@pieai/pro-gov 0.7.2 → 0.8.0

package/assets/profiles/engineering-runtime/manifest.yml

@@ -8,8 +8,6 @@ required:
     source: external shared-rule SSOT
   agents_routing: docs/governance/agents-routing/engineering-runtime-v1.1.md
   current_work: docs/reference/execution/current-work.md
-optional:
-  mattpocock_skills: integrations/mattpocock-skills.md
 project_local_required:
   - docs/policy/best-practice-for-this-project.md
   - AGENTS.md lane summary

package/assets/profiles/engineering-runtime/profile.md

@@ -9,7 +9,6 @@ Use for code-heavy projects: apps, games, runtimes, services, browser products,
 - `docs/governance/ssot-v1.1.md`
 - external AI-in-the-Loop policy linked by target projects under `docs/policy/shared-rules/ai-in-the-loop.md`
 - `docs/governance/agents-routing/engineering-runtime-v1.1.md`
-- `integrations/mattpocock-skills.md`
 - starter `docs/governance/` and `docs/policy/` templates
 
 ## Requires Project-Local Rules
@@ -28,7 +27,6 @@ Each project must define:
 - stack-specific rules
 - game/app-specific lane wording
 - external workflow plugin bodies
-- mattpocock/skills body
 
 ## Automation Boundary
 
@@ -42,5 +40,8 @@ their required governance commands remain present.
 
 For non-trivial engineering work, run `pro-gov learn recall --query "<task
 summary>"` before changing files so existing `docs/reference/learnings/**` and
-`CONCEPTS.md` lessons can shape the work. After verified work, use the
-`capture-learning` skill only when a reusable lesson exists.
+`CONCEPTS.md` lessons can shape the work. After completed, verified, non-trivial
+work, let `capture-learning` make a visible soft closeout decision. Capture only
+when a non-obvious reusable lesson exists; a skip is valid and no exit hook is
+required. Resolve the CLI through the project (`pnpm pro-gov` in this source
+repository), not by assuming a global `pro-gov` binary.

package/assets/public-agent-assets/bundles/base-governance.json

@@ -5,7 +5,6 @@
   "assets": [
     "pie-rules/ai-in-the-loop",
     "pie-rules/rule-evolution-methodology",
-    "pie-skills/beginner-friendly-docs",
-    "pie-skills/doc-cross-validator"
+    "pie-skills/beginner-friendly-docs"
   ]
 }

package/assets/public-agent-assets/registry.json

@@ -87,46 +87,13 @@
       "notes": "Public skill for writing teaching-oriented documentation with stories, analogies, diagrams, and examples.",
       "promotion": {
         "privateSourcePath": "skills/pie-skills/beginner-friendly-docs",
-        "privateSourceHash": "sha256:0098a81bf811f4044a62cbc4ddae30728c219be19df9006df593a2f7b610912e",
-        "publicHash": "sha256:0098a81bf811f4044a62cbc4ddae30728c219be19df9006df593a2f7b610912e",
+        "privateSourceHash": "sha256:1d33061af9376ca30a046c26e2d15f67d2972ea2364e799472fcd31c62ba7104",
+        "publicHash": "sha256:1d33061af9376ca30a046c26e2d15f67d2972ea2364e799472fcd31c62ba7104",
         "sanitized": false,
-        "lastReviewed": "2026-06-25",
+        "lastReviewed": "2026-07-16",
         "reviewNotes": "Public copy is byte-for-byte aligned with the private source at review time."
       },
       "defaultPlacement": "auto"
-    },
-    {
-      "id": "pie-skills/doc-cross-validator",
-      "title": "Doc Cross Validator",
-      "family": "pie-skills",
-      "kind": "skill",
-      "visibility": "public",
-      "sourceKind": "local",
-      "sourcePath": "skills/pie-skills/doc-cross-validator",
-      "hosts": [
-        "codex",
-        "claude-code",
-        "gemini-cli",
-        "antigravity"
-      ],
-      "tags": [
-        "skill",
-        "pie-skills",
-        "documentation",
-        "validation"
-      ],
-      "publishable": true,
-      "origin": "Promoted from maintainer-authored PGS local skills after public review.",
-      "notes": "Public skill for checking documentation claims against source code, config, data structures, and command output.",
-      "promotion": {
-        "privateSourcePath": "skills/pie-skills/doc-cross-validator",
-        "privateSourceHash": "sha256:8aadfc76f9c660ca42ac1dc2c2b25119f8f8328fcf759adb35f9106969411ab4",
-        "publicHash": "sha256:46bd797682876c3973ae6abf757bfc90fcbb3c451ace493eb091ea86e2b2ee0e",
-        "sanitized": true,
-        "lastReviewed": "2026-06-25",
-        "reviewNotes": "Public copy keeps the validation workflow while removing private checkout wording."
-      },
-      "defaultPlacement": "auto"
     }
   ]
 }

package/assets/public-agent-assets/skills/pie-skills/beginner-friendly-docs/SKILL.md

@@ -186,16 +186,14 @@ graph LR
 
 ### 第六步：交叉验证
 
-这一步至关重要，单独列为一个技能（见 `doc-cross-validator` 技能）。
-
-写完后必须对照真实系统验证文档内容，确保没有自己想当然地编造流程。
+这一步至关重要。写完后必须直接对照真实系统的源代码、配置、数据结构和命令输出验证文档内容，确保没有自己想当然地编造流程。
 
 ## 红线（这些是 AI 写教学文档时反复栽的坑，记住"为什么"就不会犯）
 
 **所有层级**：
 - 别用"简单来说"开头——它八成是"我没讲清楚"的遮羞布，真清楚的解释不需要这个前缀
 - 别让一整段纯文字不带任何视觉元素（图/表/引用块）——读者的眼睛需要落脚点，文字墙会劝退人
-- 别写完不做交叉验证——读着顺但流程是错的，比"丑但对"更危险（见 `doc-cross-validator`）
+- 别写完不做交叉验证——读着顺但流程是错的，比"丑但对"更危险
 - 别在没有比喻或例子的情况下抛出复杂概念——抽象概念没有抓手，读者会假装看懂然后悄悄放弃
 
 **初级额外**：

package/assets/starter/.github/workflows/docs-check.yml

@@ -24,12 +24,22 @@ on:
       - "package.json"
       - "pnpm-lock.yaml"
 
+permissions:
+  contents: read
+
+concurrency:
+  group: docs-check-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   doc-gov:
     name: doc-gov
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - uses: pnpm/action-setup@v6
         with:

package/assets/starter/docs/governance/agents-routing/engineering-runtime-v1.1.md

@@ -6,7 +6,7 @@ status: stable
 canonical: true
 owner: human
 created: 2026-07-13
-last_reviewed: 2026-07-13
+last_reviewed: 2026-07-16
 domain: agents-routing
 tags:
   - agents-routing
@@ -41,6 +41,24 @@ flowchart TD
 
 Use this router only to pick depth and workflow. Do not use it as a project roadmap.
 
+## Local-First Verification And Release Boundary
+
+- Before pushing, run the smallest project-local verification ladder that fully
+  covers the changed surface. Do not use hosted CI as a remote debugging loop.
+- If a relevant local gate fails, fix it locally before pushing. If it cannot run
+  locally, record the exact blocker and do not push repeated guesses.
+- Automatic hosted CI is a short independent smoke check. Keep it path-scoped,
+  cached, least-privileged, time-bounded, and configured to cancel stale runs.
+- Expensive browser, performance, packaging, staging, publishing, and deployment
+  lanes are local or manually triggered release evidence unless a project records
+  a specific exception.
+- Implementation and release are separate phases. The same solo developer or AI
+  may perform both, but a product task does not silently authorize publishing a
+  shared package or mutating staging/production.
+
+This is a behavior contract, not a requirement to add another hook, CI service,
+or local tool. Reuse the project's existing scripts and verification ladder.
+
 ## Project-Local Lane Profile
 
 Every engineering project must define its own lane profile in `AGENTS.md` or `docs/policy/best-practice-for-this-project.md`.

package/assets/starter/docs/governance/boundary.md

@@ -57,7 +57,7 @@ project-specific AI development habits live.
 | Project AI development practices | `docs/policy/best-practice-for-this-project.md` |
 | Current work index | `docs/reference/execution/current-work.md` |
 | Product or world truth | `docs/canon/` |
-| Durable decisions | `docs/adr/`, the single Matt-compatible decision surface |
+| Durable decisions | `docs/adr/`, governed decision records |
 | Active implementation work | `docs/plans/active/` |
 | Completed proof records | `docs/plans/completed/` |
 | Reusable project learnings | `docs/reference/learnings/**` as governed reference documents |
@@ -78,6 +78,5 @@ product packages, workbenches, prompt libraries, source folders, or asset
 folders can be product artifacts. Keep those files where the product package
 expects them unless a project explicitly opts them into doc-gov.
 
-Matt-native files under `docs/adr/**` and `docs/agents/**` are not governed docs
-by default. `docs/adr/**` is nevertheless the only durable decision surface;
-do not copy ADRs into a second PGS decision directory.
+Decision records under `docs/adr/**` are governed documents. Do not copy them
+into a second PGS decision directory.

package/assets/starter/docs/governance/doc-agent-rules.md

@@ -58,8 +58,8 @@ draft -> active -> completed -> stable -> superseded -> archived
 
 `completed` is for finished execution records or specs that should no longer appear in active folders.
 
-Durable decisions belong only in `docs/adr/**`. They use Matt's concise ADR
-format and remain outside the Doc Gov status machine.
+Durable decisions belong only in `docs/adr/**`. They use the governed decision
+frontmatter and decision lifecycle; do not duplicate them elsewhere.
 
 ## Upstream Rule
 

package/assets/starter/docs/governance/doc-types.md

@@ -42,5 +42,5 @@ Normal documents use:
 draft -> active -> completed -> stable -> superseded -> archived
 ```
 
-Durable decisions use the Matt-compatible `docs/adr/**` surface and stay
-outside the Doc Gov schema. Do not duplicate them in another decision folder.
+Durable decisions use the governed `docs/adr/**` surface and the decision
+lifecycle. Do not duplicate them in another decision folder.

package/assets/starter/docs/governance/ssot-v1.1.md

@@ -54,12 +54,10 @@ Markdown.
 
 Extra governed roots are allowed only when a project explicitly opts in.
 
-Matt-native and optional-tool artifacts are explicitly outside the default Doc
-Gov schema:
+External and optional-tool artifacts are explicitly outside the default Doc Gov
+schema:
 
 - `CONTEXT.md` and `CONTEXT-MAP.md`
-- `docs/adr/**`
-- `docs/agents/**`
 - `docs/brainstorms/**`
 - `docs/pulse-reports/**`
 
@@ -161,7 +159,7 @@ works for governed docs:
 | Agents-routing rules | `docs/governance/agents-routing/` |
 | Doc-system rules, templates, and manifest | `docs/governance/` |
 | Project AI/development policy | `docs/policy/` |
-| Durable decisions | `docs/adr/`, the single Matt-compatible decision surface outside Doc Gov schema |
+| Durable decisions | `docs/adr/`, governed decision records |
 | Product or feature requirement | `docs/specs/` |
 | Step-by-step implementation work | `docs/plans/` |
 | Reusable learning records | `docs/reference/learnings/**`, governed as `reference` documents and recalled on demand |

package/assets/starter/docs/governance/templates/adr.md

@@ -1,3 +1,25 @@
-# Replace Me
+---
+id: REPLACE-ME
+title: Replace Me
+type: decision
+status: proposed
+canonical: true
+owner: human
+created: YYYY-MM-DD
+last_reviewed: YYYY-MM-DD
+domain: meta
+tags:
+  - replace-me
+pinned: false
+related: []
+supersedes: []
+superseded_by: null
+---
 
-Record the context, decision, and why in one to three sentences.
+# REPLACE-ME: Replace Me
+
+## Context
+
+## Decision
+
+## Consequences

package/assets/starter/docs/reference/documentation-map.md

@@ -35,7 +35,7 @@ Use `AGENTS.md` for startup reading. It should point agents to:
 | Area | Purpose |
 | --- | --- |
 | `docs/policy/` | Project policy and AI development rules |
-| `docs/adr/` | The single Matt-compatible durable decision surface, outside Doc Gov schema |
+| `docs/adr/` | Governed durable decision records |
 | `docs/specs/active/` | Active requirements |
 | `docs/specs/completed/` | Completed specs |
 | `docs/plans/active/` | Active implementation plans |

package/cli-guide.md

@@ -21,6 +21,9 @@ pro-gov portfolio plan --config /path/to/portfolio.json --target web-app --json
 pro-gov portfolio assets-check --config /path/to/portfolio.json --json
 pro-gov portfolio doctor --config /path/to/portfolio.json --json
 pro-gov portfolio ai-health --config /path/to/portfolio.json --target all --out audits/portfolio-ai-health/2026-07-12
+pro-gov host-lens inspect --config /path/to/portfolio.json --json
+pro-gov host-lens scan --config /path/to/portfolio.json --out audits/host-lens/2026-07-16
+pro-gov host-lens plan --config /path/to/portfolio.json --out audits/host-lens/cleanup-review.json
 pro-gov learn recall --query "release downstream sync" --target .
 pro-gov learn capture --title "Reusable learning" --summary "Reusable lesson..." --target .
 pro-gov lens inspect --target .
@@ -73,6 +76,7 @@ pro-gov portfolio plan --config /path/to/control-repo/.pro-gov/portfolio.json --
 pro-gov portfolio assets-check --config /path/to/control-repo/.pro-gov/portfolio.json --json
 pro-gov portfolio doctor --config /path/to/control-repo/.pro-gov/portfolio.json --json
 pro-gov portfolio ai-health --config /path/to/control-repo/.pro-gov/portfolio.json --target all --out audits/portfolio-ai-health/2026-07-12
+pro-gov host-lens scan --config /path/to/portfolio.json --out .scratch/scheduled/host-lens
 pro-gov assets plan --bundle base-governance --target . --out .pro-gov/asset-plan.json
 pro-gov assets plan --bundle project-lens --target /path/to/project --host codex --placement manual --out /tmp/project-lens-plan.json
 pro-gov assets apply --plan .pro-gov/asset-plan.json
@@ -94,7 +98,7 @@ target.
 `portfolio ai-health` performs a read-only structural inventory of the control
 plane, execution engine, registered targets, user/project AI-host configuration,
 exact technology-version policy, the four verification-gate scripts, bounded
-legacy-directory/Playwright-cache evidence, and machine-level specialist checks
+project legacy-directory evidence, and machine-level specialist checks
 explicitly declared in the private manifest (currently DevSpace). It then writes
 a fixed local HTML dashboard plus JSON evidence to the explicit `--out`
 directory. `--target <id>` refreshes one target and merges it into the existing
@@ -102,8 +106,17 @@ same-portfolio board; `--target all` creates complete coverage. Specialist
 checks retain derived health states only; credentials, URLs, and raw process
 environments are never written. The inventory records MCP server names and
 environment filenames, but never reads or emits secret values, environment
-values, MCP commands, arguments, or MCP environment maps. Redundancy evidence is
-read-only and never deletes caches or legacy directories.
+values, MCP commands, arguments, or MCP environment maps. Project redundancy
+evidence is read-only and never deletes legacy directories.
+
+`host-lens` owns host-storage inspection that does not belong in ProjectLens.
+It measures known AI-host roots, package stores, Playwright browsers, explicit
+backup/cache/temp groups, and protected runtime/configuration groups without
+reading file contents. `scan` writes a second fixed SwimmerUIKit dashboard;
+`plan` writes only a review checklist with `executable: false` and
+`approved: false`. Prefer each package manager or host's native maintenance
+tool over generic recursive deletion. See `docs/reference/host-lens.md` in a
+full PGS checkout for the boundary and scheduled-operation contract.
 
 Portfolio manifests are external configuration files owned by a user or
 organization. PGS provides the format and commands; it does not publish a real