@pieai/pro-gov 0.6.0 → 0.7.1

package/dist/cli.js

@@ -2584,6 +2584,9 @@ function formatProjectLensInspection(report) {
     `ai-host-ssot: ${report.hostSsot.compliant ? "compliant" : "non-compliant"}`,
     `claude-entry-link: ${formatLink(report.hostSsot.claudeEntry)}`,
     `claude-skills-link: ${formatLink(report.hostSsot.claudeSkills)}`,
+    `user-host-ssot: ${report.userHostSsot.compliant ? "compliant" : "non-compliant"}`,
+    `verification: ${report.verification.status} (missing: ${formatList(report.verification.missing)})`,
+    `redundancy: ${report.redundancy.status}`,
     `package-scripts: ${formatList(report.packageJson?.scripts ?? [])}`,
     `dependencies: ${formatList(report.packageJson?.dependencies ?? [])}`,
     `dev-dependencies: ${formatList(report.packageJson?.devDependencies ?? [])}`,
@@ -2624,6 +2627,20 @@ function renderProjectLensMarkdownReport(report) {
     `- Canonical skills: \`${report.hostSsot.canonicalSkills.path}\` (${report.hostSsot.canonicalSkills.status})`,
     `- Claude skills: ${formatLink(report.hostSsot.claudeSkills)}`,
     `- Issues: ${formatList(report.hostSsot.issues)}`,
+    `- User skills SSOT: ${report.userHostSsot.compliant ? "compliant" : "non-compliant"}`,
+    `- User SSOT issues: ${formatList(report.userHostSsot.issues)}`,
+    "",
+    "## Verification Gates",
+    "",
+    `- Status: ${report.verification.status}`,
+    `- Required scripts: ${formatList(report.verification.requiredScripts)}`,
+    `- Missing scripts: ${formatList(report.verification.missing)}`,
+    "",
+    "## Redundancy Evidence",
+    "",
+    `- Status: ${report.redundancy.status}`,
+    `- Legacy directories: ${formatList(report.redundancy.legacyDirectories.map((entry) => entry.path))}`,
+    `- Playwright caches: ${formatList(report.redundancy.playwrightCaches.filter((entry) => entry.exists).map((entry) => `${entry.path} (${entry.bytes} bytes)`))}`,
     "",
     "## Package",
     "",
@@ -2669,8 +2686,9 @@ function formatLink(link) {
 
 // src/lens/scan.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync16, readdirSync as readdirSync7, readFileSync as readFileSync11, statSync as statSync3 } from "node:fs";
-import { join as join18, relative as relative7 } from "node:path";
+import { existsSync as existsSync18, readdirSync as readdirSync8, readFileSync as readFileSync12, statSync as statSync4 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join20, relative as relative7 } from "node:path";
 
 // src/host-ssot.ts
 import {
@@ -2795,6 +2813,117 @@ function safeLstat2(path) {
   }
 }
 
+// src/portfolio/redundancy.ts
+import { existsSync as existsSync16, readdirSync as readdirSync7, statSync as statSync3 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join18 } from "node:path";
+var DEFAULT_CACHE_THRESHOLD_BYTES = 1e9;
+var MAX_CACHE_ENTRIES = 2e4;
+function inspectProjectRedundancy(root, options = {}) {
+  const legacyDirectories = inspectLegacyDirectories(root);
+  const homeDir = options.homeDir ?? homedir();
+  const cachePaths = getPlaywrightCachePaths(homeDir, options.playwrightBrowsersPath ?? process.env.PLAYWRIGHT_BROWSERS_PATH);
+  const playwrightCaches = cachePaths.map((path) => inspectPlaywrightCache(path));
+  const cacheThresholdBytes = options.cacheThresholdBytes ?? DEFAULT_CACHE_THRESHOLD_BYTES;
+  const status = legacyDirectories.length > 0 || playwrightCaches.some((cache) => cache.exists && (cache.bytes >= cacheThresholdBytes || cache.truncated)) ? "attention" : "clean";
+  return { status, legacyDirectories, playwrightCaches };
+}
+function inspectLegacyDirectories(root) {
+  const relativePath = ".agent";
+  const path = join18(root, relativePath);
+  if (!existsSync16(path)) return [];
+  const stats = collectDirectoryStats(path);
+  return [{
+    path: relativePath,
+    kind: "legacy-ai-directory",
+    fileCount: stats.fileCount,
+    bytes: stats.bytes,
+    reason: "\u9879\u76EE\u7EA7\u65E7 AI \u5BBF\u4E3B\u76EE\u5F55\uFF1B\u5E94\u4E0E .agents/skills \u7684 SSOT \u9010\u9879\u6BD4\u5BF9\u540E\u518D\u51B3\u5B9A\u662F\u5426\u8FC1\u79FB\uFF0C\u626B\u63CF\u5668\u4E0D\u81EA\u52A8\u5220\u9664\u3002"
+  }];
+}
+function getPlaywrightCachePaths(homeDir, configuredPath) {
+  const candidates = [
+    configuredPath && configuredPath !== "0" ? configuredPath : void 0,
+    join18(homeDir, "Library/Caches/ms-playwright"),
+    join18(homeDir, ".cache/ms-playwright"),
+    join18(homeDir, "AppData/Local/ms-playwright")
+  ].filter((path) => Boolean(path));
+  return [...new Set(candidates)];
+}
+function inspectPlaywrightCache(path) {
+  if (!existsSync16(path)) {
+    return { path, exists: false, fileCount: 0, bytes: 0, revisionCount: 0, truncated: false };
+  }
+  const stats = collectDirectoryStats(path);
+  let revisionCount = 0;
+  try {
+    revisionCount = readdirSync7(path, { withFileTypes: true }).filter((entry) => entry.isDirectory()).length;
+  } catch {
+    revisionCount = 0;
+  }
+  return { path, exists: true, fileCount: stats.fileCount, bytes: stats.bytes, revisionCount, truncated: stats.truncated };
+}
+function collectDirectoryStats(root) {
+  let fileCount = 0;
+  let bytes = 0;
+  let truncated = false;
+  const pending = [root];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    if (!current) continue;
+    let entries;
+    try {
+      entries = readdirSync7(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (fileCount >= MAX_CACHE_ENTRIES) {
+        truncated = true;
+        break;
+      }
+      const path = join18(current, entry.name);
+      if (entry.isDirectory()) {
+        pending.push(path);
+      } else if (entry.isFile()) {
+        fileCount += 1;
+        try {
+          bytes += statSync3(path).size;
+        } catch {
+        }
+      }
+    }
+    if (truncated) break;
+  }
+  return { fileCount, bytes, truncated };
+}
+
+// src/portfolio/verification.ts
+import { existsSync as existsSync17, readFileSync as readFileSync11 } from "node:fs";
+import { join as join19 } from "node:path";
+var REQUIRED_PROJECT_SCRIPTS = ["typecheck", "lint", "format:check", "verify"];
+function inspectProjectVerification(root) {
+  const packageJson = readPackageJson(join19(root, "package.json"));
+  const scripts = Object.fromEntries(
+    REQUIRED_PROJECT_SCRIPTS.map((name) => [name, typeof packageJson?.scripts?.[name] === "string" ? packageJson.scripts[name] : void 0])
+  );
+  const missing = REQUIRED_PROJECT_SCRIPTS.filter((name) => typeof scripts[name] !== "string" || scripts[name]?.trim().length === 0);
+  return {
+    status: packageJson ? missing.length === 0 ? "compliant" : "attention" : "unknown",
+    requiredScripts: REQUIRED_PROJECT_SCRIPTS,
+    scripts,
+    missing
+  };
+}
+function readPackageJson(path) {
+  if (!existsSync17(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync11(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+
 // src/lens/scan.ts
 var ignoredDirectories = /* @__PURE__ */ new Set([
   ".git",
@@ -2811,7 +2940,7 @@ function scanProjectLensTarget(targetDir, options = {}) {
   const markdownFiles = files.filter(
     (file) => file.startsWith("docs/") && file.endsWith(".md")
   );
-  const packageJson = readPackageJson(targetDir);
+  const packageJson = readPackageJson2(targetDir);
   return {
     targetDir,
     scanScope: {
@@ -2821,25 +2950,31 @@ function scanProjectLensTarget(targetDir, options = {}) {
       excludedFileCount: candidateFiles.length - files.length
     },
     aiEntryFiles: ["AGENTS.md", "CLAUDE.md"].filter(
-      (file) => existsSync16(join18(targetDir, file))
+      (file) => existsSync18(join20(targetDir, file))
     ),
     aiConfigFiles: [],
     hostSsot: inspectProjectHostSsot(targetDir),
+    userHostSsot: inspectUserSkillsSsot(options.homeDir ?? process.env.HOME ?? homedir2()),
+    verification: inspectProjectVerification(targetDir),
+    redundancy: inspectProjectRedundancy(targetDir, {
+      homeDir: options.homeDir,
+      playwrightBrowsersPath: options.playwrightBrowsersPath
+    }),
     packageJson,
     docs: {
-      hasDocsDirectory: existsSync16(join18(targetDir, "docs")),
+      hasDocsDirectory: existsSync18(join20(targetDir, "docs")),
       markdownFileCount: markdownFiles.length,
       governanceFiles: markdownFiles.filter((file) => file.startsWith("docs/governance/") || file.startsWith("docs/policy/")).sort()
     },
     git: readGitState(targetDir),
-    largeFiles: files.map((file) => ({ path: file, bytes: statSync3(join18(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
+    largeFiles: files.map((file) => ({ path: file, bytes: statSync4(join20(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
   };
 }
-function readPackageJson(targetDir) {
-  const packageJsonPath = join18(targetDir, "package.json");
-  if (!existsSync16(packageJsonPath)) return void 0;
+function readPackageJson2(targetDir) {
+  const packageJsonPath = join20(targetDir, "package.json");
+  if (!existsSync18(packageJsonPath)) return void 0;
   try {
-    const packageJson = JSON.parse(readFileSync11(packageJsonPath, "utf8"));
+    const packageJson = JSON.parse(readFileSync12(packageJsonPath, "utf8"));
     return {
       scripts: Object.keys(packageJson.scripts ?? {}).sort(),
       dependencies: Object.keys(packageJson.dependencies ?? {}).sort(),
@@ -2877,7 +3012,7 @@ function listProjectFiles(targetDir) {
     "-z"
   ]);
   if (gitFiles.ok) {
-    return gitFiles.stdout.split("\0").filter(Boolean).map(toUnixPath4).filter((file) => existsSync16(join18(targetDir, file))).sort();
+    return gitFiles.stdout.split("\0").filter(Boolean).map(toUnixPath4).filter((file) => existsSync18(join20(targetDir, file))).sort();
   }
   const files = [];
   collectFiles2(targetDir, targetDir, files);
@@ -2895,13 +3030,13 @@ function isFirstPartyEvidenceFile(file) {
   return !excludedEvidencePrefixes.some((prefix) => file.startsWith(prefix));
 }
 function collectFiles2(rootDir, currentDir, files) {
-  if (!existsSync16(currentDir)) return;
-  for (const entry of readdirSync7(currentDir, { withFileTypes: true })) {
+  if (!existsSync18(currentDir)) return;
+  for (const entry of readdirSync8(currentDir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
       if (ignoredDirectories.has(entry.name)) continue;
-      collectFiles2(rootDir, join18(currentDir, entry.name), files);
+      collectFiles2(rootDir, join20(currentDir, entry.name), files);
     } else if (entry.isFile()) {
-      files.push(toUnixPath4(relative7(rootDir, join18(currentDir, entry.name))));
+      files.push(toUnixPath4(relative7(rootDir, join20(currentDir, entry.name))));
     }
   }
 }
@@ -3057,16 +3192,16 @@ function printUsage3() {
 }
 
 // src/commands/portfolio.ts
-import { existsSync as existsSync21 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync18 } from "node:fs";
+import { join as join25 } from "node:path";
 
 // src/portfolio/manifest.ts
-import { existsSync as existsSync17, readFileSync as readFileSync12 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync13 } from "node:fs";
 import { dirname as dirname11, isAbsolute as isAbsolute4, resolve as resolve4 } from "node:path";
 function loadPortfolioManifest(configPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync12(configPath, "utf8"));
+    parsed = JSON.parse(readFileSync13(configPath, "utf8"));
   } catch (error) {
     return {
       configPath,
@@ -3235,7 +3370,7 @@ function validateEndpoint(value, field, issues, technologyCatalog) {
     });
     return;
   }
-  if (!existsSync17(value.path)) {
+  if (!existsSync19(value.path)) {
     issues.push({
       type: "missing-path",
       id: typeof value.id === "string" ? value.id : void 0,
@@ -3264,7 +3399,7 @@ function validateTechnologyGovernance(value, issues) {
     issues.push({ type: "invalid-field", field: "technologyGovernance", message: "Portfolio technologyGovernance must be an object." });
     return { technologies, projectTypes };
   }
-  validateAllowedFields(value, "technologyGovernance", ["strategySource", "technologies", "projectTypes"], issues);
+  validateAllowedFields(value, "technologyGovernance", ["strategySource", "versionPolicy", "technologies", "projectTypes"], issues);
   if (value.strategySource !== void 0 && (typeof value.strategySource !== "string" || value.strategySource.length === 0)) {
     issues.push({ type: "invalid-field", field: "technologyGovernance.strategySource", message: "Technology strategySource must be a non-empty string." });
   }
@@ -3327,8 +3462,102 @@ function validateTechnologyGovernance(value, issues) {
       if (!technologies.has(technology)) issues.push({ type: "invalid-field", field: "technologyGovernance.projectTypes", message: `Project type ${projectType.id} references unknown technology: ${technology}` });
     }
   }
+  validateVersionPolicy(value.versionPolicy, projectTypes, issues);
   return { technologies, projectTypes };
 }
+function validateVersionPolicy(value, projectTypes, issues) {
+  if (value === void 0) return;
+  if (!isRecord(value)) {
+    issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy", message: "Technology versionPolicy must be an object." });
+    return;
+  }
+  validateAllowedFields(value, "versionPolicy", ["schemaVersion", "packageManager", "runtime", "runtimes", "packages"], issues);
+  if (value.schemaVersion !== 1) {
+    issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.schemaVersion", message: "Technology versionPolicy schemaVersion must be 1." });
+  }
+  validateVersionRequirement(value.packageManager, "technologyGovernance.versionPolicy.packageManager", issues);
+  validateVersionRequirement(value.runtime, "technologyGovernance.versionPolicy.runtime", issues);
+  validateRuntimeRequirements(value.runtimes, projectTypes, issues);
+  if (!Array.isArray(value.packages)) {
+    issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.packages", message: "Technology versionPolicy packages must be an array." });
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of value.packages) {
+    if (!isRecord(entry)) {
+      issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.packages", message: "Version policy package entries must be objects." });
+      continue;
+    }
+    validateAllowedFields(entry, "versionPolicy.package", ["name", "version", "appliesTo"], issues);
+    const name = typeof entry.name === "string" ? entry.name : "";
+    if (!name || seen.has(name)) {
+      issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.packages.name", message: `Version policy package name must be non-empty and unique: ${String(entry.name)}` });
+    } else seen.add(name);
+    if (typeof entry.version !== "string" || !isExactVersion(entry.version)) {
+      issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.packages.version", message: `Version policy package version must be exact semver: ${String(entry.version)}` });
+    }
+    if (entry.appliesTo !== void 0) {
+      validateOptionalStringArray(entry.appliesTo, name, "technologyGovernance.versionPolicy.packages.appliesTo", issues);
+      if (Array.isArray(entry.appliesTo)) {
+        for (const projectType of entry.appliesTo) {
+          if (typeof projectType === "string" && !projectTypes.has(projectType)) {
+            issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.packages.appliesTo", message: `Version policy references unknown project type: ${projectType}` });
+          }
+        }
+      }
+    }
+  }
+}
+function validateRuntimeRequirements(value, projectTypes, issues) {
+  if (value === void 0) return;
+  const field = "technologyGovernance.versionPolicy.runtimes";
+  if (!Array.isArray(value)) {
+    issues.push({ type: "invalid-field", field, message: "Technology versionPolicy runtimes must be an array." });
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of value) {
+    if (!isRecord(entry)) {
+      issues.push({ type: "invalid-field", field, message: "Version policy runtime entries must be objects." });
+      continue;
+    }
+    validateAllowedFields(entry, "versionPolicy.runtimeEntry", ["name", "version", "appliesTo"], issues);
+    const name = typeof entry.name === "string" ? entry.name : "";
+    if (!name || seen.has(name)) {
+      issues.push({ type: "invalid-field", field: `${field}.name`, message: `Version policy runtime name must be non-empty and unique: ${String(entry.name)}` });
+    } else seen.add(name);
+    if (typeof entry.version !== "string" || !isExactVersion(entry.version)) {
+      issues.push({ type: "invalid-field", field: `${field}.version`, message: `Version policy runtime version must be exact semver: ${String(entry.version)}` });
+    }
+    if (entry.appliesTo !== void 0) {
+      validateOptionalStringArray(entry.appliesTo, name, `${field}.appliesTo`, issues);
+      if (Array.isArray(entry.appliesTo)) {
+        for (const projectType of entry.appliesTo) {
+          if (typeof projectType === "string" && !projectTypes.has(projectType)) {
+            issues.push({ type: "invalid-field", field: `${field}.appliesTo`, message: `Version policy references unknown project type: ${projectType}` });
+          }
+        }
+      }
+    }
+  }
+}
+function validateVersionRequirement(value, field, issues) {
+  if (value === void 0) return;
+  if (!isRecord(value)) {
+    issues.push({ type: "invalid-field", field, message: "Version requirement must be an object." });
+    return;
+  }
+  validateAllowedFields(value, field, ["name", "version"], issues);
+  if (typeof value.name !== "string" || value.name.length === 0) {
+    issues.push({ type: "invalid-field", field: `${field}.name`, message: "Version requirement name must be non-empty." });
+  }
+  if (typeof value.version !== "string" || !isExactVersion(value.version)) {
+    issues.push({ type: "invalid-field", field: `${field}.version`, message: `Version requirement version must be exact semver: ${String(value.version)}` });
+  }
+}
+function isExactVersion(value) {
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value);
+}
 function isRepositoryRelativePath(value) {
   if (value.length === 0 || isAbsolute4(value)) return false;
   const segments = value.replaceAll("\\", "/").split("/");
@@ -3502,11 +3731,11 @@ function isRecord(value) {
 }
 
 // src/portfolio/doctor.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync19, readFileSync as readFileSync14 } from "node:fs";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync22, readFileSync as readFileSync16 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { homedir } from "node:os";
-import { dirname as dirname12, join as join20 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname12, join as join23 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/host-tooling/inventory.ts
@@ -3597,13 +3826,13 @@ function isRecord2(value) {
 }
 
 // src/portfolio/asset-state.ts
-import { existsSync as existsSync18, lstatSync as lstatSync7, readFileSync as readFileSync13 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync20, lstatSync as lstatSync7, readFileSync as readFileSync14 } from "node:fs";
+import { join as join21 } from "node:path";
 function comparePortfolioAssetState(options) {
   const expectedManifest = readPlanDocument(options.expectedPlan, ".pro-gov/assets.json");
   const expectedLock = readPlanDocument(options.expectedPlan, ".pro-gov/assets.lock.json");
-  const currentManifest = readJsonFile(join19(options.targetDir, ".pro-gov/assets.json"));
-  const currentLock = readJsonFile(join19(options.targetDir, ".pro-gov/assets.lock.json"));
+  const currentManifest = readJsonFile(join21(options.targetDir, ".pro-gov/assets.json"));
+  const currentLock = readJsonFile(join21(options.targetDir, ".pro-gov/assets.lock.json"));
   const issues = [];
   if (!sameStrings(currentManifest?.bundleIds, expectedManifest?.bundleIds)) {
     issues.push({
@@ -3627,7 +3856,7 @@ function comparePortfolioAssetState(options) {
   for (const entry of currentLock?.assets ?? []) {
     if (expectedTargets.has(entry.targetPath)) continue;
     if (options.expectedPlan.actions.some((action) => action.type === "adopt-symlink" && action.assetId === entry.id && action.legacyTargetPath === entry.targetPath)) continue;
-    const targetAbsolutePath = join19(options.targetDir, entry.targetPath);
+    const targetAbsolutePath = join21(options.targetDir, entry.targetPath);
     if (!pathIsSymlink(targetAbsolutePath)) continue;
     issues.push({
       type: "orphaned-managed-symlink",
@@ -3649,9 +3878,9 @@ function readPlanDocument(plan, targetPath) {
   }
 }
 function readJsonFile(path) {
-  if (!existsSync18(path)) return void 0;
+  if (!existsSync20(path)) return void 0;
   try {
-    return JSON.parse(readFileSync13(path, "utf8"));
+    return JSON.parse(readFileSync14(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -3678,6 +3907,95 @@ function pathIsSymlink(path) {
   }
 }
 
+// src/portfolio/version-policy.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync21, readFileSync as readFileSync15 } from "node:fs";
+import { join as join22 } from "node:path";
+function inspectVersionPolicy(root, policy, projectType) {
+  if (!policy) return { status: "compliant", packages: [], runtimes: [], attentionCount: 0 };
+  const packageJson = readJson2(join22(root, "package.json"));
+  const packageManager = policy.packageManager ? inspectPackageManager(packageJson, policy.packageManager.name, policy.packageManager.version) : void 0;
+  const runtime = policy.runtime ? inspectRuntime(policy.runtime.name, policy.runtime.version) : void 0;
+  const runtimes = (policy.runtimes ?? []).map((requirement) => {
+    if (requirement.appliesTo && (!projectType || !requirement.appliesTo.includes(projectType))) {
+      return { name: requirement.name, expected: requirement.version, status: "not-applicable" };
+    }
+    return inspectRuntime(requirement.name, requirement.version);
+  });
+  const packages = policy.packages.map((requirement) => {
+    if (requirement.appliesTo && (!projectType || !requirement.appliesTo.includes(projectType))) {
+      return { name: requirement.name, expected: requirement.version, status: "not-applicable" };
+    }
+    const declared = findDeclaredVersion(packageJson, requirement.name);
+    const installed = readInstalledVersion(root, requirement.name);
+    const status = declared === void 0 ? requirement.appliesTo ? "missing" : "not-applicable" : declared !== requirement.version ? "drift" : installed !== requirement.version ? installed === void 0 ? "missing" : "drift" : "compliant";
+    return {
+      name: requirement.name,
+      expected: requirement.version,
+      declared,
+      installed,
+      actual: installed,
+      status
+    };
+  });
+  const all = [packageManager, runtime, ...runtimes, ...packages].filter((item) => item !== void 0);
+  const attentionCount = all.filter((item) => item.status !== "compliant" && item.status !== "not-applicable").length;
+  return {
+    status: attentionCount === 0 ? "compliant" : "attention",
+    packageManager,
+    runtime,
+    runtimes,
+    packages,
+    attentionCount
+  };
+}
+function inspectPackageManager(packageJson, expectedName, expectedVersion) {
+  const declared = typeof packageJson?.packageManager === "string" ? packageJson.packageManager : void 0;
+  const expected = `${expectedName}@${expectedVersion}`;
+  return {
+    name: expectedName,
+    expected: expectedVersion,
+    actual: declared,
+    declared,
+    status: declared === void 0 ? "missing" : declared === expected ? "compliant" : "drift"
+  };
+}
+function inspectRuntime(expectedName, expectedVersion) {
+  const actual = readRuntimeVersion(expectedName);
+  return {
+    name: expectedName,
+    expected: expectedVersion,
+    actual,
+    status: actual === void 0 ? "missing" : actual === expectedVersion ? "compliant" : "drift"
+  };
+}
+function readRuntimeVersion(name) {
+  if (name === "node") return process.versions.node;
+  if (name !== "deno") return void 0;
+  const result = spawnSync5("deno", ["--version"], { encoding: "utf8" });
+  if (result.status !== 0) return void 0;
+  return /^deno\s+(\d+\.\d+\.\d+)/m.exec(result.stdout)?.[1];
+}
+function findDeclaredVersion(packageJson, name) {
+  for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+    const value = packageJson?.[section]?.[name];
+    if (typeof value === "string") return value;
+  }
+  return void 0;
+}
+function readInstalledVersion(root, name) {
+  const packageJson = readJson2(join22(root, "node_modules", name, "package.json"));
+  return typeof packageJson?.version === "string" ? packageJson.version : void 0;
+}
+function readJson2(path) {
+  if (!existsSync21(path)) return void 0;
+  try {
+    return JSON.parse(readFileSync15(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+
 // src/portfolio/doctor.ts
 function inspectPortfolio(options) {
   const expectedPackageVersions = getExpectedPackageVersions();
@@ -3687,14 +4005,15 @@ function inspectPortfolio(options) {
     agentAssetsDir: options.agentAssetsDir,
     registry: options.registry,
     bundles: options.bundles,
-    expectedPackageVersions
+    expectedPackageVersions,
+    versionPolicy: options.manifest.technologyGovernance?.versionPolicy
   }));
   return {
     ok: hostTooling.issues.length === 0 && targets.every((target) => target.issues.length === 0),
     portfolioId: options.manifest.portfolioId,
     expectedPackageVersions,
     hostTooling,
-    hostSsot: { userSkills: inspectUserSkillsSsot(options.homeDir ?? homedir()) },
+    hostSsot: { userSkills: inspectUserSkillsSsot(options.homeDir ?? homedir3()) },
     targets
   };
 }
@@ -3702,11 +4021,11 @@ function inspectTarget(options) {
   const { target } = options;
   const hostSsot = inspectProjectHostSsot(target.path);
   const issues = [];
-  const packageJson = readJson2(join20(target.path, "package.json"));
+  const packageJson = readJson3(join23(target.path, "package.json"));
   const packages = {};
   for (const packageName of ["@pieai/pro-gov", "@pieai/doc-gov"]) {
     const declared = packageJson?.devDependencies?.[packageName] ?? packageJson?.dependencies?.[packageName];
-    const installedPackage = readJson2(join20(target.path, "node_modules", packageName, "package.json"));
+    const installedPackage = readJson3(join23(target.path, "node_modules", packageName, "package.json"));
     const installed = installedPackage?.version;
     const expected = options.expectedPackageVersions[packageName];
     packages[packageName] = { declared, installed, expected };
@@ -3726,6 +4045,8 @@ function inspectTarget(options) {
     }
   }
   const checks = runTargetChecks(target);
+  const versions = inspectVersionPolicy(target.path, options.versionPolicy, target.projectType);
+  const verification = inspectProjectVerification(target.path);
   for (const check of checks) {
     if (check.status === 0) continue;
     issues.push({
@@ -3760,7 +4081,7 @@ function inspectTarget(options) {
       type: "asset-lock-drift",
       message: error instanceof Error ? error.message : String(error)
     });
-    if (!existsSync19(join20(target.path, ".pro-gov/assets.json"))) {
+    if (!existsSync22(join23(target.path, ".pro-gov/assets.json"))) {
       issues.push({ type: "bundle-drift", message: "Target asset manifest is missing." });
     }
   }
@@ -3772,19 +4093,21 @@ function inspectTarget(options) {
     git: inspectGit(target.path),
     checks,
     hostSsot,
+    versions,
+    verification,
     issues: deduplicateIssues(issues)
   };
 }
 function readTargetAssetHost(targetDir) {
-  const lockfile = readJson2(join20(targetDir, ".pro-gov/assets.lock.json"));
+  const lockfile = readJson3(join23(targetDir, ".pro-gov/assets.lock.json"));
   return isAssetRegistryHost(lockfile?.host) ? lockfile.host : void 0;
 }
 function isAssetRegistryHost(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
 function runTargetChecks(target) {
-  const proGovCli = join20(target.path, "node_modules/@pieai/pro-gov/dist/cli.js");
-  const docGovCli = join20(target.path, "node_modules/@pieai/doc-gov/dist/cli.js");
+  const proGovCli = join23(target.path, "node_modules/@pieai/pro-gov/dist/cli.js");
+  const docGovCli = join23(target.path, "node_modules/@pieai/doc-gov/dist/cli.js");
   const commands = [
     {
       name: "pro-gov doctor",
@@ -3795,8 +4118,8 @@ function runTargetChecks(target) {
     { name: "doc-gov scan --check", cli: docGovCli, args: ["scan", "--check"] }
   ];
   return commands.map((command2) => {
-    if (!existsSync19(command2.cli)) return { name: command2.name, status: null };
-    const result = spawnSync5(process.execPath, [command2.cli, ...command2.args], {
+    if (!existsSync22(command2.cli)) return { name: command2.name, status: null };
+    const result = spawnSync6(process.execPath, [command2.cli, ...command2.args], {
       cwd: target.path,
       encoding: "utf8",
       timeout: 3e4
@@ -3805,13 +4128,13 @@ function runTargetChecks(target) {
   });
 }
 function inspectGit(path) {
-  const inside = spawnSync5("git", ["rev-parse", "--is-inside-work-tree"], {
+  const inside = spawnSync6("git", ["rev-parse", "--is-inside-work-tree"], {
     cwd: path,
     encoding: "utf8"
   });
   if (inside.status !== 0) return { isRepository: false, dirty: false };
-  const status = spawnSync5("git", ["status", "--porcelain"], { cwd: path, encoding: "utf8" });
-  const branch = spawnSync5("git", ["branch", "--show-current"], { cwd: path, encoding: "utf8" });
+  const status = spawnSync6("git", ["status", "--porcelain"], { cwd: path, encoding: "utf8" });
+  const branch = spawnSync6("git", ["branch", "--show-current"], { cwd: path, encoding: "utf8" });
   return {
     isRepository: true,
     dirty: status.stdout.trim().length > 0,
@@ -3819,11 +4142,11 @@ function inspectGit(path) {
   };
 }
 function getExpectedPackageVersions() {
-  const proGovPackage = readJson2(findOwnPackageJson());
+  const proGovPackage = readJson3(findOwnPackageJson());
   let docGovVersion;
   try {
     const require2 = createRequire2(import.meta.url);
-    const docGovPackage = readJson2(require2.resolve("@pieai/doc-gov/package.json"));
+    const docGovPackage = readJson3(require2.resolve("@pieai/doc-gov/package.json"));
     docGovVersion = docGovPackage?.version;
   } catch {
     docGovVersion = void 0;
@@ -3836,16 +4159,16 @@ function getExpectedPackageVersions() {
 function findOwnPackageJson() {
   let current = dirname12(fileURLToPath3(import.meta.url));
   for (let depth = 0; depth < 5; depth += 1) {
-    const candidate = join20(current, "package.json");
-    if (existsSync19(candidate)) return candidate;
+    const candidate = join23(current, "package.json");
+    if (existsSync22(candidate)) return candidate;
     current = dirname12(current);
   }
   return "";
 }
-function readJson2(path) {
-  if (!path || !existsSync19(path)) return void 0;
+function readJson3(path) {
+  if (!path || !existsSync22(path)) return void 0;
   try {
-    return JSON.parse(readFileSync14(path, "utf8"));
+    return JSON.parse(readFileSync16(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -3864,27 +4187,31 @@ function deduplicateIssues(issues) {
 import { execFileSync } from "node:child_process";
 import {
   cpSync as cpSync2,
-  existsSync as existsSync20,
+  existsSync as existsSync23,
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync15,
-  readdirSync as readdirSync8,
+  readFileSync as readFileSync17,
+  readdirSync as readdirSync9,
   realpathSync as realpathSync4,
-  statSync as statSync4,
+  statSync as statSync5,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { dirname as dirname13, join as join21, relative as relative8, resolve as resolve5, sep } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname13, join as join24, relative as relative8, resolve as resolve5, sep } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var CURRENT_ROUTER_VERSION = "1.1";
 function inspectPortfolioAiHealth(options) {
-  const endpoints = collectEndpoints(options.manifest);
-  const secretsRoot = options.secretsRoot ?? join21(dirname13(options.manifest.controlPlane?.path ?? endpoints[0]?.endpoint.path ?? process.cwd()), ".secrets");
-  const homeDir = options.homeDir ?? process.env.HOME ?? homedir2();
+  const allEndpoints = collectEndpoints(options.manifest);
+  const endpoints = options.targetId && options.targetId !== "all" ? allEndpoints.filter(({ endpoint }) => endpoint.id === options.targetId) : allEndpoints;
+  if (options.targetId && options.targetId !== "all" && endpoints.length === 0) {
+    throw new Error(`Unknown portfolio target: ${options.targetId}`);
+  }
+  const secretsRoot = options.secretsRoot ?? join24(dirname13(options.manifest.controlPlane?.path ?? allEndpoints[0]?.endpoint.path ?? process.cwd()), ".secrets");
+  const homeDir = options.homeDir ?? process.env.HOME ?? homedir4();
   const grokVersion = commandVersion("grok");
   const executionEngineRoot = options.manifest.executionEngine?.path;
   const skillRegistry = inspectSkillRegistry(executionEngineRoot);
-  const expectedPackageVersion = packageVersion(join21(executionEngineRoot ?? "", "packages/pro-gov/package.json"));
+  const expectedPackageVersion = packageVersion(join24(executionEngineRoot ?? "", "packages/pro-gov/package.json"));
   const repositories = endpoints.map(({ endpoint, role }) => inspectRepository(
     endpoint,
     role,
@@ -3897,20 +4224,27 @@ function inspectPortfolioAiHealth(options) {
   const summary = { healthy: 0, attention: 0, unhealthy: 0 };
   for (const repository of repositories) summary[repository.status] += 1;
   return {
-    schemaVersion: 4,
+    schemaVersion: 5,
     portfolioId: options.manifest.portfolioId,
     generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    coverage: {
+      mode: options.targetId && options.targetId !== "all" ? "single" : "all",
+      targetId: options.targetId && options.targetId !== "all" ? options.targetId : void 0,
+      coveredRepositoryIds: repositories.map((repository) => repository.id),
+      totalRepositoryCount: allEndpoints.length
+    },
     privacy: "Names, paths, counts, scopes, safe health states, and configuration origins only. Secret values, environment values, MCP commands, arguments, URLs, headers, MCP environment maps, and raw process environments are never retained or rendered.",
     secretsRoot: inspectSecretsRoot(secretsRoot),
     hostEnvironment: inspectHostEnvironment(
       homeDir,
       grokVersion,
-      endpoints.map(({ endpoint }) => endpoint.path),
+      allEndpoints.map(({ endpoint }) => endpoint.path),
       options.manifest.specialistChecks?.devspace
     ),
     skillRegistry,
     technologyGovernance: {
       strategySource: options.manifest.technologyGovernance?.strategySource,
+      versionPolicy: options.manifest.technologyGovernance?.versionPolicy,
       projectTypes: options.manifest.technologyGovernance?.projectTypes.length ?? 0,
       technologies: options.manifest.technologyGovernance?.technologies.length ?? 0
     },
@@ -3918,19 +4252,44 @@ function inspectPortfolioAiHealth(options) {
     repositories
   };
 }
+function mergePortfolioAiHealthReport(existing, latest, allRepositoryIds) {
+  const repositoriesById = /* @__PURE__ */ new Map();
+  for (const repository of existing?.repositories ?? []) repositoriesById.set(repository.id, repository);
+  for (const repository of latest.repositories) repositoriesById.set(repository.id, repository);
+  const repositories = allRepositoryIds.map((id) => repositoriesById.get(id)).filter((repository) => repository !== void 0);
+  const coveredIds = /* @__PURE__ */ new Set([
+    ...existing?.coverage?.coveredRepositoryIds ?? [],
+    ...latest.coverage.coveredRepositoryIds
+  ]);
+  const coveredRepositoryIds = allRepositoryIds.filter((id) => coveredIds.has(id));
+  const summary = { healthy: 0, attention: 0, unhealthy: 0 };
+  for (const repository of repositories) summary[repository.status] += 1;
+  const complete = coveredRepositoryIds.length === allRepositoryIds.length;
+  return {
+    ...latest,
+    repositories,
+    summary,
+    coverage: {
+      mode: complete ? "all" : "single",
+      targetId: complete ? void 0 : latest.coverage.targetId,
+      coveredRepositoryIds,
+      totalRepositoryCount: allRepositoryIds.length
+    }
+  };
+}
 function writePortfolioAiHealthReport(report, outDir) {
   mkdirSync8(outDir, { recursive: true });
   const dashboardAssets = findDashboardAssets();
   for (const file of ["index.html", "app.js", "app.css"]) {
-    const source = join21(dashboardAssets, file);
-    if (!existsSync20(source)) throw new Error(`Portfolio dashboard asset is missing: ${source}`);
-    cpSync2(source, join21(outDir, file));
+    const source = join24(dashboardAssets, file);
+    if (!existsSync23(source)) throw new Error(`Portfolio dashboard asset is missing: ${source}`);
+    cpSync2(source, join24(outDir, file));
   }
-  const jsonPath = join21(outDir, "portfolio-ai-health.json");
-  const htmlPath = join21(outDir, "index.html");
+  const jsonPath = join24(outDir, "portfolio-ai-health.json");
+  const htmlPath = join24(outDir, "index.html");
   writeFileSync7(jsonPath, `${JSON.stringify(report, null, 2)}
 `);
-  writeFileSync7(join21(outDir, "data.js"), `window.__PORTFOLIO_AI_HEALTH__ = ${safeJavaScriptJson(report)};
+  writeFileSync7(join24(outDir, "data.js"), `window.__PORTFOLIO_AI_HEALTH__ = ${safeJavaScriptJson(report)};
 `);
   return { jsonPath, htmlPath };
 }
@@ -3957,15 +4316,18 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
   const hooks = inspectHooks(root);
   const docs = inspectDocs(root, role === "execution-engine" ? void 0 : expectedPackageVersion);
   const mcp = {
-    codexProject: tomlMcpNames(join21(root, ".codex/config.toml")),
-    claudeCodeProjectShared: jsonObjectKeys(join21(root, ".mcp.json"), "mcpServers"),
+    codexProject: tomlMcpNames(join24(root, ".codex/config.toml")),
+    claudeCodeProjectShared: jsonObjectKeys(join24(root, ".mcp.json"), "mcpServers"),
     claudeCodeProjectLocal: claudeProjectLocalMcpNames(homeDir, root),
-    grokProject: tomlMcpNames(join21(root, ".grok/config.toml")),
+    grokProject: tomlMcpNames(join24(root, ".grok/config.toml")),
     grokEffective: grokInspection.effectiveMcp,
     grokInspection: grokInspection.inspection
   };
   const secrets = inspectRepositorySecrets(root, endpoint.id, secretsRoot, git.isRepository, endpoint.environmentPolicy);
   const projectModel = inspectProjectModel(root, endpoint, technologyGovernance);
+  const versions = inspectVersionPolicy(root, technologyGovernance?.versionPolicy, endpoint.projectType);
+  const verification = inspectProjectVerification(root);
+  const redundancy = inspectProjectRedundancy(root, { homeDir });
   const recommendations = [];
   if (!git.isRepository) recommendations.push("\u8BE5\u8DEF\u5F84\u4E0D\u662F Git \u4ED3\u5E93\uFF1B\u786E\u8BA4\u6E05\u5355\u8DEF\u5F84\u662F\u5426\u6B63\u786E\u3002");
   if (git.unmergedBranches.length > 0) recommendations.push(`\u6709 ${git.unmergedBranches.length} \u6761\u5206\u652F\u5C1A\u672A\u5408\u5165\u5F53\u524D HEAD\uFF1A${git.unmergedBranches.join(", ")}\u3002`);
@@ -4002,12 +4364,15 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
   if (missingBaseline.length > 0) recommendations.push(`\u6280\u672F\u57FA\u7EBF\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingBaseline.map((technology) => technology.label).join("\u3001")}\u3002`);
   const missingSelected = projectModel.optionalCapabilities.filter((technology) => technology.selected && !technology.detected);
   if (missingSelected.length > 0) recommendations.push(`\u5DF2\u9009\u80FD\u529B\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingSelected.map((technology) => technology.label).join("\u3001")}\u3002`);
+  if (versions.status === "attention") recommendations.push(`\u6280\u672F\u7248\u672C\u7B56\u7565\u6709 ${versions.attentionCount} \u9879\u6F02\u79FB\u6216\u7F3A\u5931\uFF1B\u58F0\u660E\u7248\u672C\u4E0E\u5DF2\u5B89\u88C5\u7248\u672C\u5FC5\u987B\u7CBE\u786E\u5BF9\u9F50\u3002`);
+  if (verification.status === "attention") recommendations.push(`\u9A8C\u8BC1\u811A\u672C\u7F3A\u5931\uFF1A${verification.missing.join("\u3001")}\uFF1BPGS \u8981\u6C42 typecheck\u3001lint\u3001format:check\u3001verify \u53EF\u53D1\u73B0\u3002`);
+  if (redundancy.status === "attention") recommendations.push("\u53D1\u73B0\u65E7 AI \u76EE\u5F55\u6216\u5927\u578B Playwright \u7F13\u5B58\uFF1B\u4EC5\u63D0\u4F9B\u8BC1\u636E\uFF0C\u786E\u8BA4\u5F52\u5C5E\u540E\u518D\u7531\u4EBA\u5DE5\u6E05\u7406\u3002");
   return {
     id: endpoint.id,
     role,
     path: root,
     profile: "profile" in endpoint ? endpoint.profile : void 0,
-    status: deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, Boolean(technologyGovernance)),
+    status: deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, Boolean(technologyGovernance), versions, verification, redundancy),
     recommendations,
     git,
     entries,
@@ -4017,10 +4382,13 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
     hostSsot,
     secrets,
     docs,
-    projectModel
+    projectModel,
+    versions,
+    verification,
+    redundancy
   };
 }
-function deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, technologyGovernanceConfigured) {
+function deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, technologyGovernanceConfigured, versions, verification, redundancy) {
   if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || skills.canonical.some((item) => item.kind === "dangling-symlink") || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets)) return "unhealthy";
   const missingBaseline = projectModel.baseline.some((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
   const missingSelected = projectModel.optionalCapabilities.some((technology) => technology.selected && !technology.detected);
@@ -4029,7 +4397,7 @@ function deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs
   const packageVersionNeedsReview = docs.packages.expected !== void 0 && !docs.packages.aligned;
   const routerVersionNeedsReview = !docs.routerAligned;
   const targetManifestMissing = role === "target" && !docs.manifest;
-  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || !hostSsot.compliant || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected || packageVersionNeedsReview || routerVersionNeedsReview || targetManifestMissing) return "attention";
+  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || !hostSsot.compliant || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected || packageVersionNeedsReview || routerVersionNeedsReview || targetManifestMissing || versions.status === "attention" || verification.status === "attention" || redundancy.legacyDirectories.length > 0) return "attention";
   return "healthy";
 }
 function inspectProjectModel(root, endpoint, governance) {
@@ -4039,7 +4407,7 @@ function inspectProjectModel(root, endpoint, governance) {
   const detection = (id) => {
     const technology = technologyById.get(id);
     const packageMatch = technology?.packages?.some((name) => packages.has(name)) ?? false;
-    const fileMatch = technology?.files?.some((path) => existsSync20(join21(root, path))) ?? false;
+    const fileMatch = technology?.files?.some((path) => existsSync23(join24(root, path))) ?? false;
     return { id, label: technology?.label ?? id, detected: packageMatch || fileMatch };
   };
   const selected = new Set(endpoint.capabilities ?? []);
@@ -4062,10 +4430,10 @@ function collectPackageNames(root) {
   try {
     files = splitLines(execFileSync("git", ["ls-files", "*package.json"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }));
   } catch {
-    if (existsSync20(join21(root, "package.json"))) files = ["package.json"];
+    if (existsSync23(join24(root, "package.json"))) files = ["package.json"];
   }
   for (const file of files) {
-    const packageJson = readJson3(join21(root, file));
+    const packageJson = readJson4(join24(root, file));
     if (!isRecord3(packageJson)) continue;
     for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
       const dependencies = packageJson[section];
@@ -4103,9 +4471,9 @@ function inspectGit2(root) {
   };
 }
 function inspectEntries(root) {
-  const agentsPath = join21(root, "AGENTS.md");
-  const agents = !existsSync20(agentsPath) ? "missing" : safeRead(agentsPath).includes("PGS-ROUTER:BEGIN") ? "pgs-router" : "custom";
-  const claudePath = join21(root, "CLAUDE.md");
+  const agentsPath = join24(root, "AGENTS.md");
+  const agents = !existsSync23(agentsPath) ? "missing" : safeRead(agentsPath).includes("PGS-ROUTER:BEGIN") ? "pgs-router" : "custom";
+  const claudePath = join24(root, "CLAUDE.md");
   let claude = "missing";
   if (pathLexists(claudePath)) {
     const info = lstatSync8(claudePath);
@@ -4123,7 +4491,7 @@ function inspectEntries(root) {
   return { agents, claude, gemini: inspectOptionalEntry(root, "GEMINI.md", agentsPath) };
 }
 function inspectOptionalEntry(root, filename, agentsPath) {
-  const path = join21(root, filename);
+  const path = join24(root, filename);
   if (!pathLexists(path)) return "missing";
   const info = lstatSync8(path);
   if (info.isSymbolicLink()) {
@@ -4137,7 +4505,7 @@ function inspectOptionalEntry(root, filename, agentsPath) {
   return /AGENTS\.md/.test(content) && content.length < 2e3 ? "thin-adapter" : "custom";
 }
 function inspectSkills(root, grokInspection) {
-  const lock = readJson3(join21(root, ".pro-gov/assets.lock.json"));
+  const lock = readJson4(join24(root, ".pro-gov/assets.lock.json"));
   const managed = /* @__PURE__ */ new Set();
   const bundleIds = stringArray(isRecord3(lock) ? lock.bundleIds : void 0);
   if (isRecord3(lock) && Array.isArray(lock.assets)) {
@@ -4147,9 +4515,9 @@ function inspectSkills(root, grokInspection) {
       if (match) managed.add(match[1]);
     }
   }
-  const skillRoot = join21(root, ".agents/skills");
+  const skillRoot = join24(root, ".agents/skills");
   const canonical = pathLexists(skillRoot) && safeIsDirectory(skillRoot) ? safeReadDir(skillRoot).filter((name) => !name.startsWith(".")).map((name) => {
-    const path = join21(skillRoot, name);
+    const path = join24(skillRoot, name);
     const stat = lstatSync8(path);
     let kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : "file";
     if (stat.isSymbolicLink()) {
@@ -4175,20 +4543,20 @@ function inspectSkills(root, grokInspection) {
     },
     hosts: {
       codexProject: canonical.filter((item) => item.kind !== "dangling-symlink").length,
-      claudeCodeProject: inspectSkillRoot(join21(root, ".claude/skills")).names.length,
-      grokNativeProject: inspectSkillRoot(join21(root, ".grok/skills")).names.length,
+      claudeCodeProject: inspectSkillRoot(join24(root, ".claude/skills")).names.length,
+      grokNativeProject: inspectSkillRoot(join24(root, ".grok/skills")).names.length,
       grokEffective: grokInspection.skills
     }
   };
 }
 function inspectClaudeSkillRoot(root) {
-  const path = join21(root, ".claude/skills");
+  const path = join24(root, ".claude/skills");
   if (!pathLexists(path)) return "missing";
   const stat = lstatSync8(path);
   if (stat.isSymbolicLink()) {
     try {
       const target = realpathSync4(path);
-      return target === realpathSync4(join21(root, ".agents/skills")) ? "shared-root" : "other";
+      return target === realpathSync4(join24(root, ".agents/skills")) ? "shared-root" : "other";
     } catch {
       return "dangling-symlink";
     }
@@ -4196,7 +4564,7 @@ function inspectClaudeSkillRoot(root) {
   return stat.isDirectory() ? "duplicate-directory" : "other";
 }
 function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environmentPolicy) {
-  const centralPath = join21(secretsRoot, id);
+  const centralPath = join24(secretsRoot, id);
   const centralRealPath = safeRealpath(centralPath);
   const localOnlyReasons = new Map(
     (environmentPolicy?.localOnly ?? []).map((entry) => [entry.path, entry.reason])
@@ -4208,16 +4576,16 @@ function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environme
       tracked: isRepository ? gitTracks(root, path) : false,
       template: isEnvironmentTemplate(path),
       fixture: isEnvironmentFixture(path),
-      symlink: lstatSync8(join21(root, path)).isSymbolicLink(),
-      centralized: pointsInside(join21(root, path), centralRealPath),
+      symlink: lstatSync8(join24(root, path)).isSymbolicLink(),
+      centralized: pointsInside(join24(root, path), centralRealPath),
       localOnly: localOnlyReason !== void 0,
       ...localOnlyReason !== void 0 ? { localOnlyReason } : {}
     };
   });
   return {
-    centralDirectory: existsSync20(centralPath) ? "present" : "absent",
-    centralMode: existsSync20(centralPath) ? modeString(statSync4(centralPath).mode) : void 0,
-    centralFiles: existsSync20(centralPath) ? collectCentralSecretFiles(centralPath) : [],
+    centralDirectory: existsSync23(centralPath) ? "present" : "absent",
+    centralMode: existsSync23(centralPath) ? modeString(statSync5(centralPath).mode) : void 0,
+    centralFiles: existsSync23(centralPath) ? collectCentralSecretFiles(centralPath) : [],
     repositoryEnvFiles: envFiles
   };
 }
@@ -4226,11 +4594,11 @@ function collectEnvironmentFiles(root, current = root, depth = 0) {
   if (depth > 5) return [];
   const found = [];
   try {
-    for (const entry of readdirSync8(current, { withFileTypes: true })) {
+    for (const entry of readdirSync9(current, { withFileTypes: true })) {
       if (entry.isDirectory()) {
-        if (!SKIP_ENV_DIRECTORIES.has(entry.name)) found.push(...collectEnvironmentFiles(root, join21(current, entry.name), depth + 1));
+        if (!SKIP_ENV_DIRECTORIES.has(entry.name)) found.push(...collectEnvironmentFiles(root, join24(current, entry.name), depth + 1));
       } else if (isEnvironmentFilename(entry.name) && !isProviderGeneratedEnvironmentFile(entry.name)) {
-        found.push(relative8(root, join21(current, entry.name)));
+        found.push(relative8(root, join24(current, entry.name)));
       }
     }
   } catch {
@@ -4242,8 +4610,8 @@ function collectCentralSecretFiles(root, current = root, depth = 0) {
   if (depth > 3) return [];
   const found = [];
   try {
-    for (const entry of readdirSync8(current, { withFileTypes: true })) {
-      const path = join21(current, entry.name);
+    for (const entry of readdirSync9(current, { withFileTypes: true })) {
+      const path = join24(current, entry.name);
       if (entry.isDirectory()) found.push(...collectCentralSecretFiles(root, path, depth + 1));
       else found.push({ path: relative8(root, path), mode: modeString(lstatSync8(path).mode) });
     }
@@ -4286,12 +4654,12 @@ function hasUnsafeCentralSecretPermissions(secrets) {
   return secrets.centralDirectory === "present" && (secrets.centralMode !== "700" || secrets.centralFiles.some((file) => file.mode !== "600"));
 }
 function inspectSecretsRoot(path) {
-  return existsSync20(path) ? { path, exists: true, mode: modeString(statSync4(path).mode) } : { path, exists: false };
+  return existsSync23(path) ? { path, exists: true, mode: modeString(statSync5(path).mode) } : { path, exists: false };
 }
 function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceSettings) {
-  const codexConfig = join21(homeDir, ".codex/config.toml");
-  const claudeConfig = join21(homeDir, ".claude.json");
-  const grokConfig = join21(homeDir, ".grok/config.toml");
+  const codexConfig = join24(homeDir, ".codex/config.toml");
+  const claudeConfig = join24(homeDir, ".claude.json");
+  const grokConfig = join24(homeDir, ".grok/config.toml");
   const hostEnvironment = {
     mcp: {
       codexUser: { path: codexConfig, names: tomlMcpNames(codexConfig) },
@@ -4299,11 +4667,11 @@ function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceS
       grokUser: { path: grokConfig, names: tomlMcpNames(grokConfig) }
     },
     skills: {
-      codexUser: inspectSkillRoot(join21(homeDir, ".agents/skills")),
-      claudeCodeUser: inspectSkillRoot(join21(homeDir, ".claude/skills")),
-      grokUser: inspectSkillRoot(join21(homeDir, ".grok/skills")),
-      grokAgentsCompatibility: inspectSkillRoot(join21(homeDir, ".agents/skills")),
-      grokClaudeCompatibility: inspectSkillRoot(join21(homeDir, ".claude/skills")),
+      codexUser: inspectSkillRoot(join24(homeDir, ".agents/skills")),
+      claudeCodeUser: inspectSkillRoot(join24(homeDir, ".claude/skills")),
+      grokUser: inspectSkillRoot(join24(homeDir, ".grok/skills")),
+      grokAgentsCompatibility: inspectSkillRoot(join24(homeDir, ".agents/skills")),
+      grokClaudeCompatibility: inspectSkillRoot(join24(homeDir, ".claude/skills")),
       ssot: inspectUserSkillsSsot(homeDir)
     },
     grok: {
@@ -4323,9 +4691,9 @@ function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceS
 }
 function inspectDevSpaceHealth(options) {
   const run = options.run ?? runDevSpaceCommand;
-  const configDirectory = join21(options.homeDir, ".devspace");
-  const configPath = join21(configDirectory, "config.json");
-  const authPath = join21(configDirectory, "auth.json");
+  const configDirectory = join24(options.homeDir, ".devspace");
+  const configPath = join24(configDirectory, "config.json");
+  const authPath = join24(configDirectory, "auth.json");
   const installedResult = run("devspace", ["--version"], 3e3);
   const installedVersion = installedResult.ok ? installedResult.stdout.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/)?.[0] : void 0;
   const latestResult = run("npm", ["view", "@waishnav/devspace", "version", "--registry=https://registry.npmjs.org/"], 5e3);
@@ -4335,14 +4703,14 @@ function inspectDevSpaceHealth(options) {
   const processEnvironment = pid ? run("ps", ["eww", "-p", pid, "-o", "command="], 3e3) : void 0;
   const processToolMode = processEnvironment?.ok ? processEnvironment.stdout.match(/(?:^|\s)DEVSPACE_TOOL_MODE=(minimal|full|codex)(?:\s|$)/)?.[1] : void 0;
   const doctor = !installedResult.ok ? "unavailable" : run("devspace", ["doctor"], 1e4).ok ? "ok" : "failed";
-  const configValue = readJson3(configPath);
+  const configValue = readJson4(configPath);
   const configExists = isRecord3(configValue);
   const allowedRoots = configExists && Array.isArray(configValue.allowedRoots) ? configValue.allowedRoots.filter((value) => typeof value === "string") : [];
   const portfolioCoverage = !configExists || allowedRoots.length === 0 ? "unknown" : options.repositoryPaths.every((repositoryPath) => allowedRoots.some((root) => isPathInside(repositoryPath, root))) ? "complete" : "partial";
   const bind = configExists && typeof configValue.host === "string" ? isLoopbackHost(configValue.host) ? "loopback" : "non-loopback" : "unknown";
-  const directoryMode = existsSync20(configDirectory) ? modeString(statSync4(configDirectory).mode) : void 0;
-  const fileMode = existsSync20(configPath) ? modeString(statSync4(configPath).mode) : void 0;
-  const authMode = existsSync20(authPath) ? modeString(statSync4(authPath).mode) : void 0;
+  const directoryMode = existsSync23(configDirectory) ? modeString(statSync5(configDirectory).mode) : void 0;
+  const fileMode = existsSync23(configPath) ? modeString(statSync5(configPath).mode) : void 0;
+  const authMode = existsSync23(authPath) ? modeString(statSync5(authPath).mode) : void 0;
   const update = installedVersion && latestVersion ? installedVersion === latestVersion ? "current" : "available" : "unknown";
   const recommendations = [];
   let status = "healthy";
@@ -4356,7 +4724,7 @@ function inspectDevSpaceHealth(options) {
   };
   if (!installedResult.ok) unhealthy("\u672C\u673A\u672A\u53D1\u73B0 DevSpace\uFF1B\u65E0\u6CD5\u4F7F\u7528\u5BBF\u4E3B\u5DE5\u4F5C\u533A\u670D\u52A1\u3002");
   if (!configExists) unhealthy("\u7F3A\u5C11 ~/.devspace/config.json\u3002");
-  if (!existsSync20(authPath)) unhealthy("\u7F3A\u5C11 ~/.devspace/auth.json\u3002");
+  if (!existsSync23(authPath)) unhealthy("\u7F3A\u5C11 ~/.devspace/auth.json\u3002");
   if (directoryMode && directoryMode !== "700") unhealthy(`~/.devspace \u76EE\u5F55\u6743\u9650\u4E3A ${directoryMode}\uFF0C\u5E94\u6536\u7D27\u4E3A 700\u3002`);
   if (fileMode && fileMode !== "600") unhealthy(`DevSpace \u914D\u7F6E\u6587\u4EF6\u6743\u9650\u4E3A ${fileMode}\uFF0C\u5E94\u4E3A 600\u3002`);
   if (authMode && authMode !== "600") unhealthy(`DevSpace \u8BA4\u8BC1\u6587\u4EF6\u6743\u9650\u4E3A ${authMode}\uFF0C\u5E94\u4E3A 600\u3002`);
@@ -4382,7 +4750,7 @@ function inspectDevSpaceHealth(options) {
       exists: configExists,
       ...directoryMode ? { directoryMode } : {},
       ...fileMode ? { fileMode } : {},
-      authExists: existsSync20(authPath),
+      authExists: existsSync23(authPath),
       ...authMode ? { authMode } : {},
       bind,
       portValid: configExists && typeof configValue.port === "number" && Number.isInteger(configValue.port) && configValue.port > 0 && configValue.port <= 65535,
@@ -4416,12 +4784,12 @@ function isPathInside(path, root) {
 }
 function inspectSkillRoot(path) {
   const exists = pathLexists(path) && safeIsDirectory(path);
-  const names = exists ? safeReadDir(path).filter((name) => !name.startsWith(".") && existsSync20(join21(path, name, "SKILL.md"))) : [];
+  const names = exists ? safeReadDir(path).filter((name) => !name.startsWith(".") && existsSync23(join24(path, name, "SKILL.md"))) : [];
   return { path, exists, names };
 }
 function claudeProjectLocalMcpNames(homeDir, root) {
   if (!homeDir) return [];
-  const value = readJson3(join21(homeDir, ".claude.json"));
+  const value = readJson4(join24(homeDir, ".claude.json"));
   if (!isRecord3(value) || !isRecord3(value.projects)) return [];
   const candidates = new Set([resolve5(root), safeRealpath(root)].filter((path) => Boolean(path)));
   const names = /* @__PURE__ */ new Set();
@@ -4457,13 +4825,13 @@ function inspectGrokProject(root, homeDir, grokVersion) {
     const value = JSON.parse(execFileSync("grok", ["inspect", "--json"], {
       cwd: root,
       encoding: "utf8",
-      env: { ...process.env, HOME: homeDir, GROK_HOME: join21(homeDir, ".grok") },
+      env: { ...process.env, HOME: homeDir, GROK_HOME: join24(homeDir, ".grok") },
       maxBuffer: 10 * 1024 * 1024,
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 8e3
     }));
     if (!isRecord3(value)) return empty("failed");
-    const userClaudeNames = new Set(jsonObjectKeys(join21(homeDir, ".claude.json"), "mcpServers"));
+    const userClaudeNames = new Set(jsonObjectKeys(join24(homeDir, ".claude.json"), "mcpServers"));
     const localClaudeNames = new Set(claudeProjectLocalMcpNames(homeDir, root));
     const effectiveMcp = Array.isArray(value.mcpServers) ? value.mcpServers.flatMap((item) => {
       if (!isRecord3(item) || typeof item.name !== "string") return [];
@@ -4521,9 +4889,9 @@ function inferGrokMcpScope(name, sourceType, sourcePath, root, homeDir, userClau
   }
   const resolvedSource = safeRealpath(sourcePath) ?? resolve5(sourcePath);
   const resolvedRoot = safeRealpath(root) ?? resolve5(root);
-  if (resolvedSource === join21(resolvedRoot, ".mcp.json")) return "project-shared";
+  if (resolvedSource === join24(resolvedRoot, ".mcp.json")) return "project-shared";
   if (resolvedSource.startsWith(resolvedRoot + sep)) return "project";
-  if (homeDir && resolvedSource === join21(resolve5(homeDir), ".claude.json")) {
+  if (homeDir && resolvedSource === join24(resolve5(homeDir), ".claude.json")) {
     if (localClaudeNames.has(name)) return "project-local";
     if (userClaudeNames.has(name)) return "user";
   }
@@ -4558,7 +4926,7 @@ function inspectHooks(root) {
     { host: "codex", path: ".codex/hooks.json" }
   ];
   return configs.map((config) => {
-    const value = readJson3(join21(root, config.path));
+    const value = readJson4(join24(root, config.path));
     const counts = /* @__PURE__ */ new Map();
     collectHookEvents(value, counts);
     return {
@@ -4579,18 +4947,18 @@ function collectHookEvents(value, counts) {
   }
 }
 function inspectDocs(root, expected) {
-  const packageJson = readJson3(join21(root, "package.json"));
+  const packageJson = readJson4(join24(root, "package.json"));
   const dependencies = isRecord3(packageJson) ? { ...recordOrEmpty(packageJson.dependencies), ...recordOrEmpty(packageJson.devDependencies) } : {};
   const docGov = dependencyVersion(dependencies["@pieai/doc-gov"]);
   const proGov = dependencyVersion(dependencies["@pieai/pro-gov"]);
-  const routerMatch = safeRead(join21(root, "AGENTS.md")).match(/PGS-ROUTER:BEGIN\s+v([0-9.]+)/);
+  const routerMatch = safeRead(join24(root, "AGENTS.md")).match(/PGS-ROUTER:BEGIN\s+v([0-9.]+)/);
   const declared = [docGov, proGov].filter((value) => Boolean(value));
   return {
     routerVersion: routerMatch?.[1],
     expectedRouterVersion: CURRENT_ROUTER_VERSION,
     routerAligned: routerMatch?.[1] === CURRENT_ROUTER_VERSION,
-    manifest: existsSync20(join21(root, "docs/governance/MANIFEST.yml")),
-    currentWork: existsSync20(join21(root, "docs/reference/execution/current-work.md")),
+    manifest: existsSync23(join24(root, "docs/governance/MANIFEST.yml")),
+    currentWork: existsSync23(join24(root, "docs/reference/execution/current-work.md")),
     packages: {
       expected,
       docGov,
@@ -4605,7 +4973,7 @@ function dependencyVersion(value) {
   return match?.[1];
 }
 function packageVersion(path) {
-  const value = readJson3(path);
+  const value = readJson4(path);
   return isRecord3(value) && typeof value.version === "string" ? value.version : void 0;
 }
 function recordOrEmpty(value) {
@@ -4613,20 +4981,20 @@ function recordOrEmpty(value) {
 }
 function inspectSkillRegistry(executionEngineRoot) {
   if (!executionEngineRoot) return { source: 0, registered: 0, bundled: 0, bundles: 0 };
-  const agentAssetsRoot = join21(executionEngineRoot, "agent-assets");
-  const registry = readJson3(join21(agentAssetsRoot, "registry.json"));
+  const agentAssetsRoot = join24(executionEngineRoot, "agent-assets");
+  const registry = readJson4(join24(agentAssetsRoot, "registry.json"));
   const assets = isRecord3(registry) && Array.isArray(registry.assets) ? registry.assets : [];
   const registeredSkills = assets.filter((asset) => isRecord3(asset) && asset.kind === "skill");
-  const bundleRoot = join21(agentAssetsRoot, "bundles");
+  const bundleRoot = join24(agentAssetsRoot, "bundles");
   const bundleFiles = safeReadDir(bundleRoot).filter((file) => file.endsWith(".json"));
   const bundledIds = /* @__PURE__ */ new Set();
   for (const file of bundleFiles) {
-    const bundle = readJson3(join21(bundleRoot, file));
+    const bundle = readJson4(join24(bundleRoot, file));
     if (!isRecord3(bundle) || !Array.isArray(bundle.assets)) continue;
     for (const id of bundle.assets) if (typeof id === "string") bundledIds.add(id);
   }
-  const sourceRoots = [join21(agentAssetsRoot, "skills/pie-skills"), join21(agentAssetsRoot, "skills/npx-skills/.agents/skills")];
-  const source = sourceRoots.reduce((count, root) => count + safeReadDir(root).filter((name) => existsSync20(join21(root, name, "SKILL.md"))).length, 0);
+  const sourceRoots = [join24(agentAssetsRoot, "skills/pie-skills"), join24(agentAssetsRoot, "skills/npx-skills/.agents/skills")];
+  const source = sourceRoots.reduce((count, root) => count + safeReadDir(root).filter((name) => existsSync23(join24(root, name, "SKILL.md"))).length, 0);
   return {
     source,
     registered: registeredSkills.length,
@@ -4635,12 +5003,12 @@ function inspectSkillRegistry(executionEngineRoot) {
   };
 }
 function jsonObjectKeys(path, key) {
-  const value = readJson3(path);
+  const value = readJson4(path);
   if (!isRecord3(value) || !isRecord3(value[key])) return [];
   return Object.keys(value[key]).sort();
 }
 function tomlMcpNames(path) {
-  if (!existsSync20(path)) return [];
+  if (!existsSync23(path)) return [];
   const names = /* @__PURE__ */ new Set();
   for (const line of safeRead(path).split(/\r?\n/)) {
     const match = line.match(/^\s*\[mcp_servers\.(?:"([^"]+)"|([^\.\]]+))\]\s*$/);
@@ -4649,30 +5017,30 @@ function tomlMcpNames(path) {
   }
   return [...names].sort();
 }
-function readJson3(path) {
+function readJson4(path) {
   try {
-    return JSON.parse(readFileSync15(path, "utf8"));
+    return JSON.parse(readFileSync17(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function safeRead(path) {
   try {
-    return readFileSync15(path, "utf8");
+    return readFileSync17(path, "utf8");
   } catch {
     return "";
   }
 }
 function safeReadDir(path) {
   try {
-    return readdirSync8(path).sort();
+    return readdirSync9(path).sort();
   } catch {
     return [];
   }
 }
 function safeIsDirectory(path) {
   try {
-    return statSync4(path).isDirectory();
+    return statSync5(path).isDirectory();
   } catch {
     return false;
   }
@@ -4709,14 +5077,14 @@ function findDashboardAssets() {
   const packageRoot2 = dirname13(dirname13(fileURLToPath4(import.meta.url)));
   const candidates = [
     process.env.PGS_DASHBOARD_ASSETS_DIR,
-    join21(packageRoot2, ".dashboard-build"),
-    join21(packageRoot2, "assets/portfolio-dashboard"),
-    join21(process.cwd(), ".dashboard-build"),
-    join21(process.cwd(), "assets/portfolio-dashboard"),
-    join21(process.cwd(), "packages/pro-gov/.dashboard-build"),
-    join21(process.cwd(), "packages/pro-gov/assets/portfolio-dashboard")
+    join24(packageRoot2, ".dashboard-build"),
+    join24(packageRoot2, "assets/portfolio-dashboard"),
+    join24(process.cwd(), ".dashboard-build"),
+    join24(process.cwd(), "assets/portfolio-dashboard"),
+    join24(process.cwd(), "packages/pro-gov/.dashboard-build"),
+    join24(process.cwd(), "packages/pro-gov/assets/portfolio-dashboard")
   ].filter((value) => Boolean(value));
-  const match = candidates.find((path) => existsSync20(join21(path, "index.html")));
+  const match = candidates.find((path) => existsSync23(join24(path, "index.html")));
   if (!match) throw new Error("Portfolio dashboard assets were not built. Run pnpm --filter @pieai/pro-gov build.");
   return match;
 }
@@ -4752,10 +5120,23 @@ function runPortfolioAiHealth(args) {
     for (const issue of loaded.issues) console.error(`${issue.type}: ${issue.message}`);
     return 1;
   }
-  const report = inspectPortfolioAiHealth({
+  const targetId = options.value.targetId && options.value.targetId !== "all" ? options.value.targetId : void 0;
+  if (targetId && !loaded.manifest.targets.some((target) => target.id === targetId)) {
+    console.error(`Unknown portfolio target: ${targetId}`);
+    return 1;
+  }
+  const latest = inspectPortfolioAiHealth({
     manifest: loaded.manifest,
-    secretsRoot: options.value.secretsRoot
+    secretsRoot: options.value.secretsRoot,
+    targetId
   });
+  const allRepositoryIds = [
+    loaded.manifest.controlPlane?.id,
+    loaded.manifest.executionEngine?.id,
+    ...loaded.manifest.targets.map((target) => target.id)
+  ].filter((id) => Boolean(id));
+  const existing = targetId ? readExistingAiHealthReport(options.value.outDir, loaded.manifest.portfolioId) : void 0;
+  const report = targetId ? mergePortfolioAiHealthReport(existing, latest, allRepositoryIds) : latest;
   const written = writePortfolioAiHealthReport(report, options.value.outDir);
   if (options.value.json) {
     console.log(JSON.stringify({ ok: true, ...written, summary: report.summary }, null, 2));
@@ -4814,6 +5195,12 @@ function runPortfolioDoctor(args) {
       for (const warning of target.hostSsot.issues) {
         console.log(`${target.id}	host-ssot-warning: ${warning}`);
       }
+      if (target.verification.status === "attention") {
+        console.log(`${target.id}	verification-warning: missing ${target.verification.missing.join(", ")}`);
+      }
+      if (target.versions.status === "attention") {
+        console.log(`${target.id}	version-policy-warning: ${target.versions.attentionCount} drift(s)`);
+      }
     }
     if (result.ok) {
       console.log(`portfolio doctor passed (${targets.length} targets)`);
@@ -5078,8 +5465,8 @@ function isHost2(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
 function findPortfolioAgentAssetsDir(manifest) {
-  const agentAssetsDir = manifest?.executionEngine?.path ? join22(manifest.executionEngine.path, "agent-assets") : void 0;
-  return agentAssetsDir && existsSync21(join22(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
+  const agentAssetsDir = manifest?.executionEngine?.path ? join25(manifest.executionEngine.path, "agent-assets") : void 0;
+  return agentAssetsDir && existsSync24(join25(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
 }
 function printUsage4() {
   console.error("Usage:");
@@ -5087,12 +5474,24 @@ function printUsage4() {
   console.error("  pro-gov portfolio plan --config <path> [--target <id|all>] [--host codex|claude-code|gemini-cli|antigravity] [--json]");
   console.error("  pro-gov portfolio assets-check --config <path> [--target <id|all>] [--json]");
   console.error("  pro-gov portfolio doctor --config <path> [--target <id|all>] [--json]");
-  console.error("  pro-gov portfolio ai-health --config <path> --out <directory> [--secrets-root <directory>] [--json]");
+  console.error("  pro-gov portfolio ai-health --config <path> --out <directory> [--target <id|all>] [--secrets-root <directory>] [--json]");
+}
+function readExistingAiHealthReport(outDir, portfolioId) {
+  if (!outDir) return void 0;
+  const path = join25(outDir, "portfolio-ai-health.json");
+  if (!existsSync24(path)) return void 0;
+  try {
+    const value = JSON.parse(readFileSync18(path, "utf8"));
+    if (!value || typeof value !== "object" || value.portfolioId !== portfolioId || !Array.isArray(value.repositories)) return void 0;
+    return value;
+  } catch {
+    return void 0;
+  }
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync22, lstatSync as lstatSync9, readFileSync as readFileSync16, readlinkSync as readlinkSync4 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync25, lstatSync as lstatSync9, readFileSync as readFileSync19, readlinkSync as readlinkSync4 } from "node:fs";
+import { join as join26 } from "node:path";
 function runSync(args) {
   const check = args.includes("--check");
   if (!check) {
@@ -5120,7 +5519,7 @@ function runSync(args) {
   console.log("pro-gov sync check");
   console.log(`profile: ${profile}`);
   for (const file of planStarterFiles(profile)) {
-    const targetPath = join23(process.cwd(), file.targetPath);
+    const targetPath = join26(process.cwd(), file.targetPath);
     const stat = safeLstat3(targetPath);
     if (!stat) {
       if (file.ownership === "optional-guardrail") continue;
@@ -5144,8 +5543,8 @@ function runSync(args) {
       }
       continue;
     }
-    const source = readFileSync16(file.absoluteSourcePath, "utf8");
-    const target = readFileSync16(targetPath, "utf8");
+    const source = readFileSync19(file.absoluteSourcePath, "utf8");
+    const target = readFileSync19(targetPath, "utf8");
     if (!matchesExpectedContent(file.targetPath, source, target)) {
       console.log(`different: ${file.targetPath}`);
       differences += 1;
@@ -5179,7 +5578,7 @@ function normalizeMarkdownTableCell(cell) {
 }
 function inferInstalledProfile(root) {
   const installed = ["engineering-runtime", "doc-only"].filter(
-    (profile) => existsSync22(join23(root, `docs/governance/agents-routing/${profile}-v1.1.md`))
+    (profile) => existsSync25(join26(root, `docs/governance/agents-routing/${profile}-v1.1.md`))
   );
   return installed.length === 1 ? installed[0] : void 0;
 }