@pieai/pro-gov 0.9.0 → 0.9.2

package/assets/public-agent-assets/registry.json

@@ -25,11 +25,11 @@
       "notes": "Public rule for choosing evidence lanes and requiring fresh verification before completion.",
       "promotion": {
         "privateSourcePath": "rules/pie-rules/ai-in-the-loop.md",
-        "privateSourceHash": "sha256:71f487152123491a2c110ad839a90780b08e04ae3a133d59bbe977bf8b2f64e4",
+        "privateSourceHash": "sha256:344eba8c3b1f3130ed33e4b6a4511a332e2ca477e6a40ad7d4c73006197f5445",
         "publicHash": "sha256:911702baf6ea1d724e41ea1876d23d80f4de8dfaaadbf1399a40c982c810224c",
         "sanitized": true,
-        "lastReviewed": "2026-08-17",
-        "reviewNotes": "Reviewed after the private source gained governed front matter and normalized formatting. The public copy intentionally keeps the portable evidence-loop method without the private Grok compatibility lane or project governance metadata."
+        "lastReviewed": "2026-08-20",
+        "reviewNotes": "Reviewed after the private source gained governed front matter and normalized formatting. The public copy intentionally keeps the portable evidence-loop method without the private Grok compatibility lane or project governance metadata. Re-reviewed 2026-08-20: the private source moved by Markdown table padding only, with no wording change, so the sanitized public copy is unaffected and only the private hash is re-pinned."
       }
     },
     {

package/assets/starter/.github/workflows/docs-check.yml

@@ -43,7 +43,7 @@ jobs:
 
       - uses: pnpm/action-setup@v6
         with:
-          version: 11.9.0
+          version: 11.22.0
 
       - uses: actions/setup-node@v6
         with:

package/assets/starter/.oxfmtignore

@@ -0,0 +1,27 @@
+# Seeded by `pro-gov init`. This file is project-local after seeding — add
+# your own build outputs and generated paths freely.
+
+# Dependencies and build output
+node_modules
+dist
+build
+coverage
+out
+.next
+.turbo
+.tmp
+
+# ─────────────────────────────────────────────────────────────────────────
+# PGS-managed content — DO NOT REFORMAT. Keep these entries.
+#
+# `pro-gov sync --check` byte-compares docs/governance against the packaged
+# starter, and `pro-gov portfolio assets-check` byte-compares the shared-rule
+# snapshots. A formatter that only pads Markdown table cells is enough to fail
+# both, and the guardrails cannot tell cosmetic padding from a real local edit
+# — re-applying the asset then refuses with asset-lock-drift.
+#
+# If you need one of these files changed, change it upstream in Project
+# Governance System and re-sync; do not restyle it here.
+# ─────────────────────────────────────────────────────────────────────────
+docs/governance
+docs/policy/shared-rules

package/dist/cli.js

@@ -211,12 +211,12 @@ function toUnixPath2(path) {
 // src/asset-registry/loader.ts
 import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync5, readdirSync as readdirSync5, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
-import { dirname as dirname2, join as join5, relative as relative3 } from "node:path";
+import { dirname as dirname2, join as join5, relative as relative4 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/asset-registry/registry.ts
-import { existsSync as existsSync4, lstatSync, readdirSync as readdirSync4 } from "node:fs";
-import { isAbsolute, join as join4, posix } from "node:path";
+import { existsSync as existsSync4, lstatSync, readdirSync as readdirSync4, realpathSync } from "node:fs";
+import { isAbsolute, join as join4, posix, relative as relative3, sep } from "node:path";
 var supportedFamilies = /* @__PURE__ */ new Set([
   "pie-skills",
   "npx-skills",
@@ -427,6 +427,13 @@ function validateAssetRegistry(registry, options = {}) {
           path: asset.sourcePath,
           message: `Asset source path does not exist: ${asset.sourcePath}`
         });
+      } else if (!isWithinAgentAssetsDir(options.agentAssetsDir, sourceAbsolutePath)) {
+        issues.push({
+          type: "source-target-escape",
+          id: asset.id,
+          path: asset.sourcePath,
+          message: `Asset source resolves outside agent-assets: ${asset.sourcePath}`
+        });
       } else if (asset.kind === "skill") {
         if (asset.sourceKind === "local-pack") {
           if (!isLocalSkillPack(sourceAbsolutePath)) {
@@ -483,6 +490,16 @@ function isSafeRegistrySourcePath(sourcePath) {
 function normalizeRegistrySourcePath(sourcePath) {
   return posix.normalize(sourcePath.replaceAll("\\", "/"));
 }
+function isWithinAgentAssetsDir(agentAssetsDir, sourceAbsolutePath) {
+  try {
+    const agentAssetsRealPath = realpathSync(agentAssetsDir);
+    const sourceRealPath = realpathSync(sourceAbsolutePath);
+    const relativePath = relative3(agentAssetsRealPath, sourceRealPath);
+    return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath);
+  } catch {
+    return false;
+  }
+}
 function pathExistsEvenIfDanglingSymlink(path) {
   try {
     lstatSync(path);
@@ -544,7 +561,7 @@ function hashAgentAssetContent(asset, agentAssetsDir) {
 function hashAssetPathContent(sourceAbsolutePath) {
   const hash = createHash2("sha256");
   for (const filePath of listFiles3(sourceAbsolutePath)) {
-    const relativePath = toUnixPath3(relative3(sourceAbsolutePath, filePath));
+    const relativePath = toUnixPath3(relative4(sourceAbsolutePath, filePath));
     hash.update(relativePath);
     hash.update("\0");
     hash.update(readFileSync3(filePath));
@@ -712,15 +729,15 @@ import {
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync2,
   readlinkSync as readlinkSync2,
-  realpathSync as realpathSync2,
+  realpathSync as realpathSync3,
   symlinkSync,
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { dirname as dirname4, join as join8, relative as relative4, resolve as resolve2 } from "node:path";
+import { dirname as dirname4, join as join8, relative as relative5, resolve as resolve2 } from "node:path";
 
 // src/asset-targets/install-plan.ts
-import { existsSync as existsSync7, lstatSync as lstatSync2, readFileSync as readFileSync4, readlinkSync, realpathSync, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync7, lstatSync as lstatSync2, readFileSync as readFileSync4, readlinkSync, realpathSync as realpathSync2, statSync as statSync3 } from "node:fs";
 import { basename, dirname as dirname3, join as join7, resolve } from "node:path";
 function createAssetInstallPlan(options) {
   const placement = options.placement ?? "registry";
@@ -872,7 +889,7 @@ function createAssetAction(asset, agentAssetsDir, targetDir, host, placement, ma
     if (managedEntry && managedEntry.delivery === "snapshot") {
       throw new Error(`Refusing to replace managed snapshot with a symlink: ${targetPath}`);
     }
-    if (stats.isSymbolicLink() && existsSync7(targetAbsolutePath) && realpathSync(targetAbsolutePath) === realpathSync(sourcePath)) {
+    if (stats.isSymbolicLink() && existsSync7(targetAbsolutePath) && realpathSync2(targetAbsolutePath) === realpathSync2(sourcePath)) {
       return {
         type: "adopt-existing-symlink",
         assetId: asset.id,
@@ -913,7 +930,7 @@ function createSnapshotAction(options) {
   }
   const stats = lstatSync2(options.targetAbsolutePath);
   if (stats.isSymbolicLink()) {
-    if (existsSync7(options.targetAbsolutePath) && realpathSync(options.targetAbsolutePath) === realpathSync(options.sourcePath) && hashAssetPathContent(options.targetAbsolutePath) === contentHash) {
+    if (existsSync7(options.targetAbsolutePath) && realpathSync2(options.targetAbsolutePath) === realpathSync2(options.sourcePath) && hashAssetPathContent(options.targetAbsolutePath) === contentHash) {
       return {
         type: "migrate-symlink-to-snapshot",
         assetId: options.asset.id,
@@ -1031,7 +1048,7 @@ function createLegacyClaudeAdoptions(options) {
     const targetAbsolutePath = join7(options.targetDir, targetPath);
     const compatibilityRootPath = join7(options.targetDir, ".claude/skills");
     const canonicalRootPath = join7(options.targetDir, ".agents/skills");
-    if (!lstatSync2(canonicalRootPath).isDirectory() || !lstatSync2(compatibilityRootPath).isSymbolicLink() || readlinkSync(compatibilityRootPath) !== "../.agents/skills" || realpathSync(compatibilityRootPath) !== realpathSync(canonicalRootPath)) {
+    if (!lstatSync2(canonicalRootPath).isDirectory() || !lstatSync2(compatibilityRootPath).isSymbolicLink() || readlinkSync(compatibilityRootPath) !== "../.agents/skills" || realpathSync2(compatibilityRootPath) !== realpathSync2(canonicalRootPath)) {
       throw new Error(
         `Legacy Claude compatibility root is not the exact canonical alias for ${entry.id}.`
       );
@@ -1044,7 +1061,7 @@ function createLegacyClaudeAdoptions(options) {
     const legacyAbsolutePath = join7(options.targetDir, entry.targetPath);
     const legacyStat = lstatSync2(legacyAbsolutePath);
     const expectedSourcePath = join7(options.agentAssetsDir, entry.sourcePath);
-    if (!targetStat.isSymbolicLink() || !legacyStat.isSymbolicLink() || targetStat.dev !== legacyStat.dev || targetStat.ino !== legacyStat.ino || realpathSync(targetAbsolutePath) !== realpathSync(expectedSourcePath)) {
+    if (!targetStat.isSymbolicLink() || !legacyStat.isSymbolicLink() || targetStat.dev !== legacyStat.dev || targetStat.ino !== legacyStat.ino || realpathSync2(targetAbsolutePath) !== realpathSync2(expectedSourcePath)) {
       throw new Error(`Legacy Claude skill target cannot be safely adopted: ${entry.targetPath}`);
     }
     const action = {
@@ -1175,7 +1192,7 @@ function applyAction(targetDir, action) {
   }
   mkdirSync2(dirname4(targetAbsolutePath), { recursive: true });
   const sourceAbsolutePath = resolve2(action.sourcePath);
-  const symlinkTarget = relative4(realpathSync2(dirname4(targetAbsolutePath)), realpathSync2(sourceAbsolutePath)) || ".";
+  const symlinkTarget = relative5(realpathSync3(dirname4(targetAbsolutePath)), realpathSync3(sourceAbsolutePath)) || ".";
   if (action.type === "symlink") {
     if (pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
       throw new Error(`Refusing to overwrite unmanaged target: ${action.targetPath}`);
@@ -1199,7 +1216,7 @@ function validateExistingSymlink(targetDir, action) {
     throw new Error(`Refusing unsafe existing symlink adoption: ${action.targetPath}`);
   }
   const targetAbsolutePath = join8(targetDir, action.targetPath);
-  if (!lstatSync3(targetAbsolutePath).isSymbolicLink() || realpathSync2(targetAbsolutePath) !== realpathSync2(action.sourcePath)) {
+  if (!lstatSync3(targetAbsolutePath).isSymbolicLink() || realpathSync3(targetAbsolutePath) !== realpathSync3(action.sourcePath)) {
     throw new Error(`Existing skill symlink changed before apply: ${action.targetPath}`);
   }
 }
@@ -1226,7 +1243,7 @@ function validateSnapshotAction(targetDir, action) {
     return;
   }
   if (action.type === "migrate-symlink-to-snapshot") {
-    if (!pathExistsEvenIfDanglingSymlink3(targetAbsolutePath) || !lstatSync3(targetAbsolutePath).isSymbolicLink() || !existsSync8(targetAbsolutePath) || realpathSync2(targetAbsolutePath) !== realpathSync2(action.sourcePath) || hashAssetPathContent(targetAbsolutePath) !== action.contentHash) {
+    if (!pathExistsEvenIfDanglingSymlink3(targetAbsolutePath) || !lstatSync3(targetAbsolutePath).isSymbolicLink() || !existsSync8(targetAbsolutePath) || realpathSync3(targetAbsolutePath) !== realpathSync3(action.sourcePath) || hashAssetPathContent(targetAbsolutePath) !== action.contentHash) {
       throw new Error(`Snapshot symlink changed before apply: ${action.targetPath}`);
     }
     return;
@@ -1272,14 +1289,14 @@ function validateAdoptedSymlink(targetDir, action) {
   const compatibilityRootPath = join8(targetDir, action.compatibilityRootPath);
   const targetAbsolutePath = join8(targetDir, action.targetPath);
   const legacyAbsolutePath = join8(targetDir, action.legacyTargetPath);
-  if (!lstatSync3(canonicalRootPath).isDirectory() || !lstatSync3(compatibilityRootPath).isSymbolicLink() || readlinkSync2(compatibilityRootPath) !== action.expectedCompatibilityRawTarget || realpathSync2(compatibilityRootPath) !== realpathSync2(canonicalRootPath)) {
+  if (!lstatSync3(canonicalRootPath).isDirectory() || !lstatSync3(compatibilityRootPath).isSymbolicLink() || readlinkSync2(compatibilityRootPath) !== action.expectedCompatibilityRawTarget || realpathSync3(compatibilityRootPath) !== realpathSync3(canonicalRootPath)) {
     throw new Error(
       `Legacy Claude compatibility alias changed before apply: ${action.compatibilityRootPath}`
     );
   }
   const targetStat = lstatSync3(targetAbsolutePath);
   const legacyStat = lstatSync3(legacyAbsolutePath);
-  if (!targetStat.isSymbolicLink() || !legacyStat.isSymbolicLink() || targetStat.dev !== legacyStat.dev || targetStat.ino !== legacyStat.ino || targetStat.dev !== action.expectedDevice || targetStat.ino !== action.expectedInode || realpathSync2(targetAbsolutePath) !== realpathSync2(action.sourcePath)) {
+  if (!targetStat.isSymbolicLink() || !legacyStat.isSymbolicLink() || targetStat.dev !== legacyStat.dev || targetStat.ino !== legacyStat.ino || targetStat.dev !== action.expectedDevice || targetStat.ino !== action.expectedInode || realpathSync3(targetAbsolutePath) !== realpathSync3(action.sourcePath)) {
     throw new Error(`Legacy Claude skill target changed before apply: ${action.targetPath}`);
   }
 }
@@ -1312,7 +1329,7 @@ function pathExistsEvenIfDanglingSymlink3(path) {
 }
 
 // src/asset-targets/check.ts
-import { existsSync as existsSync9, lstatSync as lstatSync4, readFileSync as readFileSync5 } from "node:fs";
+import { existsSync as existsSync9, lstatSync as lstatSync4, readFileSync as readFileSync5, realpathSync as realpathSync4 } from "node:fs";
 import { join as join9 } from "node:path";
 function checkInstalledAssets(options) {
   const lockfilePath = join9(options.targetDir, ".pro-gov/assets.lock.json");
@@ -1469,6 +1486,18 @@ function checkInstalledAssets(options) {
       });
       continue;
     }
+    if (delivery === "symlink") {
+      const expectedSource = realpathSync4(sourceAbsolutePath);
+      const actualSource = realpathSync4(targetAbsolutePath);
+      if (expectedSource !== actualSource) {
+        issues.push({
+          type: "symlink-source-drift",
+          id: entry.id,
+          targetPath: entry.targetPath,
+          message: `Managed symlink does not resolve to its registered source: ${entry.targetPath}`
+        });
+      }
+    }
     const currentSourceHash = hashAgentAssetContent(asset, options.agentAssetsDir);
     if ((delivery === "snapshot" || targetHashMatchesLock) && currentSourceHash !== entry.contentHash) {
       issues.push({
@@ -2222,25 +2251,26 @@ function runPackageDoctor(_args, dependencies = {}) {
 function runDoctor(args) {
   return runPackageDoctor(args);
 }
-function checkDocGov() {
-  const fromPath = spawnSync2("doc-gov", ["--help"], {
+function checkDocGov(options = {}) {
+  const run = options.run ?? ((command2, args) => spawnSync2(command2, args, {
     encoding: "utf8",
     stdio: "ignore"
-  });
-  if (!fromPath.error && fromPath.status === 0) {
-    return { ok: true, message: "doc-gov: available on PATH" };
-  }
-  const dependencyCli = resolveDocGovDependencyCli();
+  }));
+  const dependencyCli = (options.resolveDependencyCli ?? resolveDocGovDependencyCli)();
   if (!dependencyCli) {
+    const fromPath = run("doc-gov", ["--help"]);
+    if (!fromPath.error && fromPath.status === 0) {
+      return {
+        ok: false,
+        message: "doc-gov: found only on PATH; the required local @pieai/doc-gov package dependency is unavailable."
+      };
+    }
     return {
       ok: false,
-      message: "doc-gov: not found; install @pieai/doc-gov beside @pieai/pro-gov for validation."
+      message: "doc-gov: not found; install the required @pieai/doc-gov package dependency beside @pieai/pro-gov."
     };
   }
-  const fromDependency = spawnSync2(process.execPath, [dependencyCli, "--help"], {
-    encoding: "utf8",
-    stdio: "ignore"
-  });
+  const fromDependency = run(process.execPath, [dependencyCli, "--help"]);
   if (!fromDependency.error && fromDependency.status === 0) {
     return { ok: true, message: "doc-gov: available via package dependency" };
   }
@@ -2298,7 +2328,10 @@ function classifyOwnership(targetPath) {
   if (targetPath === "lefthook.yml" || targetPath === ".github/workflows/docs-check.yml") {
     return "optional-guardrail";
   }
-  if (targetPath === "AGENTS.md" || targetPath === "docs/policy/best-practice-for-this-project.md" || targetPath === "docs/reference/documentation-map.md" || targetPath === "docs/reference/execution/current-work.md") {
+  if (targetPath === "AGENTS.md" || // Seeded so a new project starts with the managed paths protected from its
+  // formatter, then owned locally — every project adds its own build outputs,
+  // so this must not be byte-compared by `sync --check`.
+  targetPath === ".oxfmtignore" || targetPath === "docs/policy/best-practice-for-this-project.md" || targetPath === "docs/reference/documentation-map.md" || targetPath === "docs/reference/execution/current-work.md") {
     return "project-local-seed";
   }
   return "shared";
@@ -2416,7 +2449,7 @@ import {
   writeFileSync as writeFileSync4
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname as dirname8, join as join14, relative as relative5, resolve as resolve3 } from "node:path";
+import { dirname as dirname8, join as join14, relative as relative6, resolve as resolve3 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var ROOT_DEFINITIONS = [
   {
@@ -2563,7 +2596,11 @@ function inspectAgentBrowser(options) {
     const output = execFileSync(command2, ["--version"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
-      timeout: 3e3
+      // Host scans can run alongside the full portfolio test matrix. Keep the
+      // probe bounded, but leave enough headroom for a busy Node process to
+      // spawn the pinned CLI instead of misclassifying a slow start as an
+      // unparseable version.
+      timeout: 1e4
     }).trim();
     const installedVersion = output.match(/(?:^|\s)(\d+\.\d+\.\d+)(?:\s|$)/)?.[1];
     if (!installedVersion) {
@@ -2857,7 +2894,7 @@ function countImmediateEntries(path) {
 }
 function displayPath(path, homePath) {
   const absolute = resolve3(path);
-  const withinHome = relative5(homePath, absolute);
+  const withinHome = relative6(homePath, absolute);
   if (withinHome === "") return "~";
   if (!withinHome.startsWith("..")) return `~/${withinHome}`;
   return absolute;
@@ -3983,7 +4020,7 @@ function printUsage2() {
 
 // src/learning/recall.ts
 import { existsSync as existsSync15, readdirSync as readdirSync8, readFileSync as readFileSync10 } from "node:fs";
-import { basename as basename3, join as join15, relative as relative6 } from "node:path";
+import { basename as basename3, join as join15, relative as relative7 } from "node:path";
 function recallLearnings(root, options) {
   const query = options.query.trim();
   const terms = tokenize(query);
@@ -4038,7 +4075,7 @@ function readLearningRecord(root, absolutePath) {
   const parsed = splitFrontmatter(content);
   const body = parsed.body;
   return {
-    relativePath: normalizePath(relative6(root, absolutePath)),
+    relativePath: normalizePath(relative7(root, absolutePath)),
     title: findTitle(parsed.frontmatter, body) ?? titleFromPath(absolutePath),
     metadata: parsed.frontmatter,
     body
@@ -4120,7 +4157,7 @@ function cleanMarkdownLine(input) {
 
 // src/learning/capture.ts
 import { existsSync as existsSync16, mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "node:fs";
-import { basename as basename4, join as join16, relative as relative7 } from "node:path";
+import { basename as basename4, join as join16, relative as relative8 } from "node:path";
 function captureLearning(root, options) {
   const title = options.title.trim();
   const summary = options.summary.trim();
@@ -4134,7 +4171,7 @@ function captureLearning(root, options) {
   const idSlug = basename4(path, ".md");
   writeFileSync6(path, renderLearning({ title, summary, category, moduleName, idSlug }));
   return {
-    relativePath: normalizePath2(relative7(root, path)),
+    relativePath: normalizePath2(relative8(root, path)),
     title,
     captureMode: "pgs-native"
   };
@@ -4758,7 +4795,7 @@ import { homedir as homedir3 } from "node:os";
 import { join as join22 } from "node:path";
 
 // src/host-ssot.ts
-import { lstatSync as lstatSync7, readlinkSync as readlinkSync3, realpathSync as realpathSync3 } from "node:fs";
+import { lstatSync as lstatSync7, readlinkSync as readlinkSync3, realpathSync as realpathSync5 } from "node:fs";
 import { dirname as dirname12, isAbsolute as isAbsolute4, join as join18, resolve as resolve6 } from "node:path";
 function inspectProjectHostSsot(root) {
   const agentsEntry = inspectCanonicalPath(root, "AGENTS.md");
@@ -4808,7 +4845,7 @@ function inspectCanonicalPath(root, path) {
   if (!stat) return { path, status: "missing" };
   if (stat.isSymbolicLink()) {
     try {
-      realpathSync3(absolutePath);
+      realpathSync5(absolutePath);
       return { path, status: "symlink" };
     } catch {
       return { path, status: "dangling-symlink" };
@@ -4842,7 +4879,7 @@ function inspectCompatibilityLink(root, path, expectedRawTarget) {
   }
   let targetMatches = false;
   try {
-    targetMatches = realpathSync3(absolutePath) === realpathSync3(expectedPath);
+    targetMatches = realpathSync5(absolutePath) === realpathSync5(expectedPath);
   } catch {
     return { ...base, rawTarget, resolvedTarget, status: "dangling-symlink" };
   }
@@ -5036,7 +5073,7 @@ function readPackageJson(path) {
 // src/repository-files.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync20, readdirSync as readdirSync10 } from "node:fs";
-import { isAbsolute as isAbsolute5, join as join21, posix as posix3, relative as relative8 } from "node:path";
+import { isAbsolute as isAbsolute5, join as join21, posix as posix3, relative as relative9 } from "node:path";
 var gitMaxBufferBytes = 64 * 1024 * 1024;
 var RepositoryFileDiscoveryError = class extends Error {
   constructor(message) {
@@ -5104,7 +5141,7 @@ function discoverFilesystemFiles(root, options) {
         continue;
       }
       if (!entry.isFile()) continue;
-      const relativePath = normalizeRepositoryRelativePath(relative8(root, absolutePath));
+      const relativePath = normalizeRepositoryRelativePath(relative9(root, absolutePath));
       if (isSafeRepositoryRelativePath(relativePath) && (options.fallbackIncludeFile?.(relativePath) ?? true)) {
         files.add(relativePath);
       }
@@ -5954,15 +5991,15 @@ import { homedir as homedir5 } from "node:os";
 import { dirname as dirname17, join as join33, resolve as resolve9 } from "node:path";
 
 // src/portfolio/ai-health/entries.ts
-import { existsSync as existsSync26, lstatSync as lstatSync11, realpathSync as realpathSync5 } from "node:fs";
+import { existsSync as existsSync26, lstatSync as lstatSync11, realpathSync as realpathSync7 } from "node:fs";
 import { join as join26 } from "node:path";
 
 // src/portfolio/ai-health/shared.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync25, lstatSync as lstatSync10, readFileSync as readFileSync17, readdirSync as readdirSync11, realpathSync as realpathSync4, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync25, lstatSync as lstatSync10, readFileSync as readFileSync17, readdirSync as readdirSync11, realpathSync as realpathSync6, statSync as statSync7 } from "node:fs";
 function safeRealpath(path) {
   try {
-    return realpathSync4(path);
+    return realpathSync6(path);
   } catch {
     return void 0;
   }
@@ -6074,7 +6111,7 @@ function inspectEntries(root) {
     const info = lstatSync11(claudePath);
     if (info.isSymbolicLink()) {
       try {
-        claude = realpathSync5(claudePath) === realpathSync5(agentsPath) ? "agents-symlink" : "custom";
+        claude = realpathSync7(claudePath) === realpathSync7(agentsPath) ? "agents-symlink" : "custom";
       } catch {
         claude = "dangling-symlink";
       }
@@ -6107,7 +6144,7 @@ function inspectAgentLinks(root) {
       let kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : "file";
       if (stat.isSymbolicLink()) {
         try {
-          realpathSync5(path);
+          realpathSync7(path);
         } catch {
           kind = "dangling-symlink";
         }
@@ -6126,7 +6163,7 @@ function inspectOptionalEntry(root, filename, agentsPath) {
   const info = lstatSync11(path);
   if (info.isSymbolicLink()) {
     try {
-      return realpathSync5(path) === realpathSync5(agentsPath) ? "agents-symlink" : "custom";
+      return realpathSync7(path) === realpathSync7(agentsPath) ? "agents-symlink" : "custom";
     } catch {
       return "dangling-symlink";
     }
@@ -6257,12 +6294,12 @@ function inspectGit2(root) {
 // src/portfolio/ai-health/hosts.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { existsSync as existsSync28 } from "node:fs";
-import { join as join28, resolve as resolve8, sep as sep2 } from "node:path";
+import { join as join28, resolve as resolve8, sep as sep3 } from "node:path";
 
 // src/portfolio/ai-health/devspace.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { existsSync as existsSync27, statSync as statSync8 } from "node:fs";
-import { join as join27, relative as relative9, resolve as resolve7, sep } from "node:path";
+import { join as join27, relative as relative10, resolve as resolve7, sep as sep2 } from "node:path";
 function inspectDevSpaceHealth(options) {
   const run = options.run ?? runDevSpaceCommand;
   const configDirectory = join27(options.homeDir, ".devspace");
@@ -6368,8 +6405,8 @@ function isLoopbackHost(host) {
   return ["127.0.0.1", "localhost", "::1"].includes(host.trim().toLowerCase());
 }
 function isPathInside(path, root) {
-  const fromRoot = relative9(resolve7(root), resolve7(path));
-  return fromRoot === "" || fromRoot !== ".." && !fromRoot.startsWith(`..${sep}`);
+  const fromRoot = relative10(resolve7(root), resolve7(path));
+  return fromRoot === "" || fromRoot !== ".." && !fromRoot.startsWith(`..${sep2}`);
 }
 
 // src/portfolio/ai-health/hosts.ts
@@ -6498,7 +6535,7 @@ function inspectGrokProject(root, homeDir, grokVersion) {
         if (!isRecord3(item) || !isRecord3(item.source)) continue;
         const type = item.source.type;
         const path = item.source.path;
-        if (typeof path === "string" && path.includes(sep2 + ".grok" + sep2 + "bundled" + sep2))
+        if (typeof path === "string" && path.includes(sep3 + ".grok" + sep3 + "bundled" + sep3))
           skillCounts.bundled += 1;
         else if (type === "project") skillCounts.project += 1;
         else if (type === "plugin") skillCounts.plugin += 1;
@@ -6537,19 +6574,19 @@ function inferGrokMcpScope(name, sourceType, sourcePath, root, homeDir, userClau
   const resolvedRoot = safeRealpath(root) ?? resolve8(root);
   if (resolvedSource === join28(resolvedRoot, MCP_DISCOVERY_PATHS.project.claudeCodeShared))
     return "project-shared";
-  if (resolvedSource.startsWith(resolvedRoot + sep2)) return "project";
+  if (resolvedSource.startsWith(resolvedRoot + sep3)) return "project";
   if (homeDir && resolvedSource === join28(resolve8(homeDir), MCP_DISCOVERY_PATHS.user.claudeCode)) {
     if (localClaudeNames.has(name)) return "project-local";
     if (userClaudeNames.has(name)) return "user";
   }
-  if (homeDir && resolvedSource.startsWith(resolve8(homeDir) + sep2)) return "user";
+  if (homeDir && resolvedSource.startsWith(resolve8(homeDir) + sep3)) return "user";
   if (sourceType === "project") return "project";
   return "unknown";
 }
 
 // src/portfolio/ai-health/secrets.ts
 import { existsSync as existsSync29, lstatSync as lstatSync12, readdirSync as readdirSync12, statSync as statSync9 } from "node:fs";
-import { join as join29, relative as relative10, sep as sep3 } from "node:path";
+import { join as join29, relative as relative11, sep as sep4 } from "node:path";
 function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environmentPolicy) {
   const centralPath = join29(secretsRoot, id);
   const centralRealPath = safeRealpath(centralPath);
@@ -6600,7 +6637,7 @@ function collectEnvironmentFiles(root, current = root, depth = 0) {
         if (!SKIP_ENV_DIRECTORIES.has(entry.name))
           found.push(...collectEnvironmentFiles(root, join29(current, entry.name), depth + 1));
       } else if (isEnvironmentFilename(entry.name) && !isProviderGeneratedEnvironmentFile(entry.name)) {
-        found.push(relative10(root, join29(current, entry.name)));
+        found.push(relative11(root, join29(current, entry.name)));
       }
     }
   } catch {
@@ -6615,7 +6652,7 @@ function collectCentralSecretFiles(root, current = root, depth = 0) {
     for (const entry of readdirSync12(current, { withFileTypes: true })) {
       const path = join29(current, entry.name);
       if (entry.isDirectory()) found.push(...collectCentralSecretFiles(root, path, depth + 1));
-      else found.push({ path: relative10(root, path), mode: modeString(lstatSync12(path).mode) });
+      else found.push({ path: relative11(root, path), mode: modeString(lstatSync12(path).mode) });
     }
   } catch {
     return found;
@@ -6642,8 +6679,8 @@ function pointsInside(path, expectedRoot) {
   if (!expectedRoot || !lstatSync12(path).isSymbolicLink()) return false;
   const target = safeRealpath(path);
   if (!target) return false;
-  const fromRoot = relative10(expectedRoot, target);
-  return fromRoot === "" || fromRoot !== ".." && !fromRoot.startsWith(`..${sep3}`);
+  const fromRoot = relative11(expectedRoot, target);
+  return fromRoot === "" || fromRoot !== ".." && !fromRoot.startsWith(`..${sep4}`);
 }
 function hasUnsafeCentralSecretPermissions(secrets) {
   return secrets.centralDirectory === "present" && (secrets.centralMode !== "700" || secrets.centralFiles.some((file) => file.mode !== "600"));
@@ -6653,7 +6690,7 @@ function inspectSecretsRoot(path) {
 }
 
 // src/portfolio/ai-health/skills.ts
-import { existsSync as existsSync30, lstatSync as lstatSync13, realpathSync as realpathSync6 } from "node:fs";
+import { existsSync as existsSync30, lstatSync as lstatSync13, realpathSync as realpathSync8 } from "node:fs";
 import { join as join30 } from "node:path";
 function countAutomaticSkillsNeedingReview(skills) {
   return skills.automatic.filter(
@@ -6741,7 +6778,7 @@ function inspectSkillItem(skillRoot, directory, name, managed, registeredSkills)
   let kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : "file";
   let realPath;
   try {
-    realPath = realpathSync6(path);
+    realPath = realpathSync8(path);
   } catch {
     if (stat.isSymbolicLink()) kind = "dangling-symlink";
   }
@@ -6802,8 +6839,8 @@ function inspectClaudeSkillRoot(root) {
   const stat = lstatSync13(path);
   if (stat.isSymbolicLink()) {
     try {
-      const target = realpathSync6(path);
-      return target === realpathSync6(join30(root, ".agents/skills")) ? "shared-root" : "other";
+      const target = realpathSync8(path);
+      return target === realpathSync8(join30(root, ".agents/skills")) ? "shared-root" : "other";
     } catch {
       return "dangling-symlink";
     }
@@ -7568,8 +7605,12 @@ function runPortfolioDoctor(args) {
     console.error(`Unknown portfolio target: ${options.value.targetId}`);
     return 1;
   }
+  const agentAssetsDir = findPortfolioAgentAssetsDir(loaded.manifest);
+  if (loaded.manifest.executionEngine?.path && !agentAssetsDir) {
+    return reportMissingPortfolioRegistry(loaded, options.value.json);
+  }
   const loadedAssets = loadAgentAssetRegistry({
-    agentAssetsDir: findPortfolioAgentAssetsDir(loaded.manifest)
+    agentAssetsDir
   });
   if (loadedAssets.issues.length > 0) {
     for (const issue of loadedAssets.issues) console.error(`${issue.type}: ${issue.message}`);
@@ -7670,8 +7711,12 @@ function runPortfolioPlan(args) {
     console.error(`Unknown portfolio target: ${options.value.targetId}`);
     return 1;
   }
+  const agentAssetsDir = findPortfolioAgentAssetsDir(loaded.manifest);
+  if (loaded.manifest.executionEngine?.path && !agentAssetsDir) {
+    return reportMissingPortfolioRegistry(loaded, options.value.json);
+  }
   const loadedAssets = loadAgentAssetRegistry({
-    agentAssetsDir: findPortfolioAgentAssetsDir(loaded.manifest)
+    agentAssetsDir
   });
   if (loadedAssets.issues.length > 0) {
     for (const issue of loadedAssets.issues) {
@@ -7760,8 +7805,12 @@ function runPortfolioAssetsCheck(args) {
     console.error(`Unknown portfolio target: ${options.value.targetId}`);
     return 1;
   }
+  const agentAssetsDir = findPortfolioAgentAssetsDir(loaded.manifest);
+  if (loaded.manifest.executionEngine?.path && !agentAssetsDir) {
+    return reportMissingPortfolioRegistry(loaded, options.value.json);
+  }
   const loadedAssets = loadAgentAssetRegistry({
-    agentAssetsDir: findPortfolioAgentAssetsDir(loaded.manifest)
+    agentAssetsDir
   });
   if (loadedAssets.issues.length > 0) {
     if (options.value.json) {
@@ -7874,6 +7923,31 @@ function findPortfolioAgentAssetsDir(manifest) {
   const agentAssetsDir = manifest?.executionEngine?.path ? join34(manifest.executionEngine.path, "agent-assets") : void 0;
   return agentAssetsDir && existsSync33(join34(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
 }
+function reportMissingPortfolioRegistry(loaded, json) {
+  const expectedPath = loaded.manifest?.executionEngine?.path ? join34(loaded.manifest.executionEngine.path, "agent-assets/registry.json") : "executionEngine.path/agent-assets/registry.json";
+  const issue = {
+    type: "missing-control-plane-registry",
+    message: `Portfolio control-plane registry is required at ${expectedPath}; refusing the package fallback registry.`
+  };
+  if (json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok: false,
+          configPath: loaded.configPath,
+          portfolioId: loaded.manifest?.portfolioId,
+          issues: [issue],
+          targets: []
+        },
+        null,
+        2
+      )
+    );
+  } else {
+    console.error(`${issue.type}: ${issue.message}`);
+  }
+  return 1;
+}
 function printUsage5() {
   console.error("Usage:");
   console.error("  pro-gov portfolio check --config <path> [--json]");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pieai/pro-gov",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Project-level distribution kit for Project Governance System.",
   "keywords": [
     "ai-agents",
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pieai/doc-gov": "^0.9.0"
+    "@pieai/doc-gov": "^0.9.2"
   },
   "devDependencies": {
     "@pieai/swimmer-ui-kit": "1.3.2",