@webpresso/agent-kit 3.1.30 → 3.2.0

package/catalog/agent/rules/typescript-version.md

@@ -0,0 +1,50 @@
+---
+type: rule
+slug: typescript-version
+title: TypeScript 7 required at consumers
+status: active
+scope: repo
+applies_to: [agents]
+related:
+  - package-conventions
+  - ci-test-perf
+created: "2026-07-24"
+last_reviewed: "2026-07-24"
+paths:
+  - "pnpm-workspace.yaml"
+  - "**/package.json"
+---
+
+# TypeScript 7 required at consumers
+
+The Webpresso toolchain runs on **TypeScript 7** — the native (Go) compiler that
+`tsc` resolves to since the 7.0 GA. Consumer repos must stay on the 7 major so
+their typecheck, build, and shipped `.d.ts` match the compiler agent-kit ships
+and tests against.
+
+## What is enforced
+
+`wp audit typescript-version` (bundled in `wp audit guardrails`, so it runs in
+every consumer CI that calls guardrails, and updates automatically on the next
+`wp` / agent-kit bump — no CI edits) fails when the `typescript` compiler
+dependency is pinned below major 7, in either:
+
+- the `catalog.typescript` pin in `pnpm-workspace.yaml`, or
+- a direct `typescript` dependency/devDependency in any `package.json`
+  (`catalog:` / `workspace:` references are skipped — they resolve through the
+  catalog, which is checked directly).
+
+## `@typescript/typescript6` is allowed — it is not legacy
+
+TypeScript 7's **programmatic** compiler API is not stable until 7.1, so tooling
+that calls the compiler API (e.g. `wp typecheck`) bridges through
+`@typescript/typescript6`, the Microsoft-published TS6 compiler-API
+compatibility package. That is a distinct dependency from the `typescript`
+compiler and is **never** flagged by this audit. Keep `typescript` on `^7` and
+`@typescript/typescript6` on `^6` — do not downgrade the `typescript` compiler.
+
+## Temporary exception
+
+A consumer mid-migration may add a `typescript-version-allow` comment in
+`pnpm-workspace.yaml` (or the manifest) to suppress the check. Treat it as
+temporary and remove it once the repo is on TypeScript 7.

package/catalog/agent/skills/codex/SKILL.md

@@ -8,13 +8,37 @@ license: MIT
 
 Use this skill from Claude or another non-Codex host when the user wants Codex to independently review a diff, challenge a plan, or answer a repo question. Keep Codex read-only by default and treat its answer as external advice until independently verified.
 
+## Primary path: the `wp_review_run` MCP tool
+
+When the webpresso MCP server is available, call `wp_review_run` directly instead of any bash block below — it is the same `wp review run` typed runtime, called in-process, with two ergonomic wins: it takes a `prompt` string (no `--prompt-file` bookkeeping) and it runs the probe stage and the review stage in **one call** by default (the review stage is skipped automatically if the probe fails, so you never waste a full review invocation on a cold/broken provider).
+
+```jsonc
+// wp_review_run MCP tool call
+{
+  "prompt": "<diff summary + what to look for>",
+  "provider": "codex",
+  // model, effort, artifactRoot, idleSeconds are all optional and default
+  // the same way the `wp review run` CLI does. Omit `stage` for automatic
+  // probe-then-review; pass stage: "probe" or stage: "review" only for
+  // manual single-stage control.
+}
+```
+
+**Provider fallback lives in this one call.** If your primary provider (e.g. Codex) is unavailable — out of credits, auth expired — switch the `provider` parameter to another supported value (`claude`, `opencode`, `grok`) in the SAME `wp_review_run` call. Never shell into a different provider's CLI directly; that bypasses artifact capture under `.webpresso/reviews`, availability tracking, and the probe-then-review handshake this tool exists to provide. The pretool guard hook actively blocks shelling straight into a provider CLI's review-launching subcommand and redirects here.
+
+The bash blocks in this skill (below) are the **MCP-unavailable fallback only** — use them when the webpresso MCP server itself is not reachable in the current host, not as a provider-fallback mechanism.
+
 ## Single-shot budget (anti-stampede)
 
 - Default: **one** review invocation per request.
 - Do **not** fan out parallel multi-host review matrices unless the user set `review_budget`/`N` > 1.
-- Prefer `wp review run` / `wp review gate` over spawn/wait agent loops for review.
+- Prefer `wp_review_run` (MCP) or `wp review run` / `wp review gate` (CLI fallback) over spawn/wait agent loops for review.
 - Keep prompts bounded; no whole-repo paste.
 
+## MCP-unavailable fallback (raw CLI)
+
+Everything from here down is the manual `wp review run` CLI path documented for hosts or sessions where the webpresso MCP server is not reachable. Prefer `wp_review_run` above whenever MCP is available.
+
 ## Auth check
 
 ```bash

package/catalog/agent/skills/verify/SKILL.md

@@ -235,8 +235,10 @@ Reviewer preference (pick **one** path):
 
 Approval evidence requirements:
 
-- Blueprint lifecycle: `wp review gate <blueprint-slug> --target HEAD --json` first.
-  Use `wp review log` / `wp review read` for inspection.
+- Blueprint lifecycle: `wp review gate <blueprint-slug> --purpose delivery --target HEAD --json`
+  first. Delivery gates automatically run declared Promotion Gates from the
+  Trust Dossier before outside-review provider probes. Use `wp review log` /
+  `wp review read` for inspection.
 - Each reviewer must return clear `APPROVED`/`BLOCKED` with enough evidence.
 - Record as PR comments when a PR exists (model/tool, verdict, reviewed commit).
 - Unavailable reviewer → try next preferred; if still short, report gap and

package/catalog/docs/templates/blueprint.md

@@ -22,7 +22,7 @@ approvals: [] # Legacy approval mirror; authority may also come from v2 review-e
 - Draft slug: `{{slug}}`
 - Output path: `{{output_path}}`
 - Generated command: `wp blueprint new "{{description}}" --complexity {{complexity}}`
-- Default shape: folder (`blueprints/<status>/<slug>/_overview.md`, with sibling `reviews.md` for approvals); flat `blueprints/<status>/<slug>.md` is legacy-valid
+- Default shape: folder (`blueprints/<status>/<slug>/_overview.md`, with sibling `reviews.md` for approvals); flat `blueprints/<status>/<slug>.md` stays readable but cannot hold review evidence, ledgers, or approvals — run `wp blueprint canonicalize <slug>` first
 - Validation scope: parser compliance before write
 
 ## Architecture Overview

package/dist/esm/audit/agents.js

@@ -13,6 +13,7 @@ const REQUIRED_SUBAGENTS = [
     "security-auditor.md",
     "doc-writer.md",
     "explorer.md",
+    "implementer.md",
 ];
 const EXPLORER_CONTRACT_MARKERS = [
     "3–5 tool calls",

package/dist/esm/audit/blueprint-lifecycle-sql.d.ts

@@ -35,4 +35,16 @@ export interface BlueprintLifecycleAuditOptions {
      */
     readonly affectedFiles?: readonly string[];
 }
+/**
+ * Decide the file scope for the per-file `runBlueprintAudit` pass. In
+ * changed-only mode with a resolved changed scope, audit only the changed
+ * blueprint files (bounded, pre-commit-fast); otherwise audit the whole corpus
+ * (`all: true`, the CI-grade pass). Extracted + exported so the scoping contract
+ * is unit-testable without standing up the full corpus.
+ */
+export declare function resolveRunBlueprintAuditScope(changedOnly: boolean, changedFiles: ReadonlySet<string> | null): {
+    readonly stagedFiles: string[];
+} | {
+    readonly all: true;
+};
 export declare function auditBlueprintLifecycleSql(cwd?: string, options?: BlueprintLifecycleAuditOptions): Promise<RepoAuditResult>;

package/dist/esm/audit/blueprint-lifecycle-sql.js

@@ -357,17 +357,20 @@ function listTrackedBlueprintPaths(cwd) {
 }
 function changedBlueprintScope(candidates) {
     const slugs = new Set();
+    const files = new Set();
     for (const [currentPath, candidate] of candidates) {
+        files.add(currentPath);
         const currentSlug = blueprintSlugFromGitPath(currentPath);
         if (currentSlug)
             slugs.add(currentSlug);
         for (const previousPath of candidate.previousPaths) {
+            files.add(previousPath);
             const previousSlug = blueprintSlugFromGitPath(previousPath);
             if (previousSlug)
                 slugs.add(previousSlug);
         }
     }
-    return { slugs };
+    return { slugs, files };
 }
 /**
  * When `--affected` supplies an explicit file set (pre-commit staged files or
@@ -435,6 +438,19 @@ function readPreviousLifecycleStatusFromCandidate(cwd, row, candidate, trackedPa
     }
     return null;
 }
+/**
+ * Decide the file scope for the per-file `runBlueprintAudit` pass. In
+ * changed-only mode with a resolved changed scope, audit only the changed
+ * blueprint files (bounded, pre-commit-fast); otherwise audit the whole corpus
+ * (`all: true`, the CI-grade pass). Extracted + exported so the scoping contract
+ * is unit-testable without standing up the full corpus.
+ */
+export function resolveRunBlueprintAuditScope(changedOnly, changedFiles) {
+    if (changedOnly && changedFiles !== null) {
+        return { stagedFiles: [...changedFiles] };
+    }
+    return { all: true };
+}
 export async function auditBlueprintLifecycleSql(cwd = process.cwd(), options = {}) {
     const budgets = loadBudgets(cwd);
     const wipInProgressMax = budgets["blueprint-wip-in-progress-max"].max ?? 3;
@@ -522,10 +538,15 @@ export async function auditBlueprintLifecycleSql(cwd = process.cwd(), options =
     if (options.changedOnly && changedScope) {
         titleNotices.push(`changed-only: ${changedScope.slugs.size} blueprint(s)`);
     }
+    // In changed-only mode, scope the per-file blueprint audit to the changed
+    // blueprints. Auditing all blueprints (`all: true`) parses and validates the
+    // entire corpus (~1300 files, ~70s) even for a one-blueprint change — far too
+    // slow for the pre-commit hot path. The whole-corpus pass is CI's job; the
+    // structural + SQL projection checks below still run over every blueprint.
     const { runBlueprintAudit } = await import("../blueprint/lifecycle/audit.js");
     const lifecycle = await runBlueprintAudit({
         projectRoot: cwd,
-        all: true,
+        ...resolveRunBlueprintAuditScope(options.changedOnly === true, changedScope?.files ?? null),
         completedApprovalGate: options.changedOnly === true,
         inProgressApprovalGate: options.changedOnly === true,
         strict: true,

package/dist/esm/audit/blueprint-pr-coverage.js

@@ -262,6 +262,10 @@ function isDependabotDependencyFile(filePath) {
         normalized === "bun.lockb" ||
         normalized === "deno.lock" ||
         normalized === "pnpm-workspace.yaml" ||
+        normalized === "Cargo.toml" ||
+        normalized.endsWith("/Cargo.toml") ||
+        normalized === "Cargo.lock" ||
+        normalized.endsWith("/Cargo.lock") ||
         (normalized.startsWith(".github/workflows/") && /\.ya?ml$/u.test(basename)));
 }
 function normalizeHeadRef(value) {

package/dist/esm/audit/ci-guardrails-wiring.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Guardrail: keep `wp audit guardrails` wired into a repo's own CI.
+ *
+ * `wp audit guardrails` is the delivery vehicle for every guardrail that ships
+ * inside the suite (e.g. `typescript-version` from #810). A consumer inherits a
+ * new guardrail automatically on their next agent-kit bump ONLY IF their CI
+ * still invokes `wp audit guardrails`. If that step is deleted, the whole suite
+ * silently stops running in CI and new guardrails never reach the consumer.
+ *
+ * This audit is dogfood / defense-in-depth — NOT the delivery guarantee. It
+ * cannot run if the very invariant it checks is already broken (a CI with no
+ * guardrails step never executes this audit in CI). The actual self-healing
+ * guarantee is the managed inject-by-content-absence repair in
+ * `scaffold-base-kit.ts` (`ensureGuardrailsCiStep`), which re-inserts the step
+ * on every `wp setup`. This audit's value is LOCAL: it is registered as
+ * affected-safe + MCP-visible, so `wp audit guardrails --affected` (pre-commit /
+ * IDE) catches the drift on the developer's machine even when CI has drifted.
+ *
+ * Modeled on the self-CI checks in `ci-test-perf.ts`.
+ */
+import type { RepoAuditResult } from "./repo-guardrails.js";
+export declare function auditCiGuardrailsWiring(rootDirectory?: string): RepoAuditResult;

package/dist/esm/audit/ci-guardrails-wiring.js

@@ -0,0 +1,90 @@
+/**
+ * Guardrail: keep `wp audit guardrails` wired into a repo's own CI.
+ *
+ * `wp audit guardrails` is the delivery vehicle for every guardrail that ships
+ * inside the suite (e.g. `typescript-version` from #810). A consumer inherits a
+ * new guardrail automatically on their next agent-kit bump ONLY IF their CI
+ * still invokes `wp audit guardrails`. If that step is deleted, the whole suite
+ * silently stops running in CI and new guardrails never reach the consumer.
+ *
+ * This audit is dogfood / defense-in-depth — NOT the delivery guarantee. It
+ * cannot run if the very invariant it checks is already broken (a CI with no
+ * guardrails step never executes this audit in CI). The actual self-healing
+ * guarantee is the managed inject-by-content-absence repair in
+ * `scaffold-base-kit.ts` (`ensureGuardrailsCiStep`), which re-inserts the step
+ * on every `wp setup`. This audit's value is LOCAL: it is registered as
+ * affected-safe + MCP-visible, so `wp audit guardrails --affected` (pre-commit /
+ * IDE) catches the drift on the developer's machine even when CI has drifted.
+ *
+ * Modeled on the self-CI checks in `ci-test-perf.ts`.
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+const WORKFLOW_DIR = ".github/workflows";
+const WORKFLOW_FILE_PATTERN = /\.(ya?ml)$/iu;
+/** The guardrails invocation, keyed on the command itself (not the `wp` prefix
+ * nor a marker comment) so `wp audit guardrails`, `./bin/wp audit guardrails`,
+ * and the `--affected`/`--full` variants all count as wired. */
+const GUARDRAILS_INVOCATION_PATTERN = /\baudit guardrails\b/u;
+/**
+ * Lines that run the default test suite — the signal that a workflow is a
+ * quality-CI pipeline that owes a guardrails step. Mirrors the notion of a
+ * test-running workflow used by `ci-test-perf.ts`; kept local so the two audits
+ * stay independent.
+ */
+const TEST_RUN_PATTERN = /(?:\bvp\s+run\s+test\b|\bpnpm\s+(?:run\s+)?test\b|\bnpm\s+(?:run\s+)?test\b|\bbun\s+(?:run\s+)?test\b|\bwp\s+test\b|\bvitest\s+run\b)/iu;
+function walkWorkflowFiles(dir) {
+    if (!existsSync(dir))
+        return [];
+    const files = [];
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const fullPath = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...walkWorkflowFiles(fullPath));
+            continue;
+        }
+        if (entry.isFile() && WORKFLOW_FILE_PATTERN.test(entry.name)) {
+            files.push(fullPath);
+        }
+    }
+    return files;
+}
+export function auditCiGuardrailsWiring(rootDirectory = process.cwd()) {
+    const workflowsRoot = join(rootDirectory, WORKFLOW_DIR);
+    const files = walkWorkflowFiles(workflowsRoot);
+    const testWorkflows = [];
+    let anyWorkflowWiresGuardrails = false;
+    for (const file of files) {
+        const content = readFileSync(file, "utf8");
+        if (GUARDRAILS_INVOCATION_PATTERN.test(content))
+            anyWorkflowWiresGuardrails = true;
+        if (TEST_RUN_PATTERN.test(content)) {
+            testWorkflows.push(relative(rootDirectory, file).replace(/\\/gu, "/"));
+        }
+    }
+    // No quality-CI pipeline (no workflow runs the default test suite) → nothing
+    // to enforce; a repo without agent-kit CI is not "drifted".
+    const violations = [];
+    if (testWorkflows.length > 0 && !anyWorkflowWiresGuardrails) {
+        for (const workflow of testWorkflows) {
+            violations.push({
+                file: workflow,
+                severity: "error",
+                ruleId: "ci-guardrails-wiring",
+                message: `${workflow} runs the test suite but no workflow invokes \`wp audit guardrails\`. ` +
+                    `Guardrails (e.g. typescript-version) reach this repo only while CI runs ` +
+                    `\`wp audit guardrails\`. Re-run \`wp setup\` to restore the managed CI step.`,
+            });
+        }
+    }
+    return {
+        ok: violations.length === 0,
+        title: "CI guardrails wiring",
+        checked: files.length,
+        sources: files.map((file) => ({
+            path: relative(rootDirectory, file).replace(/\\/gu, "/"),
+            kind: "workflow",
+        })),
+        violations,
+    };
+}

package/dist/esm/audit/ci-test-perf.js

@@ -11,6 +11,7 @@
  */
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, relative } from "node:path";
+import { parse as parseYaml } from "yaml";
 const WORKFLOW_DIR = ".github/workflows";
 const WORKFLOW_FILE_PATTERN = /\.(ya?ml)$/iu;
 /** Steps/jobs that intentionally serialize workers (mutation, Stryker, etc.). */
@@ -26,6 +27,16 @@ const SETUP_VP_CACHE_TRUE_PATTERN = /^\s*cache:\s*(?:true|pnpm|npm)\b/mu;
 const PACKAGE_INSTALL_PATTERN = /(?:\bvp\s+install\b|\bpnpm\s+install\b|\bnpm\s+ci\b|\bnpm\s+install\b|\bbun\s+install\b)/u;
 // Opt-out: put this comment on the same line or the line immediately above a serial force.
 const ALLOW_COMMENT_PATTERN = /ci-test-perf-allow(?:-serial)?\b/iu;
+const AGENT_KIT_SELF_CI_PATH = ".github/workflows/ci.agent-kit.yml";
+function readWorkflowJob(content, jobName) {
+    try {
+        const parsed = parseYaml(content);
+        return parsed.jobs?.[jobName];
+    }
+    catch {
+        return;
+    }
+}
 function walkWorkflowFiles(dir) {
     if (!existsSync(dir))
         return [];
@@ -112,6 +123,25 @@ function findViolations(root, file) {
                 `Cold installs inflate test job wall-clock without adding coverage.`,
         });
     }
+    if (relPath === AGENT_KIT_SELF_CI_PATH) {
+        const testJob = readWorkflowJob(content, "test");
+        const supervisorSteps = testJob?.steps?.filter((step) => typeof step.run === "string" && step.run.includes("bun scripts/run-vitest-projects.ts"));
+        const hasConcurrentLane = content.includes("WP_VITEST_PROJECT_MODE: concurrent");
+        const hasSerialLane = content.includes("WP_VITEST_PROJECT_MODE: serial");
+        if ((supervisorSteps?.length ?? 0) < 2 || !hasConcurrentLane || !hasSerialLane) {
+            violations.push({
+                file: relPath,
+                message: `${relPath}: agent-kit self-CI must run concurrent Test shards and the isolated serial lane ` +
+                    `through scripts/run-vitest-projects.ts so project concurrency and owned-process cleanup stay enforced.`,
+            });
+        }
+        if (testJob?.["timeout-minutes"] !== 5) {
+            violations.push({
+                file: relPath,
+                message: `${relPath}: agent-kit self-CI Test job must declare timeout-minutes: 5.`,
+            });
+        }
+    }
     return violations;
 }
 export function auditCiTestPerf(rootDirectory = process.cwd()) {

package/dist/esm/audit/command-surface.js

@@ -23,6 +23,7 @@ export function auditCommandSurface(root) {
     const verifySkillPath = path.join(root, "catalog/agent/skills/verify/SKILL.md");
     const codexVerifyPath = path.join(root, "packages/codex-plugin/skills/verify/SKILL.md");
     const claudeVerifyPath = path.join(root, "packages/claude-plugin/skills/verify/SKILL.md");
+    const opencodeVerifyPath = path.join(root, "packages/opencode-plugin/skills/verify/SKILL.md");
     const hookGuidancePath = path.join(root, "src/hooks/pretool-guard/dev-routing.ts");
     const requiredFiles = [
         cliPath,
@@ -35,6 +36,7 @@ export function auditCommandSurface(root) {
         verifySkillPath,
         codexVerifyPath,
         claudeVerifyPath,
+        opencodeVerifyPath,
         hookGuidancePath,
     ];
     for (const file of requiredFiles) {
@@ -65,8 +67,8 @@ export function auditCommandSurface(root) {
     if (!contains(mcpPrWaitPath, "buildStatusSnapshot")) {
         findings.push(violation("src/mcp/tools/pr-wait.ts", "MCP ready wait does not use the shared snapshot evaluator"));
     }
-    for (const file of [verifySkillPath, codexVerifyPath, claudeVerifyPath]) {
-        if (!contains(file, "wp review gate <blueprint-slug> --target HEAD --json")) {
+    for (const file of [verifySkillPath, codexVerifyPath, claudeVerifyPath, opencodeVerifyPath]) {
+        if (!contains(file, "wp review gate <blueprint-slug> --purpose delivery --target HEAD --json")) {
             findings.push(violation(path.relative(root, file), "missing executable review-gate lifecycle guidance"));
         }
     }

package/dist/esm/audit/host-substitution-risk.d.ts

@@ -0,0 +1,2 @@
+import type { RepoAuditResult } from "./repo-guardrails.js";
+export declare function auditHostSubstitutionRisk(rootDirectory?: string): RepoAuditResult;

package/dist/esm/audit/host-substitution-risk.js

@@ -0,0 +1,256 @@
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import path from "node:path";
+import { parse as parseYaml } from "yaml";
+import { readTrustedJsonFile } from "#shared-utils/read-json-file.js";
+const AGENT_KIT_PACKAGE = "@webpresso/agent-kit";
+const SCORECARD_REL = "docs/host-substitution-scorecard.md";
+const BASELINES_REL = "maintainers/host-baselines";
+const SCORECARD_HEADERS = [
+    "capability",
+    "class",
+    "substitution risk",
+    "observed native overlap",
+    "repo-owned invariant",
+    "independent verifier",
+    "blueprints",
+    "investment",
+];
+const CLASS_VALUES = new Set(["core", "bridge", "utility"]);
+const RISK_VALUES = new Set(["low", "medium", "high"]);
+const INVESTMENT_VALUES = new Set(["invest", "maintain", "minimize"]);
+const SURFACE_STATUS_VALUES = new Set(["full", "partial", "none", "in-progress"]);
+function violation(file, message) {
+    return { file, message };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function packageName(root) {
+    try {
+        const parsed = readTrustedJsonFile(path.join(root, "package.json"));
+        return typeof parsed.name === "string" ? parsed.name : null;
+    }
+    catch {
+        return null;
+    }
+}
+function splitMarkdownRow(line) {
+    return line
+        .trim()
+        .replace(/^\|/u, "")
+        .replace(/\|$/u, "")
+        .split("|")
+        .map((cell) => cell.trim());
+}
+function parseScorecard(markdown) {
+    const lines = markdown.split(/\r?\n/u);
+    const rows = [];
+    const errors = [];
+    for (let index = 0; index < lines.length - 1; index += 1) {
+        const header = splitMarkdownRow(lines[index] ?? "").map((cell) => cell.toLowerCase());
+        if (header.join("|") !== SCORECARD_HEADERS.join("|"))
+            continue;
+        const separator = lines[index + 1] ?? "";
+        if (!/^\s*\|[\s:|-]+\|\s*$/u.test(separator)) {
+            errors.push("scorecard table header must be followed by a markdown separator row");
+            continue;
+        }
+        for (let rowIndex = index + 2; rowIndex < lines.length; rowIndex += 1) {
+            const line = lines[rowIndex] ?? "";
+            if (!line.trimStart().startsWith("|"))
+                break;
+            const cells = splitMarkdownRow(line);
+            if (cells.length !== SCORECARD_HEADERS.length) {
+                errors.push(`scorecard row ${rowIndex + 1} has ${cells.length} cells`);
+                continue;
+            }
+            rows.push(Object.fromEntries(SCORECARD_HEADERS.map((key, i) => [key, cells[i] ?? ""])));
+        }
+        return { rows, errors };
+    }
+    errors.push(`missing scorecard table with headers: ${SCORECARD_HEADERS.join(" | ")}`);
+    return { rows, errors };
+}
+function cleanToken(value) {
+    return value.replace(/^`|`$/gu, "").trim();
+}
+function splitCellList(value) {
+    return value
+        .split(/(?:<br\s*\/?>|,)/iu)
+        .map((item) => cleanToken(item))
+        .filter((item) => item.length > 0 && item !== "--" && item.toLowerCase() !== "none");
+}
+function scanBlueprintIds(root) {
+    const ids = new Set();
+    const base = path.join(root, "blueprints");
+    if (!existsSync(base))
+        return ids;
+    for (const status of ["draft", "planned", "in-progress", "completed", "archived", "parked"]) {
+        const statusDir = path.join(base, status);
+        if (!existsSync(statusDir))
+            continue;
+        for (const entry of readdirSync(statusDir)) {
+            if (entry.startsWith("."))
+                continue;
+            const absolute = path.join(statusDir, entry);
+            if (entry.endsWith(".md")) {
+                ids.add(`${status}/${entry.replace(/\.md$/u, "")}`);
+                continue;
+            }
+            if (statSync(absolute).isDirectory() && existsSync(path.join(absolute, "_overview.md"))) {
+                ids.add(`${status}/${entry}`);
+            }
+        }
+    }
+    return ids;
+}
+function activeBlueprintIds(root) {
+    const ids = new Set();
+    for (const id of scanBlueprintIds(root)) {
+        if (id.startsWith("planned/") || id.startsWith("in-progress/"))
+            ids.add(id);
+    }
+    return ids;
+}
+function validateScorecard(root) {
+    const scorecardPath = path.join(root, SCORECARD_REL);
+    if (!existsSync(scorecardPath)) {
+        return { checked: 1, violations: [violation(SCORECARD_REL, "scorecard file is missing")] };
+    }
+    const parsed = parseScorecard(readFileSync(scorecardPath, "utf8"));
+    const violations = parsed.errors.map((message) => violation(SCORECARD_REL, message));
+    const seenCapabilities = new Set();
+    const allBlueprintIds = scanBlueprintIds(root);
+    const active = activeBlueprintIds(root);
+    const activeCoverage = new Map();
+    for (const id of active)
+        activeCoverage.set(id, 0);
+    for (const [index, row] of parsed.rows.entries()) {
+        const rowLabel = `row ${index + 1}`;
+        const capability = cleanToken(row.capability ?? "");
+        if (!/^[a-z][a-z0-9-]*$/u.test(capability)) {
+            violations.push(violation(SCORECARD_REL, `${rowLabel}: capability must be a stable kebab-case id`));
+        }
+        else if (seenCapabilities.has(capability)) {
+            violations.push(violation(SCORECARD_REL, `${rowLabel}: duplicate capability ${capability}`));
+        }
+        seenCapabilities.add(capability);
+        const kind = cleanToken(row.class ?? "");
+        if (!CLASS_VALUES.has(kind)) {
+            violations.push(violation(SCORECARD_REL, `${rowLabel}: class must be core, bridge, or utility`));
+        }
+        const risk = cleanToken(row["substitution risk"] ?? "");
+        if (!RISK_VALUES.has(risk)) {
+            violations.push(violation(SCORECARD_REL, `${rowLabel}: substitution risk must be low, medium, or high`));
+        }
+        const investment = cleanToken(row.investment ?? "");
+        if (!INVESTMENT_VALUES.has(investment)) {
+            violations.push(violation(SCORECARD_REL, `${rowLabel}: investment must be invest, maintain, or minimize`));
+        }
+        for (const verifier of splitCellList(row["independent verifier"] ?? "")) {
+            if (!verifier.startsWith("repo:"))
+                continue;
+            const verifierPath = verifier.slice("repo:".length);
+            if (!existsSync(path.join(root, verifierPath))) {
+                violations.push(violation(SCORECARD_REL, `${rowLabel}: verifier path missing: ${verifier}`));
+            }
+        }
+        for (const blueprint of splitCellList(row.blueprints ?? "")) {
+            if (!/^(?:draft|planned|in-progress|completed|archived|parked)\/[a-z0-9][a-z0-9-]*$/u.test(blueprint)) {
+                violations.push(violation(SCORECARD_REL, `${rowLabel}: invalid blueprint reference ${blueprint}`));
+                continue;
+            }
+            if (!allBlueprintIds.has(blueprint)) {
+                violations.push(violation(SCORECARD_REL, `${rowLabel}: blueprint reference does not exist: ${blueprint}`));
+            }
+            if (activeCoverage.has(blueprint)) {
+                activeCoverage.set(blueprint, (activeCoverage.get(blueprint) ?? 0) + 1);
+            }
+        }
+    }
+    for (const [id, count] of activeCoverage) {
+        if (count !== 1) {
+            violations.push(violation(SCORECARD_REL, `active blueprint ${id} must be covered exactly once in scorecard blueprints column; found ${count}`));
+        }
+    }
+    return { checked: parsed.rows.length + activeCoverage.size, violations };
+}
+function validateHostBaseline(root, relPath) {
+    const violations = [];
+    const value = parseYaml(readFileSync(path.join(root, relPath), "utf8"));
+    if (!isRecord(value))
+        return [violation(relPath, "host baseline must be a YAML object")];
+    for (const key of ["host", "cli"]) {
+        if (typeof value[key] !== "string" || value[key].trim() === "") {
+            violations.push(violation(relPath, `${key} must be a non-empty string`));
+        }
+    }
+    for (const key of ["last_implemented", "last_observed"]) {
+        const record = value[key];
+        if (!isRecord(record)) {
+            violations.push(violation(relPath, `${key} must be an object`));
+            continue;
+        }
+        for (const child of ["version", "date"]) {
+            if (typeof record[child] !== "string" || record[child].trim() === "") {
+                violations.push(violation(relPath, `${key}.${child} must be a non-empty string`));
+            }
+        }
+    }
+    const sources = value.sources;
+    const docs = isRecord(sources) ? sources.docs : undefined;
+    if (!Array.isArray(docs) ||
+        docs.some((item) => typeof item !== "string" || !item.startsWith("https://"))) {
+        violations.push(violation(relPath, "sources.docs must be an array of https URLs"));
+    }
+    const surfaces = value.surfaces;
+    if (!isRecord(surfaces)) {
+        violations.push(violation(relPath, "surfaces must be an object"));
+    }
+    else {
+        for (const [name, raw] of Object.entries(surfaces)) {
+            if (!isRecord(raw)) {
+                violations.push(violation(relPath, `surfaces.${name} must be an object`));
+                continue;
+            }
+            if (typeof raw.status !== "string" || !SURFACE_STATUS_VALUES.has(raw.status)) {
+                violations.push(violation(relPath, `surfaces.${name}.status must be full, partial, none, or in-progress`));
+            }
+            if (typeof raw.notes !== "string" || raw.notes.trim() === "") {
+                violations.push(violation(relPath, `surfaces.${name}.notes must be a non-empty string`));
+            }
+        }
+    }
+    return violations;
+}
+function validateHostBaselines(root) {
+    const dir = path.join(root, BASELINES_REL);
+    if (!existsSync(dir)) {
+        return {
+            checked: 1,
+            violations: [violation(BASELINES_REL, "host baselines directory missing")],
+        };
+    }
+    const files = readdirSync(dir)
+        .filter((entry) => entry.endsWith(".yaml"))
+        .map((entry) => path.join(BASELINES_REL, entry));
+    return {
+        checked: files.length,
+        violations: files.flatMap((file) => validateHostBaseline(root, file)),
+    };
+}
+export function auditHostSubstitutionRisk(rootDirectory = process.cwd()) {
+    const root = path.resolve(rootDirectory);
+    const title = "Host substitution risk";
+    if (packageName(root) !== AGENT_KIT_PACKAGE)
+        return { ok: true, title, checked: 0, violations: [] };
+    const scorecard = validateScorecard(root);
+    const baselines = validateHostBaselines(root);
+    const violations = [...scorecard.violations, ...baselines.violations];
+    return {
+        ok: violations.length === 0,
+        title,
+        checked: scorecard.checked + baselines.checked,
+        violations,
+    };
+}