@structor-dev/cli 0.1.0

package/template/scripts/check-issue-template.mjs.tpl

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+
+import { readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const issueTemplatePath = "ai/templates/issue-template.md";
+const issueFixtureDirectory = "ai/templates/fixtures/issues";
+const issueFixtureFileExtension = ".md";
+const invalidFixturePrefix = "invalid-";
+const validStatuses = new Set(["Backlog", "Ready for Agent", "Running", "Needs Fix", "Report Ready", "PR Ready", "Human Review", "Blocked", "Done"]);
+const validRisk = new Set(["low", "medium", "high"]);
+const validAutonomy = new Set(["report_only", "pr_ready", "auto_merge"]);
+const validModelPolicy = new Set(["cheap", "standard", "reasoning", "frontier", "review_only"]);
+const canonicalRepos = new Set(["{{HARNESS_REPO_NAME}}", ...{{CONSUMER_REPO_NAMES_JSON}}]);
+const requiredKeys = ["id", "status", "risk", "autonomy", "model_policy", "repos", "allowed_paths", "forbidden_paths", "requires_human_approval"];
+const requiredSections = [
+  "Summary",
+  "Context",
+  "Goals",
+  "Non-Goals",
+  "Scope",
+  "Path Contract",
+  "Requirements",
+  "Bootstrap Requirements",
+  "Proposed Approach",
+  "Agent Execution Protocol",
+  "Success Criteria",
+  "Validation",
+  "Validation Evidence Required",
+  "Risk and Autonomy",
+  "Review Routing",
+  "Dependencies",
+  "Rollback / Recovery",
+  "Open Questions",
+  "Notes for the Agent",
+];
+const placeholderPattern = /<[^>]+>/;
+const sectionHeaderPatternMetaChars = /[.*+?^${}()|[\]\\]/g;
+const protectedSurfacePattern = /\b(auth|authentication|authorization|billing|subscription|payment|secret|environment variable|infrastructure|deployment|database migration|production data|tenant|quota|rate limit|shared contract)\b/i;
+const protectedSurfaceMentionPattern = /protected surface|protected surfaces/i;
+const autoMergeFutureFacingPattern = /auto_merge.*future-facing|future-facing.*auto_merge/i;
+const validationSectionHeader = "## Validation";
+const validationCommandPattern = /`[^`]+`/;
+
+async function read(relativePath) {
+  return readFile(path.join(repoRoot, relativePath), "utf8");
+}
+
+function parseScalar(value) {
+  if (value === "true") return true;
+  if (value === "false") return false;
+  return value;
+}
+
+function parseFrontMatter(content) {
+  const match = content.match(/^---\n([\s\S]*?)\n---/);
+  if (!match) return null;
+  const result = {};
+  let currentKey = null;
+  for (const rawLine of match[1].split(/\r?\n/)) {
+    const line = rawLine.trimEnd();
+    const keyValue = line.match(/^([A-Za-z0-9_]+):\s*(.*)$/);
+    if (keyValue) {
+      currentKey = keyValue[1];
+      result[currentKey] = keyValue[2] === "" ? [] : parseScalar(keyValue[2]);
+      continue;
+    }
+    const listItem = line.match(/^\s*-\s+(.+)$/);
+    if (listItem && currentKey) {
+      if (!Array.isArray(result[currentKey])) result[currentKey] = [];
+      result[currentKey].push(parseScalar(listItem[1]));
+    }
+  }
+  return result;
+}
+
+function hasSection(content, section) {
+  return new RegExp(`^## ${section.replace(sectionHeaderPatternMetaChars, "\\$&")}\\s*$`, "m").test(content);
+}
+
+function valuesFor(value) {
+  return Array.isArray(value) ? value : [value];
+}
+
+function validateIssueFile(relativePath, content, { allowPlaceholders }) {
+  const errors = [];
+  const frontMatter = parseFrontMatter(content);
+  if (!frontMatter) return [`${relativePath} must start with YAML front matter.`];
+
+  for (const key of requiredKeys) {
+    if (!(key in frontMatter)) errors.push(`${relativePath} is missing front matter key '${key}'.`);
+  }
+  if (!allowPlaceholders && placeholderPattern.test(content)) {
+    errors.push(`${relativePath} contains placeholder text.`);
+  }
+  if (!placeholderPattern.test(String(frontMatter.status)) && !validStatuses.has(frontMatter.status)) {
+    errors.push(`${relativePath} has invalid status '${frontMatter.status}'.`);
+  }
+  if (!placeholderPattern.test(String(frontMatter.risk)) && !validRisk.has(frontMatter.risk)) {
+    errors.push(`${relativePath} has invalid risk '${frontMatter.risk}'.`);
+  }
+  if (!placeholderPattern.test(String(frontMatter.autonomy)) && !validAutonomy.has(frontMatter.autonomy)) {
+    errors.push(`${relativePath} has invalid autonomy '${frontMatter.autonomy}'.`);
+  }
+  if (!placeholderPattern.test(String(frontMatter.model_policy)) && !validModelPolicy.has(frontMatter.model_policy)) {
+    errors.push(`${relativePath} has invalid model_policy '${frontMatter.model_policy}'.`);
+  }
+  for (const repo of frontMatter.repos ?? []) {
+    if (!placeholderPattern.test(String(repo)) && !canonicalRepos.has(repo)) {
+      errors.push(`${relativePath} references non-canonical repo '${repo}'.`);
+    }
+  }
+  for (const key of ["allowed_paths", "forbidden_paths"]) {
+    if (!Array.isArray(frontMatter[key]) || frontMatter[key].length === 0) {
+      errors.push(`${relativePath} front matter key '${key}' must contain at least one path.`);
+    }
+  }
+  if (frontMatter.risk === "high" && frontMatter.autonomy === "auto_merge") {
+    errors.push(`${relativePath} has risk: high with autonomy: auto_merge.`);
+  }
+  if ("requires_human_approval" in frontMatter && typeof frontMatter.requires_human_approval !== "boolean") {
+    errors.push(`${relativePath} requires_human_approval must be boolean.`);
+  }
+  for (const section of requiredSections) {
+    if (!hasSection(content, section)) errors.push(`${relativePath} is missing required section '${section}'.`);
+  }
+  if (!protectedSurfaceMentionPattern.test(content)) {
+    errors.push(`${relativePath} must mention protected surfaces.`);
+  }
+  if (!autoMergeFutureFacingPattern.test(content)) {
+    errors.push(`${relativePath} must state that auto_merge is future-facing metadata.`);
+  }
+  const validationSection = content.match(new RegExp(`^${validationSectionHeader}\\s*\\n([\\s\\S]*?)(?=^## |$)`, "m"))?.[1] ?? "";
+  if (!allowPlaceholders && !validationCommandPattern.test(validationSection)) {
+    errors.push(`${relativePath} Validation section must include a concrete command in backticks.`);
+  }
+  if (!allowPlaceholders && protectedSurfacePattern.test(content) && frontMatter.requires_human_approval !== true) {
+    errors.push(`${relativePath} touches protected surfaces but requires_human_approval is not true.`);
+  }
+
+  return errors;
+}
+
+async function fixtureFiles() {
+  const dir = path.join(repoRoot, issueFixtureDirectory);
+  const entries = await readdir(dir, { withFileTypes: true });
+  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(issueFixtureFileExtension)).map((entry) => `${issueFixtureDirectory}/${entry.name}`);
+}
+
+const errors = [];
+errors.push(...validateIssueFile(issueTemplatePath, await read(issueTemplatePath), { allowPlaceholders: true }));
+for (const fixture of await fixtureFiles()) {
+  const fixtureErrors = validateIssueFile(fixture, await read(fixture), { allowPlaceholders: false });
+  const shouldFail = path.basename(fixture).startsWith(invalidFixturePrefix);
+  if (shouldFail && fixtureErrors.length === 0) errors.push(`${fixture} was expected to fail but passed.`);
+  if (!shouldFail && fixtureErrors.length > 0) errors.push(`${fixture} was expected to pass but failed: ${fixtureErrors.join("; ")}`);
+}
+
+if (errors.length > 0) {
+  console.error("Issue template check failed.");
+  for (const error of errors) console.error(`- ${error}`);
+  process.exit(1);
+}
+
+console.log("Issue template check passed.");

package/template/scripts/check-knowledge-manifest.mjs.tpl

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+
+import { access, readFile, readdir } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const manifestPath = "ai/knowledge-manifest.json";
+const ignoredAiDocDirectories = new Set(["model-overlays", "templates", "contracts", "skills", "specs", "plans"]);
+const archiveOrGeneratedPattern = /archive|archived|historical|generated/i;
+
+async function exists(relativePath) {
+  try {
+    await access(path.join(repoRoot, relativePath), fsConstants.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function read(relativePath) {
+  return readFile(path.join(repoRoot, relativePath), "utf8");
+}
+
+async function markdownFiles(baseRelativePath) {
+  const files = [];
+  async function walk(currentPath) {
+    const entries = await readdir(currentPath, { withFileTypes: true });
+    for (const entry of entries) {
+      const absolute = path.join(currentPath, entry.name);
+      const relative = path.relative(repoRoot, absolute).replaceAll(path.sep, "/");
+      if (entry.isDirectory()) {
+        if (ignoredAiDocDirectories.has(entry.name)) continue;
+        await walk(absolute);
+      } else if (entry.isFile() && entry.name.endsWith(".md")) {
+        files.push(relative);
+      }
+    }
+  }
+  await walk(path.join(repoRoot, baseRelativePath));
+  return files.sort();
+}
+
+const errors = [];
+const manifest = JSON.parse(await read(manifestPath));
+const docs = manifest.canonicalDocs ?? [];
+const listed = new Set(docs.map((doc) => doc.path));
+
+for (const doc of docs) {
+  if (!(await exists(doc.path))) {
+    errors.push(`${doc.path} is listed in ${manifestPath} but does not exist.`);
+    continue;
+  }
+  if (doc.status === "active" && !doc.purpose?.trim()) {
+    errors.push(`${doc.path} is active but has no purpose.`);
+  }
+  for (const linkedFrom of doc.linkedFrom ?? []) {
+    if (!(await exists(linkedFrom))) {
+      errors.push(`${doc.path} expects a routing link from ${linkedFrom}, but it does not exist.`);
+      continue;
+    }
+    const source = await read(linkedFrom);
+    if (!source.includes(doc.path) && !source.includes(path.basename(doc.path))) {
+      errors.push(`${doc.path} is not linked from ${linkedFrom}.`);
+    }
+  }
+}
+
+  for (const relativePath of await markdownFiles("ai")) {
+  if (!listed.has(relativePath) && !archiveOrGeneratedPattern.test((await read(relativePath)).slice(0, 400))) {
+    errors.push(`${relativePath} is an active ai/*.md doc but is not listed in ${manifestPath}.`);
+  }
+  }
+
+if (errors.length > 0) {
+  console.error("Knowledge manifest check failed.");
+  for (const error of errors) console.error(`- ${error}`);
+  process.exit(1);
+}
+
+console.log("Knowledge manifest check passed.");

package/template/scripts/check-overlay-drift.mjs.tpl

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const models = {
+  openai: {{MODEL_OPENAI_ENABLED}},
+  anthropic: {{MODEL_ANTHROPIC_ENABLED}},
+};
+
+async function read(relativePath) {
+  return readFile(path.join(repoRoot, relativePath), "utf8");
+}
+
+const errors = [];
+const canonical = await read("ai/AGENTS.md");
+if (!canonical.includes("model-neutral")) {
+  errors.push("ai/AGENTS.md must keep shared guidance model-neutral.");
+}
+
+if (models.openai) {
+  const openai = await read("ai/model-overlays/openai/AGENTS.md");
+  if (!/OpenAI|Codex/i.test(openai)) {
+    errors.push("ai/model-overlays/openai/AGENTS.md must identify the OpenAI/Codex surface.");
+  }
+  if (!openai.includes("../AGENTS.md") && !openai.includes("../../AGENTS.md")) {
+    errors.push("ai/model-overlays/openai/AGENTS.md must route back to canonical ai/* guidance.");
+  }
+}
+
+if (models.anthropic) {
+  const claude = await read("ai/model-overlays/anthropic/CLAUDE.md");
+  if (!/Anthropic|Claude/i.test(claude)) {
+    errors.push("ai/model-overlays/anthropic/CLAUDE.md must identify the Anthropic/Claude surface.");
+  }
+  if (!claude.includes("../AGENTS.md") && !claude.includes("../../CLAUDE.md")) {
+    errors.push("ai/model-overlays/anthropic/CLAUDE.md must route back to canonical ai/* guidance.");
+  }
+}
+
+if (errors.length > 0) {
+  console.error("Overlay drift check failed.");
+  for (const error of errors) console.error(`- ${error}`);
+  process.exit(1);
+}
+
+console.log("Overlay drift check passed.");

package/template/scripts/check-plans.mjs.tpl

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+
+import { access, readFile, readdir } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const plansDir = "ai/plans/active";
+const headingRules = ["Status", "Goal", "Next Step", "Validation Plan"];
+const runtimeTokens = ["app-server.jsonl", "run-status.json", "events.jsonl", ".agent-runs", ".agent-workspaces", "scripts/orchestrator/"];
+const readmePath = "ai/plans/README.md";
+const rulesHeading = "## Rules";
+const techDebtPath = "ai/plans/tech-debt.md";
+const openItemsHeading = "## Open Items";
+
+async function exists(relativePath) {
+  try {
+    await access(path.join(repoRoot, relativePath), fsConstants.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function read(relativePath) {
+  return readFile(path.join(repoRoot, relativePath), "utf8");
+}
+
+async function markdownFiles(relativeDir) {
+  if (!(await exists(relativeDir))) return [];
+  const entries = await readdir(path.join(repoRoot, relativeDir), { withFileTypes: true });
+  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => `${relativeDir}/${entry.name}`);
+}
+
+function sectionHasContent(content, heading) {
+  const match = content.match(new RegExp(`^## ${heading}\\s*\\n([\\s\\S]*?)(?=^## |$)`, "m"));
+  return Boolean(match?.[1]?.replace(/[-*\\s:]/g, "").trim());
+}
+
+const errors = [];
+  for (const relativePath of await markdownFiles(plansDir)) {
+    const content = await read(relativePath);
+    for (const heading of headingRules) {
+      if (!sectionHasContent(content, heading)) errors.push(`${relativePath} has no ${heading} content.`);
+    }
+  for (const token of runtimeTokens) {
+    if (content.includes(token)) errors.push(`${relativePath} references runtime state token '${token}'.`);
+  }
+}
+
+  const readme = await read(readmePath);
+  const rulesRegex = new RegExp(`^${rulesHeading}\\s*$`, "m");
+  if (!rulesRegex.test(readme)) {
+    errors.push("ai/plans/README.md must include a Rules section.");
+  }
+
+  const techDebt = await read(techDebtPath);
+  const openItemsRegex = new RegExp(`^${openItemsHeading}\\s*$`, "m");
+  if (!openItemsRegex.test(techDebt)) {
+    errors.push("ai/plans/tech-debt.md must include Open Items.");
+  }
+
+if (errors.length > 0) {
+  console.error("Plan check failed.");
+  for (const error of errors) console.error(`- ${error}`);
+  process.exit(1);
+}
+
+console.log("Plan check passed.");

package/template/scripts/check-readiness.mjs.tpl

@@ -0,0 +1,130 @@
+#!/usr/bin/env node
+
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const models = {
+  openai: {{MODEL_OPENAI_ENABLED}},
+  anthropic: {{MODEL_ANTHROPIC_ENABLED}},
+};
+const clientSupport = {
+  codexHooks: {{CLIENT_CODEX_HOOKS_ENABLED}},
+};
+const requiredVerdicts = ["PASS", "FAIL", "MANUAL REVIEW REQUIRED"];
+const readinessCommands = {
+  validateGovernance: "node scripts/validate-governance.mjs",
+  bootstrapWorkspaceDryRun: "node scripts/bootstrap-workspace.mjs --dry-run",
+  bootstrapWorkspace: "node scripts/bootstrap-workspace.mjs",
+  checkWorkspace: "node scripts/check-workspace.mjs",
+  checkOverlayDrift: "node scripts/check-overlay-drift.mjs",
+  checkCodexHooks: "node scripts/check-codex-hooks.mjs",
+  checkClaudeCompatibility: "node scripts/check-claude-compatibility.mjs",
+};
+const qualityTableHeader = "| Domain | Grade | Evidence | Enforced by | Blocking gaps |";
+const gradePattern = /^(A|B|C|D|F|Manual|N\/A)$/;
+const placeholderPattern = /^(todo|tbd|none)$/i;
+
+async function read(relativePath) {
+  return readFile(path.join(repoRoot, relativePath), "utf8");
+}
+
+function tableRows(markdown, headerPrefix) {
+  const lines = markdown.split(/\r?\n/);
+  const start = lines.findIndex((line) => line.startsWith(headerPrefix));
+  if (start === -1) return [];
+  const rows = [];
+  for (const line of lines.slice(start + 2)) {
+    if (!line.startsWith("|")) break;
+    rows.push(line);
+  }
+  return rows;
+}
+
+function cells(row) {
+  return row
+    .split("|")
+    .slice(1, -1)
+    .map((cell) => cell.trim());
+}
+
+const readiness = await read("ai/READINESS.md");
+const quality = await read("ai/QUALITY.md");
+const errors = [];
+
+for (const verdict of requiredVerdicts) {
+  if (!readiness.includes(verdict)) {
+    errors.push(`ai/READINESS.md must define the ${verdict} verdict.`);
+  }
+}
+
+const requiredCommands = [
+  readinessCommands.validateGovernance,
+  readinessCommands.bootstrapWorkspaceDryRun,
+  readinessCommands.bootstrapWorkspace,
+  readinessCommands.checkWorkspace,
+];
+if (models.openai || models.anthropic) requiredCommands.push(readinessCommands.checkOverlayDrift);
+if (clientSupport.codexHooks) requiredCommands.push(readinessCommands.checkCodexHooks);
+if (models.anthropic) requiredCommands.push(readinessCommands.checkClaudeCompatibility);
+
+for (const command of requiredCommands) {
+  if (!readiness.includes(command)) {
+    errors.push(`ai/READINESS.md must list required command: ${command}`);
+  }
+}
+
+const scorePatterns = [
+  /\b\d{1,3}\s*%/,
+  /\b\d+\s*\/\s*100\b/,
+  /\breadiness score\s*[:=]\s*\d+/i,
+];
+for (const [relativePath, content] of [
+  ["ai/READINESS.md", readiness],
+  ["ai/QUALITY.md", quality],
+]) {
+  for (const pattern of scorePatterns) {
+    if (pattern.test(content)) {
+      errors.push(`${relativePath} must not use a numeric readiness score.`);
+      break;
+    }
+  }
+}
+
+const qualityRows = tableRows(quality, qualityTableHeader);
+if (qualityRows.length === 0) {
+  errors.push("ai/QUALITY.md must include the readiness scorecard table.");
+}
+
+for (const row of qualityRows) {
+  const [domain, grade, evidence, enforcedBy, blockingGaps] = cells(row);
+  if (![domain, grade, evidence, enforcedBy, blockingGaps].every(Boolean)) {
+    errors.push(`ai/QUALITY.md has an incomplete scorecard row: ${row}`);
+    continue;
+  }
+  if (!gradePattern.test(grade)) {
+    errors.push(`ai/QUALITY.md has unsupported grade "${grade}" for ${domain}.`);
+  }
+  for (const [label, value] of [
+    ["Evidence", evidence],
+    ["Enforced by", enforcedBy],
+    ["Blocking gaps", blockingGaps],
+  ]) {
+    if (placeholderPattern.test(value)) {
+      errors.push(`ai/QUALITY.md ${label} for ${domain} must be evidence-based, not "${value}".`);
+    }
+  }
+}
+
+if (!quality.includes("ai/READINESS.md") || !quality.includes("scripts/check-readiness.mjs")) {
+  errors.push("ai/QUALITY.md must link readiness evidence to ai/READINESS.md and scripts/check-readiness.mjs.");
+}
+
+if (errors.length > 0) {
+  console.error("Readiness check failed.");
+  for (const error of errors) console.error(`- ${error}`);
+  process.exit(1);
+}
+
+console.log("Readiness check passed.");

package/template/scripts/check-review-skills.mjs.tpl

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+
+import { readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const skillsReadmePath = "ai/skills/README.md";
+const skillsDir = "ai/skills";
+const skillFileExtension = ".md";
+const requiredSections = [
+  "Purpose",
+  "When to Use",
+  "Required Inputs",
+  "Blocking Findings",
+  "Non-Blocking Observations",
+  "Output Format",
+  "Escalation Rules",
+  "Validation Or Evidence",
+];
+
+async function read(relativePath) {
+  return readFile(path.join(repoRoot, relativePath), "utf8");
+}
+
+function hasHeading(content, heading) {
+  return new RegExp(`^## ${heading}\\s*$`, "m").test(content);
+}
+
+const errors = [];
+const readme = await read(skillsReadmePath);
+const entries = await readdir(path.join(repoRoot, skillsDir), { withFileTypes: true });
+for (const entry of entries.filter((item) => item.isFile() && item.name.endsWith(skillFileExtension) && item.name !== "README.md")) {
+  const relativePath = `ai/skills/${entry.name}`;
+  const content = await read(relativePath);
+  if (!readme.includes(entry.name)) errors.push(`${relativePath} is not linked from ai/skills/README.md.`);
+  for (const section of requiredSections) {
+    if (!hasHeading(content, section)) errors.push(`${relativePath} is missing section '${section}'.`);
+  }
+}
+
+if (errors.length > 0) {
+  console.error("Review skill check failed.");
+  for (const error of errors) console.error(`- ${error}`);
+  process.exit(1);
+}
+
+console.log("Review skill check passed.");

package/template/scripts/check-task-template.mjs.tpl

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const taskTemplatePath = "ai/templates/task-brief-template.md";
+const content = await readFile(path.join(repoRoot, taskTemplatePath), "utf8");
+const providerModelPattern = /\b(?:gpt-|claude|opus|sonnet|haiku)/i;
+
+const requiredSections = [
+  "## Summary",
+  "## Context",
+  "## Goals",
+  "## Non-Goals",
+  "## Scope",
+  "## Path Contract",
+  "## Requirements",
+  "## Bootstrap Requirements",
+  "## Proposed Approach",
+  "## Agent Execution Protocol",
+  "## Success Criteria",
+  "## Validation",
+  "## Validation Evidence Required",
+  "## Risk and Autonomy",
+  "## Review Routing",
+  "## Dependencies",
+  "## Rollback / Recovery",
+  "## Open Questions",
+  "## Notes for the Agent",
+];
+
+const requiredFrontmatter = [
+  "id:",
+  "status:",
+  "risk:",
+  "autonomy:",
+  "model_policy:",
+  "model:",
+  "repos:",
+  "allowed_paths:",
+  "forbidden_paths:",
+  "requires_human_approval:",
+];
+
+const errors = [];
+for (const token of [...requiredSections, ...requiredFrontmatter]) {
+  if (!content.includes(token)) errors.push(`${taskTemplatePath} is missing ${token}`);
+}
+
+const modelLine = content.split("\n").find((line) => line.startsWith("model:"));
+if (modelLine && providerModelPattern.test(modelLine)) {
+  errors.push(`${taskTemplatePath} must use a runtime-neutral model selector, not a concrete provider model.`);
+}
+
+if (errors.length > 0) {
+  console.error("Task template check failed.");
+  for (const error of errors) console.error(`- ${error}`);
+  process.exit(1);
+}
+
+console.log("Task template check passed.");