@pourkit/cli 0.0.0-next-20260615184943 → 0.0.0-next-20260617183635

package/dist/cli.js

@@ -58,20 +58,20 @@ function createLogger(name, filePath) {
       );
     },
     async close() {
-      await new Promise((resolve5) => {
+      await new Promise((resolve6) => {
         if (!fileStream) {
-          resolve5();
+          resolve6();
           return;
         }
         const timer = setTimeout(() => {
           if (!fileStream.destroyed) {
             fileStream.destroy();
           }
-          resolve5();
+          resolve6();
         }, 2e3);
         fileStream.end(() => {
           clearTimeout(timer);
-          resolve5();
+          resolve6();
         });
       });
     }
@@ -266,7 +266,7 @@ async function execJson(command, args, options = {}) {
   return JSON.parse(result.stdout);
 }
 function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 async function execCaptureWithRetry(command, args, options = {}) {
   const retries = options.retries ?? 3;
@@ -892,11 +892,11 @@ var OBSOLETE_CONFIG_PATHS = [
 ];
 var CANONICAL_CONFIG_PATH = ".pourkit/config.json";
 async function loadRepoConfig(repoRoot2, _configFileName) {
-  const { existsSync: existsSync22 } = await import("fs");
+  const { existsSync: existsSync23 } = await import("fs");
   const { join: pjoin } = await import("path");
   for (const obPath of OBSOLETE_CONFIG_PATHS) {
     const fullPath = pjoin(repoRoot2, obPath);
-    if (existsSync22(fullPath)) {
+    if (existsSync23(fullPath)) {
       const isRootJson = obPath === "pourkit.json";
       throw new Error(
         isRootJson ? `Found root ${obPath}, but Pourkit config now lives at ${CANONICAL_CONFIG_PATH}. Move the file and update "$schema" to "./schema/pourkit.schema.json".` : `Found ${obPath}, but executable config is no longer supported. Move configuration to ${CANONICAL_CONFIG_PATH} with "$schema": "./schema/pourkit.schema.json".`
@@ -904,13 +904,13 @@ async function loadRepoConfig(repoRoot2, _configFileName) {
     }
   }
   const configPath = pjoin(repoRoot2, CANONICAL_CONFIG_PATH);
-  if (!existsSync22(configPath)) {
+  if (!existsSync23(configPath)) {
     throw new Error(
       `No Pourkit config found at ${CANONICAL_CONFIG_PATH}. Run pourkit init or create ${CANONICAL_CONFIG_PATH} with "$schema": "./schema/pourkit.schema.json".`
     );
   }
-  const { readFile: readFile7 } = await import("fs/promises");
-  const raw = await readFile7(configPath, "utf-8");
+  const { readFile: readFile8 } = await import("fs/promises");
+  const raw = await readFile8(configPath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -924,7 +924,7 @@ function resolvePromptTemplatePath(repoRoot2, promptTemplate) {
   if (promptTemplate.includes("/")) {
     return join(repoRoot2, promptTemplate);
   }
-  return join(repoRoot2, ".pourkit", "prompts", promptTemplate);
+  return join(repoRoot2, ".pourkit", "managed", "prompts", promptTemplate);
 }
 function resolveTarget(config, explicitTarget) {
   if (config.targets.length === 0) {
@@ -1067,10 +1067,10 @@ async function removeStaleWorktree(candidate, repoRoot2, logger) {
   }
 }
 async function removeExpiredFiles(dirPath, retentionDays) {
-  const { readdir: readdir2, stat, unlink, access: access2 } = await import("fs/promises");
+  const { readdir: readdir4, stat, unlink, access: access2 } = await import("fs/promises");
   let entries;
   try {
-    entries = await readdir2(dirPath);
+    entries = await readdir4(dirPath);
   } catch {
     return;
   }
@@ -2505,6 +2505,7 @@ function renderReviewCriteriaEffect(repoRoot2, criteria, fs) {
       const snippetPath = join6(
         repoRoot2,
         ".pourkit",
+        "managed",
         "prompts",
         `reviewer-${criterion}.snippet.md`
       );
@@ -3345,6 +3346,34 @@ function validateIssueFinalReviewArtifact(parsed, options) {
   diagnostics.push(
     `changedFiles: ${parsed.changedFiles.length} files`
   );
+  if (options.baseRef && parsed.verdict === "pass") {
+    const expectedChangedFiles = listIssueFinalReviewChangedPaths({
+      worktreePath: options.worktreePath ?? process.cwd(),
+      baseRef: options.baseRef
+    });
+    const declaredChangedFiles = new Set(
+      parsed.changedFiles.map(
+        (file) => normalizeGitPath(String(file.path))
+      )
+    );
+    const missing = expectedChangedFiles.filter(
+      (path9) => !declaredChangedFiles.has(path9)
+    );
+    if (missing.length > 0) {
+      return {
+        ok: false,
+        reason: `pass verdict changedFiles is missing ${missing.length} changed file(s): ${missing.join(", ")}`,
+        diagnostics: [
+          ...diagnostics,
+          `baseRef: ${options.baseRef}`,
+          `missingChangedFiles: ${missing.join(", ")}`
+        ]
+      };
+    }
+    diagnostics.push(
+      `changedFiles coverage: ${expectedChangedFiles.length} files from ${options.baseRef}`
+    );
+  }
   if (!Array.isArray(parsed.outOfScopeFiles) || !parsed.outOfScopeFiles.every((p) => typeof p === "string")) {
     return {
       ok: false,
@@ -3627,9 +3656,44 @@ function runValidateArtifactCommand(options) {
     ...options,
     artifactPath,
     latestReviewArtifactPath,
-    worktreePath: options.repoRoot
+    worktreePath: options.repoRoot,
+    baseRef: options.baseRef
   });
 }
+function listIssueFinalReviewChangedPaths(options) {
+  const trackedDiff = String(
+    execSync(`git diff-index --name-only ${shellQuote(options.baseRef)} --`, {
+      cwd: options.worktreePath,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    })
+  );
+  const untrackedFiles = String(
+    execSync("git ls-files --others --exclude-standard", {
+      cwd: options.worktreePath,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    })
+  );
+  return Array.from(
+    /* @__PURE__ */ new Set([
+      ...parseGitPathList(trackedDiff),
+      ...parseGitPathList(untrackedFiles)
+    ])
+  ).filter(isIssueFinalReviewAuditedPath);
+}
+function parseGitPathList(output) {
+  return output.split(/\r?\n/).map(normalizeGitPath).filter((path9) => path9.length > 0);
+}
+function normalizeGitPath(path9) {
+  return path9.replace(/^"|"$/g, "").replace(/\\/g, "/").replace(/^\.\/+/g, "").replace(/\/+$/g, "");
+}
+function isIssueFinalReviewAuditedPath(path9) {
+  return path9 !== "" && path9 !== ".pourkit/state.json" && !path9.startsWith(".pourkit/.tmp/") && !path9.startsWith(".pourkit/logs/");
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
 function runLocalValidateArtifactCommand(options) {
   const resolvedPath = resolve3(options.repoRoot, options.artifactPath);
   const resolvedExtra = (options.extraArgs ?? []).map(
@@ -4935,7 +4999,7 @@ async function canReachMcp(url) {
       return true;
     } catch {
       if (attempt < 9) {
-        await new Promise((resolve5) => setTimeout(resolve5, 100));
+        await new Promise((resolve6) => setTimeout(resolve6, 100));
       }
     }
   }
@@ -6671,7 +6735,11 @@ async function runIssueFinalReviewAgent(options) {
   const strategy = target.strategy;
   const issueFinalReview = strategy.issueFinalReview;
   const agent = issueFinalReview;
-  const prompt = loadIssueFinalReviewPrompt(repoRoot2, agent.promptTemplate);
+  const prompt = loadIssueFinalReviewPrompt({
+    repoRoot: repoRoot2,
+    promptTemplate: agent.promptTemplate,
+    validationCommand: `pourkit validate-artifact issue-final-review ${artifactPathInWorktree} --issue-number ${issue.number} --branch-name ${builderBranch} --base-ref origin/${target.baseBranch}`
+  });
   const entry = await executeWithMissingOrEmptyArtifactRetry({
     executionProvider,
     missingOrEmptyRetries: resolveMissingOrEmptyOutputRetries(agent),
@@ -6764,7 +6832,8 @@ function extractChangedPaths(parsed) {
     (file) => file && typeof file === "object" ? file.path : void 0
   ).filter((path9) => typeof path9 === "string") : [];
 }
-function loadIssueFinalReviewPrompt(repoRoot2, promptTemplate) {
+function loadIssueFinalReviewPrompt(options) {
+  const { repoRoot: repoRoot2, promptTemplate, validationCommand } = options;
   const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
   const promptBody = existsSync12(promptPath) ? readFileSync14(promptPath, "utf-8") : promptTemplate;
   return appendProtectedWorkGuidance(`${promptBody}
@@ -6780,7 +6849,24 @@ Read the selected issue requirements, PRD context, comments, branch context, ver
 - Run the commands exactly as configured. Do not substitute narrower commands unless the configured command cannot run.
 - If a configured command fails, keep reviewing after recording the failure details; use the failure output as review evidence.
 - If a command cannot run because the environment is missing required setup, dependencies, or scripts outside agent control, treat it as a human handoff blocker.
-- If no verification commands are configured, note that and proceed with normal review.`);
+- If no verification commands are configured, note that and proceed with normal review.
+
+## Changed Files Audit
+
+- Read the Branch section of ${RUN_CONTEXT_PATH_IN_WORKTREE} and use its Canonical Base Ref for the changed-file inventory.
+- Before writing \`changedFiles\`, run \`git diff-index --name-only <canonical-base-ref> --\` from the Worktree to enumerate tracked files changed by the Issue.
+- Also run \`git ls-files --others --exclude-standard\` from the Worktree to enumerate untracked files changed by the Issue.
+- Treat the union of those command outputs, excluding only \`.pourkit/.tmp/**\`, \`.pourkit/logs/**\`, and \`.pourkit/state.json\`, as the required \`changedFiles\` inventory.
+- Include every file from that inventory in \`changedFiles\`, including generated files, managed operating assets, docs, prompts, schema files, and large batches.
+- If any file from the inventory is out-of-scope, mark it \`out-of-scope\` and either self-retouch it away or return \`needs_human_review\`; do not omit it.
+- Do not return \`pass\` until \`changedFiles\` covers the full inventory.
+
+## Required Artifact Validation
+
+- Before handoff, run exactly: \`${validationCommand}\`
+- This validation checks both the artifact shape and \`changedFiles\` coverage against the canonical Git diff.
+- If validation fails, fix the artifact or safely retouch the worktree as needed, then rerun the same command.
+- Do not finish until the validation command passes.`);
 }
 
 // commands/issue-run.ts
@@ -6899,7 +6985,7 @@ async function advanceIssueFinalReview(options) {
     logger
   });
   if (result.verdict === "pass") {
-    await assertIssueFinalReviewCoversActualDiff({
+    const changedPaths = await completeIssueFinalReviewChangedPaths({
       worktreePath,
       baseRef: `origin/${target.baseBranch}`,
       declaredChangedPaths: result.changedPaths,
@@ -6911,10 +6997,14 @@ async function advanceIssueFinalReview(options) {
         verdict: "pass",
         artifactPath: result.artifactPath,
         selfRetouched: result.selfRetouched,
-        changedPaths: result.changedPaths,
+        changedPaths,
         verificationPassed: result.verificationPassed
       }
     });
+    return {
+      ...result,
+      changedPaths
+    };
   }
   return result;
 }
@@ -7629,18 +7719,21 @@ async function assertCanonicalBaseAncestor(options) {
     );
   }
 }
-async function assertIssueFinalReviewCoversActualDiff(options) {
-  const actualChangedPaths = await listIssueFinalReviewChangedPaths(options);
-  const declared = new Set(options.declaredChangedPaths.map(normalizeGitPath));
+async function completeIssueFinalReviewChangedPaths(options) {
+  const actualChangedPaths = await listIssueFinalReviewChangedPaths2(options);
+  const declared = new Set(options.declaredChangedPaths.map(normalizeGitPath2));
   const missing = actualChangedPaths.filter((path9) => !declared.has(path9));
   if (missing.length === 0) {
-    return;
+    return actualChangedPaths;
   }
-  throw new Error(
-    `Issue Final Review pass did not enumerate all changed files. Missing from changedFiles: ${missing.join(", ")}. Re-run Issue Final Review or remove out-of-scope files before finalization.`
+  options.logger.step(
+    "warn",
+    `Issue Final Review pass omitted ${missing.length} changed file(s) from changedFiles; using git inventory for finalization state.`
   );
+  options.logger.kv("MISSING_CHANGED_FILES", missing.join(", "));
+  return actualChangedPaths;
 }
-async function listIssueFinalReviewChangedPaths(options) {
+async function listIssueFinalReviewChangedPaths2(options) {
   const trackedDiff = await execCapture(
     "git",
     ["diff-index", "--name-only", options.baseRef, "--"],
@@ -7661,18 +7754,18 @@ async function listIssueFinalReviewChangedPaths(options) {
   );
   return Array.from(
     /* @__PURE__ */ new Set([
-      ...parseGitPathList(trackedDiff.stdout),
-      ...parseGitPathList(untrackedFiles.stdout)
+      ...parseGitPathList2(trackedDiff.stdout),
+      ...parseGitPathList2(untrackedFiles.stdout)
     ])
-  ).filter(isIssueFinalReviewAuditedPath);
+  ).filter(isIssueFinalReviewAuditedPath2);
 }
-function parseGitPathList(output) {
-  return output.split(/\r?\n/).map(normalizeGitPath).filter((path9) => path9.length > 0);
+function parseGitPathList2(output) {
+  return output.split(/\r?\n/).map(normalizeGitPath2).filter((path9) => path9.length > 0);
 }
-function normalizeGitPath(path9) {
+function normalizeGitPath2(path9) {
   return path9.replace(/^"|"$/g, "").replace(/\\/g, "/").replace(/^\.\/+/, "").replace(/\/+$/, "");
 }
-function isIssueFinalReviewAuditedPath(path9) {
+function isIssueFinalReviewAuditedPath2(path9) {
   return path9 !== "" && path9 !== WORKTREE_RUN_STATE_PATH && !path9.startsWith(".pourkit/.tmp/") && !path9.startsWith(".pourkit/logs/");
 }
 async function syncRemoteBaseRef(worktreePath, baseRef, logger) {
@@ -11933,8 +12026,124 @@ async function tryCreateGitHubClient(options) {
   return { ok: true, client: { octokit, ...repo } };
 }
 
+// workflow-pack.ts
+var BASELINE_MANAGED_SKILLS = [
+  "code-review",
+  "diagnose",
+  "explain",
+  "grill-with-docs",
+  "handoff",
+  "improve-codebase-architecture",
+  "publish-prd",
+  "secret-commit-guard",
+  "security-review",
+  "ship-current-changes",
+  "tdd",
+  "to-issues",
+  "to-plan",
+  "to-prd",
+  "triage",
+  "write-a-skill",
+  "zoom-out"
+];
+var RELEASE_ADDON_SKILLS = ["changeset", "promote-release"];
+var RELEASE_ADDON_DOCS = ["release-workflow.md"];
+var MANAGED_DOCS = [
+  "git-workflow.md",
+  "issue-tracker.md",
+  "naming.md",
+  "triage-labels.md",
+  "commit-style.md",
+  "domain.md"
+];
+var MANAGED_PROMPTS = [
+  "builder.prompt.md",
+  "conflict-resolution.prompt.md",
+  "failure-resolution.prompt.md",
+  "finalizer.prompt.md",
+  "issue-final-review.prompt.md",
+  "pr-description.prompt.md",
+  "refactor.prompt.md",
+  "reviewer.prompt.md",
+  "reviewer-correctness.snippet.md",
+  "reviewer-quality.snippet.md",
+  "reviewer-scope.snippet.md",
+  "reviewer-tests.snippet.md"
+];
+var OPENCODE_PROJECTION = {
+  harness: "opencode",
+  path: ".agents/skills"
+};
+var CURRENT_VERSION = "0.0.0-next";
+function getWorkflowPackCatalog() {
+  return {
+    docs: [...MANAGED_DOCS],
+    prompts: [...MANAGED_PROMPTS],
+    baselineSkills: [...BASELINE_MANAGED_SKILLS],
+    releaseAddonDocs: [...RELEASE_ADDON_DOCS],
+    releaseAddonSkills: [...RELEASE_ADDON_SKILLS],
+    projections: [OPENCODE_PROJECTION]
+  };
+}
+function buildOpenCodeSkillProjectionContent(managedSourcePath, sourceContent) {
+  const generatedNotice = `Generated from ${managedSourcePath}. Do not edit directly.`;
+  if (managedSourcePath.endsWith(".md") || managedSourcePath.endsWith(".mdx")) {
+    return `<!-- ${generatedNotice} -->
+${sourceContent}`;
+  }
+  if (managedSourcePath.endsWith(".sh") || managedSourcePath.endsWith(".bash") || managedSourcePath.endsWith(".zsh") || managedSourcePath.endsWith(".py") || managedSourcePath.endsWith(".rb") || managedSourcePath.endsWith(".yml") || managedSourcePath.endsWith(".yaml") || managedSourcePath.endsWith(".toml")) {
+    const comment = `# ${generatedNotice}`;
+    if (sourceContent.startsWith("#!")) {
+      const lineBreakIndex = sourceContent.indexOf("\n");
+      if (lineBreakIndex === -1) {
+        return `${sourceContent}
+${comment}
+`;
+      }
+      return `${sourceContent.slice(0, lineBreakIndex + 1)}${comment}
+${sourceContent.slice(lineBreakIndex + 1)}`;
+    }
+    return `${comment}
+${sourceContent}`;
+  }
+  return sourceContent;
+}
+function getBaselineManagedSkillNames() {
+  return BASELINE_MANAGED_SKILLS;
+}
+function getWorkflowPackVersion() {
+  return CURRENT_VERSION;
+}
+function buildWorkflowPackMetadata(enabledAddons) {
+  return {
+    version: getWorkflowPackVersion(),
+    enabledAddons,
+    projections: [OPENCODE_PROJECTION]
+  };
+}
+
 // commands/init.ts
 var execFileAsync2 = promisify2(execFile2);
+var RELEASE_ADDON_SKILL_NAMES = ["changeset", "promote-release"];
+var BASELINE_SKILL_NAMES = [
+  "code-review",
+  "diagnose",
+  "explain",
+  "grill-with-docs",
+  "handoff",
+  "improve-codebase-architecture",
+  "publish-prd",
+  "secret-commit-guard",
+  "security-review",
+  "ship-current-changes",
+  "tdd",
+  "to-issues",
+  "to-plan",
+  "to-prd",
+  "triage",
+  "write-a-skill",
+  "zoom-out"
+];
 var NO_TOKEN_LABEL_PROVISIONING_WARNING = "Skipped GitHub label provisioning because no GitHub token was provided.";
 var ALLOWED_VERIFICATION_SCRIPTS = [
   "typecheck",
@@ -12077,26 +12286,26 @@ function generateConfigTemplate(options) {
         builder: {
           agent: "pourkit-builder",
           model: "opencode-go/deepseek-v4-flash",
-          promptTemplate: ".pourkit/prompts/builder.prompt.md"
+          promptTemplate: ".pourkit/managed/prompts/builder.prompt.md"
         }
       },
       failureResolution: {
         agent: "pourkit-failure-resolution-agent",
         model: "opencode-go/mimo-v2.5",
-        promptTemplate: ".pourkit/prompts/failure-resolution.prompt.md",
+        promptTemplate: ".pourkit/managed/prompts/failure-resolution.prompt.md",
         maxAttemptsPerFailure: 1
       },
       review: {
         reviewer: {
           agent: "pourkit-reviewer",
           model: "opencode-go/deepseek-v4-pro",
-          promptTemplate: ".pourkit/prompts/reviewer.prompt.md",
+          promptTemplate: ".pourkit/managed/prompts/reviewer.prompt.md",
           criteria: ["correctness", "scope", "tests", "quality"]
         },
         refactor: {
           agent: "pourkit-refactor",
           model: "opencode-go/qwen3.6-plus",
-          promptTemplate: ".pourkit/prompts/refactor.prompt.md"
+          promptTemplate: ".pourkit/managed/prompts/refactor.prompt.md"
         },
         maxIterations: 3,
         passWithNotesRefactorAttempts: 2
@@ -12104,14 +12313,14 @@ function generateConfigTemplate(options) {
       issueFinalReview: {
         agent: "pourkit-reviewer",
         model: "opencode-go/deepseek-v4-pro",
-        promptTemplate: ".pourkit/prompts/issue-final-review.prompt.md",
+        promptTemplate: ".pourkit/managed/prompts/issue-final-review.prompt.md",
         maxAttempts: 3
       },
       finalize: {
         prDescriptionAgent: {
           agent: "pourkit-pr-description",
           model: "opencode-go/deepseek-v4-flash",
-          promptTemplate: ".pourkit/prompts/pr-description.prompt.md"
+          promptTemplate: ".pourkit/managed/prompts/pr-description.prompt.md"
         },
         maxAttempts: 2
       }
@@ -12131,6 +12340,17 @@ function generateConfigTemplate(options) {
     $schema: "./schema/pourkit.schema.json",
     schemaVersion: 1,
     targets: [target],
+    workflowPack: {
+      version: "1.0.0",
+      skillProjections: [{ harness: "opencode", path: ".agents/skills" }]
+    },
+    releaseWorkflow: options.releaseWorkflow?.enabled ? {
+      enabled: true,
+      integrationBranch: options.releaseWorkflow.integrationBranch ?? "integration",
+      developmentReleaseBranch: options.releaseWorkflow.developmentReleaseBranch ?? "preview",
+      stableReleaseBranch: options.releaseWorkflow.stableReleaseBranch ?? "stable",
+      changesets: options.releaseWorkflow.changesets ?? true
+    } : { enabled: false },
     labels: {
       readyForAgent: labels.readyForAgent,
       agentInProgress: labels.agentInProgress,
@@ -12278,18 +12498,33 @@ _Avoid_: Alternative terms
 - <Document ambiguous terms and their resolution here.>
 `;
 }
-async function generateManagedAgentInstructions(options) {
-  const sourcePath = path5.join(options.sourceRoot, "AGENTS.md");
-  try {
-    return await readFile5(sourcePath, "utf-8");
-  } catch {
-    return `## Codebase exploration
+async function generateManagedAgentInstructions(_options) {
+  return `## Codebase exploration
 
 Use \`fd\` for file discovery, \`rg\` for text search, and direct file reads for focused context.
 
-Follow the project's domain docs and conventions documented in \`.pourkit/docs/agents/*\`.
+Follow the project's domain docs and conventions documented in \`.pourkit/managed/docs/agents/*\`.
+
+### Managed operating docs
+
+- \`.pourkit/managed/docs/agents/issue-tracker.md\`
+- \`.pourkit/managed/docs/agents/triage-labels.md\`
+- \`.pourkit/managed/docs/agents/naming.md\`
+- \`.pourkit/managed/docs/agents/git-workflow.md\`
+- \`.pourkit/managed/docs/agents/commit-style.md\`
+- \`.pourkit/managed/docs/agents/domain.md\`
+
+### Project-owned context
+
+- \`.pourkit/CONTEXT.md\`
+- \`.pourkit/CONTEXT-MAP.md\`
+- \`.pourkit/docs/adr/*\`
+
+### Important
+
+- Do not edit \`.pourkit/managed/*\` unless explicitly updating Pourkit-managed assets.
+- Do not edit generated harness projections directly.
 `;
-  }
 }
 function generateGitignoreBlock() {
   const lines = [
@@ -12655,11 +12890,28 @@ async function planInit(options) {
       }
       const plannedSkillDests = /* @__PURE__ */ new Set();
       for (const op of operations) {
-        if (op.kind === "copy" && op.path?.includes(".agents/skills")) {
+        if (op.path?.includes(".agents/skills")) {
           plannedSkillDests.add(op.path);
         }
       }
-      const srcSkills = await discoverAgentSkills(sourceRoot);
+      const packagedManagedSkills = path5.join(
+        sourceRoot,
+        "pourkit",
+        "managed",
+        "skills"
+      );
+      const packagedReleaseAddonSkills = path5.join(
+        sourceRoot,
+        "pourkit",
+        "managed",
+        "addons",
+        "release",
+        "skills"
+      );
+      const srcSkills = existsSync18(packagedManagedSkills) ? [
+        packagedManagedSkills,
+        ...existsSync18(packagedReleaseAddonSkills) ? [packagedReleaseAddonSkills] : []
+      ] : await discoverAgentSkills(sourceRoot);
       for (const s of srcSkills) {
         const isOpenCode = s.includes(".opencode");
         if (isOpenCode && !options.legacySkills) {
@@ -12671,35 +12923,118 @@ async function planInit(options) {
           });
           continue;
         }
-        const targetDirName = ".agents/skills";
-        const targetPath = path5.join(targetRoot, targetDirName);
-        const skillFiles = await walkDir(s);
-        for (const file of skillFiles) {
-          const relPath = path5.relative(s, file);
-          const destPath = path5.join(targetPath, relPath);
-          if (plannedSkillDests.has(destPath)) {
+        if (isOpenCode) {
+          const skillFiles = await walkDir(s);
+          for (const file of skillFiles) {
+            const relPath = path5.relative(s, file);
+            const destPath = path5.join(
+              targetRoot,
+              ".agents",
+              "skills",
+              relPath
+            );
+            if (!existsSync18(destPath)) {
+              operations.push({
+                kind: "copy",
+                sourcePath: file,
+                path: destPath,
+                ownership: "project-owned",
+                reason: `Migrate legacy skill: ${path5.join(".opencode/skills", relPath)}`,
+                requiresConfirmation: false,
+                destructive: false
+              });
+            }
+          }
+          continue;
+        }
+        const managedSkillsDir = path5.join(
+          targetRoot,
+          ".pourkit",
+          "managed",
+          "skills"
+        );
+        const projectionSkillsDir = path5.join(targetRoot, ".agents", "skills");
+        const entries = await readdir(s, { withFileTypes: true });
+        const skillNames = entries.filter((e) => e.isDirectory()).map((e) => e.name);
+        const addonManagedDir = path5.join(
+          targetRoot,
+          ".pourkit",
+          "managed",
+          "addons",
+          "release",
+          "skills"
+        );
+        for (const skillName of skillNames) {
+          const isReleaseAddon = RELEASE_ADDON_SKILL_NAMES.includes(skillName);
+          const isBaseline = BASELINE_SKILL_NAMES.includes(skillName);
+          if (isReleaseAddon) {
+            if (!options.releaseWorkflow?.enabled) {
+              operations.push({
+                kind: "skip",
+                reason: `Release add-on skill not enabled: ${skillName}`,
+                requiresConfirmation: false,
+                destructive: false
+              });
+              continue;
+            }
+          } else if (!isBaseline) {
             operations.push({
               kind: "skip",
-              path: destPath,
-              ownership: "project-owned",
-              reason: `Skill destination conflict, skipping source copy: ${path5.join(targetDirName, relPath)}`,
+              reason: `Non-baseline skill not installed: ${skillName}`,
               requiresConfirmation: false,
-              destructive: false,
-              conflict: "destination already planned"
+              destructive: false
             });
             continue;
           }
-          const checksum = await computeFileChecksum(file);
-          operations.push({
-            kind: "copy",
-            sourcePath: file,
-            path: destPath,
-            ownership: "copied-customizable",
-            reason: `Copy skill: ${path5.join(targetDirName, relPath)}`,
-            requiresConfirmation: false,
-            destructive: false,
-            checksum
-          });
+          const skillSourceDir = path5.join(s, skillName);
+          const skillFiles = await walkDir(skillSourceDir);
+          for (const file of skillFiles) {
+            const relPath = path5.relative(skillSourceDir, file);
+            const managedDest = isReleaseAddon ? path5.join(addonManagedDir, skillName, relPath) : path5.join(managedSkillsDir, skillName, relPath);
+            const checksum = await computeFileChecksum(file);
+            const installLabel = isReleaseAddon ? `Install release add-on skill: ${skillName}/${relPath}` : `Install managed skill: ${skillName}/${relPath}`;
+            operations.push({
+              kind: "copy",
+              sourcePath: file,
+              path: managedDest,
+              ownership: "managed",
+              reason: installLabel,
+              requiresConfirmation: false,
+              destructive: false,
+              checksum
+            });
+            const projectionDest = path5.join(
+              projectionSkillsDir,
+              skillName,
+              relPath
+            );
+            if (plannedSkillDests.has(projectionDest)) {
+              operations.push({
+                kind: "skip",
+                path: projectionDest,
+                ownership: "project-owned",
+                reason: `Skill destination conflict, skipping projection: ${skillName}/${relPath}`,
+                requiresConfirmation: false,
+                destructive: false,
+                conflict: "destination already planned"
+              });
+              continue;
+            }
+            const sourceContent = await readFile5(file, "utf-8");
+            const managedSourcePath = isReleaseAddon ? `.pourkit/managed/addons/release/skills/${skillName}/${relPath}` : `.pourkit/managed/skills/${skillName}/${relPath}`;
+            operations.push({
+              kind: "create",
+              path: projectionDest,
+              ownership: "managed",
+              reason: `Project skill: ${skillName}/${relPath}`,
+              requiresConfirmation: false,
+              destructive: false,
+              content: buildOpenCodeSkillProjectionContent(
+                managedSourcePath,
+                sourceContent
+              )
+            });
+          }
         }
       }
       const srcReadme = await discoverReadme(sourceRoot);
@@ -12792,7 +13127,7 @@ async function planInit(options) {
         operations.push({
           kind: "create",
           path: contextPath,
-          ownership: "managed",
+          ownership: "project-owned",
           reason: "Init CONTEXT.md scaffold",
           requiresConfirmation: false,
           destructive: false,
@@ -12816,16 +13151,41 @@ async function planInit(options) {
           destructive: false
         });
       }
-      const srcDocAgents = path5.join(sourceRoot, ".pourkit", "docs", "agents");
-      const tgtDocAgents = path5.join(targetRoot, ".pourkit", "docs", "agents");
-      if (existsSync18(srcDocAgents) && !existsSync18(tgtDocAgents)) {
+      const packagedManagedDocAgents = path5.join(
+        sourceRoot,
+        "pourkit",
+        "managed",
+        "docs",
+        "agents"
+      );
+      const legacyDocAgents = path5.join(
+        sourceRoot,
+        ".pourkit",
+        "docs",
+        "agents"
+      );
+      const srcDocAgents = existsSync18(packagedManagedDocAgents) ? packagedManagedDocAgents : legacyDocAgents;
+      const tgtManagedDocAgents = path5.join(
+        targetRoot,
+        ".pourkit",
+        "managed",
+        "docs",
+        "agents"
+      );
+      const tgtStubDocAgents = path5.join(
+        targetRoot,
+        ".pourkit",
+        "docs",
+        "agents"
+      );
+      if (existsSync18(srcDocAgents) && !existsSync18(tgtManagedDocAgents)) {
         const docFiles = await walkDir(srcDocAgents);
         for (const file of docFiles) {
           const relPath = path5.relative(srcDocAgents, file);
           if (relPath === "triage-labels.md") {
             operations.push({
               kind: "create",
-              path: path5.join(tgtDocAgents, relPath),
+              path: path5.join(tgtManagedDocAgents, relPath),
               ownership: "managed",
               reason: "Init triage labels doc",
               requiresConfirmation: false,
@@ -12834,24 +13194,94 @@ async function planInit(options) {
                 options.labels ?? DEFAULT_RUNNER_LABELS
               )
             });
-            continue;
+          } else {
+            const checksum = await computeFileChecksum(file);
+            operations.push({
+              kind: "copy",
+              sourcePath: file,
+              path: path5.join(tgtManagedDocAgents, relPath),
+              ownership: "managed",
+              reason: `Copy agent doc: ${relPath}`,
+              requiresConfirmation: false,
+              destructive: false,
+              checksum
+            });
           }
-          const checksum = await computeFileChecksum(file);
+          if (relPath === "triage-labels.md") continue;
+          const managedRelPath = path5.join(
+            ".pourkit",
+            "managed",
+            "docs",
+            "agents",
+            relPath
+          );
           operations.push({
-            kind: "copy",
-            sourcePath: file,
-            path: path5.join(tgtDocAgents, relPath),
+            kind: "create",
+            path: path5.join(tgtStubDocAgents, relPath),
             ownership: "managed",
-            reason: `Copy agent doc: ${relPath}`,
+            reason: `Create moved stub for: ${relPath}`,
             requiresConfirmation: false,
             destructive: false,
-            checksum
+            content: `# Moved
+
+This Pourkit operating doc moved to \`${managedRelPath}\`.
+Do not edit this file.
+`
           });
         }
       }
-      const srcPrompts = path5.join(sourceRoot, ".pourkit", "prompts");
-      const tgtPrompts = path5.join(targetRoot, ".pourkit", "prompts");
-      if (existsSync18(srcPrompts) && !existsSync18(tgtPrompts)) {
+      if (options.releaseWorkflow?.enabled) {
+        const packagedReleaseAddonDocs = path5.join(
+          sourceRoot,
+          "pourkit",
+          "managed",
+          "addons",
+          "release",
+          "docs",
+          "agents"
+        );
+        const tgtReleaseAddonDocs = path5.join(
+          targetRoot,
+          ".pourkit",
+          "managed",
+          "addons",
+          "release",
+          "docs",
+          "agents"
+        );
+        if (existsSync18(packagedReleaseAddonDocs)) {
+          const docFiles = await walkDir(packagedReleaseAddonDocs);
+          for (const file of docFiles) {
+            const relPath = path5.relative(packagedReleaseAddonDocs, file);
+            const checksum = await computeFileChecksum(file);
+            operations.push({
+              kind: "copy",
+              sourcePath: file,
+              path: path5.join(tgtReleaseAddonDocs, relPath),
+              ownership: "managed",
+              reason: `Install release add-on doc: ${relPath}`,
+              requiresConfirmation: false,
+              destructive: false,
+              checksum
+            });
+          }
+        }
+      }
+      const packagedManagedPrompts = path5.join(
+        sourceRoot,
+        "pourkit",
+        "managed",
+        "prompts"
+      );
+      const legacyPrompts = path5.join(sourceRoot, ".pourkit", "prompts");
+      const srcPrompts = existsSync18(packagedManagedPrompts) ? packagedManagedPrompts : legacyPrompts;
+      const tgtManagedPrompts = path5.join(
+        targetRoot,
+        ".pourkit",
+        "managed",
+        "prompts"
+      );
+      if (existsSync18(srcPrompts) && !existsSync18(tgtManagedPrompts)) {
         const promptFiles = await walkDir(srcPrompts);
         for (const file of promptFiles) {
           const relPath = path5.relative(srcPrompts, file);
@@ -12859,7 +13289,7 @@ async function planInit(options) {
           operations.push({
             kind: "copy",
             sourcePath: file,
-            path: path5.join(tgtPrompts, relPath),
+            path: path5.join(tgtManagedPrompts, relPath),
             ownership: "managed",
             reason: `Copy prompt: ${relPath}`,
             requiresConfirmation: false,
@@ -12911,7 +13341,8 @@ async function planInit(options) {
           baseBranch,
           verificationCommands: verifyCommands,
           hasPackageJson,
-          labels: options.labels
+          labels: options.labels,
+          releaseWorkflow: options.releaseWorkflow
         });
         operations.push({
           kind: "create",
@@ -13156,7 +13587,8 @@ ${gitignoreContent}${MANAGED_BLOCK_END}
     sourceRoot: sourceRoot ?? "",
     operations,
     warnings,
-    hasLabelConflicts
+    hasLabelConflicts,
+    enabledAddons: options.releaseWorkflow?.enabled ? ["release"] : []
   };
 }
 var GROUP_LABELS = {
@@ -13228,6 +13660,7 @@ async function promptForInitChoices(plan, current) {
   let packageManager = current.packageManager;
   let legacySkills = current.legacySkills ?? false;
   let noGitCheck = current.noGitCheck ?? false;
+  let releaseWorkflow;
   const labels = current.labels ? { ...current.labels } : { ...DEFAULT_RUNNER_LABELS };
   if (!packageManager && plan.warnings.some((w) => w.toLowerCase().includes("lockfile"))) {
     const result = await select({
@@ -13247,6 +13680,7 @@ async function promptForInitChoices(plan, current) {
         legacySkills,
         noGitCheck,
         labels,
+        releaseWorkflow,
         cancelled: true
       };
     }
@@ -13270,6 +13704,7 @@ async function promptForInitChoices(plan, current) {
         legacySkills,
         noGitCheck,
         labels,
+        releaseWorkflow,
         cancelled: true
       };
     }
@@ -13295,6 +13730,7 @@ async function promptForInitChoices(plan, current) {
         legacySkills,
         noGitCheck,
         labels,
+        releaseWorkflow,
         cancelled: true
       };
     }
@@ -13413,11 +13849,84 @@ async function promptForInitChoices(plan, current) {
         legacySkills,
         noGitCheck,
         labels,
+        releaseWorkflow,
         cancelled: true
       };
     }
     noGitCheck = true;
   }
+  const releaseEnabledResult = await confirm({
+    message: "Enable the Release Workflow Add-On for Changesets and Promotion PR orchestration?",
+    initialValue: false
+  });
+  if (isCancel(releaseEnabledResult)) {
+    return {
+      docsMigration: docsMigration ?? "copy",
+      agentFile: agentFile ?? "both",
+      packageManager,
+      legacySkills,
+      noGitCheck,
+      labels,
+      releaseWorkflow: void 0,
+      cancelled: true
+    };
+  }
+  if (releaseEnabledResult) {
+    const integrationBranchResult = await text({
+      message: "Integration Branch name (e.g. dev)?",
+      placeholder: "integration"
+    });
+    if (isCancel(integrationBranchResult)) {
+      return {
+        docsMigration: docsMigration ?? "copy",
+        agentFile: agentFile ?? "both",
+        packageManager,
+        legacySkills,
+        noGitCheck,
+        labels,
+        releaseWorkflow: void 0,
+        cancelled: true
+      };
+    }
+    const devReleaseBranchResult = await text({
+      message: "Development Release Branch name (e.g. next)?",
+      placeholder: "preview"
+    });
+    if (isCancel(devReleaseBranchResult)) {
+      return {
+        docsMigration: docsMigration ?? "copy",
+        agentFile: agentFile ?? "both",
+        packageManager,
+        legacySkills,
+        noGitCheck,
+        labels,
+        releaseWorkflow: void 0,
+        cancelled: true
+      };
+    }
+    const stableReleaseBranchResult = await text({
+      message: "Stable Release Branch name (e.g. main)?",
+      placeholder: "stable"
+    });
+    if (isCancel(stableReleaseBranchResult)) {
+      return {
+        docsMigration: docsMigration ?? "copy",
+        agentFile: agentFile ?? "both",
+        packageManager,
+        legacySkills,
+        noGitCheck,
+        labels,
+        releaseWorkflow: void 0,
+        cancelled: true
+      };
+    }
+    releaseWorkflow = {
+      enabled: true,
+      integrationBranch: typeof integrationBranchResult === "string" && integrationBranchResult.trim().length > 0 ? integrationBranchResult.trim() : "integration",
+      developmentReleaseBranch: typeof devReleaseBranchResult === "string" && devReleaseBranchResult.trim().length > 0 ? devReleaseBranchResult.trim() : "preview",
+      stableReleaseBranch: typeof stableReleaseBranchResult === "string" && stableReleaseBranchResult.trim().length > 0 ? stableReleaseBranchResult.trim() : "stable"
+    };
+  }
   return {
     docsMigration: docsMigration ?? "copy",
     agentFile: agentFile ?? "both",
@@ -13425,6 +13934,7 @@ async function promptForInitChoices(plan, current) {
     legacySkills,
     noGitCheck,
     labels,
+    releaseWorkflow,
     cancelled: false
   };
 }
@@ -13490,6 +14000,7 @@ async function writeManifest(plan, sourceMeta, agentFiles, packageManager) {
     },
     agentFiles,
     packageManager,
+    workflowPack: buildWorkflowPackMetadata(plan.enabledAddons ?? []),
     assets
   };
   await mkdir5(manifestDir, { recursive: true });
@@ -13766,7 +14277,8 @@ async function runInitCommand(options) {
       agentFile: options.agentFile ?? promptResult.agentFile,
       packageManager: options.packageManager ?? promptResult.packageManager,
       legacySkills: options.legacySkills ?? promptResult.legacySkills,
-      noGitCheck: options.noGitCheck ?? promptResult.noGitCheck
+      noGitCheck: options.noGitCheck ?? promptResult.noGitCheck,
+      releaseWorkflow: options.releaseWorkflow ?? promptResult.releaseWorkflow
     };
     promptLabels = promptResult.labels;
   }
@@ -13784,7 +14296,8 @@ async function runInitCommand(options) {
     packageManager: options.packageManager,
     noGitCheck: options.noGitCheck,
     skipInstall: options.skipInstall,
-    labels: planLabels
+    labels: planLabels,
+    releaseWorkflow: options.releaseWorkflow
   });
   let planLabelConflictPolicy = "skip-metadata-changes";
   if (isInteractive && plan.hasLabelConflicts) {
@@ -13990,8 +14503,8 @@ async function runSerenaStatusCommand(options) {
 
 // commands/config-schema.ts
 import { readFileSync as readFileSync20, existsSync as existsSync19 } from "fs";
-import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile3 } from "fs/promises";
-import { resolve as resolve4, dirname as dirname5 } from "path";
+import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile3, readdir as readdir2 } from "fs/promises";
+import { resolve as resolve4, dirname as dirname5, relative as relative2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import Ajv2 from "ajv";
 var __filename2 = fileURLToPath2(import.meta.url);
@@ -14028,33 +14541,569 @@ function readPackagedHash() {
 function localSchemaDir(repoRoot2) {
   return resolve4(repoRoot2, ".pourkit/schema");
 }
-async function runDoctorCommand(options) {
-  const repoRootPath = options.cwd ?? process.cwd();
-  const schemaDir = localSchemaDir(repoRootPath);
-  const localSchemaPath = resolve4(schemaDir, "pourkit.schema.json");
-  const localHashPath = resolve4(schemaDir, "pourkit.schema.hash");
-  const localSchemaExists = existsSync19(localSchemaPath);
-  const localHashExists = existsSync19(localHashPath);
-  let packagedHash = null;
+var MANAGED_BLOCK_BEGIN2 = "<!-- BEGIN POURKIT MANAGED BLOCK -->\n";
+var OLD_DOCS_PATH_PATTERN = ".pourkit/docs/agents/";
+function resolvePackagedManagedPath(...segments) {
+  return resolve4(__dirname2, "..", "managed", ...segments);
+}
+function resolvePackagedManagedDocPath(docName) {
+  return resolvePackagedManagedPath("docs", "agents", docName);
+}
+function resolvePackagedReleaseAddonDocPath(docName) {
+  return resolvePackagedManagedPath(
+    "addons",
+    "release",
+    "docs",
+    "agents",
+    docName
+  );
+}
+async function readPackagedTextFile(filePath) {
   try {
-    packagedHash = readPackagedHash();
+    return await readFile6(filePath, "utf-8");
   } catch {
+    return null;
   }
-  let localHashContent = null;
-  if (localHashExists) {
-    try {
-      localHashContent = await readFile6(localHashPath, "utf-8");
-    } catch {
+}
+function isPathContained(parent, child) {
+  const relativePath = relative2(parent, child);
+  return !relativePath.startsWith("..") && !relativePath.startsWith("../");
+}
+async function walkDir2(dir) {
+  const files = [];
+  try {
+    const entries = await readdir2(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = resolve4(dir, entry.name);
+      if (entry.isDirectory()) {
+        files.push(...await walkDir2(full));
+      } else {
+        files.push(full);
+      }
     }
+  } catch {
+    return [];
   }
-  const schema = !localSchemaExists ? "missing" : !packagedHash || !localHashContent ? "missing" : localHashContent.trim() === packagedHash.trim() ? "fresh" : "stale";
-  const hash = !localHashExists ? "missing" : !packagedHash ? "missing" : localHashContent && localHashContent.trim() === packagedHash.trim() ? "fresh" : "stale";
-  const overall = schema === "fresh" && hash === "fresh" ? "fresh" : schema === "missing" || hash === "missing" ? "missing" : "stale";
-  const configPath = resolve4(repoRootPath, ".pourkit/config.json");
-  let configValidation;
-  if (existsSync19(configPath)) {
-    try {
-      const raw = JSON.parse(readFileSync20(configPath, "utf-8"));
+  return files;
+}
+function removeCodeFences(content) {
+  return content.replace(/```[\s\S]*?```/g, "");
+}
+function isInsideBacktick(content, index) {
+  const before = content.slice(0, index);
+  const backtickCount = (before.match(/`/g) || []).length;
+  return backtickCount % 2 === 1;
+}
+var BRANCH_NAME_PATTERN = /\b(dev|next|main)\b/g;
+var OBSOLETE_PRD_PATTERN = /PRD-\d{3}(?![\dNn])/g;
+var OVERWIDE_PRD_PATTERN = /PRD-\d{5,}/g;
+function isExampleLine(content, matchIndex) {
+  return /^(?:[-*]\s+)?Example:/i.test(getLine(content, matchIndex).trim());
+}
+function getLine(content, matchIndex) {
+  const lineStart = content.lastIndexOf("\n", matchIndex - 1) + 1;
+  const lineEnd = content.indexOf("\n", matchIndex);
+  return content.slice(lineStart, lineEnd === -1 ? content.length : lineEnd);
+}
+function isBranchPolicyLine(content, matchIndex) {
+  const line = getLine(content, matchIndex).toLowerCase();
+  return /->|\b(branch|branches|lane|release|promotion|promote|target|base|merge|push|hotfix|changeset|origin)\b/.test(
+    line
+  );
+}
+function scanManagedPolicyText(content, filePath, allowlist) {
+  const violations = [];
+  const noFences = removeCodeFences(content);
+  let match;
+  BRANCH_NAME_PATTERN.lastIndex = 0;
+  while ((match = BRANCH_NAME_PATTERN.exec(noFences)) !== null) {
+    if (isExampleLine(noFences, match.index)) continue;
+    if (!isBranchPolicyLine(noFences, match.index)) continue;
+    if (allowlist?.includes(match[0])) continue;
+    violations.push({
+      path: filePath,
+      phrase: match[0],
+      reason: "hardcoded_branch_policy"
+    });
+  }
+  OBSOLETE_PRD_PATTERN.lastIndex = 0;
+  while ((match = OBSOLETE_PRD_PATTERN.exec(noFences)) !== null) {
+    if (allowlist?.includes(match[0])) continue;
+    if (!isInsideBacktick(noFences, match.index)) {
+      violations.push({
+        path: filePath,
+        phrase: match[0],
+        reason: "obsolete_prd_placeholder"
+      });
+    }
+  }
+  OVERWIDE_PRD_PATTERN.lastIndex = 0;
+  while ((match = OVERWIDE_PRD_PATTERN.exec(noFences)) !== null) {
+    if (allowlist?.includes(match[0])) continue;
+    if (!isInsideBacktick(noFences, match.index)) {
+      violations.push({
+        path: filePath,
+        phrase: match[0],
+        reason: "obsolete_prd_placeholder"
+      });
+    }
+  }
+  return violations;
+}
+async function validateWorkflowPack(cwd) {
+  const failures = [];
+  const warnings = [];
+  const catalog = getWorkflowPackCatalog();
+  const baselineSkills = getBaselineManagedSkillNames();
+  for (const docName of catalog.docs) {
+    const localPath = resolve4(cwd, `.pourkit/managed/docs/agents/${docName}`);
+    if (!existsSync19(localPath)) {
+      failures.push({
+        severity: "failure",
+        kind: "missing_managed_asset",
+        path: `.pourkit/managed/docs/agents/${docName}`,
+        message: `Missing managed doc: ${docName}`
+      });
+    } else {
+      const packagedPath = resolvePackagedManagedDocPath(docName);
+      const packagedContent = await readPackagedTextFile(packagedPath);
+      if (packagedContent !== null) {
+        try {
+          const localContent = await readFile6(localPath, "utf-8");
+          if (localContent !== packagedContent) {
+            const overridePath = resolve4(
+              cwd,
+              `.pourkit/overrides/docs/agents/${docName}`
+            );
+            if (existsSync19(overridePath)) {
+              warnings.push({
+                severity: "warning",
+                kind: "overridden",
+                path: `.pourkit/overrides/docs/agents/${docName}`,
+                message: `Managed doc ${docName} is overridden by explicit override.`
+              });
+            } else {
+              failures.push({
+                severity: "failure",
+                kind: "managed_asset_drift",
+                path: `.pourkit/managed/docs/agents/${docName}`,
+                message: `Managed doc ${docName} content differs from packaged source. Run 'pourkit sync workflow-pack' to repair.`
+              });
+            }
+          }
+        } catch {
+        }
+      }
+    }
+  }
+  for (const skillName of baselineSkills) {
+    const skillDir = resolve4(cwd, `.pourkit/managed/skills/${skillName}`);
+    if (!existsSync19(skillDir)) {
+      failures.push({
+        severity: "failure",
+        kind: "missing_managed_asset",
+        path: `.pourkit/managed/skills/${skillName}`,
+        message: `Missing managed skill: ${skillName}`
+      });
+    } else {
+      const skillSourcePath = resolve4(skillDir, "SKILL.md");
+      if (existsSync19(skillSourcePath)) {
+        const packagedSkillPath = resolvePackagedManagedPath(
+          "skills",
+          skillName,
+          "SKILL.md"
+        );
+        const packagedContent = await readPackagedTextFile(packagedSkillPath);
+        if (packagedContent !== null) {
+          try {
+            const localContent = await readFile6(skillSourcePath, "utf-8");
+            if (localContent !== packagedContent) {
+              const overridePath = resolve4(
+                cwd,
+                `.pourkit/overrides/skills/${skillName}/SKILL.md`
+              );
+              if (existsSync19(overridePath)) {
+                warnings.push({
+                  severity: "warning",
+                  kind: "overridden",
+                  path: `.pourkit/overrides/skills/${skillName}/SKILL.md`,
+                  message: `Managed skill ${skillName} is overridden by explicit override.`
+                });
+              } else {
+                failures.push({
+                  severity: "failure",
+                  kind: "managed_asset_drift",
+                  path: `.pourkit/managed/skills/${skillName}/SKILL.md`,
+                  message: `Managed skill ${skillName} content differs from packaged source. Run 'pourkit sync workflow-pack' to repair.`
+                });
+              }
+            }
+          } catch {
+          }
+        }
+      }
+    }
+  }
+  for (const promptName of catalog.prompts) {
+    const promptPath = resolve4(cwd, `.pourkit/managed/prompts/${promptName}`);
+    if (!existsSync19(promptPath)) {
+      failures.push({
+        severity: "failure",
+        kind: "missing_managed_asset",
+        path: `.pourkit/managed/prompts/${promptName}`,
+        message: `Missing managed prompt: ${promptName}`
+      });
+    }
+  }
+  for (const skillName of baselineSkills) {
+    const projectionDir = resolve4(cwd, `.agents/skills/${skillName}`);
+    if (!existsSync19(projectionDir)) {
+      warnings.push({
+        severity: "warning",
+        kind: "projection_stale",
+        path: `.agents/skills/${skillName}`,
+        message: `Missing skill projection for ${skillName}. Run 'pourkit sync workflow-pack' to regenerate.`
+      });
+    } else {
+      const projectionPath = resolve4(projectionDir, "SKILL.md");
+      if (existsSync19(projectionPath)) {
+        const managedSourcePath = resolvePackagedManagedPath(
+          "skills",
+          skillName,
+          "SKILL.md"
+        );
+        const packagedContent = await readPackagedTextFile(managedSourcePath);
+        if (packagedContent !== null) {
+          try {
+            const projectionContent = await readFile6(projectionPath, "utf-8");
+            const managedSourceRelativePath = `.pourkit/managed/skills/${skillName}/SKILL.md`;
+            if (projectionContent !== buildOpenCodeSkillProjectionContent(
+              managedSourceRelativePath,
+              packagedContent
+            )) {
+              warnings.push({
+                severity: "warning",
+                kind: "projection_stale",
+                path: `.agents/skills/${skillName}/SKILL.md`,
+                message: `Projection for ${skillName} differs from managed source. Run 'pourkit sync workflow-pack' to regenerate.`
+              });
+            }
+          } catch {
+          }
+        }
+      }
+    }
+  }
+  const agentsPath = resolve4(cwd, "AGENTS.md");
+  if (existsSync19(agentsPath)) {
+    try {
+      const agentsContent = await readFile6(agentsPath, "utf-8");
+      if (agentsContent.includes(OLD_DOCS_PATH_PATTERN)) {
+        failures.push({
+          severity: "failure",
+          kind: "router_drift",
+          path: "AGENTS.md",
+          message: "AGENTS.md references old .pourkit/docs/agents/ paths. Update to .pourkit/managed/docs/agents/."
+        });
+      }
+      if (!agentsContent.includes(MANAGED_BLOCK_BEGIN2.trim())) {
+        failures.push({
+          severity: "failure",
+          kind: "router_drift",
+          path: "AGENTS.md",
+          message: "AGENTS.md is missing the Pourkit managed block. Run 'pourkit sync workflow-pack' to add it."
+        });
+      }
+    } catch {
+    }
+  }
+  const overridesDir = resolve4(cwd, ".pourkit/overrides");
+  if (existsSync19(overridesDir)) {
+    const overrideFiles = await walkDir2(overridesDir);
+    for (const file of overrideFiles) {
+      const relPath = relative2(cwd, file);
+      if (!warnings.some((w) => w.kind === "overridden" && w.path === relPath)) {
+        warnings.push({
+          severity: "warning",
+          kind: "overridden",
+          path: relPath,
+          message: `Explicit override present: ${relPath}`
+        });
+      }
+    }
+  }
+  const configPath = resolve4(cwd, ".pourkit/config.json");
+  if (existsSync19(configPath)) {
+    try {
+      const configContent = await readFile6(configPath, "utf-8");
+      const parsed = JSON.parse(configContent);
+      const releaseEnabled = parsed.releaseWorkflow?.enabled === true;
+      if (releaseEnabled) {
+        for (const skillName of catalog.releaseAddonSkills) {
+          const addonDir = resolve4(
+            cwd,
+            `.pourkit/managed/addons/release/skills/${skillName}`
+          );
+          if (!existsSync19(addonDir)) {
+            failures.push({
+              severity: "failure",
+              kind: "release_config_conflict",
+              path: `.pourkit/managed/addons/release/skills/${skillName}`,
+              message: `Release workflow is enabled but release addon skill ${skillName} is not installed. Run 'pourkit sync workflow-pack' to install.`
+            });
+          }
+        }
+        for (const docName of catalog.releaseAddonDocs) {
+          const addonDocPath = resolve4(
+            cwd,
+            `.pourkit/managed/addons/release/docs/agents/${docName}`
+          );
+          if (!existsSync19(addonDocPath)) {
+            failures.push({
+              severity: "failure",
+              kind: "release_config_conflict",
+              path: `.pourkit/managed/addons/release/docs/agents/${docName}`,
+              message: `Release workflow is enabled but release addon doc ${docName} is not installed. Run 'pourkit sync workflow-pack' to install.`
+            });
+          } else {
+            const packagedContent = await readPackagedTextFile(
+              resolvePackagedReleaseAddonDocPath(docName)
+            );
+            if (packagedContent !== null) {
+              const localContent = await readFile6(addonDocPath, "utf-8");
+              if (localContent !== packagedContent) {
+                failures.push({
+                  severity: "failure",
+                  kind: "managed_asset_drift",
+                  path: `.pourkit/managed/addons/release/docs/agents/${docName}`,
+                  message: `Release addon doc ${docName} content differs from packaged source. Run 'pourkit sync workflow-pack' to repair.`
+                });
+              }
+            }
+          }
+        }
+        const rw = parsed.releaseWorkflow;
+        const requiredFields = [
+          ["integrationBranch", rw?.integrationBranch],
+          ["developmentReleaseBranch", rw?.developmentReleaseBranch],
+          ["stableReleaseBranch", rw?.stableReleaseBranch]
+        ];
+        for (const [fieldName, value] of requiredFields) {
+          if (!value || typeof value === "string" && value.trim() === "") {
+            failures.push({
+              severity: "failure",
+              kind: "release_config_conflict",
+              message: `Release workflow is enabled but required field releaseWorkflow.${fieldName} is missing or empty.`
+            });
+          }
+        }
+      } else {
+        for (const skillName of catalog.releaseAddonSkills) {
+          const addonDir = resolve4(
+            cwd,
+            `.pourkit/managed/addons/release/skills/${skillName}`
+          );
+          if (existsSync19(addonDir)) {
+            failures.push({
+              severity: "failure",
+              kind: "release_config_conflict",
+              path: `.pourkit/managed/addons/release/skills/${skillName}`,
+              message: `Release workflow is disabled but release addon skill ${skillName} is present as active baseline policy. Disable or remove the addon skill.`
+            });
+          }
+        }
+        for (const docName of catalog.releaseAddonDocs) {
+          const addonDocPath = resolve4(
+            cwd,
+            `.pourkit/managed/addons/release/docs/agents/${docName}`
+          );
+          if (existsSync19(addonDocPath)) {
+            failures.push({
+              severity: "failure",
+              kind: "release_config_conflict",
+              path: `.pourkit/managed/addons/release/docs/agents/${docName}`,
+              message: `Release workflow is disabled but release addon doc ${docName} is present as active baseline policy. Disable or remove the addon doc.`
+            });
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  const manifestPath = resolve4(cwd, ".pourkit/manifest.json");
+  if (existsSync19(manifestPath)) {
+    try {
+      const manifestContent = await readFile6(manifestPath, "utf-8");
+      const manifest = JSON.parse(manifestContent);
+      const wp = manifest.workflowPack;
+      if (wp?.projections) {
+        for (const proj of wp.projections) {
+          if (proj.path) {
+            const resolved = resolve4(cwd, proj.path);
+            if (!isPathContained(cwd, resolved)) {
+              failures.push({
+                severity: "failure",
+                kind: "path_escape",
+                message: `Manifest projection path escapes repository: ${proj.path}`
+              });
+            }
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  const pathEscapeOverrideDir = resolve4(cwd, ".pourkit/overrides");
+  if (existsSync19(pathEscapeOverrideDir)) {
+    const overrideFiles = await walkDir2(pathEscapeOverrideDir);
+    for (const file of overrideFiles) {
+      if (!isPathContained(cwd, file)) {
+        failures.push({
+          severity: "failure",
+          kind: "path_escape",
+          path: relative2(cwd, file),
+          message: `Override file path escapes repository: ${relative2(cwd, file)}`
+        });
+      }
+    }
+  }
+  const managedDocsDir = resolve4(cwd, ".pourkit/managed/docs/agents");
+  if (existsSync19(managedDocsDir)) {
+    const docFiles = await walkDir2(managedDocsDir);
+    for (const file of docFiles) {
+      if (!file.endsWith(".md")) continue;
+      try {
+        const content = await readFile6(file, "utf-8");
+        const relPath = relative2(cwd, file);
+        const violations = scanManagedPolicyText(content, relPath);
+        for (const v of violations) {
+          failures.push({
+            severity: "failure",
+            kind: "terminology_policy_violation",
+            path: v.path,
+            message: `Policy violation: "${v.phrase}" is a ${v.reason === "hardcoded_branch_policy" ? "hardcoded branch name in policy context" : "obsolete or over-wide PRD placeholder"}.`
+          });
+        }
+      } catch {
+      }
+    }
+  }
+  const managedSkillsDir = resolve4(cwd, ".pourkit/managed/skills");
+  if (existsSync19(managedSkillsDir)) {
+    const skillDirs = await readdir2(managedSkillsDir, { withFileTypes: true });
+    for (const entry of skillDirs) {
+      if (!entry.isDirectory()) continue;
+      const skillFile = resolve4(managedSkillsDir, entry.name, "SKILL.md");
+      if (!existsSync19(skillFile)) continue;
+      try {
+        const content = await readFile6(skillFile, "utf-8");
+        const relPath = relative2(cwd, skillFile);
+        const violations = scanManagedPolicyText(content, relPath);
+        for (const v of violations) {
+          failures.push({
+            severity: "failure",
+            kind: "terminology_policy_violation",
+            path: v.path,
+            message: `Policy violation: "${v.phrase}" is a ${v.reason === "hardcoded_branch_policy" ? "hardcoded branch name in policy context" : "obsolete or over-wide PRD placeholder"}.`
+          });
+        }
+      } catch {
+      }
+    }
+  }
+  const managedPromptsDir = resolve4(cwd, ".pourkit/managed/prompts");
+  if (existsSync19(managedPromptsDir)) {
+    for (const promptName of catalog.prompts) {
+      const promptFile = resolve4(managedPromptsDir, promptName);
+      if (!existsSync19(promptFile)) continue;
+      try {
+        const content = await readFile6(promptFile, "utf-8");
+        const relPath = relative2(cwd, promptFile);
+        const violations = scanManagedPolicyText(content, relPath);
+        for (const v of violations) {
+          failures.push({
+            severity: "failure",
+            kind: "terminology_policy_violation",
+            path: v.path,
+            message: `Policy violation: "${v.phrase}" is a ${v.reason === "hardcoded_branch_policy" ? "hardcoded branch name in policy context" : "obsolete or over-wide PRD placeholder"}.`
+          });
+        }
+      } catch {
+      }
+    }
+  }
+  for (const skillName of catalog.releaseAddonSkills) {
+    const addonSkillFile = resolve4(
+      cwd,
+      `.pourkit/managed/addons/release/skills/${skillName}/SKILL.md`
+    );
+    if (!existsSync19(addonSkillFile)) continue;
+    try {
+      const content = await readFile6(addonSkillFile, "utf-8");
+      const relPath = relative2(cwd, addonSkillFile);
+      const violations = scanManagedPolicyText(content, relPath);
+      for (const v of violations) {
+        failures.push({
+          severity: "failure",
+          kind: "terminology_policy_violation",
+          path: v.path,
+          message: `Policy violation: "${v.phrase}" is a ${v.reason === "hardcoded_branch_policy" ? "hardcoded branch name in policy context" : "obsolete or over-wide PRD placeholder"}.`
+        });
+      }
+    } catch {
+    }
+  }
+  for (const docName of catalog.releaseAddonDocs) {
+    const addonDocFile = resolve4(
+      cwd,
+      `.pourkit/managed/addons/release/docs/agents/${docName}`
+    );
+    if (!existsSync19(addonDocFile)) continue;
+    try {
+      const content = await readFile6(addonDocFile, "utf-8");
+      const relPath = relative2(cwd, addonDocFile);
+      const violations = scanManagedPolicyText(content, relPath);
+      for (const v of violations) {
+        failures.push({
+          severity: "failure",
+          kind: "terminology_policy_violation",
+          path: v.path,
+          message: `Policy violation: "${v.phrase}" is a ${v.reason === "hardcoded_branch_policy" ? "hardcoded branch name in policy context" : "obsolete or over-wide PRD placeholder"}.`
+        });
+      }
+    } catch {
+    }
+  }
+  const status = failures.length > 0 ? "failed" : warnings.length > 0 ? "warning" : "fresh";
+  return { status, failures, warnings };
+}
+async function runDoctorCommand(options) {
+  const repoRootPath = options.cwd ?? process.cwd();
+  const schemaDir = localSchemaDir(repoRootPath);
+  const localSchemaPath = resolve4(schemaDir, "pourkit.schema.json");
+  const localHashPath = resolve4(schemaDir, "pourkit.schema.hash");
+  const localSchemaExists = existsSync19(localSchemaPath);
+  const localHashExists = existsSync19(localHashPath);
+  let packagedHash = null;
+  try {
+    packagedHash = readPackagedHash();
+  } catch {
+  }
+  let localHashContent = null;
+  if (localHashExists) {
+    try {
+      localHashContent = await readFile6(localHashPath, "utf-8");
+    } catch {
+    }
+  }
+  const schema = !localSchemaExists ? "missing" : !packagedHash || !localHashContent ? "missing" : localHashContent.trim() === packagedHash.trim() ? "fresh" : "stale";
+  const hash = !localHashExists ? "missing" : !packagedHash ? "missing" : localHashContent && localHashContent.trim() === packagedHash.trim() ? "fresh" : "stale";
+  const overall = schema === "fresh" && hash === "fresh" ? "fresh" : schema === "missing" || hash === "missing" ? "missing" : "stale";
+  const configPath = resolve4(repoRootPath, ".pourkit/config.json");
+  let configValidation;
+  if (existsSync19(configPath)) {
+    try {
+      const raw = JSON.parse(readFileSync20(configPath, "utf-8"));
       const validate = getSchemaValidator();
       const valid2 = validate(raw);
       if (valid2) {
@@ -14087,30 +15136,37 @@ async function runDoctorCommand(options) {
     "pourkit.config.js",
     "pourkit.json"
   ].filter((p) => existsSync19(resolve4(repoRootPath, p)));
+  const workflowPack = await validateWorkflowPack(repoRootPath);
   let recommendation = null;
-  if (!configValidation.ok || overall !== "fresh" || obsoleteConfigs.length > 0) {
-    const parts = [];
-    if (obsoleteConfigs.length > 0) {
-      parts.push(
-        `Found obsolete config files: ${obsoleteConfigs.join(", ")}. Move configuration to .pourkit/config.json with "$schema": "./schema/pourkit.schema.json".`
-      );
-    }
-    if (!configValidation.ok) {
-      parts.push(
-        "Config validation failed; fix errors in .pourkit/config.json."
-      );
-    }
-    if (overall !== "fresh") {
-      parts.push(
-        'Run "pourkit config sync-schema" to update local schema assets.'
-      );
-    }
-    recommendation = parts.join(" ");
+  const recParts = [];
+  if (obsoleteConfigs.length > 0) {
+    recParts.push(
+      `Found obsolete config files: ${obsoleteConfigs.join(", ")}. Move configuration to .pourkit/config.json with "$schema": "./schema/pourkit.schema.json".`
+    );
+  }
+  if (!configValidation.ok) {
+    recParts.push(
+      "Config validation failed; fix errors in .pourkit/config.json."
+    );
+  }
+  if (overall !== "fresh") {
+    recParts.push(
+      'Run "pourkit config sync-schema" to update local schema assets.'
+    );
+  }
+  if (workflowPack.status === "failed" || workflowPack.status === "warning") {
+    recParts.push(
+      'Run "pourkit sync workflow-pack" to repair workflow pack issues.'
+    );
+  }
+  if (recParts.length > 0) {
+    recommendation = recParts.join(" ");
   }
   return {
     configValidation,
     obsoleteConfigs,
     schemaAssets: { schema, hash, overall },
+    workflowPack,
     recommendation
   };
 }
@@ -14151,6 +15207,576 @@ async function runConfigSyncSchemaCommand(options) {
   };
 }
 
+// commands/workflow-pack-sync.ts
+import { existsSync as existsSync20, readdirSync as readdirSync5 } from "fs";
+import { mkdir as mkdir7, readFile as readFile7, writeFile as writeFile4, readdir as readdir3 } from "fs/promises";
+import { resolve as resolve5, dirname as dirname6, relative as relative3, normalize as normalize2 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+var __filename3 = fileURLToPath3(import.meta.url);
+var __dirname3 = dirname6(__filename3);
+var PROJECT_OWNED_PATHS = [".pourkit/CONTEXT.md", ".pourkit/CONTEXT-MAP.md"];
+var PROJECT_OWNED_DIRECTORIES = [
+  ".pourkit/docs/adr",
+  ".pourkit/plans",
+  ".pourkit/handoffs"
+];
+var OVERRIDES_DIR = ".pourkit/overrides";
+var MANAGED_BLOCK_BEGIN3 = "<!-- BEGIN POURKIT MANAGED BLOCK -->\n";
+var MANAGED_BLOCK_END2 = "\n<!-- END POURKIT MANAGED BLOCK -->";
+function resolvePackagedManagedPath2(...segments) {
+  const candidates = [resolve5(__dirname3, "..", "managed", ...segments)];
+  return candidates[0];
+}
+function resolvePackagedManagedDocPath2(docName) {
+  return resolvePackagedManagedPath2("docs", "agents", docName);
+}
+function resolvePackagedReleaseAddonDocPath2(docName) {
+  return resolvePackagedManagedPath2(
+    "addons",
+    "release",
+    "docs",
+    "agents",
+    docName
+  );
+}
+function resolvePackagedManagedSkillDir(skillName) {
+  return resolvePackagedManagedPath2("skills", skillName);
+}
+function resolvePackagedManagedPromptPath(promptName) {
+  return resolvePackagedManagedPath2("prompts", promptName);
+}
+async function readPackagedTextFile2(filePath) {
+  try {
+    return await readFile7(filePath, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function isPathContained2(parent, child) {
+  const relativePath = relative3(parent, child);
+  return !relativePath.startsWith("..") && !relativePath.startsWith("../");
+}
+function isProjectOwnedPath(relativePath) {
+  for (const owned of PROJECT_OWNED_PATHS) {
+    if (relativePath === owned || relativePath.startsWith(owned + "/")) {
+      return true;
+    }
+  }
+  for (const ownedDir of PROJECT_OWNED_DIRECTORIES) {
+    if (relativePath.startsWith(ownedDir + "/") || relativePath === ownedDir + "/") {
+      return true;
+    }
+  }
+  return false;
+}
+function getManagedRelativePath(overrideRelativePath) {
+  if (!overrideRelativePath.startsWith(OVERRIDES_DIR + "/")) {
+    return null;
+  }
+  const managedPath = overrideRelativePath.slice(OVERRIDES_DIR.length + 1);
+  if (managedPath.startsWith("skills/") || managedPath.startsWith("docs/") || managedPath.startsWith("prompts/")) {
+    return `.pourkit/managed/${managedPath}`;
+  }
+  return null;
+}
+function findOverrideForManagedPath(existingOverrides, targetRelativePath, overridePath) {
+  if (existingOverrides.some(
+    (o) => o === overridePath || o.startsWith(overridePath + "/")
+  )) {
+    return overridePath;
+  }
+  if (existingOverrides.some((o) => {
+    const managedPath = getManagedRelativePath(o);
+    return managedPath === targetRelativePath;
+  })) {
+    return overridePath;
+  }
+  return null;
+}
+function checkForPathEscape(cwd, resolvedPath) {
+  const normalizedCwd = normalize2(cwd);
+  const normalizedPath = normalize2(resolvedPath);
+  if (!isPathContained2(normalizedCwd, normalizedPath)) {
+    return `Path escape detected: ${resolvedPath} is outside ${cwd}`;
+  }
+  return null;
+}
+async function walkDir3(dir) {
+  const files = [];
+  try {
+    const entries = await readdir3(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = resolve5(dir, entry.name);
+      if (entry.isDirectory()) {
+        files.push(...await walkDir3(full));
+      } else {
+        files.push(full);
+      }
+    }
+  } catch {
+  }
+  return files;
+}
+function generateManagedBlockContent() {
+  return [
+    "This repository uses Pourkit.",
+    "",
+    "## Managed operating docs",
+    "",
+    "Follow the managed operating docs under `.pourkit/managed/docs/agents/*`:",
+    "",
+    "- `.pourkit/managed/docs/agents/issue-tracker.md`",
+    "- `.pourkit/managed/docs/agents/triage-labels.md`",
+    "- `.pourkit/managed/docs/agents/naming.md`",
+    "- `.pourkit/managed/docs/agents/git-workflow.md`",
+    "- `.pourkit/managed/docs/agents/commit-style.md`",
+    "- `.pourkit/managed/docs/agents/domain.md`",
+    "",
+    "### Project-owned context",
+    "",
+    "- `.pourkit/CONTEXT.md`",
+    "- `.pourkit/CONTEXT-MAP.md`",
+    "- `.pourkit/docs/adr/*`",
+    "- `.pourkit/plans/*`",
+    "- `.pourkit/handoffs/*`",
+    "",
+    "### Important",
+    "",
+    "- Do not edit `.pourkit/managed/*` unless explicitly updating Pourkit-managed assets.",
+    "- Do not edit generated harness projections directly.",
+    ""
+  ].join("\n");
+}
+async function syncFile(cwd, targetRelativePath, sourceContent, errors) {
+  if (sourceContent === null) {
+    return false;
+  }
+  const targetPath = resolve5(cwd, targetRelativePath);
+  const escapeError = checkForPathEscape(cwd, targetPath);
+  if (escapeError) {
+    errors.push(escapeError);
+    return false;
+  }
+  await mkdir7(resolve5(targetPath, ".."), { recursive: true });
+  if (existsSync20(targetPath)) {
+    const existing = await readFile7(targetPath, "utf-8");
+    if (existing === sourceContent) {
+      return false;
+    }
+  }
+  await writeFile4(targetPath, sourceContent, "utf-8");
+  return true;
+}
+function walkDirSync(dir) {
+  const result = [];
+  try {
+    const entries = readdirSync5(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = resolve5(dir, entry.name);
+      if (entry.isDirectory()) {
+        result.push(...walkDirSync(full));
+      } else {
+        result.push(full);
+      }
+    }
+  } catch {
+  }
+  return result;
+}
+async function detectOverrides(cwd) {
+  const overridesDir = resolve5(cwd, OVERRIDES_DIR);
+  if (!existsSync20(overridesDir)) {
+    return [];
+  }
+  const files = await walkDir3(overridesDir);
+  return files.map((f) => relative3(cwd, f));
+}
+async function detectProjectOwnedFiles(cwd) {
+  const found = [];
+  for (const ownedPath of PROJECT_OWNED_PATHS) {
+    const fullPath = resolve5(cwd, ownedPath);
+    if (existsSync20(fullPath)) {
+      found.push(ownedPath);
+    }
+  }
+  for (const ownedDir of PROJECT_OWNED_DIRECTORIES) {
+    const fullDir = resolve5(cwd, ownedDir);
+    if (existsSync20(fullDir)) {
+      const files = await walkDir3(fullDir);
+      for (const file of files) {
+        found.push(relative3(cwd, file));
+      }
+    }
+  }
+  return found;
+}
+async function isReleaseWorkflowEnabled(cwd) {
+  try {
+    const configPath = resolve5(cwd, ".pourkit", "config.json");
+    const content = await readFile7(configPath, "utf-8");
+    const parsed = JSON.parse(content);
+    return parsed.releaseWorkflow?.enabled === true;
+  } catch {
+    return false;
+  }
+}
+async function runWorkflowPackSyncCommand(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const catalog = getWorkflowPackCatalog();
+  const updated = [];
+  const regeneratedProjections = [];
+  const skippedProjectOwned = [];
+  const overrides = [];
+  const errors = [];
+  const existingOverrides = await detectOverrides(cwd);
+  const existingProjectOwned = await detectProjectOwnedFiles(cwd);
+  for (const docName of catalog.docs) {
+    const targetRelativePath = `.pourkit/managed/docs/agents/${docName}`;
+    if (isProjectOwnedPath(targetRelativePath)) {
+      skippedProjectOwned.push(targetRelativePath);
+      continue;
+    }
+    const overridePath = `.pourkit/overrides/docs/agents/${docName}`;
+    if (findOverrideForManagedPath(
+      existingOverrides,
+      targetRelativePath,
+      overridePath
+    )) {
+      overrides.push(overridePath);
+      continue;
+    }
+    const sourcePath = resolvePackagedManagedDocPath2(docName);
+    const sourceContent = await readPackagedTextFile2(sourcePath);
+    if (sourceContent === null) {
+      errors.push(`Missing packaged managed doc: ${docName}`);
+      continue;
+    }
+    const written = await syncFile(
+      cwd,
+      targetRelativePath,
+      sourceContent,
+      errors
+    );
+    if (written) {
+      updated.push(targetRelativePath);
+    }
+  }
+  const baselineSkills = getBaselineManagedSkillNames();
+  const syncAcc = {
+    updated,
+    regeneratedProjections,
+    skippedProjectOwned,
+    overrides,
+    errors
+  };
+  const syncCtx = { cwd, existingOverrides };
+  for (const skillName of baselineSkills) {
+    await syncSkill(skillName, catalog, syncAcc, syncCtx);
+  }
+  const releaseEnabled = await isReleaseWorkflowEnabled(cwd);
+  if (releaseEnabled) {
+    for (const skillName of catalog.releaseAddonSkills) {
+      await syncAddonSkill(skillName, syncAcc, syncCtx);
+    }
+  }
+  if (releaseEnabled) {
+    for (const docName of catalog.releaseAddonDocs) {
+      const targetRelativePath = `.pourkit/managed/addons/release/docs/agents/${docName}`;
+      const overridePath = `.pourkit/overrides/addons/release/docs/agents/${docName}`;
+      if (findOverrideForManagedPath(
+        existingOverrides,
+        targetRelativePath,
+        overridePath
+      )) {
+        overrides.push(overridePath);
+        continue;
+      }
+      const sourcePath = resolvePackagedReleaseAddonDocPath2(docName);
+      const sourceContent = await readPackagedTextFile2(sourcePath);
+      if (sourceContent === null) {
+        errors.push(`Missing packaged release addon doc: ${docName}`);
+        continue;
+      }
+      const written = await syncFile(
+        cwd,
+        targetRelativePath,
+        sourceContent,
+        errors
+      );
+      if (written) {
+        updated.push(targetRelativePath);
+      }
+    }
+  }
+  for (const promptName of catalog.prompts) {
+    const targetRelativePath = `.pourkit/managed/prompts/${promptName}`;
+    if (isProjectOwnedPath(targetRelativePath)) {
+      skippedProjectOwned.push(targetRelativePath);
+      continue;
+    }
+    const overridePath = `.pourkit/overrides/prompts/${promptName}`;
+    if (findOverrideForManagedPath(
+      existingOverrides,
+      targetRelativePath,
+      overridePath
+    )) {
+      overrides.push(overridePath);
+      continue;
+    }
+    const sourcePath = resolvePackagedManagedPromptPath(promptName);
+    const sourceContent = await readPackagedTextFile2(sourcePath);
+    if (sourceContent === null) {
+      errors.push(`Missing packaged managed prompt: ${promptName}`);
+      continue;
+    }
+    const written = await syncFile(
+      cwd,
+      targetRelativePath,
+      sourceContent,
+      errors
+    );
+    if (written) {
+      updated.push(targetRelativePath);
+    }
+  }
+  const schemaResult = await runConfigSyncSchemaCommand({ cwd });
+  const agentsPath = resolve5(cwd, "AGENTS.md");
+  const managedBlockContent = generateManagedBlockContent();
+  const fullManagedBlock = `${MANAGED_BLOCK_BEGIN3}${managedBlockContent}${MANAGED_BLOCK_END2}`;
+  let agentsUpdated = false;
+  if (existsSync20(agentsPath)) {
+    const existing = await readFile7(agentsPath, "utf-8");
+    const beginIdx = existing.indexOf(MANAGED_BLOCK_BEGIN3);
+    const endIdx = existing.indexOf(MANAGED_BLOCK_END2);
+    if (beginIdx !== -1 && endIdx !== -1) {
+      const beforeBlock = existing.slice(0, beginIdx);
+      const afterBlock = existing.slice(endIdx + MANAGED_BLOCK_END2.length);
+      const newContent = `${beforeBlock}${fullManagedBlock}${afterBlock}`;
+      if (newContent !== existing) {
+        await writeFile4(agentsPath, newContent, "utf-8");
+        agentsUpdated = true;
+      }
+    } else {
+      const newContent = `${existing}
+
+${fullManagedBlock}
+`;
+      if (newContent !== existing) {
+        await writeFile4(agentsPath, newContent, "utf-8");
+        agentsUpdated = true;
+      }
+    }
+  } else {
+    await writeFile4(agentsPath, fullManagedBlock + "\n", "utf-8");
+    agentsUpdated = true;
+  }
+  if (agentsUpdated) {
+    updated.push("AGENTS.md");
+  }
+  const enabledAddons = releaseEnabled ? ["release"] : [];
+  const manifestMeta = buildWorkflowPackMetadata(enabledAddons);
+  const manifestPath = resolve5(cwd, ".pourkit", "manifest.json");
+  let manifestWritten = false;
+  let previousManifestWorkflowPack = void 0;
+  try {
+    const existingRaw = await readFile7(manifestPath, "utf-8").catch(() => null);
+    if (existingRaw) {
+      const existing = JSON.parse(existingRaw);
+      previousManifestWorkflowPack = existing.workflowPack;
+    }
+  } catch {
+  }
+  if (previousManifestWorkflowPack === void 0 || JSON.stringify(previousManifestWorkflowPack) !== JSON.stringify(manifestMeta)) {
+    try {
+      const existingRaw = await readFile7(manifestPath, "utf-8").catch(
+        () => null
+      );
+      let manifest = existingRaw ? JSON.parse(existingRaw) : {};
+      manifest.workflowPack = manifestMeta;
+      await mkdir7(resolve5(manifestPath, ".."), { recursive: true });
+      await writeFile4(
+        manifestPath,
+        JSON.stringify(manifest, null, 2) + "\n",
+        "utf-8"
+      );
+      manifestWritten = true;
+    } catch {
+      errors.push("Failed to write manifest metadata");
+    }
+  }
+  for (const owned of existingProjectOwned) {
+    if (!skippedProjectOwned.includes(owned)) {
+      skippedProjectOwned.push(owned);
+    }
+  }
+  for (const overridePath of existingOverrides) {
+    const displayPath = overridePath;
+    if (!overrides.includes(displayPath)) {
+      overrides.push(displayPath);
+    }
+  }
+  const changed = updated.length > 0 || regeneratedProjections.length > 0 || schemaResult.changed || agentsUpdated || manifestWritten;
+  return {
+    changed,
+    updated,
+    regeneratedProjections,
+    skippedProjectOwned,
+    overrides,
+    errors,
+    schema: schemaResult,
+    manifestWritten
+  };
+}
+async function syncSkill(skillName, catalog, acc, ctx) {
+  const { cwd, existingOverrides } = ctx;
+  const {
+    updated,
+    regeneratedProjections,
+    skippedProjectOwned,
+    overrides,
+    errors
+  } = acc;
+  const skillDir = resolvePackagedManagedSkillDir(skillName);
+  const skillFiles = walkDirSync(skillDir);
+  if (skillFiles.length === 0) {
+    errors.push(`Missing packaged managed skill: ${skillName}`);
+    return;
+  }
+  for (const sourceFile of skillFiles) {
+    const relPath = relative3(skillDir, sourceFile);
+    const targetRelativePath = `.pourkit/managed/skills/${skillName}/${relPath}`;
+    if (isProjectOwnedPath(targetRelativePath)) {
+      skippedProjectOwned.push(targetRelativePath);
+      continue;
+    }
+    const overridePath = `.pourkit/overrides/skills/${skillName}/${relPath}`;
+    if (findOverrideForManagedPath(
+      existingOverrides,
+      targetRelativePath,
+      overridePath
+    )) {
+      if (!overrides.includes(overridePath)) {
+        overrides.push(overridePath);
+      }
+      continue;
+    }
+    const sourceContent = await readPackagedTextFile2(sourceFile);
+    if (sourceContent === null) {
+      errors.push(`Cannot read packaged skill file: ${skillName}/${relPath}`);
+      continue;
+    }
+    const written = await syncFile(
+      cwd,
+      targetRelativePath,
+      sourceContent,
+      errors
+    );
+    if (written) {
+      updated.push(targetRelativePath);
+    }
+    const projectionRelativePath = `.agents/skills/${skillName}/${relPath}`;
+    const projectionOverridePath = `.pourkit/overrides/${projectionRelativePath}`;
+    if (existingOverrides.some((o) => o === projectionOverridePath)) {
+      if (!overrides.includes(projectionOverridePath)) {
+        overrides.push(projectionOverridePath);
+      }
+      continue;
+    }
+    const managedSourcePath = `.pourkit/managed/skills/${skillName}/${relPath}`;
+    const projectionContent = buildOpenCodeSkillProjectionContent(
+      managedSourcePath,
+      sourceContent
+    );
+    const projectionWritten = await syncFile(
+      cwd,
+      projectionRelativePath,
+      projectionContent,
+      errors
+    );
+    if (projectionWritten) {
+      regeneratedProjections.push(projectionRelativePath);
+    }
+  }
+}
+async function syncAddonSkill(skillName, acc, ctx) {
+  const { cwd, existingOverrides } = ctx;
+  const {
+    updated,
+    regeneratedProjections,
+    skippedProjectOwned,
+    overrides,
+    errors
+  } = acc;
+  const addonSkillDir = resolvePackagedManagedPath2(
+    "addons",
+    "release",
+    "skills",
+    skillName
+  );
+  const skillFiles = walkDirSync(addonSkillDir);
+  if (skillFiles.length === 0) {
+    errors.push(`Missing packaged release addon skill: ${skillName}`);
+    return;
+  }
+  for (const sourceFile of skillFiles) {
+    const relPath = relative3(addonSkillDir, sourceFile);
+    const targetRelativePath = `.pourkit/managed/addons/release/skills/${skillName}/${relPath}`;
+    if (isProjectOwnedPath(targetRelativePath)) {
+      skippedProjectOwned.push(targetRelativePath);
+      continue;
+    }
+    const overridePath = `.pourkit/overrides/addons/release/skills/${skillName}/${relPath}`;
+    if (findOverrideForManagedPath(
+      existingOverrides,
+      targetRelativePath,
+      overridePath
+    )) {
+      if (!overrides.includes(overridePath)) {
+        overrides.push(overridePath);
+      }
+      continue;
+    }
+    const sourceContent = await readPackagedTextFile2(sourceFile);
+    if (sourceContent === null) {
+      errors.push(
+        `Cannot read packaged addon skill file: ${skillName}/${relPath}`
+      );
+      continue;
+    }
+    const written = await syncFile(
+      cwd,
+      targetRelativePath,
+      sourceContent,
+      errors
+    );
+    if (written) {
+      updated.push(targetRelativePath);
+    }
+    const projectionRelativePath = `.agents/skills/${skillName}/${relPath}`;
+    const projectionOverridePath = `.pourkit/overrides/${projectionRelativePath}`;
+    if (existingOverrides.some((o) => o === projectionOverridePath)) {
+      if (!overrides.includes(projectionOverridePath)) {
+        overrides.push(projectionOverridePath);
+      }
+      continue;
+    }
+    const managedSourcePath = `.pourkit/managed/addons/release/skills/${skillName}/${relPath}`;
+    const projectionContent = buildOpenCodeSkillProjectionContent(
+      managedSourcePath,
+      sourceContent
+    );
+    const projectionWritten = await syncFile(
+      cwd,
+      projectionRelativePath,
+      projectionContent,
+      errors
+    );
+    if (projectionWritten) {
+      regeneratedProjections.push(projectionRelativePath);
+    }
+  }
+}
+
 // providers/github-provider.ts
 var GitHubIssueProvider = class {
   client;
@@ -14688,7 +16314,7 @@ function formatChecks2(checks) {
 init_common();
 
 // execution/sandcastle-execution.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync9, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync9, statSync as statSync2, writeFileSync as writeFileSync7 } from "fs";
 import { join as join23 } from "path";
 import { createWorktree, opencode } from "@ai-hero/sandcastle";
 import { docker } from "@ai-hero/sandcastle/sandboxes/docker";
@@ -14696,14 +16322,14 @@ import { docker } from "@ai-hero/sandcastle/sandboxes/docker";
 // execution/execution-provider.ts
 init_common();
 import { mkdtempSync } from "fs";
-import { writeFile as writeFile4 } from "fs/promises";
+import { writeFile as writeFile5 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname6, join as join22 } from "path";
+import { dirname as dirname7, join as join22 } from "path";
 async function writeExecutionArtifacts(worktreePath, artifacts) {
   for (const artifact of artifacts) {
     const filePath = join22(worktreePath, artifact.path);
-    await ensureDir(dirname6(filePath));
-    await writeFile4(filePath, artifact.content, "utf-8");
+    await ensureDir(dirname7(filePath));
+    await writeFile5(filePath, artifact.content, "utf-8");
   }
 }
 
@@ -14713,14 +16339,14 @@ import path7 from "path";
 
 // execution/sandbox-image.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync20, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync21 } from "fs";
 import path6 from "path";
 function sandboxImageName(repoRoot2) {
   const dirName = path6.basename(repoRoot2.replace(/[\\/]+$/, "")) || "local";
   const sanitized = dirName.toLowerCase().replace(/[^a-z0-9_.-]/g, "-");
   const baseName = sanitized || "local";
   const dockerfilePath = path6.join(repoRoot2, ".sandcastle", "Dockerfile");
-  if (!existsSync20(dockerfilePath)) {
+  if (!existsSync21(dockerfilePath)) {
     return `sandcastle:${baseName}`;
   }
   const fingerprint = createHash3("sha256").update(readFileSync21(dockerfilePath)).digest("hex").slice(0, 8);
@@ -14970,7 +16596,7 @@ function sanitizeBranch(branchName) {
 function safeCopyToWorktreePaths(paths, repoRoot2, worktreePath) {
   return paths.filter((relativePath) => {
     const source = join23(repoRoot2, relativePath);
-    if (!existsSync21(source)) {
+    if (!existsSync22(source)) {
       return true;
     }
     try {
@@ -14981,7 +16607,7 @@ function safeCopyToWorktreePaths(paths, repoRoot2, worktreePath) {
       return true;
     }
     const destination = join23(worktreePath, relativePath);
-    return !existsSync21(destination);
+    return !existsSync22(destination);
   });
 }
 function formatAgentStreamEvent(event) {
@@ -15201,6 +16827,9 @@ function createCliProgram(version) {
   ).option(
     "--branch-name <name>",
     "branch name for issue-final-review artifacts"
+  ).option(
+    "--base-ref <ref>",
+    "canonical base ref for issue-final-review changedFiles coverage validation"
   ).option("--no-check-conflict-markers", "skip conflict marker scan").option("--cwd <path>", "target repository directory").action(
     (kind, artifactPath, extraPaths, options) => {
       const allowedKinds = /* @__PURE__ */ new Set([
@@ -15243,6 +16872,7 @@ function createCliProgram(version) {
         allowedDecisions: options.allowedDecision,
         issueNumber: options.issueNumber,
         branchName: options.branchName,
+        baseRef: options.baseRef,
         checkConflictMarkers: options.checkConflictMarkers
       });
       console.log(JSON.stringify(result, null, 2));
@@ -15603,7 +17233,7 @@ function createCliProgram(version) {
     const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
     const report = await runDoctorCommand({ cwd: targetRepoRoot });
     console.log(JSON.stringify(report, null, 2));
-    if (!report.configValidation.ok || report.obsoleteConfigs.length > 0 || report.schemaAssets.overall !== "fresh") {
+    if (!report.configValidation.ok || report.obsoleteConfigs.length > 0 || report.schemaAssets.overall !== "fresh" || report.workflowPack.status === "failed") {
       process.exitCode = 1;
     }
   });
@@ -15619,6 +17249,24 @@ function createCliProgram(version) {
       console.log("Schema assets are up to date.");
     }
   });
+  const syncCommand = program.command("sync").description("Sync commands for refreshing managed assets");
+  syncCommand.command("workflow-pack").description("Refresh managed workflow pack assets from packaged sources").option("--cwd <path>", "target repository directory").action(async (options) => {
+    const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
+    const result = await runWorkflowPackSyncCommand({ cwd: targetRepoRoot });
+    if (result.changed) {
+      console.log(
+        `Workflow pack sync complete: ${result.updated.length} updated, ${result.regeneratedProjections.length} projections regenerated, ${result.overrides.length} overrides, ${result.skippedProjectOwned.length} project-owned files skipped.`
+      );
+    } else {
+      console.log("Workflow pack is up to date.");
+    }
+    if (result.errors.length > 0) {
+      for (const err of result.errors) {
+        console.error(`  Error: ${err}`);
+      }
+      process.exitCode = 1;
+    }
+  });
   const serena = program.command("serena").description("Serena baseline and sidecar commands");
   serena.command("init").requiredOption("--target <name>", "target name").option("--cwd <path>", "target repository directory").action(async (options) => {
     await runSerenaInitCommand({
@@ -15744,11 +17392,11 @@ function createCliProgram(version) {
   return program;
 }
 async function resolveCliVersion() {
-  if (isPackageVersion("0.0.0-next-20260615184943")) {
-    return "0.0.0-next-20260615184943";
+  if (isPackageVersion("0.0.0-next-20260617183635")) {
+    return "0.0.0-next-20260617183635";
   }
-  if (isReleaseVersion("0.0.0-next-20260615184943")) {
-    return "0.0.0-next-20260615184943";
+  if (isReleaseVersion("0.0.0-next-20260617183635")) {
+    return "0.0.0-next-20260617183635";
   }
   try {
     const root = repoRoot();