Governance System.",
   "keywords": [
     "ai-agents",
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pieai/doc-gov": "^0.4.9"
+    "@pieai/doc-gov": "^0.5.0"
   },
   "devDependencies": {
     "@pieai/swimmer-ui-kit": "1.0.1",

package/assets/starter/docs/decisions/.gitkeep

@@ -1 +0,0 @@
-