@pieai/pro-gov 0.5.3 → 0.6.0

package/dist/cli.js

@@ -565,7 +565,7 @@ import {
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync2,
   readlinkSync as readlinkSync2,
-  realpathSync,
+  realpathSync as realpathSync2,
   symlinkSync,
   unlinkSync,
   writeFileSync
@@ -573,7 +573,7 @@ import {
 import { dirname as dirname4, join as join8, relative as relative4, resolve as resolve2 } from "node:path";
 
 // src/asset-targets/install-plan.ts
-import { existsSync as existsSync7, lstatSync as lstatSync2, readFileSync as readFileSync4, readlinkSync } from "node:fs";
+import { existsSync as existsSync7, lstatSync as lstatSync2, readFileSync as readFileSync4, readlinkSync, realpathSync } from "node:fs";
 import { basename, dirname as dirname3, join as join7, resolve } from "node:path";
 function createAssetInstallPlan(options) {
   const placement = options.placement ?? "registry";
@@ -589,10 +589,19 @@ function createAssetInstallPlan(options) {
     return asset;
   });
   const lockEntries = createAgentAssetLockEntries(options.registry, options.agentAssetsDir, assetIds);
-  const managedEntries = readManagedEntries(options.targetDir);
+  const managedLock = readManagedLock(options.targetDir);
+  const managedEntries = managedLock.entries;
   const managedTargets = new Set(managedEntries.map((entry) => entry.targetPath));
+  const legacyAdoptions = createLegacyClaudeAdoptions({
+    targetDir: options.targetDir,
+    agentAssetsDir: options.agentAssetsDir,
+    managedLock,
+    assets,
+    host: options.host,
+    placement
+  });
   const assetActions = assets.map(
-    (asset) => createAssetAction(asset, options.agentAssetsDir, options.targetDir, options.host, placement, managedTargets)
+    (asset) => legacyAdoptions.byAssetId.get(asset.id) ?? createAssetAction(asset, options.agentAssetsDir, options.targetDir, options.host, placement, managedTargets)
   );
   const manifest = {
     schemaVersion: 1,
@@ -635,7 +644,8 @@ function createAssetInstallPlan(options) {
     options.targetDir,
     options.agentAssetsDir,
     managedEntries,
-    expectedTargetPaths
+    expectedTargetPaths,
+    legacyAdoptions.consumedTargetPaths
   );
   return {
     schemaVersion: 1,
@@ -693,15 +703,9 @@ function createAssetAction(asset, agentAssetsDir, targetDir, host, placement, ma
     targetPath
   };
 }
-function resolveHostTargetPath(asset, host, placement) {
+function resolveHostTargetPath(asset, _host, placement) {
   if (asset.kind === "skill") {
     const effectivePlacement = resolveSkillPlacement(asset, placement);
-    if (host === "claude-code") {
-      if (placement === "manual") {
-        throw new Error("Manual skill placement is only supported for .agents hosts");
-      }
-      return `.claude/skills/${basename(asset.sourcePath)}`;
-    }
     if (effectivePlacement === "manual") {
       return `.agents/manual-skills/${basename(asset.sourcePath)}`;
     }
@@ -725,22 +729,84 @@ function createDirectoryActions(actions) {
   }
   return [...directories].sort().map((targetPath) => ({ type: "create-dir", targetPath }));
 }
-function readManagedEntries(targetDir) {
+function readManagedLock(targetDir) {
   const lockfilePath = join7(targetDir, ".pro-gov/assets.lock.json");
-  if (!existsSync7(lockfilePath)) return [];
+  if (!existsSync7(lockfilePath)) return { entries: [] };
   try {
     const lockfile = JSON.parse(readFileSync4(lockfilePath, "utf8"));
-    return (lockfile.assets ?? []).filter(
-      (entry) => typeof entry.id === "string" && typeof entry.sourcePath === "string" && typeof entry.targetPath === "string"
-    );
+    return {
+      host: typeof lockfile.host === "string" ? lockfile.host : void 0,
+      entries: (lockfile.assets ?? []).filter(
+        (entry) => typeof entry.id === "string" && typeof entry.sourcePath === "string" && typeof entry.targetPath === "string"
+      )
+    };
   } catch {
-    return [];
+    return { entries: [] };
+  }
+}
+function createLegacyClaudeAdoptions(options) {
+  const byAssetId = /* @__PURE__ */ new Map();
+  const consumedTargetPaths = /* @__PURE__ */ new Set();
+  const legacyEntries = options.managedLock.entries.filter((entry) => isLegacyClaudeSkillTargetPath(entry.targetPath));
+  if (legacyEntries.length === 0) return { byAssetId, consumedTargetPaths };
+  if (options.managedLock.host !== "claude-code" || options.host !== "claude-code") {
+    throw new Error("Legacy Claude skill targets require a claude-code lock and migration plan.");
+  }
+  const assetsById = new Map(options.assets.map((asset) => [asset.id, asset]));
+  const seenAssetIds = /* @__PURE__ */ new Set();
+  for (const entry of legacyEntries) {
+    if (seenAssetIds.has(entry.id)) {
+      throw new Error(`Duplicate legacy Claude lock entry: ${entry.id}`);
+    }
+    seenAssetIds.add(entry.id);
+    const asset = assetsById.get(entry.id);
+    if (!asset) {
+      throw new Error(`Legacy Claude asset ${entry.id} must be adopted before it can be removed.`);
+    }
+    const match = entry.targetPath.match(/^\.claude\/skills\/([^/]+)$/);
+    const skillName = match?.[1];
+    if (!skillName || asset.kind !== "skill" || entry.sourcePath !== asset.sourcePath || skillName !== basename(entry.sourcePath) || resolveHostTargetPath(asset, options.host, options.placement) !== `.agents/skills/${skillName}`) {
+      throw new Error(`Legacy Claude lock entry cannot be safely normalized: ${entry.targetPath}`);
+    }
+    const targetPath = `.agents/skills/${skillName}`;
+    const targetAbsolutePath = join7(options.targetDir, targetPath);
+    const compatibilityRootPath = join7(options.targetDir, ".claude/skills");
+    const canonicalRootPath = join7(options.targetDir, ".agents/skills");
+    if (!lstatSync2(canonicalRootPath).isDirectory() || !lstatSync2(compatibilityRootPath).isSymbolicLink() || readlinkSync(compatibilityRootPath) !== "../.agents/skills" || realpathSync(compatibilityRootPath) !== realpathSync(canonicalRootPath)) {
+      throw new Error(`Legacy Claude compatibility root is not the exact canonical alias for ${entry.id}.`);
+    }
+    if (!pathExistsEvenIfDanglingSymlink2(targetAbsolutePath)) {
+      consumedTargetPaths.add(entry.targetPath);
+      continue;
+    }
+    const targetStat = lstatSync2(targetAbsolutePath);
+    const legacyAbsolutePath = join7(options.targetDir, entry.targetPath);
+    const legacyStat = lstatSync2(legacyAbsolutePath);
+    const expectedSourcePath = join7(options.agentAssetsDir, entry.sourcePath);
+    if (!targetStat.isSymbolicLink() || !legacyStat.isSymbolicLink() || targetStat.dev !== legacyStat.dev || targetStat.ino !== legacyStat.ino || realpathSync(targetAbsolutePath) !== realpathSync(expectedSourcePath)) {
+      throw new Error(`Legacy Claude skill target cannot be safely adopted: ${entry.targetPath}`);
+    }
+    const action = {
+      type: "adopt-symlink",
+      assetId: entry.id,
+      sourcePath: expectedSourcePath,
+      targetPath,
+      legacyTargetPath: entry.targetPath,
+      compatibilityRootPath: ".claude/skills",
+      expectedCompatibilityRawTarget: "../.agents/skills",
+      expectedDevice: targetStat.dev,
+      expectedInode: targetStat.ino
+    };
+    byAssetId.set(entry.id, action);
+    consumedTargetPaths.add(entry.targetPath);
   }
+  return { byAssetId, consumedTargetPaths };
 }
-function createRemovalActions(targetDir, agentAssetsDir, managedEntries, expectedTargetPaths) {
+function createRemovalActions(targetDir, agentAssetsDir, managedEntries, expectedTargetPaths, consumedTargetPaths) {
   const actions = [];
   for (const entry of managedEntries) {
     if (expectedTargetPaths.has(entry.targetPath)) continue;
+    if (consumedTargetPaths.has(entry.targetPath)) continue;
     if (!isManagedAssetTargetPath(entry.targetPath)) {
       throw new Error(`Refusing to remove managed asset outside supported roots: ${entry.targetPath}`);
     }
@@ -765,13 +831,10 @@ function createRemovalActions(targetDir, agentAssetsDir, managedEntries, expecte
   return actions.sort((a, b) => a.targetPath.localeCompare(b.targetPath));
 }
 function isManagedAssetTargetPath(path) {
-  return [
-    ".agents/skills/",
-    ".agents/manual-skills/",
-    ".claude/skills/",
-    ".pro-gov/agent-assets/rules/",
-    ".pro-gov/agent-assets/commands/"
-  ].some((prefix) => path.startsWith(prefix));
+  return /^(?:\.agents\/(?:skills|manual-skills)|\.pro-gov\/agent-assets\/(?:rules|commands))\/[^/.][^/]*$/.test(path);
+}
+function isLegacyClaudeSkillTargetPath(path) {
+  return /^\.claude\/skills\/[^/.][^/]*$/.test(path);
 }
 function pathExistsEvenIfDanglingSymlink2(path) {
   try {
@@ -785,6 +848,9 @@ function pathExistsEvenIfDanglingSymlink2(path) {
 // src/asset-targets/apply.ts
 function applyAssetInstallPlan(plan) {
   const appliedActions = [];
+  for (const action of plan.actions) {
+    if (action.type === "adopt-symlink") validateAdoptedSymlink(plan.targetDir, action);
+  }
   for (const action of plan.actions) {
     applyAction(plan.targetDir, action);
     appliedActions.push(action.type);
@@ -797,6 +863,7 @@ function applyAction(targetDir, action) {
     removeManagedSymlink(targetAbsolutePath, action);
     return;
   }
+  if (action.type === "adopt-symlink") return;
   if (action.type === "create-dir") {
     mkdirSync2(targetAbsolutePath, { recursive: true });
     return;
@@ -808,7 +875,7 @@ function applyAction(targetDir, action) {
   }
   mkdirSync2(dirname4(targetAbsolutePath), { recursive: true });
   const sourceAbsolutePath = resolve2(action.sourcePath);
-  const symlinkTarget = relative4(realpathSync(dirname4(targetAbsolutePath)), realpathSync(sourceAbsolutePath)) || ".";
+  const symlinkTarget = relative4(realpathSync2(dirname4(targetAbsolutePath)), realpathSync2(sourceAbsolutePath)) || ".";
   if (action.type === "symlink") {
     if (pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
       throw new Error(`Refusing to overwrite unmanaged target: ${action.targetPath}`);
@@ -827,6 +894,23 @@ function applyAction(targetDir, action) {
   unlinkSync(targetAbsolutePath);
   symlinkSync(symlinkTarget, targetAbsolutePath);
 }
+function validateAdoptedSymlink(targetDir, action) {
+  if (!isManagedAssetTargetPath(action.targetPath) || !isLegacyClaudeSkillTargetPath(action.legacyTargetPath) || action.compatibilityRootPath !== ".claude/skills" || action.expectedCompatibilityRawTarget !== "../.agents/skills") {
+    throw new Error(`Refusing unsafe legacy Claude adoption: ${action.legacyTargetPath}`);
+  }
+  const canonicalRootPath = join8(targetDir, ".agents/skills");
+  const compatibilityRootPath = join8(targetDir, action.compatibilityRootPath);
+  const targetAbsolutePath = join8(targetDir, action.targetPath);
+  const legacyAbsolutePath = join8(targetDir, action.legacyTargetPath);
+  if (!lstatSync3(canonicalRootPath).isDirectory() || !lstatSync3(compatibilityRootPath).isSymbolicLink() || readlinkSync2(compatibilityRootPath) !== action.expectedCompatibilityRawTarget || realpathSync2(compatibilityRootPath) !== realpathSync2(canonicalRootPath)) {
+    throw new Error(`Legacy Claude compatibility alias changed before apply: ${action.compatibilityRootPath}`);
+  }
+  const targetStat = lstatSync3(targetAbsolutePath);
+  const legacyStat = lstatSync3(legacyAbsolutePath);
+  if (!targetStat.isSymbolicLink() || !legacyStat.isSymbolicLink() || targetStat.dev !== legacyStat.dev || targetStat.ino !== legacyStat.ino || targetStat.dev !== action.expectedDevice || targetStat.ino !== action.expectedInode || realpathSync2(targetAbsolutePath) !== realpathSync2(action.sourcePath)) {
+    throw new Error(`Legacy Claude skill target changed before apply: ${action.targetPath}`);
+  }
+}
 function removeManagedSymlink(targetAbsolutePath, action) {
   if (!isManagedAssetTargetPath(action.targetPath)) {
     throw new Error(`Refusing to remove managed asset outside supported roots: ${action.targetPath}`);
@@ -1014,18 +1098,14 @@ function checkHostFolder(host, kind, targetPath, id) {
   return void 0;
 }
 function expectedSkillTargetPrefixes(host) {
-  if (host === "claude-code") return [".claude/skills/"];
-  if (host === "codex" || host === "gemini-cli" || host === "antigravity") {
+  if (host === "codex" || host === "claude-code" || host === "gemini-cli" || host === "antigravity") {
     return [".agents/skills/", ".agents/manual-skills/"];
   }
   return void 0;
 }
 function expectedRegistrySkillTargetPath(host, sourcePath, placement) {
   const skillName = basename2(sourcePath);
-  if (host === "claude-code") {
-    return placement === "manual" ? void 0 : `.claude/skills/${skillName}`;
-  }
-  if (host === "codex" || host === "gemini-cli" || host === "antigravity") {
+  if (host === "codex" || host === "claude-code" || host === "gemini-cli" || host === "antigravity") {
     return placement === "manual" ? `.agents/manual-skills/${skillName}` : `.agents/skills/${skillName}`;
   }
   return void 0;
@@ -1653,12 +1733,14 @@ import { existsSync as existsSync12 } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname as dirname6, join as join12 } from "node:path";
 var REQUIRED_ASSETS = [
+  "starter/.agents/skills/.gitkeep",
   "starter/AGENTS.template.md",
-  "starter/docs/governance/ssot-v1.0.md",
-  "starter/docs/governance/agents-routing/engineering-runtime-v1.0.md",
-  "starter/docs/governance/agents-routing/doc-only-v1.0.md",
+  "starter/docs/governance/ssot-v1.1.md",
+  "starter/docs/governance/agents-routing/engineering-runtime-v1.1.md",
+  "starter/docs/governance/agents-routing/doc-only-v1.1.md",
   "profiles/engineering-runtime/profile.md",
-  "profiles/doc-only/profile.md"
+  "profiles/doc-only/profile.md",
+  "docs/reference/adoption/migration-v1.1.md"
 ];
 function runDoctor(_args) {
   const assets = listAssets();
@@ -1709,40 +1791,46 @@ function resolveDocGovDependencyCli() {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "node:fs";
+import { lstatSync as lstatSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync8, symlinkSync as symlinkSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { basename as basename3, dirname as dirname7, join as join13 } from "node:path";
 
 // src/commands/shared.ts
 function planStarterFiles(profile) {
-  return listAssets().flatMap((asset) => {
+  const files = listAssets().flatMap((asset) => {
     const targetPath = starterTargetPath(asset.path);
     if (!targetPath) return [];
     if (profile && isOtherProfileRouting(targetPath, profile)) return [];
     return [
       {
+        kind: "file",
         sourcePath: asset.path,
         targetPath,
         absoluteSourcePath: asset.absolutePath,
         ownership: classifyOwnership(targetPath)
       }
     ];
-  }).sort((a, b) => a.targetPath.localeCompare(b.targetPath));
+  });
+  const compatibilityEntries = [
+    { kind: "directory", targetPath: ".agents/skills", ownership: "shared" },
+    { kind: "symlink", targetPath: "CLAUDE.md", linkTarget: "AGENTS.md", ownership: "shared" },
+    { kind: "symlink", targetPath: ".claude/skills", linkTarget: "../.agents/skills", ownership: "shared" }
+  ];
+  return [...files, ...compatibilityEntries].sort((a, b) => a.targetPath.localeCompare(b.targetPath));
 }
 function classifyOwnership(targetPath) {
   if (targetPath === "lefthook.yml" || targetPath === ".github/workflows/docs-check.yml") {
     return "optional-guardrail";
   }
-  if (targetPath === "AGENTS.md" || targetPath === "CLAUDE.md" || targetPath === "docs/policy/best-practice-for-this-project.md" || targetPath === "docs/reference/documentation-map.md" || targetPath === "docs/reference/execution/current-work.md") {
+  if (targetPath === "AGENTS.md" || targetPath === "docs/policy/best-practice-for-this-project.md" || targetPath === "docs/reference/documentation-map.md" || targetPath === "docs/reference/execution/current-work.md") {
     return "project-local-seed";
   }
   return "shared";
 }
 function isOtherProfileRouting(targetPath, profile) {
-  return targetPath.startsWith("docs/governance/agents-routing/") && targetPath !== `docs/governance/agents-routing/${profile}-v1.0.md`;
+  return targetPath.startsWith("docs/governance/agents-routing/") && targetPath !== `docs/governance/agents-routing/${profile}-v1.1.md`;
 }
 function starterTargetPath(sourcePath) {
   if (sourcePath === "starter/AGENTS.template.md") return "AGENTS.md";
-  if (sourcePath === "starter/CLAUDE.template.md") return "CLAUDE.md";
   if (sourcePath === "starter/lefthook.template.yml") return "lefthook.yml";
   if (!sourcePath.startsWith("starter/")) return null;
   return sourcePath.slice("starter/".length);
@@ -1772,13 +1860,20 @@ function runInit(args) {
   console.log("");
   console.log("Planned starter files:");
   for (const file of files) {
-    console.log(`  ${file.targetPath} <- ${file.sourcePath}`);
+    if (file.kind === "file") console.log(`  ${file.targetPath} <- ${file.sourcePath}`);
+    if (file.kind === "directory") console.log(`  ${file.targetPath} <- directory`);
+    if (file.kind === "symlink") console.log(`  ${file.targetPath} <- symlink:${file.linkTarget}`);
   }
   return 0;
 }
 function applyStarterFiles(files, profile) {
   const root = process.cwd();
-  const conflicts = files.filter((file) => existsSync13(join13(root, file.targetPath)));
+  const conflicts = files.filter((file) => {
+    const targetPath = join13(root, file.targetPath);
+    const stat = safeLstat(targetPath);
+    if (!stat) return false;
+    return file.kind !== "directory" || !stat.isDirectory();
+  });
   if (conflicts.length > 0) {
     console.error("pro-gov init is refusing to overwrite existing project files:");
     for (const file of conflicts) console.error(`  ${file.targetPath}`);
@@ -1788,6 +1883,14 @@ function applyStarterFiles(files, profile) {
   for (const file of files) {
     const targetPath = join13(root, file.targetPath);
     mkdirSync4(dirname7(targetPath), { recursive: true });
+    if (file.kind === "directory") {
+      mkdirSync4(targetPath, { recursive: true });
+      continue;
+    }
+    if (file.kind === "symlink") {
+      symlinkSync2(file.linkTarget, targetPath);
+      continue;
+    }
     const source = readFileSync8(file.absoluteSourcePath);
     const content = file.targetPath === "AGENTS.md" ? renderAgentsTemplate(source.toString("utf8"), basename3(root), profile) : source;
     writeFileSync3(targetPath, content);
@@ -1800,9 +1903,16 @@ function applyStarterFiles(files, profile) {
   return 0;
 }
 function renderAgentsTemplate(template, projectName, profile) {
-  const selectedRoute = `docs/governance/agents-routing/${profile}-v1.0.md`;
+  const selectedRoute = `docs/governance/agents-routing/${profile}-v1.1.md`;
   return template.replace("# PROJECT_NAME AI Router", `# ${projectName} AI Router`).replace("`PROFILE_NAME`", `\`${profile}\``).replace("`PROFILE_ROUTE`", `\`${selectedRoute}\``).replace(/\n{3,}/g, "\n\n");
 }
+function safeLstat(path) {
+  try {
+    return lstatSync5(path);
+  } catch {
+    return void 0;
+  }
+}
 function readFlag(args, flag) {
   const index = args.indexOf(flag);
   if (index === -1) return null;
@@ -1812,7 +1922,7 @@ function readFlag(args, flag) {
 }
 
 // src/learning/recall.ts
-import { existsSync as existsSync14, readdirSync as readdirSync6, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync13, readdirSync as readdirSync6, readFileSync as readFileSync9 } from "node:fs";
 import { basename as basename4, join as join14, relative as relative5 } from "node:path";
 function recallLearnings(root, options) {
   const query = options.query.trim();
@@ -1837,7 +1947,7 @@ function loadLearningRecords(root) {
   const recordsByTitle = /* @__PURE__ */ new Map();
   for (const relativeDir of ["docs/reference/learnings", "docs/solutions"]) {
     const learningDir = join14(root, relativeDir);
-    if (!existsSync14(learningDir)) continue;
+    if (!existsSync13(learningDir)) continue;
     for (const path of listMarkdownFiles(learningDir)) {
       const record = readLearningRecord(root, path);
       const key = record.title.trim().toLowerCase();
@@ -1845,7 +1955,7 @@ function loadLearningRecords(root) {
     }
   }
   const conceptsPath = join14(root, "CONCEPTS.md");
-  if (existsSync14(conceptsPath)) {
+  if (existsSync13(conceptsPath)) {
     const record = readLearningRecord(root, conceptsPath);
     recordsByTitle.set(`concepts:${record.title.toLowerCase()}`, record);
   }
@@ -1947,7 +2057,7 @@ function cleanMarkdownLine(input) {
 }
 
 // src/learning/capture.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "node:fs";
 import { basename as basename5, join as join15, relative as relative6 } from "node:path";
 function captureLearning(root, options) {
   const title = options.title.trim();
@@ -2005,7 +2115,7 @@ function renderLearning(options) {
 function uniquePath(dir, slug) {
   let index = 1;
   let candidate = join15(dir, `${slug}.md`);
-  while (existsSync15(candidate)) {
+  while (existsSync14(candidate)) {
     index += 1;
     candidate = join15(dir, `${slug}-${index}.md`);
   }
@@ -2188,10 +2298,10 @@ function printUsage2() {
 
 // src/commands/lens.ts
 import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname9 } from "node:path";
+import { dirname as dirname10 } from "node:path";
 
 // src/lens/audit.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
 import { basename as basename6, dirname as dirname8, join as join16 } from "node:path";
 var REQUIRED_ARTIFACTS = [
   "manifest.md",
@@ -2223,7 +2333,7 @@ function createProjectLensAuditPackage(targetDir, auditDir) {
 }
 function checkProjectLensAuditPackage(auditDir, options = {}) {
   const contractPath = join16(auditDir, "audit.contract.json");
-  if (!existsSync16(contractPath)) {
+  if (!existsSync15(contractPath)) {
     return {
       ok: false,
       auditDir,
@@ -2271,7 +2381,7 @@ function checkProjectLensAuditPackage(auditDir, options = {}) {
   }
   for (const artifactPath of REQUIRED_ARTIFACTS) {
     const absolutePath = join16(auditDir, artifactPath);
-    if (!existsSync16(absolutePath)) {
+    if (!existsSync15(absolutePath)) {
       issues.push({ type: "missing-required-artifact", path: artifactPath });
       continue;
     }
@@ -2471,6 +2581,9 @@ function formatProjectLensInspection(report) {
     `excluded-files: ${report.scanScope.excludedFileCount}`,
     `ai-entry-files: ${formatList(report.aiEntryFiles)}`,
     `ai-config-files: ${formatList(report.aiConfigFiles)}`,
+    `ai-host-ssot: ${report.hostSsot.compliant ? "compliant" : "non-compliant"}`,
+    `claude-entry-link: ${formatLink(report.hostSsot.claudeEntry)}`,
+    `claude-skills-link: ${formatLink(report.hostSsot.claudeSkills)}`,
     `package-scripts: ${formatList(report.packageJson?.scripts ?? [])}`,
     `dependencies: ${formatList(report.packageJson?.dependencies ?? [])}`,
     `dev-dependencies: ${formatList(report.packageJson?.devDependencies ?? [])}`,
@@ -2503,6 +2616,15 @@ function renderProjectLensMarkdownReport(report) {
     "",
     bulletList(report.aiConfigFiles),
     "",
+    "## AI Host SSOT",
+    "",
+    `- Status: ${report.hostSsot.compliant ? "compliant" : "non-compliant"}`,
+    `- Canonical entry: \`${report.hostSsot.agentsEntry.path}\` (${report.hostSsot.agentsEntry.status})`,
+    `- Claude entry: ${formatLink(report.hostSsot.claudeEntry)}`,
+    `- Canonical skills: \`${report.hostSsot.canonicalSkills.path}\` (${report.hostSsot.canonicalSkills.status})`,
+    `- Claude skills: ${formatLink(report.hostSsot.claudeSkills)}`,
+    `- Issues: ${formatList(report.hostSsot.issues)}`,
+    "",
     "## Package",
     "",
     `- Scripts: ${formatList(report.packageJson?.scripts ?? [])}`,
@@ -2539,11 +2661,141 @@ function bulletList(values) {
   if (values.length === 0) return "- none";
   return values.map((value) => `- \`${value}\``).join("\n");
 }
+function formatLink(link) {
+  const rawTarget = link.rawTarget ? ` -> \`${link.rawTarget}\`` : "";
+  const resolvedTarget = link.resolvedTarget ? `; resolved: \`${link.resolvedTarget}\`` : "";
+  return `\`${link.path}\`${rawTarget} (${link.status}${resolvedTarget})`;
+}
 
 // src/lens/scan.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync17, readdirSync as readdirSync7, readFileSync as readFileSync11, statSync as statSync3 } from "node:fs";
-import { join as join17, relative as relative7 } from "node:path";
+import { existsSync as existsSync16, readdirSync as readdirSync7, readFileSync as readFileSync11, statSync as statSync3 } from "node:fs";
+import { join as join18, relative as relative7 } from "node:path";
+
+// src/host-ssot.ts
+import {
+  lstatSync as lstatSync6,
+  readlinkSync as readlinkSync3,
+  realpathSync as realpathSync3
+} from "node:fs";
+import { dirname as dirname9, isAbsolute as isAbsolute3, join as join17, resolve as resolve3 } from "node:path";
+function inspectProjectHostSsot(root) {
+  const agentsEntry = inspectCanonicalPath(root, "AGENTS.md");
+  const canonicalSkills = inspectCanonicalPath(root, ".agents/skills");
+  const claudeEntry = inspectCompatibilityLink(root, "CLAUDE.md", "AGENTS.md");
+  const claudeSkills = inspectCompatibilityLink(
+    root,
+    ".claude/skills",
+    "../.agents/skills"
+  );
+  const issues = [
+    ...agentsEntry.status === "file" ? [] : [`AGENTS.md must be the canonical project entry file; found ${agentsEntry.status}.`],
+    ...canonicalSkills.status === "directory" ? [] : [`.agents/skills must be the canonical project skill directory; found ${canonicalSkills.status}.`],
+    ...claudeEntry.compliant ? [] : [`CLAUDE.md must be the relative symlink AGENTS.md; found ${claudeEntry.status}.`],
+    ...claudeSkills.compliant ? [] : [`.claude/skills must be the relative symlink ../.agents/skills; found ${claudeSkills.status}.`]
+  ];
+  return {
+    agentsEntry,
+    canonicalSkills,
+    claudeEntry,
+    claudeSkills,
+    compliant: issues.length === 0,
+    issues
+  };
+}
+function inspectUserSkillsSsot(homeDir) {
+  const canonicalSkills = inspectCanonicalPath(homeDir, ".agents/skills");
+  const claudeSkills = inspectCompatibilityLink(
+    homeDir,
+    ".claude/skills",
+    "../.agents/skills"
+  );
+  const issues = [
+    ...canonicalSkills.status === "directory" ? [] : [`~/.agents/skills must be the canonical user skill directory; found ${canonicalSkills.status}.`],
+    ...claudeSkills.compliant ? [] : [`~/.claude/skills must be the relative symlink ../.agents/skills; found ${claudeSkills.status}.`]
+  ];
+  return {
+    canonicalSkills,
+    claudeSkills,
+    compliant: issues.length === 0,
+    issues
+  };
+}
+function inspectCanonicalPath(root, path) {
+  const absolutePath = join17(root, path);
+  const stat = safeLstat2(absolutePath);
+  if (!stat) return { path, status: "missing" };
+  if (stat.isSymbolicLink()) {
+    try {
+      realpathSync3(absolutePath);
+      return { path, status: "symlink" };
+    } catch {
+      return { path, status: "dangling-symlink" };
+    }
+  }
+  if (stat.isFile()) return { path, status: "file" };
+  if (stat.isDirectory()) return { path, status: "directory" };
+  return { path, status: "other" };
+}
+function inspectCompatibilityLink(root, path, expectedRawTarget) {
+  const absolutePath = join17(root, path);
+  const stat = safeLstat2(absolutePath);
+  const base = { path, expectedRawTarget, compliant: false };
+  if (!stat) return { ...base, status: "missing" };
+  if (!stat.isSymbolicLink()) {
+    if (stat.isFile()) return { ...base, status: "file" };
+    if (stat.isDirectory()) return { ...base, status: "directory" };
+    return { ...base, status: "other" };
+  }
+  const rawTarget = readlinkSync3(absolutePath);
+  const resolvedTarget = resolve3(dirname9(absolutePath), rawTarget);
+  const expectedPath = resolve3(dirname9(absolutePath), expectedRawTarget);
+  const targetStat = safeLstat2(resolvedTarget);
+  if (!targetStat) {
+    return {
+      ...base,
+      rawTarget,
+      resolvedTarget,
+      status: rawTarget === expectedRawTarget ? "target-missing" : "dangling-symlink"
+    };
+  }
+  let targetMatches = false;
+  try {
+    targetMatches = realpathSync3(absolutePath) === realpathSync3(expectedPath);
+  } catch {
+    return { ...base, rawTarget, resolvedTarget, status: "dangling-symlink" };
+  }
+  if (!targetMatches) {
+    return { ...base, rawTarget, resolvedTarget, status: "wrong-target" };
+  }
+  if (isAbsolute3(rawTarget)) {
+    return { ...base, rawTarget, resolvedTarget, status: "absolute-symlink" };
+  }
+  if (rawTarget !== expectedRawTarget) {
+    return {
+      ...base,
+      rawTarget,
+      resolvedTarget,
+      status: "noncanonical-relative-symlink"
+    };
+  }
+  return {
+    ...base,
+    rawTarget,
+    resolvedTarget,
+    status: "compliant-relative-symlink",
+    compliant: true
+  };
+}
+function safeLstat2(path) {
+  try {
+    return lstatSync6(path);
+  } catch {
+    return void 0;
+  }
+}
+
+// src/lens/scan.ts
 var ignoredDirectories = /* @__PURE__ */ new Set([
   ".git",
   ".next",
@@ -2569,22 +2821,23 @@ function scanProjectLensTarget(targetDir, options = {}) {
       excludedFileCount: candidateFiles.length - files.length
     },
     aiEntryFiles: ["AGENTS.md", "CLAUDE.md"].filter(
-      (file) => existsSync17(join17(targetDir, file))
+      (file) => existsSync16(join18(targetDir, file))
     ),
     aiConfigFiles: [],
+    hostSsot: inspectProjectHostSsot(targetDir),
     packageJson,
     docs: {
-      hasDocsDirectory: existsSync17(join17(targetDir, "docs")),
+      hasDocsDirectory: existsSync16(join18(targetDir, "docs")),
       markdownFileCount: markdownFiles.length,
       governanceFiles: markdownFiles.filter((file) => file.startsWith("docs/governance/") || file.startsWith("docs/policy/")).sort()
     },
     git: readGitState(targetDir),
-    largeFiles: files.map((file) => ({ path: file, bytes: statSync3(join17(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
+    largeFiles: files.map((file) => ({ path: file, bytes: statSync3(join18(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
   };
 }
 function readPackageJson(targetDir) {
-  const packageJsonPath = join17(targetDir, "package.json");
-  if (!existsSync17(packageJsonPath)) return void 0;
+  const packageJsonPath = join18(targetDir, "package.json");
+  if (!existsSync16(packageJsonPath)) return void 0;
   try {
     const packageJson = JSON.parse(readFileSync11(packageJsonPath, "utf8"));
     return {
@@ -2624,7 +2877,7 @@ function listProjectFiles(targetDir) {
     "-z"
   ]);
   if (gitFiles.ok) {
-    return gitFiles.stdout.split("\0").filter(Boolean).map(toUnixPath4).filter((file) => existsSync17(join17(targetDir, file))).sort();
+    return gitFiles.stdout.split("\0").filter(Boolean).map(toUnixPath4).filter((file) => existsSync16(join18(targetDir, file))).sort();
   }
   const files = [];
   collectFiles2(targetDir, targetDir, files);
@@ -2642,13 +2895,13 @@ function isFirstPartyEvidenceFile(file) {
   return !excludedEvidencePrefixes.some((prefix) => file.startsWith(prefix));
 }
 function collectFiles2(rootDir, currentDir, files) {
-  if (!existsSync17(currentDir)) return;
+  if (!existsSync16(currentDir)) return;
   for (const entry of readdirSync7(currentDir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
       if (ignoredDirectories.has(entry.name)) continue;
-      collectFiles2(rootDir, join17(currentDir, entry.name), files);
+      collectFiles2(rootDir, join18(currentDir, entry.name), files);
     } else if (entry.isFile()) {
-      files.push(toUnixPath4(relative7(rootDir, join17(currentDir, entry.name))));
+      files.push(toUnixPath4(relative7(rootDir, join18(currentDir, entry.name))));
     }
   }
 }
@@ -2700,7 +2953,7 @@ function runLensReport(args) {
   }
   const report = scanProjectLensTarget(options.value.targetDir);
   const markdown = renderProjectLensMarkdownReport(report);
-  mkdirSync7(dirname9(options.value.outPath), { recursive: true });
+  mkdirSync7(dirname10(options.value.outPath), { recursive: true });
   writeFileSync6(options.value.outPath, markdown);
   console.log(`report: ${options.value.outPath}`);
   return 0;
@@ -2804,12 +3057,12 @@ function printUsage3() {
 }
 
 // src/commands/portfolio.ts
-import { existsSync as existsSync22 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync21 } from "node:fs";
+import { join as join22 } from "node:path";
 
 // src/portfolio/manifest.ts
-import { existsSync as existsSync18, readFileSync as readFileSync12 } from "node:fs";
-import { dirname as dirname10, isAbsolute as isAbsolute3, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync12 } from "node:fs";
+import { dirname as dirname11, isAbsolute as isAbsolute4, resolve as resolve4 } from "node:path";
 function loadPortfolioManifest(configPath) {
   let parsed;
   try {
@@ -2825,7 +3078,7 @@ function loadPortfolioManifest(configPath) {
       ]
     };
   }
-  const normalized = resolveManifestPaths(parsed, dirname10(resolve3(configPath)));
+  const normalized = resolveManifestPaths(parsed, dirname11(resolve4(configPath)));
   const issues = validatePortfolioManifest(normalized);
   return {
     configPath,
@@ -2836,14 +3089,14 @@ function loadPortfolioManifest(configPath) {
 function resolveManifestPaths(value, configDir) {
   if (!isRecord(value)) return value;
   const resolveEndpoint = (endpoint) => {
-    if (!isRecord(endpoint) || typeof endpoint.path !== "string" || isAbsolute3(endpoint.path)) {
+    if (!isRecord(endpoint) || typeof endpoint.path !== "string" || isAbsolute4(endpoint.path)) {
       return endpoint;
     }
-    return { ...endpoint, path: resolve3(configDir, endpoint.path) };
+    return { ...endpoint, path: resolve4(configDir, endpoint.path) };
   };
   return {
     ...value,
-    technologyGovernance: isRecord(value.technologyGovernance) && typeof value.technologyGovernance.strategySource === "string" && !isAbsolute3(value.technologyGovernance.strategySource) ? { ...value.technologyGovernance, strategySource: resolve3(configDir, value.technologyGovernance.strategySource) } : value.technologyGovernance,
+    technologyGovernance: isRecord(value.technologyGovernance) && typeof value.technologyGovernance.strategySource === "string" && !isAbsolute4(value.technologyGovernance.strategySource) ? { ...value.technologyGovernance, strategySource: resolve4(configDir, value.technologyGovernance.strategySource) } : value.technologyGovernance,
     controlPlane: resolveEndpoint(value.controlPlane),
     executionEngine: resolveEndpoint(value.executionEngine),
     targets: Array.isArray(value.targets) ? value.targets.map(resolveEndpoint) : value.targets
@@ -2877,13 +3130,14 @@ function validatePortfolioManifest(value) {
   validateAllowedFields(
     value,
     "root",
-    ["schemaVersion", "portfolioId", "technologyGovernance", "controlPlane", "executionEngine", "hostTooling", "targets"],
+    ["schemaVersion", "portfolioId", "technologyGovernance", "controlPlane", "executionEngine", "hostTooling", "specialistChecks", "targets"],
     issues
   );
   const technologyCatalog = validateTechnologyGovernance(value.technologyGovernance, issues);
   validateEndpoint(value.controlPlane, "controlPlane", issues, technologyCatalog);
   validateEndpoint(value.executionEngine, "executionEngine", issues, technologyCatalog);
   validateHostTooling(value.hostTooling, issues);
+  validateSpecialistChecks(value.specialistChecks, issues);
   if (!Array.isArray(value.targets)) {
     issues.push({
       type: "invalid-field",
@@ -2981,7 +3235,7 @@ function validateEndpoint(value, field, issues, technologyCatalog) {
     });
     return;
   }
-  if (!existsSync18(value.path)) {
+  if (!existsSync17(value.path)) {
     issues.push({
       type: "missing-path",
       id: typeof value.id === "string" ? value.id : void 0,
@@ -3076,13 +3330,13 @@ function validateTechnologyGovernance(value, issues) {
   return { technologies, projectTypes };
 }
 function isRepositoryRelativePath(value) {
-  if (value.length === 0 || isAbsolute3(value)) return false;
+  if (value.length === 0 || isAbsolute4(value)) return false;
   const segments = value.replaceAll("\\", "/").split("/");
   return !segments.includes("..");
 }
 function isExactRepositoryRelativePath(value) {
   if (value.length === 0) return false;
-  if (isAbsolute3(value)) return false;
+  if (isAbsolute4(value)) return false;
   if (/^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\") || value.startsWith("//")) return false;
   if (value.includes("\\")) return false;
   const segments = value.split("/");
@@ -3214,15 +3468,45 @@ function validateHostTooling(value, issues) {
     }
   }
 }
+function validateSpecialistChecks(value, issues) {
+  if (value === void 0) return;
+  if (!isRecord(value)) {
+    issues.push({
+      type: "invalid-field",
+      field: "specialistChecks",
+      message: "Portfolio specialistChecks must be an object."
+    });
+    return;
+  }
+  validateAllowedFields(value, "specialistChecks", ["devspace"], issues);
+  if (value.devspace === void 0) return;
+  if (!isRecord(value.devspace)) {
+    issues.push({
+      type: "invalid-field",
+      field: "specialistChecks.devspace",
+      message: "Portfolio specialistChecks.devspace must be an object."
+    });
+    return;
+  }
+  validateAllowedFields(value.devspace, "specialistChecks.devspace", ["expectedToolMode"], issues);
+  if (value.devspace.expectedToolMode !== void 0 && !["minimal", "full", "codex"].includes(String(value.devspace.expectedToolMode))) {
+    issues.push({
+      type: "invalid-field",
+      field: "specialistChecks.devspace.expectedToolMode",
+      message: "DevSpace expectedToolMode must be minimal, full, or codex."
+    });
+  }
+}
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // src/portfolio/doctor.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync20, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync14 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname11, join as join19 } from "node:path";
+import { homedir } from "node:os";
+import { dirname as dirname12, join as join20 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/host-tooling/inventory.ts
@@ -3313,13 +3597,13 @@ function isRecord2(value) {
 }
 
 // src/portfolio/asset-state.ts
-import { existsSync as existsSync19, lstatSync as lstatSync5, readFileSync as readFileSync13 } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync18, lstatSync as lstatSync7, readFileSync as readFileSync13 } from "node:fs";
+import { join as join19 } from "node:path";
 function comparePortfolioAssetState(options) {
   const expectedManifest = readPlanDocument(options.expectedPlan, ".pro-gov/assets.json");
   const expectedLock = readPlanDocument(options.expectedPlan, ".pro-gov/assets.lock.json");
-  const currentManifest = readJsonFile(join18(options.targetDir, ".pro-gov/assets.json"));
-  const currentLock = readJsonFile(join18(options.targetDir, ".pro-gov/assets.lock.json"));
+  const currentManifest = readJsonFile(join19(options.targetDir, ".pro-gov/assets.json"));
+  const currentLock = readJsonFile(join19(options.targetDir, ".pro-gov/assets.lock.json"));
   const issues = [];
   if (!sameStrings(currentManifest?.bundleIds, expectedManifest?.bundleIds)) {
     issues.push({
@@ -3342,7 +3626,8 @@ function comparePortfolioAssetState(options) {
   const expectedTargets = new Set((expectedLock?.assets ?? []).map((entry) => entry.targetPath));
   for (const entry of currentLock?.assets ?? []) {
     if (expectedTargets.has(entry.targetPath)) continue;
-    const targetAbsolutePath = join18(options.targetDir, entry.targetPath);
+    if (options.expectedPlan.actions.some((action) => action.type === "adopt-symlink" && action.assetId === entry.id && action.legacyTargetPath === entry.targetPath)) continue;
+    const targetAbsolutePath = join19(options.targetDir, entry.targetPath);
     if (!pathIsSymlink(targetAbsolutePath)) continue;
     issues.push({
       type: "orphaned-managed-symlink",
@@ -3364,7 +3649,7 @@ function readPlanDocument(plan, targetPath) {
   }
 }
 function readJsonFile(path) {
-  if (!existsSync19(path)) return void 0;
+  if (!existsSync18(path)) return void 0;
   try {
     return JSON.parse(readFileSync13(path, "utf8"));
   } catch {
@@ -3387,7 +3672,7 @@ function normalizeLock(lock) {
 }
 function pathIsSymlink(path) {
   try {
-    return lstatSync5(path).isSymbolicLink();
+    return lstatSync7(path).isSymbolicLink();
   } catch {
     return false;
   }
@@ -3409,17 +3694,19 @@ function inspectPortfolio(options) {
     portfolioId: options.manifest.portfolioId,
     expectedPackageVersions,
     hostTooling,
+    hostSsot: { userSkills: inspectUserSkillsSsot(options.homeDir ?? homedir()) },
     targets
   };
 }
 function inspectTarget(options) {
   const { target } = options;
+  const hostSsot = inspectProjectHostSsot(target.path);
   const issues = [];
-  const packageJson = readJson2(join19(target.path, "package.json"));
+  const packageJson = readJson2(join20(target.path, "package.json"));
   const packages = {};
   for (const packageName of ["@pieai/pro-gov", "@pieai/doc-gov"]) {
     const declared = packageJson?.devDependencies?.[packageName] ?? packageJson?.dependencies?.[packageName];
-    const installedPackage = readJson2(join19(target.path, "node_modules", packageName, "package.json"));
+    const installedPackage = readJson2(join20(target.path, "node_modules", packageName, "package.json"));
     const installed = installedPackage?.version;
     const expected = options.expectedPackageVersions[packageName];
     packages[packageName] = { declared, installed, expected };
@@ -3473,7 +3760,7 @@ function inspectTarget(options) {
       type: "asset-lock-drift",
       message: error instanceof Error ? error.message : String(error)
     });
-    if (!existsSync20(join19(target.path, ".pro-gov/assets.json"))) {
+    if (!existsSync19(join20(target.path, ".pro-gov/assets.json"))) {
       issues.push({ type: "bundle-drift", message: "Target asset manifest is missing." });
     }
   }
@@ -3484,19 +3771,20 @@ function inspectTarget(options) {
     packages,
     git: inspectGit(target.path),
     checks,
+    hostSsot,
     issues: deduplicateIssues(issues)
   };
 }
 function readTargetAssetHost(targetDir) {
-  const lockfile = readJson2(join19(targetDir, ".pro-gov/assets.lock.json"));
+  const lockfile = readJson2(join20(targetDir, ".pro-gov/assets.lock.json"));
   return isAssetRegistryHost(lockfile?.host) ? lockfile.host : void 0;
 }
 function isAssetRegistryHost(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
 function runTargetChecks(target) {
-  const proGovCli = join19(target.path, "node_modules/@pieai/pro-gov/dist/cli.js");
-  const docGovCli = join19(target.path, "node_modules/@pieai/doc-gov/dist/cli.js");
+  const proGovCli = join20(target.path, "node_modules/@pieai/pro-gov/dist/cli.js");
+  const docGovCli = join20(target.path, "node_modules/@pieai/doc-gov/dist/cli.js");
   const commands = [
     {
       name: "pro-gov doctor",
@@ -3507,7 +3795,7 @@ function runTargetChecks(target) {
     { name: "doc-gov scan --check", cli: docGovCli, args: ["scan", "--check"] }
   ];
   return commands.map((command2) => {
-    if (!existsSync20(command2.cli)) return { name: command2.name, status: null };
+    if (!existsSync19(command2.cli)) return { name: command2.name, status: null };
     const result = spawnSync5(process.execPath, [command2.cli, ...command2.args], {
       cwd: target.path,
       encoding: "utf8",
@@ -3546,16 +3834,16 @@ function getExpectedPackageVersions() {
   };
 }
 function findOwnPackageJson() {
-  let current = dirname11(fileURLToPath3(import.meta.url));
+  let current = dirname12(fileURLToPath3(import.meta.url));
   for (let depth = 0; depth < 5; depth += 1) {
-    const candidate = join19(current, "package.json");
-    if (existsSync20(candidate)) return candidate;
-    current = dirname11(current);
+    const candidate = join20(current, "package.json");
+    if (existsSync19(candidate)) return candidate;
+    current = dirname12(current);
   }
   return "";
 }
 function readJson2(path) {
-  if (!path || !existsSync20(path)) return void 0;
+  if (!path || !existsSync19(path)) return void 0;
   try {
     return JSON.parse(readFileSync14(path, "utf8"));
   } catch {
@@ -3576,34 +3864,50 @@ function deduplicateIssues(issues) {
 import { execFileSync } from "node:child_process";
 import {
   cpSync as cpSync2,
-  existsSync as existsSync21,
-  lstatSync as lstatSync6,
+  existsSync as existsSync20,
+  lstatSync as lstatSync8,
   mkdirSync as mkdirSync8,
   readFileSync as readFileSync15,
   readdirSync as readdirSync8,
-  realpathSync as realpathSync2,
+  realpathSync as realpathSync4,
   statSync as statSync4,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname12, join as join20, relative as relative8, resolve as resolve4, sep } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname13, join as join21, relative as relative8, resolve as resolve5, sep } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
+var CURRENT_ROUTER_VERSION = "1.1";
 function inspectPortfolioAiHealth(options) {
   const endpoints = collectEndpoints(options.manifest);
-  const secretsRoot = options.secretsRoot ?? join20(dirname12(options.manifest.controlPlane?.path ?? endpoints[0]?.endpoint.path ?? process.cwd()), ".secrets");
-  const homeDir = options.homeDir ?? process.env.HOME ?? "";
+  const secretsRoot = options.secretsRoot ?? join21(dirname13(options.manifest.controlPlane?.path ?? endpoints[0]?.endpoint.path ?? process.cwd()), ".secrets");
+  const homeDir = options.homeDir ?? process.env.HOME ?? homedir2();
+  const grokVersion = commandVersion("grok");
   const executionEngineRoot = options.manifest.executionEngine?.path;
   const skillRegistry = inspectSkillRegistry(executionEngineRoot);
-  const expectedPackageVersion = packageVersion(join20(executionEngineRoot ?? "", "packages/pro-gov/package.json"));
-  const repositories = endpoints.map(({ endpoint, role }) => inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion, options.manifest.technologyGovernance));
+  const expectedPackageVersion = packageVersion(join21(executionEngineRoot ?? "", "packages/pro-gov/package.json"));
+  const repositories = endpoints.map(({ endpoint, role }) => inspectRepository(
+    endpoint,
+    role,
+    secretsRoot,
+    homeDir,
+    expectedPackageVersion,
+    options.manifest.technologyGovernance,
+    grokVersion
+  ));
   const summary = { healthy: 0, attention: 0, unhealthy: 0 };
   for (const repository of repositories) summary[repository.status] += 1;
   return {
-    schemaVersion: 1,
+    schemaVersion: 4,
     portfolioId: options.manifest.portfolioId,
     generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    privacy: "Names, paths, counts, and configuration structure only. Secret values, environment values, MCP commands, arguments, and MCP environment maps are never collected.",
+    privacy: "Names, paths, counts, scopes, safe health states, and configuration origins only. Secret values, environment values, MCP commands, arguments, URLs, headers, MCP environment maps, and raw process environments are never retained or rendered.",
     secretsRoot: inspectSecretsRoot(secretsRoot),
-    userMcp: inspectUserMcp(homeDir),
+    hostEnvironment: inspectHostEnvironment(
+      homeDir,
+      grokVersion,
+      endpoints.map(({ endpoint }) => endpoint.path),
+      options.manifest.specialistChecks?.devspace
+    ),
     skillRegistry,
     technologyGovernance: {
       strategySource: options.manifest.technologyGovernance?.strategySource,
@@ -3618,15 +3922,15 @@ function writePortfolioAiHealthReport(report, outDir) {
   mkdirSync8(outDir, { recursive: true });
   const dashboardAssets = findDashboardAssets();
   for (const file of ["index.html", "app.js", "app.css"]) {
-    const source = join20(dashboardAssets, file);
-    if (!existsSync21(source)) throw new Error(`Portfolio dashboard asset is missing: ${source}`);
-    cpSync2(source, join20(outDir, file));
+    const source = join21(dashboardAssets, file);
+    if (!existsSync20(source)) throw new Error(`Portfolio dashboard asset is missing: ${source}`);
+    cpSync2(source, join21(outDir, file));
   }
-  const jsonPath = join20(outDir, "portfolio-ai-health.json");
-  const htmlPath = join20(outDir, "index.html");
+  const jsonPath = join21(outDir, "portfolio-ai-health.json");
+  const htmlPath = join21(outDir, "index.html");
   writeFileSync7(jsonPath, `${JSON.stringify(report, null, 2)}
 `);
-  writeFileSync7(join20(outDir, "data.js"), `window.__PORTFOLIO_AI_HEALTH__ = ${safeJavaScriptJson(report)};
+  writeFileSync7(join21(outDir, "data.js"), `window.__PORTFOLIO_AI_HEALTH__ = ${safeJavaScriptJson(report)};
 `);
   return { jsonPath, htmlPath };
 }
@@ -3637,23 +3941,28 @@ function collectEndpoints(manifest) {
   for (const target of manifest.targets) result.push({ endpoint: target, role: "target" });
   const seen = /* @__PURE__ */ new Set();
   return result.filter(({ endpoint }) => {
-    const key = resolve4(endpoint.path);
+    const key = resolve5(endpoint.path);
     if (seen.has(key)) return false;
     seen.add(key);
     return true;
   });
 }
-function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion, technologyGovernance) {
+function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackageVersion, technologyGovernance, grokVersion) {
   const root = endpoint.path;
   const git = inspectGit2(root);
   const entries = inspectEntries(root);
-  const skills = inspectSkills(root);
+  const grokInspection = inspectGrokProject(root, homeDir, grokVersion);
+  const skills = inspectSkills(root, grokInspection);
+  const hostSsot = inspectProjectHostSsot(root);
   const hooks = inspectHooks(root);
   const docs = inspectDocs(root, role === "execution-engine" ? void 0 : expectedPackageVersion);
   const mcp = {
-    root: jsonObjectKeys(join20(root, ".mcp.json"), "mcpServers"),
-    claudeCode: jsonObjectKeys(join20(root, ".claude/settings.json"), "mcpServers"),
-    codex: tomlMcpNames(join20(root, ".codex/config.toml"))
+    codexProject: tomlMcpNames(join21(root, ".codex/config.toml")),
+    claudeCodeProjectShared: jsonObjectKeys(join21(root, ".mcp.json"), "mcpServers"),
+    claudeCodeProjectLocal: claudeProjectLocalMcpNames(homeDir, root),
+    grokProject: tomlMcpNames(join21(root, ".grok/config.toml")),
+    grokEffective: grokInspection.effectiveMcp,
+    grokInspection: grokInspection.inspection
   };
   const secrets = inspectRepositorySecrets(root, endpoint.id, secretsRoot, git.isRepository, endpoint.environmentPolicy);
   const projectModel = inspectProjectModel(root, endpoint, technologyGovernance);
@@ -3675,6 +3984,9 @@ function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion,
   if (skills.canonical.some((skill) => skill.kind === "dangling-symlink")) recommendations.push("`.agents/skills` \u4E2D\u5B58\u5728\u65AD\u5F00\u7684\u6280\u80FD\u94FE\u63A5\u3002");
   if (skills.claudeCompatibility === "duplicate-directory") recommendations.push("`.claude/skills` \u662F\u72EC\u7ACB\u526F\u672C\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 `.agents/skills`\uFF0C\u907F\u514D\u53CC\u4EFD\u6280\u80FD\u6F02\u79FB\u3002");
   if (skills.claudeCompatibility === "dangling-symlink") recommendations.push("`.claude/skills` \u662F\u65AD\u5F00\u7684\u94FE\u63A5\u3002");
+  if (!hostSsot.claudeEntry.compliant) recommendations.push(`CLAUDE.md \u4E0D\u662F\u89C4\u8303\u7684\u76F8\u5BF9\u94FE\u63A5 AGENTS.md\uFF08${hostSsot.claudeEntry.status}\uFF09\u3002`);
+  if (!hostSsot.claudeSkills.compliant) recommendations.push(`.claude/skills \u4E0D\u662F\u89C4\u8303\u7684\u76F8\u5BF9\u94FE\u63A5 ../.agents/skills\uFF08${hostSsot.claudeSkills.status}\uFF09\u3002`);
+  if (hostSsot.canonicalSkills.status !== "directory") recommendations.push(`\u7F3A\u5C11\u89C4\u8303\u7684 .agents/skills \u6280\u80FD\u76EE\u5F55\uFF08${hostSsot.canonicalSkills.status}\uFF09\u3002`);
   if (hasWorkflowReminderHooks(hooks)) recommendations.push("\u53D1\u73B0 Stop/SubagentStop hook\uFF1B\u786E\u8BA4\u5B83\u662F\u5426\u4ECD\u6709\u9879\u76EE\u4E13\u5C5E\u7528\u9014\uFF0C\u5E76\u79FB\u9664\u9000\u4F11\u7684 PGS \u5DE5\u4F5C\u6D41\u63D0\u9192\u3002");
   const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
   const envNeedsCentralReview = liveEnv.filter((file) => !file.localOnly);
@@ -3683,6 +3995,7 @@ function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion,
   else if (envNeedsCentralReview.some((file) => !file.centralized)) recommendations.push("\u53D1\u73B0\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\u5C1A\u672A\u8FDE\u63A5\u5230\u672C\u9879\u76EE\u7684\u4E2D\u592E `.secrets` \u76EE\u5F55\uFF1B\u533A\u5206\u53EF\u4E22\u5F03\u751F\u6210\u7269\u4E0E\u672C\u5730\u4E3B\u6765\u6E90\uFF0C\u9700\u4FDD\u7559\u7684\u6765\u6E90\u5E94\u96C6\u4E2D\u540E\u518D\u63A5\u56DE\u9879\u76EE\u3002");
   if (hasUnsafeCentralSecretPermissions(secrets)) recommendations.push("\u4E2D\u592E\u5BC6\u94A5\u76EE\u5F55\u6216\u6587\u4EF6\u6743\u9650\u8FC7\u5BBD\uFF1B\u76EE\u5F55\u5E94\u4E3A 0700\uFF0C\u914D\u7F6E\u6587\u4EF6\u5E94\u4E3A 0600\u3002");
   if (!docs.packages.aligned) recommendations.push(`PGS \u5305\u7248\u672C\u672A\u4E0E\u6267\u884C\u5F15\u64CE ${docs.packages.expected ?? "\u672A\u77E5\u7248\u672C"} \u5BF9\u9F50\uFF1B\u53D1\u5E03\u4E0A\u6E38\u540E\u518D\u540C\u6B65\u76EE\u6807\u4ED3\u5E93\u3002`);
+  if (!docs.routerAligned) recommendations.push(`PGS Router \u7248\u672C\u4E3A ${docs.routerVersion ? `v${docs.routerVersion}` : "\u672A\u8BC6\u522B"}\uFF0C\u5E94\u540C\u6B65\u5230 v${docs.expectedRouterVersion}\u3002`);
   if (role === "target" && !docs.manifest) recommendations.push("\u7F3A\u5C11 docs/governance/MANIFEST.yml\uFF1B\u6587\u6863\u6E05\u5355\u65E0\u6CD5\u8BC1\u660E\u5DF2\u540C\u6B65\u3002");
   if (technologyGovernance && !projectModel.projectType) recommendations.push("\u672A\u58F0\u660E\u9879\u76EE\u7C7B\u578B\uFF1B\u65E0\u6CD5\u628A\u5B9E\u9645\u6280\u672F\u4E0E\u4EA7\u54C1\u7EBF\u57FA\u7EBF\u8FDB\u884C\u6BD4\u8F83\u3002");
   const missingBaseline = projectModel.baseline.filter((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
@@ -3694,27 +4007,29 @@ function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion,
     role,
     path: root,
     profile: "profile" in endpoint ? endpoint.profile : void 0,
-    status: deriveStatus(role, entries, git, hooks, skills, secrets, docs, projectModel, Boolean(technologyGovernance)),
+    status: deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, Boolean(technologyGovernance)),
     recommendations,
     git,
     entries,
     hooks,
     mcp,
     skills,
+    hostSsot,
     secrets,
     docs,
     projectModel
   };
 }
-function deriveStatus(role, entries, git, hooks, skills, secrets, docs, projectModel, technologyGovernanceConfigured) {
+function deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, technologyGovernanceConfigured) {
   if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || skills.canonical.some((item) => item.kind === "dangling-symlink") || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets)) return "unhealthy";
   const missingBaseline = projectModel.baseline.some((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
   const missingSelected = projectModel.optionalCapabilities.some((technology) => technology.selected && !technology.detected);
   const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
   const secretMaterializationNeedsReview = liveEnv.some((file) => !file.centralized && !file.localOnly);
   const packageVersionNeedsReview = docs.packages.expected !== void 0 && !docs.packages.aligned;
+  const routerVersionNeedsReview = !docs.routerAligned;
   const targetManifestMissing = role === "target" && !docs.manifest;
-  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected || packageVersionNeedsReview || targetManifestMissing) return "attention";
+  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || !hostSsot.compliant || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected || packageVersionNeedsReview || routerVersionNeedsReview || targetManifestMissing) return "attention";
   return "healthy";
 }
 function inspectProjectModel(root, endpoint, governance) {
@@ -3724,7 +4039,7 @@ function inspectProjectModel(root, endpoint, governance) {
   const detection = (id) => {
     const technology = technologyById.get(id);
     const packageMatch = technology?.packages?.some((name) => packages.has(name)) ?? false;
-    const fileMatch = technology?.files?.some((path) => existsSync21(join20(root, path))) ?? false;
+    const fileMatch = technology?.files?.some((path) => existsSync20(join21(root, path))) ?? false;
     return { id, label: technology?.label ?? id, detected: packageMatch || fileMatch };
   };
   const selected = new Set(endpoint.capabilities ?? []);
@@ -3747,10 +4062,10 @@ function collectPackageNames(root) {
   try {
     files = splitLines(execFileSync("git", ["ls-files", "*package.json"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }));
   } catch {
-    if (existsSync21(join20(root, "package.json"))) files = ["package.json"];
+    if (existsSync20(join21(root, "package.json"))) files = ["package.json"];
   }
   for (const file of files) {
-    const packageJson = readJson3(join20(root, file));
+    const packageJson = readJson3(join21(root, file));
     if (!isRecord3(packageJson)) continue;
     for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
       const dependencies = packageJson[section];
@@ -3788,15 +4103,15 @@ function inspectGit2(root) {
   };
 }
 function inspectEntries(root) {
-  const agentsPath = join20(root, "AGENTS.md");
-  const agents = !existsSync21(agentsPath) ? "missing" : safeRead(agentsPath).includes("PGS-ROUTER:BEGIN") ? "pgs-router" : "custom";
-  const claudePath = join20(root, "CLAUDE.md");
+  const agentsPath = join21(root, "AGENTS.md");
+  const agents = !existsSync20(agentsPath) ? "missing" : safeRead(agentsPath).includes("PGS-ROUTER:BEGIN") ? "pgs-router" : "custom";
+  const claudePath = join21(root, "CLAUDE.md");
   let claude = "missing";
   if (pathLexists(claudePath)) {
-    const info = lstatSync6(claudePath);
+    const info = lstatSync8(claudePath);
     if (info.isSymbolicLink()) {
       try {
-        claude = realpathSync2(claudePath) === realpathSync2(agentsPath) ? "agents-symlink" : "custom";
+        claude = realpathSync4(claudePath) === realpathSync4(agentsPath) ? "agents-symlink" : "custom";
       } catch {
         claude = "dangling-symlink";
       }
@@ -3808,12 +4123,12 @@ function inspectEntries(root) {
   return { agents, claude, gemini: inspectOptionalEntry(root, "GEMINI.md", agentsPath) };
 }
 function inspectOptionalEntry(root, filename, agentsPath) {
-  const path = join20(root, filename);
+  const path = join21(root, filename);
   if (!pathLexists(path)) return "missing";
-  const info = lstatSync6(path);
+  const info = lstatSync8(path);
   if (info.isSymbolicLink()) {
     try {
-      return realpathSync2(path) === realpathSync2(agentsPath) ? "agents-symlink" : "custom";
+      return realpathSync4(path) === realpathSync4(agentsPath) ? "agents-symlink" : "custom";
     } catch {
       return "dangling-symlink";
     }
@@ -3821,8 +4136,8 @@ function inspectOptionalEntry(root, filename, agentsPath) {
   const content = safeRead(path);
   return /AGENTS\.md/.test(content) && content.length < 2e3 ? "thin-adapter" : "custom";
 }
-function inspectSkills(root) {
-  const lock = readJson3(join20(root, ".pro-gov/assets.lock.json"));
+function inspectSkills(root, grokInspection) {
+  const lock = readJson3(join21(root, ".pro-gov/assets.lock.json"));
   const managed = /* @__PURE__ */ new Set();
   const bundleIds = stringArray(isRecord3(lock) ? lock.bundleIds : void 0);
   if (isRecord3(lock) && Array.isArray(lock.assets)) {
@@ -3832,14 +4147,14 @@ function inspectSkills(root) {
       if (match) managed.add(match[1]);
     }
   }
-  const skillRoot = join20(root, ".agents/skills");
+  const skillRoot = join21(root, ".agents/skills");
   const canonical = pathLexists(skillRoot) && safeIsDirectory(skillRoot) ? safeReadDir(skillRoot).filter((name) => !name.startsWith(".")).map((name) => {
-    const path = join20(skillRoot, name);
-    const stat = lstatSync6(path);
+    const path = join21(skillRoot, name);
+    const stat = lstatSync8(path);
     let kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : "file";
     if (stat.isSymbolicLink()) {
       try {
-        realpathSync2(path);
+        realpathSync4(path);
       } catch {
         kind = "dangling-symlink";
       }
@@ -3857,17 +4172,23 @@ function inspectSkills(root) {
       installed: canonical.filter((item) => item.managed && item.kind !== "dangling-symlink").length,
       discoverable: canonical.filter((item) => item.kind !== "dangling-symlink").length,
       runtime: "unobservable"
+    },
+    hosts: {
+      codexProject: canonical.filter((item) => item.kind !== "dangling-symlink").length,
+      claudeCodeProject: inspectSkillRoot(join21(root, ".claude/skills")).names.length,
+      grokNativeProject: inspectSkillRoot(join21(root, ".grok/skills")).names.length,
+      grokEffective: grokInspection.skills
     }
   };
 }
 function inspectClaudeSkillRoot(root) {
-  const path = join20(root, ".claude/skills");
+  const path = join21(root, ".claude/skills");
   if (!pathLexists(path)) return "missing";
-  const stat = lstatSync6(path);
+  const stat = lstatSync8(path);
   if (stat.isSymbolicLink()) {
     try {
-      const target = realpathSync2(path);
-      return target === realpathSync2(join20(root, ".agents/skills")) ? "shared-root" : "other";
+      const target = realpathSync4(path);
+      return target === realpathSync4(join21(root, ".agents/skills")) ? "shared-root" : "other";
     } catch {
       return "dangling-symlink";
     }
@@ -3875,7 +4196,7 @@ function inspectClaudeSkillRoot(root) {
   return stat.isDirectory() ? "duplicate-directory" : "other";
 }
 function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environmentPolicy) {
-  const centralPath = join20(secretsRoot, id);
+  const centralPath = join21(secretsRoot, id);
   const centralRealPath = safeRealpath(centralPath);
   const localOnlyReasons = new Map(
     (environmentPolicy?.localOnly ?? []).map((entry) => [entry.path, entry.reason])
@@ -3887,16 +4208,16 @@ function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environme
       tracked: isRepository ? gitTracks(root, path) : false,
       template: isEnvironmentTemplate(path),
       fixture: isEnvironmentFixture(path),
-      symlink: lstatSync6(join20(root, path)).isSymbolicLink(),
-      centralized: pointsInside(join20(root, path), centralRealPath),
+      symlink: lstatSync8(join21(root, path)).isSymbolicLink(),
+      centralized: pointsInside(join21(root, path), centralRealPath),
       localOnly: localOnlyReason !== void 0,
       ...localOnlyReason !== void 0 ? { localOnlyReason } : {}
     };
   });
   return {
-    centralDirectory: existsSync21(centralPath) ? "present" : "absent",
-    centralMode: existsSync21(centralPath) ? modeString(statSync4(centralPath).mode) : void 0,
-    centralFiles: existsSync21(centralPath) ? collectCentralSecretFiles(centralPath) : [],
+    centralDirectory: existsSync20(centralPath) ? "present" : "absent",
+    centralMode: existsSync20(centralPath) ? modeString(statSync4(centralPath).mode) : void 0,
+    centralFiles: existsSync20(centralPath) ? collectCentralSecretFiles(centralPath) : [],
     repositoryEnvFiles: envFiles
   };
 }
@@ -3907,9 +4228,9 @@ function collectEnvironmentFiles(root, current = root, depth = 0) {
   try {
     for (const entry of readdirSync8(current, { withFileTypes: true })) {
       if (entry.isDirectory()) {
-        if (!SKIP_ENV_DIRECTORIES.has(entry.name)) found.push(...collectEnvironmentFiles(root, join20(current, entry.name), depth + 1));
+        if (!SKIP_ENV_DIRECTORIES.has(entry.name)) found.push(...collectEnvironmentFiles(root, join21(current, entry.name), depth + 1));
       } else if (isEnvironmentFilename(entry.name) && !isProviderGeneratedEnvironmentFile(entry.name)) {
-        found.push(relative8(root, join20(current, entry.name)));
+        found.push(relative8(root, join21(current, entry.name)));
       }
     }
   } catch {
@@ -3922,9 +4243,9 @@ function collectCentralSecretFiles(root, current = root, depth = 0) {
   const found = [];
   try {
     for (const entry of readdirSync8(current, { withFileTypes: true })) {
-      const path = join20(current, entry.name);
+      const path = join21(current, entry.name);
       if (entry.isDirectory()) found.push(...collectCentralSecretFiles(root, path, depth + 1));
-      else found.push({ path: relative8(root, path), mode: modeString(lstatSync6(path).mode) });
+      else found.push({ path: relative8(root, path), mode: modeString(lstatSync8(path).mode) });
     }
   } catch {
     return found;
@@ -3949,13 +4270,13 @@ function isEnvironmentFixture(path) {
 }
 function safeRealpath(path) {
   try {
-    return realpathSync2(path);
+    return realpathSync4(path);
   } catch {
     return void 0;
   }
 }
 function pointsInside(path, expectedRoot) {
-  if (!expectedRoot || !lstatSync6(path).isSymbolicLink()) return false;
+  if (!expectedRoot || !lstatSync8(path).isSymbolicLink()) return false;
   const target = safeRealpath(path);
   if (!target) return false;
   const fromRoot = relative8(expectedRoot, target);
@@ -3965,15 +4286,251 @@ function hasUnsafeCentralSecretPermissions(secrets) {
   return secrets.centralDirectory === "present" && (secrets.centralMode !== "700" || secrets.centralFiles.some((file) => file.mode !== "600"));
 }
 function inspectSecretsRoot(path) {
-  return existsSync21(path) ? { path, exists: true, mode: modeString(statSync4(path).mode) } : { path, exists: false };
-}
-function inspectUserMcp(homeDir) {
-  if (!homeDir) return { codex: [], claudeCode: [] };
+  return existsSync20(path) ? { path, exists: true, mode: modeString(statSync4(path).mode) } : { path, exists: false };
+}
+function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceSettings) {
+  const codexConfig = join21(homeDir, ".codex/config.toml");
+  const claudeConfig = join21(homeDir, ".claude.json");
+  const grokConfig = join21(homeDir, ".grok/config.toml");
+  const hostEnvironment = {
+    mcp: {
+      codexUser: { path: codexConfig, names: tomlMcpNames(codexConfig) },
+      claudeCodeUser: { path: claudeConfig, names: jsonObjectKeys(claudeConfig, "mcpServers") },
+      grokUser: { path: grokConfig, names: tomlMcpNames(grokConfig) }
+    },
+    skills: {
+      codexUser: inspectSkillRoot(join21(homeDir, ".agents/skills")),
+      claudeCodeUser: inspectSkillRoot(join21(homeDir, ".claude/skills")),
+      grokUser: inspectSkillRoot(join21(homeDir, ".grok/skills")),
+      grokAgentsCompatibility: inspectSkillRoot(join21(homeDir, ".agents/skills")),
+      grokClaudeCompatibility: inspectSkillRoot(join21(homeDir, ".claude/skills")),
+      ssot: inspectUserSkillsSsot(homeDir)
+    },
+    grok: {
+      available: grokVersion !== void 0,
+      ...grokVersion ? { version: grokVersion } : {},
+      inspectionCommand: "grok inspect --json"
+    }
+  };
+  if (devspaceSettings) {
+    hostEnvironment.devspace = inspectDevSpaceHealth({
+      homeDir,
+      repositoryPaths,
+      expectedToolMode: devspaceSettings.expectedToolMode
+    });
+  }
+  return hostEnvironment;
+}
+function inspectDevSpaceHealth(options) {
+  const run = options.run ?? runDevSpaceCommand;
+  const configDirectory = join21(options.homeDir, ".devspace");
+  const configPath = join21(configDirectory, "config.json");
+  const authPath = join21(configDirectory, "auth.json");
+  const installedResult = run("devspace", ["--version"], 3e3);
+  const installedVersion = installedResult.ok ? installedResult.stdout.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/)?.[0] : void 0;
+  const latestResult = run("npm", ["view", "@waishnav/devspace", "version", "--registry=https://registry.npmjs.org/"], 5e3);
+  const latestVersion = latestResult.ok ? latestResult.stdout.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/)?.[0] : void 0;
+  const processResult = run("pgrep", ["-f", "devspace serve"], 3e3);
+  const pid = processResult.ok ? processResult.stdout.match(/\b\d+\b/)?.[0] : void 0;
+  const processEnvironment = pid ? run("ps", ["eww", "-p", pid, "-o", "command="], 3e3) : void 0;
+  const processToolMode = processEnvironment?.ok ? processEnvironment.stdout.match(/(?:^|\s)DEVSPACE_TOOL_MODE=(minimal|full|codex)(?:\s|$)/)?.[1] : void 0;
+  const doctor = !installedResult.ok ? "unavailable" : run("devspace", ["doctor"], 1e4).ok ? "ok" : "failed";
+  const configValue = readJson3(configPath);
+  const configExists = isRecord3(configValue);
+  const allowedRoots = configExists && Array.isArray(configValue.allowedRoots) ? configValue.allowedRoots.filter((value) => typeof value === "string") : [];
+  const portfolioCoverage = !configExists || allowedRoots.length === 0 ? "unknown" : options.repositoryPaths.every((repositoryPath) => allowedRoots.some((root) => isPathInside(repositoryPath, root))) ? "complete" : "partial";
+  const bind = configExists && typeof configValue.host === "string" ? isLoopbackHost(configValue.host) ? "loopback" : "non-loopback" : "unknown";
+  const directoryMode = existsSync20(configDirectory) ? modeString(statSync4(configDirectory).mode) : void 0;
+  const fileMode = existsSync20(configPath) ? modeString(statSync4(configPath).mode) : void 0;
+  const authMode = existsSync20(authPath) ? modeString(statSync4(authPath).mode) : void 0;
+  const update = installedVersion && latestVersion ? installedVersion === latestVersion ? "current" : "available" : "unknown";
+  const recommendations = [];
+  let status = "healthy";
+  const unhealthy = (message) => {
+    status = "unhealthy";
+    recommendations.push(message);
+  };
+  const attention = (message) => {
+    if (status === "healthy") status = "attention";
+    recommendations.push(message);
+  };
+  if (!installedResult.ok) unhealthy("\u672C\u673A\u672A\u53D1\u73B0 DevSpace\uFF1B\u65E0\u6CD5\u4F7F\u7528\u5BBF\u4E3B\u5DE5\u4F5C\u533A\u670D\u52A1\u3002");
+  if (!configExists) unhealthy("\u7F3A\u5C11 ~/.devspace/config.json\u3002");
+  if (!existsSync20(authPath)) unhealthy("\u7F3A\u5C11 ~/.devspace/auth.json\u3002");
+  if (directoryMode && directoryMode !== "700") unhealthy(`~/.devspace \u76EE\u5F55\u6743\u9650\u4E3A ${directoryMode}\uFF0C\u5E94\u6536\u7D27\u4E3A 700\u3002`);
+  if (fileMode && fileMode !== "600") unhealthy(`DevSpace \u914D\u7F6E\u6587\u4EF6\u6743\u9650\u4E3A ${fileMode}\uFF0C\u5E94\u4E3A 600\u3002`);
+  if (authMode && authMode !== "600") unhealthy(`DevSpace \u8BA4\u8BC1\u6587\u4EF6\u6743\u9650\u4E3A ${authMode}\uFF0C\u5E94\u4E3A 600\u3002`);
+  if (bind === "non-loopback") unhealthy("DevSpace \u76F4\u63A5\u7ED1\u5B9A\u5230\u975E\u672C\u673A\u5730\u5740\uFF1B\u5E94\u4F7F\u7528 loopback \u5E76\u7531\u53D7\u63A7\u4EE3\u7406\u66B4\u9732\u3002");
+  if (doctor === "failed") unhealthy("devspace doctor \u672A\u901A\u8FC7\u3002");
+  if (portfolioCoverage === "partial") attention("DevSpace allowedRoots \u6CA1\u6709\u8986\u76D6\u5168\u90E8\u5DF2\u767B\u8BB0\u4ED3\u5E93\u3002");
+  if (installedResult.ok && !pid) attention("DevSpace \u5DF2\u5B89\u88C5\u4F46\u5F53\u524D\u6CA1\u6709\u8FD0\u884C\u3002");
+  if (options.expectedToolMode && pid && processToolMode !== options.expectedToolMode) {
+    attention(`\u8FD0\u884C\u4E2D\u7684 DevSpace \u5DE5\u5177\u6A21\u5F0F\u4E3A ${processToolMode ?? "unknown"}\uFF0C\u671F\u671B ${options.expectedToolMode}\u3002`);
+  }
+  if (update === "available") attention(`DevSpace \u6709\u65B0\u7248\u672C\uFF1A${installedVersion} \u2192 ${latestVersion}\uFF1B\u5347\u7EA7\u524D\u4ECD\u5E94\u68C0\u67E5\u53D8\u66F4\u4E0E\u517C\u5BB9\u6027\u3002`);
   return {
-    codex: tomlMcpNames(join20(homeDir, ".codex/config.toml")),
-    claudeCode: jsonObjectKeys(join20(homeDir, ".claude/settings.json"), "mcpServers")
+    status,
+    installed: installedResult.ok,
+    ...installedVersion ? { installedVersion } : {},
+    ...latestVersion ? { latestVersion } : {},
+    update,
+    doctor,
+    running: Boolean(pid),
+    ...options.expectedToolMode ? { expectedToolMode: options.expectedToolMode } : {},
+    processToolMode: processToolMode ?? "unknown",
+    config: {
+      exists: configExists,
+      ...directoryMode ? { directoryMode } : {},
+      ...fileMode ? { fileMode } : {},
+      authExists: existsSync20(authPath),
+      ...authMode ? { authMode } : {},
+      bind,
+      portValid: configExists && typeof configValue.port === "number" && Number.isInteger(configValue.port) && configValue.port > 0 && configValue.port <= 65535,
+      publicHttpsConfigured: configExists && typeof configValue.publicBaseUrl === "string" && configValue.publicBaseUrl.startsWith("https://"),
+      allowedRootCount: allowedRoots.length,
+      portfolioCoverage
+    },
+    recommendations
   };
 }
+function runDevSpaceCommand(command2, args, timeout) {
+  try {
+    return {
+      ok: true,
+      stdout: execFileSync(command2, args, {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout
+      })
+    };
+  } catch {
+    return { ok: false, stdout: "" };
+  }
+}
+function isLoopbackHost(host) {
+  return ["127.0.0.1", "localhost", "::1"].includes(host.trim().toLowerCase());
+}
+function isPathInside(path, root) {
+  const fromRoot = relative8(resolve5(root), resolve5(path));
+  return fromRoot === "" || fromRoot !== ".." && !fromRoot.startsWith(`..${sep}`);
+}
+function inspectSkillRoot(path) {
+  const exists = pathLexists(path) && safeIsDirectory(path);
+  const names = exists ? safeReadDir(path).filter((name) => !name.startsWith(".") && existsSync20(join21(path, name, "SKILL.md"))) : [];
+  return { path, exists, names };
+}
+function claudeProjectLocalMcpNames(homeDir, root) {
+  if (!homeDir) return [];
+  const value = readJson3(join21(homeDir, ".claude.json"));
+  if (!isRecord3(value) || !isRecord3(value.projects)) return [];
+  const candidates = new Set([resolve5(root), safeRealpath(root)].filter((path) => Boolean(path)));
+  const names = /* @__PURE__ */ new Set();
+  for (const [path, project] of Object.entries(value.projects)) {
+    const projectPaths = [resolve5(path), safeRealpath(path)].filter((candidate) => Boolean(candidate));
+    if (!projectPaths.some((candidate) => candidates.has(candidate)) || !isRecord3(project) || !isRecord3(project.mcpServers)) continue;
+    for (const name of Object.keys(project.mcpServers)) names.add(name);
+  }
+  return [...names].sort();
+}
+function commandVersion(command2) {
+  try {
+    const output = execFileSync(command2, ["version"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 3e3
+    });
+    return output.match(/\b\d+\.\d+\.\d+\b/)?.[0];
+  } catch {
+    return void 0;
+  }
+}
+function inspectGrokProject(root, homeDir, grokVersion) {
+  const empty = (inspection) => ({
+    inspection,
+    effectiveMcp: [],
+    skills: { inspection, total: 0, project: 0, userOrCompatible: 0, plugin: 0, bundled: 0 },
+    claudeCompatibility: "unknown",
+    cursorCompatibility: "unknown"
+  });
+  if (!grokVersion) return empty("unavailable");
+  try {
+    const value = JSON.parse(execFileSync("grok", ["inspect", "--json"], {
+      cwd: root,
+      encoding: "utf8",
+      env: { ...process.env, HOME: homeDir, GROK_HOME: join21(homeDir, ".grok") },
+      maxBuffer: 10 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 8e3
+    }));
+    if (!isRecord3(value)) return empty("failed");
+    const userClaudeNames = new Set(jsonObjectKeys(join21(homeDir, ".claude.json"), "mcpServers"));
+    const localClaudeNames = new Set(claudeProjectLocalMcpNames(homeDir, root));
+    const effectiveMcp = Array.isArray(value.mcpServers) ? value.mcpServers.flatMap((item) => {
+      if (!isRecord3(item) || typeof item.name !== "string") return [];
+      const source = isRecord3(item.source) ? item.source : {};
+      const sourceType = typeof source.type === "string" ? source.type : "unknown";
+      const sourcePath = typeof source.path === "string" ? source.path : void 0;
+      const vendor = typeof item.vendor === "string" ? item.vendor : sourceType;
+      return [{
+        name: item.name,
+        vendor,
+        scope: inferGrokMcpScope(item.name, sourceType, sourcePath, root, homeDir, userClaudeNames, localClaudeNames),
+        sourceType,
+        ...sourcePath ? { sourcePath } : {}
+      }];
+    }) : [];
+    const skillCounts = { project: 0, userOrCompatible: 0, plugin: 0, bundled: 0 };
+    if (Array.isArray(value.skills)) {
+      for (const item of value.skills) {
+        if (!isRecord3(item) || !isRecord3(item.source)) continue;
+        const type = item.source.type;
+        const path = item.source.path;
+        if (typeof path === "string" && path.includes(sep + ".grok" + sep + "bundled" + sep)) skillCounts.bundled += 1;
+        else if (type === "project") skillCounts.project += 1;
+        else if (type === "plugin") skillCounts.plugin += 1;
+        else skillCounts.userOrCompatible += 1;
+      }
+    }
+    const cells = isRecord3(value.externalCompat) && Array.isArray(value.externalCompat.cells) ? value.externalCompat.cells : [];
+    return {
+      inspection: "ok",
+      effectiveMcp,
+      skills: {
+        inspection: "ok",
+        total: skillCounts.project + skillCounts.userOrCompatible + skillCounts.plugin + skillCounts.bundled,
+        ...skillCounts
+      },
+      claudeCompatibility: compatibilityEnabled(cells, "claude"),
+      cursorCompatibility: compatibilityEnabled(cells, "cursor")
+    };
+  } catch {
+    return empty("failed");
+  }
+}
+function compatibilityEnabled(cells, vendor) {
+  const matching = cells.filter((cell) => isRecord3(cell) && cell.vendor === vendor);
+  if (matching.length === 0) return "unknown";
+  return matching.some((cell) => isRecord3(cell) && cell.enabled === true);
+}
+function inferGrokMcpScope(name, sourceType, sourcePath, root, homeDir, userClaudeNames, localClaudeNames) {
+  if (!sourcePath) {
+    if (sourceType === "project") return "project";
+    if (localClaudeNames.has(name)) return "project-local";
+    if (userClaudeNames.has(name)) return "user";
+    return "unknown";
+  }
+  const resolvedSource = safeRealpath(sourcePath) ?? resolve5(sourcePath);
+  const resolvedRoot = safeRealpath(root) ?? resolve5(root);
+  if (resolvedSource === join21(resolvedRoot, ".mcp.json")) return "project-shared";
+  if (resolvedSource.startsWith(resolvedRoot + sep)) return "project";
+  if (homeDir && resolvedSource === join21(resolve5(homeDir), ".claude.json")) {
+    if (localClaudeNames.has(name)) return "project-local";
+    if (userClaudeNames.has(name)) return "user";
+  }
+  if (homeDir && resolvedSource.startsWith(resolve5(homeDir) + sep)) return "user";
+  if (sourceType === "project") return "project";
+  return "unknown";
+}
 var HOOK_EVENT_NAMES = /* @__PURE__ */ new Set([
   "PreToolUse",
   "PostToolUse",
@@ -4001,7 +4558,7 @@ function inspectHooks(root) {
     { host: "codex", path: ".codex/hooks.json" }
   ];
   return configs.map((config) => {
-    const value = readJson3(join20(root, config.path));
+    const value = readJson3(join21(root, config.path));
     const counts = /* @__PURE__ */ new Map();
     collectHookEvents(value, counts);
     return {
@@ -4022,16 +4579,18 @@ function collectHookEvents(value, counts) {
   }
 }
 function inspectDocs(root, expected) {
-  const packageJson = readJson3(join20(root, "package.json"));
+  const packageJson = readJson3(join21(root, "package.json"));
   const dependencies = isRecord3(packageJson) ? { ...recordOrEmpty(packageJson.dependencies), ...recordOrEmpty(packageJson.devDependencies) } : {};
   const docGov = dependencyVersion(dependencies["@pieai/doc-gov"]);
   const proGov = dependencyVersion(dependencies["@pieai/pro-gov"]);
-  const routerMatch = safeRead(join20(root, "AGENTS.md")).match(/PGS-ROUTER:BEGIN\s+v([0-9.]+)/);
+  const routerMatch = safeRead(join21(root, "AGENTS.md")).match(/PGS-ROUTER:BEGIN\s+v([0-9.]+)/);
   const declared = [docGov, proGov].filter((value) => Boolean(value));
   return {
     routerVersion: routerMatch?.[1],
-    manifest: existsSync21(join20(root, "docs/governance/MANIFEST.yml")),
-    currentWork: existsSync21(join20(root, "docs/reference/execution/current-work.md")),
+    expectedRouterVersion: CURRENT_ROUTER_VERSION,
+    routerAligned: routerMatch?.[1] === CURRENT_ROUTER_VERSION,
+    manifest: existsSync20(join21(root, "docs/governance/MANIFEST.yml")),
+    currentWork: existsSync20(join21(root, "docs/reference/execution/current-work.md")),
     packages: {
       expected,
       docGov,
@@ -4054,20 +4613,20 @@ function recordOrEmpty(value) {
 }
 function inspectSkillRegistry(executionEngineRoot) {
   if (!executionEngineRoot) return { source: 0, registered: 0, bundled: 0, bundles: 0 };
-  const agentAssetsRoot = join20(executionEngineRoot, "agent-assets");
-  const registry = readJson3(join20(agentAssetsRoot, "registry.json"));
+  const agentAssetsRoot = join21(executionEngineRoot, "agent-assets");
+  const registry = readJson3(join21(agentAssetsRoot, "registry.json"));
   const assets = isRecord3(registry) && Array.isArray(registry.assets) ? registry.assets : [];
   const registeredSkills = assets.filter((asset) => isRecord3(asset) && asset.kind === "skill");
-  const bundleRoot = join20(agentAssetsRoot, "bundles");
+  const bundleRoot = join21(agentAssetsRoot, "bundles");
   const bundleFiles = safeReadDir(bundleRoot).filter((file) => file.endsWith(".json"));
   const bundledIds = /* @__PURE__ */ new Set();
   for (const file of bundleFiles) {
-    const bundle = readJson3(join20(bundleRoot, file));
+    const bundle = readJson3(join21(bundleRoot, file));
     if (!isRecord3(bundle) || !Array.isArray(bundle.assets)) continue;
     for (const id of bundle.assets) if (typeof id === "string") bundledIds.add(id);
   }
-  const sourceRoots = [join20(agentAssetsRoot, "skills/pie-skills"), join20(agentAssetsRoot, "skills/npx-skills/.agents/skills")];
-  const source = sourceRoots.reduce((count, root) => count + safeReadDir(root).filter((name) => existsSync21(join20(root, name, "SKILL.md"))).length, 0);
+  const sourceRoots = [join21(agentAssetsRoot, "skills/pie-skills"), join21(agentAssetsRoot, "skills/npx-skills/.agents/skills")];
+  const source = sourceRoots.reduce((count, root) => count + safeReadDir(root).filter((name) => existsSync20(join21(root, name, "SKILL.md"))).length, 0);
   return {
     source,
     registered: registeredSkills.length,
@@ -4081,7 +4640,7 @@ function jsonObjectKeys(path, key) {
   return Object.keys(value[key]).sort();
 }
 function tomlMcpNames(path) {
-  if (!existsSync21(path)) return [];
+  if (!existsSync20(path)) return [];
   const names = /* @__PURE__ */ new Set();
   for (const line of safeRead(path).split(/\r?\n/)) {
     const match = line.match(/^\s*\[mcp_servers\.(?:"([^"]+)"|([^\.\]]+))\]\s*$/);
@@ -4120,7 +4679,7 @@ function safeIsDirectory(path) {
 }
 function pathLexists(path) {
   try {
-    lstatSync6(path);
+    lstatSync8(path);
     return true;
   } catch {
     return false;
@@ -4147,14 +4706,17 @@ function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function findDashboardAssets() {
-  const packageRoot2 = dirname12(dirname12(fileURLToPath4(import.meta.url)));
+  const packageRoot2 = dirname13(dirname13(fileURLToPath4(import.meta.url)));
   const candidates = [
     process.env.PGS_DASHBOARD_ASSETS_DIR,
-    join20(packageRoot2, "assets/portfolio-dashboard"),
-    join20(process.cwd(), "assets/portfolio-dashboard"),
-    join20(process.cwd(), "packages/pro-gov/assets/portfolio-dashboard")
+    join21(packageRoot2, ".dashboard-build"),
+    join21(packageRoot2, "assets/portfolio-dashboard"),
+    join21(process.cwd(), ".dashboard-build"),
+    join21(process.cwd(), "assets/portfolio-dashboard"),
+    join21(process.cwd(), "packages/pro-gov/.dashboard-build"),
+    join21(process.cwd(), "packages/pro-gov/assets/portfolio-dashboard")
   ].filter((value) => Boolean(value));
-  const match = candidates.find((path) => existsSync21(join20(path, "index.html")));
+  const match = candidates.find((path) => existsSync20(join21(path, "index.html")));
   if (!match) throw new Error("Portfolio dashboard assets were not built. Run pnpm --filter @pieai/pro-gov build.");
   return match;
 }
@@ -4244,12 +4806,22 @@ function runPortfolioDoctor(args) {
   const output = { configPath: loaded.configPath, ...result };
   if (options.value.json) {
     console.log(JSON.stringify(output, null, 2));
-  } else if (result.ok) {
-    console.log(`portfolio doctor passed (${targets.length} targets)`);
   } else {
-    for (const issue of result.hostTooling.issues) console.log(`${issue.host}	${issue.type}: ${issue.message}`);
+    for (const warning of result.hostSsot.userSkills.issues) {
+      console.log(`user	host-ssot-warning: ${warning}`);
+    }
     for (const target of result.targets) {
-      for (const issue of target.issues) console.log(`${target.id}	${issue.type}: ${issue.message}`);
+      for (const warning of target.hostSsot.issues) {
+        console.log(`${target.id}	host-ssot-warning: ${warning}`);
+      }
+    }
+    if (result.ok) {
+      console.log(`portfolio doctor passed (${targets.length} targets)`);
+    } else {
+      for (const issue of result.hostTooling.issues) console.log(`${issue.host}	${issue.type}: ${issue.message}`);
+      for (const target of result.targets) {
+        for (const issue of target.issues) console.log(`${target.id}	${issue.type}: ${issue.message}`);
+      }
     }
   }
   return result.ok ? 0 : 1;
@@ -4506,8 +5078,8 @@ function isHost2(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
 function findPortfolioAgentAssetsDir(manifest) {
-  const agentAssetsDir = manifest?.executionEngine?.path ? join21(manifest.executionEngine.path, "agent-assets") : void 0;
-  return agentAssetsDir && existsSync22(join21(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
+  const agentAssetsDir = manifest?.executionEngine?.path ? join22(manifest.executionEngine.path, "agent-assets") : void 0;
+  return agentAssetsDir && existsSync21(join22(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
 }
 function printUsage4() {
   console.error("Usage:");
@@ -4519,8 +5091,8 @@ function printUsage4() {
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync23, readFileSync as readFileSync16 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync22, lstatSync as lstatSync9, readFileSync as readFileSync16, readlinkSync as readlinkSync4 } from "node:fs";
+import { join as join23 } from "node:path";
 function runSync(args) {
   const check = args.includes("--check");
   if (!check) {
@@ -4548,8 +5120,9 @@ function runSync(args) {
   console.log("pro-gov sync check");
   console.log(`profile: ${profile}`);
   for (const file of planStarterFiles(profile)) {
-    const targetPath = join22(process.cwd(), file.targetPath);
-    if (!existsSync23(targetPath)) {
+    const targetPath = join23(process.cwd(), file.targetPath);
+    const stat = safeLstat3(targetPath);
+    if (!stat) {
       if (file.ownership === "optional-guardrail") continue;
       console.log(`missing: ${file.targetPath}`);
       differences += 1;
@@ -4557,6 +5130,20 @@ function runSync(args) {
     }
     if (file.ownership === "optional-guardrail") continue;
     if (file.ownership === "project-local-seed") continue;
+    if (file.kind === "directory") {
+      if (!stat.isDirectory()) {
+        console.log(`different: ${file.targetPath}`);
+        differences += 1;
+      }
+      continue;
+    }
+    if (file.kind === "symlink") {
+      if (!stat.isSymbolicLink() || readlinkSync4(targetPath) !== file.linkTarget) {
+        console.log(`different: ${file.targetPath}`);
+        differences += 1;
+      }
+      continue;
+    }
     const source = readFileSync16(file.absoluteSourcePath, "utf8");
     const target = readFileSync16(targetPath, "utf8");
     if (!matchesExpectedContent(file.targetPath, source, target)) {
@@ -4592,10 +5179,17 @@ function normalizeMarkdownTableCell(cell) {
 }
 function inferInstalledProfile(root) {
   const installed = ["engineering-runtime", "doc-only"].filter(
-    (profile) => existsSync23(join22(root, `docs/governance/agents-routing/${profile}-v1.0.md`))
+    (profile) => existsSync22(join23(root, `docs/governance/agents-routing/${profile}-v1.1.md`))
   );
   return installed.length === 1 ? installed[0] : void 0;
 }
+function safeLstat3(path) {
+  try {
+    return lstatSync9(path);
+  } catch {
+    return void 0;
+  }
+}
 function readFlag2(args, flag) {
   const index = args.indexOf(flag);
   const value = index >= 0 ? args[index + 1] : void 0;