@pieai/pro-gov 0.5.4 → 0.7.0

package/dist/cli.js

@@ -565,7 +565,7 @@ import {
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync2,
   readlinkSync as readlinkSync2,
-  realpathSync,
+  realpathSync as realpathSync2,
   symlinkSync,
   unlinkSync,
   writeFileSync
@@ -573,7 +573,7 @@ import {
 import { dirname as dirname4, join as join8, relative as relative4, resolve as resolve2 } from "node:path";
 
 // src/asset-targets/install-plan.ts
-import { existsSync as existsSync7, lstatSync as lstatSync2, readFileSync as readFileSync4, readlinkSync } from "node:fs";
+import { existsSync as existsSync7, lstatSync as lstatSync2, readFileSync as readFileSync4, readlinkSync, realpathSync } from "node:fs";
 import { basename, dirname as dirname3, join as join7, resolve } from "node:path";
 function createAssetInstallPlan(options) {
   const placement = options.placement ?? "registry";
@@ -589,10 +589,19 @@ function createAssetInstallPlan(options) {
     return asset;
   });
   const lockEntries = createAgentAssetLockEntries(options.registry, options.agentAssetsDir, assetIds);
-  const managedEntries = readManagedEntries(options.targetDir);
+  const managedLock = readManagedLock(options.targetDir);
+  const managedEntries = managedLock.entries;
   const managedTargets = new Set(managedEntries.map((entry) => entry.targetPath));
+  const legacyAdoptions = createLegacyClaudeAdoptions({
+    targetDir: options.targetDir,
+    agentAssetsDir: options.agentAssetsDir,
+    managedLock,
+    assets,
+    host: options.host,
+    placement
+  });
   const assetActions = assets.map(
-    (asset) => createAssetAction(asset, options.agentAssetsDir, options.targetDir, options.host, placement, managedTargets)
+    (asset) => legacyAdoptions.byAssetId.get(asset.id) ?? createAssetAction(asset, options.agentAssetsDir, options.targetDir, options.host, placement, managedTargets)
   );
   const manifest = {
     schemaVersion: 1,
@@ -635,7 +644,8 @@ function createAssetInstallPlan(options) {
     options.targetDir,
     options.agentAssetsDir,
     managedEntries,
-    expectedTargetPaths
+    expectedTargetPaths,
+    legacyAdoptions.consumedTargetPaths
   );
   return {
     schemaVersion: 1,
@@ -693,15 +703,9 @@ function createAssetAction(asset, agentAssetsDir, targetDir, host, placement, ma
     targetPath
   };
 }
-function resolveHostTargetPath(asset, host, placement) {
+function resolveHostTargetPath(asset, _host, placement) {
   if (asset.kind === "skill") {
     const effectivePlacement = resolveSkillPlacement(asset, placement);
-    if (host === "claude-code") {
-      if (placement === "manual") {
-        throw new Error("Manual skill placement is only supported for .agents hosts");
-      }
-      return `.claude/skills/${basename(asset.sourcePath)}`;
-    }
     if (effectivePlacement === "manual") {
       return `.agents/manual-skills/${basename(asset.sourcePath)}`;
     }
@@ -725,22 +729,84 @@ function createDirectoryActions(actions) {
   }
   return [...directories].sort().map((targetPath) => ({ type: "create-dir", targetPath }));
 }
-function readManagedEntries(targetDir) {
+function readManagedLock(targetDir) {
   const lockfilePath = join7(targetDir, ".pro-gov/assets.lock.json");
-  if (!existsSync7(lockfilePath)) return [];
+  if (!existsSync7(lockfilePath)) return { entries: [] };
   try {
     const lockfile = JSON.parse(readFileSync4(lockfilePath, "utf8"));
-    return (lockfile.assets ?? []).filter(
-      (entry) => typeof entry.id === "string" && typeof entry.sourcePath === "string" && typeof entry.targetPath === "string"
-    );
+    return {
+      host: typeof lockfile.host === "string" ? lockfile.host : void 0,
+      entries: (lockfile.assets ?? []).filter(
+        (entry) => typeof entry.id === "string" && typeof entry.sourcePath === "string" && typeof entry.targetPath === "string"
+      )
+    };
   } catch {
-    return [];
+    return { entries: [] };
+  }
+}
+function createLegacyClaudeAdoptions(options) {
+  const byAssetId = /* @__PURE__ */ new Map();
+  const consumedTargetPaths = /* @__PURE__ */ new Set();
+  const legacyEntries = options.managedLock.entries.filter((entry) => isLegacyClaudeSkillTargetPath(entry.targetPath));
+  if (legacyEntries.length === 0) return { byAssetId, consumedTargetPaths };
+  if (options.managedLock.host !== "claude-code" || options.host !== "claude-code") {
+    throw new Error("Legacy Claude skill targets require a claude-code lock and migration plan.");
+  }
+  const assetsById = new Map(options.assets.map((asset) => [asset.id, asset]));
+  const seenAssetIds = /* @__PURE__ */ new Set();
+  for (const entry of legacyEntries) {
+    if (seenAssetIds.has(entry.id)) {
+      throw new Error(`Duplicate legacy Claude lock entry: ${entry.id}`);
+    }
+    seenAssetIds.add(entry.id);
+    const asset = assetsById.get(entry.id);
+    if (!asset) {
+      throw new Error(`Legacy Claude asset ${entry.id} must be adopted before it can be removed.`);
+    }
+    const match = entry.targetPath.match(/^\.claude\/skills\/([^/]+)$/);
+    const skillName = match?.[1];
+    if (!skillName || asset.kind !== "skill" || entry.sourcePath !== asset.sourcePath || skillName !== basename(entry.sourcePath) || resolveHostTargetPath(asset, options.host, options.placement) !== `.agents/skills/${skillName}`) {
+      throw new Error(`Legacy Claude lock entry cannot be safely normalized: ${entry.targetPath}`);
+    }
+    const targetPath = `.agents/skills/${skillName}`;
+    const targetAbsolutePath = join7(options.targetDir, targetPath);
+    const compatibilityRootPath = join7(options.targetDir, ".claude/skills");
+    const canonicalRootPath = join7(options.targetDir, ".agents/skills");
+    if (!lstatSync2(canonicalRootPath).isDirectory() || !lstatSync2(compatibilityRootPath).isSymbolicLink() || readlinkSync(compatibilityRootPath) !== "../.agents/skills" || realpathSync(compatibilityRootPath) !== realpathSync(canonicalRootPath)) {
+      throw new Error(`Legacy Claude compatibility root is not the exact canonical alias for ${entry.id}.`);
+    }
+    if (!pathExistsEvenIfDanglingSymlink2(targetAbsolutePath)) {
+      consumedTargetPaths.add(entry.targetPath);
+      continue;
+    }
+    const targetStat = lstatSync2(targetAbsolutePath);
+    const legacyAbsolutePath = join7(options.targetDir, entry.targetPath);
+    const legacyStat = lstatSync2(legacyAbsolutePath);
+    const expectedSourcePath = join7(options.agentAssetsDir, entry.sourcePath);
+    if (!targetStat.isSymbolicLink() || !legacyStat.isSymbolicLink() || targetStat.dev !== legacyStat.dev || targetStat.ino !== legacyStat.ino || realpathSync(targetAbsolutePath) !== realpathSync(expectedSourcePath)) {
+      throw new Error(`Legacy Claude skill target cannot be safely adopted: ${entry.targetPath}`);
+    }
+    const action = {
+      type: "adopt-symlink",
+      assetId: entry.id,
+      sourcePath: expectedSourcePath,
+      targetPath,
+      legacyTargetPath: entry.targetPath,
+      compatibilityRootPath: ".claude/skills",
+      expectedCompatibilityRawTarget: "../.agents/skills",
+      expectedDevice: targetStat.dev,
+      expectedInode: targetStat.ino
+    };
+    byAssetId.set(entry.id, action);
+    consumedTargetPaths.add(entry.targetPath);
   }
+  return { byAssetId, consumedTargetPaths };
 }
-function createRemovalActions(targetDir, agentAssetsDir, managedEntries, expectedTargetPaths) {
+function createRemovalActions(targetDir, agentAssetsDir, managedEntries, expectedTargetPaths, consumedTargetPaths) {
   const actions = [];
   for (const entry of managedEntries) {
     if (expectedTargetPaths.has(entry.targetPath)) continue;
+    if (consumedTargetPaths.has(entry.targetPath)) continue;
     if (!isManagedAssetTargetPath(entry.targetPath)) {
       throw new Error(`Refusing to remove managed asset outside supported roots: ${entry.targetPath}`);
     }
@@ -765,13 +831,10 @@ function createRemovalActions(targetDir, agentAssetsDir, managedEntries, expecte
   return actions.sort((a, b) => a.targetPath.localeCompare(b.targetPath));
 }
 function isManagedAssetTargetPath(path) {
-  return [
-    ".agents/skills/",
-    ".agents/manual-skills/",
-    ".claude/skills/",
-    ".pro-gov/agent-assets/rules/",
-    ".pro-gov/agent-assets/commands/"
-  ].some((prefix) => path.startsWith(prefix));
+  return /^(?:\.agents\/(?:skills|manual-skills)|\.pro-gov\/agent-assets\/(?:rules|commands))\/[^/.][^/]*$/.test(path);
+}
+function isLegacyClaudeSkillTargetPath(path) {
+  return /^\.claude\/skills\/[^/.][^/]*$/.test(path);
 }
 function pathExistsEvenIfDanglingSymlink2(path) {
   try {
@@ -785,6 +848,9 @@ function pathExistsEvenIfDanglingSymlink2(path) {
 // src/asset-targets/apply.ts
 function applyAssetInstallPlan(plan) {
   const appliedActions = [];
+  for (const action of plan.actions) {
+    if (action.type === "adopt-symlink") validateAdoptedSymlink(plan.targetDir, action);
+  }
   for (const action of plan.actions) {
     applyAction(plan.targetDir, action);
     appliedActions.push(action.type);
@@ -797,6 +863,7 @@ function applyAction(targetDir, action) {
     removeManagedSymlink(targetAbsolutePath, action);
     return;
   }
+  if (action.type === "adopt-symlink") return;
   if (action.type === "create-dir") {
     mkdirSync2(targetAbsolutePath, { recursive: true });
     return;
@@ -808,7 +875,7 @@ function applyAction(targetDir, action) {
   }
   mkdirSync2(dirname4(targetAbsolutePath), { recursive: true });
   const sourceAbsolutePath = resolve2(action.sourcePath);
-  const symlinkTarget = relative4(realpathSync(dirname4(targetAbsolutePath)), realpathSync(sourceAbsolutePath)) || ".";
+  const symlinkTarget = relative4(realpathSync2(dirname4(targetAbsolutePath)), realpathSync2(sourceAbsolutePath)) || ".";
   if (action.type === "symlink") {
     if (pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
       throw new Error(`Refusing to overwrite unmanaged target: ${action.targetPath}`);
@@ -827,6 +894,23 @@ function applyAction(targetDir, action) {
   unlinkSync(targetAbsolutePath);
   symlinkSync(symlinkTarget, targetAbsolutePath);
 }
+function validateAdoptedSymlink(targetDir, action) {
+  if (!isManagedAssetTargetPath(action.targetPath) || !isLegacyClaudeSkillTargetPath(action.legacyTargetPath) || action.compatibilityRootPath !== ".claude/skills" || action.expectedCompatibilityRawTarget !== "../.agents/skills") {
+    throw new Error(`Refusing unsafe legacy Claude adoption: ${action.legacyTargetPath}`);
+  }
+  const canonicalRootPath = join8(targetDir, ".agents/skills");
+  const compatibilityRootPath = join8(targetDir, action.compatibilityRootPath);
+  const targetAbsolutePath = join8(targetDir, action.targetPath);
+  const legacyAbsolutePath = join8(targetDir, action.legacyTargetPath);
+  if (!lstatSync3(canonicalRootPath).isDirectory() || !lstatSync3(compatibilityRootPath).isSymbolicLink() || readlinkSync2(compatibilityRootPath) !== action.expectedCompatibilityRawTarget || realpathSync2(compatibilityRootPath) !== realpathSync2(canonicalRootPath)) {
+    throw new Error(`Legacy Claude compatibility alias changed before apply: ${action.compatibilityRootPath}`);
+  }
+  const targetStat = lstatSync3(targetAbsolutePath);
+  const legacyStat = lstatSync3(legacyAbsolutePath);
+  if (!targetStat.isSymbolicLink() || !legacyStat.isSymbolicLink() || targetStat.dev !== legacyStat.dev || targetStat.ino !== legacyStat.ino || targetStat.dev !== action.expectedDevice || targetStat.ino !== action.expectedInode || realpathSync2(targetAbsolutePath) !== realpathSync2(action.sourcePath)) {
+    throw new Error(`Legacy Claude skill target changed before apply: ${action.targetPath}`);
+  }
+}
 function removeManagedSymlink(targetAbsolutePath, action) {
   if (!isManagedAssetTargetPath(action.targetPath)) {
     throw new Error(`Refusing to remove managed asset outside supported roots: ${action.targetPath}`);
@@ -1014,18 +1098,14 @@ function checkHostFolder(host, kind, targetPath, id) {
   return void 0;
 }
 function expectedSkillTargetPrefixes(host) {
-  if (host === "claude-code") return [".claude/skills/"];
-  if (host === "codex" || host === "gemini-cli" || host === "antigravity") {
+  if (host === "codex" || host === "claude-code" || host === "gemini-cli" || host === "antigravity") {
     return [".agents/skills/", ".agents/manual-skills/"];
   }
   return void 0;
 }
 function expectedRegistrySkillTargetPath(host, sourcePath, placement) {
   const skillName = basename2(sourcePath);
-  if (host === "claude-code") {
-    return placement === "manual" ? void 0 : `.claude/skills/${skillName}`;
-  }
-  if (host === "codex" || host === "gemini-cli" || host === "antigravity") {
+  if (host === "codex" || host === "claude-code" || host === "gemini-cli" || host === "antigravity") {
     return placement === "manual" ? `.agents/manual-skills/${skillName}` : `.agents/skills/${skillName}`;
   }
   return void 0;
@@ -1653,12 +1733,14 @@ import { existsSync as existsSync12 } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname as dirname6, join as join12 } from "node:path";
 var REQUIRED_ASSETS = [
+  "starter/.agents/skills/.gitkeep",
   "starter/AGENTS.template.md",
-  "starter/docs/governance/ssot-v1.0.md",
-  "starter/docs/governance/agents-routing/engineering-runtime-v1.0.md",
-  "starter/docs/governance/agents-routing/doc-only-v1.0.md",
+  "starter/docs/governance/ssot-v1.1.md",
+  "starter/docs/governance/agents-routing/engineering-runtime-v1.1.md",
+  "starter/docs/governance/agents-routing/doc-only-v1.1.md",
   "profiles/engineering-runtime/profile.md",
-  "profiles/doc-only/profile.md"
+  "profiles/doc-only/profile.md",
+  "docs/reference/adoption/migration-v1.1.md"
 ];
 function runDoctor(_args) {
   const assets = listAssets();
@@ -1709,40 +1791,46 @@ function resolveDocGovDependencyCli() {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "node:fs";
+import { lstatSync as lstatSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync8, symlinkSync as symlinkSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { basename as basename3, dirname as dirname7, join as join13 } from "node:path";
 
 // src/commands/shared.ts
 function planStarterFiles(profile) {
-  return listAssets().flatMap((asset) => {
+  const files = listAssets().flatMap((asset) => {
     const targetPath = starterTargetPath(asset.path);
     if (!targetPath) return [];
     if (profile && isOtherProfileRouting(targetPath, profile)) return [];
     return [
       {
+        kind: "file",
         sourcePath: asset.path,
         targetPath,
         absoluteSourcePath: asset.absolutePath,
         ownership: classifyOwnership(targetPath)
       }
     ];
-  }).sort((a, b) => a.targetPath.localeCompare(b.targetPath));
+  });
+  const compatibilityEntries = [
+    { kind: "directory", targetPath: ".agents/skills", ownership: "shared" },
+    { kind: "symlink", targetPath: "CLAUDE.md", linkTarget: "AGENTS.md", ownership: "shared" },
+    { kind: "symlink", targetPath: ".claude/skills", linkTarget: "../.agents/skills", ownership: "shared" }
+  ];
+  return [...files, ...compatibilityEntries].sort((a, b) => a.targetPath.localeCompare(b.targetPath));
 }
 function classifyOwnership(targetPath) {
   if (targetPath === "lefthook.yml" || targetPath === ".github/workflows/docs-check.yml") {
     return "optional-guardrail";
   }
-  if (targetPath === "AGENTS.md" || targetPath === "CLAUDE.md" || targetPath === "docs/policy/best-practice-for-this-project.md" || targetPath === "docs/reference/documentation-map.md" || targetPath === "docs/reference/execution/current-work.md") {
+  if (targetPath === "AGENTS.md" || targetPath === "docs/policy/best-practice-for-this-project.md" || targetPath === "docs/reference/documentation-map.md" || targetPath === "docs/reference/execution/current-work.md") {
     return "project-local-seed";
   }
   return "shared";
 }
 function isOtherProfileRouting(targetPath, profile) {
-  return targetPath.startsWith("docs/governance/agents-routing/") && targetPath !== `docs/governance/agents-routing/${profile}-v1.0.md`;
+  return targetPath.startsWith("docs/governance/agents-routing/") && targetPath !== `docs/governance/agents-routing/${profile}-v1.1.md`;
 }
 function starterTargetPath(sourcePath) {
   if (sourcePath === "starter/AGENTS.template.md") return "AGENTS.md";
-  if (sourcePath === "starter/CLAUDE.template.md") return "CLAUDE.md";
   if (sourcePath === "starter/lefthook.template.yml") return "lefthook.yml";
   if (!sourcePath.startsWith("starter/")) return null;
   return sourcePath.slice("starter/".length);
@@ -1772,13 +1860,20 @@ function runInit(args) {
   console.log("");
   console.log("Planned starter files:");
   for (const file of files) {
-    console.log(`  ${file.targetPath} <- ${file.sourcePath}`);
+    if (file.kind === "file") console.log(`  ${file.targetPath} <- ${file.sourcePath}`);
+    if (file.kind === "directory") console.log(`  ${file.targetPath} <- directory`);
+    if (file.kind === "symlink") console.log(`  ${file.targetPath} <- symlink:${file.linkTarget}`);
   }
   return 0;
 }
 function applyStarterFiles(files, profile) {
   const root = process.cwd();
-  const conflicts = files.filter((file) => existsSync13(join13(root, file.targetPath)));
+  const conflicts = files.filter((file) => {
+    const targetPath = join13(root, file.targetPath);
+    const stat = safeLstat(targetPath);
+    if (!stat) return false;
+    return file.kind !== "directory" || !stat.isDirectory();
+  });
   if (conflicts.length > 0) {
     console.error("pro-gov init is refusing to overwrite existing project files:");
     for (const file of conflicts) console.error(`  ${file.targetPath}`);
@@ -1788,6 +1883,14 @@ function applyStarterFiles(files, profile) {
   for (const file of files) {
     const targetPath = join13(root, file.targetPath);
     mkdirSync4(dirname7(targetPath), { recursive: true });
+    if (file.kind === "directory") {
+      mkdirSync4(targetPath, { recursive: true });
+      continue;
+    }
+    if (file.kind === "symlink") {
+      symlinkSync2(file.linkTarget, targetPath);
+      continue;
+    }
     const source = readFileSync8(file.absoluteSourcePath);
     const content = file.targetPath === "AGENTS.md" ? renderAgentsTemplate(source.toString("utf8"), basename3(root), profile) : source;
     writeFileSync3(targetPath, content);
@@ -1800,9 +1903,16 @@ function applyStarterFiles(files, profile) {
   return 0;
 }
 function renderAgentsTemplate(template, projectName, profile) {
-  const selectedRoute = `docs/governance/agents-routing/${profile}-v1.0.md`;
+  const selectedRoute = `docs/governance/agents-routing/${profile}-v1.1.md`;
   return template.replace("# PROJECT_NAME AI Router", `# ${projectName} AI Router`).replace("`PROFILE_NAME`", `\`${profile}\``).replace("`PROFILE_ROUTE`", `\`${selectedRoute}\``).replace(/\n{3,}/g, "\n\n");
 }
+function safeLstat(path) {
+  try {
+    return lstatSync5(path);
+  } catch {
+    return void 0;
+  }
+}
 function readFlag(args, flag) {
   const index = args.indexOf(flag);
   if (index === -1) return null;
@@ -1812,7 +1922,7 @@ function readFlag(args, flag) {
 }
 
 // src/learning/recall.ts
-import { existsSync as existsSync14, readdirSync as readdirSync6, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync13, readdirSync as readdirSync6, readFileSync as readFileSync9 } from "node:fs";
 import { basename as basename4, join as join14, relative as relative5 } from "node:path";
 function recallLearnings(root, options) {
   const query = options.query.trim();
@@ -1837,7 +1947,7 @@ function loadLearningRecords(root) {
   const recordsByTitle = /* @__PURE__ */ new Map();
   for (const relativeDir of ["docs/reference/learnings", "docs/solutions"]) {
     const learningDir = join14(root, relativeDir);
-    if (!existsSync14(learningDir)) continue;
+    if (!existsSync13(learningDir)) continue;
     for (const path of listMarkdownFiles(learningDir)) {
       const record = readLearningRecord(root, path);
       const key = record.title.trim().toLowerCase();
@@ -1845,7 +1955,7 @@ function loadLearningRecords(root) {
     }
   }
   const conceptsPath = join14(root, "CONCEPTS.md");
-  if (existsSync14(conceptsPath)) {
+  if (existsSync13(conceptsPath)) {
     const record = readLearningRecord(root, conceptsPath);
     recordsByTitle.set(`concepts:${record.title.toLowerCase()}`, record);
   }
@@ -1947,7 +2057,7 @@ function cleanMarkdownLine(input) {
 }
 
 // src/learning/capture.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "node:fs";
 import { basename as basename5, join as join15, relative as relative6 } from "node:path";
 function captureLearning(root, options) {
   const title = options.title.trim();
@@ -2005,7 +2115,7 @@ function renderLearning(options) {
 function uniquePath(dir, slug) {
   let index = 1;
   let candidate = join15(dir, `${slug}.md`);
-  while (existsSync15(candidate)) {
+  while (existsSync14(candidate)) {
     index += 1;
     candidate = join15(dir, `${slug}-${index}.md`);
   }
@@ -2188,10 +2298,10 @@ function printUsage2() {
 
 // src/commands/lens.ts
 import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname9 } from "node:path";
+import { dirname as dirname10 } from "node:path";
 
 // src/lens/audit.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "node:fs";
 import { basename as basename6, dirname as dirname8, join as join16 } from "node:path";
 var REQUIRED_ARTIFACTS = [
   "manifest.md",
@@ -2223,7 +2333,7 @@ function createProjectLensAuditPackage(targetDir, auditDir) {
 }
 function checkProjectLensAuditPackage(auditDir, options = {}) {
   const contractPath = join16(auditDir, "audit.contract.json");
-  if (!existsSync16(contractPath)) {
+  if (!existsSync15(contractPath)) {
     return {
       ok: false,
       auditDir,
@@ -2271,7 +2381,7 @@ function checkProjectLensAuditPackage(auditDir, options = {}) {
   }
   for (const artifactPath of REQUIRED_ARTIFACTS) {
     const absolutePath = join16(auditDir, artifactPath);
-    if (!existsSync16(absolutePath)) {
+    if (!existsSync15(absolutePath)) {
       issues.push({ type: "missing-required-artifact", path: artifactPath });
       continue;
     }
@@ -2471,6 +2581,12 @@ function formatProjectLensInspection(report) {
     `excluded-files: ${report.scanScope.excludedFileCount}`,
     `ai-entry-files: ${formatList(report.aiEntryFiles)}`,
     `ai-config-files: ${formatList(report.aiConfigFiles)}`,
+    `ai-host-ssot: ${report.hostSsot.compliant ? "compliant" : "non-compliant"}`,
+    `claude-entry-link: ${formatLink(report.hostSsot.claudeEntry)}`,
+    `claude-skills-link: ${formatLink(report.hostSsot.claudeSkills)}`,
+    `user-host-ssot: ${report.userHostSsot.compliant ? "compliant" : "non-compliant"}`,
+    `verification: ${report.verification.status} (missing: ${formatList(report.verification.missing)})`,
+    `redundancy: ${report.redundancy.status}`,
     `package-scripts: ${formatList(report.packageJson?.scripts ?? [])}`,
     `dependencies: ${formatList(report.packageJson?.dependencies ?? [])}`,
     `dev-dependencies: ${formatList(report.packageJson?.devDependencies ?? [])}`,
@@ -2503,6 +2619,29 @@ function renderProjectLensMarkdownReport(report) {
     "",
     bulletList(report.aiConfigFiles),
     "",
+    "## AI Host SSOT",
+    "",
+    `- Status: ${report.hostSsot.compliant ? "compliant" : "non-compliant"}`,
+    `- Canonical entry: \`${report.hostSsot.agentsEntry.path}\` (${report.hostSsot.agentsEntry.status})`,
+    `- Claude entry: ${formatLink(report.hostSsot.claudeEntry)}`,
+    `- Canonical skills: \`${report.hostSsot.canonicalSkills.path}\` (${report.hostSsot.canonicalSkills.status})`,
+    `- Claude skills: ${formatLink(report.hostSsot.claudeSkills)}`,
+    `- Issues: ${formatList(report.hostSsot.issues)}`,
+    `- User skills SSOT: ${report.userHostSsot.compliant ? "compliant" : "non-compliant"}`,
+    `- User SSOT issues: ${formatList(report.userHostSsot.issues)}`,
+    "",
+    "## Verification Gates",
+    "",
+    `- Status: ${report.verification.status}`,
+    `- Required scripts: ${formatList(report.verification.requiredScripts)}`,
+    `- Missing scripts: ${formatList(report.verification.missing)}`,
+    "",
+    "## Redundancy Evidence",
+    "",
+    `- Status: ${report.redundancy.status}`,
+    `- Legacy directories: ${formatList(report.redundancy.legacyDirectories.map((entry) => entry.path))}`,
+    `- Playwright caches: ${formatList(report.redundancy.playwrightCaches.filter((entry) => entry.exists).map((entry) => `${entry.path} (${entry.bytes} bytes)`))}`,
+    "",
     "## Package",
     "",
     `- Scripts: ${formatList(report.packageJson?.scripts ?? [])}`,
@@ -2539,11 +2678,253 @@ function bulletList(values) {
   if (values.length === 0) return "- none";
   return values.map((value) => `- \`${value}\``).join("\n");
 }
+function formatLink(link) {
+  const rawTarget = link.rawTarget ? ` -> \`${link.rawTarget}\`` : "";
+  const resolvedTarget = link.resolvedTarget ? `; resolved: \`${link.resolvedTarget}\`` : "";
+  return `\`${link.path}\`${rawTarget} (${link.status}${resolvedTarget})`;
+}
 
 // src/lens/scan.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync17, readdirSync as readdirSync7, readFileSync as readFileSync11, statSync as statSync3 } from "node:fs";
-import { join as join17, relative as relative7 } from "node:path";
+import { existsSync as existsSync18, readdirSync as readdirSync8, readFileSync as readFileSync12, statSync as statSync4 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join20, relative as relative7 } from "node:path";
+
+// src/host-ssot.ts
+import {
+  lstatSync as lstatSync6,
+  readlinkSync as readlinkSync3,
+  realpathSync as realpathSync3
+} from "node:fs";
+import { dirname as dirname9, isAbsolute as isAbsolute3, join as join17, resolve as resolve3 } from "node:path";
+function inspectProjectHostSsot(root) {
+  const agentsEntry = inspectCanonicalPath(root, "AGENTS.md");
+  const canonicalSkills = inspectCanonicalPath(root, ".agents/skills");
+  const claudeEntry = inspectCompatibilityLink(root, "CLAUDE.md", "AGENTS.md");
+  const claudeSkills = inspectCompatibilityLink(
+    root,
+    ".claude/skills",
+    "../.agents/skills"
+  );
+  const issues = [
+    ...agentsEntry.status === "file" ? [] : [`AGENTS.md must be the canonical project entry file; found ${agentsEntry.status}.`],
+    ...canonicalSkills.status === "directory" ? [] : [`.agents/skills must be the canonical project skill directory; found ${canonicalSkills.status}.`],
+    ...claudeEntry.compliant ? [] : [`CLAUDE.md must be the relative symlink AGENTS.md; found ${claudeEntry.status}.`],
+    ...claudeSkills.compliant ? [] : [`.claude/skills must be the relative symlink ../.agents/skills; found ${claudeSkills.status}.`]
+  ];
+  return {
+    agentsEntry,
+    canonicalSkills,
+    claudeEntry,
+    claudeSkills,
+    compliant: issues.length === 0,
+    issues
+  };
+}
+function inspectUserSkillsSsot(homeDir) {
+  const canonicalSkills = inspectCanonicalPath(homeDir, ".agents/skills");
+  const claudeSkills = inspectCompatibilityLink(
+    homeDir,
+    ".claude/skills",
+    "../.agents/skills"
+  );
+  const issues = [
+    ...canonicalSkills.status === "directory" ? [] : [`~/.agents/skills must be the canonical user skill directory; found ${canonicalSkills.status}.`],
+    ...claudeSkills.compliant ? [] : [`~/.claude/skills must be the relative symlink ../.agents/skills; found ${claudeSkills.status}.`]
+  ];
+  return {
+    canonicalSkills,
+    claudeSkills,
+    compliant: issues.length === 0,
+    issues
+  };
+}
+function inspectCanonicalPath(root, path) {
+  const absolutePath = join17(root, path);
+  const stat = safeLstat2(absolutePath);
+  if (!stat) return { path, status: "missing" };
+  if (stat.isSymbolicLink()) {
+    try {
+      realpathSync3(absolutePath);
+      return { path, status: "symlink" };
+    } catch {
+      return { path, status: "dangling-symlink" };
+    }
+  }
+  if (stat.isFile()) return { path, status: "file" };
+  if (stat.isDirectory()) return { path, status: "directory" };
+  return { path, status: "other" };
+}
+function inspectCompatibilityLink(root, path, expectedRawTarget) {
+  const absolutePath = join17(root, path);
+  const stat = safeLstat2(absolutePath);
+  const base = { path, expectedRawTarget, compliant: false };
+  if (!stat) return { ...base, status: "missing" };
+  if (!stat.isSymbolicLink()) {
+    if (stat.isFile()) return { ...base, status: "file" };
+    if (stat.isDirectory()) return { ...base, status: "directory" };
+    return { ...base, status: "other" };
+  }
+  const rawTarget = readlinkSync3(absolutePath);
+  const resolvedTarget = resolve3(dirname9(absolutePath), rawTarget);
+  const expectedPath = resolve3(dirname9(absolutePath), expectedRawTarget);
+  const targetStat = safeLstat2(resolvedTarget);
+  if (!targetStat) {
+    return {
+      ...base,
+      rawTarget,
+      resolvedTarget,
+      status: rawTarget === expectedRawTarget ? "target-missing" : "dangling-symlink"
+    };
+  }
+  let targetMatches = false;
+  try {
+    targetMatches = realpathSync3(absolutePath) === realpathSync3(expectedPath);
+  } catch {
+    return { ...base, rawTarget, resolvedTarget, status: "dangling-symlink" };
+  }
+  if (!targetMatches) {
+    return { ...base, rawTarget, resolvedTarget, status: "wrong-target" };
+  }
+  if (isAbsolute3(rawTarget)) {
+    return { ...base, rawTarget, resolvedTarget, status: "absolute-symlink" };
+  }
+  if (rawTarget !== expectedRawTarget) {
+    return {
+      ...base,
+      rawTarget,
+      resolvedTarget,
+      status: "noncanonical-relative-symlink"
+    };
+  }
+  return {
+    ...base,
+    rawTarget,
+    resolvedTarget,
+    status: "compliant-relative-symlink",
+    compliant: true
+  };
+}
+function safeLstat2(path) {
+  try {
+    return lstatSync6(path);
+  } catch {
+    return void 0;
+  }
+}
+
+// src/portfolio/redundancy.ts
+import { existsSync as existsSync16, readdirSync as readdirSync7, statSync as statSync3 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join18 } from "node:path";
+var DEFAULT_CACHE_THRESHOLD_BYTES = 1e9;
+var MAX_CACHE_ENTRIES = 2e4;
+function inspectProjectRedundancy(root, options = {}) {
+  const legacyDirectories = inspectLegacyDirectories(root);
+  const homeDir = options.homeDir ?? homedir();
+  const cachePaths = getPlaywrightCachePaths(homeDir, options.playwrightBrowsersPath ?? process.env.PLAYWRIGHT_BROWSERS_PATH);
+  const playwrightCaches = cachePaths.map((path) => inspectPlaywrightCache(path));
+  const cacheThresholdBytes = options.cacheThresholdBytes ?? DEFAULT_CACHE_THRESHOLD_BYTES;
+  const status = legacyDirectories.length > 0 || playwrightCaches.some((cache) => cache.exists && (cache.bytes >= cacheThresholdBytes || cache.truncated)) ? "attention" : "clean";
+  return { status, legacyDirectories, playwrightCaches };
+}
+function inspectLegacyDirectories(root) {
+  const relativePath = ".agent";
+  const path = join18(root, relativePath);
+  if (!existsSync16(path)) return [];
+  const stats = collectDirectoryStats(path);
+  return [{
+    path: relativePath,
+    kind: "legacy-ai-directory",
+    fileCount: stats.fileCount,
+    bytes: stats.bytes,
+    reason: "\u9879\u76EE\u7EA7\u65E7 AI \u5BBF\u4E3B\u76EE\u5F55\uFF1B\u5E94\u4E0E .agents/skills \u7684 SSOT \u9010\u9879\u6BD4\u5BF9\u540E\u518D\u51B3\u5B9A\u662F\u5426\u8FC1\u79FB\uFF0C\u626B\u63CF\u5668\u4E0D\u81EA\u52A8\u5220\u9664\u3002"
+  }];
+}
+function getPlaywrightCachePaths(homeDir, configuredPath) {
+  const candidates = [
+    configuredPath && configuredPath !== "0" ? configuredPath : void 0,
+    join18(homeDir, "Library/Caches/ms-playwright"),
+    join18(homeDir, ".cache/ms-playwright"),
+    join18(homeDir, "AppData/Local/ms-playwright")
+  ].filter((path) => Boolean(path));
+  return [...new Set(candidates)];
+}
+function inspectPlaywrightCache(path) {
+  if (!existsSync16(path)) {
+    return { path, exists: false, fileCount: 0, bytes: 0, revisionCount: 0, truncated: false };
+  }
+  const stats = collectDirectoryStats(path);
+  let revisionCount = 0;
+  try {
+    revisionCount = readdirSync7(path, { withFileTypes: true }).filter((entry) => entry.isDirectory()).length;
+  } catch {
+    revisionCount = 0;
+  }
+  return { path, exists: true, fileCount: stats.fileCount, bytes: stats.bytes, revisionCount, truncated: stats.truncated };
+}
+function collectDirectoryStats(root) {
+  let fileCount = 0;
+  let bytes = 0;
+  let truncated = false;
+  const pending = [root];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    if (!current) continue;
+    let entries;
+    try {
+      entries = readdirSync7(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (fileCount >= MAX_CACHE_ENTRIES) {
+        truncated = true;
+        break;
+      }
+      const path = join18(current, entry.name);
+      if (entry.isDirectory()) {
+        pending.push(path);
+      } else if (entry.isFile()) {
+        fileCount += 1;
+        try {
+          bytes += statSync3(path).size;
+        } catch {
+        }
+      }
+    }
+    if (truncated) break;
+  }
+  return { fileCount, bytes, truncated };
+}
+
+// src/portfolio/verification.ts
+import { existsSync as existsSync17, readFileSync as readFileSync11 } from "node:fs";
+import { join as join19 } from "node:path";
+var REQUIRED_PROJECT_SCRIPTS = ["typecheck", "lint", "format:check", "verify"];
+function inspectProjectVerification(root) {
+  const packageJson = readPackageJson(join19(root, "package.json"));
+  const scripts = Object.fromEntries(
+    REQUIRED_PROJECT_SCRIPTS.map((name) => [name, typeof packageJson?.scripts?.[name] === "string" ? packageJson.scripts[name] : void 0])
+  );
+  const missing = REQUIRED_PROJECT_SCRIPTS.filter((name) => typeof scripts[name] !== "string" || scripts[name]?.trim().length === 0);
+  return {
+    status: packageJson ? missing.length === 0 ? "compliant" : "attention" : "unknown",
+    requiredScripts: REQUIRED_PROJECT_SCRIPTS,
+    scripts,
+    missing
+  };
+}
+function readPackageJson(path) {
+  if (!existsSync17(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync11(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+
+// src/lens/scan.ts
 var ignoredDirectories = /* @__PURE__ */ new Set([
   ".git",
   ".next",
@@ -2559,7 +2940,7 @@ function scanProjectLensTarget(targetDir, options = {}) {
   const markdownFiles = files.filter(
     (file) => file.startsWith("docs/") && file.endsWith(".md")
   );
-  const packageJson = readPackageJson(targetDir);
+  const packageJson = readPackageJson2(targetDir);
   return {
     targetDir,
     scanScope: {
@@ -2569,24 +2950,31 @@ function scanProjectLensTarget(targetDir, options = {}) {
       excludedFileCount: candidateFiles.length - files.length
     },
     aiEntryFiles: ["AGENTS.md", "CLAUDE.md"].filter(
-      (file) => existsSync17(join17(targetDir, file))
+      (file) => existsSync18(join20(targetDir, file))
     ),
     aiConfigFiles: [],
+    hostSsot: inspectProjectHostSsot(targetDir),
+    userHostSsot: inspectUserSkillsSsot(options.homeDir ?? process.env.HOME ?? homedir2()),
+    verification: inspectProjectVerification(targetDir),
+    redundancy: inspectProjectRedundancy(targetDir, {
+      homeDir: options.homeDir,
+      playwrightBrowsersPath: options.playwrightBrowsersPath
+    }),
     packageJson,
     docs: {
-      hasDocsDirectory: existsSync17(join17(targetDir, "docs")),
+      hasDocsDirectory: existsSync18(join20(targetDir, "docs")),
       markdownFileCount: markdownFiles.length,
       governanceFiles: markdownFiles.filter((file) => file.startsWith("docs/governance/") || file.startsWith("docs/policy/")).sort()
     },
     git: readGitState(targetDir),
-    largeFiles: files.map((file) => ({ path: file, bytes: statSync3(join17(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
+    largeFiles: files.map((file) => ({ path: file, bytes: statSync4(join20(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
   };
 }
-function readPackageJson(targetDir) {
-  const packageJsonPath = join17(targetDir, "package.json");
-  if (!existsSync17(packageJsonPath)) return void 0;
+function readPackageJson2(targetDir) {
+  const packageJsonPath = join20(targetDir, "package.json");
+  if (!existsSync18(packageJsonPath)) return void 0;
   try {
-    const packageJson = JSON.parse(readFileSync11(packageJsonPath, "utf8"));
+    const packageJson = JSON.parse(readFileSync12(packageJsonPath, "utf8"));
     return {
       scripts: Object.keys(packageJson.scripts ?? {}).sort(),
       dependencies: Object.keys(packageJson.dependencies ?? {}).sort(),
@@ -2624,7 +3012,7 @@ function listProjectFiles(targetDir) {
     "-z"
   ]);
   if (gitFiles.ok) {
-    return gitFiles.stdout.split("\0").filter(Boolean).map(toUnixPath4).filter((file) => existsSync17(join17(targetDir, file))).sort();
+    return gitFiles.stdout.split("\0").filter(Boolean).map(toUnixPath4).filter((file) => existsSync18(join20(targetDir, file))).sort();
   }
   const files = [];
   collectFiles2(targetDir, targetDir, files);
@@ -2642,13 +3030,13 @@ function isFirstPartyEvidenceFile(file) {
   return !excludedEvidencePrefixes.some((prefix) => file.startsWith(prefix));
 }
 function collectFiles2(rootDir, currentDir, files) {
-  if (!existsSync17(currentDir)) return;
-  for (const entry of readdirSync7(currentDir, { withFileTypes: true })) {
+  if (!existsSync18(currentDir)) return;
+  for (const entry of readdirSync8(currentDir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
       if (ignoredDirectories.has(entry.name)) continue;
-      collectFiles2(rootDir, join17(currentDir, entry.name), files);
+      collectFiles2(rootDir, join20(currentDir, entry.name), files);
     } else if (entry.isFile()) {
-      files.push(toUnixPath4(relative7(rootDir, join17(currentDir, entry.name))));
+      files.push(toUnixPath4(relative7(rootDir, join20(currentDir, entry.name))));
     }
   }
 }
@@ -2700,7 +3088,7 @@ function runLensReport(args) {
   }
   const report = scanProjectLensTarget(options.value.targetDir);
   const markdown = renderProjectLensMarkdownReport(report);
-  mkdirSync7(dirname9(options.value.outPath), { recursive: true });
+  mkdirSync7(dirname10(options.value.outPath), { recursive: true });
   writeFileSync6(options.value.outPath, markdown);
   console.log(`report: ${options.value.outPath}`);
   return 0;
@@ -2804,16 +3192,16 @@ function printUsage3() {
 }
 
 // src/commands/portfolio.ts
-import { existsSync as existsSync22 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync18 } from "node:fs";
+import { join as join25 } from "node:path";
 
 // src/portfolio/manifest.ts
-import { existsSync as existsSync18, readFileSync as readFileSync12 } from "node:fs";
-import { dirname as dirname10, isAbsolute as isAbsolute3, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync13 } from "node:fs";
+import { dirname as dirname11, isAbsolute as isAbsolute4, resolve as resolve4 } from "node:path";
 function loadPortfolioManifest(configPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync12(configPath, "utf8"));
+    parsed = JSON.parse(readFileSync13(configPath, "utf8"));
   } catch (error) {
     return {
       configPath,
@@ -2825,7 +3213,7 @@ function loadPortfolioManifest(configPath) {
       ]
     };
   }
-  const normalized = resolveManifestPaths(parsed, dirname10(resolve3(configPath)));
+  const normalized = resolveManifestPaths(parsed, dirname11(resolve4(configPath)));
   const issues = validatePortfolioManifest(normalized);
   return {
     configPath,
@@ -2836,14 +3224,14 @@ function loadPortfolioManifest(configPath) {
 function resolveManifestPaths(value, configDir) {
   if (!isRecord(value)) return value;
   const resolveEndpoint = (endpoint) => {
-    if (!isRecord(endpoint) || typeof endpoint.path !== "string" || isAbsolute3(endpoint.path)) {
+    if (!isRecord(endpoint) || typeof endpoint.path !== "string" || isAbsolute4(endpoint.path)) {
       return endpoint;
     }
-    return { ...endpoint, path: resolve3(configDir, endpoint.path) };
+    return { ...endpoint, path: resolve4(configDir, endpoint.path) };
   };
   return {
     ...value,
-    technologyGovernance: isRecord(value.technologyGovernance) && typeof value.technologyGovernance.strategySource === "string" && !isAbsolute3(value.technologyGovernance.strategySource) ? { ...value.technologyGovernance, strategySource: resolve3(configDir, value.technologyGovernance.strategySource) } : value.technologyGovernance,
+    technologyGovernance: isRecord(value.technologyGovernance) && typeof value.technologyGovernance.strategySource === "string" && !isAbsolute4(value.technologyGovernance.strategySource) ? { ...value.technologyGovernance, strategySource: resolve4(configDir, value.technologyGovernance.strategySource) } : value.technologyGovernance,
     controlPlane: resolveEndpoint(value.controlPlane),
     executionEngine: resolveEndpoint(value.executionEngine),
     targets: Array.isArray(value.targets) ? value.targets.map(resolveEndpoint) : value.targets
@@ -2877,13 +3265,14 @@ function validatePortfolioManifest(value) {
   validateAllowedFields(
     value,
     "root",
-    ["schemaVersion", "portfolioId", "technologyGovernance", "controlPlane", "executionEngine", "hostTooling", "targets"],
+    ["schemaVersion", "portfolioId", "technologyGovernance", "controlPlane", "executionEngine", "hostTooling", "specialistChecks", "targets"],
     issues
   );
   const technologyCatalog = validateTechnologyGovernance(value.technologyGovernance, issues);
   validateEndpoint(value.controlPlane, "controlPlane", issues, technologyCatalog);
   validateEndpoint(value.executionEngine, "executionEngine", issues, technologyCatalog);
   validateHostTooling(value.hostTooling, issues);
+  validateSpecialistChecks(value.specialistChecks, issues);
   if (!Array.isArray(value.targets)) {
     issues.push({
       type: "invalid-field",
@@ -2981,7 +3370,7 @@ function validateEndpoint(value, field, issues, technologyCatalog) {
     });
     return;
   }
-  if (!existsSync18(value.path)) {
+  if (!existsSync19(value.path)) {
     issues.push({
       type: "missing-path",
       id: typeof value.id === "string" ? value.id : void 0,
@@ -3010,7 +3399,7 @@ function validateTechnologyGovernance(value, issues) {
     issues.push({ type: "invalid-field", field: "technologyGovernance", message: "Portfolio technologyGovernance must be an object." });
     return { technologies, projectTypes };
   }
-  validateAllowedFields(value, "technologyGovernance", ["strategySource", "technologies", "projectTypes"], issues);
+  validateAllowedFields(value, "technologyGovernance", ["strategySource", "versionPolicy", "technologies", "projectTypes"], issues);
   if (value.strategySource !== void 0 && (typeof value.strategySource !== "string" || value.strategySource.length === 0)) {
     issues.push({ type: "invalid-field", field: "technologyGovernance.strategySource", message: "Technology strategySource must be a non-empty string." });
   }
@@ -3073,16 +3462,76 @@ function validateTechnologyGovernance(value, issues) {
       if (!technologies.has(technology)) issues.push({ type: "invalid-field", field: "technologyGovernance.projectTypes", message: `Project type ${projectType.id} references unknown technology: ${technology}` });
     }
   }
+  validateVersionPolicy(value.versionPolicy, projectTypes, issues);
   return { technologies, projectTypes };
 }
+function validateVersionPolicy(value, projectTypes, issues) {
+  if (value === void 0) return;
+  if (!isRecord(value)) {
+    issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy", message: "Technology versionPolicy must be an object." });
+    return;
+  }
+  validateAllowedFields(value, "versionPolicy", ["schemaVersion", "packageManager", "runtime", "packages"], issues);
+  if (value.schemaVersion !== 1) {
+    issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.schemaVersion", message: "Technology versionPolicy schemaVersion must be 1." });
+  }
+  validateVersionRequirement(value.packageManager, "technologyGovernance.versionPolicy.packageManager", issues);
+  validateVersionRequirement(value.runtime, "technologyGovernance.versionPolicy.runtime", issues);
+  if (!Array.isArray(value.packages)) {
+    issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.packages", message: "Technology versionPolicy packages must be an array." });
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of value.packages) {
+    if (!isRecord(entry)) {
+      issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.packages", message: "Version policy package entries must be objects." });
+      continue;
+    }
+    validateAllowedFields(entry, "versionPolicy.package", ["name", "version", "appliesTo"], issues);
+    const name = typeof entry.name === "string" ? entry.name : "";
+    if (!name || seen.has(name)) {
+      issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.packages.name", message: `Version policy package name must be non-empty and unique: ${String(entry.name)}` });
+    } else seen.add(name);
+    if (typeof entry.version !== "string" || !isExactVersion(entry.version)) {
+      issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.packages.version", message: `Version policy package version must be exact semver: ${String(entry.version)}` });
+    }
+    if (entry.appliesTo !== void 0) {
+      validateOptionalStringArray(entry.appliesTo, name, "technologyGovernance.versionPolicy.packages.appliesTo", issues);
+      if (Array.isArray(entry.appliesTo)) {
+        for (const projectType of entry.appliesTo) {
+          if (typeof projectType === "string" && !projectTypes.has(projectType)) {
+            issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.packages.appliesTo", message: `Version policy references unknown project type: ${projectType}` });
+          }
+        }
+      }
+    }
+  }
+}
+function validateVersionRequirement(value, field, issues) {
+  if (value === void 0) return;
+  if (!isRecord(value)) {
+    issues.push({ type: "invalid-field", field, message: "Version requirement must be an object." });
+    return;
+  }
+  validateAllowedFields(value, field, ["name", "version"], issues);
+  if (typeof value.name !== "string" || value.name.length === 0) {
+    issues.push({ type: "invalid-field", field: `${field}.name`, message: "Version requirement name must be non-empty." });
+  }
+  if (typeof value.version !== "string" || !isExactVersion(value.version)) {
+    issues.push({ type: "invalid-field", field: `${field}.version`, message: `Version requirement version must be exact semver: ${String(value.version)}` });
+  }
+}
+function isExactVersion(value) {
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value);
+}
 function isRepositoryRelativePath(value) {
-  if (value.length === 0 || isAbsolute3(value)) return false;
+  if (value.length === 0 || isAbsolute4(value)) return false;
   const segments = value.replaceAll("\\", "/").split("/");
   return !segments.includes("..");
 }
 function isExactRepositoryRelativePath(value) {
   if (value.length === 0) return false;
-  if (isAbsolute3(value)) return false;
+  if (isAbsolute4(value)) return false;
   if (/^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\") || value.startsWith("//")) return false;
   if (value.includes("\\")) return false;
   const segments = value.split("/");
@@ -3214,15 +3663,45 @@ function validateHostTooling(value, issues) {
     }
   }
 }
+function validateSpecialistChecks(value, issues) {
+  if (value === void 0) return;
+  if (!isRecord(value)) {
+    issues.push({
+      type: "invalid-field",
+      field: "specialistChecks",
+      message: "Portfolio specialistChecks must be an object."
+    });
+    return;
+  }
+  validateAllowedFields(value, "specialistChecks", ["devspace"], issues);
+  if (value.devspace === void 0) return;
+  if (!isRecord(value.devspace)) {
+    issues.push({
+      type: "invalid-field",
+      field: "specialistChecks.devspace",
+      message: "Portfolio specialistChecks.devspace must be an object."
+    });
+    return;
+  }
+  validateAllowedFields(value.devspace, "specialistChecks.devspace", ["expectedToolMode"], issues);
+  if (value.devspace.expectedToolMode !== void 0 && !["minimal", "full", "codex"].includes(String(value.devspace.expectedToolMode))) {
+    issues.push({
+      type: "invalid-field",
+      field: "specialistChecks.devspace.expectedToolMode",
+      message: "DevSpace expectedToolMode must be minimal, full, or codex."
+    });
+  }
+}
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // src/portfolio/doctor.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync20, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync16 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname11, join as join19 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname12, join as join23 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/host-tooling/inventory.ts
@@ -3313,13 +3792,13 @@ function isRecord2(value) {
 }
 
 // src/portfolio/asset-state.ts
-import { existsSync as existsSync19, lstatSync as lstatSync5, readFileSync as readFileSync13 } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync20, lstatSync as lstatSync7, readFileSync as readFileSync14 } from "node:fs";
+import { join as join21 } from "node:path";
 function comparePortfolioAssetState(options) {
   const expectedManifest = readPlanDocument(options.expectedPlan, ".pro-gov/assets.json");
   const expectedLock = readPlanDocument(options.expectedPlan, ".pro-gov/assets.lock.json");
-  const currentManifest = readJsonFile(join18(options.targetDir, ".pro-gov/assets.json"));
-  const currentLock = readJsonFile(join18(options.targetDir, ".pro-gov/assets.lock.json"));
+  const currentManifest = readJsonFile(join21(options.targetDir, ".pro-gov/assets.json"));
+  const currentLock = readJsonFile(join21(options.targetDir, ".pro-gov/assets.lock.json"));
   const issues = [];
   if (!sameStrings(currentManifest?.bundleIds, expectedManifest?.bundleIds)) {
     issues.push({
@@ -3342,7 +3821,8 @@ function comparePortfolioAssetState(options) {
   const expectedTargets = new Set((expectedLock?.assets ?? []).map((entry) => entry.targetPath));
   for (const entry of currentLock?.assets ?? []) {
     if (expectedTargets.has(entry.targetPath)) continue;
-    const targetAbsolutePath = join18(options.targetDir, entry.targetPath);
+    if (options.expectedPlan.actions.some((action) => action.type === "adopt-symlink" && action.assetId === entry.id && action.legacyTargetPath === entry.targetPath)) continue;
+    const targetAbsolutePath = join21(options.targetDir, entry.targetPath);
     if (!pathIsSymlink(targetAbsolutePath)) continue;
     issues.push({
       type: "orphaned-managed-symlink",
@@ -3364,9 +3844,9 @@ function readPlanDocument(plan, targetPath) {
   }
 }
 function readJsonFile(path) {
-  if (!existsSync19(path)) return void 0;
+  if (!existsSync20(path)) return void 0;
   try {
-    return JSON.parse(readFileSync13(path, "utf8"));
+    return JSON.parse(readFileSync14(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -3387,12 +3867,86 @@ function normalizeLock(lock) {
 }
 function pathIsSymlink(path) {
   try {
-    return lstatSync5(path).isSymbolicLink();
+    return lstatSync7(path).isSymbolicLink();
   } catch {
     return false;
   }
 }
 
+// src/portfolio/version-policy.ts
+import { existsSync as existsSync21, readFileSync as readFileSync15 } from "node:fs";
+import { join as join22 } from "node:path";
+function inspectVersionPolicy(root, policy, projectType) {
+  if (!policy) return { status: "compliant", packages: [], attentionCount: 0 };
+  const packageJson = readJson2(join22(root, "package.json"));
+  const packageManager = policy.packageManager ? inspectPackageManager(packageJson, policy.packageManager.name, policy.packageManager.version) : void 0;
+  const runtime = policy.runtime ? inspectRuntime(policy.runtime.name, policy.runtime.version) : void 0;
+  const packages = policy.packages.map((requirement) => {
+    if (requirement.appliesTo && (!projectType || !requirement.appliesTo.includes(projectType))) {
+      return { name: requirement.name, expected: requirement.version, status: "not-applicable" };
+    }
+    const declared = findDeclaredVersion(packageJson, requirement.name);
+    const installed = readInstalledVersion(root, requirement.name);
+    const status = declared === void 0 ? requirement.appliesTo ? "missing" : "not-applicable" : declared !== requirement.version ? "drift" : installed !== requirement.version ? installed === void 0 ? "missing" : "drift" : "compliant";
+    return {
+      name: requirement.name,
+      expected: requirement.version,
+      declared,
+      installed,
+      actual: installed,
+      status
+    };
+  });
+  const all = [packageManager, runtime, ...packages].filter((item) => item !== void 0);
+  const attentionCount = all.filter((item) => item.status !== "compliant" && item.status !== "not-applicable").length;
+  return {
+    status: attentionCount === 0 ? "compliant" : "attention",
+    packageManager,
+    runtime,
+    packages,
+    attentionCount
+  };
+}
+function inspectPackageManager(packageJson, expectedName, expectedVersion) {
+  const declared = typeof packageJson?.packageManager === "string" ? packageJson.packageManager : void 0;
+  const expected = `${expectedName}@${expectedVersion}`;
+  return {
+    name: expectedName,
+    expected: expectedVersion,
+    actual: declared,
+    declared,
+    status: declared === void 0 ? "missing" : declared === expected ? "compliant" : "drift"
+  };
+}
+function inspectRuntime(expectedName, expectedVersion) {
+  const actual = expectedName === "node" ? process.versions.node : void 0;
+  return {
+    name: expectedName,
+    expected: expectedVersion,
+    actual,
+    status: actual === void 0 ? "missing" : actual === expectedVersion ? "compliant" : "drift"
+  };
+}
+function findDeclaredVersion(packageJson, name) {
+  for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+    const value = packageJson?.[section]?.[name];
+    if (typeof value === "string") return value;
+  }
+  return void 0;
+}
+function readInstalledVersion(root, name) {
+  const packageJson = readJson2(join22(root, "node_modules", name, "package.json"));
+  return typeof packageJson?.version === "string" ? packageJson.version : void 0;
+}
+function readJson2(path) {
+  if (!existsSync21(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync15(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+
 // src/portfolio/doctor.ts
 function inspectPortfolio(options) {
   const expectedPackageVersions = getExpectedPackageVersions();
@@ -3402,24 +3956,27 @@ function inspectPortfolio(options) {
     agentAssetsDir: options.agentAssetsDir,
     registry: options.registry,
     bundles: options.bundles,
-    expectedPackageVersions
+    expectedPackageVersions,
+    versionPolicy: options.manifest.technologyGovernance?.versionPolicy
   }));
   return {
     ok: hostTooling.issues.length === 0 && targets.every((target) => target.issues.length === 0),
     portfolioId: options.manifest.portfolioId,
     expectedPackageVersions,
     hostTooling,
+    hostSsot: { userSkills: inspectUserSkillsSsot(options.homeDir ?? homedir3()) },
     targets
   };
 }
 function inspectTarget(options) {
   const { target } = options;
+  const hostSsot = inspectProjectHostSsot(target.path);
   const issues = [];
-  const packageJson = readJson2(join19(target.path, "package.json"));
+  const packageJson = readJson3(join23(target.path, "package.json"));
   const packages = {};
   for (const packageName of ["@pieai/pro-gov", "@pieai/doc-gov"]) {
     const declared = packageJson?.devDependencies?.[packageName] ?? packageJson?.dependencies?.[packageName];
-    const installedPackage = readJson2(join19(target.path, "node_modules", packageName, "package.json"));
+    const installedPackage = readJson3(join23(target.path, "node_modules", packageName, "package.json"));
     const installed = installedPackage?.version;
     const expected = options.expectedPackageVersions[packageName];
     packages[packageName] = { declared, installed, expected };
@@ -3439,6 +3996,8 @@ function inspectTarget(options) {
     }
   }
   const checks = runTargetChecks(target);
+  const versions = inspectVersionPolicy(target.path, options.versionPolicy, target.projectType);
+  const verification = inspectProjectVerification(target.path);
   for (const check of checks) {
     if (check.status === 0) continue;
     issues.push({
@@ -3473,7 +4032,7 @@ function inspectTarget(options) {
       type: "asset-lock-drift",
       message: error instanceof Error ? error.message : String(error)
     });
-    if (!existsSync20(join19(target.path, ".pro-gov/assets.json"))) {
+    if (!existsSync22(join23(target.path, ".pro-gov/assets.json"))) {
       issues.push({ type: "bundle-drift", message: "Target asset manifest is missing." });
     }
   }
@@ -3484,19 +4043,22 @@ function inspectTarget(options) {
     packages,
     git: inspectGit(target.path),
     checks,
+    hostSsot,
+    versions,
+    verification,
     issues: deduplicateIssues(issues)
   };
 }
 function readTargetAssetHost(targetDir) {
-  const lockfile = readJson2(join19(targetDir, ".pro-gov/assets.lock.json"));
+  const lockfile = readJson3(join23(targetDir, ".pro-gov/assets.lock.json"));
   return isAssetRegistryHost(lockfile?.host) ? lockfile.host : void 0;
 }
 function isAssetRegistryHost(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
 function runTargetChecks(target) {
-  const proGovCli = join19(target.path, "node_modules/@pieai/pro-gov/dist/cli.js");
-  const docGovCli = join19(target.path, "node_modules/@pieai/doc-gov/dist/cli.js");
+  const proGovCli = join23(target.path, "node_modules/@pieai/pro-gov/dist/cli.js");
+  const docGovCli = join23(target.path, "node_modules/@pieai/doc-gov/dist/cli.js");
   const commands = [
     {
       name: "pro-gov doctor",
@@ -3507,7 +4069,7 @@ function runTargetChecks(target) {
     { name: "doc-gov scan --check", cli: docGovCli, args: ["scan", "--check"] }
   ];
   return commands.map((command2) => {
-    if (!existsSync20(command2.cli)) return { name: command2.name, status: null };
+    if (!existsSync22(command2.cli)) return { name: command2.name, status: null };
     const result = spawnSync5(process.execPath, [command2.cli, ...command2.args], {
       cwd: target.path,
       encoding: "utf8",
@@ -3531,11 +4093,11 @@ function inspectGit(path) {
   };
 }
 function getExpectedPackageVersions() {
-  const proGovPackage = readJson2(findOwnPackageJson());
+  const proGovPackage = readJson3(findOwnPackageJson());
   let docGovVersion;
   try {
     const require2 = createRequire2(import.meta.url);
-    const docGovPackage = readJson2(require2.resolve("@pieai/doc-gov/package.json"));
+    const docGovPackage = readJson3(require2.resolve("@pieai/doc-gov/package.json"));
     docGovVersion = docGovPackage?.version;
   } catch {
     docGovVersion = void 0;
@@ -3546,18 +4108,18 @@ function getExpectedPackageVersions() {
   };
 }
 function findOwnPackageJson() {
-  let current = dirname11(fileURLToPath3(import.meta.url));
+  let current = dirname12(fileURLToPath3(import.meta.url));
   for (let depth = 0; depth < 5; depth += 1) {
-    const candidate = join19(current, "package.json");
-    if (existsSync20(candidate)) return candidate;
-    current = dirname11(current);
+    const candidate = join23(current, "package.json");
+    if (existsSync22(candidate)) return candidate;
+    current = dirname12(current);
   }
   return "";
 }
-function readJson2(path) {
-  if (!path || !existsSync20(path)) return void 0;
+function readJson3(path) {
+  if (!path || !existsSync22(path)) return void 0;
   try {
-    return JSON.parse(readFileSync14(path, "utf8"));
+    return JSON.parse(readFileSync16(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -3576,26 +4138,31 @@ function deduplicateIssues(issues) {
 import { execFileSync } from "node:child_process";
 import {
   cpSync as cpSync2,
-  existsSync as existsSync21,
-  lstatSync as lstatSync6,
+  existsSync as existsSync23,
+  lstatSync as lstatSync8,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync15,
-  readdirSync as readdirSync8,
-  realpathSync as realpathSync2,
-  statSync as statSync4,
+  readFileSync as readFileSync17,
+  readdirSync as readdirSync9,
+  realpathSync as realpathSync4,
+  statSync as statSync5,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { homedir } from "node:os";
-import { dirname as dirname12, join as join20, relative as relative8, resolve as resolve4, sep } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname13, join as join24, relative as relative8, resolve as resolve5, sep } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
+var CURRENT_ROUTER_VERSION = "1.1";
 function inspectPortfolioAiHealth(options) {
-  const endpoints = collectEndpoints(options.manifest);
-  const secretsRoot = options.secretsRoot ?? join20(dirname12(options.manifest.controlPlane?.path ?? endpoints[0]?.endpoint.path ?? process.cwd()), ".secrets");
-  const homeDir = options.homeDir ?? process.env.HOME ?? homedir();
+  const allEndpoints = collectEndpoints(options.manifest);
+  const endpoints = options.targetId && options.targetId !== "all" ? allEndpoints.filter(({ endpoint }) => endpoint.id === options.targetId) : allEndpoints;
+  if (options.targetId && options.targetId !== "all" && endpoints.length === 0) {
+    throw new Error(`Unknown portfolio target: ${options.targetId}`);
+  }
+  const secretsRoot = options.secretsRoot ?? join24(dirname13(options.manifest.controlPlane?.path ?? allEndpoints[0]?.endpoint.path ?? process.cwd()), ".secrets");
+  const homeDir = options.homeDir ?? process.env.HOME ?? homedir4();
   const grokVersion = commandVersion("grok");
   const executionEngineRoot = options.manifest.executionEngine?.path;
   const skillRegistry = inspectSkillRegistry(executionEngineRoot);
-  const expectedPackageVersion = packageVersion(join20(executionEngineRoot ?? "", "packages/pro-gov/package.json"));
+  const expectedPackageVersion = packageVersion(join24(executionEngineRoot ?? "", "packages/pro-gov/package.json"));
   const repositories = endpoints.map(({ endpoint, role }) => inspectRepository(
     endpoint,
     role,
@@ -3608,15 +4175,27 @@ function inspectPortfolioAiHealth(options) {
   const summary = { healthy: 0, attention: 0, unhealthy: 0 };
   for (const repository of repositories) summary[repository.status] += 1;
   return {
-    schemaVersion: 2,
+    schemaVersion: 5,
     portfolioId: options.manifest.portfolioId,
     generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    privacy: "Names, paths, counts, scopes, and configuration origins only. Secret values, environment values, MCP commands, arguments, URLs, headers, and MCP environment maps are never retained or rendered.",
+    coverage: {
+      mode: options.targetId && options.targetId !== "all" ? "single" : "all",
+      targetId: options.targetId && options.targetId !== "all" ? options.targetId : void 0,
+      coveredRepositoryIds: repositories.map((repository) => repository.id),
+      totalRepositoryCount: allEndpoints.length
+    },
+    privacy: "Names, paths, counts, scopes, safe health states, and configuration origins only. Secret values, environment values, MCP commands, arguments, URLs, headers, MCP environment maps, and raw process environments are never retained or rendered.",
     secretsRoot: inspectSecretsRoot(secretsRoot),
-    hostEnvironment: inspectHostEnvironment(homeDir, grokVersion),
+    hostEnvironment: inspectHostEnvironment(
+      homeDir,
+      grokVersion,
+      allEndpoints.map(({ endpoint }) => endpoint.path),
+      options.manifest.specialistChecks?.devspace
+    ),
     skillRegistry,
     technologyGovernance: {
       strategySource: options.manifest.technologyGovernance?.strategySource,
+      versionPolicy: options.manifest.technologyGovernance?.versionPolicy,
       projectTypes: options.manifest.technologyGovernance?.projectTypes.length ?? 0,
       technologies: options.manifest.technologyGovernance?.technologies.length ?? 0
     },
@@ -3624,19 +4203,44 @@ function inspectPortfolioAiHealth(options) {
     repositories
   };
 }
+function mergePortfolioAiHealthReport(existing, latest, allRepositoryIds) {
+  const repositoriesById = /* @__PURE__ */ new Map();
+  for (const repository of existing?.repositories ?? []) repositoriesById.set(repository.id, repository);
+  for (const repository of latest.repositories) repositoriesById.set(repository.id, repository);
+  const repositories = allRepositoryIds.map((id) => repositoriesById.get(id)).filter((repository) => repository !== void 0);
+  const coveredIds = /* @__PURE__ */ new Set([
+    ...existing?.coverage?.coveredRepositoryIds ?? [],
+    ...latest.coverage.coveredRepositoryIds
+  ]);
+  const coveredRepositoryIds = allRepositoryIds.filter((id) => coveredIds.has(id));
+  const summary = { healthy: 0, attention: 0, unhealthy: 0 };
+  for (const repository of repositories) summary[repository.status] += 1;
+  const complete = coveredRepositoryIds.length === allRepositoryIds.length;
+  return {
+    ...latest,
+    repositories,
+    summary,
+    coverage: {
+      mode: complete ? "all" : "single",
+      targetId: complete ? void 0 : latest.coverage.targetId,
+      coveredRepositoryIds,
+      totalRepositoryCount: allRepositoryIds.length
+    }
+  };
+}
 function writePortfolioAiHealthReport(report, outDir) {
   mkdirSync8(outDir, { recursive: true });
   const dashboardAssets = findDashboardAssets();
   for (const file of ["index.html", "app.js", "app.css"]) {
-    const source = join20(dashboardAssets, file);
-    if (!existsSync21(source)) throw new Error(`Portfolio dashboard asset is missing: ${source}`);
-    cpSync2(source, join20(outDir, file));
+    const source = join24(dashboardAssets, file);
+    if (!existsSync23(source)) throw new Error(`Portfolio dashboard asset is missing: ${source}`);
+    cpSync2(source, join24(outDir, file));
   }
-  const jsonPath = join20(outDir, "portfolio-ai-health.json");
-  const htmlPath = join20(outDir, "index.html");
+  const jsonPath = join24(outDir, "portfolio-ai-health.json");
+  const htmlPath = join24(outDir, "index.html");
   writeFileSync7(jsonPath, `${JSON.stringify(report, null, 2)}
 `);
-  writeFileSync7(join20(outDir, "data.js"), `window.__PORTFOLIO_AI_HEALTH__ = ${safeJavaScriptJson(report)};
+  writeFileSync7(join24(outDir, "data.js"), `window.__PORTFOLIO_AI_HEALTH__ = ${safeJavaScriptJson(report)};
 `);
   return { jsonPath, htmlPath };
 }
@@ -3647,7 +4251,7 @@ function collectEndpoints(manifest) {
   for (const target of manifest.targets) result.push({ endpoint: target, role: "target" });
   const seen = /* @__PURE__ */ new Set();
   return result.filter(({ endpoint }) => {
-    const key = resolve4(endpoint.path);
+    const key = resolve5(endpoint.path);
     if (seen.has(key)) return false;
     seen.add(key);
     return true;
@@ -3659,18 +4263,22 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
   const entries = inspectEntries(root);
   const grokInspection = inspectGrokProject(root, homeDir, grokVersion);
   const skills = inspectSkills(root, grokInspection);
+  const hostSsot = inspectProjectHostSsot(root);
   const hooks = inspectHooks(root);
   const docs = inspectDocs(root, role === "execution-engine" ? void 0 : expectedPackageVersion);
   const mcp = {
-    codexProject: tomlMcpNames(join20(root, ".codex/config.toml")),
-    claudeCodeProjectShared: jsonObjectKeys(join20(root, ".mcp.json"), "mcpServers"),
+    codexProject: tomlMcpNames(join24(root, ".codex/config.toml")),
+    claudeCodeProjectShared: jsonObjectKeys(join24(root, ".mcp.json"), "mcpServers"),
     claudeCodeProjectLocal: claudeProjectLocalMcpNames(homeDir, root),
-    grokProject: tomlMcpNames(join20(root, ".grok/config.toml")),
+    grokProject: tomlMcpNames(join24(root, ".grok/config.toml")),
     grokEffective: grokInspection.effectiveMcp,
     grokInspection: grokInspection.inspection
   };
   const secrets = inspectRepositorySecrets(root, endpoint.id, secretsRoot, git.isRepository, endpoint.environmentPolicy);
   const projectModel = inspectProjectModel(root, endpoint, technologyGovernance);
+  const versions = inspectVersionPolicy(root, technologyGovernance?.versionPolicy, endpoint.projectType);
+  const verification = inspectProjectVerification(root);
+  const redundancy = inspectProjectRedundancy(root, { homeDir });
   const recommendations = [];
   if (!git.isRepository) recommendations.push("\u8BE5\u8DEF\u5F84\u4E0D\u662F Git \u4ED3\u5E93\uFF1B\u786E\u8BA4\u6E05\u5355\u8DEF\u5F84\u662F\u5426\u6B63\u786E\u3002");
   if (git.unmergedBranches.length > 0) recommendations.push(`\u6709 ${git.unmergedBranches.length} \u6761\u5206\u652F\u5C1A\u672A\u5408\u5165\u5F53\u524D HEAD\uFF1A${git.unmergedBranches.join(", ")}\u3002`);
@@ -3689,6 +4297,9 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
   if (skills.canonical.some((skill) => skill.kind === "dangling-symlink")) recommendations.push("`.agents/skills` \u4E2D\u5B58\u5728\u65AD\u5F00\u7684\u6280\u80FD\u94FE\u63A5\u3002");
   if (skills.claudeCompatibility === "duplicate-directory") recommendations.push("`.claude/skills` \u662F\u72EC\u7ACB\u526F\u672C\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 `.agents/skills`\uFF0C\u907F\u514D\u53CC\u4EFD\u6280\u80FD\u6F02\u79FB\u3002");
   if (skills.claudeCompatibility === "dangling-symlink") recommendations.push("`.claude/skills` \u662F\u65AD\u5F00\u7684\u94FE\u63A5\u3002");
+  if (!hostSsot.claudeEntry.compliant) recommendations.push(`CLAUDE.md \u4E0D\u662F\u89C4\u8303\u7684\u76F8\u5BF9\u94FE\u63A5 AGENTS.md\uFF08${hostSsot.claudeEntry.status}\uFF09\u3002`);
+  if (!hostSsot.claudeSkills.compliant) recommendations.push(`.claude/skills \u4E0D\u662F\u89C4\u8303\u7684\u76F8\u5BF9\u94FE\u63A5 ../.agents/skills\uFF08${hostSsot.claudeSkills.status}\uFF09\u3002`);
+  if (hostSsot.canonicalSkills.status !== "directory") recommendations.push(`\u7F3A\u5C11\u89C4\u8303\u7684 .agents/skills \u6280\u80FD\u76EE\u5F55\uFF08${hostSsot.canonicalSkills.status}\uFF09\u3002`);
   if (hasWorkflowReminderHooks(hooks)) recommendations.push("\u53D1\u73B0 Stop/SubagentStop hook\uFF1B\u786E\u8BA4\u5B83\u662F\u5426\u4ECD\u6709\u9879\u76EE\u4E13\u5C5E\u7528\u9014\uFF0C\u5E76\u79FB\u9664\u9000\u4F11\u7684 PGS \u5DE5\u4F5C\u6D41\u63D0\u9192\u3002");
   const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
   const envNeedsCentralReview = liveEnv.filter((file) => !file.localOnly);
@@ -3697,38 +4308,47 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
   else if (envNeedsCentralReview.some((file) => !file.centralized)) recommendations.push("\u53D1\u73B0\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\u5C1A\u672A\u8FDE\u63A5\u5230\u672C\u9879\u76EE\u7684\u4E2D\u592E `.secrets` \u76EE\u5F55\uFF1B\u533A\u5206\u53EF\u4E22\u5F03\u751F\u6210\u7269\u4E0E\u672C\u5730\u4E3B\u6765\u6E90\uFF0C\u9700\u4FDD\u7559\u7684\u6765\u6E90\u5E94\u96C6\u4E2D\u540E\u518D\u63A5\u56DE\u9879\u76EE\u3002");
   if (hasUnsafeCentralSecretPermissions(secrets)) recommendations.push("\u4E2D\u592E\u5BC6\u94A5\u76EE\u5F55\u6216\u6587\u4EF6\u6743\u9650\u8FC7\u5BBD\uFF1B\u76EE\u5F55\u5E94\u4E3A 0700\uFF0C\u914D\u7F6E\u6587\u4EF6\u5E94\u4E3A 0600\u3002");
   if (!docs.packages.aligned) recommendations.push(`PGS \u5305\u7248\u672C\u672A\u4E0E\u6267\u884C\u5F15\u64CE ${docs.packages.expected ?? "\u672A\u77E5\u7248\u672C"} \u5BF9\u9F50\uFF1B\u53D1\u5E03\u4E0A\u6E38\u540E\u518D\u540C\u6B65\u76EE\u6807\u4ED3\u5E93\u3002`);
+  if (!docs.routerAligned) recommendations.push(`PGS Router \u7248\u672C\u4E3A ${docs.routerVersion ? `v${docs.routerVersion}` : "\u672A\u8BC6\u522B"}\uFF0C\u5E94\u540C\u6B65\u5230 v${docs.expectedRouterVersion}\u3002`);
   if (role === "target" && !docs.manifest) recommendations.push("\u7F3A\u5C11 docs/governance/MANIFEST.yml\uFF1B\u6587\u6863\u6E05\u5355\u65E0\u6CD5\u8BC1\u660E\u5DF2\u540C\u6B65\u3002");
   if (technologyGovernance && !projectModel.projectType) recommendations.push("\u672A\u58F0\u660E\u9879\u76EE\u7C7B\u578B\uFF1B\u65E0\u6CD5\u628A\u5B9E\u9645\u6280\u672F\u4E0E\u4EA7\u54C1\u7EBF\u57FA\u7EBF\u8FDB\u884C\u6BD4\u8F83\u3002");
   const missingBaseline = projectModel.baseline.filter((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
   if (missingBaseline.length > 0) recommendations.push(`\u6280\u672F\u57FA\u7EBF\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingBaseline.map((technology) => technology.label).join("\u3001")}\u3002`);
   const missingSelected = projectModel.optionalCapabilities.filter((technology) => technology.selected && !technology.detected);
   if (missingSelected.length > 0) recommendations.push(`\u5DF2\u9009\u80FD\u529B\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingSelected.map((technology) => technology.label).join("\u3001")}\u3002`);
+  if (versions.status === "attention") recommendations.push(`\u6280\u672F\u7248\u672C\u7B56\u7565\u6709 ${versions.attentionCount} \u9879\u6F02\u79FB\u6216\u7F3A\u5931\uFF1B\u58F0\u660E\u7248\u672C\u4E0E\u5DF2\u5B89\u88C5\u7248\u672C\u5FC5\u987B\u7CBE\u786E\u5BF9\u9F50\u3002`);
+  if (verification.status === "attention") recommendations.push(`\u9A8C\u8BC1\u811A\u672C\u7F3A\u5931\uFF1A${verification.missing.join("\u3001")}\uFF1BPGS \u8981\u6C42 typecheck\u3001lint\u3001format:check\u3001verify \u53EF\u53D1\u73B0\u3002`);
+  if (redundancy.status === "attention") recommendations.push("\u53D1\u73B0\u65E7 AI \u76EE\u5F55\u6216\u5927\u578B Playwright \u7F13\u5B58\uFF1B\u4EC5\u63D0\u4F9B\u8BC1\u636E\uFF0C\u786E\u8BA4\u5F52\u5C5E\u540E\u518D\u7531\u4EBA\u5DE5\u6E05\u7406\u3002");
   return {
     id: endpoint.id,
     role,
     path: root,
     profile: "profile" in endpoint ? endpoint.profile : void 0,
-    status: deriveStatus(role, entries, git, hooks, skills, secrets, docs, projectModel, Boolean(technologyGovernance)),
+    status: deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, Boolean(technologyGovernance), versions, verification, redundancy),
     recommendations,
     git,
     entries,
     hooks,
     mcp,
     skills,
+    hostSsot,
     secrets,
     docs,
-    projectModel
+    projectModel,
+    versions,
+    verification,
+    redundancy
   };
 }
-function deriveStatus(role, entries, git, hooks, skills, secrets, docs, projectModel, technologyGovernanceConfigured) {
+function deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, technologyGovernanceConfigured, versions, verification, redundancy) {
   if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || skills.canonical.some((item) => item.kind === "dangling-symlink") || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets)) return "unhealthy";
   const missingBaseline = projectModel.baseline.some((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
   const missingSelected = projectModel.optionalCapabilities.some((technology) => technology.selected && !technology.detected);
   const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
   const secretMaterializationNeedsReview = liveEnv.some((file) => !file.centralized && !file.localOnly);
   const packageVersionNeedsReview = docs.packages.expected !== void 0 && !docs.packages.aligned;
+  const routerVersionNeedsReview = !docs.routerAligned;
   const targetManifestMissing = role === "target" && !docs.manifest;
-  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected || packageVersionNeedsReview || targetManifestMissing) return "attention";
+  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || !hostSsot.compliant || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected || packageVersionNeedsReview || routerVersionNeedsReview || targetManifestMissing || versions.status === "attention" || verification.status === "attention" || redundancy.legacyDirectories.length > 0) return "attention";
   return "healthy";
 }
 function inspectProjectModel(root, endpoint, governance) {
@@ -3738,7 +4358,7 @@ function inspectProjectModel(root, endpoint, governance) {
   const detection = (id) => {
     const technology = technologyById.get(id);
     const packageMatch = technology?.packages?.some((name) => packages.has(name)) ?? false;
-    const fileMatch = technology?.files?.some((path) => existsSync21(join20(root, path))) ?? false;
+    const fileMatch = technology?.files?.some((path) => existsSync23(join24(root, path))) ?? false;
     return { id, label: technology?.label ?? id, detected: packageMatch || fileMatch };
   };
   const selected = new Set(endpoint.capabilities ?? []);
@@ -3761,10 +4381,10 @@ function collectPackageNames(root) {
   try {
     files = splitLines(execFileSync("git", ["ls-files", "*package.json"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }));
   } catch {
-    if (existsSync21(join20(root, "package.json"))) files = ["package.json"];
+    if (existsSync23(join24(root, "package.json"))) files = ["package.json"];
   }
   for (const file of files) {
-    const packageJson = readJson3(join20(root, file));
+    const packageJson = readJson4(join24(root, file));
     if (!isRecord3(packageJson)) continue;
     for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
       const dependencies = packageJson[section];
@@ -3802,15 +4422,15 @@ function inspectGit2(root) {
   };
 }
 function inspectEntries(root) {
-  const agentsPath = join20(root, "AGENTS.md");
-  const agents = !existsSync21(agentsPath) ? "missing" : safeRead(agentsPath).includes("PGS-ROUTER:BEGIN") ? "pgs-router" : "custom";
-  const claudePath = join20(root, "CLAUDE.md");
+  const agentsPath = join24(root, "AGENTS.md");
+  const agents = !existsSync23(agentsPath) ? "missing" : safeRead(agentsPath).includes("PGS-ROUTER:BEGIN") ? "pgs-router" : "custom";
+  const claudePath = join24(root, "CLAUDE.md");
   let claude = "missing";
   if (pathLexists(claudePath)) {
-    const info = lstatSync6(claudePath);
+    const info = lstatSync8(claudePath);
     if (info.isSymbolicLink()) {
       try {
-        claude = realpathSync2(claudePath) === realpathSync2(agentsPath) ? "agents-symlink" : "custom";
+        claude = realpathSync4(claudePath) === realpathSync4(agentsPath) ? "agents-symlink" : "custom";
       } catch {
         claude = "dangling-symlink";
       }
@@ -3822,12 +4442,12 @@ function inspectEntries(root) {
   return { agents, claude, gemini: inspectOptionalEntry(root, "GEMINI.md", agentsPath) };
 }
 function inspectOptionalEntry(root, filename, agentsPath) {
-  const path = join20(root, filename);
+  const path = join24(root, filename);
   if (!pathLexists(path)) return "missing";
-  const info = lstatSync6(path);
+  const info = lstatSync8(path);
   if (info.isSymbolicLink()) {
     try {
-      return realpathSync2(path) === realpathSync2(agentsPath) ? "agents-symlink" : "custom";
+      return realpathSync4(path) === realpathSync4(agentsPath) ? "agents-symlink" : "custom";
     } catch {
       return "dangling-symlink";
     }
@@ -3836,7 +4456,7 @@ function inspectOptionalEntry(root, filename, agentsPath) {
   return /AGENTS\.md/.test(content) && content.length < 2e3 ? "thin-adapter" : "custom";
 }
 function inspectSkills(root, grokInspection) {
-  const lock = readJson3(join20(root, ".pro-gov/assets.lock.json"));
+  const lock = readJson4(join24(root, ".pro-gov/assets.lock.json"));
   const managed = /* @__PURE__ */ new Set();
   const bundleIds = stringArray(isRecord3(lock) ? lock.bundleIds : void 0);
   if (isRecord3(lock) && Array.isArray(lock.assets)) {
@@ -3846,14 +4466,14 @@ function inspectSkills(root, grokInspection) {
       if (match) managed.add(match[1]);
     }
   }
-  const skillRoot = join20(root, ".agents/skills");
+  const skillRoot = join24(root, ".agents/skills");
   const canonical = pathLexists(skillRoot) && safeIsDirectory(skillRoot) ? safeReadDir(skillRoot).filter((name) => !name.startsWith(".")).map((name) => {
-    const path = join20(skillRoot, name);
-    const stat = lstatSync6(path);
+    const path = join24(skillRoot, name);
+    const stat = lstatSync8(path);
     let kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : "file";
     if (stat.isSymbolicLink()) {
       try {
-        realpathSync2(path);
+        realpathSync4(path);
       } catch {
         kind = "dangling-symlink";
       }
@@ -3874,20 +4494,20 @@ function inspectSkills(root, grokInspection) {
     },
     hosts: {
       codexProject: canonical.filter((item) => item.kind !== "dangling-symlink").length,
-      claudeCodeProject: inspectSkillRoot(join20(root, ".claude/skills")).names.length,
-      grokNativeProject: inspectSkillRoot(join20(root, ".grok/skills")).names.length,
+      claudeCodeProject: inspectSkillRoot(join24(root, ".claude/skills")).names.length,
+      grokNativeProject: inspectSkillRoot(join24(root, ".grok/skills")).names.length,
       grokEffective: grokInspection.skills
     }
   };
 }
 function inspectClaudeSkillRoot(root) {
-  const path = join20(root, ".claude/skills");
+  const path = join24(root, ".claude/skills");
   if (!pathLexists(path)) return "missing";
-  const stat = lstatSync6(path);
+  const stat = lstatSync8(path);
   if (stat.isSymbolicLink()) {
     try {
-      const target = realpathSync2(path);
-      return target === realpathSync2(join20(root, ".agents/skills")) ? "shared-root" : "other";
+      const target = realpathSync4(path);
+      return target === realpathSync4(join24(root, ".agents/skills")) ? "shared-root" : "other";
     } catch {
       return "dangling-symlink";
     }
@@ -3895,7 +4515,7 @@ function inspectClaudeSkillRoot(root) {
   return stat.isDirectory() ? "duplicate-directory" : "other";
 }
 function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environmentPolicy) {
-  const centralPath = join20(secretsRoot, id);
+  const centralPath = join24(secretsRoot, id);
   const centralRealPath = safeRealpath(centralPath);
   const localOnlyReasons = new Map(
     (environmentPolicy?.localOnly ?? []).map((entry) => [entry.path, entry.reason])
@@ -3907,16 +4527,16 @@ function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environme
       tracked: isRepository ? gitTracks(root, path) : false,
       template: isEnvironmentTemplate(path),
       fixture: isEnvironmentFixture(path),
-      symlink: lstatSync6(join20(root, path)).isSymbolicLink(),
-      centralized: pointsInside(join20(root, path), centralRealPath),
+      symlink: lstatSync8(join24(root, path)).isSymbolicLink(),
+      centralized: pointsInside(join24(root, path), centralRealPath),
       localOnly: localOnlyReason !== void 0,
       ...localOnlyReason !== void 0 ? { localOnlyReason } : {}
     };
   });
   return {
-    centralDirectory: existsSync21(centralPath) ? "present" : "absent",
-    centralMode: existsSync21(centralPath) ? modeString(statSync4(centralPath).mode) : void 0,
-    centralFiles: existsSync21(centralPath) ? collectCentralSecretFiles(centralPath) : [],
+    centralDirectory: existsSync23(centralPath) ? "present" : "absent",
+    centralMode: existsSync23(centralPath) ? modeString(statSync5(centralPath).mode) : void 0,
+    centralFiles: existsSync23(centralPath) ? collectCentralSecretFiles(centralPath) : [],
     repositoryEnvFiles: envFiles
   };
 }
@@ -3925,11 +4545,11 @@ function collectEnvironmentFiles(root, current = root, depth = 0) {
   if (depth > 5) return [];
   const found = [];
   try {
-    for (const entry of readdirSync8(current, { withFileTypes: true })) {
+    for (const entry of readdirSync9(current, { withFileTypes: true })) {
       if (entry.isDirectory()) {
-        if (!SKIP_ENV_DIRECTORIES.has(entry.name)) found.push(...collectEnvironmentFiles(root, join20(current, entry.name), depth + 1));
+        if (!SKIP_ENV_DIRECTORIES.has(entry.name)) found.push(...collectEnvironmentFiles(root, join24(current, entry.name), depth + 1));
       } else if (isEnvironmentFilename(entry.name) && !isProviderGeneratedEnvironmentFile(entry.name)) {
-        found.push(relative8(root, join20(current, entry.name)));
+        found.push(relative8(root, join24(current, entry.name)));
       }
     }
   } catch {
@@ -3941,10 +4561,10 @@ function collectCentralSecretFiles(root, current = root, depth = 0) {
   if (depth > 3) return [];
   const found = [];
   try {
-    for (const entry of readdirSync8(current, { withFileTypes: true })) {
-      const path = join20(current, entry.name);
+    for (const entry of readdirSync9(current, { withFileTypes: true })) {
+      const path = join24(current, entry.name);
       if (entry.isDirectory()) found.push(...collectCentralSecretFiles(root, path, depth + 1));
-      else found.push({ path: relative8(root, path), mode: modeString(lstatSync6(path).mode) });
+      else found.push({ path: relative8(root, path), mode: modeString(lstatSync8(path).mode) });
     }
   } catch {
     return found;
@@ -3969,13 +4589,13 @@ function isEnvironmentFixture(path) {
 }
 function safeRealpath(path) {
   try {
-    return realpathSync2(path);
+    return realpathSync4(path);
   } catch {
     return void 0;
   }
 }
 function pointsInside(path, expectedRoot) {
-  if (!expectedRoot || !lstatSync6(path).isSymbolicLink()) return false;
+  if (!expectedRoot || !lstatSync8(path).isSymbolicLink()) return false;
   const target = safeRealpath(path);
   if (!target) return false;
   const fromRoot = relative8(expectedRoot, target);
@@ -3985,24 +4605,25 @@ function hasUnsafeCentralSecretPermissions(secrets) {
   return secrets.centralDirectory === "present" && (secrets.centralMode !== "700" || secrets.centralFiles.some((file) => file.mode !== "600"));
 }
 function inspectSecretsRoot(path) {
-  return existsSync21(path) ? { path, exists: true, mode: modeString(statSync4(path).mode) } : { path, exists: false };
+  return existsSync23(path) ? { path, exists: true, mode: modeString(statSync5(path).mode) } : { path, exists: false };
 }
-function inspectHostEnvironment(homeDir, grokVersion) {
-  const codexConfig = join20(homeDir, ".codex/config.toml");
-  const claudeConfig = join20(homeDir, ".claude.json");
-  const grokConfig = join20(homeDir, ".grok/config.toml");
-  return {
+function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceSettings) {
+  const codexConfig = join24(homeDir, ".codex/config.toml");
+  const claudeConfig = join24(homeDir, ".claude.json");
+  const grokConfig = join24(homeDir, ".grok/config.toml");
+  const hostEnvironment = {
     mcp: {
       codexUser: { path: codexConfig, names: tomlMcpNames(codexConfig) },
       claudeCodeUser: { path: claudeConfig, names: jsonObjectKeys(claudeConfig, "mcpServers") },
       grokUser: { path: grokConfig, names: tomlMcpNames(grokConfig) }
     },
     skills: {
-      codexUser: inspectSkillRoot(join20(homeDir, ".agents/skills")),
-      claudeCodeUser: inspectSkillRoot(join20(homeDir, ".claude/skills")),
-      grokUser: inspectSkillRoot(join20(homeDir, ".grok/skills")),
-      grokAgentsCompatibility: inspectSkillRoot(join20(homeDir, ".agents/skills")),
-      grokClaudeCompatibility: inspectSkillRoot(join20(homeDir, ".claude/skills"))
+      codexUser: inspectSkillRoot(join24(homeDir, ".agents/skills")),
+      claudeCodeUser: inspectSkillRoot(join24(homeDir, ".claude/skills")),
+      grokUser: inspectSkillRoot(join24(homeDir, ".grok/skills")),
+      grokAgentsCompatibility: inspectSkillRoot(join24(homeDir, ".agents/skills")),
+      grokClaudeCompatibility: inspectSkillRoot(join24(homeDir, ".claude/skills")),
+      ssot: inspectUserSkillsSsot(homeDir)
     },
     grok: {
       available: grokVersion !== void 0,
@@ -4010,20 +4631,121 @@ function inspectHostEnvironment(homeDir, grokVersion) {
       inspectionCommand: "grok inspect --json"
     }
   };
+  if (devspaceSettings) {
+    hostEnvironment.devspace = inspectDevSpaceHealth({
+      homeDir,
+      repositoryPaths,
+      expectedToolMode: devspaceSettings.expectedToolMode
+    });
+  }
+  return hostEnvironment;
+}
+function inspectDevSpaceHealth(options) {
+  const run = options.run ?? runDevSpaceCommand;
+  const configDirectory = join24(options.homeDir, ".devspace");
+  const configPath = join24(configDirectory, "config.json");
+  const authPath = join24(configDirectory, "auth.json");
+  const installedResult = run("devspace", ["--version"], 3e3);
+  const installedVersion = installedResult.ok ? installedResult.stdout.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/)?.[0] : void 0;
+  const latestResult = run("npm", ["view", "@waishnav/devspace", "version", "--registry=https://registry.npmjs.org/"], 5e3);
+  const latestVersion = latestResult.ok ? latestResult.stdout.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/)?.[0] : void 0;
+  const processResult = run("pgrep", ["-f", "devspace serve"], 3e3);
+  const pid = processResult.ok ? processResult.stdout.match(/\b\d+\b/)?.[0] : void 0;
+  const processEnvironment = pid ? run("ps", ["eww", "-p", pid, "-o", "command="], 3e3) : void 0;
+  const processToolMode = processEnvironment?.ok ? processEnvironment.stdout.match(/(?:^|\s)DEVSPACE_TOOL_MODE=(minimal|full|codex)(?:\s|$)/)?.[1] : void 0;
+  const doctor = !installedResult.ok ? "unavailable" : run("devspace", ["doctor"], 1e4).ok ? "ok" : "failed";
+  const configValue = readJson4(configPath);
+  const configExists = isRecord3(configValue);
+  const allowedRoots = configExists && Array.isArray(configValue.allowedRoots) ? configValue.allowedRoots.filter((value) => typeof value === "string") : [];
+  const portfolioCoverage = !configExists || allowedRoots.length === 0 ? "unknown" : options.repositoryPaths.every((repositoryPath) => allowedRoots.some((root) => isPathInside(repositoryPath, root))) ? "complete" : "partial";
+  const bind = configExists && typeof configValue.host === "string" ? isLoopbackHost(configValue.host) ? "loopback" : "non-loopback" : "unknown";
+  const directoryMode = existsSync23(configDirectory) ? modeString(statSync5(configDirectory).mode) : void 0;
+  const fileMode = existsSync23(configPath) ? modeString(statSync5(configPath).mode) : void 0;
+  const authMode = existsSync23(authPath) ? modeString(statSync5(authPath).mode) : void 0;
+  const update = installedVersion && latestVersion ? installedVersion === latestVersion ? "current" : "available" : "unknown";
+  const recommendations = [];
+  let status = "healthy";
+  const unhealthy = (message) => {
+    status = "unhealthy";
+    recommendations.push(message);
+  };
+  const attention = (message) => {
+    if (status === "healthy") status = "attention";
+    recommendations.push(message);
+  };
+  if (!installedResult.ok) unhealthy("\u672C\u673A\u672A\u53D1\u73B0 DevSpace\uFF1B\u65E0\u6CD5\u4F7F\u7528\u5BBF\u4E3B\u5DE5\u4F5C\u533A\u670D\u52A1\u3002");
+  if (!configExists) unhealthy("\u7F3A\u5C11 ~/.devspace/config.json\u3002");
+  if (!existsSync23(authPath)) unhealthy("\u7F3A\u5C11 ~/.devspace/auth.json\u3002");
+  if (directoryMode && directoryMode !== "700") unhealthy(`~/.devspace \u76EE\u5F55\u6743\u9650\u4E3A ${directoryMode}\uFF0C\u5E94\u6536\u7D27\u4E3A 700\u3002`);
+  if (fileMode && fileMode !== "600") unhealthy(`DevSpace \u914D\u7F6E\u6587\u4EF6\u6743\u9650\u4E3A ${fileMode}\uFF0C\u5E94\u4E3A 600\u3002`);
+  if (authMode && authMode !== "600") unhealthy(`DevSpace \u8BA4\u8BC1\u6587\u4EF6\u6743\u9650\u4E3A ${authMode}\uFF0C\u5E94\u4E3A 600\u3002`);
+  if (bind === "non-loopback") unhealthy("DevSpace \u76F4\u63A5\u7ED1\u5B9A\u5230\u975E\u672C\u673A\u5730\u5740\uFF1B\u5E94\u4F7F\u7528 loopback \u5E76\u7531\u53D7\u63A7\u4EE3\u7406\u66B4\u9732\u3002");
+  if (doctor === "failed") unhealthy("devspace doctor \u672A\u901A\u8FC7\u3002");
+  if (portfolioCoverage === "partial") attention("DevSpace allowedRoots \u6CA1\u6709\u8986\u76D6\u5168\u90E8\u5DF2\u767B\u8BB0\u4ED3\u5E93\u3002");
+  if (installedResult.ok && !pid) attention("DevSpace \u5DF2\u5B89\u88C5\u4F46\u5F53\u524D\u6CA1\u6709\u8FD0\u884C\u3002");
+  if (options.expectedToolMode && pid && processToolMode !== options.expectedToolMode) {
+    attention(`\u8FD0\u884C\u4E2D\u7684 DevSpace \u5DE5\u5177\u6A21\u5F0F\u4E3A ${processToolMode ?? "unknown"}\uFF0C\u671F\u671B ${options.expectedToolMode}\u3002`);
+  }
+  if (update === "available") attention(`DevSpace \u6709\u65B0\u7248\u672C\uFF1A${installedVersion} \u2192 ${latestVersion}\uFF1B\u5347\u7EA7\u524D\u4ECD\u5E94\u68C0\u67E5\u53D8\u66F4\u4E0E\u517C\u5BB9\u6027\u3002`);
+  return {
+    status,
+    installed: installedResult.ok,
+    ...installedVersion ? { installedVersion } : {},
+    ...latestVersion ? { latestVersion } : {},
+    update,
+    doctor,
+    running: Boolean(pid),
+    ...options.expectedToolMode ? { expectedToolMode: options.expectedToolMode } : {},
+    processToolMode: processToolMode ?? "unknown",
+    config: {
+      exists: configExists,
+      ...directoryMode ? { directoryMode } : {},
+      ...fileMode ? { fileMode } : {},
+      authExists: existsSync23(authPath),
+      ...authMode ? { authMode } : {},
+      bind,
+      portValid: configExists && typeof configValue.port === "number" && Number.isInteger(configValue.port) && configValue.port > 0 && configValue.port <= 65535,
+      publicHttpsConfigured: configExists && typeof configValue.publicBaseUrl === "string" && configValue.publicBaseUrl.startsWith("https://"),
+      allowedRootCount: allowedRoots.length,
+      portfolioCoverage
+    },
+    recommendations
+  };
+}
+function runDevSpaceCommand(command2, args, timeout) {
+  try {
+    return {
+      ok: true,
+      stdout: execFileSync(command2, args, {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout
+      })
+    };
+  } catch {
+    return { ok: false, stdout: "" };
+  }
+}
+function isLoopbackHost(host) {
+  return ["127.0.0.1", "localhost", "::1"].includes(host.trim().toLowerCase());
+}
+function isPathInside(path, root) {
+  const fromRoot = relative8(resolve5(root), resolve5(path));
+  return fromRoot === "" || fromRoot !== ".." && !fromRoot.startsWith(`..${sep}`);
 }
 function inspectSkillRoot(path) {
   const exists = pathLexists(path) && safeIsDirectory(path);
-  const names = exists ? safeReadDir(path).filter((name) => !name.startsWith(".") && existsSync21(join20(path, name, "SKILL.md"))) : [];
+  const names = exists ? safeReadDir(path).filter((name) => !name.startsWith(".") && existsSync23(join24(path, name, "SKILL.md"))) : [];
   return { path, exists, names };
 }
 function claudeProjectLocalMcpNames(homeDir, root) {
   if (!homeDir) return [];
-  const value = readJson3(join20(homeDir, ".claude.json"));
+  const value = readJson4(join24(homeDir, ".claude.json"));
   if (!isRecord3(value) || !isRecord3(value.projects)) return [];
-  const candidates = new Set([resolve4(root), safeRealpath(root)].filter((path) => Boolean(path)));
+  const candidates = new Set([resolve5(root), safeRealpath(root)].filter((path) => Boolean(path)));
   const names = /* @__PURE__ */ new Set();
   for (const [path, project] of Object.entries(value.projects)) {
-    const projectPaths = [resolve4(path), safeRealpath(path)].filter((candidate) => Boolean(candidate));
+    const projectPaths = [resolve5(path), safeRealpath(path)].filter((candidate) => Boolean(candidate));
     if (!projectPaths.some((candidate) => candidates.has(candidate)) || !isRecord3(project) || !isRecord3(project.mcpServers)) continue;
     for (const name of Object.keys(project.mcpServers)) names.add(name);
   }
@@ -4054,13 +4776,13 @@ function inspectGrokProject(root, homeDir, grokVersion) {
     const value = JSON.parse(execFileSync("grok", ["inspect", "--json"], {
       cwd: root,
       encoding: "utf8",
-      env: { ...process.env, HOME: homeDir, GROK_HOME: join20(homeDir, ".grok") },
+      env: { ...process.env, HOME: homeDir, GROK_HOME: join24(homeDir, ".grok") },
       maxBuffer: 10 * 1024 * 1024,
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 8e3
     }));
     if (!isRecord3(value)) return empty("failed");
-    const userClaudeNames = new Set(jsonObjectKeys(join20(homeDir, ".claude.json"), "mcpServers"));
+    const userClaudeNames = new Set(jsonObjectKeys(join24(homeDir, ".claude.json"), "mcpServers"));
     const localClaudeNames = new Set(claudeProjectLocalMcpNames(homeDir, root));
     const effectiveMcp = Array.isArray(value.mcpServers) ? value.mcpServers.flatMap((item) => {
       if (!isRecord3(item) || typeof item.name !== "string") return [];
@@ -4116,15 +4838,15 @@ function inferGrokMcpScope(name, sourceType, sourcePath, root, homeDir, userClau
     if (userClaudeNames.has(name)) return "user";
     return "unknown";
   }
-  const resolvedSource = safeRealpath(sourcePath) ?? resolve4(sourcePath);
-  const resolvedRoot = safeRealpath(root) ?? resolve4(root);
-  if (resolvedSource === join20(resolvedRoot, ".mcp.json")) return "project-shared";
+  const resolvedSource = safeRealpath(sourcePath) ?? resolve5(sourcePath);
+  const resolvedRoot = safeRealpath(root) ?? resolve5(root);
+  if (resolvedSource === join24(resolvedRoot, ".mcp.json")) return "project-shared";
   if (resolvedSource.startsWith(resolvedRoot + sep)) return "project";
-  if (homeDir && resolvedSource === join20(resolve4(homeDir), ".claude.json")) {
+  if (homeDir && resolvedSource === join24(resolve5(homeDir), ".claude.json")) {
     if (localClaudeNames.has(name)) return "project-local";
     if (userClaudeNames.has(name)) return "user";
   }
-  if (homeDir && resolvedSource.startsWith(resolve4(homeDir) + sep)) return "user";
+  if (homeDir && resolvedSource.startsWith(resolve5(homeDir) + sep)) return "user";
   if (sourceType === "project") return "project";
   return "unknown";
 }
@@ -4155,7 +4877,7 @@ function inspectHooks(root) {
     { host: "codex", path: ".codex/hooks.json" }
   ];
   return configs.map((config) => {
-    const value = readJson3(join20(root, config.path));
+    const value = readJson4(join24(root, config.path));
     const counts = /* @__PURE__ */ new Map();
     collectHookEvents(value, counts);
     return {
@@ -4176,16 +4898,18 @@ function collectHookEvents(value, counts) {
   }
 }
 function inspectDocs(root, expected) {
-  const packageJson = readJson3(join20(root, "package.json"));
+  const packageJson = readJson4(join24(root, "package.json"));
   const dependencies = isRecord3(packageJson) ? { ...recordOrEmpty(packageJson.dependencies), ...recordOrEmpty(packageJson.devDependencies) } : {};
   const docGov = dependencyVersion(dependencies["@pieai/doc-gov"]);
   const proGov = dependencyVersion(dependencies["@pieai/pro-gov"]);
-  const routerMatch = safeRead(join20(root, "AGENTS.md")).match(/PGS-ROUTER:BEGIN\s+v([0-9.]+)/);
+  const routerMatch = safeRead(join24(root, "AGENTS.md")).match(/PGS-ROUTER:BEGIN\s+v([0-9.]+)/);
   const declared = [docGov, proGov].filter((value) => Boolean(value));
   return {
     routerVersion: routerMatch?.[1],
-    manifest: existsSync21(join20(root, "docs/governance/MANIFEST.yml")),
-    currentWork: existsSync21(join20(root, "docs/reference/execution/current-work.md")),
+    expectedRouterVersion: CURRENT_ROUTER_VERSION,
+    routerAligned: routerMatch?.[1] === CURRENT_ROUTER_VERSION,
+    manifest: existsSync23(join24(root, "docs/governance/MANIFEST.yml")),
+    currentWork: existsSync23(join24(root, "docs/reference/execution/current-work.md")),
     packages: {
       expected,
       docGov,
@@ -4200,7 +4924,7 @@ function dependencyVersion(value) {
   return match?.[1];
 }
 function packageVersion(path) {
-  const value = readJson3(path);
+  const value = readJson4(path);
   return isRecord3(value) && typeof value.version === "string" ? value.version : void 0;
 }
 function recordOrEmpty(value) {
@@ -4208,20 +4932,20 @@ function recordOrEmpty(value) {
 }
 function inspectSkillRegistry(executionEngineRoot) {
   if (!executionEngineRoot) return { source: 0, registered: 0, bundled: 0, bundles: 0 };
-  const agentAssetsRoot = join20(executionEngineRoot, "agent-assets");
-  const registry = readJson3(join20(agentAssetsRoot, "registry.json"));
+  const agentAssetsRoot = join24(executionEngineRoot, "agent-assets");
+  const registry = readJson4(join24(agentAssetsRoot, "registry.json"));
   const assets = isRecord3(registry) && Array.isArray(registry.assets) ? registry.assets : [];
   const registeredSkills = assets.filter((asset) => isRecord3(asset) && asset.kind === "skill");
-  const bundleRoot = join20(agentAssetsRoot, "bundles");
+  const bundleRoot = join24(agentAssetsRoot, "bundles");
   const bundleFiles = safeReadDir(bundleRoot).filter((file) => file.endsWith(".json"));
   const bundledIds = /* @__PURE__ */ new Set();
   for (const file of bundleFiles) {
-    const bundle = readJson3(join20(bundleRoot, file));
+    const bundle = readJson4(join24(bundleRoot, file));
     if (!isRecord3(bundle) || !Array.isArray(bundle.assets)) continue;
     for (const id of bundle.assets) if (typeof id === "string") bundledIds.add(id);
   }
-  const sourceRoots = [join20(agentAssetsRoot, "skills/pie-skills"), join20(agentAssetsRoot, "skills/npx-skills/.agents/skills")];
-  const source = sourceRoots.reduce((count, root) => count + safeReadDir(root).filter((name) => existsSync21(join20(root, name, "SKILL.md"))).length, 0);
+  const sourceRoots = [join24(agentAssetsRoot, "skills/pie-skills"), join24(agentAssetsRoot, "skills/npx-skills/.agents/skills")];
+  const source = sourceRoots.reduce((count, root) => count + safeReadDir(root).filter((name) => existsSync23(join24(root, name, "SKILL.md"))).length, 0);
   return {
     source,
     registered: registeredSkills.length,
@@ -4230,12 +4954,12 @@ function inspectSkillRegistry(executionEngineRoot) {
   };
 }
 function jsonObjectKeys(path, key) {
-  const value = readJson3(path);
+  const value = readJson4(path);
   if (!isRecord3(value) || !isRecord3(value[key])) return [];
   return Object.keys(value[key]).sort();
 }
 function tomlMcpNames(path) {
-  if (!existsSync21(path)) return [];
+  if (!existsSync23(path)) return [];
   const names = /* @__PURE__ */ new Set();
   for (const line of safeRead(path).split(/\r?\n/)) {
     const match = line.match(/^\s*\[mcp_servers\.(?:"([^"]+)"|([^\.\]]+))\]\s*$/);
@@ -4244,37 +4968,37 @@ function tomlMcpNames(path) {
   }
   return [...names].sort();
 }
-function readJson3(path) {
+function readJson4(path) {
   try {
-    return JSON.parse(readFileSync15(path, "utf8"));
+    return JSON.parse(readFileSync17(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function safeRead(path) {
   try {
-    return readFileSync15(path, "utf8");
+    return readFileSync17(path, "utf8");
   } catch {
     return "";
   }
 }
 function safeReadDir(path) {
   try {
-    return readdirSync8(path).sort();
+    return readdirSync9(path).sort();
   } catch {
     return [];
   }
 }
 function safeIsDirectory(path) {
   try {
-    return statSync4(path).isDirectory();
+    return statSync5(path).isDirectory();
   } catch {
     return false;
   }
 }
 function pathLexists(path) {
   try {
-    lstatSync6(path);
+    lstatSync8(path);
     return true;
   } catch {
     return false;
@@ -4301,14 +5025,17 @@ function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function findDashboardAssets() {
-  const packageRoot2 = dirname12(dirname12(fileURLToPath4(import.meta.url)));
+  const packageRoot2 = dirname13(dirname13(fileURLToPath4(import.meta.url)));
   const candidates = [
     process.env.PGS_DASHBOARD_ASSETS_DIR,
-    join20(packageRoot2, "assets/portfolio-dashboard"),
-    join20(process.cwd(), "assets/portfolio-dashboard"),
-    join20(process.cwd(), "packages/pro-gov/assets/portfolio-dashboard")
+    join24(packageRoot2, ".dashboard-build"),
+    join24(packageRoot2, "assets/portfolio-dashboard"),
+    join24(process.cwd(), ".dashboard-build"),
+    join24(process.cwd(), "assets/portfolio-dashboard"),
+    join24(process.cwd(), "packages/pro-gov/.dashboard-build"),
+    join24(process.cwd(), "packages/pro-gov/assets/portfolio-dashboard")
   ].filter((value) => Boolean(value));
-  const match = candidates.find((path) => existsSync21(join20(path, "index.html")));
+  const match = candidates.find((path) => existsSync23(join24(path, "index.html")));
   if (!match) throw new Error("Portfolio dashboard assets were not built. Run pnpm --filter @pieai/pro-gov build.");
   return match;
 }
@@ -4344,10 +5071,23 @@ function runPortfolioAiHealth(args) {
     for (const issue of loaded.issues) console.error(`${issue.type}: ${issue.message}`);
     return 1;
   }
-  const report = inspectPortfolioAiHealth({
+  const targetId = options.value.targetId && options.value.targetId !== "all" ? options.value.targetId : void 0;
+  if (targetId && !loaded.manifest.targets.some((target) => target.id === targetId)) {
+    console.error(`Unknown portfolio target: ${targetId}`);
+    return 1;
+  }
+  const latest = inspectPortfolioAiHealth({
     manifest: loaded.manifest,
-    secretsRoot: options.value.secretsRoot
+    secretsRoot: options.value.secretsRoot,
+    targetId
   });
+  const allRepositoryIds = [
+    loaded.manifest.controlPlane?.id,
+    loaded.manifest.executionEngine?.id,
+    ...loaded.manifest.targets.map((target) => target.id)
+  ].filter((id) => Boolean(id));
+  const existing = targetId ? readExistingAiHealthReport(options.value.outDir, loaded.manifest.portfolioId) : void 0;
+  const report = targetId ? mergePortfolioAiHealthReport(existing, latest, allRepositoryIds) : latest;
   const written = writePortfolioAiHealthReport(report, options.value.outDir);
   if (options.value.json) {
     console.log(JSON.stringify({ ok: true, ...written, summary: report.summary }, null, 2));
@@ -4398,12 +5138,28 @@ function runPortfolioDoctor(args) {
   const output = { configPath: loaded.configPath, ...result };
   if (options.value.json) {
     console.log(JSON.stringify(output, null, 2));
-  } else if (result.ok) {
-    console.log(`portfolio doctor passed (${targets.length} targets)`);
   } else {
-    for (const issue of result.hostTooling.issues) console.log(`${issue.host}	${issue.type}: ${issue.message}`);
+    for (const warning of result.hostSsot.userSkills.issues) {
+      console.log(`user	host-ssot-warning: ${warning}`);
+    }
     for (const target of result.targets) {
-      for (const issue of target.issues) console.log(`${target.id}	${issue.type}: ${issue.message}`);
+      for (const warning of target.hostSsot.issues) {
+        console.log(`${target.id}	host-ssot-warning: ${warning}`);
+      }
+      if (target.verification.status === "attention") {
+        console.log(`${target.id}	verification-warning: missing ${target.verification.missing.join(", ")}`);
+      }
+      if (target.versions.status === "attention") {
+        console.log(`${target.id}	version-policy-warning: ${target.versions.attentionCount} drift(s)`);
+      }
+    }
+    if (result.ok) {
+      console.log(`portfolio doctor passed (${targets.length} targets)`);
+    } else {
+      for (const issue of result.hostTooling.issues) console.log(`${issue.host}	${issue.type}: ${issue.message}`);
+      for (const target of result.targets) {
+        for (const issue of target.issues) console.log(`${target.id}	${issue.type}: ${issue.message}`);
+      }
     }
   }
   return result.ok ? 0 : 1;
@@ -4660,8 +5416,8 @@ function isHost2(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
 function findPortfolioAgentAssetsDir(manifest) {
-  const agentAssetsDir = manifest?.executionEngine?.path ? join21(manifest.executionEngine.path, "agent-assets") : void 0;
-  return agentAssetsDir && existsSync22(join21(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
+  const agentAssetsDir = manifest?.executionEngine?.path ? join25(manifest.executionEngine.path, "agent-assets") : void 0;
+  return agentAssetsDir && existsSync24(join25(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
 }
 function printUsage4() {
   console.error("Usage:");
@@ -4669,12 +5425,24 @@ function printUsage4() {
   console.error("  pro-gov portfolio plan --config <path> [--target <id|all>] [--host codex|claude-code|gemini-cli|antigravity] [--json]");
   console.error("  pro-gov portfolio assets-check --config <path> [--target <id|all>] [--json]");
   console.error("  pro-gov portfolio doctor --config <path> [--target <id|all>] [--json]");
-  console.error("  pro-gov portfolio ai-health --config <path> --out <directory> [--secrets-root <directory>] [--json]");
+  console.error("  pro-gov portfolio ai-health --config <path> --out <directory> [--target <id|all>] [--secrets-root <directory>] [--json]");
+}
+function readExistingAiHealthReport(outDir, portfolioId) {
+  if (!outDir) return void 0;
+  const path = join25(outDir, "portfolio-ai-health.json");
+  if (!existsSync24(path)) return void 0;
+  try {
+    const value = JSON.parse(readFileSync18(path, "utf8"));
+    if (!value || typeof value !== "object" || value.portfolioId !== portfolioId || !Array.isArray(value.repositories)) return void 0;
+    return value;
+  } catch {
+    return void 0;
+  }
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync23, readFileSync as readFileSync16 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync25, lstatSync as lstatSync9, readFileSync as readFileSync19, readlinkSync as readlinkSync4 } from "node:fs";
+import { join as join26 } from "node:path";
 function runSync(args) {
   const check = args.includes("--check");
   if (!check) {
@@ -4702,8 +5470,9 @@ function runSync(args) {
   console.log("pro-gov sync check");
   console.log(`profile: ${profile}`);
   for (const file of planStarterFiles(profile)) {
-    const targetPath = join22(process.cwd(), file.targetPath);
-    if (!existsSync23(targetPath)) {
+    const targetPath = join26(process.cwd(), file.targetPath);
+    const stat = safeLstat3(targetPath);
+    if (!stat) {
       if (file.ownership === "optional-guardrail") continue;
       console.log(`missing: ${file.targetPath}`);
       differences += 1;
@@ -4711,8 +5480,22 @@ function runSync(args) {
     }
     if (file.ownership === "optional-guardrail") continue;
     if (file.ownership === "project-local-seed") continue;
-    const source = readFileSync16(file.absoluteSourcePath, "utf8");
-    const target = readFileSync16(targetPath, "utf8");
+    if (file.kind === "directory") {
+      if (!stat.isDirectory()) {
+        console.log(`different: ${file.targetPath}`);
+        differences += 1;
+      }
+      continue;
+    }
+    if (file.kind === "symlink") {
+      if (!stat.isSymbolicLink() || readlinkSync4(targetPath) !== file.linkTarget) {
+        console.log(`different: ${file.targetPath}`);
+        differences += 1;
+      }
+      continue;
+    }
+    const source = readFileSync19(file.absoluteSourcePath, "utf8");
+    const target = readFileSync19(targetPath, "utf8");
     if (!matchesExpectedContent(file.targetPath, source, target)) {
       console.log(`different: ${file.targetPath}`);
       differences += 1;
@@ -4746,10 +5529,17 @@ function normalizeMarkdownTableCell(cell) {
 }
 function inferInstalledProfile(root) {
   const installed = ["engineering-runtime", "doc-only"].filter(
-    (profile) => existsSync23(join22(root, `docs/governance/agents-routing/${profile}-v1.0.md`))
+    (profile) => existsSync25(join26(root, `docs/governance/agents-routing/${profile}-v1.1.md`))
   );
   return installed.length === 1 ? installed[0] : void 0;
 }
+function safeLstat3(path) {
+  try {
+    return lstatSync9(path);
+  } catch {
+    return void 0;
+  }
+}
 function readFlag2(args, flag) {
   const index = args.indexOf(flag);
   const value = index >= 0 ? args[index + 1] : void 0;