@pieai/pro-gov 0.7.1 → 0.7.3

package/dist/cli.js

@@ -66,7 +66,15 @@ function loadAgentAssetBundles(agentAssetsDir) {
 // src/asset-npx/maintenance.ts
 import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { cpSync, existsSync as existsSync3, mkdirSync, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync2, statSync } from "node:fs";
+import {
+  cpSync,
+  existsSync as existsSync3,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync2,
+  statSync
+} from "node:fs";
 import { join as join3, relative as relative2 } from "node:path";
 import { tmpdir } from "node:os";
 function createNpxSkillsMaintenancePlan(options) {
@@ -93,7 +101,6 @@ function createNpxSkillsMaintenancePlan(options) {
   if (options.operation === "update") {
     assertNoReportedPartialUpdateFailure(result.stdout, result.stderr);
   }
-  assertNoDeprecatedMattSkills(tempRoot);
   const after = snapshotFiles(tempRoot);
   const changes = diffSnapshots(before, after);
   return {
@@ -111,23 +118,14 @@ function createNpxSkillsMaintenancePlan(options) {
   };
 }
 function assertNoReportedPartialUpdateFailure(stdout, stderr) {
+  const ansiEscape = new RegExp(`${String.fromCharCode(27)}\\[[0-?]*[ -/]*[@-~]`, "g");
   const output = `${stdout}
-${stderr}`.replace(/\u001B\[[0-?]*[ -/]*[@-~]/g, "");
+${stderr}`.replace(ansiEscape, "");
   const failure = output.match(/Failed to update\s+\d+\s+skill\(s\)/i);
   if (failure) {
     throw new Error(`npx skills update reported a partial failure: ${failure[0]}`);
   }
 }
-function assertNoDeprecatedMattSkills(npxRoot) {
-  const lockPath = join3(npxRoot, "skills-lock.json");
-  const lock = JSON.parse(readFileSync2(lockPath, "utf8"));
-  const deprecated = Object.entries(lock.skills ?? {}).filter(
-    ([, entry]) => entry.source === "mattpocock/skills" && entry.skillPath?.startsWith("skills/deprecated/")
-  ).map(([name]) => name).sort();
-  if (deprecated.length > 0) {
-    throw new Error(`npx skills plan contains deprecated mattpocock skills: ${deprecated.join(", ")}`);
-  }
-}
 function assertNativeNpxRoot(npxRoot) {
   if (!existsSync3(join3(npxRoot, "skills-lock.json"))) {
     throw new Error(`npx skills root is missing skills-lock.json: ${npxRoot}`);
@@ -579,10 +577,10 @@ function createAssetInstallPlan(options) {
   const placement = options.placement ?? "registry";
   const assetsById = new Map(options.registry.assets.map((asset) => [asset.id, asset]));
   const bundlesById = new Map(options.bundles.map((bundle) => [bundle.id, bundle]));
-  const assetIds = resolveBundleAssetIds(options.bundleIds, bundlesById);
+  const assetIds = resolveAssetIds(options.bundleIds, options.assetIds ?? [], bundlesById);
   const assets = assetIds.map((assetId) => {
     const asset = assetsById.get(assetId);
-    if (!asset) throw new Error(`Unknown asset id in bundle: ${assetId}`);
+    if (!asset) throw new Error(`Unknown asset id in install plan: ${assetId}`);
     if (asset.kind === "skill" && !asset.hosts.includes(options.host)) {
       throw new Error(`Asset ${assetId} does not support host ${options.host}`);
     }
@@ -663,8 +661,8 @@ function createAssetInstallPlan(options) {
     ]
   };
 }
-function resolveBundleAssetIds(bundleIds, bundlesById) {
-  const ids = /* @__PURE__ */ new Set();
+function resolveAssetIds(bundleIds, explicitAssetIds, bundlesById) {
+  const ids = new Set(explicitAssetIds);
   for (const bundleId of bundleIds) {
     const bundle = bundlesById.get(bundleId);
     if (!bundle) throw new Error(`Unknown bundle id: ${bundleId}`);
@@ -1439,6 +1437,7 @@ function runAssetsPlan(args) {
       registry: loaded.registry,
       bundles: loadAgentAssetBundles(loaded.agentAssetsDir),
       bundleIds: options.value.bundleIds,
+      assetIds: options.value.assetIds,
       host: options.value.host,
       placement: options.value.placement
     });
@@ -1521,6 +1520,7 @@ function parsePlanOptions(args) {
     targetDir: process.cwd(),
     json: false,
     bundleIds: [],
+    assetIds: [],
     host: "codex"
   };
   for (let index = 0; index < args.length; index += 1) {
@@ -1535,6 +1535,11 @@ function parsePlanOptions(args) {
       if (!bundleId) return { ok: false, error: "Expected --bundle <bundle-id>" };
       options.bundleIds.push(bundleId);
       index += 1;
+    } else if (arg === "--asset") {
+      const assetId = args[index + 1];
+      if (!assetId) return { ok: false, error: "Expected --asset <asset-id>" };
+      options.assetIds.push(assetId);
+      index += 1;
     } else if (arg === "--host") {
       const host = args[index + 1];
       if (!isHost(host)) {
@@ -1566,8 +1571,8 @@ function parsePlanOptions(args) {
       return { ok: false, error: `Unknown assets plan option: ${arg}` };
     }
   }
-  if (options.bundleIds.length === 0) {
-    return { ok: false, error: "Expected at least one --bundle <bundle-id>" };
+  if (options.bundleIds.length === 0 && options.assetIds.length === 0) {
+    return { ok: false, error: "Expected at least one --bundle <bundle-id> or --asset <asset-id>" };
   }
   return { ok: true, value: options };
 }
@@ -1713,7 +1718,7 @@ function printUsage() {
   console.error("  pro-gov assets list [--registry] [--json] [--visibility public|private|third-party|all]");
   console.error("  pro-gov assets discover [--target <path>] [--json]");
   console.error("  pro-gov assets recommend [--target <path>] [--json]");
-  console.error("  pro-gov assets plan --bundle <bundle-id> [--bundle <bundle-id>] [--target <path>] [--host codex|claude-code|gemini-cli|antigravity] [--placement auto|manual] [--out <path>] [--json]");
+  console.error("  pro-gov assets plan [--bundle <bundle-id>] [--asset <asset-id>] [--target <path>] [--host codex|claude-code|gemini-cli|antigravity] [--placement auto|manual] [--out <path>] [--json]");
   console.error("  pro-gov assets apply --plan <path>");
   console.error("  pro-gov assets check [--target <path>] [--json]");
   console.error("  pro-gov assets public-check [--public-root <path>] [--private-root <path>] [--json]");
@@ -2819,13 +2824,30 @@ import { homedir } from "node:os";
 import { join as join18 } from "node:path";
 var DEFAULT_CACHE_THRESHOLD_BYTES = 1e9;
 var MAX_CACHE_ENTRIES = 2e4;
-function inspectProjectRedundancy(root, options = {}) {
-  const legacyDirectories = inspectLegacyDirectories(root);
+function inspectHostRedundancy(options = {}) {
   const homeDir = options.homeDir ?? homedir();
-  const cachePaths = getPlaywrightCachePaths(homeDir, options.playwrightBrowsersPath ?? process.env.PLAYWRIGHT_BROWSERS_PATH);
-  const playwrightCaches = cachePaths.map((path) => inspectPlaywrightCache(path));
+  const cachePaths = getPlaywrightCachePaths(
+    homeDir,
+    options.playwrightBrowsersPath ?? process.env.PLAYWRIGHT_BROWSERS_PATH
+  );
+  const playwrightCaches = cachePaths.map((path) => inspectPlaywrightCache(path, options.cache));
   const cacheThresholdBytes = options.cacheThresholdBytes ?? DEFAULT_CACHE_THRESHOLD_BYTES;
-  const status = legacyDirectories.length > 0 || playwrightCaches.some((cache) => cache.exists && (cache.bytes >= cacheThresholdBytes || cache.truncated)) ? "attention" : "clean";
+  const status = playwrightCaches.some(
+    (cache) => cache.exists && (cache.bytes >= cacheThresholdBytes || cache.truncated)
+  ) ? "attention" : "clean";
+  return {
+    status,
+    playwrightCaches,
+    recommendations: status === "attention" ? [
+      "\u53D1\u73B0\u5927\u578B\u6216\u672A\u5B8C\u6574\u8BA1\u6570\u7684 Playwright \u6D4F\u89C8\u5668\u7F13\u5B58\uFF1B\u786E\u8BA4\u6CA1\u6709\u6D4B\u8BD5\u4EFB\u52A1\u5360\u7528\u540E\uFF0C\u6309\u5BBF\u4E3B\u7EA7\u7F13\u5B58\u7EDF\u4E00\u6E05\u7406\u3002"
+    ] : []
+  };
+}
+function inspectProjectRedundancy(root, options = {}) {
+  const legacyDirectories = inspectLegacyDirectories(root);
+  const hostRedundancy = options.includePlaywrightCaches === false ? void 0 : inspectHostRedundancy(options);
+  const playwrightCaches = hostRedundancy?.playwrightCaches ?? [];
+  const status = legacyDirectories.length > 0 || hostRedundancy?.status === "attention" ? "attention" : "clean";
   return { status, legacyDirectories, playwrightCaches };
 }
 function inspectLegacyDirectories(root) {
@@ -2833,13 +2855,15 @@ function inspectLegacyDirectories(root) {
   const path = join18(root, relativePath);
   if (!existsSync16(path)) return [];
   const stats = collectDirectoryStats(path);
-  return [{
-    path: relativePath,
-    kind: "legacy-ai-directory",
-    fileCount: stats.fileCount,
-    bytes: stats.bytes,
-    reason: "\u9879\u76EE\u7EA7\u65E7 AI \u5BBF\u4E3B\u76EE\u5F55\uFF1B\u5E94\u4E0E .agents/skills \u7684 SSOT \u9010\u9879\u6BD4\u5BF9\u540E\u518D\u51B3\u5B9A\u662F\u5426\u8FC1\u79FB\uFF0C\u626B\u63CF\u5668\u4E0D\u81EA\u52A8\u5220\u9664\u3002"
-  }];
+  return [
+    {
+      path: relativePath,
+      kind: "legacy-ai-directory",
+      fileCount: stats.fileCount,
+      bytes: stats.bytes,
+      reason: "\u9879\u76EE\u7EA7\u65E7 AI \u5BBF\u4E3B\u76EE\u5F55\uFF1B\u5E94\u4E0E .agents/skills \u7684 SSOT \u9010\u9879\u6BD4\u5BF9\u540E\u518D\u51B3\u5B9A\u662F\u5426\u8FC1\u79FB\uFF0C\u626B\u63CF\u5668\u4E0D\u81EA\u52A8\u5220\u9664\u3002"
+    }
+  ];
 }
 function getPlaywrightCachePaths(homeDir, configuredPath) {
   const candidates = [
@@ -2850,18 +2874,40 @@ function getPlaywrightCachePaths(homeDir, configuredPath) {
   ].filter((path) => Boolean(path));
   return [...new Set(candidates)];
 }
-function inspectPlaywrightCache(path) {
+function inspectPlaywrightCache(path, cache) {
+  const cached = cache?.get(path);
+  if (cached) return cached;
   if (!existsSync16(path)) {
-    return { path, exists: false, fileCount: 0, bytes: 0, revisionCount: 0, truncated: false };
+    const missing = {
+      path,
+      exists: false,
+      fileCount: 0,
+      bytes: 0,
+      revisionCount: 0,
+      truncated: false
+    };
+    cache?.set(path, missing);
+    return missing;
   }
   const stats = collectDirectoryStats(path);
   let revisionCount = 0;
   try {
-    revisionCount = readdirSync7(path, { withFileTypes: true }).filter((entry) => entry.isDirectory()).length;
+    revisionCount = readdirSync7(path, { withFileTypes: true }).filter(
+      (entry) => entry.isDirectory()
+    ).length;
   } catch {
     revisionCount = 0;
   }
-  return { path, exists: true, fileCount: stats.fileCount, bytes: stats.bytes, revisionCount, truncated: stats.truncated };
+  const evidence = {
+    path,
+    exists: true,
+    fileCount: stats.fileCount,
+    bytes: stats.bytes,
+    revisionCount,
+    truncated: stats.truncated
+  };
+  cache?.set(path, evidence);
+  return evidence;
 }
 function collectDirectoryStats(root) {
   let fileCount = 0;
@@ -3399,7 +3445,7 @@ function validateTechnologyGovernance(value, issues) {
     issues.push({ type: "invalid-field", field: "technologyGovernance", message: "Portfolio technologyGovernance must be an object." });
     return { technologies, projectTypes };
   }
-  validateAllowedFields(value, "technologyGovernance", ["strategySource", "versionPolicy", "technologies", "projectTypes"], issues);
+  validateAllowedFields(value, "technologyGovernance", ["strategySource", "versionPolicy", "exclusiveOwnership", "technologies", "projectTypes"], issues);
   if (value.strategySource !== void 0 && (typeof value.strategySource !== "string" || value.strategySource.length === 0)) {
     issues.push({ type: "invalid-field", field: "technologyGovernance.strategySource", message: "Technology strategySource must be a non-empty string." });
   }
@@ -3462,9 +3508,65 @@ function validateTechnologyGovernance(value, issues) {
       if (!technologies.has(technology)) issues.push({ type: "invalid-field", field: "technologyGovernance.projectTypes", message: `Project type ${projectType.id} references unknown technology: ${technology}` });
     }
   }
+  validateExclusiveOwnership(value.exclusiveOwnership, projectTypes, issues);
   validateVersionPolicy(value.versionPolicy, projectTypes, issues);
   return { technologies, projectTypes };
 }
+function validateExclusiveOwnership(value, projectTypes, issues) {
+  if (value === void 0) return;
+  const field = "technologyGovernance.exclusiveOwnership";
+  if (!Array.isArray(value)) {
+    issues.push({ type: "invalid-field", field, message: "Technology exclusiveOwnership must be an array." });
+    return;
+  }
+  const seenIds = /* @__PURE__ */ new Set();
+  for (const rule of value) {
+    if (!isRecord(rule)) {
+      issues.push({ type: "invalid-field", field, message: "Exclusive ownership rule must be an object." });
+      continue;
+    }
+    validateAllowedFields(rule, "exclusiveOwnership", ["id", "label", "allowedProjectTypes", "paths"], issues);
+    const id = typeof rule.id === "string" ? rule.id : "";
+    if (!id || seenIds.has(id)) {
+      issues.push({ type: "invalid-field", field: `${field}.id`, message: `Exclusive ownership rule id must be non-empty and unique: ${String(rule.id)}` });
+    } else {
+      seenIds.add(id);
+    }
+    if (typeof rule.label !== "string" || rule.label.trim().length === 0) {
+      issues.push({ type: "invalid-field", field: `${field}.label`, message: "Exclusive ownership rule label must be a non-empty string." });
+    }
+    validateOptionalStringArray(rule.allowedProjectTypes, id, `${field}.allowedProjectTypes`, issues);
+    if (!Array.isArray(rule.allowedProjectTypes) || rule.allowedProjectTypes.length === 0) {
+      issues.push({ type: "invalid-field", field: `${field}.allowedProjectTypes`, message: "Exclusive ownership rule must allow at least one project type." });
+    } else {
+      for (const projectType of rule.allowedProjectTypes) {
+        if (typeof projectType === "string" && !projectTypes.has(projectType)) {
+          issues.push({ type: "invalid-field", field: `${field}.allowedProjectTypes`, message: `Exclusive ownership rule references unknown project type: ${projectType}` });
+        }
+      }
+    }
+    validateOptionalStringArray(rule.paths, id, `${field}.paths`, issues);
+    if (!Array.isArray(rule.paths) || rule.paths.length === 0) {
+      issues.push({ type: "invalid-field", field: `${field}.paths`, message: "Exclusive ownership rule must declare at least one repository-relative path." });
+    } else {
+      const seenPaths = /* @__PURE__ */ new Set();
+      for (const path of rule.paths) {
+        if (typeof path !== "string") continue;
+        if (!isExactRepositoryRelativePath(path)) {
+          issues.push({
+            type: "invalid-field",
+            field: `${field}.paths`,
+            message: `Exclusive ownership path must be an exact repository-relative path: ${path}`
+          });
+        } else if (seenPaths.has(path)) {
+          issues.push({ type: "invalid-field", field: `${field}.paths`, message: `Duplicate exclusive ownership path: ${path}` });
+        } else {
+          seenPaths.add(path);
+        }
+      }
+    }
+  }
+}
 function validateVersionPolicy(value, projectTypes, issues) {
   if (value === void 0) return;
   if (!isRecord(value)) {
@@ -3735,7 +3837,7 @@ import { spawnSync as spawnSync6 } from "node:child_process";
 import { existsSync as existsSync22, readFileSync as readFileSync16 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname12, join as join23 } from "node:path";
+import { dirname as dirname13, join as join23 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/host-tooling/inventory.ts
@@ -3909,26 +4011,50 @@ function pathIsSymlink(path) {
 
 // src/portfolio/version-policy.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync21, readFileSync as readFileSync15 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync21, readFileSync as readFileSync15, readdirSync as readdirSync9 } from "node:fs";
+import { dirname as dirname12, join as join22 } from "node:path";
 function inspectVersionPolicy(root, policy, projectType) {
   if (!policy) return { status: "compliant", packages: [], runtimes: [], attentionCount: 0 };
-  const packageJson = readJson2(join22(root, "package.json"));
+  const packageManifests = collectPackageManifests(root);
+  const packageJson = packageManifests.find(
+    (manifest) => manifest.path === "package.json"
+  )?.packageJson;
   const packageManager = policy.packageManager ? inspectPackageManager(packageJson, policy.packageManager.name, policy.packageManager.version) : void 0;
   const runtime = policy.runtime ? inspectRuntime(policy.runtime.name, policy.runtime.version) : void 0;
   const runtimes = (policy.runtimes ?? []).map((requirement) => {
     if (requirement.appliesTo && (!projectType || !requirement.appliesTo.includes(projectType))) {
-      return { name: requirement.name, expected: requirement.version, status: "not-applicable" };
+      return {
+        name: requirement.name,
+        expected: requirement.version,
+        status: "not-applicable"
+      };
     }
     return inspectRuntime(requirement.name, requirement.version);
   });
   const packages = policy.packages.map((requirement) => {
     if (requirement.appliesTo && (!projectType || !requirement.appliesTo.includes(projectType))) {
-      return { name: requirement.name, expected: requirement.version, status: "not-applicable" };
+      return {
+        name: requirement.name,
+        expected: requirement.version,
+        status: "not-applicable"
+      };
     }
-    const declared = findDeclaredVersion(packageJson, requirement.name);
-    const installed = readInstalledVersion(root, requirement.name);
-    const status = declared === void 0 ? requirement.appliesTo ? "missing" : "not-applicable" : declared !== requirement.version ? "drift" : installed !== requirement.version ? installed === void 0 ? "missing" : "drift" : "compliant";
+    const declarations = packageManifests.map((manifest) => ({
+      manifest,
+      declared: findDeclaredVersion(manifest.packageJson, requirement.name)
+    })).filter(
+      (item) => item.declared !== void 0
+    );
+    const declaredValues = unique(declarations.map((item) => item.declared));
+    const installedValues = unique(
+      declarations.map((item) => readInstalledVersion(root, requirement.name, item.manifest.directory)).filter((value) => value !== void 0)
+    );
+    const hasMissingInstall = declarations.some(
+      (item) => readInstalledVersion(root, requirement.name, item.manifest.directory) === void 0
+    );
+    const declared = declaredValues.length ? declaredValues.join(" \xB7 ") : void 0;
+    const installed = installedValues.length ? installedValues.join(" \xB7 ") : void 0;
+    const status = declarations.length === 0 ? requirement.appliesTo ? "missing" : "not-applicable" : declarations.some((item) => item.declared !== requirement.version) ? "drift" : hasMissingInstall ? "missing" : installedValues.some((value) => value !== requirement.version) ? "drift" : "compliant";
     return {
       name: requirement.name,
       expected: requirement.version,
@@ -3938,8 +4064,12 @@ function inspectVersionPolicy(root, policy, projectType) {
       status
     };
   });
-  const all = [packageManager, runtime, ...runtimes, ...packages].filter((item) => item !== void 0);
-  const attentionCount = all.filter((item) => item.status !== "compliant" && item.status !== "not-applicable").length;
+  const all = [packageManager, runtime, ...runtimes, ...packages].filter(
+    (item) => item !== void 0
+  );
+  const attentionCount = all.filter(
+    (item) => item.status !== "compliant" && item.status !== "not-applicable"
+  ).length;
   return {
     status: attentionCount === 0 ? "compliant" : "attention",
     packageManager,
@@ -3977,15 +4107,81 @@ function readRuntimeVersion(name) {
   return /^deno\s+(\d+\.\d+\.\d+)/m.exec(result.stdout)?.[1];
 }
 function findDeclaredVersion(packageJson, name) {
-  for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+  for (const section of [
+    "dependencies",
+    "devDependencies",
+    "peerDependencies",
+    "optionalDependencies"
+  ]) {
     const value = packageJson?.[section]?.[name];
     if (typeof value === "string") return value;
   }
   return void 0;
 }
-function readInstalledVersion(root, name) {
-  const packageJson = readJson2(join22(root, "node_modules", name, "package.json"));
-  return typeof packageJson?.version === "string" ? packageJson.version : void 0;
+function readInstalledVersion(root, name, fromDirectory = root) {
+  let current = fromDirectory;
+  while (true) {
+    const packageJson = readJson2(join22(current, "node_modules", name, "package.json"));
+    if (typeof packageJson?.version === "string") return packageJson.version;
+    if (current === root) return void 0;
+    const parent = dirname12(current);
+    if (parent === current) return void 0;
+    current = parent;
+  }
+}
+function collectPackageManifests(root) {
+  const manifests = [];
+  const ignored = /* @__PURE__ */ new Set([
+    ".git",
+    ".next",
+    ".nuxt",
+    ".output",
+    ".pnpm",
+    ".turbo",
+    ".vercel",
+    ".worktrees",
+    "build",
+    "coverage",
+    "dist",
+    "examples",
+    "fixtures",
+    "node_modules",
+    "out",
+    "target",
+    "templates",
+    "tmp",
+    ".cache",
+    ".pnpm-store",
+    ".tmp-repos"
+  ]);
+  const visit = (directory, depth) => {
+    if (depth > 6) return;
+    let entries;
+    try {
+      entries = readdirSync9(directory, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const path = join22(directory, entry.name);
+      if (entry.isFile() && entry.name === "package.json") {
+        const packageJson = readJson2(path);
+        if (packageJson)
+          manifests.push({
+            path: path.slice(root.length + 1) || "package.json",
+            directory,
+            packageJson
+          });
+      } else if (entry.isDirectory() && !ignored.has(entry.name)) {
+        visit(path, depth + 1);
+      }
+    }
+  };
+  visit(root, 0);
+  return manifests.sort((a, b) => a.path.localeCompare(b.path));
+}
+function unique(values) {
+  return [...new Set(values)];
 }
 function readJson2(path) {
   if (!existsSync21(path)) return void 0;
@@ -4157,11 +4353,11 @@ function getExpectedPackageVersions() {
   };
 }
 function findOwnPackageJson() {
-  let current = dirname12(fileURLToPath3(import.meta.url));
+  let current = dirname13(fileURLToPath3(import.meta.url));
   for (let depth = 0; depth < 5; depth += 1) {
     const candidate = join23(current, "package.json");
     if (existsSync22(candidate)) return candidate;
-    current = dirname12(current);
+    current = dirname13(current);
   }
   return "";
 }
@@ -4191,40 +4387,64 @@ import {
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync8,
   readFileSync as readFileSync17,
-  readdirSync as readdirSync9,
+  readdirSync as readdirSync10,
   realpathSync as realpathSync4,
   statSync as statSync5,
   writeFileSync as writeFileSync7
 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname13, join as join24, relative as relative8, resolve as resolve5, sep } from "node:path";
+import { dirname as dirname14, join as join24, relative as relative8, resolve as resolve5, sep } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var CURRENT_ROUTER_VERSION = "1.1";
+var MCP_DISCOVERY_PATHS = {
+  project: {
+    codex: ".codex/config.toml",
+    claudeCodeShared: ".mcp.json",
+    grok: ".grok/config.toml"
+  },
+  user: {
+    codex: ".codex/config.toml",
+    claudeCode: ".claude.json",
+    grok: ".grok/config.toml"
+  }
+};
 function inspectPortfolioAiHealth(options) {
   const allEndpoints = collectEndpoints(options.manifest);
   const endpoints = options.targetId && options.targetId !== "all" ? allEndpoints.filter(({ endpoint }) => endpoint.id === options.targetId) : allEndpoints;
   if (options.targetId && options.targetId !== "all" && endpoints.length === 0) {
     throw new Error(`Unknown portfolio target: ${options.targetId}`);
   }
-  const secretsRoot = options.secretsRoot ?? join24(dirname13(options.manifest.controlPlane?.path ?? allEndpoints[0]?.endpoint.path ?? process.cwd()), ".secrets");
+  const secretsRoot = options.secretsRoot ?? join24(
+    dirname14(
+      options.manifest.controlPlane?.path ?? allEndpoints[0]?.endpoint.path ?? process.cwd()
+    ),
+    ".secrets"
+  );
   const homeDir = options.homeDir ?? process.env.HOME ?? homedir4();
   const grokVersion = commandVersion("grok");
   const executionEngineRoot = options.manifest.executionEngine?.path;
   const skillRegistry = inspectSkillRegistry(executionEngineRoot);
-  const expectedPackageVersion = packageVersion(join24(executionEngineRoot ?? "", "packages/pro-gov/package.json"));
-  const repositories = endpoints.map(({ endpoint, role }) => inspectRepository(
-    endpoint,
-    role,
-    secretsRoot,
-    homeDir,
-    expectedPackageVersion,
-    options.manifest.technologyGovernance,
-    grokVersion
-  ));
+  const userSkills = inspectUserSkillEvidence(join24(homeDir, ".agents/skills"));
+  const expectedPackageVersion = packageVersion(
+    join24(executionEngineRoot ?? "", "packages/pro-gov/package.json")
+  );
+  const repositories = endpoints.map(
+    ({ endpoint, role }) => inspectRepository(
+      endpoint,
+      role,
+      secretsRoot,
+      homeDir,
+      expectedPackageVersion,
+      options.manifest.technologyGovernance,
+      grokVersion,
+      skillRegistry.skills,
+      userSkills
+    )
+  );
   const summary = { healthy: 0, attention: 0, unhealthy: 0 };
   for (const repository of repositories) summary[repository.status] += 1;
   return {
-    schemaVersion: 5,
+    schemaVersion: 6,
     portfolioId: options.manifest.portfolioId,
     generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     coverage: {
@@ -4241,10 +4461,12 @@ function inspectPortfolioAiHealth(options) {
       allEndpoints.map(({ endpoint }) => endpoint.path),
       options.manifest.specialistChecks?.devspace
     ),
-    skillRegistry,
+    skillRegistry: skillRegistry.health,
     technologyGovernance: {
       strategySource: options.manifest.technologyGovernance?.strategySource,
       versionPolicy: options.manifest.technologyGovernance?.versionPolicy,
+      catalog: options.manifest.technologyGovernance?.technologies ?? [],
+      matrix: buildTechnologyMatrix(options.manifest.technologyGovernance, repositories),
       projectTypes: options.manifest.technologyGovernance?.projectTypes.length ?? 0,
       technologies: options.manifest.technologyGovernance?.technologies.length ?? 0
     },
@@ -4254,7 +4476,8 @@ function inspectPortfolioAiHealth(options) {
 }
 function mergePortfolioAiHealthReport(existing, latest, allRepositoryIds) {
   const repositoriesById = /* @__PURE__ */ new Map();
-  for (const repository of existing?.repositories ?? []) repositoriesById.set(repository.id, repository);
+  for (const repository of existing?.repositories ?? [])
+    repositoriesById.set(repository.id, repository);
   for (const repository of latest.repositories) repositoriesById.set(repository.id, repository);
   const repositories = allRepositoryIds.map((id) => repositoriesById.get(id)).filter((repository) => repository !== void 0);
   const coveredIds = /* @__PURE__ */ new Set([
@@ -4265,8 +4488,20 @@ function mergePortfolioAiHealthReport(existing, latest, allRepositoryIds) {
   const summary = { healthy: 0, attention: 0, unhealthy: 0 };
   for (const repository of repositories) summary[repository.status] += 1;
   const complete = coveredRepositoryIds.length === allRepositoryIds.length;
+  const technologyGovernance = (latest.technologyGovernance.catalog?.length ?? 0) > 0 ? {
+    ...latest.technologyGovernance,
+    matrix: buildTechnologyMatrix(
+      {
+        technologies: latest.technologyGovernance.catalog,
+        projectTypes: [],
+        versionPolicy: latest.technologyGovernance.versionPolicy
+      },
+      repositories
+    )
+  } : latest.technologyGovernance;
   return {
     ...latest,
+    technologyGovernance,
     repositories,
     summary,
     coverage: {
@@ -4289,14 +4524,19 @@ function writePortfolioAiHealthReport(report, outDir) {
   const htmlPath = join24(outDir, "index.html");
   writeFileSync7(jsonPath, `${JSON.stringify(report, null, 2)}
 `);
-  writeFileSync7(join24(outDir, "data.js"), `window.__PORTFOLIO_AI_HEALTH__ = ${safeJavaScriptJson(report)};
-`);
+  writeFileSync7(
+    join24(outDir, "data.js"),
+    `window.__PORTFOLIO_AI_HEALTH__ = ${safeJavaScriptJson(report)};
+`
+  );
   return { jsonPath, htmlPath };
 }
 function collectEndpoints(manifest) {
   const result = [];
-  if (manifest.controlPlane) result.push({ endpoint: manifest.controlPlane, role: "control-plane" });
-  if (manifest.executionEngine) result.push({ endpoint: manifest.executionEngine, role: "execution-engine" });
+  if (manifest.controlPlane)
+    result.push({ endpoint: manifest.controlPlane, role: "control-plane" });
+  if (manifest.executionEngine)
+    result.push({ endpoint: manifest.executionEngine, role: "execution-engine" });
   for (const target of manifest.targets) result.push({ endpoint: target, role: "target" });
   const seen = /* @__PURE__ */ new Set();
   return result.filter(({ endpoint }) => {
@@ -4306,73 +4546,214 @@ function collectEndpoints(manifest) {
     return true;
   });
 }
-function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackageVersion, technologyGovernance, grokVersion) {
+function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackageVersion, technologyGovernance, grokVersion, registeredSkills, userSkills) {
   const root = endpoint.path;
   const git = inspectGit2(root);
   const entries = inspectEntries(root);
   const grokInspection = inspectGrokProject(root, homeDir, grokVersion);
-  const skills = inspectSkills(root, grokInspection);
+  const skills = inspectSkills(root, grokInspection, registeredSkills, userSkills);
   const hostSsot = inspectProjectHostSsot(root);
   const hooks = inspectHooks(root);
   const docs = inspectDocs(root, role === "execution-engine" ? void 0 : expectedPackageVersion);
   const mcp = {
-    codexProject: tomlMcpNames(join24(root, ".codex/config.toml")),
-    claudeCodeProjectShared: jsonObjectKeys(join24(root, ".mcp.json"), "mcpServers"),
+    codexProject: tomlMcpNames(join24(root, MCP_DISCOVERY_PATHS.project.codex)),
+    claudeCodeProjectShared: jsonObjectKeys(
+      join24(root, MCP_DISCOVERY_PATHS.project.claudeCodeShared),
+      "mcpServers"
+    ),
     claudeCodeProjectLocal: claudeProjectLocalMcpNames(homeDir, root),
-    grokProject: tomlMcpNames(join24(root, ".grok/config.toml")),
+    grokProject: tomlMcpNames(join24(root, MCP_DISCOVERY_PATHS.project.grok)),
     grokEffective: grokInspection.effectiveMcp,
     grokInspection: grokInspection.inspection
   };
-  const secrets = inspectRepositorySecrets(root, endpoint.id, secretsRoot, git.isRepository, endpoint.environmentPolicy);
+  const secrets = inspectRepositorySecrets(
+    root,
+    endpoint.id,
+    secretsRoot,
+    git.isRepository,
+    endpoint.environmentPolicy
+  );
   const projectModel = inspectProjectModel(root, endpoint, technologyGovernance);
-  const versions = inspectVersionPolicy(root, technologyGovernance?.versionPolicy, endpoint.projectType);
+  const exclusiveOwnershipViolations = inspectExclusiveOwnership(
+    root,
+    endpoint,
+    technologyGovernance
+  );
+  const versions = inspectVersionPolicy(
+    root,
+    technologyGovernance?.versionPolicy,
+    endpoint.projectType
+  );
   const verification = inspectProjectVerification(root);
-  const redundancy = inspectProjectRedundancy(root, { homeDir });
+  const redundancy = inspectProjectRedundancy(root, {
+    homeDir,
+    includePlaywrightCaches: false
+  });
   const recommendations = [];
   if (!git.isRepository) recommendations.push("\u8BE5\u8DEF\u5F84\u4E0D\u662F Git \u4ED3\u5E93\uFF1B\u786E\u8BA4\u6E05\u5355\u8DEF\u5F84\u662F\u5426\u6B63\u786E\u3002");
-  if (git.unmergedBranches.length > 0) recommendations.push(`\u6709 ${git.unmergedBranches.length} \u6761\u5206\u652F\u5C1A\u672A\u5408\u5165\u5F53\u524D HEAD\uFF1A${git.unmergedBranches.join(", ")}\u3002`);
-  else if (git.branches.length > 1) recommendations.push(`\u6709 ${git.branches.length} \u6761\u672C\u5730\u5206\u652F\uFF0C\u5747\u5DF2\u5408\u5165\u5F53\u524D HEAD\uFF1B\u786E\u8BA4\u65E0\u5176\u4ED6\u5BBF\u4E3B\u5360\u7528\u540E\u53EF\u6E05\u7406\u989D\u5916\u5206\u652F\u3002`);
-  if (git.worktrees.length > 1) recommendations.push(`\u6709 ${git.worktrees.length} \u4E2A worktree\uFF1B\u5B8C\u6210\u5E76\u5408\u5E76\u540E\u518D\u62C6\u9664\u4E34\u65F6 worktree\u3002`);
-  if (git.dirtyPaths.length > 0) recommendations.push(`\u5DE5\u4F5C\u533A\u6709 ${git.dirtyPaths.length} \u4E2A\u53D8\u66F4\u8DEF\u5F84\uFF1B\u5148\u786E\u8BA4\u5F52\u5C5E\uFF0C\u4E0D\u8981\u7531\u5065\u5EB7\u626B\u63CF\u5668\u81EA\u52A8\u6E05\u7406\u3002`);
-  if ((git.ahead ?? 0) > 0) recommendations.push(`\u5F53\u524D\u5206\u652F\u9886\u5148\u4E0A\u6E38 ${git.ahead} \u4E2A\u63D0\u4EA4\uFF1B\u786E\u8BA4\u5DE5\u4F5C\u5B8C\u6210\u540E\u518D\u63A8\u9001\u3002`);
+  if (git.unmergedBranches.length > 0)
+    recommendations.push(
+      `\u6709 ${git.unmergedBranches.length} \u6761\u5206\u652F\u5C1A\u672A\u5408\u5165\u5F53\u524D HEAD\uFF1A${git.unmergedBranches.join(", ")}\u3002`
+    );
+  else if (git.branches.length > 1)
+    recommendations.push(
+      `\u6709 ${git.branches.length} \u6761\u672C\u5730\u5206\u652F\uFF0C\u5747\u5DF2\u5408\u5165\u5F53\u524D HEAD\uFF1B\u786E\u8BA4\u65E0\u5176\u4ED6\u5BBF\u4E3B\u5360\u7528\u540E\u53EF\u6E05\u7406\u989D\u5916\u5206\u652F\u3002`
+    );
+  if (git.worktrees.length > 1)
+    recommendations.push(
+      `\u6709 ${git.worktrees.length} \u4E2A worktree\uFF1B\u5B8C\u6210\u5E76\u5408\u5E76\u540E\u518D\u62C6\u9664\u4E34\u65F6 worktree\u3002`
+    );
+  if (git.dirtyPaths.length > 0)
+    recommendations.push(
+      `\u5DE5\u4F5C\u533A\u6709 ${git.dirtyPaths.length} \u4E2A\u53D8\u66F4\u8DEF\u5F84\uFF1B\u5148\u786E\u8BA4\u5F52\u5C5E\uFF0C\u4E0D\u8981\u7531\u5065\u5EB7\u626B\u63CF\u5668\u81EA\u52A8\u6E05\u7406\u3002`
+    );
+  if ((git.ahead ?? 0) > 0)
+    recommendations.push(`\u5F53\u524D\u5206\u652F\u9886\u5148\u4E0A\u6E38 ${git.ahead} \u4E2A\u63D0\u4EA4\uFF1B\u786E\u8BA4\u5DE5\u4F5C\u5B8C\u6210\u540E\u518D\u63A8\u9001\u3002`);
   if (entries.agents === "missing") recommendations.push("\u7F3A\u5C11 AGENTS.md\uFF1B\u65E0\u6CD5\u53D1\u73B0\u9879\u76EE\u5165\u53E3\u89C4\u5219\u3002");
-  if (entries.agents === "custom") recommendations.push("AGENTS.md \u672A\u8BC6\u522B\u5230 PGS Router \u6807\u8BB0\uFF1B\u68C0\u67E5\u662F\u5426\u5C1A\u672A\u540C\u6B65\u6216\u5DF2\u88AB\u9879\u76EE\u5185\u5BB9\u8986\u76D6\u3002");
-  if (entries.claude === "missing") recommendations.push("\u7F3A\u5C11 CLAUDE.md\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 AGENTS.md\uFF0C\u907F\u514D\u4E24\u4EFD\u5165\u53E3\u6F02\u79FB\u3002");
-  if (entries.claude === "thin-adapter") recommendations.push("CLAUDE.md \u662F\u517C\u5BB9\u9002\u914D\u5668\uFF1B\u53EF\u6539\u4E3A\u76F4\u63A5\u94FE\u63A5 AGENTS.md \u4EE5\u8FDB\u4E00\u6B65\u51CF\u5C11\u7EF4\u62A4\u9762\u3002");
-  if (entries.claude === "custom") recommendations.push("CLAUDE.md \u662F\u72EC\u7ACB\u5165\u53E3\uFF1B\u5BB9\u6613\u4E0E AGENTS.md \u6F02\u79FB\uFF0C\u5EFA\u8BAE\u53EA\u4FDD\u7559\u9879\u76EE\u786E\u9700\u7684\u5BBF\u4E3B\u5DEE\u5F02\u3002");
-  if (entries.claude === "dangling-symlink") recommendations.push("CLAUDE.md \u662F\u65AD\u5F00\u7684\u94FE\u63A5\uFF1B\u9700\u8981\u91CD\u65B0\u6307\u5411 AGENTS.md\u3002");
-  if (entries.gemini === "custom") recommendations.push("GEMINI.md \u662F\u72EC\u7ACB\u5165\u53E3\uFF1B\u82E5\u6CA1\u6709 Gemini \u4E13\u5C5E\u5DEE\u5F02\uFF0C\u5EFA\u8BAE\u94FE\u63A5\u5230 AGENTS.md\u3002");
-  if (entries.gemini === "dangling-symlink") recommendations.push("GEMINI.md \u662F\u65AD\u5F00\u7684\u94FE\u63A5\uFF1B\u9700\u8981\u91CD\u65B0\u6307\u5411 AGENTS.md\u3002");
-  if (skills.canonical.some((skill) => skill.kind === "dangling-symlink")) recommendations.push("`.agents/skills` \u4E2D\u5B58\u5728\u65AD\u5F00\u7684\u6280\u80FD\u94FE\u63A5\u3002");
-  if (skills.claudeCompatibility === "duplicate-directory") recommendations.push("`.claude/skills` \u662F\u72EC\u7ACB\u526F\u672C\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 `.agents/skills`\uFF0C\u907F\u514D\u53CC\u4EFD\u6280\u80FD\u6F02\u79FB\u3002");
-  if (skills.claudeCompatibility === "dangling-symlink") recommendations.push("`.claude/skills` \u662F\u65AD\u5F00\u7684\u94FE\u63A5\u3002");
-  if (!hostSsot.claudeEntry.compliant) recommendations.push(`CLAUDE.md \u4E0D\u662F\u89C4\u8303\u7684\u76F8\u5BF9\u94FE\u63A5 AGENTS.md\uFF08${hostSsot.claudeEntry.status}\uFF09\u3002`);
-  if (!hostSsot.claudeSkills.compliant) recommendations.push(`.claude/skills \u4E0D\u662F\u89C4\u8303\u7684\u76F8\u5BF9\u94FE\u63A5 ../.agents/skills\uFF08${hostSsot.claudeSkills.status}\uFF09\u3002`);
-  if (hostSsot.canonicalSkills.status !== "directory") recommendations.push(`\u7F3A\u5C11\u89C4\u8303\u7684 .agents/skills \u6280\u80FD\u76EE\u5F55\uFF08${hostSsot.canonicalSkills.status}\uFF09\u3002`);
-  if (hasWorkflowReminderHooks(hooks)) recommendations.push("\u53D1\u73B0 Stop/SubagentStop hook\uFF1B\u786E\u8BA4\u5B83\u662F\u5426\u4ECD\u6709\u9879\u76EE\u4E13\u5C5E\u7528\u9014\uFF0C\u5E76\u79FB\u9664\u9000\u4F11\u7684 PGS \u5DE5\u4F5C\u6D41\u63D0\u9192\u3002");
+  if (entries.agents === "custom")
+    recommendations.push(
+      "AGENTS.md \u672A\u8BC6\u522B\u5230 PGS Router \u6807\u8BB0\uFF1B\u68C0\u67E5\u662F\u5426\u5C1A\u672A\u540C\u6B65\u6216\u5DF2\u88AB\u9879\u76EE\u5185\u5BB9\u8986\u76D6\u3002"
+    );
+  if (entries.claude === "missing")
+    recommendations.push("\u7F3A\u5C11 CLAUDE.md\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 AGENTS.md\uFF0C\u907F\u514D\u4E24\u4EFD\u5165\u53E3\u6F02\u79FB\u3002");
+  if (entries.claude === "thin-adapter")
+    recommendations.push("CLAUDE.md \u662F\u517C\u5BB9\u9002\u914D\u5668\uFF1B\u53EF\u6539\u4E3A\u76F4\u63A5\u94FE\u63A5 AGENTS.md \u4EE5\u8FDB\u4E00\u6B65\u51CF\u5C11\u7EF4\u62A4\u9762\u3002");
+  if (entries.claude === "custom")
+    recommendations.push(
+      "CLAUDE.md \u662F\u72EC\u7ACB\u5165\u53E3\uFF1B\u5BB9\u6613\u4E0E AGENTS.md \u6F02\u79FB\uFF0C\u5EFA\u8BAE\u53EA\u4FDD\u7559\u9879\u76EE\u786E\u9700\u7684\u5BBF\u4E3B\u5DEE\u5F02\u3002"
+    );
+  if (entries.claude === "dangling-symlink")
+    recommendations.push("CLAUDE.md \u662F\u65AD\u5F00\u7684\u94FE\u63A5\uFF1B\u9700\u8981\u91CD\u65B0\u6307\u5411 AGENTS.md\u3002");
+  if (entries.gemini === "custom")
+    recommendations.push("GEMINI.md \u662F\u72EC\u7ACB\u5165\u53E3\uFF1B\u82E5\u6CA1\u6709 Gemini \u4E13\u5C5E\u5DEE\u5F02\uFF0C\u5EFA\u8BAE\u94FE\u63A5\u5230 AGENTS.md\u3002");
+  if (entries.gemini === "dangling-symlink")
+    recommendations.push("GEMINI.md \u662F\u65AD\u5F00\u7684\u94FE\u63A5\uFF1B\u9700\u8981\u91CD\u65B0\u6307\u5411 AGENTS.md\u3002");
+  if ([...skills.automatic, ...skills.manual].some((skill) => skill.kind === "dangling-symlink"))
+    recommendations.push("`.agents/skills` \u6216 `.agents/manual-skills` \u4E2D\u5B58\u5728\u65AD\u5F00\u7684\u6280\u80FD\u94FE\u63A5\u3002");
+  if (skills.invalidEntries.length > 0)
+    recommendations.push(
+      `\u6280\u80FD\u76EE\u5F55\u4E2D\u6709 ${skills.invalidEntries.length} \u4E2A\u5783\u573E\u6216\u975E\u6280\u80FD\u6587\u4EF6\uFF1A${skills.invalidEntries.map((entry) => entry.path).join("\u3001")}\u3002`
+    );
+  if (skills.userDuplicates.length > 0)
+    recommendations.push(
+      `\u9879\u76EE\u6280\u80FD\u4E0E\u7528\u6237\u7EA7\u6280\u80FD\u91CD\u590D\uFF1A${skills.userDuplicates.join("\u3001")}\uFF1B\u4F18\u5148\u4FDD\u7559\u7528\u6237\u7EA7\u5355\u4E00\u5165\u53E3\u3002`
+    );
+  if (skills.crossPlacementDuplicates.length > 0)
+    recommendations.push(
+      `\u540C\u540D\u6280\u80FD\u540C\u65F6\u51FA\u73B0\u5728 auto \u4E0E manual\uFF1A${skills.crossPlacementDuplicates.join("\u3001")}\uFF1B\u53EA\u80FD\u4FDD\u7559\u4E00\u4E2A\u671F\u671B\u4F4D\u7F6E\u3002`
+    );
+  if (skills.placementDrift.length > 0)
+    recommendations.push(
+      `\u6709 ${skills.placementDrift.length} \u4E2A\u6280\u80FD\u672A\u653E\u5728\u6CE8\u518C\u8868\u89C4\u5B9A\u7684\u4F4D\u7F6E\uFF1A${skills.placementDrift.map((item) => `${item.name} \u5E94\u4E3A ${item.reason === "scope" ? "\u7528\u6237\u7EA7" : `\u9879\u76EE ${item.expectedPlacement}`}`).join("\u3001")}\u3002`
+    );
+  if (skills.automatic.length > skills.automaticReviewThreshold)
+    recommendations.push(
+      `\u81EA\u52A8\u53D1\u73B0\u6280\u80FD\u6709 ${skills.automatic.length} \u4E2A\uFF0C\u8D85\u8FC7 ${skills.automaticReviewThreshold} \u4E2A\u590D\u6838\u7EBF\uFF1B\u9010\u9879\u786E\u8BA4\u662F\u5426\u9AD8\u9891\u4E14\u5141\u8BB8\u4E3B\u52A8\u89E6\u53D1\u3002`
+    );
+  if (skills.unregistered.length > 0)
+    recommendations.push(
+      `\u6709 ${skills.unregistered.length} \u4E2A\u6280\u80FD\u65E0\u6CD5\u6620\u5C04\u5230 PGS \u6CE8\u518C\u6E90\uFF1B\u786E\u8BA4\u5B83\u4EEC\u662F\u5408\u7406\u7684\u9879\u76EE\u672C\u5730\u6280\u80FD\u8FD8\u662F\u5F85\u767B\u8BB0\u8D44\u4EA7\u3002`
+    );
+  if (skills.claudeCompatibility === "duplicate-directory")
+    recommendations.push(
+      "`.claude/skills` \u662F\u72EC\u7ACB\u526F\u672C\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 `.agents/skills`\uFF0C\u907F\u514D\u53CC\u4EFD\u6280\u80FD\u6F02\u79FB\u3002"
+    );
+  if (skills.claudeCompatibility === "dangling-symlink")
+    recommendations.push("`.claude/skills` \u662F\u65AD\u5F00\u7684\u94FE\u63A5\u3002");
+  if (!hostSsot.claudeEntry.compliant)
+    recommendations.push(
+      `CLAUDE.md \u4E0D\u662F\u89C4\u8303\u7684\u76F8\u5BF9\u94FE\u63A5 AGENTS.md\uFF08${hostSsot.claudeEntry.status}\uFF09\u3002`
+    );
+  if (!hostSsot.claudeSkills.compliant)
+    recommendations.push(
+      `.claude/skills \u4E0D\u662F\u89C4\u8303\u7684\u76F8\u5BF9\u94FE\u63A5 ../.agents/skills\uFF08${hostSsot.claudeSkills.status}\uFF09\u3002`
+    );
+  if (hostSsot.canonicalSkills.status !== "directory")
+    recommendations.push(
+      `\u7F3A\u5C11\u89C4\u8303\u7684 .agents/skills \u6280\u80FD\u76EE\u5F55\uFF08${hostSsot.canonicalSkills.status}\uFF09\u3002`
+    );
+  if (hasWorkflowReminderHooks(hooks))
+    recommendations.push(
+      "\u53D1\u73B0 Stop/SubagentStop hook\uFF1B\u786E\u8BA4\u5B83\u662F\u5426\u4ECD\u6709\u9879\u76EE\u4E13\u5C5E\u7528\u9014\uFF0C\u5E76\u79FB\u9664\u9000\u4F11\u7684 PGS \u5DE5\u4F5C\u6D41\u63D0\u9192\u3002"
+    );
   const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
   const envNeedsCentralReview = liveEnv.filter((file) => !file.localOnly);
-  if (liveEnv.some((file) => file.tracked)) recommendations.push("\u53D1\u73B0\u88AB Git \u8DDF\u8E2A\u7684\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\uFF1B\u5E94\u7ACB\u5373\u786E\u8BA4\u5176\u4E2D\u662F\u5426\u5305\u542B\u51ED\u636E\u5E76\u8FC1\u51FA\u4ED3\u5E93\u3002");
-  if (envNeedsCentralReview.length > 0 && secrets.centralDirectory === "absent") recommendations.push("\u4ED3\u5E93\u6709\u672C\u5730\u73AF\u5883\u6587\u4EF6\uFF0C\u4F46\u4E2D\u592E `.secrets` \u4E2D\u6CA1\u6709\u5BF9\u5E94\u76EE\u5F55\uFF1B\u786E\u8BA4\u662F\u5426\u9700\u8981\u7EB3\u5165\u5206\u5C42\u7BA1\u7406\u3002");
-  else if (envNeedsCentralReview.some((file) => !file.centralized)) recommendations.push("\u53D1\u73B0\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\u5C1A\u672A\u8FDE\u63A5\u5230\u672C\u9879\u76EE\u7684\u4E2D\u592E `.secrets` \u76EE\u5F55\uFF1B\u533A\u5206\u53EF\u4E22\u5F03\u751F\u6210\u7269\u4E0E\u672C\u5730\u4E3B\u6765\u6E90\uFF0C\u9700\u4FDD\u7559\u7684\u6765\u6E90\u5E94\u96C6\u4E2D\u540E\u518D\u63A5\u56DE\u9879\u76EE\u3002");
-  if (hasUnsafeCentralSecretPermissions(secrets)) recommendations.push("\u4E2D\u592E\u5BC6\u94A5\u76EE\u5F55\u6216\u6587\u4EF6\u6743\u9650\u8FC7\u5BBD\uFF1B\u76EE\u5F55\u5E94\u4E3A 0700\uFF0C\u914D\u7F6E\u6587\u4EF6\u5E94\u4E3A 0600\u3002");
-  if (!docs.packages.aligned) recommendations.push(`PGS \u5305\u7248\u672C\u672A\u4E0E\u6267\u884C\u5F15\u64CE ${docs.packages.expected ?? "\u672A\u77E5\u7248\u672C"} \u5BF9\u9F50\uFF1B\u53D1\u5E03\u4E0A\u6E38\u540E\u518D\u540C\u6B65\u76EE\u6807\u4ED3\u5E93\u3002`);
-  if (!docs.routerAligned) recommendations.push(`PGS Router \u7248\u672C\u4E3A ${docs.routerVersion ? `v${docs.routerVersion}` : "\u672A\u8BC6\u522B"}\uFF0C\u5E94\u540C\u6B65\u5230 v${docs.expectedRouterVersion}\u3002`);
-  if (role === "target" && !docs.manifest) recommendations.push("\u7F3A\u5C11 docs/governance/MANIFEST.yml\uFF1B\u6587\u6863\u6E05\u5355\u65E0\u6CD5\u8BC1\u660E\u5DF2\u540C\u6B65\u3002");
-  if (technologyGovernance && !projectModel.projectType) recommendations.push("\u672A\u58F0\u660E\u9879\u76EE\u7C7B\u578B\uFF1B\u65E0\u6CD5\u628A\u5B9E\u9645\u6280\u672F\u4E0E\u4EA7\u54C1\u7EBF\u57FA\u7EBF\u8FDB\u884C\u6BD4\u8F83\u3002");
-  const missingBaseline = projectModel.baseline.filter((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
-  if (missingBaseline.length > 0) recommendations.push(`\u6280\u672F\u57FA\u7EBF\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingBaseline.map((technology) => technology.label).join("\u3001")}\u3002`);
-  const missingSelected = projectModel.optionalCapabilities.filter((technology) => technology.selected && !technology.detected);
-  if (missingSelected.length > 0) recommendations.push(`\u5DF2\u9009\u80FD\u529B\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingSelected.map((technology) => technology.label).join("\u3001")}\u3002`);
-  if (versions.status === "attention") recommendations.push(`\u6280\u672F\u7248\u672C\u7B56\u7565\u6709 ${versions.attentionCount} \u9879\u6F02\u79FB\u6216\u7F3A\u5931\uFF1B\u58F0\u660E\u7248\u672C\u4E0E\u5DF2\u5B89\u88C5\u7248\u672C\u5FC5\u987B\u7CBE\u786E\u5BF9\u9F50\u3002`);
-  if (verification.status === "attention") recommendations.push(`\u9A8C\u8BC1\u811A\u672C\u7F3A\u5931\uFF1A${verification.missing.join("\u3001")}\uFF1BPGS \u8981\u6C42 typecheck\u3001lint\u3001format:check\u3001verify \u53EF\u53D1\u73B0\u3002`);
-  if (redundancy.status === "attention") recommendations.push("\u53D1\u73B0\u65E7 AI \u76EE\u5F55\u6216\u5927\u578B Playwright \u7F13\u5B58\uFF1B\u4EC5\u63D0\u4F9B\u8BC1\u636E\uFF0C\u786E\u8BA4\u5F52\u5C5E\u540E\u518D\u7531\u4EBA\u5DE5\u6E05\u7406\u3002");
+  if (liveEnv.some((file) => file.tracked))
+    recommendations.push("\u53D1\u73B0\u88AB Git \u8DDF\u8E2A\u7684\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\uFF1B\u5E94\u7ACB\u5373\u786E\u8BA4\u5176\u4E2D\u662F\u5426\u5305\u542B\u51ED\u636E\u5E76\u8FC1\u51FA\u4ED3\u5E93\u3002");
+  if (envNeedsCentralReview.length > 0 && secrets.centralDirectory === "absent")
+    recommendations.push(
+      "\u4ED3\u5E93\u6709\u672C\u5730\u73AF\u5883\u6587\u4EF6\uFF0C\u4F46\u4E2D\u592E `.secrets` \u4E2D\u6CA1\u6709\u5BF9\u5E94\u76EE\u5F55\uFF1B\u786E\u8BA4\u662F\u5426\u9700\u8981\u7EB3\u5165\u5206\u5C42\u7BA1\u7406\u3002"
+    );
+  else if (envNeedsCentralReview.some((file) => !file.centralized))
+    recommendations.push(
+      "\u53D1\u73B0\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\u5C1A\u672A\u8FDE\u63A5\u5230\u672C\u9879\u76EE\u7684\u4E2D\u592E `.secrets` \u76EE\u5F55\uFF1B\u533A\u5206\u53EF\u4E22\u5F03\u751F\u6210\u7269\u4E0E\u672C\u5730\u4E3B\u6765\u6E90\uFF0C\u9700\u4FDD\u7559\u7684\u6765\u6E90\u5E94\u96C6\u4E2D\u540E\u518D\u63A5\u56DE\u9879\u76EE\u3002"
+    );
+  if (hasUnsafeCentralSecretPermissions(secrets))
+    recommendations.push("\u4E2D\u592E\u5BC6\u94A5\u76EE\u5F55\u6216\u6587\u4EF6\u6743\u9650\u8FC7\u5BBD\uFF1B\u76EE\u5F55\u5E94\u4E3A 0700\uFF0C\u914D\u7F6E\u6587\u4EF6\u5E94\u4E3A 0600\u3002");
+  if (!docs.packages.aligned)
+    recommendations.push(
+      `PGS \u5305\u7248\u672C\u672A\u4E0E\u6267\u884C\u5F15\u64CE ${docs.packages.expected ?? "\u672A\u77E5\u7248\u672C"} \u5BF9\u9F50\uFF1B\u53D1\u5E03\u4E0A\u6E38\u540E\u518D\u540C\u6B65\u76EE\u6807\u4ED3\u5E93\u3002`
+    );
+  if (!docs.routerAligned)
+    recommendations.push(
+      `PGS Router \u7248\u672C\u4E3A ${docs.routerVersion ? `v${docs.routerVersion}` : "\u672A\u8BC6\u522B"}\uFF0C\u5E94\u540C\u6B65\u5230 v${docs.expectedRouterVersion}\u3002`
+    );
+  if (role === "target" && !docs.manifest)
+    recommendations.push("\u7F3A\u5C11 docs/governance/MANIFEST.yml\uFF1B\u6587\u6863\u6E05\u5355\u65E0\u6CD5\u8BC1\u660E\u5DF2\u540C\u6B65\u3002");
+  if (technologyGovernance && !projectModel.projectType)
+    recommendations.push("\u672A\u58F0\u660E\u9879\u76EE\u7C7B\u578B\uFF1B\u65E0\u6CD5\u628A\u5B9E\u9645\u6280\u672F\u4E0E\u4EA7\u54C1\u7EBF\u57FA\u7EBF\u8FDB\u884C\u6BD4\u8F83\u3002");
+  for (const violation of exclusiveOwnershipViolations) {
+    recommendations.push(
+      `\u4ED3\u5E93\u8D8A\u754C\u62E5\u6709\u201C${violation.rule.label}\u201D\uFF1A${violation.paths.join("\u3001")}\uFF1B\u4EC5\u5141\u8BB8\u9879\u76EE\u7C7B\u578B ${violation.rule.allowedProjectTypes.join("\u3001")} \u6301\u6709\u3002`
+    );
+  }
+  const missingBaseline = projectModel.baseline.filter(
+    (technology) => !technology.detected && !hasBaselineException(projectModel, technology.id)
+  );
+  if (missingBaseline.length > 0)
+    recommendations.push(
+      `\u6280\u672F\u57FA\u7EBF\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingBaseline.map((technology) => technology.label).join("\u3001")}\u3002`
+    );
+  const missingSelected = projectModel.optionalCapabilities.filter(
+    (technology) => technology.selected && !technology.detected
+  );
+  if (missingSelected.length > 0)
+    recommendations.push(
+      `\u5DF2\u9009\u80FD\u529B\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingSelected.map((technology) => technology.label).join("\u3001")}\u3002`
+    );
+  if (versions.status === "attention")
+    recommendations.push(
+      `\u6280\u672F\u7248\u672C\u7B56\u7565\u6709 ${versions.attentionCount} \u9879\u6F02\u79FB\u6216\u7F3A\u5931\uFF1B\u58F0\u660E\u7248\u672C\u4E0E\u5DF2\u5B89\u88C5\u7248\u672C\u5FC5\u987B\u7CBE\u786E\u5BF9\u9F50\u3002`
+    );
+  if (verification.status === "attention")
+    recommendations.push(
+      `\u9A8C\u8BC1\u811A\u672C\u7F3A\u5931\uFF1A${verification.missing.join("\u3001")}\uFF1BPGS \u8981\u6C42 typecheck\u3001lint\u3001format:check\u3001verify \u53EF\u53D1\u73B0\u3002`
+    );
+  if (redundancy.status === "attention")
+    recommendations.push(
+      "\u53D1\u73B0\u9879\u76EE\u7EA7\u65E7 AI \u76EE\u5F55\uFF1B\u4EC5\u63D0\u4F9B\u8BC1\u636E\uFF0C\u4E0E .agents/skills \u7684 SSOT \u6BD4\u5BF9\u540E\u518D\u7531\u4EBA\u5DE5\u8FC1\u79FB\u6216\u6E05\u7406\u3002"
+    );
   return {
     id: endpoint.id,
     role,
     path: root,
     profile: "profile" in endpoint ? endpoint.profile : void 0,
-    status: deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, Boolean(technologyGovernance), versions, verification, redundancy),
+    status: deriveStatus(
+      role,
+      entries,
+      git,
+      hooks,
+      skills,
+      hostSsot,
+      secrets,
+      docs,
+      projectModel,
+      exclusiveOwnershipViolations,
+      Boolean(technologyGovernance),
+      versions,
+      verification,
+      redundancy
+    ),
     recommendations,
     git,
     entries,
@@ -4388,22 +4769,169 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
     redundancy
   };
 }
-function deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, technologyGovernanceConfigured, versions, verification, redundancy) {
-  if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || skills.canonical.some((item) => item.kind === "dangling-symlink") || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets)) return "unhealthy";
-  const missingBaseline = projectModel.baseline.some((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
-  const missingSelected = projectModel.optionalCapabilities.some((technology) => technology.selected && !technology.detected);
+function buildTechnologyMatrix(governance, repositories) {
+  if (!governance) return [];
+  const policy = governance.versionPolicy;
+  return governance.technologies.map((technology) => {
+    const projects = repositories.flatMap((repository) => {
+      const packageManifests = collectPackageManifests(repository.path);
+      const packageSignals = (technology.packages ?? []).map((name) => {
+        const requirement = policy?.packages.find((item) => item.name === name);
+        return packageManifests.map((manifest) => {
+          const declared = findDeclaredVersion(manifest.packageJson, name);
+          return declared === void 0 ? void 0 : {
+            name,
+            source: manifest.path,
+            declared,
+            installed: readInstalledVersion(repository.path, name, manifest.directory),
+            expected: requirement?.version
+          };
+        }).filter((item) => item !== void 0);
+      }).flat();
+      const fileSignal = (technology.files ?? []).some(
+        (path) => hasUsableTechnologyFile(join24(repository.path, path)) || packageManifests.some(
+          (manifest) => hasUsableTechnologyFile(join24(manifest.directory, path))
+        )
+      );
+      const modelSignal = [
+        ...repository.projectModel.baseline,
+        ...repository.projectModel.optionalCapabilities
+      ].find((item) => item.id === technology.id)?.detected ?? false;
+      const runtimeRequirement2 = policy?.runtimes?.find(
+        (item) => item.name === technology.id || technology.id === "deno-edge" && item.name === "deno"
+      );
+      const runtimeEvidence = runtimeRequirement2 ? repository.versions.runtimes.find((item) => item.name === runtimeRequirement2.name) : void 0;
+      const uses = modelSignal || fileSignal || packageSignals.length > 0;
+      if (!uses) return [];
+      const packageStatuses = packageSignals.map(
+        (item) => item.expected === void 0 ? "unversioned" : item.declared !== item.expected ? "drift" : item.installed === void 0 ? "unknown" : item.installed !== item.expected ? "drift" : "aligned"
+      );
+      const statuses = runtimeEvidence ? [
+        ...packageStatuses,
+        runtimeEvidence.status === "compliant" ? "aligned" : runtimeEvidence.status === "not-applicable" ? "unknown" : "drift"
+      ] : packageStatuses;
+      const status2 = statuses.includes("drift") ? "drift" : statuses.includes("unversioned") ? "unversioned" : statuses.includes("unknown") || statuses.length === 0 ? "unknown" : "aligned";
+      const values = {
+        sources: [...new Set(packageSignals.map((item) => item.source))],
+        packages: [...new Set(packageSignals.map((item) => item.name))],
+        declared: [
+          ...new Set(
+            packageSignals.flatMap(
+              (item) => item.declared ? [`${item.name}@${item.declared}`] : []
+            )
+          )
+        ],
+        installed: [
+          ...new Set(
+            packageSignals.flatMap(
+              (item) => item.installed ? [`${item.name}@${item.installed}`] : []
+            )
+          )
+        ],
+        expected: [
+          ...new Set(
+            packageSignals.flatMap(
+              (item) => item.expected ? [`${item.name}@${item.expected}`] : []
+            )
+          )
+        ]
+      };
+      if (runtimeEvidence && runtimeRequirement2) {
+        values.expected.push(`${runtimeRequirement2.name}@${runtimeRequirement2.version}`);
+        if (runtimeEvidence.actual)
+          values.installed.push(`${runtimeRequirement2.name}@${runtimeEvidence.actual}`);
+      }
+      return [
+        {
+          repositoryId: repository.id,
+          sources: values.sources,
+          packages: values.packages,
+          declared: values.declared.length ? values.declared.join(" \xB7 ") : void 0,
+          installed: values.installed.length ? values.installed.join(" \xB7 ") : void 0,
+          expected: values.expected.length ? values.expected.join(" \xB7 ") : void 0,
+          status: status2
+        }
+      ];
+    });
+    const expected = /* @__PURE__ */ new Set();
+    for (const requirement of policy?.packages ?? []) {
+      if ((technology.packages ?? []).includes(requirement.name))
+        expected.add(`${requirement.name}@${requirement.version}`);
+    }
+    const runtimeRequirement = policy?.runtimes?.find(
+      (item) => item.name === technology.id || technology.id === "deno-edge" && item.name === "deno"
+    );
+    if (runtimeRequirement)
+      expected.add(`${runtimeRequirement.name}@${runtimeRequirement.version}`);
+    for (const project of projects) {
+      for (const value of project.expected?.split(" \xB7 ") ?? []) expected.add(value);
+    }
+    const status = projects.some(
+      (project) => project.status === "drift"
+    ) ? "drift" : projects.some((project) => project.status === "unversioned") ? "unversioned" : projects.some((project) => project.status === "unknown") ? "unknown" : projects.length ? "aligned" : "not-applicable";
+    return {
+      id: technology.id,
+      label: technology.label,
+      packages: technology.packages ?? [],
+      expected: [...expected],
+      projectCount: projects.length,
+      status,
+      projects
+    };
+  }).filter((technology) => technology.projectCount > 0);
+}
+function hasUsableTechnologyFile(path) {
+  if (!existsSync23(path)) return false;
+  try {
+    const info = statSync5(path);
+    if (info.isFile()) return true;
+    if (!info.isDirectory()) return false;
+    return readdirSync10(path, { withFileTypes: true }).some((entry) => {
+      if (entry.name.startsWith(".")) return false;
+      const child = join24(path, entry.name);
+      if (entry.isDirectory()) return hasUsableTechnologyFile(child);
+      return entry.name.toLowerCase() !== "readme.md";
+    });
+  } catch {
+    return false;
+  }
+}
+function deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, exclusiveOwnershipViolations, technologyGovernanceConfigured, versions, verification, redundancy) {
+  if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || [...skills.automatic, ...skills.manual].some((item) => item.kind === "dangling-symlink") || exclusiveOwnershipViolations.length > 0 || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets))
+    return "unhealthy";
+  const missingBaseline = projectModel.baseline.some(
+    (technology) => !technology.detected && !hasBaselineException(projectModel, technology.id)
+  );
+  const missingSelected = projectModel.optionalCapabilities.some(
+    (technology) => technology.selected && !technology.detected
+  );
   const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
-  const secretMaterializationNeedsReview = liveEnv.some((file) => !file.centralized && !file.localOnly);
+  const secretMaterializationNeedsReview = liveEnv.some(
+    (file) => !file.centralized && !file.localOnly
+  );
   const packageVersionNeedsReview = docs.packages.expected !== void 0 && !docs.packages.aligned;
   const routerVersionNeedsReview = !docs.routerAligned;
   const targetManifestMissing = role === "target" && !docs.manifest;
-  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || !hostSsot.compliant || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected || packageVersionNeedsReview || routerVersionNeedsReview || targetManifestMissing || versions.status === "attention" || verification.status === "attention" || redundancy.legacyDirectories.length > 0) return "attention";
+  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || skills.invalidEntries.length > 0 || skills.userDuplicates.length > 0 || skills.crossPlacementDuplicates.length > 0 || skills.placementDrift.length > 0 || skills.automatic.length > skills.automaticReviewThreshold || !hostSsot.compliant || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected || packageVersionNeedsReview || routerVersionNeedsReview || targetManifestMissing || versions.status === "attention" || verification.status === "attention" || redundancy.legacyDirectories.length > 0)
+    return "attention";
   return "healthy";
 }
+function inspectExclusiveOwnership(root, endpoint, governance) {
+  const projectType = endpoint.projectType;
+  return (governance?.exclusiveOwnership ?? []).flatMap((rule) => {
+    if (projectType && rule.allowedProjectTypes.includes(projectType)) return [];
+    const paths = rule.paths.filter((path) => existsSync23(join24(root, path)));
+    return paths.length > 0 ? [{ rule, paths }] : [];
+  });
+}
 function inspectProjectModel(root, endpoint, governance) {
-  const projectType = governance?.projectTypes.find((candidate) => candidate.id === endpoint.projectType);
+  const projectType = governance?.projectTypes.find(
+    (candidate) => candidate.id === endpoint.projectType
+  );
   const packages = collectPackageNames(root);
-  const technologyById = new Map((governance?.technologies ?? []).map((technology) => [technology.id, technology]));
+  const technologyById = new Map(
+    (governance?.technologies ?? []).map((technology) => [technology.id, technology])
+  );
   const detection = (id) => {
     const technology = technologyById.get(id);
     const packageMatch = technology?.packages?.some((name) => packages.has(name)) ?? false;
@@ -4415,7 +4943,10 @@ function inspectProjectModel(root, endpoint, governance) {
     projectType: projectType ? { id: projectType.id, title: projectType.title, summary: projectType.summary } : void 0,
     boundary: endpoint.boundary,
     baseline: (projectType?.baseline ?? []).map(detection),
-    optionalCapabilities: (projectType?.optionalCapabilities ?? []).map((id) => ({ ...detection(id), selected: selected.has(id) })),
+    optionalCapabilities: (projectType?.optionalCapabilities ?? []).map((id) => ({
+      ...detection(id),
+      selected: selected.has(id)
+    })),
     exceptions: endpoint.technologyExceptions ?? []
   };
 }
@@ -4426,16 +4957,14 @@ function hasBaselineException(projectModel, technologyId) {
 }
 function collectPackageNames(root) {
   const names = /* @__PURE__ */ new Set();
-  let files = [];
-  try {
-    files = splitLines(execFileSync("git", ["ls-files", "*package.json"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }));
-  } catch {
-    if (existsSync23(join24(root, "package.json"))) files = ["package.json"];
-  }
-  for (const file of files) {
-    const packageJson = readJson4(join24(root, file));
+  for (const { packageJson } of collectPackageManifests(root)) {
     if (!isRecord3(packageJson)) continue;
-    for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+    for (const section of [
+      "dependencies",
+      "devDependencies",
+      "peerDependencies",
+      "optionalDependencies"
+    ]) {
       const dependencies = packageJson[section];
       if (!isRecord3(dependencies)) continue;
       for (const name of Object.keys(dependencies)) names.add(name);
@@ -4444,17 +4973,31 @@ function collectPackageNames(root) {
   return names;
 }
 function hasWorkflowReminderHooks(hooks) {
-  return hooks.some((hook) => hook.events.some((event) => event.name === "Stop" || event.name === "SubagentStop"));
+  return hooks.some(
+    (hook) => hook.events.some((event) => event.name === "Stop" || event.name === "SubagentStop")
+  );
 }
 function inspectGit2(root) {
   const git = (...args) => {
     try {
-      return execFileSync("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trimEnd();
+      return execFileSync("git", args, {
+        cwd: root,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }).trimEnd();
     } catch {
       return void 0;
     }
   };
-  if (git("rev-parse", "--is-inside-work-tree") !== "true") return { isRepository: false, branches: [], mergedBranches: [], unmergedBranches: [], worktrees: [], dirtyPaths: [] };
+  if (git("rev-parse", "--is-inside-work-tree") !== "true")
+    return {
+      isRepository: false,
+      branches: [],
+      mergedBranches: [],
+      unmergedBranches: [],
+      worktrees: [],
+      dirtyPaths: []
+    };
   const status = git("status", "--porcelain=v1", "-uall") ?? "";
   const worktreeText = git("worktree", "list", "--porcelain") ?? "";
   const upstreamCounts = git("rev-list", "--left-right", "--count", "@{upstream}...HEAD")?.split(/\s+/).map(Number);
@@ -4462,8 +5005,12 @@ function inspectGit2(root) {
     isRepository: true,
     branch: git("branch", "--show-current") || "(detached)",
     branches: splitLines(git("for-each-ref", "--format=%(refname:short)", "refs/heads")),
-    mergedBranches: splitLines(git("for-each-ref", "--merged=HEAD", "--format=%(refname:short)", "refs/heads")),
-    unmergedBranches: splitLines(git("for-each-ref", "--no-merged=HEAD", "--format=%(refname:short)", "refs/heads")),
+    mergedBranches: splitLines(
+      git("for-each-ref", "--merged=HEAD", "--format=%(refname:short)", "refs/heads")
+    ),
+    unmergedBranches: splitLines(
+      git("for-each-ref", "--no-merged=HEAD", "--format=%(refname:short)", "refs/heads")
+    ),
     worktrees: splitLines(worktreeText).filter((line) => line.startsWith("worktree ")).map((line) => line.slice(9)),
     dirtyPaths: splitLines(status).map((line) => line.slice(3)),
     behind: upstreamCounts?.[0],
@@ -4504,51 +5051,142 @@ function inspectOptionalEntry(root, filename, agentsPath) {
   const content = safeRead(path);
   return /AGENTS\.md/.test(content) && content.length < 2e3 ? "thin-adapter" : "custom";
 }
-function inspectSkills(root, grokInspection) {
+function inspectSkills(root, grokInspection, registeredSkills, userSkills) {
   const lock = readJson4(join24(root, ".pro-gov/assets.lock.json"));
+  const assetManifest = readJson4(join24(root, ".pro-gov/assets.json"));
   const managed = /* @__PURE__ */ new Set();
   const bundleIds = stringArray(isRecord3(lock) ? lock.bundleIds : void 0);
   if (isRecord3(lock) && Array.isArray(lock.assets)) {
     for (const asset of lock.assets) {
       if (!isRecord3(asset) || typeof asset.targetPath !== "string") continue;
-      const match = asset.targetPath.match(/^\.agents\/skills\/([^/]+)$/);
-      if (match) managed.add(match[1]);
+      const match = asset.targetPath.match(/^\.agents\/(skills|manual-skills)\/([^/]+)$/);
+      if (match) managed.add(`${match[1]}:${match[2]}`);
     }
   }
-  const skillRoot = join24(root, ".agents/skills");
-  const canonical = pathLexists(skillRoot) && safeIsDirectory(skillRoot) ? safeReadDir(skillRoot).filter((name) => !name.startsWith(".")).map((name) => {
-    const path = join24(skillRoot, name);
-    const stat = lstatSync8(path);
-    let kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : "file";
-    if (stat.isSymbolicLink()) {
-      try {
-        realpathSync4(path);
-      } catch {
-        kind = "dangling-symlink";
-      }
-    }
-    return { name, kind, managed: managed.has(name) };
-  }) : [];
-  const locked = isRecord3(lock) && Array.isArray(lock.assets) ? lock.assets.length : 0;
+  const inspectPlacement = (placement) => {
+    const directory = placement === "auto" ? "skills" : "manual-skills";
+    const skillRoot = join24(root, ".agents", directory);
+    if (!pathLexists(skillRoot) || !safeIsDirectory(skillRoot)) return [];
+    return safeReadDir(skillRoot).filter((name) => !name.startsWith(".")).map((name) => inspectSkillItem(skillRoot, directory, name, managed, registeredSkills));
+  };
+  const automatic = inspectPlacement("auto");
+  const manual = inspectPlacement("manual");
+  const invalidEntries = [
+    ...inspectInvalidSkillEntries(root, "skills"),
+    ...inspectInvalidSkillEntries(root, "manual-skills")
+  ];
+  const userDuplicates = [...automatic, ...manual].filter((item) => skillDuplicatesUser(item, root, userSkills)).map((item) => item.name).filter((name, index, names) => names.indexOf(name) === index).sort();
+  const automaticNames = new Set(automatic.map((item) => item.name));
+  const crossPlacementDuplicates = manual.map((item) => item.name).filter((name) => automaticNames.has(name)).sort();
+  const placementDrift = [
+    ...automatic.flatMap((item) => skillPlacementDrift(item, "auto")),
+    ...manual.flatMap((item) => skillPlacementDrift(item, "manual"))
+  ];
+  const unregistered = [
+    ...automatic.flatMap(
+      (item) => item.registryId || item.classification ? [] : [{ name: item.name, placement: "auto" }]
+    ),
+    ...manual.flatMap(
+      (item) => item.registryId || item.classification ? [] : [{ name: item.name, placement: "manual" }]
+    )
+  ];
+  const lockedSkills = isRecord3(lock) && Array.isArray(lock.assets) ? lock.assets.filter(
+    (asset) => isRecord3(asset) && typeof asset.targetPath === "string" && /^\.agents\/(skills|manual-skills)\/[^/]+$/.test(asset.targetPath)
+  ) : [];
+  const desiredAssetIds = new Set(
+    isRecord3(assetManifest) ? stringArray(assetManifest.assetIds) : []
+  );
+  const desired = registeredSkills.filter(
+    (skill) => desiredAssetIds.has(skill.id) && skill.defaultScope === "project"
+  ).length;
+  const allInstalled = [...automatic, ...manual];
   return {
-    canonical,
+    automatic,
+    manual,
+    invalidEntries,
+    userDuplicates,
+    crossPlacementDuplicates,
+    placementDrift,
+    unregistered,
+    automaticReviewThreshold: 10,
     claudeCompatibility: inspectClaudeSkillRoot(root),
     bundleIds,
     lifecycle: {
-      desired: bundleIds.length,
-      locked,
-      installed: canonical.filter((item) => item.managed && item.kind !== "dangling-symlink").length,
-      discoverable: canonical.filter((item) => item.kind !== "dangling-symlink").length,
+      desired,
+      locked: lockedSkills.length,
+      installed: allInstalled.filter((item) => item.managed && item.kind !== "dangling-symlink").length,
+      discoverable: automatic.filter((item) => item.kind !== "dangling-symlink").length,
       runtime: "unobservable"
     },
     hosts: {
-      codexProject: canonical.filter((item) => item.kind !== "dangling-symlink").length,
+      codexProject: automatic.filter((item) => item.kind !== "dangling-symlink").length,
       claudeCodeProject: inspectSkillRoot(join24(root, ".claude/skills")).names.length,
       grokNativeProject: inspectSkillRoot(join24(root, ".grok/skills")).names.length,
       grokEffective: grokInspection.skills
     }
   };
 }
+function inspectSkillItem(skillRoot, directory, name, managed, registeredSkills) {
+  const path = join24(skillRoot, name);
+  const stat = lstatSync8(path);
+  let kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : "file";
+  let realPath;
+  try {
+    realPath = realpathSync4(path);
+  } catch {
+    if (stat.isSymbolicLink()) kind = "dangling-symlink";
+  }
+  const registered = realPath ? registeredSkills.find((skill) => skill.sourceRealPath === realPath) : void 0;
+  const classification = registered ? void 0 : realPath && isPluginPack(realPath) ? "plugin-pack" : kind === "directory" && existsSync23(join24(path, "SKILL.md")) ? "project-local" : void 0;
+  return {
+    name,
+    kind,
+    managed: managed.has(`${directory}:${name}`),
+    classification,
+    registryId: registered?.id,
+    expectedPlacement: registered?.defaultPlacement,
+    expectedScope: registered?.defaultScope
+  };
+}
+function isPluginPack(path) {
+  const skillsRoot = join24(path, "skills");
+  return existsSync23(join24(path, ".codex-plugin/plugin.json")) && safeIsDirectory(skillsRoot) && safeReadDir(skillsRoot).some((name) => existsSync23(join24(skillsRoot, name, "SKILL.md")));
+}
+function inspectInvalidSkillEntries(root, directory) {
+  const skillRoot = join24(root, ".agents", directory);
+  if (!pathLexists(skillRoot) || !safeIsDirectory(skillRoot)) return [];
+  return safeReadDir(skillRoot).flatMap((name) => {
+    if (name === ".gitkeep") return [];
+    if (name === ".DS_Store")
+      return [{ path: `.agents/${directory}/${name}`, reason: "metadata-junk" }];
+    if (name.startsWith("."))
+      return [{ path: `.agents/${directory}/${name}`, reason: "unexpected-file" }];
+    const path = join24(skillRoot, name);
+    return !lstatSync8(path).isDirectory() && !lstatSync8(path).isSymbolicLink() ? [{ path: `.agents/${directory}/${name}`, reason: "unexpected-file" }] : [];
+  });
+}
+function skillDuplicatesUser(item, root, userSkills) {
+  if (userSkills.names.has(item.name)) return true;
+  const automatic = join24(root, ".agents/skills", item.name);
+  const manual = join24(root, ".agents/manual-skills", item.name);
+  const realPath = safeRealpath(pathLexists(automatic) ? automatic : manual);
+  return realPath ? userSkills.realPaths.has(realPath) : false;
+}
+function skillPlacementDrift(item, actualPlacement) {
+  if (!item.registryId || !item.expectedPlacement) return [];
+  if (item.expectedScope === "user" || item.expectedPlacement !== actualPlacement)
+    return [
+      {
+        name: item.name,
+        registryId: item.registryId,
+        actualPlacement,
+        expectedPlacement: item.expectedPlacement,
+        expectedScope: item.expectedScope ?? "project",
+        reason: item.expectedScope === "user" ? "scope" : "placement"
+      }
+    ];
+  return [];
+}
 function inspectClaudeSkillRoot(root) {
   const path = join24(root, ".claude/skills");
   if (!pathLexists(path)) return "missing";
@@ -4589,14 +5227,29 @@ function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environme
     repositoryEnvFiles: envFiles
   };
 }
-var SKIP_ENV_DIRECTORIES = /* @__PURE__ */ new Set([".git", ".next", ".nuxt", ".output", ".turbo", ".vercel", ".worktrees", "build", "coverage", "dist", "node_modules", "out", "target"]);
+var SKIP_ENV_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".git",
+  ".next",
+  ".nuxt",
+  ".output",
+  ".turbo",
+  ".vercel",
+  ".worktrees",
+  "build",
+  "coverage",
+  "dist",
+  "node_modules",
+  "out",
+  "target"
+]);
 function collectEnvironmentFiles(root, current = root, depth = 0) {
   if (depth > 5) return [];
   const found = [];
   try {
-    for (const entry of readdirSync9(current, { withFileTypes: true })) {
+    for (const entry of readdirSync10(current, { withFileTypes: true })) {
       if (entry.isDirectory()) {
-        if (!SKIP_ENV_DIRECTORIES.has(entry.name)) found.push(...collectEnvironmentFiles(root, join24(current, entry.name), depth + 1));
+        if (!SKIP_ENV_DIRECTORIES.has(entry.name))
+          found.push(...collectEnvironmentFiles(root, join24(current, entry.name), depth + 1));
       } else if (isEnvironmentFilename(entry.name) && !isProviderGeneratedEnvironmentFile(entry.name)) {
         found.push(relative8(root, join24(current, entry.name)));
       }
@@ -4610,7 +5263,7 @@ function collectCentralSecretFiles(root, current = root, depth = 0) {
   if (depth > 3) return [];
   const found = [];
   try {
-    for (const entry of readdirSync9(current, { withFileTypes: true })) {
+    for (const entry of readdirSync10(current, { withFileTypes: true })) {
       const path = join24(current, entry.name);
       if (entry.isDirectory()) found.push(...collectCentralSecretFiles(root, path, depth + 1));
       else found.push({ path: relative8(root, path), mode: modeString(lstatSync8(path).mode) });
@@ -4657,9 +5310,9 @@ function inspectSecretsRoot(path) {
   return existsSync23(path) ? { path, exists: true, mode: modeString(statSync5(path).mode) } : { path, exists: false };
 }
 function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceSettings) {
-  const codexConfig = join24(homeDir, ".codex/config.toml");
-  const claudeConfig = join24(homeDir, ".claude.json");
-  const grokConfig = join24(homeDir, ".grok/config.toml");
+  const codexConfig = join24(homeDir, MCP_DISCOVERY_PATHS.user.codex);
+  const claudeConfig = join24(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode);
+  const grokConfig = join24(homeDir, MCP_DISCOVERY_PATHS.user.grok);
   const hostEnvironment = {
     mcp: {
       codexUser: { path: codexConfig, names: tomlMcpNames(codexConfig) },
@@ -4678,7 +5331,8 @@ function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceS
       available: grokVersion !== void 0,
       ...grokVersion ? { version: grokVersion } : {},
       inspectionCommand: "grok inspect --json"
-    }
+    },
+    redundancy: inspectHostRedundancy({ homeDir })
   };
   if (devspaceSettings) {
     hostEnvironment.devspace = inspectDevSpaceHealth({
@@ -4696,17 +5350,25 @@ function inspectDevSpaceHealth(options) {
   const authPath = join24(configDirectory, "auth.json");
   const installedResult = run("devspace", ["--version"], 3e3);
   const installedVersion = installedResult.ok ? installedResult.stdout.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/)?.[0] : void 0;
-  const latestResult = run("npm", ["view", "@waishnav/devspace", "version", "--registry=https://registry.npmjs.org/"], 5e3);
+  const latestResult = run(
+    "npm",
+    ["view", "@waishnav/devspace", "version", "--registry=https://registry.npmjs.org/"],
+    5e3
+  );
   const latestVersion = latestResult.ok ? latestResult.stdout.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/)?.[0] : void 0;
   const processResult = run("pgrep", ["-f", "devspace serve"], 3e3);
   const pid = processResult.ok ? processResult.stdout.match(/\b\d+\b/)?.[0] : void 0;
   const processEnvironment = pid ? run("ps", ["eww", "-p", pid, "-o", "command="], 3e3) : void 0;
-  const processToolMode = processEnvironment?.ok ? processEnvironment.stdout.match(/(?:^|\s)DEVSPACE_TOOL_MODE=(minimal|full|codex)(?:\s|$)/)?.[1] : void 0;
+  const processToolMode = processEnvironment?.ok ? processEnvironment.stdout.match(
+    /(?:^|\s)DEVSPACE_TOOL_MODE=(minimal|full|codex)(?:\s|$)/
+  )?.[1] : void 0;
   const doctor = !installedResult.ok ? "unavailable" : run("devspace", ["doctor"], 1e4).ok ? "ok" : "failed";
   const configValue = readJson4(configPath);
   const configExists = isRecord3(configValue);
   const allowedRoots = configExists && Array.isArray(configValue.allowedRoots) ? configValue.allowedRoots.filter((value) => typeof value === "string") : [];
-  const portfolioCoverage = !configExists || allowedRoots.length === 0 ? "unknown" : options.repositoryPaths.every((repositoryPath) => allowedRoots.some((root) => isPathInside(repositoryPath, root))) ? "complete" : "partial";
+  const portfolioCoverage = !configExists || allowedRoots.length === 0 ? "unknown" : options.repositoryPaths.every(
+    (repositoryPath) => allowedRoots.some((root) => isPathInside(repositoryPath, root))
+  ) ? "complete" : "partial";
   const bind = configExists && typeof configValue.host === "string" ? isLoopbackHost(configValue.host) ? "loopback" : "non-loopback" : "unknown";
   const directoryMode = existsSync23(configDirectory) ? modeString(statSync5(configDirectory).mode) : void 0;
   const fileMode = existsSync23(configPath) ? modeString(statSync5(configPath).mode) : void 0;
@@ -4725,17 +5387,24 @@ function inspectDevSpaceHealth(options) {
   if (!installedResult.ok) unhealthy("\u672C\u673A\u672A\u53D1\u73B0 DevSpace\uFF1B\u65E0\u6CD5\u4F7F\u7528\u5BBF\u4E3B\u5DE5\u4F5C\u533A\u670D\u52A1\u3002");
   if (!configExists) unhealthy("\u7F3A\u5C11 ~/.devspace/config.json\u3002");
   if (!existsSync23(authPath)) unhealthy("\u7F3A\u5C11 ~/.devspace/auth.json\u3002");
-  if (directoryMode && directoryMode !== "700") unhealthy(`~/.devspace \u76EE\u5F55\u6743\u9650\u4E3A ${directoryMode}\uFF0C\u5E94\u6536\u7D27\u4E3A 700\u3002`);
+  if (directoryMode && directoryMode !== "700")
+    unhealthy(`~/.devspace \u76EE\u5F55\u6743\u9650\u4E3A ${directoryMode}\uFF0C\u5E94\u6536\u7D27\u4E3A 700\u3002`);
   if (fileMode && fileMode !== "600") unhealthy(`DevSpace \u914D\u7F6E\u6587\u4EF6\u6743\u9650\u4E3A ${fileMode}\uFF0C\u5E94\u4E3A 600\u3002`);
   if (authMode && authMode !== "600") unhealthy(`DevSpace \u8BA4\u8BC1\u6587\u4EF6\u6743\u9650\u4E3A ${authMode}\uFF0C\u5E94\u4E3A 600\u3002`);
-  if (bind === "non-loopback") unhealthy("DevSpace \u76F4\u63A5\u7ED1\u5B9A\u5230\u975E\u672C\u673A\u5730\u5740\uFF1B\u5E94\u4F7F\u7528 loopback \u5E76\u7531\u53D7\u63A7\u4EE3\u7406\u66B4\u9732\u3002");
+  if (bind === "non-loopback")
+    unhealthy("DevSpace \u76F4\u63A5\u7ED1\u5B9A\u5230\u975E\u672C\u673A\u5730\u5740\uFF1B\u5E94\u4F7F\u7528 loopback \u5E76\u7531\u53D7\u63A7\u4EE3\u7406\u66B4\u9732\u3002");
   if (doctor === "failed") unhealthy("devspace doctor \u672A\u901A\u8FC7\u3002");
   if (portfolioCoverage === "partial") attention("DevSpace allowedRoots \u6CA1\u6709\u8986\u76D6\u5168\u90E8\u5DF2\u767B\u8BB0\u4ED3\u5E93\u3002");
   if (installedResult.ok && !pid) attention("DevSpace \u5DF2\u5B89\u88C5\u4F46\u5F53\u524D\u6CA1\u6709\u8FD0\u884C\u3002");
   if (options.expectedToolMode && pid && processToolMode !== options.expectedToolMode) {
-    attention(`\u8FD0\u884C\u4E2D\u7684 DevSpace \u5DE5\u5177\u6A21\u5F0F\u4E3A ${processToolMode ?? "unknown"}\uFF0C\u671F\u671B ${options.expectedToolMode}\u3002`);
+    attention(
+      `\u8FD0\u884C\u4E2D\u7684 DevSpace \u5DE5\u5177\u6A21\u5F0F\u4E3A ${processToolMode ?? "unknown"}\uFF0C\u671F\u671B ${options.expectedToolMode}\u3002`
+    );
   }
-  if (update === "available") attention(`DevSpace \u6709\u65B0\u7248\u672C\uFF1A${installedVersion} \u2192 ${latestVersion}\uFF1B\u5347\u7EA7\u524D\u4ECD\u5E94\u68C0\u67E5\u53D8\u66F4\u4E0E\u517C\u5BB9\u6027\u3002`);
+  if (update === "available")
+    attention(
+      `DevSpace \u6709\u65B0\u7248\u672C\uFF1A${installedVersion} \u2192 ${latestVersion}\uFF1B\u5347\u7EA7\u524D\u4ECD\u5E94\u68C0\u67E5\u53D8\u66F4\u4E0E\u517C\u5BB9\u6027\u3002`
+    );
   return {
     status,
     installed: installedResult.ok,
@@ -4784,18 +5453,25 @@ function isPathInside(path, root) {
 }
 function inspectSkillRoot(path) {
   const exists = pathLexists(path) && safeIsDirectory(path);
-  const names = exists ? safeReadDir(path).filter((name) => !name.startsWith(".") && existsSync23(join24(path, name, "SKILL.md"))) : [];
+  const names = exists ? safeReadDir(path).filter(
+    (name) => !name.startsWith(".") && existsSync23(join24(path, name, "SKILL.md"))
+  ) : [];
   return { path, exists, names };
 }
 function claudeProjectLocalMcpNames(homeDir, root) {
   if (!homeDir) return [];
-  const value = readJson4(join24(homeDir, ".claude.json"));
+  const value = readJson4(join24(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode));
   if (!isRecord3(value) || !isRecord3(value.projects)) return [];
-  const candidates = new Set([resolve5(root), safeRealpath(root)].filter((path) => Boolean(path)));
+  const candidates = new Set(
+    [resolve5(root), safeRealpath(root)].filter((path) => Boolean(path))
+  );
   const names = /* @__PURE__ */ new Set();
   for (const [path, project] of Object.entries(value.projects)) {
-    const projectPaths = [resolve5(path), safeRealpath(path)].filter((candidate) => Boolean(candidate));
-    if (!projectPaths.some((candidate) => candidates.has(candidate)) || !isRecord3(project) || !isRecord3(project.mcpServers)) continue;
+    const projectPaths = [resolve5(path), safeRealpath(path)].filter(
+      (candidate) => Boolean(candidate)
+    );
+    if (!projectPaths.some((candidate) => candidates.has(candidate)) || !isRecord3(project) || !isRecord3(project.mcpServers))
+      continue;
     for (const name of Object.keys(project.mcpServers)) names.add(name);
   }
   return [...names].sort();
@@ -4822,16 +5498,20 @@ function inspectGrokProject(root, homeDir, grokVersion) {
   });
   if (!grokVersion) return empty("unavailable");
   try {
-    const value = JSON.parse(execFileSync("grok", ["inspect", "--json"], {
-      cwd: root,
-      encoding: "utf8",
-      env: { ...process.env, HOME: homeDir, GROK_HOME: join24(homeDir, ".grok") },
-      maxBuffer: 10 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 8e3
-    }));
+    const value = JSON.parse(
+      execFileSync("grok", ["inspect", "--json"], {
+        cwd: root,
+        encoding: "utf8",
+        env: { ...process.env, HOME: homeDir, GROK_HOME: join24(homeDir, ".grok") },
+        maxBuffer: 10 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 8e3
+      })
+    );
     if (!isRecord3(value)) return empty("failed");
-    const userClaudeNames = new Set(jsonObjectKeys(join24(homeDir, ".claude.json"), "mcpServers"));
+    const userClaudeNames = new Set(
+      jsonObjectKeys(join24(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode), "mcpServers")
+    );
     const localClaudeNames = new Set(claudeProjectLocalMcpNames(homeDir, root));
     const effectiveMcp = Array.isArray(value.mcpServers) ? value.mcpServers.flatMap((item) => {
       if (!isRecord3(item) || typeof item.name !== "string") return [];
@@ -4839,13 +5519,23 @@ function inspectGrokProject(root, homeDir, grokVersion) {
       const sourceType = typeof source.type === "string" ? source.type : "unknown";
       const sourcePath = typeof source.path === "string" ? source.path : void 0;
       const vendor = typeof item.vendor === "string" ? item.vendor : sourceType;
-      return [{
-        name: item.name,
-        vendor,
-        scope: inferGrokMcpScope(item.name, sourceType, sourcePath, root, homeDir, userClaudeNames, localClaudeNames),
-        sourceType,
-        ...sourcePath ? { sourcePath } : {}
-      }];
+      return [
+        {
+          name: item.name,
+          vendor,
+          scope: inferGrokMcpScope(
+            item.name,
+            sourceType,
+            sourcePath,
+            root,
+            homeDir,
+            userClaudeNames,
+            localClaudeNames
+          ),
+          sourceType,
+          ...sourcePath ? { sourcePath } : {}
+        }
+      ];
     }) : [];
     const skillCounts = { project: 0, userOrCompatible: 0, plugin: 0, bundled: 0 };
     if (Array.isArray(value.skills)) {
@@ -4853,7 +5543,8 @@ function inspectGrokProject(root, homeDir, grokVersion) {
         if (!isRecord3(item) || !isRecord3(item.source)) continue;
         const type = item.source.type;
         const path = item.source.path;
-        if (typeof path === "string" && path.includes(sep + ".grok" + sep + "bundled" + sep)) skillCounts.bundled += 1;
+        if (typeof path === "string" && path.includes(sep + ".grok" + sep + "bundled" + sep))
+          skillCounts.bundled += 1;
         else if (type === "project") skillCounts.project += 1;
         else if (type === "plugin") skillCounts.plugin += 1;
         else skillCounts.userOrCompatible += 1;
@@ -4889,9 +5580,10 @@ function inferGrokMcpScope(name, sourceType, sourcePath, root, homeDir, userClau
   }
   const resolvedSource = safeRealpath(sourcePath) ?? resolve5(sourcePath);
   const resolvedRoot = safeRealpath(root) ?? resolve5(root);
-  if (resolvedSource === join24(resolvedRoot, ".mcp.json")) return "project-shared";
+  if (resolvedSource === join24(resolvedRoot, MCP_DISCOVERY_PATHS.project.claudeCodeShared))
+    return "project-shared";
   if (resolvedSource.startsWith(resolvedRoot + sep)) return "project";
-  if (homeDir && resolvedSource === join24(resolve5(homeDir), ".claude.json")) {
+  if (homeDir && resolvedSource === join24(resolve5(homeDir), MCP_DISCOVERY_PATHS.user.claudeCode)) {
     if (localClaudeNames.has(name)) return "project-local";
     if (userClaudeNames.has(name)) return "user";
   }
@@ -4980,7 +5672,11 @@ function recordOrEmpty(value) {
   return isRecord3(value) ? value : {};
 }
 function inspectSkillRegistry(executionEngineRoot) {
-  if (!executionEngineRoot) return { source: 0, registered: 0, bundled: 0, bundles: 0 };
+  if (!executionEngineRoot)
+    return {
+      health: { source: 0, registered: 0, bundled: 0, bundles: 0 },
+      skills: []
+    };
   const agentAssetsRoot = join24(executionEngineRoot, "agent-assets");
   const registry = readJson4(join24(agentAssetsRoot, "registry.json"));
   const assets = isRecord3(registry) && Array.isArray(registry.assets) ? registry.assets : [];
@@ -4993,15 +5689,49 @@ function inspectSkillRegistry(executionEngineRoot) {
     if (!isRecord3(bundle) || !Array.isArray(bundle.assets)) continue;
     for (const id of bundle.assets) if (typeof id === "string") bundledIds.add(id);
   }
-  const sourceRoots = [join24(agentAssetsRoot, "skills/pie-skills"), join24(agentAssetsRoot, "skills/npx-skills/.agents/skills")];
-  const source = sourceRoots.reduce((count, root) => count + safeReadDir(root).filter((name) => existsSync23(join24(root, name, "SKILL.md"))).length, 0);
+  const sourceRoots = [
+    join24(agentAssetsRoot, "skills/pie-skills"),
+    join24(agentAssetsRoot, "skills/npx-skills/.agents/skills")
+  ];
+  const source = sourceRoots.reduce(
+    (count, root) => count + safeReadDir(root).filter((name) => existsSync23(join24(root, name, "SKILL.md"))).length,
+    0
+  );
   return {
-    source,
-    registered: registeredSkills.length,
-    bundled: registeredSkills.filter((asset) => isRecord3(asset) && typeof asset.id === "string" && bundledIds.has(asset.id)).length,
-    bundles: bundleFiles.length
+    health: {
+      source,
+      registered: registeredSkills.length,
+      bundled: registeredSkills.filter(
+        (asset) => isRecord3(asset) && typeof asset.id === "string" && bundledIds.has(asset.id)
+      ).length,
+      bundles: bundleFiles.length
+    },
+    skills: registeredSkills.flatMap((asset) => {
+      if (!isRecord3(asset) || typeof asset.id !== "string" || typeof asset.sourcePath !== "string" || asset.defaultPlacement !== "auto" && asset.defaultPlacement !== "manual")
+        return [];
+      return [
+        {
+          id: asset.id,
+          sourceRealPath: safeRealpath(join24(agentAssetsRoot, asset.sourcePath)),
+          defaultPlacement: asset.defaultPlacement,
+          defaultScope: asset.defaultScope === "user" ? "user" : "project"
+        }
+      ];
+    })
   };
 }
+function inspectUserSkillEvidence(root) {
+  const names = /* @__PURE__ */ new Set();
+  const realPaths = /* @__PURE__ */ new Set();
+  if (!pathLexists(root) || !safeIsDirectory(root)) return { names, realPaths };
+  for (const name of safeReadDir(root)) {
+    if (name.startsWith(".")) continue;
+    names.add(name);
+    const realPath = safeRealpath(join24(root, name));
+    if (realPath) realPaths.add(realPath);
+  }
+  return { names, realPaths };
+}
 function jsonObjectKeys(path, key) {
   const value = readJson4(path);
   if (!isRecord3(value) || !isRecord3(value[key])) return [];
@@ -5011,7 +5741,7 @@ function tomlMcpNames(path) {
   if (!existsSync23(path)) return [];
   const names = /* @__PURE__ */ new Set();
   for (const line of safeRead(path).split(/\r?\n/)) {
-    const match = line.match(/^\s*\[mcp_servers\.(?:"([^"]+)"|([^\.\]]+))\]\s*$/);
+    const match = line.match(/^\s*\[mcp_servers\.(?:"([^"]+)"|([^.\]]+))\]\s*$/);
     const name = match?.[1] ?? match?.[2];
     if (name) names.add(name);
   }
@@ -5033,7 +5763,7 @@ function safeRead(path) {
 }
 function safeReadDir(path) {
   try {
-    return readdirSync9(path).sort();
+    return readdirSync10(path).sort();
   } catch {
     return [];
   }
@@ -5055,7 +5785,10 @@ function pathLexists(path) {
 }
 function gitTracks(root, path) {
   try {
-    execFileSync("git", ["ls-files", "--error-unmatch", "--", path], { cwd: root, stdio: "ignore" });
+    execFileSync("git", ["ls-files", "--error-unmatch", "--", path], {
+      cwd: root,
+      stdio: "ignore"
+    });
     return true;
   } catch {
     return false;
@@ -5074,7 +5807,7 @@ function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function findDashboardAssets() {
-  const packageRoot2 = dirname13(dirname13(fileURLToPath4(import.meta.url)));
+  const packageRoot2 = dirname14(dirname14(fileURLToPath4(import.meta.url)));
   const candidates = [
     process.env.PGS_DASHBOARD_ASSETS_DIR,
     join24(packageRoot2, ".dashboard-build"),
@@ -5085,7 +5818,10 @@ function findDashboardAssets() {
     join24(process.cwd(), "packages/pro-gov/assets/portfolio-dashboard")
   ].filter((value) => Boolean(value));
   const match = candidates.find((path) => existsSync23(join24(path, "index.html")));
-  if (!match) throw new Error("Portfolio dashboard assets were not built. Run pnpm --filter @pieai/pro-gov build.");
+  if (!match)
+    throw new Error(
+      "Portfolio dashboard assets were not built. Run pnpm --filter @pieai/pro-gov build."
+    );
   return match;
 }
 function safeJavaScriptJson(value) {
@@ -5121,7 +5857,12 @@ function runPortfolioAiHealth(args) {
     return 1;
   }
   const targetId = options.value.targetId && options.value.targetId !== "all" ? options.value.targetId : void 0;
-  if (targetId && !loaded.manifest.targets.some((target) => target.id === targetId)) {
+  const allRepositoryIds = [
+    loaded.manifest.controlPlane?.id,
+    loaded.manifest.executionEngine?.id,
+    ...loaded.manifest.targets.map((target) => target.id)
+  ].filter((id) => Boolean(id));
+  if (targetId && !allRepositoryIds.includes(targetId)) {
     console.error(`Unknown portfolio target: ${targetId}`);
     return 1;
   }
@@ -5130,11 +5871,6 @@ function runPortfolioAiHealth(args) {
     secretsRoot: options.value.secretsRoot,
     targetId
   });
-  const allRepositoryIds = [
-    loaded.manifest.controlPlane?.id,
-    loaded.manifest.executionEngine?.id,
-    ...loaded.manifest.targets.map((target) => target.id)
-  ].filter((id) => Boolean(id));
   const existing = targetId ? readExistingAiHealthReport(options.value.outDir, loaded.manifest.portfolioId) : void 0;
   const report = targetId ? mergePortfolioAiHealthReport(existing, latest, allRepositoryIds) : latest;
   const written = writePortfolioAiHealthReport(report, options.value.outDir);
@@ -5600,7 +6336,7 @@ var COMMANDS = [
   "assets list [--json] [--visibility public|private|third-party|all]",
   "assets discover [--target <path>] [--json]",
   "assets recommend [--target <path>] [--json]",
-  "assets plan --bundle <bundle-id> [--target <path>] [--json]",
+  "assets plan [--bundle <bundle-id>] [--asset <asset-id>] [--target <path>] [--json]",
   "assets apply --plan <path>",
   "assets check [--target <path>] [--strict-registry] [--json]",
   "assets public-check [--public-root <path>] [--private-root <path>] [--json]",