@webpresso/agent-kit 3.1.28 → 3.2.0

package/dist/esm/audit/ci-guardrails-wiring.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Guardrail: keep `wp audit guardrails` wired into a repo's own CI.
+ *
+ * `wp audit guardrails` is the delivery vehicle for every guardrail that ships
+ * inside the suite (e.g. `typescript-version` from #810). A consumer inherits a
+ * new guardrail automatically on their next agent-kit bump ONLY IF their CI
+ * still invokes `wp audit guardrails`. If that step is deleted, the whole suite
+ * silently stops running in CI and new guardrails never reach the consumer.
+ *
+ * This audit is dogfood / defense-in-depth — NOT the delivery guarantee. It
+ * cannot run if the very invariant it checks is already broken (a CI with no
+ * guardrails step never executes this audit in CI). The actual self-healing
+ * guarantee is the managed inject-by-content-absence repair in
+ * `scaffold-base-kit.ts` (`ensureGuardrailsCiStep`), which re-inserts the step
+ * on every `wp setup`. This audit's value is LOCAL: it is registered as
+ * affected-safe + MCP-visible, so `wp audit guardrails --affected` (pre-commit /
+ * IDE) catches the drift on the developer's machine even when CI has drifted.
+ *
+ * Modeled on the self-CI checks in `ci-test-perf.ts`.
+ */
+import type { RepoAuditResult } from "./repo-guardrails.js";
+export declare function auditCiGuardrailsWiring(rootDirectory?: string): RepoAuditResult;

package/dist/esm/audit/ci-guardrails-wiring.js

@@ -0,0 +1,90 @@
+/**
+ * Guardrail: keep `wp audit guardrails` wired into a repo's own CI.
+ *
+ * `wp audit guardrails` is the delivery vehicle for every guardrail that ships
+ * inside the suite (e.g. `typescript-version` from #810). A consumer inherits a
+ * new guardrail automatically on their next agent-kit bump ONLY IF their CI
+ * still invokes `wp audit guardrails`. If that step is deleted, the whole suite
+ * silently stops running in CI and new guardrails never reach the consumer.
+ *
+ * This audit is dogfood / defense-in-depth — NOT the delivery guarantee. It
+ * cannot run if the very invariant it checks is already broken (a CI with no
+ * guardrails step never executes this audit in CI). The actual self-healing
+ * guarantee is the managed inject-by-content-absence repair in
+ * `scaffold-base-kit.ts` (`ensureGuardrailsCiStep`), which re-inserts the step
+ * on every `wp setup`. This audit's value is LOCAL: it is registered as
+ * affected-safe + MCP-visible, so `wp audit guardrails --affected` (pre-commit /
+ * IDE) catches the drift on the developer's machine even when CI has drifted.
+ *
+ * Modeled on the self-CI checks in `ci-test-perf.ts`.
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+const WORKFLOW_DIR = ".github/workflows";
+const WORKFLOW_FILE_PATTERN = /\.(ya?ml)$/iu;
+/** The guardrails invocation, keyed on the command itself (not the `wp` prefix
+ * nor a marker comment) so `wp audit guardrails`, `./bin/wp audit guardrails`,
+ * and the `--affected`/`--full` variants all count as wired. */
+const GUARDRAILS_INVOCATION_PATTERN = /\baudit guardrails\b/u;
+/**
+ * Lines that run the default test suite — the signal that a workflow is a
+ * quality-CI pipeline that owes a guardrails step. Mirrors the notion of a
+ * test-running workflow used by `ci-test-perf.ts`; kept local so the two audits
+ * stay independent.
+ */
+const TEST_RUN_PATTERN = /(?:\bvp\s+run\s+test\b|\bpnpm\s+(?:run\s+)?test\b|\bnpm\s+(?:run\s+)?test\b|\bbun\s+(?:run\s+)?test\b|\bwp\s+test\b|\bvitest\s+run\b)/iu;
+function walkWorkflowFiles(dir) {
+    if (!existsSync(dir))
+        return [];
+    const files = [];
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const fullPath = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...walkWorkflowFiles(fullPath));
+            continue;
+        }
+        if (entry.isFile() && WORKFLOW_FILE_PATTERN.test(entry.name)) {
+            files.push(fullPath);
+        }
+    }
+    return files;
+}
+export function auditCiGuardrailsWiring(rootDirectory = process.cwd()) {
+    const workflowsRoot = join(rootDirectory, WORKFLOW_DIR);
+    const files = walkWorkflowFiles(workflowsRoot);
+    const testWorkflows = [];
+    let anyWorkflowWiresGuardrails = false;
+    for (const file of files) {
+        const content = readFileSync(file, "utf8");
+        if (GUARDRAILS_INVOCATION_PATTERN.test(content))
+            anyWorkflowWiresGuardrails = true;
+        if (TEST_RUN_PATTERN.test(content)) {
+            testWorkflows.push(relative(rootDirectory, file).replace(/\\/gu, "/"));
+        }
+    }
+    // No quality-CI pipeline (no workflow runs the default test suite) → nothing
+    // to enforce; a repo without agent-kit CI is not "drifted".
+    const violations = [];
+    if (testWorkflows.length > 0 && !anyWorkflowWiresGuardrails) {
+        for (const workflow of testWorkflows) {
+            violations.push({
+                file: workflow,
+                severity: "error",
+                ruleId: "ci-guardrails-wiring",
+                message: `${workflow} runs the test suite but no workflow invokes \`wp audit guardrails\`. ` +
+                    `Guardrails (e.g. typescript-version) reach this repo only while CI runs ` +
+                    `\`wp audit guardrails\`. Re-run \`wp setup\` to restore the managed CI step.`,
+            });
+        }
+    }
+    return {
+        ok: violations.length === 0,
+        title: "CI guardrails wiring",
+        checked: files.length,
+        sources: files.map((file) => ({
+            path: relative(rootDirectory, file).replace(/\\/gu, "/"),
+            kind: "workflow",
+        })),
+        violations,
+    };
+}

package/dist/esm/audit/ci-test-perf.js

@@ -11,6 +11,7 @@
  */
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, relative } from "node:path";
+import { parse as parseYaml } from "yaml";
 const WORKFLOW_DIR = ".github/workflows";
 const WORKFLOW_FILE_PATTERN = /\.(ya?ml)$/iu;
 /** Steps/jobs that intentionally serialize workers (mutation, Stryker, etc.). */
@@ -26,6 +27,16 @@ const SETUP_VP_CACHE_TRUE_PATTERN = /^\s*cache:\s*(?:true|pnpm|npm)\b/mu;
 const PACKAGE_INSTALL_PATTERN = /(?:\bvp\s+install\b|\bpnpm\s+install\b|\bnpm\s+ci\b|\bnpm\s+install\b|\bbun\s+install\b)/u;
 // Opt-out: put this comment on the same line or the line immediately above a serial force.
 const ALLOW_COMMENT_PATTERN = /ci-test-perf-allow(?:-serial)?\b/iu;
+const AGENT_KIT_SELF_CI_PATH = ".github/workflows/ci.agent-kit.yml";
+function readWorkflowJob(content, jobName) {
+    try {
+        const parsed = parseYaml(content);
+        return parsed.jobs?.[jobName];
+    }
+    catch {
+        return;
+    }
+}
 function walkWorkflowFiles(dir) {
     if (!existsSync(dir))
         return [];
@@ -112,6 +123,25 @@ function findViolations(root, file) {
                 `Cold installs inflate test job wall-clock without adding coverage.`,
         });
     }
+    if (relPath === AGENT_KIT_SELF_CI_PATH) {
+        const testJob = readWorkflowJob(content, "test");
+        const supervisorSteps = testJob?.steps?.filter((step) => typeof step.run === "string" && step.run.includes("bun scripts/run-vitest-projects.ts"));
+        const hasConcurrentLane = content.includes("WP_VITEST_PROJECT_MODE: concurrent");
+        const hasSerialLane = content.includes("WP_VITEST_PROJECT_MODE: serial");
+        if ((supervisorSteps?.length ?? 0) < 2 || !hasConcurrentLane || !hasSerialLane) {
+            violations.push({
+                file: relPath,
+                message: `${relPath}: agent-kit self-CI must run concurrent Test shards and the isolated serial lane ` +
+                    `through scripts/run-vitest-projects.ts so project concurrency and owned-process cleanup stay enforced.`,
+            });
+        }
+        if (testJob?.["timeout-minutes"] !== 5) {
+            violations.push({
+                file: relPath,
+                message: `${relPath}: agent-kit self-CI Test job must declare timeout-minutes: 5.`,
+            });
+        }
+    }
     return violations;
 }
 export function auditCiTestPerf(rootDirectory = process.cwd()) {

package/dist/esm/audit/command-surface.js

@@ -23,6 +23,7 @@ export function auditCommandSurface(root) {
     const verifySkillPath = path.join(root, "catalog/agent/skills/verify/SKILL.md");
     const codexVerifyPath = path.join(root, "packages/codex-plugin/skills/verify/SKILL.md");
     const claudeVerifyPath = path.join(root, "packages/claude-plugin/skills/verify/SKILL.md");
+    const opencodeVerifyPath = path.join(root, "packages/opencode-plugin/skills/verify/SKILL.md");
     const hookGuidancePath = path.join(root, "src/hooks/pretool-guard/dev-routing.ts");
     const requiredFiles = [
         cliPath,
@@ -35,6 +36,7 @@ export function auditCommandSurface(root) {
         verifySkillPath,
         codexVerifyPath,
         claudeVerifyPath,
+        opencodeVerifyPath,
         hookGuidancePath,
     ];
     for (const file of requiredFiles) {
@@ -65,8 +67,8 @@ export function auditCommandSurface(root) {
     if (!contains(mcpPrWaitPath, "buildStatusSnapshot")) {
         findings.push(violation("src/mcp/tools/pr-wait.ts", "MCP ready wait does not use the shared snapshot evaluator"));
     }
-    for (const file of [verifySkillPath, codexVerifyPath, claudeVerifyPath]) {
-        if (!contains(file, "wp review gate <blueprint-slug> --target HEAD --json")) {
+    for (const file of [verifySkillPath, codexVerifyPath, claudeVerifyPath, opencodeVerifyPath]) {
+        if (!contains(file, "wp review gate <blueprint-slug> --purpose delivery --target HEAD --json")) {
             findings.push(violation(path.relative(root, file), "missing executable review-gate lifecycle guidance"));
         }
     }

package/dist/esm/audit/host-substitution-risk.d.ts

@@ -0,0 +1,2 @@
+import type { RepoAuditResult } from "./repo-guardrails.js";
+export declare function auditHostSubstitutionRisk(rootDirectory?: string): RepoAuditResult;

package/dist/esm/audit/host-substitution-risk.js

@@ -0,0 +1,256 @@
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import path from "node:path";
+import { parse as parseYaml } from "yaml";
+import { readTrustedJsonFile } from "#shared-utils/read-json-file.js";
+const AGENT_KIT_PACKAGE = "@webpresso/agent-kit";
+const SCORECARD_REL = "docs/host-substitution-scorecard.md";
+const BASELINES_REL = "maintainers/host-baselines";
+const SCORECARD_HEADERS = [
+    "capability",
+    "class",
+    "substitution risk",
+    "observed native overlap",
+    "repo-owned invariant",
+    "independent verifier",
+    "blueprints",
+    "investment",
+];
+const CLASS_VALUES = new Set(["core", "bridge", "utility"]);
+const RISK_VALUES = new Set(["low", "medium", "high"]);
+const INVESTMENT_VALUES = new Set(["invest", "maintain", "minimize"]);
+const SURFACE_STATUS_VALUES = new Set(["full", "partial", "none", "in-progress"]);
+function violation(file, message) {
+    return { file, message };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function packageName(root) {
+    try {
+        const parsed = readTrustedJsonFile(path.join(root, "package.json"));
+        return typeof parsed.name === "string" ? parsed.name : null;
+    }
+    catch {
+        return null;
+    }
+}
+function splitMarkdownRow(line) {
+    return line
+        .trim()
+        .replace(/^\|/u, "")
+        .replace(/\|$/u, "")
+        .split("|")
+        .map((cell) => cell.trim());
+}
+function parseScorecard(markdown) {
+    const lines = markdown.split(/\r?\n/u);
+    const rows = [];
+    const errors = [];
+    for (let index = 0; index < lines.length - 1; index += 1) {
+        const header = splitMarkdownRow(lines[index] ?? "").map((cell) => cell.toLowerCase());
+        if (header.join("|") !== SCORECARD_HEADERS.join("|"))
+            continue;
+        const separator = lines[index + 1] ?? "";
+        if (!/^\s*\|[\s:|-]+\|\s*$/u.test(separator)) {
+            errors.push("scorecard table header must be followed by a markdown separator row");
+            continue;
+        }
+        for (let rowIndex = index + 2; rowIndex < lines.length; rowIndex += 1) {
+            const line = lines[rowIndex] ?? "";
+            if (!line.trimStart().startsWith("|"))
+                break;
+            const cells = splitMarkdownRow(line);
+            if (cells.length !== SCORECARD_HEADERS.length) {
+                errors.push(`scorecard row ${rowIndex + 1} has ${cells.length} cells`);
+                continue;
+            }
+            rows.push(Object.fromEntries(SCORECARD_HEADERS.map((key, i) => [key, cells[i] ?? ""])));
+        }
+        return { rows, errors };
+    }
+    errors.push(`missing scorecard table with headers: ${SCORECARD_HEADERS.join(" | ")}`);
+    return { rows, errors };
+}
+function cleanToken(value) {
+    return value.replace(/^`|`$/gu, "").trim();
+}
+function splitCellList(value) {
+    return value
+        .split(/(?:<br\s*\/?>|,)/iu)
+        .map((item) => cleanToken(item))
+        .filter((item) => item.length > 0 && item !== "--" && item.toLowerCase() !== "none");
+}
+function scanBlueprintIds(root) {
+    const ids = new Set();
+    const base = path.join(root, "blueprints");
+    if (!existsSync(base))
+        return ids;
+    for (const status of ["draft", "planned", "in-progress", "completed", "archived", "parked"]) {
+        const statusDir = path.join(base, status);
+        if (!existsSync(statusDir))
+            continue;
+        for (const entry of readdirSync(statusDir)) {
+            if (entry.startsWith("."))
+                continue;
+            const absolute = path.join(statusDir, entry);
+            if (entry.endsWith(".md")) {
+                ids.add(`${status}/${entry.replace(/\.md$/u, "")}`);
+                continue;
+            }
+            if (statSync(absolute).isDirectory() && existsSync(path.join(absolute, "_overview.md"))) {
+                ids.add(`${status}/${entry}`);
+            }
+        }
+    }
+    return ids;
+}
+function activeBlueprintIds(root) {
+    const ids = new Set();
+    for (const id of scanBlueprintIds(root)) {
+        if (id.startsWith("planned/") || id.startsWith("in-progress/"))
+            ids.add(id);
+    }
+    return ids;
+}
+function validateScorecard(root) {
+    const scorecardPath = path.join(root, SCORECARD_REL);
+    if (!existsSync(scorecardPath)) {
+        return { checked: 1, violations: [violation(SCORECARD_REL, "scorecard file is missing")] };
+    }
+    const parsed = parseScorecard(readFileSync(scorecardPath, "utf8"));
+    const violations = parsed.errors.map((message) => violation(SCORECARD_REL, message));
+    const seenCapabilities = new Set();
+    const allBlueprintIds = scanBlueprintIds(root);
+    const active = activeBlueprintIds(root);
+    const activeCoverage = new Map();
+    for (const id of active)
+        activeCoverage.set(id, 0);
+    for (const [index, row] of parsed.rows.entries()) {
+        const rowLabel = `row ${index + 1}`;
+        const capability = cleanToken(row.capability ?? "");
+        if (!/^[a-z][a-z0-9-]*$/u.test(capability)) {
+            violations.push(violation(SCORECARD_REL, `${rowLabel}: capability must be a stable kebab-case id`));
+        }
+        else if (seenCapabilities.has(capability)) {
+            violations.push(violation(SCORECARD_REL, `${rowLabel}: duplicate capability ${capability}`));
+        }
+        seenCapabilities.add(capability);
+        const kind = cleanToken(row.class ?? "");
+        if (!CLASS_VALUES.has(kind)) {
+            violations.push(violation(SCORECARD_REL, `${rowLabel}: class must be core, bridge, or utility`));
+        }
+        const risk = cleanToken(row["substitution risk"] ?? "");
+        if (!RISK_VALUES.has(risk)) {
+            violations.push(violation(SCORECARD_REL, `${rowLabel}: substitution risk must be low, medium, or high`));
+        }
+        const investment = cleanToken(row.investment ?? "");
+        if (!INVESTMENT_VALUES.has(investment)) {
+            violations.push(violation(SCORECARD_REL, `${rowLabel}: investment must be invest, maintain, or minimize`));
+        }
+        for (const verifier of splitCellList(row["independent verifier"] ?? "")) {
+            if (!verifier.startsWith("repo:"))
+                continue;
+            const verifierPath = verifier.slice("repo:".length);
+            if (!existsSync(path.join(root, verifierPath))) {
+                violations.push(violation(SCORECARD_REL, `${rowLabel}: verifier path missing: ${verifier}`));
+            }
+        }
+        for (const blueprint of splitCellList(row.blueprints ?? "")) {
+            if (!/^(?:draft|planned|in-progress|completed|archived|parked)\/[a-z0-9][a-z0-9-]*$/u.test(blueprint)) {
+                violations.push(violation(SCORECARD_REL, `${rowLabel}: invalid blueprint reference ${blueprint}`));
+                continue;
+            }
+            if (!allBlueprintIds.has(blueprint)) {
+                violations.push(violation(SCORECARD_REL, `${rowLabel}: blueprint reference does not exist: ${blueprint}`));
+            }
+            if (activeCoverage.has(blueprint)) {
+                activeCoverage.set(blueprint, (activeCoverage.get(blueprint) ?? 0) + 1);
+            }
+        }
+    }
+    for (const [id, count] of activeCoverage) {
+        if (count !== 1) {
+            violations.push(violation(SCORECARD_REL, `active blueprint ${id} must be covered exactly once in scorecard blueprints column; found ${count}`));
+        }
+    }
+    return { checked: parsed.rows.length + activeCoverage.size, violations };
+}
+function validateHostBaseline(root, relPath) {
+    const violations = [];
+    const value = parseYaml(readFileSync(path.join(root, relPath), "utf8"));
+    if (!isRecord(value))
+        return [violation(relPath, "host baseline must be a YAML object")];
+    for (const key of ["host", "cli"]) {
+        if (typeof value[key] !== "string" || value[key].trim() === "") {
+            violations.push(violation(relPath, `${key} must be a non-empty string`));
+        }
+    }
+    for (const key of ["last_implemented", "last_observed"]) {
+        const record = value[key];
+        if (!isRecord(record)) {
+            violations.push(violation(relPath, `${key} must be an object`));
+            continue;
+        }
+        for (const child of ["version", "date"]) {
+            if (typeof record[child] !== "string" || record[child].trim() === "") {
+                violations.push(violation(relPath, `${key}.${child} must be a non-empty string`));
+            }
+        }
+    }
+    const sources = value.sources;
+    const docs = isRecord(sources) ? sources.docs : undefined;
+    if (!Array.isArray(docs) ||
+        docs.some((item) => typeof item !== "string" || !item.startsWith("https://"))) {
+        violations.push(violation(relPath, "sources.docs must be an array of https URLs"));
+    }
+    const surfaces = value.surfaces;
+    if (!isRecord(surfaces)) {
+        violations.push(violation(relPath, "surfaces must be an object"));
+    }
+    else {
+        for (const [name, raw] of Object.entries(surfaces)) {
+            if (!isRecord(raw)) {
+                violations.push(violation(relPath, `surfaces.${name} must be an object`));
+                continue;
+            }
+            if (typeof raw.status !== "string" || !SURFACE_STATUS_VALUES.has(raw.status)) {
+                violations.push(violation(relPath, `surfaces.${name}.status must be full, partial, none, or in-progress`));
+            }
+            if (typeof raw.notes !== "string" || raw.notes.trim() === "") {
+                violations.push(violation(relPath, `surfaces.${name}.notes must be a non-empty string`));
+            }
+        }
+    }
+    return violations;
+}
+function validateHostBaselines(root) {
+    const dir = path.join(root, BASELINES_REL);
+    if (!existsSync(dir)) {
+        return {
+            checked: 1,
+            violations: [violation(BASELINES_REL, "host baselines directory missing")],
+        };
+    }
+    const files = readdirSync(dir)
+        .filter((entry) => entry.endsWith(".yaml"))
+        .map((entry) => path.join(BASELINES_REL, entry));
+    return {
+        checked: files.length,
+        violations: files.flatMap((file) => validateHostBaseline(root, file)),
+    };
+}
+export function auditHostSubstitutionRisk(rootDirectory = process.cwd()) {
+    const root = path.resolve(rootDirectory);
+    const title = "Host substitution risk";
+    if (packageName(root) !== AGENT_KIT_PACKAGE)
+        return { ok: true, title, checked: 0, violations: [] };
+    const scorecard = validateScorecard(root);
+    const baselines = validateHostBaselines(root);
+    const violations = [...scorecard.violations, ...baselines.violations];
+    return {
+        ok: violations.length === 0,
+        title,
+        checked: scorecard.checked + baselines.checked,
+        violations,
+    };
+}

package/dist/esm/audit/registry.d.ts

@@ -14,11 +14,11 @@ export interface AuditKindDescriptor {
 }
 export declare const SCRIPT_AUDIT_KIND_IDS: readonly ["test-smells", "tph-e2e"];
 export declare const SPECIAL_AUDIT_KIND_IDS: readonly ["bundle-budget", "commit-message", "blueprint-pr-coverage", "mutation", "guardrails", "quality"];
-export declare const REPO_AUDIT_KIND_IDS: readonly ["catalog-drift", "package-surface", "command-surface", "reference-parity-matrix", "blueprint-readme-drift", "blueprint-lifecycle", "blueprint-trust", "roadmap-links", "docs-frontmatter", "agents", "vision", "tech-debt", "supported-agent-clis", "no-relative-parent-imports", "no-link-protocol", "no-relative-package-scripts", "test-isolation", "bucket-boundary", "skill-sizes", "broken-refs", "memory-rotation", "gitignore-agent-surfaces", "memory-unified", "compile-drift", "no-legacy-cli-bin", "architecture-drift", "cloudflare-deploy-contract", "toolchain-isolation", "absolute-path-policy", "no-first-party-mjs", "outside-review-runtime-ownership", "no-math-random", "agent-cost", "blueprint-db-consistency", "tech-debt-cadence", "cross-repo-correlation", "ai-contracts", "atomic-state-writes", "hook-surface", "hook-vendor-drift", "session-memory-hardcut", "open-source-licenses", "secrets-policy", "no-dev-vars", "secret-provider-quarantine", "github-actions-secrets", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "worktree-main-ownership", "sast", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "legacy-workflow-identity", "rules", "skills"];
+export declare const REPO_AUDIT_KIND_IDS: readonly ["catalog-drift", "package-surface", "command-surface", "reference-parity-matrix", "blueprint-readme-drift", "blueprint-lifecycle", "blueprint-trust", "roadmap-links", "docs-frontmatter", "agents", "vision", "tech-debt", "supported-agent-clis", "no-relative-parent-imports", "no-link-protocol", "no-relative-package-scripts", "test-isolation", "bucket-boundary", "skill-sizes", "broken-refs", "memory-rotation", "gitignore-agent-surfaces", "memory-unified", "compile-drift", "no-legacy-cli-bin", "architecture-drift", "cloudflare-deploy-contract", "toolchain-isolation", "absolute-path-policy", "no-first-party-mjs", "outside-review-runtime-ownership", "no-math-random", "agent-cost", "blueprint-db-consistency", "tech-debt-cadence", "cross-repo-correlation", "ai-contracts", "atomic-state-writes", "hook-surface", "hook-vendor-drift", "session-memory-hardcut", "open-source-licenses", "secrets-policy", "no-dev-vars", "secret-provider-quarantine", "github-actions-secrets", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "ci-guardrails-wiring", "test-scan-perf", "worktree-main-ownership", "sast", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "host-substitution-risk", "legacy-workflow-identity", "rules", "skills", "typescript-version"];
 export declare const AUDIT_KIND_DESCRIPTORS: readonly AuditKindDescriptor[];
-export declare const AUDIT_KIND_IDS: readonly ["test-smells", "tph-e2e", ...("absolute-path-policy" | "agent-cost" | "agents" | "ai-contracts" | "architecture-drift" | "atomic-state-writes" | "blueprint-db-consistency" | "blueprint-lifecycle" | "blueprint-pr-coverage" | "blueprint-readme-drift" | "blueprint-trust" | "broken-refs" | "bucket-boundary" | "bundle-budget" | "catalog-drift" | "ci-test-perf" | "cloudflare-deploy-contract" | "command-surface" | "commit-message" | "compile-drift" | "consumer-agent-kit-dependency" | "cross-repo-correlation" | "docs-frontmatter" | "github-actions-secrets" | "gitignore-agent-surfaces" | "guardrails" | "harness-overlay-evidence" | "harness-surfaces" | "hook-surface" | "hook-vendor-drift" | "legacy-workflow-identity" | "memory-rotation" | "memory-unified" | "mutation" | "no-dev-vars" | "no-first-party-mjs" | "no-legacy-cli-bin" | "no-link-protocol" | "no-math-random" | "no-relative-package-scripts" | "no-relative-parent-imports" | "open-source-licenses" | "outside-review-runtime-ownership" | "package-surface" | "quality" | "reference-parity-matrix" | "roadmap-links" | "rules" | "sast" | "secret-provider-quarantine" | "secrets-config" | "secrets-policy" | "security-quality-regressions" | "session-memory-hardcut" | "skill-sizes" | "skills" | "supported-agent-clis" | "tech-debt" | "tech-debt-cadence" | "test-isolation" | "toolchain-isolation" | "vision" | "weakness-mining" | "worktree-main-ownership")[]];
-export declare const MCP_AUDIT_KIND_IDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "session-memory-hardcut", "worktree-main-ownership", "sast"];
-export declare const AFFECTED_SAFE_AUDIT_KIND_IDS: readonly ["blueprint-readme-drift", "blueprint-lifecycle", "bucket-boundary", "skill-sizes", "broken-refs", "no-dev-vars", "absolute-path-policy", "secret-provider-quarantine", "secrets-config", "docs-frontmatter", "no-relative-parent-imports", "no-link-protocol", "no-first-party-mjs", "no-math-random"];
+export declare const AUDIT_KIND_IDS: readonly ["test-smells", "tph-e2e", ...("absolute-path-policy" | "agent-cost" | "agents" | "ai-contracts" | "architecture-drift" | "atomic-state-writes" | "blueprint-db-consistency" | "blueprint-lifecycle" | "blueprint-pr-coverage" | "blueprint-readme-drift" | "blueprint-trust" | "broken-refs" | "bucket-boundary" | "bundle-budget" | "catalog-drift" | "ci-guardrails-wiring" | "ci-test-perf" | "cloudflare-deploy-contract" | "command-surface" | "commit-message" | "compile-drift" | "consumer-agent-kit-dependency" | "cross-repo-correlation" | "docs-frontmatter" | "github-actions-secrets" | "gitignore-agent-surfaces" | "guardrails" | "harness-overlay-evidence" | "harness-surfaces" | "hook-surface" | "hook-vendor-drift" | "host-substitution-risk" | "legacy-workflow-identity" | "memory-rotation" | "memory-unified" | "mutation" | "no-dev-vars" | "no-first-party-mjs" | "no-legacy-cli-bin" | "no-link-protocol" | "no-math-random" | "no-relative-package-scripts" | "no-relative-parent-imports" | "open-source-licenses" | "outside-review-runtime-ownership" | "package-surface" | "quality" | "reference-parity-matrix" | "roadmap-links" | "rules" | "sast" | "secret-provider-quarantine" | "secrets-config" | "secrets-policy" | "security-quality-regressions" | "session-memory-hardcut" | "skill-sizes" | "skills" | "supported-agent-clis" | "tech-debt" | "tech-debt-cadence" | "test-isolation" | "test-scan-perf" | "toolchain-isolation" | "typescript-version" | "vision" | "weakness-mining" | "worktree-main-ownership")[]];
+export declare const MCP_AUDIT_KIND_IDS: readonly ["test-smells", "tph-e2e", "agents", "catalog-drift", "package-surface", "reference-parity-matrix", "docs-frontmatter", "blueprint-readme-drift", "blueprint-pr-coverage", "blueprint-lifecycle", "blueprint-trust", "architecture-drift", "cloudflare-deploy-contract", "absolute-path-policy", "no-first-party-mjs", "no-math-random", "roadmap-links", "bundle-budget", "commit-message", "tech-debt", "supported-agent-clis", "hook-surface", "harness-surfaces", "weakness-mining", "harness-overlay-evidence", "host-substitution-risk", "ai-contracts", "atomic-state-writes", "no-relative-package-scripts", "toolchain-isolation", "open-source-licenses", "secrets-policy", "no-dev-vars", "github-actions-secrets", "secret-provider-quarantine", "security-quality-regressions", "secrets-config", "consumer-agent-kit-dependency", "ci-test-perf", "test-scan-perf", "session-memory-hardcut", "worktree-main-ownership", "typescript-version", "ci-guardrails-wiring", "sast"];
+export declare const AFFECTED_SAFE_AUDIT_KIND_IDS: readonly ["blueprint-readme-drift", "blueprint-lifecycle", "bucket-boundary", "skill-sizes", "broken-refs", "no-dev-vars", "absolute-path-policy", "secret-provider-quarantine", "secrets-config", "docs-frontmatter", "no-relative-parent-imports", "no-link-protocol", "no-first-party-mjs", "no-math-random", "test-scan-perf", "ci-guardrails-wiring"];
 export type AuditKindId = (typeof AUDIT_KIND_IDS)[number];
 export type RepoAuditKindId = (typeof REPO_AUDIT_KIND_IDS)[number];
 export type MCPAuditKindId = (typeof MCP_AUDIT_KIND_IDS)[number];

package/dist/esm/audit/registry.js

@@ -16,6 +16,8 @@ const affectedSafeKinds = [
     "no-link-protocol",
     "no-first-party-mjs",
     "no-math-random",
+    "test-scan-perf",
+    "ci-guardrails-wiring",
 ];
 const mcpKindIds = [
     "test-smells",
@@ -43,6 +45,7 @@ const mcpKindIds = [
     "harness-surfaces",
     "weakness-mining",
     "harness-overlay-evidence",
+    "host-substitution-risk",
     "ai-contracts",
     "atomic-state-writes",
     "no-relative-package-scripts",
@@ -56,8 +59,11 @@ const mcpKindIds = [
     "secrets-config",
     "consumer-agent-kit-dependency",
     "ci-test-perf",
+    "test-scan-perf",
     "session-memory-hardcut",
     "worktree-main-ownership",
+    "typescript-version",
+    "ci-guardrails-wiring",
     "sast",
 ];
 const affectedSafe = new Set(affectedSafeKinds);
@@ -130,14 +136,18 @@ const repoKinds = [
     "secrets-config",
     "consumer-agent-kit-dependency",
     "ci-test-perf",
+    "ci-guardrails-wiring",
+    "test-scan-perf",
     "worktree-main-ownership",
     "sast",
     "harness-surfaces",
     "weakness-mining",
     "harness-overlay-evidence",
+    "host-substitution-risk",
     "legacy-workflow-identity",
     "rules",
     "skills",
+    "typescript-version",
 ];
 function descriptor(id, kindClass) {
     return {
@@ -148,7 +158,7 @@ function descriptor(id, kindClass) {
         gateClass: signalKinds.has(id) ? "signal" : "blocking",
         scopeSafety: affectedSafe.has(id) ? "affected-safe" : "full-scan-only",
         summaryLabel: id === "sast" ? "SAST" : id,
-        ...(id === "sast" ? { includedInGuardrails: false } : {}),
+        ...(["sast", "host-substitution-risk"].includes(id) ? { includedInGuardrails: false } : {}),
         ...(["blueprint-readme-drift", "docs-frontmatter"].includes(id) ? { fixable: true } : {}),
     };
 }

package/dist/esm/audit/roadmap-links.js

@@ -58,7 +58,13 @@ export function auditRoadmapLinks(rootDirectory = process.cwd(), options = {}) {
                 message: "Parent-roadmap execution-wave maps may list local child blueprints only; move cross-repo references to Cross-Plan References and use GitHub links there",
             });
         }
+        // Archived parent-roadmaps are non-executable program records. They may
+        // document completed children without a live execution-wave map or local
+        // children still declaring parent_roadmap. Do not fail CI on that residue.
         if (waveMapChildren.size === 0 && localChildren.length === 0) {
+            if (roadmap.status === "archived") {
+                continue;
+            }
             violations.push({
                 file: roadmap.file,
                 message: "Roadmap declares no children in its wave map",

package/dist/esm/audit/test-scan-perf.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Guardrail: keep tests from silently growing multi-second / multi-ten-second
+ * full-repo filesystem scans, and from "fixing" that cost with elevated
+ * per-test timeouts.
+ *
+ * The private-UI cutover anti-regression suite originally walked the monorepo
+ * with readdirSync/statSync/readFileSync and needed a 30s timeout. Prefer
+ * `git grep` (tracked files) or a bounded fixture tree instead.
+ *
+ * Opt-out: `// test-scan-perf-allow` on the same line or previous line as the
+ * walk/timeout site, or `// test-scan-perf-allow-file` anywhere in the file.
+ */
+import type { RepoAuditResult, RepoAuditViolation } from "./repo-guardrails.js";
+export declare function isTestScanPerfTargetPath(relativePath: string): boolean;
+export declare function findTestScanPerfViolationsInText(relativePath: string, text: string): RepoAuditViolation[];
+export declare function auditTestScanPerf(rootDirectory?: string, options?: {
+    affectedFiles?: readonly string[];
+}): RepoAuditResult;