@ps-neko/nekowork 0.1.0-alpha.3 → 0.1.0-alpha.4

package/CLAUDE.md

@@ -8,7 +8,7 @@
 
 ## 자동 갱신 영역
 
-<!-- HARNESS:START version=0.1.0-alpha.3 -->
+<!-- HARNESS:START version=0.1.0-alpha.4 -->
 <!-- 이 영역은 scripts/sync-claude-md.js 가 자동 갱신한다. 직접 편집 금지. -->
 
 ## 카탈로그 요약

package/README.md

@@ -30,7 +30,7 @@ NEKOWORK is intentionally not a 100-agent pack. Every agent, skill, hook, profil
 3. produce auditable evidence,
 4. respect Human Gate.
 
-**Public alpha evidence:** 7 packs / 9 profiles / 36 components / 5 harness targets / 7 case-study flows / 251 tests / 0 moderate+ npm audit issues / fresh `npx @alpha` smoke
+**Public alpha evidence:** 7 packs / 9 profiles / 36 components / 5 harness targets / 7 case-study flows / 252 tests / 0 moderate+ npm audit issues / fresh `npx @alpha` smoke
 
 NEKOWORK does not automatically commit, push, publish, deploy, or apply diffs. `apply` is explicit and requires verified ship-ready evidence.
 
@@ -57,10 +57,11 @@ node scripts/cli.js gate status --session first-run
 
 The simple path maps to the full evidence loop: `check = doctor --quick`, and `run = work -> verify -> ship`.
 
-To add generated harness surfaces to another local repository from a source checkout:
+To add generated harness surfaces to another local repository:
 
 ```bash
-node /path/to/harness/scripts/cli.js init --profile developer --project-root /path/to/my-project
+cd /path/to/my-project
+npx -y @ps-neko/nekowork@alpha init --profile developer --project-root .
 ```
 
 ## Example Report
@@ -139,9 +140,9 @@ NEKOWORK is for teams that want AI-assisted development without making the agent
 
 ## Status
 
-- Current repository version: `0.1.0-alpha.3`
+- Current repository version: `0.1.0-alpha.4`
 - Current package name: `@ps-neko/nekowork`
-- Current npm alpha: `@ps-neko/nekowork@0.1.0-alpha.3`
+- Current npm alpha: `@ps-neko/nekowork@0.1.0-alpha.4`
 - Supported install path today: npm alpha, clone, submodule, or local repository integration
 - Dist-tag note: use `@alpha` until a stable release; `latest` still points at the first alpha line
 - Default mode: mock providers, no API keys, no provider CLI calls
@@ -149,7 +150,7 @@ NEKOWORK is for teams that want AI-assisted development without making the agent
 Current local verification:
 
 - `npm run lint`: pass
-- `npm test`: 251 tests pass
+- `npm test`: 252 tests pass
 - `npm audit --audit-level=moderate`: 0 vulnerabilities
 - `npm pack --dry-run --json`: pass
 - `npx -y @ps-neko/nekowork@alpha check`: pass with warnings only
@@ -217,10 +218,11 @@ node scripts/cli.js gate status --session first-run
 
 `run` executes `work -> verify -> ship`. `report` turns the session evidence into a readable `REPORT.md`. It does not apply by default. `apply` is always explicit and requires a verified `SHIP_READY` live-work diff.
 
-To initialize another local repository from this checkout:
+To initialize another local repository with the published alpha:
 
 ```bash
-node /path/to/harness/scripts/cli.js init --profile developer --project-root /path/to/my-project
+cd /path/to/my-project
+npx -y @ps-neko/nekowork@alpha init --profile developer --project-root .
 ```
 
 Advanced path:
@@ -268,7 +270,15 @@ Outputs are written under:
 
 ## Use It In Another Project
 
-Recommended repository install shape:
+Shortest npm alpha install shape:
+
+```bash
+cd <target-project>
+npx -y @ps-neko/nekowork@alpha init --profile developer --project-root .
+npx -y @ps-neko/nekowork@alpha check --project-root .
+```
+
+Repository-pinned install shape:
 
 ```bash
 cd <target-project>
@@ -411,7 +421,7 @@ npm run security:hardening
 npm pack --dry-run --json
 ```
 
-`npm pack --dry-run --json` currently produces a package named like `ps-neko-nekowork-0.1.0-alpha.3.tgz`. It does not publish.
+`npm pack --dry-run --json` currently produces a package named like `ps-neko-nekowork-0.1.0-alpha.4.tgz`. It does not publish.
 
 ## Documentation
 

package/agent.yaml

@@ -1,7 +1,7 @@
 spec_version: gitagent/0.1.0
 name: nekowork
 runtime_name: harness
-version: 0.1.0-alpha.2
+version: 0.1.0-alpha.4
 description: "NEKOWORK HARNESS - Local-first multi-AI development verification runtime"
 license: MIT
 homepage: https://github.com/Ps-Neko/NEKOWORK

package/docs/ARCHITECTURE.md

@@ -202,7 +202,7 @@ Builders project the catalog into tool-specific files:
 
 ## Release State
 
-The current release line is `0.1.0-alpha.2`:
+The current release line is `0.1.0-alpha.4`:
 
 - Repository and GitHub tarball release are available.
 - Public npm alpha is published as `@ps-neko/nekowork@alpha`.

package/docs/AUDIT.md

@@ -2,23 +2,23 @@
 
 Status date: 2026-05-08
 
-This audit summarizes the current NEKOWORK state after publishing the `0.1.0-alpha.3` public alpha. It replaces the older week-by-week scratch audit, which contained stale planning notes and encoding damage.
+This audit summarizes the current NEKOWORK state after publishing the `0.1.0-alpha.4` public alpha. It replaces the older week-by-week scratch audit, which contained stale planning notes and encoding damage.
 
 ## Current Status
 
 | Area | Status | Notes |
 |---|---|---|
-| Package metadata | OK | `@ps-neko/nekowork@0.1.0-alpha.3`, `agent.yaml` uses `name: nekowork`, `runtime_name: harness` |
-| npm publish | OK | `@ps-neko/nekowork@alpha` points at `0.1.0-alpha.3` |
+| Package metadata | OK | `@ps-neko/nekowork@0.1.0-alpha.4`, `agent.yaml` uses `name: nekowork`, `runtime_name: harness`, and matching version |
+| npm publish | OK | `@ps-neko/nekowork@alpha` points at `0.1.0-alpha.4` |
 | Source install | OK | Clone, local checkout, and submodule workflows are documented |
-| Public npm alpha | OK | `docs/PUBLISH-ALPHA.md` records the first alpha publish and the `0.1.0-alpha.3` alpha update |
+| Public npm alpha | OK | `docs/PUBLISH-ALPHA.md` records the first alpha publish and the `0.1.0-alpha.4` alpha update |
 | CLI doctor/check | OK | `check`, `doctor`, `doctor --quick`, and `doctor --gemini-smoke` are available |
 | Provider auth | OK | Local delegated CLI auth is the default path |
 | Internal provider adapter | OK | `HARNESS_PROVIDER_OVERRIDE=internal` can call an explicit JSON command adapter without weakening gates |
 | Catalog | OK | 7 official packs, 11 agents, 10 skills, 5 hooks, 7 modules, 36 components, 9 profiles |
 | Multi-harness output | OK | Claude, Codex, Cursor, Gemini, and OpenCode builders are present |
 | Quick demo | OK | `npm run demo:quick` verifies the shortest no-API `doctor -> run -> report -> gate status` path |
-| Fresh npm alpha smoke | OK | CI runs `npx -y @ps-neko/nekowork@alpha doctor --quick --json` from a disposable directory |
+| Fresh npm alpha smoke | OK | CI runs `npx -y @ps-neko/nekowork@alpha check --json` from a disposable directory |
 | Report UX | OK | `report` writes inspect-only `REPORT.md` and `report-summary.json` from session evidence |
 | External demo | OK | `npm run demo:external` verifies a disposable target project flow |
 | Third-party case studies | OK | `docs/case-studies/` records real public repository runs for npm package, auth boundary, Python protocol, and environment configuration targets |
@@ -30,7 +30,7 @@ This audit summarizes the current NEKOWORK state after publishing the `0.1.0-alp
 | Persistent wakeup | OK | `wait` resumes supported active sessions and blocks on `HUMAN_GATE` |
 | Generated docs | OK | CODEMAP output is stable ASCII and reproducible |
 | Tests | OK | Unit, integration, and e2e suites pass locally and in CI |
-| Release | OK | `v0.1.0-alpha.3` is tagged and published as a GitHub prerelease |
+| Release | OK | `v0.1.0-alpha.4` is tagged and published as a GitHub prerelease |
 
 ## Verification Gates
 
@@ -55,7 +55,7 @@ Current local result for this working tree:
 - `npm run test:unit`: covered by full `npm test`
 - `npm run validate:all`: pass
 - `npm run lint`: pass
-- `npm test`: 251 tests pass
+- `npm test`: 252 tests pass
 - quick run demo: pass through `npm run demo:quick -- --cleanup`
 - external project e2e smoke: pass through `npm test`
 - `node scripts/sync-claude-md.js --check`: pass
@@ -63,9 +63,9 @@ Current local result for this working tree:
 - `npm audit --audit-level=moderate`: 0 vulnerabilities
 - `npm pack --dry-run --json`: pass
 - `npm publish --dry-run --access public --tag alpha`: pass
-- `npm publish --access public --tag alpha`: `0.1.0-alpha.3` published
-- `npm view @ps-neko/nekowork dist-tags version versions --json`: `alpha` points at `0.1.0-alpha.3`; `latest` remains `0.1.0-alpha.0`
-- `npx -y @ps-neko/nekowork@alpha check`: passed for `0.1.0-alpha.3` with WARN summary from non-git project root and Gemini auth not checked
+- `npm publish --access public --tag alpha`: `0.1.0-alpha.4` published
+- `npm view @ps-neko/nekowork dist-tags version versions --json`: `alpha` points at `0.1.0-alpha.4`; `latest` remains `0.1.0-alpha.0`
+- `npx -y @ps-neko/nekowork@alpha check`: passed for `0.1.0-alpha.4` with WARN summary from non-git project root and Gemini auth not checked
 
 ## Completed Work
 
@@ -93,7 +93,7 @@ Current local result for this working tree:
 - Official packs expose curated install shapes without creating a second safety model.
 - Checked-in example fixtures now cover financial UI, CI hardening, and quality lifecycle evidence flows.
 - Third-party case studies record NEKOWORK runs against `sindresorhus/is-plain-obj`, `jshttp/basic-auth`, `python-hyper/h11`, and `motdotla/dotenv`.
-- Public npm alpha `0.1.0-alpha.3` is published under the `alpha` dist-tag.
+- Public npm alpha `0.1.0-alpha.4` is published under the `alpha` dist-tag.
 
 ## Remaining Optional Work
 

package/docs/CATALOG-PACKS.md

@@ -20,7 +20,7 @@ Packs are public install aliases over validated profiles. They make the catalog
 5 hooks
 5 harness targets
 7 case-study flows
-251 tests
+252 tests
 ```
 
 Harness targets:

package/docs/CHANGELOG.md

@@ -7,6 +7,19 @@
 ### Added
 - No entries yet.
 
+### Changed
+- No entries yet.
+
+## [0.1.0-alpha.4] - 2026-05-08
+
+### Added
+- Add release-surface version consistency coverage, bringing the suite to 252 tests.
+
+### Changed
+- Align published alpha smoke, feedback templates, and demo docs around the beginner `check` command.
+- Align `agent.yaml`, setup, porting, demo, and runbook release references with the package version.
+- Document `npx @alpha init --project-root .` as the shortest target-project install path.
+
 ## [0.1.0-alpha.3] - 2026-05-08
 
 ### Added

package/docs/CODEMAPS/tests.md

@@ -51,6 +51,7 @@ tests/
     |-- team.test.js
     |-- token-vault.test.js
     |-- verify.test.js
+    |-- version-consistency.test.js
     |-- wait.test.js
     `-- work.test.js
 ```
@@ -99,6 +100,7 @@ tests/
 | `unit/team.test.js` | _(none)_ |  |
 | `unit/token-vault.test.js` | _(none)_ |  |
 | `unit/verify.test.js` | _(none)_ |  |
+| `unit/version-consistency.test.js` | _(none)_ |  |
 | `unit/wait.test.js` | _(none)_ |  |
 | `unit/work.test.js` | _(none)_ |  |
 

package/docs/DEMO.md

@@ -8,7 +8,7 @@ This demo uses mock providers. It does not call Claude, Codex, Gemini, or paid A
 npm run demo:quick -- --cleanup
 ```
 
-This is the shortest demo path. It creates a disposable target project, runs `doctor --quick`, runs `run = work -> verify -> ship`, generates `REPORT.md`, checks `gate status`, and removes the target when `--cleanup` is set.
+This is the shortest demo path. It creates a disposable target project, runs `check`, runs `run = work -> verify -> ship`, generates `REPORT.md`, checks `gate status`, and removes the target when `--cleanup` is set.
 
 Expected shape:
 
@@ -28,7 +28,7 @@ This transcript is the README-friendly demo path. It uses mock providers, so it
 ![NEKOWORK one-minute terminal demo](assets/demo-terminal.svg)
 
 ```text
-$ npx -y @ps-neko/nekowork@alpha doctor --quick
+$ npx -y @ps-neko/nekowork@alpha check
 NEKOWORK doctor
 STATUS  CHECK              MESSAGE
 PASS    node               Node 22+
@@ -67,7 +67,7 @@ The quick demo writes:
 npm run demo:external
 ```
 
-This creates a tiny disposable target project, applies the `developer` profile, runs `doctor --quick`, and writes a planning session into the target project's `.harness/` directory. See [EXAMPLE-PROJECT.md](EXAMPLE-PROJECT.md) for details.
+This creates a tiny disposable target project, applies the `developer` profile, runs `check`, and writes a planning session into the target project's `.harness/` directory. See [EXAMPLE-PROJECT.md](EXAMPLE-PROJECT.md) for details.
 
 ## Command
 
@@ -143,7 +143,7 @@ project root : C:\path\to\harness
 
 STATUS  CHECK                   MESSAGE
 PASS    node                    Node 24.x
-PASS    package metadata        @ps-neko/nekowork@0.1.0-alpha.2; public alpha package
+PASS    package metadata        @ps-neko/nekowork@0.1.0-alpha.4; public alpha package
 PASS    git worktree            project root is inside a git worktree
 WARN    gemini cli              installed, auth status is not checked non-interactively
 

package/docs/FAILURE-MODES.md

@@ -84,7 +84,7 @@ Live mode can fail if local CLI auth is missing or expired. In that case, log in
 
 ## npm / npx Problems
 
-If `npx -y @ps-neko/nekowork@alpha doctor --quick` fails, capture:
+If `npx -y @ps-neko/nekowork@alpha check` fails, capture:
 
 - OS and shell
 - Node and npm versions

package/docs/FEEDBACK-TRIAGE.md

@@ -8,7 +8,7 @@ Use it for GitHub issues filed through:
 
 - Alpha feedback
 - Bug report
-- Direct maintainer notes that include `doctor --quick --json`, `REPORT.md`, or install output
+- Direct maintainer notes that include `check --json`, `REPORT.md`, or install output
 
 ## Triage Principles
 
@@ -22,7 +22,7 @@ Use it for GitHub issues filed through:
 
 | Class | Signals | First response |
 |---|---|---|
-| Install failure | `npx`, npm, Node version, package metadata, binary resolution | Ask for OS/shell, Node/npm, exact command, and `doctor --quick --json` |
+| Install failure | `npx`, npm, Node version, package metadata, binary resolution | Ask for OS/shell, Node/npm, exact command, and `check --json` |
 | Auth confusion | Claude/Codex/Gemini login status, API key warning, provider CLI path | Clarify delegated CLI auth and ask whether env API keys were set intentionally |
 | Evidence confusion | Missing `REPORT.md`, unclear verdict, no `NO_SHIP`, acceptance coverage confusion | Ask for session path and report summary; link report contract |
 | Safety concern | apply, commit, push, publish, deploy, secrets, destructive changes | Confirm no automatic mutation occurred; request redacted logs and gate/ship summaries |
@@ -38,7 +38,7 @@ An issue is actionable when it includes at least three of:
 - OS and shell
 - Node and npm versions
 - exact command
-- redacted `doctor --quick --json`
+- redacted `check --json`
 - redacted `REPORT.md` summary
 - session evidence file names, such as `verify-summary.json` or `ship-summary.json`
 - expected behavior and actual behavior
@@ -55,7 +55,7 @@ If the issue is about ship/apply safety, require:
 | Severity | Meaning | Examples |
 |---|---|---|
 | Critical | Safety invariant appears bypassed | automatic apply, publish, deploy, push, PR, or secret exposure |
-| High | First-run or release path is blocked for a supported setup | `npx @alpha doctor --quick` fails on supported Node/npm |
+| High | First-run or release path is blocked for a supported setup | `npx @alpha check` fails on supported Node/npm |
 | Medium | Important docs or workflow confusion with a workaround | unclear report output, install docs missing platform note |
 | Low | Enhancement or polish | copy edit, new example request, extra case-study suggestion |
 
@@ -66,7 +66,7 @@ Critical and high issues should keep `ship_ready=false` until reproduced or expl
 Start with the smallest command that matches the report:
 
 ```bash
-npx -y @ps-neko/nekowork@alpha doctor --quick --json
+npx -y @ps-neko/nekowork@alpha check --json
 ```
 
 For source checkout reports:
@@ -136,9 +136,9 @@ Next step:
 
 ## Alpha.3 Gate
 
-Do not publish `0.1.0-alpha.3` for feedback-only changes until:
+Do not publish a new alpha for feedback-only changes until:
 
 - `@alpha` smoke remains green
 - new feedback docs or templates are covered by tests
 - any release-blocker feedback is closed or documented as unresolved
-- changelog entries match the intended alpha.3 contents
+- changelog entries match the intended alpha contents

package/docs/PORTING.md

@@ -1,6 +1,6 @@
 # Porting NEKOWORK Into Another Project
 
-NEKOWORK `0.1.0-alpha.2` is the current repository version and the published `@ps-neko/nekowork@alpha` package. Use a submodule or local checkout for repository-pinned workflows and examples.
+NEKOWORK `0.1.0-alpha.4` is the current repository version and the published `@ps-neko/nekowork@alpha` package. Use npm alpha for the shortest install path, or use a submodule/local checkout for repository-pinned workflows and examples.
 
 ## Local Demo First
 
@@ -27,6 +27,16 @@ target-project/
 
 The tool root stays in `.harness-tool/`. Generated harness files, session state, and git-aware execution target the project root.
 
+## npm Alpha Install
+
+Use this when you want the shortest target-project install path:
+
+```bash
+cd <target-project>
+npx -y @ps-neko/nekowork@alpha init --profile developer --project-root .
+npx -y @ps-neko/nekowork@alpha check --project-root .
+```
+
 ## Submodule Install
 
 ```bash

package/docs/PUBLISH-ALPHA.md

@@ -1,15 +1,15 @@
 # Public Alpha Publish Record
 
-NEKOWORK `0.0.3` stays a private/local alpha. The first npm release is the public alpha `0.1.0-alpha.0`; the current public alpha is `0.1.0-alpha.3`.
+NEKOWORK `0.0.3` stays a private/local alpha. The first npm release is the public alpha `0.1.0-alpha.0`; the current public alpha is `0.1.0-alpha.4`.
 
 Do not publish from the `0.0.3` line.
 
-The repository metadata has been advanced to `0.1.0-alpha.3` with `private: false`. The `0.1.0-alpha.0` publish succeeded on 2026-05-07. The `0.1.0-alpha.1` publish also succeeded on 2026-05-07. The `0.1.0-alpha.2` publish succeeded on 2026-05-08. The `0.1.0-alpha.3` publish succeeded on 2026-05-08 and moved the `alpha` dist-tag forward.
+The repository metadata has been advanced to `0.1.0-alpha.4` with `private: false`. The `0.1.0-alpha.0` publish succeeded on 2026-05-07. The `0.1.0-alpha.1` publish also succeeded on 2026-05-07. The `0.1.0-alpha.2`, `0.1.0-alpha.3`, and `0.1.0-alpha.4` publishes succeeded on 2026-05-08 and moved the `alpha` dist-tag forward.
 
-The matching Git tag and GitHub prerelease are published as `v0.1.0-alpha.3`:
+The matching Git tag and GitHub prerelease are published as `v0.1.0-alpha.4`:
 
 ```text
-https://github.com/Ps-Neko/NEKOWORK/releases/tag/v0.1.0-alpha.3
+https://github.com/Ps-Neko/NEKOWORK/releases/tag/v0.1.0-alpha.4
 ```
 
 ## Registry State
@@ -27,14 +27,14 @@ The current alpha install path points at the release line:
 
 ```text
 npm view @ps-neko/nekowork@alpha version --json
--> 0.1.0-alpha.3
+-> 0.1.0-alpha.4
 ```
 
 Dist-tags:
 
 ```text
 npm view @ps-neko/nekowork dist-tags --json
--> { "alpha": "0.1.0-alpha.3", "latest": "0.1.0-alpha.0" }
+-> { "alpha": "0.1.0-alpha.4", "latest": "0.1.0-alpha.0" }
 ```
 
 The publish package shape has been checked:
@@ -72,11 +72,18 @@ npm publish --access public --tag alpha
 -> published 0.1.0-alpha.3
 ```
 
+The fourth alpha update was also published with the same `alpha` dist-tag:
+
+```text
+npm publish --access public --tag alpha
+-> published 0.1.0-alpha.4
+```
+
 After publish:
 
 ```text
-npm view @ps-neko/nekowork@0.1.0-alpha.3 version --json
--> 0.1.0-alpha.3
+npm view @ps-neko/nekowork@0.1.0-alpha.4 version --json
+-> 0.1.0-alpha.4
 ```
 
 `npx` smoke passed:
@@ -101,7 +108,7 @@ Published public alpha package:
 
 ```text
 name: @ps-neko/nekowork
-version: 0.1.0-alpha.3
+version: 0.1.0-alpha.4
 dist-tag: alpha
 bin: harness
 ```
@@ -116,13 +123,13 @@ Before publishing, explicitly confirm:
 - npm 2FA readiness
 - package name `@ps-neko/nekowork`
 - binary name `harness`
-- public alpha version `0.1.0-alpha.3`
+- public alpha version `0.1.0-alpha.4`
 - `private` removed or set to `false`
 - publish tag is `alpha`, not `latest`
 
 ## Next Alpha Publish Checklist
 
-Use this checklist for `0.1.0-alpha.3` or any later alpha. Do not run it until the owner explicitly approves the publish.
+Use this checklist for `0.1.0-alpha.5` or any later alpha. Do not run it until the owner explicitly approves the publish.
 
 1. Confirm the candidate scope in [RELEASE-READINESS.md](RELEASE-READINESS.md).
 2. Move the intended changelog entries from `Unreleased` to the new version heading.

package/docs/QUICKSTART.md

@@ -28,10 +28,11 @@ node scripts/cli.js check
 
 `check` is the beginner alias for `doctor --quick`. It checks Node.js, package metadata, git state, API key overrides, and provider CLI presence without running the slower freshness checks.
 
-Initialize another local repository from the source checkout:
+Initialize another local repository with the published alpha:
 
 ```bash
-node /path/to/harness/scripts/cli.js init --profile developer --project-root /path/to/my-project
+cd /path/to/my-project
+npx -y @ps-neko/nekowork@alpha init --profile developer --project-root .
 ```
 
 `init` is the beginner alias for `install --apply`. It writes generated harness surfaces and install state to the target project. It does not commit, push, publish, or deploy.

package/docs/RELEASE-READINESS.md

@@ -2,16 +2,16 @@
 
 Status date: 2026-05-08
 
-NEKOWORK / HARNESS is release-ready for local use, repository-based installation, and public npm alpha installation. The repository and npm alpha are both at `0.1.0-alpha.3`.
+NEKOWORK / HARNESS is release-ready for local use, repository-based installation, and public npm alpha installation. The repository and npm alpha are both at `0.1.0-alpha.4`.
 
 ## Decision
 
 - Decision: do not publish 0.0.3 to npm.
-- Public alpha: `0.1.0-alpha.3`, published with `--tag alpha`.
+- Public alpha: `0.1.0-alpha.4`, published with `--tag alpha`.
 - `package.json` is set to `private: false` for the public alpha.
 - The canonical repo is `Ps-Neko/NEKOWORK`.
-- Current release track is `0.1.0-alpha.3`; npm `@alpha` points at this version.
-- GitHub prerelease: `v0.1.0-alpha.3`.
+- Current release track is `0.1.0-alpha.4`; npm `@alpha` points at this version.
+- GitHub prerelease: `v0.1.0-alpha.4`.
 - Required local provider auth is delegated CLI auth, not long-lived API keys.
 - Core workflow invariant is Claude work -> Codex verification -> Human Gate.
 - Risk classifier, acceptance criteria artifacts, and profile safety validation are part of the release gate.
@@ -22,16 +22,16 @@ NEKOWORK / HARNESS is release-ready for local use, repository-based installation
 
 GitHub Release:
 
-- https://github.com/Ps-Neko/NEKOWORK/releases/tag/v0.1.0-alpha.3
+- https://github.com/Ps-Neko/NEKOWORK/releases/tag/v0.1.0-alpha.4
 
-## 0.1.0-alpha.3 Release Scope
+## 0.1.0-alpha.4 Release Scope
 
-The `0.1.0-alpha.3` release scope is first-run trust UX and documentation hardening:
+The `0.1.0-alpha.4` release scope is first-run install trust and release-surface version consistency:
 
-- README first screen explains unverified-change prevention, Human Gate, and explicit apply
-- beginner `check` and `init` CLI aliases
-- Safety Guarantees, Failure Modes, Trust Model, and Why Not Autopilot docs
-- third-party dotenv case study and alpha feedback triage docs from the post-alpha.2 line
+- `agent.yaml` version matches `package.json`
+- version consistency is covered by unit tests
+- npm `init` guidance is documented as the shortest target-project install path
+- `published-alpha-smoke` uses the beginner `check` command
 - no catalog expansion unless a new surface directly strengthens verification evidence
 
 Release exit criteria:
@@ -39,7 +39,7 @@ Release exit criteria:
 - required gates below pass locally
 - `published-alpha-smoke` passes in GitHub Actions
 - `npm pack --dry-run --json` contains only intended files
-- changelog `0.1.0-alpha.3` entries match the release contents
+- changelog `0.1.0-alpha.4` entries match the release contents
 - `latest` remains documented as non-stable; install examples continue to use `@alpha`
 
 ## Required Gates
@@ -69,14 +69,14 @@ Current local verification after the decomposed workflow expansion:
 - `npm run lint`: pass
 - `node scripts/sync-claude-md.js --check`: pass
 - `node scripts/build-codemaps.js --check`: pass
-- `npm test`: 251 tests pass
+- `npm test`: 252 tests pass
 - `npm run demo:quick -- --cleanup`: pass
 - `npm audit --audit-level=moderate`: 0 vulnerabilities
 - `npm pack --dry-run --json`: pass
 - `npm publish --dry-run --access public --tag alpha`: pass
-- `npm publish --access public --tag alpha`: `0.1.0-alpha.3` published
-- `npm view @ps-neko/nekowork dist-tags version versions --json`: `alpha` points at `0.1.0-alpha.3`; `latest` remains `0.1.0-alpha.0`
-- `npx -y @ps-neko/nekowork@alpha check`: passed for `0.1.0-alpha.3` with WARN summary from non-git project root and Gemini auth not checked
+- `npm publish --access public --tag alpha`: `0.1.0-alpha.4` published
+- `npm view @ps-neko/nekowork dist-tags version versions --json`: `alpha` points at `0.1.0-alpha.4`; `latest` remains `0.1.0-alpha.0`
+- `npx -y @ps-neko/nekowork@alpha check`: passed for `0.1.0-alpha.4` with WARN summary from non-git project root and Gemini auth not checked
 - GitHub Actions `published-alpha-smoke`: validates the fresh `npx @alpha` path against the published package
 
 ## Install Smoke
@@ -84,11 +84,13 @@ Current local verification after the decomposed workflow expansion:
 For the default developer profile:
 
 ```bash
+npx -y @ps-neko/nekowork@alpha init --profile developer --project-root <target>
+npx -y @ps-neko/nekowork@alpha check --project-root <target>
 node scripts/install-plan.js --list --json
 node scripts/install-plan.js --pack quality --json
 node scripts/install-plan.js --profile developer --json
 node scripts/portability/simulate-port.js <target> --profile developer --json
-node scripts/install-apply.js --profile developer --project-root <target>
+node scripts/cli.js init --profile developer --project-root <target>
 node scripts/cli.js plan "release readiness smoke" --project-root <target>
 node scripts/cli.js run "release readiness decomposed smoke" --project-root <target> --session release-run-smoke
 ```
@@ -156,7 +158,7 @@ Expected target outputs:
 
 ## Public npm Checklist
 
-Already completed for `0.1.0-alpha.3`. Repeat this checklist for the next public alpha:
+Already completed for `0.1.0-alpha.4`. Repeat this checklist for the next public alpha:
 
 1. Confirm the npm package name is still `@ps-neko/nekowork`.
 2. Confirm the `harness` binary is still intentional.

package/docs/ROADMAP.md

@@ -4,21 +4,34 @@ Status date: 2026-05-08
 
 This roadmap is intentionally small. NEKOWORK should improve the evidence surface before expanding the agent catalog.
 
-## 0.1.0-alpha.2
+## 0.1.0-alpha.3
 
 Status: released.
 
 Goal: make the published package and first-run story easier to trust from the outside.
 
-Planned scope:
+Released scope:
 
-- Keep fresh `npx @ps-neko/nekowork@alpha doctor --quick` smoke coverage in CI.
+- Keep fresh `npx @ps-neko/nekowork@alpha check` smoke coverage in CI.
 - Keep the generated terminal SVG for the one-minute demo path.
 - Keep README focused on evidence, report output, Human Gate, and explicit apply.
-- Keep the external feedback path for alpha users to paste `doctor --quick --json` and `REPORT.md` summaries.
+- Keep the external feedback path for alpha users to paste `check --json` and `REPORT.md` summaries.
 - Preserve the current catalog size unless a new agent, skill, hook, or pack directly strengthens verification evidence.
 
-## 0.1.0-alpha.3 Candidate
+## 0.1.0-alpha.4
+
+Status: released.
+
+Goal: keep first-run install evidence internally consistent.
+
+Released scope:
+
+- Keep `agent.yaml` and `package.json` versions aligned.
+- Cover release-surface version consistency with a unit test.
+- Make `npx @alpha init --project-root .` the shortest documented target-project install path.
+- Keep `@alpha check` smoke evidence green across local and GitHub Actions gates.
+
+## 0.1.0-alpha.5 Candidate
 
 Goal: gather external feedback and keep the release path boring.
 

package/docs/RUNBOOK.md

@@ -47,9 +47,16 @@ The validator runs through `npm run lint`.
 
 Use a temporary target project:
 
+```bash
+npx -y @ps-neko/nekowork@alpha init --profile developer --project-root <target>
+npx -y @ps-neko/nekowork@alpha check --project-root <target>
+```
+
+For repository-pinned source checkout testing:
+
 ```bash
 node scripts/portability/simulate-port.js <target> --profile developer --verbose
-node scripts/install-apply.js --profile developer --project-root <target>
+node scripts/cli.js init --profile developer --project-root <target>
 node scripts/cli.js doctor --project-root <target> --quick
 node scripts/cli.js plan "release smoke" --project-root <target> --session release-smoke
 node scripts/cli.js run "release decomposed smoke" --project-root <target> --session release-run-smoke
@@ -92,7 +99,7 @@ Do not run this checklist unless public publish is explicitly approved.
 5. Confirm npm identity with `npm whoami`.
 6. Confirm account 2FA readiness.
 7. Confirm `private: false`.
-8. Confirm the public alpha version, for example `0.1.0-alpha.2`.
+8. Confirm the public alpha version, for example `0.1.0-alpha.4`.
 9. Run `npm publish --access public --tag alpha`.
 10. Update README, Quickstart, Changelog, and release notes from "future npm path" to "published npm path".
 

package/docs/SETUP.md

@@ -2,7 +2,7 @@
 
 Start with [QUICKSTART.md](QUICKSTART.md) if this is your first run. This page is the deeper contributor setup guide.
 
-NEKOWORK `0.1.0-alpha.2` is the current repository version and the published `@ps-neko/nekowork@alpha` package. Use a source checkout, submodule, or local repository integration when you need examples, tests, or repository-pinned workflows.
+NEKOWORK `0.1.0-alpha.4` is the current repository version and the published `@ps-neko/nekowork@alpha` package. Use npm alpha for the shortest first-run path, or use a source checkout, submodule, or local repository integration when you need examples, tests, or repository-pinned workflows.
 
 ## Requirements
 

package/docs/assets/demo-terminal.svg

@@ -21,11 +21,11 @@
     <text x="480" y="62" text-anchor="middle" font-family="Consolas, Menlo, monospace" font-size="13" fill="#c8d2dc">NEKOWORK alpha smoke</text>
   </g>
   <g font-family="Consolas, Menlo, monospace" font-size="18">
-    <text x="72" y="114" fill="#7ee787">$ npx -y @ps-neko/nekowork@alpha doctor --quick</text>
+    <text x="72" y="114" fill="#7ee787">$ npx -y @ps-neko/nekowork@alpha check</text>
     <text x="72" y="147" fill="#d7e3ec">NEKOWORK doctor</text>
     <text x="72" y="179" fill="#8fb3c8">STATUS  CHECK              MESSAGE</text>
     <text x="72" y="211" fill="#9be9a8">PASS    node               Node 22+</text>
-    <text x="72" y="243" fill="#9be9a8">PASS    package metadata   @ps-neko/nekowork@0.1.0-alpha.2</text>
+    <text x="72" y="243" fill="#9be9a8">PASS    package metadata   @ps-neko/nekowork@0.1.0-alpha.4</text>
     <text x="72" y="275" fill="#9be9a8">PASS    api key env        no delegated-provider API key overrides</text>
     <text x="72" y="307" fill="#ffd166">WARN    gemini cli         auth status is not checked non-interactively</text>
     <text x="72" y="339" fill="#d7e3ec">summary: WARN (5 pass, 2 warn, 0 fail)</text>

package/docs/workflows-stash/harness-validate.yml

@@ -16,22 +16,22 @@ jobs:
         with:
           node-version: '22'
 
-      - name: Fresh npx alpha doctor smoke
+      - name: Fresh npx alpha check smoke
         shell: bash
         run: |
           set -euo pipefail
           workdir="$RUNNER_TEMP/nekowork-alpha-smoke"
           mkdir -p "$workdir"
           cd "$workdir"
-          npx -y @ps-neko/nekowork@alpha doctor --quick --json > doctor.json
+          npx -y @ps-neko/nekowork@alpha check --json > check.json
           node <<'NODE'
           const { execSync } = require('node:child_process');
           const fs = require('node:fs');
-          const report = JSON.parse(fs.readFileSync('doctor.json', 'utf8'));
+          const report = JSON.parse(fs.readFileSync('check.json', 'utf8'));
           const expectedVersion = JSON.parse(execSync('npm view @ps-neko/nekowork@alpha version --json', { encoding: 'utf8' }));
           const metadata = report.checks.find((check) => check.name === 'package metadata');
           if (report.summary.fail !== 0) {
-            throw new Error(`doctor reported ${report.summary.fail} failure(s)`);
+            throw new Error(`check reported ${report.summary.fail} failure(s)`);
           }
           if (!metadata || !metadata.message.includes(`@ps-neko/nekowork@${expectedVersion}`)) {
             throw new Error(`unexpected package metadata: ${metadata?.message || '<missing>'}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ps-neko/nekowork",
-  "version": "0.1.0-alpha.3",
+  "version": "0.1.0-alpha.4",
   "description": "Local-first AI development harness for Claude Code, Codex CLI, and Gemini CLI",
   "keywords": [
     "claude",