@wipcomputer/wip-repos 1.9.68 → 1.9.70

package/CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## 1.9.69 (2026-04-24)
+
+# wip-repos v1.9.69
+
+## Classify lifecycle paths and make sync apply explicit
+
+- Classifies discovered repos as active, worktree, trash, sort, sunsetted, archived, or third-party.
+- Ignores worktrees and lifecycle folders by default in `wip-repos check`, with `--all` and `--class` for inspection.
+- Makes `wip-repos sync` dry-run by default; repo moves require `--apply`.
+- Refuses sync moves for dirty repos, linked worktrees, and target collisions.
+- Adds a regression test for default check filtering, lifecycle class output, sync planning, and dirty-repo refusal.

package/README.md

@@ -21,12 +21,18 @@ Move folders around all day. On sync, everything snaps back to where the manifes
 ```bash
 # Check for drift between filesystem and manifest
 wip-repos check
+wip-repos check --all
+wip-repos check --class worktree
+
+# Report release-pipeline enrollment status
+wip-repos release-enrollment
+wip-repos release-enrollment --strict
 
 # See what sync would do
-wip-repos sync --dry-run
+wip-repos sync
 
 # Actually move folders to match manifest
-wip-repos sync
+wip-repos sync --apply
 
 # Add a new repo
 wip-repos add ldm-os/utilities/my-tool --remote wipcomputer/my-tool
@@ -44,21 +50,49 @@ wip-repos tree
 --manifest   Path to repos-manifest.json (default: ./repos-manifest.json)
 --root       Path to repos root directory (default: directory containing manifest)
 --dry-run    Show what would happen without making changes
+--strict     Treat missing release enrollment decisions as failures
 --json       Output as JSON
 ```
 
 ## How It Works
 
-1. **check** walks the filesystem, finds all git repos, compares against the manifest. Reports what's on disk but not in manifest, and what's in manifest but not on disk. Exit code 1 if drift detected.
+1. **check** walks the filesystem, classifies repos, and compares active repos against the manifest. Worktrees, trash, sort, sunsetted, and archived paths are ignored by default and summarized separately. Use `--all` or `--class <class>` to inspect them.
 
-2. **sync** matches repos by their git remote URL. If a repo's remote matches a manifest entry but it's at the wrong path, sync moves it to the manifest path.
+2. **sync** matches active repos by their git remote URL. If a repo's remote matches a manifest entry but it's at the wrong path, sync prints the move plan by default. It only moves with `--apply`, and refuses dirty repos, linked worktrees, and target collisions.
 
 3. **add/move** update the manifest file. The actual folder moves happen on the next `sync`.
 
+4. **release-enrollment** reports which active manifest repos are enrolled in the release pipeline, explicitly excluded, still need a release-profile decision, missing on disk, or active on disk but unmanifested. By default, missing repos and unmanifested active repos are blockers. With `--strict`, missing release decisions are blockers too.
+
+Release enrollment metadata lives in each manifest entry:
+
+```json
+{
+  "ldm-os/devops/my-tool-private": {
+    "remote": "wipcomputer/my-tool-private",
+    "release": {
+      "enabled": true,
+      "profile": "node-package",
+      "smokeProfile": "ldm-tool",
+      "publicMirror": "wipcomputer/my-tool",
+      "requiredSecrets": ["NPM_TOKEN"]
+    }
+  },
+  "ldm-os/docs/archive": {
+    "remote": "wipcomputer/docs-archive",
+    "release": {
+      "enabled": false,
+      "reason": "archived repo"
+    }
+  }
+}
+```
+
 ## Integration
 
 - `deploy-public` and `wip-release` can call `wip-repos check` before running. Stale manifest blocks deploys.
 - CI: run `wip-repos check` as a PR check. Drift = blocked merge.
+- CI/release planning: run `wip-repos release-enrollment --strict --json` to make release-owned repo enrollment machine-readable.
 - README generation: `wip-repos tree` outputs a directory tree from the manifest.
 
 ## Source

package/SKILL.md

@@ -39,6 +39,7 @@ Repo manifest reconciler. Like prettier for folder structure. Move folders aroun
 **Use wip-repos for:**
 - Checking if the filesystem matches the manifest (`check`)
 - Moving repos to match the manifest (`sync`)
+- Reporting release-pipeline enrollment state (`release-enrollment`)
 - Adding a new repo to the manifest (`add`)
 - Moving a repo in the manifest (`move`)
 - Generating a directory tree from the manifest (`tree`)
@@ -59,8 +60,12 @@ Repo manifest reconciler. Like prettier for folder structure. Move folders aroun
 
 ```bash
 wip-repos check                              # diff filesystem vs manifest
-wip-repos sync --dry-run                     # preview moves
-wip-repos sync                               # execute moves
+wip-repos check --all                        # include worktrees/trash/archive paths
+wip-repos check --class worktree             # inspect one lifecycle class
+wip-repos release-enrollment                 # report release enrollment decisions
+wip-repos release-enrollment --strict --json # CI-ready enrollment gate
+wip-repos sync                               # preview moves
+wip-repos sync --apply                       # execute safe moves
 wip-repos add ldm-os/utilities/new-tool --remote wipcomputer/new-tool
 wip-repos move ldm-os/utilities/tool --to ldm-os/devops/tool
 wip-repos tree                               # generate directory tree
@@ -69,12 +74,15 @@ wip-repos tree                               # generate directory tree
 ### Module
 
 ```javascript
-import { check, planSync, addRepo, moveRepo, generateReadmeTree } from '@wipcomputer/wip-repos';
+import { check, releaseEnrollment, planSync, addRepo, moveRepo, generateReadmeTree } from '@wipcomputer/wip-repos';
 
 const result = check('/path/to/manifest.json', '/path/to/repos/');
+const enrollment = releaseEnrollment('/path/to/manifest.json', '/path/to/repos/', { strict: true });
 const moves = planSync('/path/to/manifest.json', '/path/to/repos/');
 ```
 
+`sync` is dry-run by default. It refuses dirty repos, linked worktrees, and target collisions when `--apply` is used.
+
 ### MCP
 
-Tools: `repos_check`, `repos_sync_plan`, `repos_add`, `repos_move`, `repos_tree`
+Tools: `repos_check`, `repos_release_enrollment`, `repos_sync_plan`, `repos_add`, `repos_move`, `repos_tree`

package/cli.mjs

@@ -11,7 +11,7 @@
  *   tree    - Generate directory tree from manifest
  */
 
-import { check, planSync, executeSync, addRepo, moveRepo, generateReadmeTree, loadManifest } from './core.mjs';
+import { check, planSync, executeSync, addRepo, moveRepo, generateReadmeTree, loadManifest, checkCompliance, fixCompliance, findUnmanifested, releaseEnrollment } from './core.mjs';
 import { runClaude } from './claude.mjs';
 import { resolve, dirname, join } from 'node:path';
 import { readFileSync } from 'node:fs';
@@ -31,16 +31,34 @@ function usage() {
   console.log(`wip-repos ... repo manifest reconciler
 
 Usage:
-  wip-repos check [--manifest path] [--root path]
-  wip-repos sync  [--manifest path] [--root path] [--dry-run]
+  wip-repos check      [--manifest path] [--root path] [--all] [--class class]
+  wip-repos sync       [--manifest path] [--root path] [--apply]
+  wip-repos compliance [--manifest path] [--root path] [--fix]
+  wip-repos watchdog   [--manifest path] [--root path]
+  wip-repos release-enrollment [--manifest path] [--root path] [--strict]
   wip-repos add <path> --remote <org/repo> [--category cat] [--description desc]
   wip-repos move <path> --to <new-path>
-  wip-repos tree  [--manifest path]
+  wip-repos tree       [--manifest path]
+
+Commands:
+  check        Diff filesystem against manifest, flag drift
+  sync         Move local folders to match the manifest
+  compliance   Check all repos for .license-guard.json, LICENSE, CLA.md, .npmignore
+  watchdog     Find repos on disk that are not in the manifest
+  release-enrollment
+               Report release-pipeline enrollment decisions for active repos
+  add          Add a repo to the manifest
+  move         Move a repo to a different category in the manifest
+  tree         Generate directory tree from manifest
 
 Options:
   --manifest   Path to repos-manifest.json (default: ./repos-manifest.json)
   --root       Path to repos root directory (default: directory containing manifest)
-  --dry-run    Show what would happen without making changes
+  --all        Include worktrees, trash, archived, and other ignored lifecycle paths
+  --class      Show one lifecycle class only (active, worktree, trash, sort, sunsetted, archived, third-party)
+  --strict     Treat missing release enrollment decisions as failures
+  --apply      Apply sync moves. Without this, sync is a dry run
+  --fix        Create missing compliance files (with compliance command)
   --json       Output as JSON`);
 }
 
@@ -56,13 +74,17 @@ function hasFlag(flag) {
 
 const manifestPath = resolve(getFlag('--manifest') || 'repos-manifest.json');
 const reposRoot = resolve(getFlag('--root') || dirname(manifestPath));
-const dryRun = hasFlag('--dry-run');
+const apply = hasFlag('--apply');
+const dryRun = hasFlag('--dry-run') || !apply;
 const jsonOutput = hasFlag('--json');
 
 try {
   switch (command) {
     case 'check': {
-      const result = check(manifestPath, reposRoot);
+      const result = check(manifestPath, reposRoot, {
+        all: hasFlag('--all'),
+        classFilter: getFlag('--class') || null,
+      });
 
       if (jsonOutput) {
         console.log(JSON.stringify(result, null, 2));
@@ -72,12 +94,18 @@ try {
       console.log(`Manifest: ${result.total.manifest} repos`);
       console.log(`On disk:  ${result.total.disk} repos`);
       console.log(`Matched:  ${result.total.matched}`);
+      if (Object.keys(result.ignored).length > 0 && !hasFlag('--all') && !getFlag('--class')) {
+        const ignored = Object.entries(result.ignored).map(([k, v]) => `${k}=${v}`).join(', ');
+        console.log(`Ignored lifecycle paths: ${ignored}`);
+      }
       console.log();
 
       if (result.onDiskOnly.length > 0) {
         console.log(`On disk but NOT in manifest (${result.onDiskOnly.length}):`);
-        for (const p of result.onDiskOnly) {
-          console.log(`  + ${p}`);
+      for (const p of result.onDiskOnly) {
+          const detail = result.onDiskOnlyDetails.find(d => d.path === p);
+          const suffix = detail ? ` [${detail.class}: ${detail.reason}]` : '';
+          console.log(`  + ${p}${suffix}`);
         }
         console.log();
       }
@@ -122,7 +150,7 @@ try {
       }
 
       if (dryRun) {
-        console.log('Dry run. No changes made.');
+        console.log('Dry run. No changes made. Re-run with --apply to move repos.');
         break;
       }
 
@@ -174,6 +202,147 @@ try {
       break;
     }
 
+    case 'compliance': {
+      const results = checkCompliance(manifestPath, reposRoot);
+      const failing = results.filter(r => !r.clean);
+      const passing = results.filter(r => r.clean);
+
+      if (jsonOutput) {
+        console.log(JSON.stringify(results, null, 2));
+        break;
+      }
+
+      console.log(`Compliance check: ${results.length} repos scanned\n`);
+
+      if (failing.length > 0) {
+        console.log(`FAILING (${failing.length}):`);
+        for (const r of failing) {
+          console.log(`  ✗ ${r.repoPath}`);
+          for (const issue of r.issues) {
+            console.log(`    - ${issue}`);
+          }
+        }
+        console.log();
+      }
+
+      if (passing.length > 0) {
+        console.log(`PASSING (${passing.length}):`);
+        for (const r of passing) {
+          console.log(`  ✓ ${r.repoPath}`);
+        }
+        console.log();
+      }
+
+      if (failing.length > 0 && hasFlag('--fix')) {
+        console.log('Fixing...\n');
+        for (const r of failing) {
+          const created = fixCompliance(r.fullPath);
+          if (created.length > 0) {
+            console.log(`  ${r.repoPath}: created ${created.join(', ')}`);
+          }
+        }
+        console.log('\nFiles created. You still need to commit and push each repo.');
+      } else if (failing.length > 0) {
+        console.log('Run with --fix to create missing files.');
+      }
+
+      if (failing.length > 0) process.exit(1);
+      break;
+    }
+
+    case 'watchdog': {
+      const unmanifested = findUnmanifested(manifestPath, reposRoot);
+      if (jsonOutput) {
+        console.log(JSON.stringify(unmanifested, null, 2));
+        break;
+      }
+      if (unmanifested.length === 0) {
+        console.log('All repos on disk are in the manifest.');
+      } else {
+        console.log(`Repos on disk but NOT in manifest (${unmanifested.length}):`);
+        for (const p of unmanifested) {
+          console.log(`  ! ${p}`);
+        }
+        console.log('\nAdd them with: wip-repos add <path> --remote <org/repo>');
+        process.exit(1);
+      }
+      break;
+    }
+
+    case 'release-enrollment': {
+      const result = releaseEnrollment(manifestPath, reposRoot, {
+        strict: hasFlag('--strict'),
+      });
+
+      if (jsonOutput) {
+        console.log(JSON.stringify(result, null, 2));
+        if (!result.clean) process.exit(1);
+        break;
+      }
+
+      console.log('Release enrollment inventory');
+      console.log(`Active manifest repos: ${result.summary.manifestActive}`);
+      console.log(`Enrolled:              ${result.summary.enrolled}`);
+      console.log(`Excluded:              ${result.summary.excluded}`);
+      console.log(`Needs decision:        ${result.summary.needsDecision}`);
+      console.log(`Missing on disk:       ${result.summary.missingOnDisk}`);
+      console.log(`Unmanifested active:   ${result.summary.unmanifestedActive}`);
+      console.log(`Blockers:              ${result.summary.blockers}`);
+      console.log();
+
+      if (result.enrolled.length > 0) {
+        console.log(`ENROLLED (${result.enrolled.length}):`);
+        for (const entry of result.enrolled) {
+          const profile = entry.profile ? ` profile=${entry.profile}` : '';
+          const pkg = entry.packageName ? ` package=${entry.packageName}` : '';
+          const issues = entry.issues?.length ? ` issues=${entry.issues.join('; ')}` : '';
+          console.log(`  ✓ ${entry.path}${profile}${pkg}${issues}`);
+        }
+        console.log();
+      }
+
+      if (result.excluded.length > 0) {
+        console.log(`EXCLUDED (${result.excluded.length}):`);
+        for (const entry of result.excluded) {
+          console.log(`  - ${entry.path}: ${entry.reason}`);
+        }
+        console.log();
+      }
+
+      if (result.needsDecision.length > 0) {
+        const mode = result.strict ? 'BLOCKING because --strict is set' : 'NON-BLOCKING without --strict';
+        console.log(`NEEDS DECISION (${result.needsDecision.length}, ${mode}):`);
+        for (const entry of result.needsDecision) {
+          console.log(`  ? ${entry.path}: ${entry.issue}`);
+        }
+        console.log();
+      }
+
+      if (result.missingOnDisk.length > 0) {
+        console.log(`MISSING ON DISK (${result.missingOnDisk.length}):`);
+        for (const entry of result.missingOnDisk) {
+          console.log(`  ! ${entry.path}: ${entry.issue}`);
+        }
+        console.log();
+      }
+
+      if (result.unmanifestedActive.length > 0) {
+        console.log(`UNMANIFESTED ACTIVE (${result.unmanifestedActive.length}):`);
+        for (const entry of result.unmanifestedActive) {
+          console.log(`  + ${entry.path}: ${entry.reason}`);
+        }
+        console.log();
+      }
+
+      if (result.clean) {
+        console.log('Release enrollment inventory is actionable.');
+      } else {
+        console.log('Release enrollment inventory has blockers.');
+        process.exit(1);
+      }
+      break;
+    }
+
     case 'claude': {
       runClaude(manifestPath, args.slice(1));
       break;

package/core.mjs

@@ -5,6 +5,7 @@
  * Like prettier for folder structure.
  */
 
+import { execSync } from 'node:child_process';
 import { readFileSync, writeFileSync, existsSync, readdirSync, statSync, mkdirSync, renameSync } from 'node:fs';
 import { join, dirname, relative, resolve } from 'node:path';
 
@@ -58,45 +59,91 @@ export function saveManifest(manifestPath, meta, repos) {
   writeFileSync(manifestPath, JSON.stringify(out, null, 2) + '\n', 'utf8');
 }
 
+export function classifyRepoPath(relPath, fullPath) {
+  const parts = relPath.split('/');
+  if (parts.includes('.worktrees')) return { class: 'worktree', reason: 'inside .worktrees' };
+  if (parts.includes('_trash')) return { class: 'trash', reason: 'inside _trash' };
+  if (parts.includes('_sort')) return { class: 'sort', reason: 'inside _sort' };
+  if (parts.includes('_sunsetted')) return { class: 'sunsetted', reason: 'inside _sunsetted' };
+  if (parts.includes('_archive') || parts.includes('archive') || parts.includes('archived')) {
+    return { class: 'archived', reason: 'inside archive path' };
+  }
+  if (parts.includes('third-party') || parts.includes('third-party-repos') || parts.includes('external')) {
+    return { class: 'third-party', reason: 'inside third-party path' };
+  }
+  try {
+    const gitStat = statSync(join(fullPath, '.git'));
+    if (gitStat.isFile()) return { class: 'worktree', reason: '.git is a worktree file' };
+  } catch {}
+  return { class: 'active', reason: 'regular repo path' };
+}
+
+function shouldSkipDirName(name, includeIgnored) {
+  if (name === '.git' || name === 'node_modules' || name === '.DS_Store') return true;
+  if (includeIgnored) return false;
+  return ['.worktrees', '_trash', '_sort', '_sunsetted', '_archive', 'archive', 'archived'].includes(name);
+}
+
 /**
- * Walk a directory tree and find all git repos (directories containing .git/).
- * Returns array of relative paths from the root.
+ * Walk a directory tree and find all git repos (directories containing .git).
+ * Returns classified entries: { path, fullPath, class, reason }.
  */
-export function walkRepos(rootDir, prefix = '') {
+export function walkRepoEntries(rootDir, prefix = '', opts = {}) {
   const results = [];
   if (!existsSync(rootDir)) return results;
+  const includeIgnored = opts.includeIgnored || false;
+  const classFilter = opts.classFilter || null;
 
   const entries = readdirSync(rootDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    if (entry.name === '.git' || entry.name === 'node_modules') continue;
-    if (entry.name === '.DS_Store') continue;
+    if (shouldSkipDirName(entry.name, includeIgnored)) continue;
 
     const fullPath = join(rootDir, entry.name);
     const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
 
     // If this directory has a .git, it's a repo
     if (existsSync(join(fullPath, '.git'))) {
-      results.push(relPath);
+      const cls = classifyRepoPath(relPath, fullPath);
+      if ((!classFilter || cls.class === classFilter) && (includeIgnored || cls.class === 'active')) {
+        results.push({ path: relPath, fullPath, ...cls });
+      }
     } else {
       // Recurse into non-repo directories (organizational folders)
-      results.push(...walkRepos(fullPath, relPath));
+      results.push(...walkRepoEntries(fullPath, relPath, opts));
     }
   }
   return results;
 }
 
+export function walkRepos(rootDir, prefix = '', opts = {}) {
+  return walkRepoEntries(rootDir, prefix, opts).map(r => r.path);
+}
+
 /**
  * Check: diff the filesystem against the manifest.
  * Returns { inManifestOnly, onDiskOnly, matched }
  */
-export function check(manifestPath, reposRoot) {
+export function check(manifestPath, reposRoot, opts = {}) {
   const manifest = loadManifest(manifestPath);
-  const manifestPaths = new Set(Object.keys(manifest.repos));
-  const diskPaths = new Set(walkRepos(reposRoot));
+  const includeIgnored = opts.all || opts.includeIgnored || Boolean(opts.classFilter);
+  const manifestEntries = Object.keys(manifest.repos)
+    .map(path => ({ path, ...classifyRepoPath(path, join(reposRoot, path)) }))
+    .filter(entry => {
+      if (opts.classFilter) return entry.class === opts.classFilter;
+      return includeIgnored || entry.class === 'active';
+    });
+  const manifestPaths = new Set(manifestEntries.map(e => e.path));
+  const allDiskEntries = walkRepoEntries(reposRoot, '', { includeIgnored: true });
+  const diskEntries = walkRepoEntries(reposRoot, '', {
+    includeIgnored,
+    classFilter: opts.classFilter || null,
+  });
+  const diskPaths = new Set(diskEntries.map(e => e.path));
 
   const inManifestOnly = [];
   const onDiskOnly = [];
+  const onDiskOnlyDetails = [];
   const matched = [];
 
   for (const p of manifestPaths) {
@@ -110,16 +157,28 @@ export function check(manifestPath, reposRoot) {
   for (const p of diskPaths) {
     if (!manifestPaths.has(p)) {
       onDiskOnly.push(p);
+      const detail = diskEntries.find(e => e.path === p);
+      if (detail) onDiskOnlyDetails.push(detail);
     }
   }
 
+  const ignored = {};
+  for (const entry of allDiskEntries) {
+    if (entry.class === 'active') continue;
+    ignored[entry.class] = (ignored[entry.class] || 0) + 1;
+  }
+
   return {
     inManifestOnly: inManifestOnly.sort(),
     onDiskOnly: onDiskOnly.sort(),
+    onDiskOnlyDetails: onDiskOnlyDetails.sort((a, b) => a.path.localeCompare(b.path)),
     matched: matched.sort(),
+    disk: diskEntries.sort((a, b) => a.path.localeCompare(b.path)),
+    ignored,
     total: {
       manifest: manifestPaths.size,
       disk: diskPaths.size,
+      diskAll: allDiskEntries.length,
       matched: matched.length,
     },
   };
@@ -187,6 +246,14 @@ export function executeSync(moves, reposRoot) {
       results.push({ ...move, status: 'skipped', reason: 'target exists' });
       continue;
     }
+    if (isWorktree(move.fromFull)) {
+      results.push({ ...move, status: 'skipped', reason: 'source is a linked worktree' });
+      continue;
+    }
+    if (isDirtyRepo(move.fromFull)) {
+      results.push({ ...move, status: 'skipped', reason: 'source repo has uncommitted changes' });
+      continue;
+    }
     try {
       renameSync(move.fromFull, move.toFull);
       results.push({ ...move, status: 'moved' });
@@ -197,6 +264,26 @@ export function executeSync(moves, reposRoot) {
   return results;
 }
 
+export function isWorktree(repoPath) {
+  try {
+    return statSync(join(repoPath, '.git')).isFile();
+  } catch {
+    return false;
+  }
+}
+
+export function isDirtyRepo(repoPath) {
+  try {
+    return execSync('git status --porcelain 2>/dev/null', {
+      cwd: repoPath,
+      encoding: 'utf8',
+      timeout: 3000,
+    }).trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Add a repo to the manifest.
  */
@@ -288,3 +375,261 @@ export function generateReadmeTree(manifestPath) {
   render(tree, '', false);
   return lines.join('\n');
 }
+
+// ── Compliance checking (Wave 3.3) ──────────────────────────────────
+
+const DEFAULT_LICENSE_GUARD = {
+  copyright: 'WIP Computer, Inc.',
+  license: 'MIT+AGPL',
+  spdx: 'MIT AND AGPL-3.0-or-later',
+};
+
+/**
+ * Check compliance of all repos in the manifest.
+ * Returns array of { repoPath, fullPath, issues[], hasPackageJson }
+ */
+export function checkCompliance(manifestPath, reposRoot) {
+  const manifest = loadManifest(manifestPath);
+  const results = [];
+
+  for (const [repoPath, info] of Object.entries(manifest.repos)) {
+    const fullPath = join(reposRoot, repoPath);
+    if (!existsSync(fullPath)) continue;
+    if (!existsSync(join(fullPath, 'package.json'))) continue;
+
+    // Skip _to-privatize, _sort, _sunsetted, _trash
+    if (repoPath.includes('_to-privatize') || repoPath.includes('_sort') ||
+        repoPath.includes('_sunsetted') || repoPath.includes('_trash')) continue;
+
+    const issues = [];
+
+    if (!existsSync(join(fullPath, '.license-guard.json'))) {
+      issues.push('missing .license-guard.json');
+    }
+    if (!existsSync(join(fullPath, 'LICENSE'))) {
+      issues.push('missing LICENSE');
+    } else {
+      const lic = readFileSync(join(fullPath, 'LICENSE'), 'utf8');
+      if (!lic.includes('WIP Computer')) issues.push('LICENSE missing copyright');
+      if (!lic.includes('AGPL') && !lic.includes('GNU Affero')) issues.push('LICENSE missing AGPL');
+    }
+    if (!existsSync(join(fullPath, 'CLA.md'))) {
+      issues.push('missing CLA.md');
+    }
+    if (existsSync(join(fullPath, 'ai')) && !existsSync(join(fullPath, '.npmignore'))) {
+      issues.push('missing .npmignore (has ai/ directory)');
+    } else if (existsSync(join(fullPath, 'ai')) && existsSync(join(fullPath, '.npmignore'))) {
+      const npmignore = readFileSync(join(fullPath, '.npmignore'), 'utf8');
+      if (!npmignore.includes('ai/')) issues.push('.npmignore does not exclude ai/');
+    }
+
+    results.push({ repoPath, fullPath, issues, clean: issues.length === 0 });
+  }
+
+  return results;
+}
+
+/**
+ * Fix compliance issues for a single repo.
+ * Creates missing files with WIP Computer defaults.
+ * Returns array of files created.
+ */
+export function fixCompliance(fullPath) {
+  const created = [];
+
+  // .license-guard.json
+  if (!existsSync(join(fullPath, '.license-guard.json'))) {
+    writeFileSync(
+      join(fullPath, '.license-guard.json'),
+      JSON.stringify(DEFAULT_LICENSE_GUARD, null, 2) + '\n',
+    );
+    created.push('.license-guard.json');
+  }
+
+  // CLA.md
+  if (!existsSync(join(fullPath, 'CLA.md'))) {
+    writeFileSync(join(fullPath, 'CLA.md'), [
+      '# Contributor License Agreement',
+      '',
+      'By submitting a pull request to this repository, you agree that:',
+      '',
+      '1. Your contribution is original work or you have the right to submit it.',
+      '2. You grant WIP Computer, Inc. a perpetual, worldwide, non-exclusive,',
+      '   royalty-free license to use, modify, and distribute your contribution',
+      '   under the terms of this project\'s license.',
+      '3. You understand your contribution will be publicly available.',
+      '',
+      'This CLA is required for all contributions. By opening a PR, you accept these terms.',
+      '',
+    ].join('\n'));
+    created.push('CLA.md');
+  }
+
+  // .npmignore (if ai/ exists)
+  if (existsSync(join(fullPath, 'ai'))) {
+    const npmignorePath = join(fullPath, '.npmignore');
+    if (!existsSync(npmignorePath)) {
+      writeFileSync(npmignorePath, 'ai/\n.claude/\n.worktrees/\n.DS_Store\nCLAUDE.md\n');
+      created.push('.npmignore');
+    } else {
+      const content = readFileSync(npmignorePath, 'utf8');
+      if (!content.includes('ai/')) {
+        writeFileSync(npmignorePath, content.trimEnd() + '\nai/\n');
+        created.push('.npmignore (updated)');
+      }
+    }
+  }
+
+  return created;
+}
+
+/**
+ * Find repos on disk that are NOT in the manifest.
+ * This is the watchdog function for the daily audit.
+ */
+export function findUnmanifested(manifestPath, reposRoot) {
+  const result = check(manifestPath, reposRoot);
+  return result.onDiskOnly;
+}
+
+function readPackageInfo(fullPath) {
+  const packagePath = join(fullPath, 'package.json');
+  if (!existsSync(packagePath)) return null;
+  try {
+    const pkg = JSON.parse(readFileSync(packagePath, 'utf8'));
+    return {
+      name: pkg.name || null,
+      version: pkg.version || null,
+      private: Boolean(pkg.private),
+      scripts: pkg.scripts || {},
+    };
+  } catch (err) {
+    return { error: err.message };
+  }
+}
+
+function getReleaseConfig(info) {
+  if (!info || typeof info !== 'object') return {};
+  if (info.release && typeof info.release === 'object') return info.release;
+  if (info.ci && typeof info.ci === 'object' && info.ci.release && typeof info.ci.release === 'object') {
+    return info.ci.release;
+  }
+  return {};
+}
+
+function isReleaseExcluded(releaseConfig) {
+  return releaseConfig.enabled === false || releaseConfig.enrolled === false;
+}
+
+function isReleaseEnrolled(releaseConfig) {
+  return releaseConfig.enabled === true || releaseConfig.enrolled === true || Boolean(releaseConfig.profile);
+}
+
+/**
+ * Report release-pipeline enrollment status for active manifest repos.
+ *
+ * This intentionally reuses the manifest and filesystem classifier from check().
+ * It answers the Phase 0 release-pipeline question: which repos are enrolled,
+ * which are explicitly excluded, and which still need a release-profile decision.
+ */
+export function releaseEnrollment(manifestPath, reposRoot, opts = {}) {
+  const manifest = loadManifest(manifestPath);
+  const inventory = check(manifestPath, reposRoot);
+  const strict = Boolean(opts.strict);
+
+  const enrolled = [];
+  const excluded = [];
+  const needsDecision = [];
+  const missingOnDisk = [];
+
+  for (const [repoPath, info] of Object.entries(manifest.repos)) {
+    const classification = classifyRepoPath(repoPath, join(reposRoot, repoPath));
+    if (classification.class !== 'active') continue;
+
+    const fullPath = join(reposRoot, repoPath);
+    const exists = existsSync(fullPath);
+    const releaseConfig = getReleaseConfig(info);
+    const packageInfo = exists ? readPackageInfo(fullPath) : null;
+    const entry = {
+      path: repoPath,
+      remote: info.remote || null,
+      packageName: packageInfo?.name || releaseConfig.packageName || releaseConfig.npmPackage || null,
+      packageVersion: packageInfo?.version || null,
+      profile: releaseConfig.profile || null,
+      smokeProfile: releaseConfig.smokeProfile || null,
+      publicMirror: releaseConfig.publicMirror || info.public || null,
+      requiredSecrets: Array.isArray(releaseConfig.requiredSecrets) ? releaseConfig.requiredSecrets : [],
+      scripts: packageInfo?.scripts ? Object.keys(packageInfo.scripts).sort() : [],
+    };
+
+    if (!exists) {
+      missingOnDisk.push({
+        ...entry,
+        issue: 'manifest entry is active but repo is not on disk',
+      });
+      continue;
+    }
+
+    if (packageInfo?.error) {
+      needsDecision.push({
+        ...entry,
+        issue: `package.json is invalid: ${packageInfo.error}`,
+      });
+      continue;
+    }
+
+    if (isReleaseExcluded(releaseConfig)) {
+      excluded.push({
+        ...entry,
+        reason: releaseConfig.reason || releaseConfig.excludeReason || 'release enrollment explicitly disabled',
+      });
+      continue;
+    }
+
+    if (isReleaseEnrolled(releaseConfig)) {
+      const issues = [];
+      if (!entry.profile) issues.push('missing release.profile');
+      if (!entry.packageName && packageInfo) issues.push('missing package name');
+      enrolled.push({ ...entry, issues });
+      continue;
+    }
+
+    needsDecision.push({
+      ...entry,
+      issue: 'missing release enrollment decision',
+    });
+  }
+
+  const unmanifestedActive = inventory.onDiskOnlyDetails
+    .filter(entry => entry.class === 'active')
+    .map(entry => ({
+      path: entry.path,
+      reason: entry.reason,
+    }));
+
+  const blockers = [
+    ...missingOnDisk.map(entry => ({ type: 'missing-on-disk', path: entry.path, issue: entry.issue })),
+    ...unmanifestedActive.map(entry => ({ type: 'unmanifested-active', path: entry.path, issue: entry.reason })),
+    ...(strict ? needsDecision.map(entry => ({ type: 'needs-decision', path: entry.path, issue: entry.issue })) : []),
+  ].sort((a, b) => a.path.localeCompare(b.path));
+
+  return {
+    strict,
+    clean: blockers.length === 0,
+    summary: {
+      manifestActive: enrolled.length + excluded.length + needsDecision.length + missingOnDisk.length,
+      enrolled: enrolled.length,
+      excluded: excluded.length,
+      needsDecision: needsDecision.length,
+      missingOnDisk: missingOnDisk.length,
+      unmanifestedActive: unmanifestedActive.length,
+      blockers: blockers.length,
+    },
+    enrolled: enrolled.sort((a, b) => a.path.localeCompare(b.path)),
+    excluded: excluded.sort((a, b) => a.path.localeCompare(b.path)),
+    needsDecision: needsDecision.sort((a, b) => a.path.localeCompare(b.path)),
+    missingOnDisk: missingOnDisk.sort((a, b) => a.path.localeCompare(b.path)),
+    unmanifestedActive,
+    blockers,
+  };
+}

package/mcp-server.mjs

@@ -7,7 +7,7 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import {
-  check, planSync, addRepo, moveRepo, generateReadmeTree,
+  check, planSync, addRepo, moveRepo, generateReadmeTree, releaseEnrollment,
 } from './core.mjs';
 
 const server = new Server(
@@ -43,6 +43,19 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         required: ['manifestPath', 'reposRoot'],
       },
     },
+    {
+      name: 'repos_release_enrollment',
+      description: 'Report release-pipeline enrollment status for active manifest repos: enrolled, excluded, needs decision, missing on disk, and unmanifested active repos.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          manifestPath: { type: 'string', description: 'Path to repos-manifest.json' },
+          reposRoot: { type: 'string', description: 'Root directory containing repos' },
+          strict: { type: 'boolean', description: 'Treat repos missing release enrollment decisions as blockers' },
+        },
+        required: ['manifestPath', 'reposRoot'],
+      },
+    },
     {
       name: 'repos_add',
       description: 'Add a repo to the manifest.',
@@ -112,6 +125,19 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
       };
     }
 
+    if (name === 'repos_release_enrollment') {
+      const result = releaseEnrollment(args.manifestPath, args.reposRoot, {
+        strict: Boolean(args.strict),
+      });
+      return {
+        content: [{
+          type: 'text',
+          text: JSON.stringify(result, null, 2),
+        }],
+        isError: !result.clean,
+      };
+    }
+
     if (name === 'repos_add') {
       const entry = addRepo(args.manifestPath, args.repoPath, args.remote, {
         description: args.description,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-repos",
-  "version": "1.9.68",
+  "version": "1.9.70",
   "type": "module",
   "description": "Repo manifest reconciler. Single source of truth for repo organization. Like prettier for folder structure.",
   "main": "core.mjs",
@@ -11,7 +11,7 @@
     ".": "./core.mjs"
   },
   "scripts": {
-    "test": "node cli.mjs --help"
+    "test": "node cli.mjs --help && node test.mjs"
   },
   "keywords": [
     "repo-manifest",

package/test.mjs

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+import { execSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { check, executeSync, planSync, releaseEnrollment } from './core.mjs';
+
+function run(cmd, cwd) {
+  execSync(cmd, { cwd, stdio: 'ignore' });
+}
+
+function initRepo(path, remote) {
+  mkdirSync(path, { recursive: true });
+  run('git init -q -b main', path);
+  run(`git remote add origin git@github.com:${remote}.git`, path);
+  writeFileSync(join(path, 'README.md'), '# repo\n');
+  run('git add README.md', path);
+  run('git -c user.email=t@t -c user.name=t commit -q -m init', path);
+}
+
+const root = mkdtempSync(join(tmpdir(), 'wip-repos-test-'));
+const manifestPath = join(root, 'repos-manifest.json');
+
+initRepo(join(root, 'active/repo-a'), 'wipcomputer/repo-a');
+initRepo(join(root, 'active/repo-b'), 'wipcomputer/repo-b');
+initRepo(join(root, 'active/no-decision'), 'wipcomputer/no-decision');
+initRepo(join(root, '_trash/old-repo'), 'wipcomputer/old-repo');
+initRepo(join(root, 'active/misplaced'), 'wipcomputer/right-place');
+mkdirSync(join(root, '.worktrees'), { recursive: true });
+run(`git worktree add -q -b feat ${join(root, '.worktrees/repo-a--feat')}`, join(root, 'active/repo-a'));
+
+writeFileSync(manifestPath, JSON.stringify({
+  _format: 'v2',
+  'active/repo-a': {
+    remote: 'wipcomputer/repo-a',
+    release: { enabled: true, profile: 'node-package', smokeProfile: 'none' },
+  },
+  'active/repo-b': {
+    remote: 'wipcomputer/repo-b',
+    release: { enabled: false, reason: 'docs-only fixture' },
+  },
+  'active/no-decision': { remote: 'wipcomputer/no-decision' },
+  'active/right-place': {
+    remote: 'wipcomputer/right-place',
+    release: { enabled: true, profile: 'node-package' },
+  },
+}, null, 2) + '\n');
+
+const defaultCheck = check(manifestPath, root);
+if (defaultCheck.onDiskOnly.includes('_trash/old-repo')) {
+  throw new Error('default check should ignore _trash repos');
+}
+if (defaultCheck.disk.some(r => r.class !== 'active')) {
+  throw new Error('default check should only include active repos');
+}
+
+const allCheck = check(manifestPath, root, { all: true });
+if (!allCheck.disk.some(r => r.class === 'trash')) {
+  throw new Error('--all check should include trash class');
+}
+if (!allCheck.disk.some(r => r.class === 'worktree')) {
+  throw new Error('--all check should include worktree class');
+}
+
+const worktreeCheck = check(manifestPath, root, { classFilter: 'worktree' });
+if (worktreeCheck.disk.length !== 1 || worktreeCheck.disk[0].class !== 'worktree') {
+  throw new Error('--class worktree should return only worktrees');
+}
+
+const enrollment = releaseEnrollment(manifestPath, root);
+if (enrollment.summary.enrolled !== 1 || enrollment.summary.excluded !== 1) {
+  throw new Error('releaseEnrollment should count enrolled and excluded repos');
+}
+if (enrollment.summary.needsDecision !== 1) {
+  throw new Error('releaseEnrollment should count repos without release decisions');
+}
+if (enrollment.summary.blockers !== 2) {
+  throw new Error('releaseEnrollment should block on missing and unmanifested active repos by default');
+}
+if (!enrollment.missingOnDisk.some(r => r.path === 'active/right-place')) {
+  throw new Error('releaseEnrollment should report active manifest repos missing on disk');
+}
+if (!enrollment.unmanifestedActive.some(r => r.path === 'active/misplaced')) {
+  throw new Error('releaseEnrollment should report active repos on disk but not in manifest');
+}
+
+const strictEnrollment = releaseEnrollment(manifestPath, root, { strict: true });
+if (strictEnrollment.summary.blockers !== 3) {
+  throw new Error('releaseEnrollment --strict should make missing decisions blocking');
+}
+
+const moves = planSync(manifestPath, root);
+if (moves.length !== 1 || moves[0].to !== 'active/right-place') {
+  throw new Error('planSync should plan the misplaced active repo only');
+}
+
+writeFileSync(join(root, 'active/misplaced/dirty.txt'), 'dirty\n');
+const results = executeSync(moves, root);
+if (results[0].status !== 'skipped' || !results[0].reason.includes('uncommitted')) {
+  throw new Error('executeSync should refuse dirty repo moves');
+}
+
+console.log('wip-repos regression passed');