@tech-leads-club/harness-toolkit 0.3.6 → 0.4.0

package/src/platform/frontmatter.ts

@@ -0,0 +1,142 @@
+/**
+ * The one frontmatter reader.
+ *
+ * why here: there were two — a full parser in `tools/dev/check-docs-bundle.ts`, which never ships and which
+ * `core/` may not import, and a private single-field extractor in `core/release/release.decisions.ts`. Operator
+ * rules need a third caller, and a third copy is the duplication this product's own gate refuses. It sits in
+ * `platform/` because it is a format primitive with no policy in it, and because that is the one direction all
+ * three callers may import from ([/decisions/ad-100.md](/decisions/ad-100.md)).
+ *
+ * invariant: pure. No filesystem, no clock. The caller reads the file.
+ */
+
+export type FrontmatterValue = string | string[];
+export type Frontmatter = Record<string, FrontmatterValue>;
+
+/** The shape `check-docs-bundle` already consumed, kept so moving this changed no caller's contract. */
+export type ParseResult = { frontmatter: Frontmatter | null; error: string | null };
+
+export type FrontmatterDoc = {
+  fields: Frontmatter;
+  /** Everything after the closing fence, verbatim. An operator rule's instruction lives here. */
+  body: string;
+};
+
+function extractFrontmatterBlock(content: string): { block: string; bodyAt: number } | null {
+  if (!content.startsWith("---\n") && !content.startsWith("---\r\n")) {
+    return null;
+  }
+  const firstBreak = content.indexOf("\n");
+  const rest = content.slice(firstBreak + 1);
+  const closingMatch = /^---\s*$/m.exec(rest);
+  if (!closingMatch) {
+    return null;
+  }
+  return {
+    block: rest.slice(0, closingMatch.index),
+    bodyAt: firstBreak + 1 + closingMatch.index + closingMatch[0].length,
+  };
+}
+
+function stripQuotes(raw: string): string {
+  const trimmed = raw.trim();
+  if (trimmed.length >= 2) {
+    const first = trimmed[0];
+    const last = trimmed[trimmed.length - 1];
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+      return trimmed.slice(1, -1);
+    }
+  }
+  return trimmed;
+}
+
+/**
+ * hazard: an escaped quote inside a value survived the outer-quote strip and reached the operator as a literal
+ * `\"` in their terminal. Seen in a real update run ([/decisions/ad-034.md](/decisions/ad-034.md)).
+ */
+function unescapeQuotes(value: string): string {
+  return value.replace(/\\(["'\\])/g, "$1");
+}
+
+function parseValue(raw: string): FrontmatterValue {
+  const trimmed = raw.trim();
+  if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+    const inner = trimmed.slice(1, -1).trim();
+    if (inner === "") {
+      return [];
+    }
+    return inner.split(",").map((item) => unescapeQuotes(stripQuotes(item)));
+  }
+  return unescapeQuotes(stripQuotes(trimmed));
+}
+
+/**
+ * why block lists: a rule declares several proofs, and `require: [a, b]` on one line is not how anybody writes
+ * three of them. `key:` with nothing after it opens a list; `key: value` closes any list before it.
+ */
+export function parseFrontmatterDoc(content: string): { doc: FrontmatterDoc | null; error: string | null } {
+  const extracted = extractFrontmatterBlock(content);
+  if (extracted === null) {
+    return { doc: null, error: "missing --- frontmatter block" };
+  }
+  const fields: Frontmatter = {};
+  let listKey: string | null = null;
+
+  for (const line of extracted.block.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) {
+      continue;
+    }
+    if (trimmed.startsWith("- ")) {
+      if (listKey === null) {
+        return { doc: null, error: `list item with no key above it: "${trimmed}"` };
+      }
+      const current = fields[listKey];
+      const item = unescapeQuotes(stripQuotes(trimmed.slice(2)));
+      fields[listKey] = Array.isArray(current) ? [...current, item] : [item];
+      continue;
+    }
+    const separator = trimmed.indexOf(":");
+    if (separator === -1) {
+      return { doc: null, error: `unparseable frontmatter line: "${trimmed}"` };
+    }
+    const key = trimmed.slice(0, separator).trim();
+    if (key === "") {
+      return { doc: null, error: `frontmatter line has an empty key: "${trimmed}"` };
+    }
+    const value = trimmed.slice(separator + 1);
+    if (value.trim() === "") {
+      fields[key] = [];
+      listKey = key;
+      continue;
+    }
+    fields[key] = parseValue(value);
+    listKey = null;
+  }
+
+  return { doc: { fields, body: content.slice(extracted.bodyAt).trim() }, error: null };
+}
+
+/** invariant: the shape the docs bundle check already used. One implementation, two entry points. */
+export function parseFrontmatter(content: string): ParseResult {
+  const { doc, error } = parseFrontmatterDoc(content);
+  return doc === null ? { frontmatter: null, error } : { frontmatter: doc.fields, error: null };
+}
+
+/** why: one field, by name, for a caller that wants nothing else. */
+export function frontmatterField(content: string, field: string): string | undefined {
+  const { doc } = parseFrontmatterDoc(content);
+  const value = doc?.fields[field];
+  if (typeof value !== "string" || value.trim() === "") {
+    return undefined;
+  }
+  return value.trim();
+}
+
+/** why: every field a rule reads is one value or a list of them, and the caller should not care which. */
+export function asList(value: FrontmatterValue | undefined): string[] {
+  if (value === undefined) {
+    return [];
+  }
+  return (Array.isArray(value) ? value : [value]).filter((item) => item !== "");
+}

package/src/platform/links.ts

@@ -48,6 +48,38 @@ export function linkDir(source: string, target: string): LinkOutcome {
   return { kind: replaced ? "relinked" : "linked", target, source };
 }
 
+/**
+ * Point a *file* `target` at `source`, for the `tlc` command on `PATH`.
+ *
+ * why not `linkDir`: its link type is `"junction"`, which Windows reads and which only means anything for a
+ * directory. A file gets no type argument, which is correct on every platform — and where a platform refuses to
+ * create one, the reason is reported rather than thrown, because a missing convenience link must not fail an
+ * install that otherwise worked ([/decisions/ad-101.md](/decisions/ad-101.md)).
+ *
+ * invariant: the same contract as `linkDir` — an existing link is replaced, anything else is refused. A real file
+ * called `tlc` in someone's bin directory is theirs.
+ */
+export function linkFile(source: string, target: string): LinkOutcome {
+  let replaced = false;
+  if (isLink(target)) {
+    rmSync(target, { force: true });
+    replaced = true;
+  } else if (existsSync(target)) {
+    return {
+      kind: "refused",
+      target,
+      reason: `${target} exists and is not a link — move it aside and re-run`,
+    };
+  }
+  try {
+    mkdirSync(dirname(target), { recursive: true });
+    symlinkSync(source, target);
+  } catch (error) {
+    return { kind: "refused", target, reason: (error as Error).message };
+  }
+  return { kind: replaced ? "relinked" : "linked", target, source };
+}
+
 /**
  * why lstat: a link whose destination is gone is still a link, and `existsSync` says it is not there — so the
  * check has to come first, or a dangling link reads as free space. Node reports a Windows junction as a symbolic

package/src/platform/paths.ts

@@ -1,5 +1,5 @@
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { delimiter, join, resolve } from "node:path";
 
 function harnessDir(root: string): string {
   return join(root, ".tlc", "harness");
@@ -22,15 +22,38 @@ export function runtimeHome(env: NodeJS.ProcessEnv = process.env): string {
 
 /**
  * invariant: `tlc-exec` always sets `TLC_HOME` in the child, so the child cannot tell an operator's choice from
- * the launcher's own resolution. This flag is that difference, and only the installer needs it — everything else
- * wants the resolved home either way.
+ * the launcher's own resolution. This flag is that difference.
  */
 export function runtimeHomeWasChosen(env: NodeJS.ProcessEnv = process.env): boolean {
   return env.TLC_HOME_FROM_ENV === "1";
 }
 
+/**
+ * Where this **machine's** operator data lives: the user-tier config, the global lesson tier, the global rules,
+ * the price catalogue, the cross-repo spool.
+ *
+ * hazard: all of that used to resolve through `runtimeHome()`, which names where the *code* lives and moves with
+ * the install. With two installs on one machine there were two "global" tiers, silently — and switching between
+ * them looked like data loss. Measured on an operator's machine: a lesson saved with `--global` landed in a
+ * checkout's state directory while the CLI printed "every product on this machine will read it", and a user-tier
+ * config with a subagent allowlist stopped being read the moment the runtime home changed
+ * ([/decisions/ad-101.md](/decisions/ad-101.md)).
+ *
+ * why the flag rather than always the conventional path: an operator who exports `TLC_HOME` is choosing a home and
+ * means it, and the test suite pins one for hermeticity. Only the launcher's own resolution — which marks itself
+ * `TLC_HOME_FROM_ENV=0` — must not be allowed to invent a second machine.
+ */
+export function machineHome(env: NodeJS.ProcessEnv = process.env): string {
+  return env.TLC_HOME_FROM_ENV === "0" ? conventionalRuntimeHome() : runtimeHome(env);
+}
+
+/** invariant: the one path install seeds and update never writes ([/decisions/ad-056.md](/decisions/ad-056.md)). */
+export function machineConfigPath(env: NodeJS.ProcessEnv = process.env): string {
+  return join(machineHome(env), "config.json");
+}
+
 export function runtimeStateDir(): string {
-  return join(runtimeHome(), "state");
+  return join(machineHome(), "state");
 }
 
 // why: one file for every repository on the machine. Per-repo state stays authoritative; this is the
@@ -105,3 +128,34 @@ export function userSettingsPaths(): string[] {
 export function providerConfigDirs(): string[] {
   return [cursorConfigDir(), claudeConfigDir()];
 }
+
+/**
+ * Where the `tlc` command goes so a shell can find it.
+ *
+ * hazard: this lived only in `uninstall-runtime.ts`, which removed a launcher `install` never created. The command
+ * came from npm's own shim instead — and that shim sits in the `bin` directory of whichever Node version npm ran
+ * under, which leaves `PATH` the moment a version manager switches. Measured on an operator's machine: a
+ * successful install followed immediately by `tlc: command not found`
+ * ([/decisions/ad-101.md](/decisions/ad-101.md)).
+ *
+ * invariant: one definition, so what install creates and what uninstall removes cannot drift apart.
+ */
+export function launcherBinDir(env: NodeJS.ProcessEnv = process.env): string {
+  return env.TLC_BIN_DIR?.trim() || join(homedir(), ".local", "bin");
+}
+
+/** why the extensionless wrapper: it is what a shell runs. The `.cmd` beside it is Windows's copy of the same. */
+export function launcherNames(): readonly string[] {
+  return ["tlc", "tlc.cmd"];
+}
+
+/**
+ * Whether a shell would find something in this directory.
+ *
+ * why it matters at install time: a launcher nobody can reach is worse than none, because `doctor` then reports a
+ * healthy link while the command still does not exist.
+ */
+export function isOnPath(dir: string, env: NodeJS.ProcessEnv = process.env): boolean {
+  const entries = (env.PATH ?? "").split(delimiter).filter((entry) => entry.length > 0);
+  return entries.some((entry) => resolve(entry) === resolve(dir));
+}

package/src/platform/pricing.ts

@@ -13,7 +13,7 @@
  */
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { runtimeHome } from "./paths.ts";
+import { machineHome } from "./paths.ts";
 
 export type VendorPool = "cursor_models" | "anthropic_models" | "other_models" | "auto" | "unknown";
 export type NeutralPool = "provider_native" | "other" | "auto" | "unknown";
@@ -163,7 +163,7 @@ function fuzzyFind(table: PriceTable, needle: string): { key: string; entry: Mod
 
 /** The catalogue the refresh writes. Not versioned, not packaged, per machine. */
 export function cataloguePath(): string {
-  return join(runtimeHome(), "model-prices.json");
+  return join(machineHome(), "model-prices.json");
 }
 
 /**
@@ -174,7 +174,7 @@ export function cataloguePath(): string {
  * refresh would replace. The refresh moves such a file here rather than overwriting it.
  */
 export function overridesPath(): string {
-  return join(runtimeHome(), "model-prices.local.json");
+  return join(machineHome(), "model-prices.local.json");
 }
 
 export type PriceResolution = {

package/src/platform/screen.ts

@@ -2,7 +2,14 @@ import { KV_WIDTH, type StatusLevel, type Style, SYMBOLS } from "./style.ts";
 
 export type Row = { label: string; value: string; level?: StatusLevel };
 
-export type Section = { title?: string; rows?: Row[]; lines?: string[] };
+/**
+ * `wrap` marks a section's lines as prose, so they are broken at word boundaries to fit the terminal.
+ *
+ * why opt-in rather than always: a section's lines are sometimes a command to copy — wrapping
+ * `tlc harness policy accept <path>` across two lines makes it unpasteable. Prose and payload look identical to a
+ * renderer, so the caller says which it has ([/decisions/ad-101.md](/decisions/ad-101.md)).
+ */
+export type Section = { title?: string; rows?: Row[]; lines?: string[]; wrap?: boolean };
 
 export type Screen = {
   title: string;
@@ -11,9 +18,54 @@ export type Screen = {
   footer?: string;
 };
 
+/** The two-space indent `render` puts in front of every line, which the wrap width has to leave room for. */
+const INDENT = 2;
+
+/**
+ * why clamped: a 400-column terminal produces lines nobody tracks across, and an 8-column one produces a word per
+ * line. Outside a TTY there is no width to read, and a fixed sensible one beats guessing.
+ */
+export function terminalColumns(columns: number | undefined = process.stdout.columns): number {
+  return Math.min(110, Math.max(60, columns ?? 100));
+}
+
+/**
+ * Break prose at word boundaries so nothing is hidden.
+ *
+ * hazard: the lessons list cut the instruction at 160 characters with no marker — a 263-character lesson lost 103
+ * of them mid-word, and the reader could not tell. An operator asked why their lesson had been cut; it had not
+ * been, only its display had ([/decisions/ad-101.md](/decisions/ad-101.md)).
+ *
+ * invariant: a word longer than the width stands on its own line rather than being cut. Losing a character is
+ * worse than an overlong line, because only one of the two is visible.
+ */
+export function wrapText(text: string, width: number): string[] {
+  if (text === "") {
+    return [""];
+  }
+  const lines: string[] = [];
+  let current = "";
+  for (const word of text.split(/\s+/).filter((part) => part.length > 0)) {
+    if (current === "") {
+      current = word;
+      continue;
+    }
+    if (current.length + 1 + word.length <= width) {
+      current = `${current} ${word}`;
+      continue;
+    }
+    lines.push(current);
+    current = word;
+  }
+  if (current !== "") {
+    lines.push(current);
+  }
+  return lines.length === 0 ? [""] : lines;
+}
+
 // why: screens describe their content and never their paint, so spacing, colour and alignment are decided once.
 // A new screen can only emit this shape, which is what makes "no screen outside the standard" mechanical.
-export function render(screen: Screen, style: Style): string {
+export function render(screen: Screen, style: Style, columns = terminalColumns()): string {
   const out: string[] = [style.heading(screen.title.toUpperCase())];
 
   if (screen.summary && screen.summary.length > 0) {
@@ -35,7 +87,14 @@ export function render(screen: Screen, style: Style): string {
       out.push(style.kv(row.label, value, width));
     }
     for (const line of section.lines ?? []) {
-      out.push(line === "" ? "" : `  ${line}`);
+      if (line === "") {
+        out.push("");
+        continue;
+      }
+      const parts = section.wrap ? wrapText(line, columns - INDENT) : [line];
+      for (const part of parts) {
+        out.push(`  ${part}`);
+      }
     }
   }
 

package/tools/doctor.ts

@@ -2,13 +2,14 @@ import { spawnSync } from "node:child_process";
 import { existsSync, lstatSync, readFileSync, readlinkSync, realpathSync } from "node:fs";
 import { homedir, platform as osPlatform } from "node:os";
 import { basename, delimiter, dirname, join } from "node:path";
-import { NPM_PACKAGE, runtimePathKind } from "../bin/tlc-cli.ts";
+import { runtimePathKind } from "../bin/tlc-cli.ts";
 import { findBunOnPath, writeRuntimeCache } from "../bin/tlc-exec.mjs";
 import { isCursorWired } from "../bin/write-user-hooks.mjs";
 import type { ProviderWiring } from "../src/contracts/index.ts";
 import { coreFacade } from "../src/core/index.ts";
 import { emitJson, takeJsonFlag } from "../src/platform/cli-output.ts";
 import {
+  launcherBinDir,
   projectConfigPath,
   projectStateDir,
   providerConfigDirs,
@@ -244,6 +245,69 @@ export function resolveOnPath(
   return null;
 }
 
+/**
+ * The operator's own rules: which apply, where each came from, and any that can never be satisfied here.
+ *
+ * why the tier is printed: two tiers apply together, so "why did this fire?" and "why did it not?" are both
+ * answered by knowing whether the rule came from this project or from the machine
+ * ([/decisions/ad-100.md](/decisions/ad-100.md)).
+ *
+ * invariant: silent when the capability is off, and silent when no rule is declared. A row about a mechanism
+ * nobody opted into is noise on every healthy install ([/decisions/ad-034.md](/decisions/ad-034.md)).
+ */
+export function checkRules(root: string): Check[] {
+  const policy = coreFacade.policy.loadPolicy(root);
+  // why the switch is not re-read here: `load` owns it, and a second copy of the same condition is a second
+  // thing to keep true ([/decisions/ad-100.md](/decisions/ad-100.md)).
+  const set = coreFacade.rules.load(root, policy.rules);
+  if (set.rules.length === 0 && set.disabled.length === 0 && set.errors.length === 0) {
+    return [];
+  }
+
+  const checks: Check[] = [];
+  if (set.rules.length > 0) {
+    checks.push({
+      level: "ok",
+      name: "operator rules",
+      detail: set.rules
+        .map((rule) => `${rule.name} (${rule.tier}) on ${rule.on.kind} → ${rule.otherwise}`)
+        .join("; "),
+    });
+  }
+
+  // why an `ok` row: switching a global off in one repository is a decision, not a fault. It is reported because
+  // an operator who forgot they did it would otherwise wonder why nothing fires.
+  if (set.disabled.length > 0) {
+    checks.push({
+      level: "ok",
+      name: "operator rules (off here)",
+      detail: set.disabled.map((rule) => rule.name).join(", "),
+    });
+  }
+
+  for (const error of set.errors) {
+    checks.push({
+      level: "fail",
+      name: `operator rule (${error.name})`,
+      detail: `${error.error} — the other rules still apply`,
+    });
+  }
+
+  /**
+   * hazard: a rule whose proof kind this project has never recorded reads as protection and enforces nothing an
+   * operator can satisfy. Saying so is factual; guessing at the host's capabilities would not be.
+   */
+  for (const entry of coreFacade.rules.unobservedKinds(set.rules, coreFacade.rules.observations(root))) {
+    checks.push({
+      level: "warn",
+      name: `operator rule (${entry.rule})`,
+      detail: `needs ${entry.kinds.join(", ")}, and no observation of that kind has been recorded in this project yet`,
+    });
+  }
+
+  return checks;
+}
+
 export function checkRuntimePaths(home: string, platform: NodeJS.Platform): Check[] {
   const launcher = join(home, "bin", "tlc-exec.mjs");
   const distSample = join(home, "dist", "stop.mjs");
@@ -262,7 +326,12 @@ export function checkRuntimePaths(home: string, platform: NodeJS.Platform): Chec
     {
       level: onPath === null ? "fail" : "ok",
       name: "CLI on PATH",
-      detail: onPath ?? `no \`tlc\` on PATH — npm i -g ${NPM_PACKAGE}, or \`npm link\` from a clone`,
+      // hazard: this said "npm i -g <package>" — advice an operator who had just done exactly that could not act
+      // on. npm's shim lives in the bin directory of whichever Node version npm ran under, and leaves PATH the
+      // moment a version manager switches ([/decisions/ad-101.md](/decisions/ad-101.md)).
+      detail:
+        onPath ??
+        `no \`tlc\` on PATH — link it: ln -s ${join(home, "bin", "tlc")} ${join(launcherBinDir(), "tlc")} (or re-run \`tlc harness install\`, which does it)`,
     },
   ];
 }
@@ -470,6 +539,94 @@ export function checkSubagentAllowlist(root: string): Check[] {
   ];
 }
 
+/**
+ * What the operator cannot otherwise find out: how many of their lessons actually reach the model.
+ *
+ * hazard: the char budget drops lessons, and the only place that said so was the injected block itself — text the
+ * model reads and the operator never sees. `lessons list` answers a different question (`not-injected` is about
+ * grading history, not about the budget), and `status` does not answer it at all. So an operator with six lessons
+ * and a 900-char budget saw six healthy lessons and had four that never left the file
+ * ([/decisions/ad-100.md](/decisions/ad-100.md)).
+ *
+ * why the real selector rather than a size sum: pinning, staleness, validity windows and the mode all bind before
+ * the budget does. Re-deriving the arithmetic here would be a second answer that drifts from the first.
+ */
+/**
+ * Which keys this project restates instead of deciding.
+ *
+ * hazard: the layers are `DEFAULTS < user < project`, and `init` writes the whole default policy when there is no
+ * config yet while the wizard writes every knob it collected. So a project config typically names dozens of values
+ * it did not choose — and each one shadows the machine-wide tier for ever. An operator who raises
+ * `maxCharsSession` once, on the machine, sees no change in any repository that restated the old number, and
+ * nothing said why ([/decisions/ad-100.md](/decisions/ad-100.md)).
+ *
+ * invariant: a warning, never a failure. Restating a value is legitimate — pinning a project to a number on
+ * purpose is a real intent. What is not legitimate is not knowing.
+ */
+export function checkShadowedPolicy(root: string): Check[] {
+  const project = coreFacade.capability.readProjectPolicyRaw(root);
+  if (!project) {
+    return [];
+  }
+  const shadowed = coreFacade.policy.shadowedKeys(project, coreFacade.policy.resolvedWithoutProjectTier());
+  if (shadowed.length === 0) {
+    return [];
+  }
+  const shown = shadowed.slice(0, 6).map((key) => key.path);
+  const rest = shadowed.length - shown.length;
+  return [
+    {
+      level: "warn",
+      name: "project policy restates lower tiers",
+      detail: `${plural(shadowed.length, "key")} in this project's config name the value ${shadowed.length === 1 ? "it" : "they"} would already have: ${shown.join(", ")}${rest > 0 ? `, and ${rest} more` : ""}. Each one stops tracking ${join(runtimeHome(), "config.json")}, so a machine-wide change will not reach this repository. Delete what this project did not decide.`,
+    },
+  ];
+}
+
+export function checkLessonBudget(root: string): Check[] {
+  const policy = coreFacade.policy.loadPolicy(root);
+  const config = policy.intelligence.lessons;
+  if (!config.enabled) {
+    return [];
+  }
+  const selected = coreFacade.lesson.previewLessonSelection({ projectDir: root, config, mode: "session" });
+  const reaching = selected.lessons.length;
+  if (selected.omitted === 0) {
+    return reaching === 0
+      ? []
+      : [
+          {
+            level: "ok",
+            name: "lesson budget",
+            detail: `every eligible lesson reaches the model at session start (${plural(reaching, "lesson")}, maxCharsSession ${config.maxCharsSession})`,
+          },
+        ];
+  }
+  const chars = selected.lessons.reduce(
+    (total, lesson) => total + coreFacade.lesson.renderLessonBlock(lesson).length,
+    0,
+  );
+  const hogs = selected.lessons
+    .filter((lesson) => lesson.pinned)
+    .map((lesson) => `${lesson.id} (pinned, ${coreFacade.lesson.renderLessonBlock(lesson).length} chars)`);
+  return [
+    {
+      level: "warn",
+      name: "lesson budget",
+      detail: [
+        // hazard: this read "4 eligible lessons never reaches". `plural` handles the noun and the verb still has to
+        // agree — the same slip the unproven row already carries a note about.
+        `${plural(selected.omitted, "eligible lesson")} ${selected.omitted === 1 ? "never reaches" : "never reach"} the model at session start:`,
+        `${reaching} of ${reaching + selected.omitted} fit in maxCharsSession ${config.maxCharsSession} (${chars} used).`,
+        hogs.length > 0 ? `Pinned lessons go first and take the room: ${hogs.join(", ")}.` : "",
+        "Raise intelligence.lessons.maxCharsSession, shorten a lesson, or unpin one. Run: tlc harness lessons list",
+      ]
+        .filter(Boolean)
+        .join(" "),
+    },
+  ];
+}
+
 export function checkLessonHealth(root: string): Check[] {
   const policy = coreFacade.policy.loadPolicy(root);
   if (!policy.intelligence.lessons.enabled) {
@@ -597,6 +754,8 @@ export function checkProjectPolicy(root: string): Check[] {
     checkPosture(root),
     ...checkObservedRails(root),
     ...checkLessonHealth(root),
+    ...checkLessonBudget(root),
+    ...checkShadowedPolicy(root),
     ...checkSubagentAllowlist(root),
     ...checkPolicyDivergence(root),
     ...checkGateScope(root),
@@ -643,6 +802,7 @@ export function runChecks(ctx: DoctorContext): Check[] {
     ...checkProjectPolicy(ctx.root),
     ...checkCapabilities(ctx.root, ctx.runtimeHome),
     ...checkPrices(),
+    ...checkRules(ctx.root),
     checkGlobalCommands(ctx.home),
   ];
 }