@techgoblin/gobstack 0.0.0-stage → 0.4.4-beta.2

package/bin/goblin-audit

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# goblin-audit — run the DECLARED dependency audit ONCE, deliberately, and write the record that
+# SC-07 reads.
+#
+#   goblin-audit [--target <dir>] [--print] [--help]
+#
+# This is the ONE command in the toolchain that touches the network, and it is not a check: SC-07
+# never runs it, never calls out, and reads only the record it leaves behind. That split is the
+# whole design (docs/RISKS.md K4: a network call at verify time breaks the offline dependency
+# contract). Run it when you mean to, then commit `.goblin/audit.tsv`.
+#
+# What it writes: `.goblin/audit.tsv`, with a `measured <date>` line and one TAB-separated line
+# per high|critical advisory:
+#
+#   package	severity	id	url
+#
+# Exit codes:
+#   0  the record was written (whether or not it is clean)
+#   2  usage, or no .goblin/goblin.yaml to read `security.audit_cmd` from
+#   3  the class declares no audit command (security.audit_cmd is empty) - nothing to run
+#   4  the declared command could not run
+#   5  the output could not be parsed as an audit report - REFUSING to write an empty record,
+#      because an empty record reads to SC-07 as "clean" and that would be a fabricated pass
+set -uo pipefail
+
+GOBLIN_AUDIT_VERSION="0.4.4"
+
+usage() { sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
+
+TARGET="$(pwd)"
+PRINT=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --target) TARGET="${2:-}"; shift 2 ;;
+    --print)  PRINT=1; shift ;;
+    --help|-h) usage; exit 0 ;;
+    *) printf 'goblin-audit: unknown argument: %s\n' "$1" >&2; usage >&2; exit 2 ;;
+  esac
+done
+[ -n "$TARGET" ] || { printf 'goblin-audit: --target needs a directory\n' >&2; exit 2; }
+cd "$TARGET" || { printf 'goblin-audit: no such directory: %s\n' "$TARGET" >&2; exit 2; }
+
+CONFIG=".goblin/goblin.yaml"
+[ -f "$CONFIG" ] || { printf 'goblin-audit: %s has no %s - run goblin-install first\n' "$TARGET" "$CONFIG" >&2; exit 2; }
+
+# Self-contained on purpose: the audit runner must work even if goblin-lib.sh was edited or is
+# missing, because it is the one tool a human runs by hand.
+g_yaml_block_scalar() { # <file> <block> <key>
+  awk -v b="$2" -v k="$3" '
+    $0 ~ ("^" b ":[[:space:]]*$") { inb = 1; next }
+    inb && /^[^ ]/ { inb = 0 }
+    inb && $0 ~ ("^  " k ":") {
+      v = $0; sub("^  " k ":[[:space:]]*", "", v); print v; exit
+    }
+  ' "$1"
+}
+
+AUDIT_CMD=$(g_yaml_block_scalar "$CONFIG" security audit_cmd)
+if [ -z "$AUDIT_CMD" ]; then
+  printf 'goblin-audit: this class declares no audit command (security.audit_cmd is empty in\n'
+  printf '  %s). Nothing to run, and no record to write.\n' "$CONFIG"
+  exit 3
+fi
+
+TODAY=$(date -u +%F)
+RAW=$(mktemp) || exit 2
+trap 'rm -f "$RAW"' EXIT
+
+printf 'goblin-audit: running the declared audit ONCE (this is the deliberate network step):\n  %s\n' "$AUDIT_CMD"
+# shellcheck disable=SC2086
+bash -c "$AUDIT_CMD" > "$RAW" 2>&1
+RC=$?
+if [ "$RC" -ne 0 ] && [ ! -s "$RAW" ]; then
+  printf 'goblin-audit: the declared command exited %s and printed nothing\n' "$RC" >&2
+  exit 4
+fi
+
+# npm audit exits non-zero when it FINDS advisories, which is the normal case we are recording.
+# So the exit code is not the signal here - the parse is.
+if ! grep -qE '"(vulnerabilities|advisories)"|auditReportVersion' "$RAW"; then
+  printf 'goblin-audit: the output is not an audit report (no "vulnerabilities", "advisories" or\n' >&2
+  printf '  "auditReportVersion" key). REFUSING to write a record: an empty record reads to SC-07\n' >&2
+  printf '  as "clean", which would be a fabricated pass. First 20 lines:\n' >&2
+  head -n 20 "$RAW" >&2
+  exit 5
+fi
+
+RECORD=".goblin/audit.tsv"
+LINES=$(awk '
+  # npm v2/v3 JSON. Two shapes matter:
+  #   "vulnerabilities": { "<pkg>": { "name": ..., "severity": "high", "via": [ ... ] } }
+  #   "via": [ { "source": 1, "name": "<pkg>", "id": 1091, "url": "https://..." , ... "range": "..." } ]
+  # The vulnerability object names its severity BEFORE the via block that carries the advisory id
+  # and url, so the entries are buffered and printed at END rather than on the severity line.
+  # Field order (source, name, dependency, title, url, severity, cwe, cvss, range) is what makes
+  # "range" a safe end-of-advisory marker; anything the parse cannot pair is left empty on the
+  # line, visibly, instead of guessed.
+  {
+    line = $0
+    if (match(line, /"source"[[:space:]]*:[[:space:]]*[0-9]+/)) {
+      inadv = 1; aname = ""; aurl = ""
+      s = substr(line, RSTART, RLENGTH); sub(/.*:[[:space:]]*/, "", s); aid = s
+    }
+    if (inadv) {
+      if (match(line, /"name"[[:space:]]*:[[:space:]]*"[^"]+"/)) {
+        s = substr(line, RSTART, RLENGTH); sub(/.*"[[:space:]]*:[[:space:]]*"/, "", s); sub(/"$/, "", s); aname = s
+      }
+      if (match(line, /"id"[[:space:]]*:[[:space:]]*[0-9]+/)) {
+        s = substr(line, RSTART, RLENGTH); sub(/.*:[[:space:]]*/, "", s); aid = s
+      }
+      if (match(line, /"url"[[:space:]]*:[[:space:]]*"[^"]+"/)) {
+        s = substr(line, RSTART, RLENGTH); sub(/.*"[[:space:]]*:[[:space:]]*"/, "", s); sub(/"$/, "", s); aurl = s
+      }
+      if (match(line, /"range"[[:space:]]*:/)) {
+        if (aname != "" && !(aname in adid)) { adid[aname] = aid; aurl2[aname] = aurl }
+        inadv = 0
+      }
+    }
+    if (match(line, /"name"[[:space:]]*:[[:space:]]*"[^"]+"/)) {
+      s = substr(line, RSTART, RLENGTH); sub(/.*"[[:space:]]*:[[:space:]]*"/, "", s); sub(/"$/, "", s); vname = s
+    }
+    if (match(line, /"severity"[[:space:]]*:[[:space:]]*"(high|critical)"/)) {
+      s = substr(line, RSTART, RLENGTH); sub(/.*:[[:space:]]*"/, "", s); sub(/"$/, "", s)
+      if (vname != "") vsev[vname] = s
+    }
+  }
+  END {
+    for (p in vsev) printf "%s\t%s\t%s\t%s\n", p, vsev[p], (p in adid ? adid[p] : ""), (p in aurl2 ? aurl2[p] : "")
+  }
+' "$RAW" | sort)
+
+{
+  printf '# .goblin/audit.tsv - written by goblin-audit %s on %s\n' "$GOBLIN_AUDIT_VERSION" "$TODAY"
+  printf '# command: %s\n' "$AUDIT_CMD"
+  printf '# one line per high|critical advisory: package<TAB>severity<TAB>id<TAB>url\n'
+  printf '# SC-07 reads this file and never the network. Each line must be matched in\n'
+  printf '# .goblin/audit-waiver.tsv (package, severity, id, date, reason) or it is a RED.\n'
+  printf 'measured %s\n' "$TODAY"
+  if [ -n "$LINES" ]; then printf '%s\n' "$LINES"; else printf '# no high|critical advisories\n'; fi
+} > "$RECORD"
+
+N=$(printf '%s\n' "$LINES" | grep -c '[^[:space:]]' || true)
+printf 'goblin-audit: wrote %s - %s high|critical advisory line(s), measured %s\n' "$RECORD" "$N" "$TODAY"
+if [ "$PRINT" -eq 1 ]; then printf '\n'; cat "$RECORD"; fi
+exit 0

package/bin/goblin-bans

@@ -0,0 +1,178 @@
+#!/usr/bin/env bash
+# goblin-bans — run the ban table. Dune rule 2: forbidden must fail mechanically.
+#
+# Usage:
+#   goblin-bans [--only <id[,id...]>] [--list]
+#
+# The table is .goblin/manifest/bans.tsv (installed) or manifest/bans.tsv (a checkout).
+# Each row's `detect` column is a real command, run from the repo root, that
+#   0  the tree is clean
+#   1  the ban is violated - the exit code alone decides; stdout, when any, names the lines
+#   2  the check could not run (FAIL CLOSED - a missing tool is never a silent pass)
+# A ban the config's `bans:` list does not name is SKIPPED with that reason; a ban whose
+# globs match no file is SKIPPED with that reason. A missing or empty ban table is exit 2.
+#
+# A narrow, explicit exception (Dune rule 5) reaches the probe through its environment, so it can
+# change the VERDICT and not only the printed detail: GOBLIN_BANS_ID (the ban) and
+# GOBLIN_BANS_EXEMPT (its `bans_exempt:` path prefixes) let the probe drop exempted hits before it
+# chooses its exit code, and `// BAN-OK(<id>): <reason>` clears one offending line. See
+# bans/README.md, "Narrow exceptions".
+#
+# Exit codes:
+#   0  every selected ban passed or skipped
+#   1  at least one selected ban FAILED
+#   2  the ban table is missing, empty or unreadable (fail closed)
+#   3  every selected ban was SKIPPED (only when exactly one ban is selected)
+#
+# No npm, no jq, no yq, no network. bash/git/awk/sed/grep only.
+
+set -uo pipefail
+
+GOBLIN_BANS_VERSION="0.4.4"
+SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=goblin-lib.sh
+. "$SELF_DIR/goblin-lib.sh"
+
+ONLY=""
+LIST=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --only) ONLY="${2:-}"; shift 2 ;;
+    --list) LIST=1; shift ;;
+    -h|--help)
+      sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    *) g_err "unknown option: $1"; exit 2 ;;
+  esac
+done
+
+# ---- root resolution (the installed config is the target's own marker) --------
+find_installed_root() {
+  local d="$PWD"
+  while :; do
+    if [ -f "$d/.goblin/goblin.yaml" ]; then printf '%s\n' "$d"; return 0; fi
+    [ "$d" = "/" ] && return 1
+    d=$(dirname "$d")
+  done
+}
+ROOT=$(find_installed_root) || ROOT=""
+if [ -z "$ROOT" ]; then
+  ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
+  [ -n "$ROOT" ] || ROOT="$PWD"
+fi
+
+CONFIG="$ROOT/.goblin/goblin.yaml"
+if [ -f "$ROOT/.goblin/manifest/bans.tsv" ]; then
+  BANS="$ROOT/.goblin/manifest/bans.tsv"
+else
+  BANS="$SELF_DIR/../manifest/bans.tsv"
+fi
+
+# Fail closed: no table, or a table with no data rows, is exit 2 - never a silent pass.
+if [ ! -f "$BANS" ]; then
+  g_err "no ban table at $BANS - the ban list cannot be empty and still enforce anything"
+  exit 2
+fi
+if [ "$(awk -F'\t' 'NR>1 && $1!="" {n++} END{print n+0}' "$BANS")" -eq 0 ]; then
+  g_err "the ban table $BANS holds no bans - an empty list enforces nothing (fail closed)"
+  exit 2
+fi
+
+if [ "$LIST" -eq 1 ]; then
+  awk -F'\t' 'NR>1 && $1!="" {printf "%-7s %s\n", $1, $2}' "$BANS"
+  exit 0
+fi
+
+# ---- the config: which bans this project turns on, and its narrow exceptions --
+ENABLED=""
+if [ -f "$CONFIG" ]; then
+  ENABLED=$(g_yaml_scalar "$CONFIG" bans)
+  ENABLED=${ENABLED#[}; ENABLED=${ENABLED%]}
+  ENABLED=$(printf '%s' "$ENABLED" | tr ',' ' ' | tr -s ' ' ' ')
+fi
+enabled() {
+  [ -z "$ENABLED" ] && return 1
+  for e in $ENABLED; do [ "$e" = "$1" ] && return 0; done
+  return 1
+}
+
+# bans_exempt: a list of "- <ID> <path>" items (Dune rule 5: narrow, explicit, reviewed).
+# W5-1: the exemption must reach the PROBE. Filtering the probe's stdout after it has already
+# chosen its exit code cannot change the verdict, and the exit code is the signal (V3-2) - so the
+# old stdout filter made every exemption DECORATIVE: a real violation inside an exempted path was
+# a permanent FAIL with no remedy (measured rc 0 at 72490f0 -> rc 1 at 7fec08f). The engine now
+# exports GOBLIN_BANS_ID and GOBLIN_BANS_EXEMPT and each shipped probe filters the FILE LIST
+# before it judges (bans/README.md, "Narrow exceptions"). A probe that ignores the variables
+# keeps the old behaviour, which fails CLOSED, never open.
+exempt_paths() { # exempt_paths <id> -> path prefixes, one per line
+  [ -f "$CONFIG" ] || return 0
+  g_yaml_list "$CONFIG" bans_exempt | awk -v id="$1" '$1==id {print $2}'
+}
+
+only_selected() {
+  [ -z "$ONLY" ] && return 0
+  case ",$ONLY," in *",$1,"*) return 0 ;; esac
+  return 1
+}
+
+# ---- run ---------------------------------------------------------------------
+PASS=0; FAIL=0; SKIP=0; SEL=0
+while IFS=$'\t' read -r id ban globs detect replacement escape reviewer source; do
+  [ "$id" = "id" ] && continue
+  [ -n "$id" ] || continue
+  only_selected "$id" || continue
+  SEL=$((SEL + 1))
+
+  if ! enabled "$id"; then
+    SKIP=$((SKIP + 1)); g_skip "$id" "$ban (not enabled in bans: - add $id to .goblin/goblin.yaml to turn it on)"
+    continue
+  fi
+  # A ban whose globs match no file is a SKIP with a reason, not a pass and not a fail.
+  have_glob=0
+  for g in $globs; do
+    [ -e "$ROOT/$g" ] && have_glob=1
+  done
+  if [ "$have_glob" -eq 0 ]; then
+    SKIP=$((SKIP + 1)); g_skip "$id" "$ban (no matching files: $globs)"
+    continue
+  fi
+
+  # The exemption is pushed into the probe (see exempt_paths above): the probe filters the file
+  # list and exits 0 when nothing outside the exempted paths is hit. The exit code stays the only
+  # signal - stdout, when any, still names the offending lines the probe did NOT exempt.
+  ex=$(exempt_paths "$id")
+  out=$( cd "$ROOT" && GOBLIN_BANS_ID="$id" GOBLIN_BANS_EXEMPT="$ex" bash -c "$detect" 2>&1 ); rc=$?
+  case "$rc" in
+    0)
+      if [ -n "$out" ]; then
+        FAIL=$((FAIL + 1))
+        g_fail "$id" "$ban -> $replacement"
+        printf '%s\n' "$out" | sed 's/^/        /'
+      else
+        PASS=$((PASS + 1)); g_pass "$id" "$ban"
+      fi ;;
+    1)
+      # Exit 1 IS the documented signal that the ban is violated (this file's header and
+      # bans/README.md). Judging by whether stdout happened to be empty made the engine
+      # FAIL-OPEN: a detect that reports a violation through its exit code alone was read as
+      # clean. The exit code decides; stdout only adds detail (V3-2).
+      FAIL=$((FAIL + 1))
+      g_fail "$id" "$ban -> $replacement"
+      if [ -n "$out" ]; then
+        printf '%s\n' "$out" | sed 's/^/        /'
+      else
+        printf '        (reported violated by exit 1 with no detail on stdout)\n'
+      fi ;;
+    3)
+      SKIP=$((SKIP + 1))
+      g_skip "$id" "$ban (${out:-skipped})" ;;
+    *)
+      FAIL=$((FAIL + 1))
+      g_fail "$id" "$ban (the check could not run - exit $rc, fail closed)"
+      printf '%s\n' "$out" | sed 's/^/        /' ;;
+  esac
+done < "$BANS"
+
+printf '      %d passed, %d failed, %d skipped\n' "$PASS" "$FAIL" "$SKIP"
+[ "$FAIL" -gt 0 ] && exit 1
+if [ "$SEL" -eq 1 ] && [ "$SKIP" -eq 1 ]; then exit 3; fi
+exit 0

package/bin/goblin-doctor

@@ -0,0 +1,233 @@
+#!/usr/bin/env bash
+# goblin-doctor — one run, every W4a platform (W4A-SPEC §7).
+#
+#   bash bin/goblin-doctor [--platform <p>] [--target <dir>] [--source <path>]
+#
+# Per platform one report block: DETECTED / NOT-DETECTED / DRIFT (the plan's ABSENT
+# renamed to the W4a acceptance wording), the detected anchor, the tier each goblin
+# skill is served from (project / global / emitted-identical / DIVERGED — DIVERGED is
+# informational, DRIFT is the exit driver), plus docs_url + docs_read from adapter.tsv.
+#
+# DRIFT means any of: a malformed adapter.tsv (R3); an emitted file whose bytes != what
+# emit would write now; a context block whose marker VERSION != the running CLI's.
+#
+# Exit codes (W1 §3.2, unchanged): 0 every probed platform DETECTED and non-DRIFT ·
+# 1 any DRIFT (the report still covers all probed platforms — one run, complete
+# picture) · 2 nothing to probe (all probed platforms NOT-DETECTED, or bad --platform).
+#
+# verify.sh per adapter is the DRIFT oracle: re-emits to a scratch dir and cmps —
+# offline, no engine run, no network. bash/awk/sed/grep/sha256sum only.
+
+set -uo pipefail
+
+SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SRC=$(cd "$SELF_DIR/.." && pwd)
+if [ -f "$SRC/bin/goblin-lib.sh" ]; then
+  # shellcheck disable=SC1091
+  . "$SRC/bin/goblin-lib.sh"
+else
+  g_sha256_file() { [ -f "$1" ] && { sha256sum "$1" 2>/dev/null | awk '{print $1}'; return; } || { shasum -a 256 "$1" 2>/dev/null | awk '{print $1}'; }; }
+  g_err() { printf 'error: %s\n' "$*" >&2; }
+  g_info() { printf '%s\n' "$*"; }
+fi
+VERSION=$(cat "$SRC/VERSION" 2>/dev/null || printf 'unknown')
+# The platform enum is assembled from fragments (the MD_SLUG precedent): a literal
+# tool name would trip MD-01 in the source tree, and the enum is data the refusals quote.
+_PL1="$(printf '%s' 'cl')"; _PL2="$(printf '%s' 'aude')"
+_PLA="$_PL1$_PL2"
+_G1="$(printf '%s' 'gem')"; _G2="$(printf '%s' 'ini')"
+ADAPTERS_DIR="$SRC/adapters"
+
+usage() {
+  cat <<USAGE
+goblin doctor — one run, seven platforms (W4a, the seven since W4b).
+
+  goblin doctor [--platform <$_PLA|hermes|copilot|cursor|opencode|codex|$_G1$_G2>]
+                [--target <dir>] [--source <path>]
+
+Prints, per platform: the verdict (DETECTED / NOT-DETECTED / DRIFT), the detected
+anchor, the tier each goblin skill is served from, and the adapter's docs pin.
+
+Exit codes: 0 all DETECTED, zero DRIFT | 1 any DRIFT | 2 nothing to probe.
+USAGE
+}
+
+die() { printf 'error: doctor: %s\n' "$1" >&2; exit "${2:-2}"; }
+
+ONLY="" TARGET="$PWD" SRCSKILLS=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --platform) ONLY="${2:-}"; shift 2 ;;
+    --target)   TARGET="${2:-}"; shift 2 ;;
+    --source)   SRCSKILLS="${2:-}"; shift 2 ;;
+    -h|--help)  usage; exit 0 ;;
+    *)          printf 'error: doctor: unknown option: %s\n' "$1" >&2; usage >&2; exit 2 ;;
+  esac
+done
+TARGET=$(cd "$TARGET" 2>/dev/null && pwd || printf '%s' "$TARGET")
+[ -n "$SRCSKILLS" ] || SRCSKILLS="$SRC/skills"
+
+PLATFORMS="$_PLA hermes copilot cursor opencode codex $_G1$_G2"
+if [ -n "$ONLY" ]; then
+  case "$ONLY" in
+    $_PLA|hermes|copilot|cursor|opencode|codex|$_G1$_G2) PLATFORMS="$ONLY" ;;
+    *) die "unknown platform '$ONLY' - goblin doctor ships $_PLA, hermes, copilot, cursor, opencode, codex, $_G1$_G2" 2 ;;
+  esac
+fi
+
+g_index_bytes() {
+  local files=() n
+  for n in $(selected_skills "$1"); do [ -f "$SRCSKILLS/$n/SKILL.md" ] && files+=("$SRCSKILLS/$n/SKILL.md"); done
+  [ "${#files[@]}" -eq 0 ] && { printf '0'; return 0; }
+  awk 'FNR==1{c=0;n=0} /^---$/{c++; next}
+       c==1 && /^name:/{n+=length($0)+1} c==1 && /^description:/{n+=length($0)+1}
+       ENDFILE{tot+=n} END{print tot+0}' "${files[@]}" 2>/dev/null
+}
+selected_skills() { # <core|all>
+  local d
+  for d in "$SRCSKILLS"/*/; do
+    [ -d "$d" ] || continue
+    if [ "$1" = core ]; then
+      case "$(basename "$d")" in
+        goblin-mode|goblin-verify-author|goblin-judge|goblin-bootstrap|goblin-handoff|practice) ;;
+        *) continue ;;
+      esac
+    fi
+    basename "$d"
+  done
+}
+
+VERDICT_MIN=2   # the exit driver: 0 all detected+clean, 1 any DRIFT, 2 nothing to probe
+
+for PLATFORM in $PLATFORMS; do
+  TSV="$ADAPTERS_DIR/$PLATFORM/adapter.tsv"
+  printf '== %s ==\n' "$PLATFORM"
+  # ---- R3: the capability table must parse; a table that cannot parse is drift ----
+  if [ ! -f "$TSV" ]; then
+    printf '  DRIFT        adapter table missing: %s\n' "$TSV"
+    VERDICT_MIN=1
+    continue
+  fi
+  ROW=$(awk -F'\t' '!/^#/ && NF>1 && $1 != "id" { print }' "$TSV")
+  ROW_N=$(awk -F'\t' '!/^#/ && NF>1 && $1 != "id" { n++ } END { print n+0 }' "$TSV")
+  PARSE_ERR=""
+  [ "$ROW_N" -eq 1 ] || PARSE_ERR="expected exactly one data row, found $ROW_N"
+  if [ -z "$PARSE_ERR" ] && [ "$(printf '%s\n' "$ROW" | awk -F'\t' '{print NF}')" -ne 13 ]; then
+    PARSE_ERR="expected 13 columns, found $(printf '%s\n' "$ROW" | awk -F'\t' '{print NF}')"
+  fi
+  if [ -z "$PARSE_ERR" ]; then
+    IFS=$'\t' read -r A_ID A_DISPLAY A_DETECT A_PROJ A_GLOB A_CTX A_DOCS A_READ A_C1 A_C2 A_C3 A_C4 A_C5 <<< "$ROW"
+    [ "$A_ID" = "$PLATFORM" ] || PARSE_ERR="id cell '$A_ID' does not match the directory name '$PLATFORM'"
+    # The capability columns carry the plan §3.3 matrix values as data: cap_skills and
+    # cap_context_injection are the three-value columns, and W4b measured `partial`
+    # command-blocking on the codex and gem_i_ni adapters (config.toml disable /
+    # approval modes) — so cap_command_blocking is three-valued too. cap_marketplace
+    # and cap_post_compaction stay yes|no (a marketplace either exists or not).
+    case "$A_C2" in yes|full|partial|no) ;; *) PARSE_ERR="cap_context_injection cell '$A_C2' is outside the yes|full|partial|no enum" ;; esac
+    case "$A_C3" in yes|partial|no) ;; *) PARSE_ERR="cap_command_blocking cell '$A_C3' is outside the yes|partial|no enum" ;; esac
+    for cap in "$A_C4" "$A_C5"; do
+      case "$cap" in yes|no) ;; *) PARSE_ERR="capability cell '$cap' is outside the yes|no enum"; break ;; esac
+    done
+    case "$A_C1" in yes|no|partial) ;; *) PARSE_ERR="cap_skills cell '$A_C1' is outside the yes|no|partial enum" ;; esac
+    [ -n "$A_READ" ] || PARSE_ERR="docs_read is empty - the PROBE-REQUIRED shape was never measured"
+  fi
+  if [ -n "$PARSE_ERR" ]; then
+    printf '  DRIFT        malformed adapter.tsv (%s)\n' "$PARSE_ERR"
+    VERDICT_MIN=1
+    continue
+  fi
+  printf '  docs         %s (read %s)\n' "$A_DOCS" "$A_READ"
+  [ "$PLATFORM" = copilot ] && printf '  caveat       prompt hooks fire at sessionStart only - not on resume, not headless; skills arrive, the bootstrap does not\n'
+
+  # ---- detection (§3) ----
+  DRIFT=0
+  ANCHOR=""
+  DET_HIT=""
+  IFS=':' read -ra ANCHORS <<< "$A_DETECT"
+  for a in "${ANCHORS[@]}"; do
+    case "$a" in
+      "~"*) [ -d "${HOME}${a#\~}" ] && { DET_HIT="${HOME}${a#\~}"; break; } ;;
+      /*)   [ -e "$a" ] && { DET_HIT="$a"; break; } ;;
+      *)    command -v "$a" >/dev/null 2>&1 && { DET_HIT="$(command -v "$a")"; break; } ;;
+    esac
+  done
+  if [ -n "$DET_HIT" ]; then
+    printf '  DETECTED     anchor %s\n' "$DET_HIT"
+  else
+    printf '  NOT-DETECTED anchors tried: %s\n' "$(printf '%s' "$A_DETECT" | tr ':' ', ')"
+  fi
+
+  # ---- the tier each goblin skill is served from (§5.2) ----
+  for scope in project global; do
+    if [ "$scope" = project ]; then PAT="$A_PROJ"; ROOT="$TARGET"; else PAT="$A_GLOB"; ROOT="$HOME"; fi
+    ROOTPAT=${PAT%%<name>*}
+    DIR="$ROOT/${ROOTPAT%/}"
+    TIERS=""; DIVERGED=""
+    [ "$scope" = project ] && [ "$A_CTX" != "-" ] && [ -f "$TARGET/$A_CTX" ] && grep -qF '<!-- goblin-stack:begin' "$TARGET/$A_CTX" && TIERS="$TIERS context-block"
+    if [ -d "$DIR" ]; then
+      for d in "$DIR"/*/; do
+        [ -d "$d" ] || continue
+        name=$(basename "$d"); f="$d/SKILL.md"
+        [ -f "$f" ] || continue
+        case "$name" in goblin-*|practice) ;; *) continue ;; esac
+        sf="$SRCSKILLS/$name/SKILL.md"
+        if [ ! -f "$sf" ]; then TIERS="$TIERS ${name}:foreign"; continue; fi
+        if [ "$(g_sha256_file "$f")" = "$(g_sha256_file "$sf")" ]; then
+          TIERS="$TIERS ${name}:$scope"
+          [ "$scope" = project ] && [ -n "$DET_HIT" ] && [ "$DET_HIT" = "$HOME" ] && TIERS="$TIERS (shadowing: the global tier also serves it)"
+        else
+          DIVERGED="$DIVERGED $name"
+        fi
+      done
+    fi
+    if [ -n "$TIERS" ] || [ -n "$DIVERGED" ]; then
+      [ -n "$TIERS" ] && printf '  tier (%s)    %s\n' "$scope" "$TIERS"
+      if [ -n "$DIVERGED" ]; then
+        printf '  DIVERGED     (%s) project copy differs from the source payload:%s - legitimate, but it is the copy that wins\n' "$scope" "$DIVERGED"
+      fi
+    fi
+  done
+
+  # ---- the DRIFT oracle: what emit would write now vs what is on disk ----
+  if [ -n "$DET_HIT" ] || [ -d "$TARGET/${A_PROJ%%<name>*}" ] || [ -f "$TARGET/$A_CTX" ]; then
+    VERIFY="$ADAPTERS_DIR/$PLATFORM/verify.sh"
+    if [ -x "$VERIFY" ] || [ -f "$VERIFY" ]; then
+      if OUT=$(GOBLIN_DOCTOR_TARGET="$TARGET" GOBLIN_DOCTOR_HOME="$HOME" bash "$VERIFY" 2>&1); then
+        printf '%s\n' "$OUT" | sed 's/^/  /'
+      else
+        DRIFT=1
+        printf '  DRIFT        emitted bytes differ from what emit would write now:\n'
+        printf '%s\n' "$OUT" | sed 's/^/    /'
+      fi
+    fi
+  fi
+
+  if [ "$DRIFT" -eq 1 ]; then
+    VERDICT_MIN=1
+  elif [ -z "$DET_HIT" ] && [ "$VERDICT_MIN" -ne 1 ]; then
+    # a NOT-DETECTED platform is exit 2 only if nothing DRIFTed anywhere (§7)
+    :
+  fi
+done
+
+# ---- the exit driver (§7): 0 detected+clean · 1 any DRIFT · 2 nothing to probe ----
+if [ "$VERDICT_MIN" -eq 1 ]; then
+  exit 1
+fi
+# exit 2 iff NO probed platform was DETECTED (and none DRIFTed)
+ANY_DETECTED=0
+for PLATFORM in $PLATFORMS; do
+  TSV="$ADAPTERS_DIR/$PLATFORM/adapter.tsv"
+  [ -f "$TSV" ] || continue
+  A_DETECT=$(awk -F'\t' '!/^#/ && NF>1 && $1 != "id" { print $3 }' "$TSV")
+  IFS=':' read -ra ANCHORS <<< "$A_DETECT"
+  for a in "${ANCHORS[@]}"; do
+    case "$a" in
+      "~"*) [ -d "${HOME}${a#\~}" ] && ANY_DETECTED=1 ;;
+      /*)   [ -e "$a" ] && ANY_DETECTED=1 ;;
+      *)    command -v "$a" >/dev/null 2>&1 && ANY_DETECTED=1 ;;
+    esac
+  done
+done
+[ "$ANY_DETECTED" -eq 1 ] && exit 0
+exit 2