arcane-cli 1.5.1 → 1.7.0

package/dist/index.js

@@ -6,11 +6,11 @@ const require = __createRequire(import.meta.url);
 import { Command } from "commander";
 import { createRequire as createRequire2 } from "module";
 import { fileURLToPath } from "url";
-import { dirname as dirname11, join as join18 } from "path";
+import { dirname as dirname11, join as join20 } from "path";
 
 // src/commands/init.ts
-import { select as select2, confirm, input as input2 } from "@inquirer/prompts";
-import { dirname as dirname4, join as join6 } from "path";
+import { select as select3, confirm as confirm2, input as input3 } from "@inquirer/prompts";
+import { dirname as dirname4, join as join7 } from "path";
 import chalk2 from "chalk";
 
 // src/modules/copier.ts
@@ -140,11 +140,13 @@ var ManifestCorruptError = class extends Error {
   }
 };
 var ManifestInvalidFieldError = class extends Error {
+  field;
   constructor(manifestPath2, field, value) {
     super(
       `Manifest at "${manifestPath2}" has an unsupported value for "${field}": ${JSON.stringify(value)}.`
     );
     this.name = "ManifestInvalidFieldError";
+    this.field = field;
   }
 };
 var MANIFEST_FILE = ".arcane.json";
@@ -152,6 +154,12 @@ var VALID_TRACKING_MODES = ["internal", "external"];
 var VALID_EXTERNAL_PROVIDERS = ["ado", "github", "jira", "other"];
 var VALID_CONTENT_SENSITIVITY = ["standard", "sensitive"];
 var VALID_PUSH_POLICIES = ["open", "guarded", "blocked"];
+var MANIFEST_ENUM_VALUES = {
+  tracking_mode: VALID_TRACKING_MODES,
+  external_provider: VALID_EXTERNAL_PROVIDERS,
+  content_sensitivity: VALID_CONTENT_SENSITIVITY,
+  push_policy: VALID_PUSH_POLICIES
+};
 var VALID_INSTALL_SCOPES = ["repo", "user"];
 function isValidFanoutPath(file) {
   return file.length > 0 && !file.startsWith("/") && !/^[a-zA-Z]:/.test(file) && !file.includes("\\") && !file.split("/").includes("..") && !/[\r\n\0]/.test(file);
@@ -181,13 +189,16 @@ function validateSecretsScanExcludePrefixes(value, filePath) {
     throw new ManifestInvalidFieldError(filePath, "secretsScanExcludePrefixes", value);
   }
 }
+function isValidIdeaTags(value) {
+  return isRecord(value) && (value["mode"] === "extend" || value["mode"] === "replace") && Array.isArray(value["tags"]) && value["tags"].every((tag) => typeof tag === "string" && tag.trim() !== "");
+}
 function manifestPath(targetDir) {
   return path2.join(targetDir, MANIFEST_FILE);
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function validateTrackingFields(manifest, filePath) {
+function validateManifestFields(manifest, filePath) {
   if (manifest.tracking_mode !== void 0 && !VALID_TRACKING_MODES.includes(manifest.tracking_mode)) {
     throw new ManifestInvalidFieldError(filePath, "tracking_mode", manifest.tracking_mode);
   }
@@ -222,6 +233,9 @@ function validateTrackingFields(manifest, filePath) {
   if (manifest.fanout !== void 0 && !isValidFanoutRecord(manifest.fanout)) {
     throw new ManifestInvalidFieldError(filePath, "fanout", manifest.fanout);
   }
+  if (manifest.idea_tags !== void 0 && !isValidIdeaTags(manifest.idea_tags)) {
+    throw new ManifestInvalidFieldError(filePath, "idea_tags", manifest.idea_tags);
+  }
 }
 async function readManifest(targetDir) {
   const filePath = manifestPath(targetDir);
@@ -240,7 +254,7 @@ async function readManifest(targetDir) {
   } catch {
     throw new ManifestCorruptError(filePath);
   }
-  validateTrackingFields(manifest, filePath);
+  validateManifestFields(manifest, filePath);
   return manifest;
 }
 async function resolveSecretsScanExcludePrefixes(targetDir) {
@@ -308,7 +322,8 @@ var PROFILE_CONFIGS = [
       "git-conventions",
       "testing-standards",
       "framework-decisions",
-      "session-continuity"
+      "session-continuity",
+      "line-ending-baseline"
     ]
   },
   {
@@ -332,7 +347,8 @@ var PROFILE_CONFIGS = [
       "decision-documentation-standard",
       "agent-work-queue-model",
       "development-methodology",
-      "spell-authoring-standards"
+      "spell-authoring-standards",
+      "line-ending-baseline"
     ]
   },
   {
@@ -357,6 +373,7 @@ var PROFILE_CONFIGS = [
       "spells-meta",
       "spells-docs",
       "docs-baseline",
+      "line-ending-baseline",
       "records-conventions",
       "agent-output-instructions",
       "git-conventions",
@@ -403,7 +420,8 @@ var PROFILE_CONFIGS = [
       "web-discoverability-standards",
       "mobile-release-standards",
       "records-conventions",
-      "compliance-standards"
+      "compliance-standards",
+      "line-ending-baseline"
     ]
   }
 ];
@@ -532,15 +550,26 @@ var COMPONENTS = [
   // non-dotfile path and mapped via sourceOverrides; see RegistryComponent.
   {
     name: "docs-baseline",
-    description: "Line-ending and binary-format baseline for document repositories (.gitattributes/.gitignore)",
-    files: [".gitattributes", ".gitignore"],
+    description: "Ignore baseline for document repositories (.gitignore)",
+    files: [".gitignore"],
     sourceOverrides: {
-      ".gitattributes": "docs-baseline/gitattributes",
       ".gitignore": "docs-baseline/gitignore"
     },
     skipExisting: true,
     initOnly: true
   },
+  // Split out of docs-baseline so every profile ships it (#281, PRD D-09);
+  // same asset source. See COMPONENT_FILE_MOVES for manifests written before.
+  {
+    name: "line-ending-baseline",
+    description: "Line-ending and binary-format baseline (.gitattributes): text normalizes to LF, binary formats are never rewritten",
+    files: [".gitattributes"],
+    sourceOverrides: {
+      ".gitattributes": "docs-baseline/gitattributes"
+    },
+    skipExisting: true,
+    initOnly: true
+  },
   // Optional MCP config scaffold (BC-22/I12). skipExisting: a repo's own
   // .mcp.json is user-owned server config Arcane must never overwrite.
   // Not initOnly -- useful to retrofit via `spell add` on an existing repo too.
@@ -768,6 +797,14 @@ var COMPONENTS = [
       ".github/prompts/spell-compliance.prompt.md",
       ".claude/commands/spell-compliance.md",
       ".agents/skills/spell-compliance/SKILL.md"
+    ],
+    // spell-make-discoverable cites the first two for every EV-/WD- rationale;
+    // spell-eas-store-deploy and spell-compliance consume the last two.
+    requires: [
+      "external-verification-standards",
+      "web-discoverability-standards",
+      "mobile-release-standards",
+      "compliance-standards"
     ]
   },
   {
@@ -872,6 +909,41 @@ var LEGACY_COMPONENT_MIGRATIONS = Object.assign(/* @__PURE__ */ Object.create(nu
   "spell-prompts": LEGACY_MONOLITH_REPLACEMENTS,
   "claude-commands": LEGACY_MONOLITH_REPLACEMENTS
 });
+var REGISTRY_RETIREMENTS = [
+  {
+    name: "spell-bootstrap-business",
+    kind: "spell",
+    successors: ["spell-summon-venture"],
+    reason: "renamed in 0.16.0 with no alias (ARC-008 precedent) \u2014 it became a hub-gated venture creator with per-venture books and a registry entry"
+  },
+  {
+    name: "spell-assess",
+    kind: "spell",
+    successors: ["spell-scope"],
+    reason: "renamed to name its outcome, epic scoping and sequencing (ARC-007); no alias (ARC-008)"
+  },
+  {
+    name: "agent-files",
+    kind: "component",
+    successors: [],
+    reason: "`.github/agents/*.agent.md` files are rendered per roster by `spell agents init` / `spell agents sync` (ARC-047), which a fixed-path component cannot do"
+  },
+  {
+    name: "spell-prompts",
+    kind: "component",
+    successors: LEGACY_MONOLITH_REPLACEMENTS,
+    reason: "split in 0.18.0 into capability-scoped spells-* components; `spell update` migrates the entry itself"
+  },
+  {
+    name: "claude-commands",
+    kind: "component",
+    successors: LEGACY_MONOLITH_REPLACEMENTS,
+    reason: "split in 0.18.0 into capability-scoped spells-* components; `spell update` migrates the entry itself"
+  }
+];
+var COMPONENT_FILE_MOVES = [
+  { from: "docs-baseline", to: "line-ending-baseline", files: [".gitattributes"] }
+];
 function getComponent(name) {
   const component = componentIndex.get(name);
   if (!component) {
@@ -2646,10 +2718,10 @@ async function runAgentsList(targetDir, scope = "repo") {
   console.log();
 }
 
-// src/modules/push-safety.ts
-import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile7, chmod, access as access3, rm as rm4, readdir as readdir5 } from "fs/promises";
-import { constants } from "fs";
-import { join as join5, resolve as resolve2, dirname as dirname3, basename } from "path";
+// src/modules/hub.ts
+import { confirm, select as select2, input as input2 } from "@inquirer/prompts";
+import { readdir as readdir5, writeFile as writeFile7 } from "fs/promises";
+import { join as join5 } from "path";
 
 // src/modules/git.ts
 import { execFile } from "child_process";
@@ -2869,7 +2941,371 @@ async function ensureLocalPullRebase(cwd) {
   }
 }
 
+// src/modules/ado-context.ts
+function remoteUrlHost(url) {
+  const trimmed = url.trim();
+  if (trimmed.includes("://")) {
+    try {
+      return new URL(trimmed).hostname.toLowerCase() || void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  const scp = /^(?:[^@/\s]+@)?([^:/\s]+):/.exec(trimmed);
+  if (!scp || /^[a-zA-Z]$/.test(scp[1])) return void 0;
+  return scp[1].toLowerCase();
+}
+function isAdoRemoteUrl(url) {
+  const host = remoteUrlHost(url);
+  if (host === void 0) return false;
+  return host === "dev.azure.com" || host.endsWith(".dev.azure.com") || host.endsWith(".visualstudio.com");
+}
+async function detectAdoContext(targetDir) {
+  let stdout;
+  try {
+    ({ stdout } = await runGit(targetDir, ["config", "--get-regexp", "^remote\\..*\\.url$"]));
+  } catch {
+    return false;
+  }
+  return stdout.split("\n").map((line) => line.slice(line.indexOf(" ") + 1)).some((url) => url.trim() !== "" && isAdoRemoteUrl(url));
+}
+
+// src/modules/hub.ts
+async function askTrackingQuestions(targetDir) {
+  const ado = targetDir !== void 0 && await detectAdoContext(targetDir);
+  const tracking_mode = await select2({
+    message: "How will work be tracked in this repo?",
+    choices: [
+      {
+        value: "internal",
+        name: "Track work in this repo (TODO.md / PRDs)",
+        description: "Spells keep TODOs, PRDs and stories in this repository's own files."
+      },
+      {
+        value: "external",
+        name: "Track work in an external tracker (Azure DevOps / GitHub / Jira / other)",
+        description: "Spells tie PRDs, commits and PRs to items in the tracker you pick next."
+      }
+    ],
+    ...ado ? { default: "external" } : {}
+  });
+  if (tracking_mode !== "external") return { tracking_mode, external_provider: null };
+  const external_provider = await select2({
+    message: "Which external tracker?",
+    choices: [
+      {
+        value: "ado",
+        name: "Azure DevOps",
+        description: "Each PRD needs an ADO work item ID; plans follow your process template's item types."
+      },
+      {
+        value: "github",
+        name: "GitHub Issues",
+        description: "Uses the gh CLI; an issue number is optional and linked from commits and PRs when known."
+      },
+      {
+        value: "jira",
+        name: "Jira",
+        description: "No Jira automation yet: spells note linking as a TODO and keep planning in this repo."
+      },
+      {
+        value: "other",
+        name: "Other",
+        description: "No automation: spells note linking as a TODO and keep planning in this repo."
+      }
+    ],
+    ...ado ? { default: "ado" } : {}
+  });
+  return { tracking_mode, external_provider };
+}
+var MANIFEST_RETROFITS = [
+  {
+    field: "role",
+    flag: "--role <hub|consumer>",
+    needsRetrofit: (m) => m.role === void 0,
+    ask: async () => {
+      const isHub = await confirm({
+        message: "Will this repo manage other ventures as a hub? (idea books, spell-manifest promotion, venture registry)",
+        default: false
+      });
+      return { role: isHub ? "hub" : "consumer" };
+    }
+  },
+  {
+    field: "tracking_mode",
+    flag: "--tracking-mode <internal|external>",
+    needsRetrofit: (m) => m.tracking_mode === void 0,
+    // Mirrors init.ts's Step 5b branching exactly (EF-14 D5): docs-only
+    // profiles get a silent default, full/lite get asked -- through the same
+    // askTrackingQuestions init uses, so the two cannot drift.
+    ask: async (manifest, targetDir) => {
+      if (manifest.profile === "governance-only" || manifest.profile === "methodology" || manifest.profile === "docs") {
+        return { tracking_mode: "internal", external_provider: null };
+      }
+      return askTrackingQuestions(targetDir);
+    }
+  },
+  {
+    field: "content_sensitivity",
+    flag: "--content-sensitivity <standard|sensitive>",
+    needsRetrofit: (m) => m.content_sensitivity === void 0,
+    // EF-12. Asked for every profile -- a code repo can hold sensitive records
+    // too -- and defaults to "standard", so an operator who just presses enter
+    // keeps today's behaviour exactly.
+    ask: async () => {
+      const content_sensitivity = await select2({
+        message: "How should agents treat this repository's contents?",
+        choices: [
+          {
+            value: "standard",
+            name: "Standard \u2014 agents may quote contents in journals and decisions"
+          },
+          {
+            value: "sensitive",
+            name: "Sensitive \u2014 agents reference documents by path, never transcribe them"
+          }
+        ],
+        default: "standard"
+      });
+      return { content_sensitivity };
+    }
+  },
+  {
+    field: "subject_root",
+    flag: "--subject-root <path>",
+    // EF-07. Only the docs profile is asked: other profiles describe code or a
+    // venture portfolio, where "what is this repo about" is already answered.
+    // A docs install that legitimately holds several subjects answers
+    // "portfolio" and stays unset -- so this retrofit deliberately does NOT
+    // re-ask on every update. It is gated on the field being absent AND the
+    // profile being docs, and once answered (either way) it never fires again,
+    // because "portfolio" writes an explicit empty marker.
+    needsRetrofit: (m) => m.profile === "docs" && m.subject_root === void 0,
+    ask: async () => {
+      const shape = await select2({
+        message: "What does this repository hold?",
+        choices: [
+          {
+            value: "root",
+            name: "One subject, at the repository root (documents sit alongside Arcane's files)"
+          },
+          { value: "subdir", name: "One subject, in its own directory" },
+          { value: "portfolio", name: "Several subjects or ventures" }
+        ]
+      });
+      if (shape === "root") return { subject_root: "." };
+      if (shape === "subdir") {
+        const answer = await input2({
+          message: "Directory holding the subject's documents:",
+          default: "docs",
+          validate: (v) => isValidSubjectRoot(v.trim() || "docs") || "Must be a relative path inside the repository (no leading /, drive letter, or ..)."
+        });
+        return { subject_root: answer.trim() || "docs" };
+      }
+      return { subject_root: null };
+    }
+  },
+  {
+    field: "push_policy",
+    flag: "--push-policy <open|guarded|blocked>",
+    needsRetrofit: (m) => m.push_policy === void 0,
+    // EF-09. Defaults to "open", so an operator who just presses enter keeps
+    // today's behaviour exactly. NOTE: this only records the choice -- unlike
+    // init, the retrofit does not install the hook or disable the push URL,
+    // because an update should not silently start blocking pushes in a repo
+    // someone is mid-workflow in (ARC-034 decision 7). ARC-049 decision 2:
+    // update prints pushPolicyNotice() instead, naming `spell block-push`.
+    ask: async () => {
+      const push_policy = await select2({
+        message: "Should this repository be allowed to push to a remote?",
+        choices: [
+          { value: "open", name: "Yes \u2014 normal repository" },
+          { value: "guarded", name: "Sensitive, but keep push working \u2014 remind me instead" },
+          { value: "blocked", name: "No \u2014 block pushes" }
+        ],
+        default: "open"
+      });
+      return { push_policy };
+    }
+  }
+];
+function pushPolicyNotice(policy) {
+  if (policy === "blocked") {
+    return [
+      "",
+      '  ! Required action: push_policy is now recorded as "blocked", but it is NOT enforced yet.',
+      "    `spell update` never installs push controls. Pushes from this repository still work",
+      "    until you run:",
+      "",
+      "      spell block-push",
+      ""
+    ];
+  }
+  if (policy === "guarded") {
+    return [
+      "",
+      '  push_policy is now recorded as "guarded". Nothing is installed for it: `spell doctor`',
+      "  reports it, and push-performing spells state the policy and ask before pushing.",
+      ""
+    ];
+  }
+  return [];
+}
+async function runManifestRetrofits(manifest, targetDir) {
+  const applicable = MANIFEST_RETROFITS.filter((r) => r.needsRetrofit(manifest));
+  if (applicable.length === 0) return {};
+  console.log();
+  console.log(
+    `This install predates ${applicable.length} manifest field${applicable.length === 1 ? "" : "s"} -- a couple of quick questions:`
+  );
+  let patch = {};
+  for (const retrofit of applicable) {
+    const answer = await retrofit.ask({ ...manifest, ...patch }, targetDir);
+    patch = { ...patch, ...answer };
+  }
+  return patch;
+}
+function manifestFlagLine(manifest) {
+  const pending = MANIFEST_RETROFITS.filter((r) => r.needsRetrofit(manifest));
+  if (pending.length === 0) return void 0;
+  const lines = [`spell update ${pending.map((r) => r.flag).join(" ")}`];
+  if (pending.some((r) => r.field === "tracking_mode")) {
+    lines.push("(--tracking-mode external also needs --external-provider <ado|github|jira|other>)");
+  }
+  return lines;
+}
+var ManifestFlagError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ManifestFlagError";
+  }
+};
+var FLAG_NAMES = {
+  role: "--role",
+  tracking_mode: "--tracking-mode",
+  external_provider: "--external-provider",
+  content_sensitivity: "--content-sensitivity",
+  subject_root: "--subject-root",
+  push_policy: "--push-policy"
+};
+var PUSH_POLICY_STRICTNESS = { open: 0, guarded: 1, blocked: 2 };
+function hasManifestFlags(flags) {
+  return flags !== void 0 && Object.values(flags).some((v) => v !== void 0);
+}
+function resolveManifestFlags(flags, current, manifestPath2) {
+  if (!hasManifestFlags(flags)) return {};
+  const requested = {};
+  if (flags.role !== void 0) requested.role = flags.role;
+  if (flags.trackingMode !== void 0) requested.tracking_mode = flags.trackingMode;
+  if (flags.externalProvider !== void 0) requested.external_provider = flags.externalProvider;
+  if (flags.contentSensitivity !== void 0) requested.content_sensitivity = flags.contentSensitivity;
+  if (flags.subjectRoot !== void 0) requested.subject_root = flags.subjectRoot;
+  if (flags.pushPolicy !== void 0) requested.push_policy = flags.pushPolicy;
+  const invalid = (error) => {
+    const allowed = error.field === "role" ? ["hub", "consumer"] : MANIFEST_ENUM_VALUES[error.field];
+    const hint = allowed ? ` Valid values: ${allowed.join(", ")}.` : "";
+    return new ManifestFlagError(`Invalid ${FLAG_NAMES[error.field] ?? error.field}: ${error.message}${hint}`);
+  };
+  if (requested.role !== void 0 && requested.role !== "hub" && requested.role !== "consumer") {
+    throw invalid(new ManifestInvalidFieldError(manifestPath2, "role", requested.role));
+  }
+  try {
+    validateManifestFields(requested, manifestPath2);
+  } catch (error) {
+    if (error instanceof ManifestInvalidFieldError) throw invalid(error);
+    throw error;
+  }
+  if (requested.external_provider !== void 0 && requested.tracking_mode !== "external") {
+    throw new ManifestFlagError("--external-provider applies only together with --tracking-mode external.");
+  }
+  if (requested.tracking_mode === "external" && requested.external_provider === void 0) {
+    throw new ManifestFlagError(
+      "--tracking-mode external needs --external-provider <ado|github|jira|other> as well."
+    );
+  }
+  if (requested.tracking_mode === "internal") requested.external_provider = null;
+  const patch = {};
+  for (const field of Object.keys(FLAG_NAMES)) {
+    if (!(field in requested)) continue;
+    const value = requested[field];
+    const recorded = current[field];
+    if (recorded === void 0) {
+      patch[field] = value;
+      continue;
+    }
+    if (field === "push_policy") {
+      const from = PUSH_POLICY_STRICTNESS[recorded];
+      const to = PUSH_POLICY_STRICTNESS[value];
+      if (to < from) {
+        throw new ManifestFlagError(
+          `--push-policy ${String(value)} would loosen this repository's recorded push_policy "${String(recorded)}". No flag can loosen it: run \`spell unblock-push\` from an interactive terminal.`
+        );
+      }
+      if (to > from) patch[field] = value;
+      continue;
+    }
+    if (recorded === value) continue;
+    const flag = field === "external_provider" && flags.externalProvider === void 0 ? "--tracking-mode" : FLAG_NAMES[field];
+    throw new ManifestFlagError(
+      `${flag} conflicts with the recorded ${field}: ${JSON.stringify(recorded)}. A flag only answers a question that has no recorded answer; change .arcane.json deliberately if the recorded value is wrong.`
+    );
+  }
+  return patch;
+}
+function describeFlagPatch(patch) {
+  return Object.entries(patch).filter(([field]) => field in FLAG_NAMES).map(([field, value]) => `${field}: ${JSON.stringify(value)}`);
+}
+async function offerRegistryScaffold(targetDir, businessRoot) {
+  const registryPath = join5(targetDir, businessRoot, "registry.json");
+  if (await fileExists(registryPath)) return;
+  const businessRootPath = join5(targetDir, businessRoot);
+  let ventureDirs;
+  try {
+    const entries = await readdir5(businessRootPath, { withFileTypes: true });
+    ventureDirs = entries.filter((e) => e.isDirectory() && e.name !== "_template").map((e) => e.name);
+  } catch {
+    return;
+  }
+  if (ventureDirs.length === 0) return;
+  console.log();
+  const scaffold = await confirm({
+    message: `Found ${ventureDirs.length} folder${ventureDirs.length === 1 ? "" : "s"} under ${businessRoot}/ -- scaffold ${businessRoot}/registry.json from them?`,
+    default: true
+  });
+  if (!scaffold) return;
+  const ventures = {};
+  for (const slug of ventureDirs) {
+    const include = await confirm({ message: `  Include "${slug}"?`, default: true });
+    if (!include) continue;
+    ventures[slug] = {
+      name: slug,
+      aliases: [],
+      status: "active",
+      visibility: "private",
+      ownership: "llc",
+      tracking: "none",
+      repos: []
+    };
+  }
+  if (Object.keys(ventures).length === 0) {
+    console.log("  No ventures selected -- registry not created.");
+    return;
+  }
+  const registry = {
+    _comment: "Hub-owned venture registry. Private. Never installed or modified by spell update. Seeded by the retrofit wizard -- review and enrich (aliases, ownership, tracking, clones) before relying on it.",
+    updated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+    ventures
+  };
+  await writeFile7(registryPath, JSON.stringify(registry, null, 2) + "\n", "utf-8");
+  console.log(
+    `  \u2713 Scaffolded ${businessRoot}/registry.json with ${Object.keys(ventures).length} venture(s).`
+  );
+}
+
 // src/modules/push-safety.ts
+import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile8, chmod, access as access3, rm as rm4, readdir as readdir6 } from "fs/promises";
+import { constants } from "fs";
+import { join as join6, resolve as resolve2, dirname as dirname3, basename } from "path";
 var DISABLED_PUSH_URL = "arcane-push-blocked-run-spell-unblock-push://this-repository";
 var NO_PUSH_URL_MARKER = (remote) => `remote.${remote}.arcaneHadNoPushUrl`;
 var ARCANE_HOOKS_DIR = ".arcane/hooks";
@@ -2960,10 +3396,10 @@ async function repositoryRoot(cwd) {
   return cwd;
 }
 async function hookFilePath(cwd, hookName = "pre-push") {
-  return join5(await repositoryRoot(cwd), ARCANE_HOOKS_DIR, hookName);
+  return join6(await repositoryRoot(cwd), ARCANE_HOOKS_DIR, hookName);
 }
 async function hooksPathValue(cwd) {
-  return join5(await repositoryRoot(cwd), ARCANE_HOOKS_DIR).replace(/\\/g, "/");
+  return join6(await repositoryRoot(cwd), ARCANE_HOOKS_DIR).replace(/\\/g, "/");
 }
 async function installHook(cwd, hookName, body) {
   const root = await repositoryRoot(cwd);
@@ -2982,12 +3418,12 @@ async function installHook(cwd, hookName, body) {
       return { status: "refused-default-hooks", hooks: displaced };
     }
   }
-  const hookPath = join5(root, ARCANE_HOOKS_DIR, hookName);
+  const hookPath = join6(root, ARCANE_HOOKS_DIR, hookName);
   if (existing !== void 0 && await hookFileMatches(cwd, hookName, body)) {
     return { status: "already-ours" };
   }
-  await mkdir5(join5(root, ARCANE_HOOKS_DIR), { recursive: true });
-  await writeFile7(hookPath, body, "utf-8");
+  await mkdir5(join6(root, ARCANE_HOOKS_DIR), { recursive: true });
+  await writeFile8(hookPath, body, "utf-8");
   await chmod(hookPath, 493);
   await runGit(cwd, ["config", "--local", "core.hooksPath", await hooksPathValue(cwd)]);
   return { status: "installed", path: hookPath };
@@ -3031,12 +3467,12 @@ async function defaultHooks(cwd) {
   let hooksDir;
   try {
     const { stdout } = await runGit(cwd, ["rev-parse", "--git-common-dir"]);
-    hooksDir = join5(resolve2(cwd, stdout.trim()), "hooks");
+    hooksDir = join6(resolve2(cwd, stdout.trim()), "hooks");
   } catch {
     return [];
   }
   try {
-    return (await readdir5(hooksDir)).filter((name) => !name.endsWith(".sample")).sort();
+    return (await readdir6(hooksDir)).filter((name) => !name.endsWith(".sample")).sort();
   } catch {
     return [];
   }
@@ -3067,10 +3503,10 @@ async function removeHook(cwd, hookName) {
     await rm4(await hookFilePath(cwd, hookName), { force: true });
   } catch {
   }
-  const hooksDir = join5(root, ARCANE_HOOKS_DIR);
+  const hooksDir = join6(root, ARCANE_HOOKS_DIR);
   let remaining = [];
   try {
-    remaining = await readdir5(hooksDir);
+    remaining = await readdir6(hooksDir);
   } catch {
     remaining = [];
   }
@@ -3290,10 +3726,64 @@ function describeError(error) {
   const message = error instanceof Error ? error.message : String(error);
   return message.split("\n")[0].trim();
 }
-
-// src/modules/secrets-scan.ts
-var SECRETS_RULES = [
-  { label: "api-key", pattern: /API[_-]KEY\s*[:=]\s*\S+/i },
+function hookInForce(outcome) {
+  return outcome.status === "installed" || outcome.status === "already-ours";
+}
+async function applyBlockedPushControls(cwd, options = {}) {
+  const messages = [];
+  const say = (level, text) => {
+    const message = { level, text };
+    messages.push(message);
+    options.emit?.(message);
+  };
+  const hook = await installPrePushHook(cwd);
+  if (hook.status === "refused-unreadable-config") {
+    say(
+      "warning",
+      "Did not install the pre-push hook: git could not report the current core.hooksPath (unreadable config, or a git too old for `--show-scope`). Installing without knowing whether another hook manager owns that setting could silently disable it. Fix the config and run `spell doctor`."
+    );
+  } else if (hook.status === "refused-default-hooks") {
+    say(
+      "warning",
+      `Did not install the pre-push hook: this repository has hooks in git's default directory (${hook.hooks.join(", ")}). Setting core.hooksPath would silently stop them running. Move them under \`${ARCANE_HOOKS_DIR}\` yourself and re-run, or add the push guard to your existing pre-push hook.`
+    );
+  } else if (hook.status === "refused-foreign-hooks-path") {
+    say(
+      "warning",
+      `Did not install the pre-push hook: core.hooksPath is already "${hook.existing}" (${describeConfigScope(hook.scope)}), so another hook manager owns it. Overwriting would silently disable those hooks. Chain an Arcane pre-push guard into that directory yourself, or unset core.hooksPath first.`
+    );
+  } else {
+    say("info", "Installed a pre-push hook that blocks pushes from this repository.");
+  }
+  if (options.stopOnHookRefusal === true && !hookInForce(hook)) {
+    return { hook, urls: [], stoppedAtHook: true, messages };
+  }
+  const urls = await disablePushUrls(cwd);
+  const unprotected = urls.filter((u) => u.status === "failed");
+  if (unprotected.length > 0) {
+    say(
+      "warning",
+      `Could not disable the push URL for: ${unprotected.map((u) => `${u.remote} (${u.reason ?? "unknown error"})`).join("; ")}. Those remotes are still pushable with \`--no-verify\`. Run \`spell doctor\` \u2014 it lists exactly which remotes are still live.`
+    );
+  }
+  if (urls.length === 0) {
+    say(
+      "warning",
+      "No remote is configured, so only the pre-push hook is active. A remote added later will NOT have its push URL disabled automatically, and a `--no-verify` push to it would succeed. Run `spell doctor` after adding one \u2014 it reports this gap."
+    );
+  } else {
+    const covered = urls.filter((u) => u.status !== "failed").map((u) => u.remote);
+    if (covered.length > 0) {
+      say("info", `Disabled the push URL for: ${covered.join(", ")} (fetch still works).`);
+    }
+  }
+  say("info", "Run `spell unblock-push` from a terminal to undo this.");
+  return { hook, urls, stoppedAtHook: false, messages };
+}
+
+// src/modules/secrets-scan.ts
+var SECRETS_RULES = [
+  { label: "api-key", pattern: /API[_-]KEY\s*[:=]\s*\S+/i },
   // Case-sensitive and requiring an all-caps/underscore identifier (SECRET,
   // MY_SECRET, API_SECRET_KEY...) -- the real config/env-var convention for a
   // credential-holding key. Widening this repository-wide (ARC-037 decision 3)
@@ -3399,6 +3889,13 @@ function buildProfileDescription(components, profile) {
 }
 async function runInit(options, targetDir, assetsDir, packageVersion) {
   if (options.user) {
+    if (hasManifestFlags(options.manifestFlags)) {
+      console.error(
+        "\n  \u2717 The manifest-question flags describe a repository; the user tier has none of those fields.\n"
+      );
+      process.exit(1);
+      return;
+    }
     await runInitUser(options, targetDir, assetsDir, packageVersion);
     return;
   }
@@ -3407,12 +3904,26 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
       `Invalid profile "${options.profile}". Valid options: ${VALID_PROFILES.join(", ")}`
     );
   }
+  let flags = {};
+  try {
+    flags = resolveManifestFlags(options.manifestFlags, {}, join7(targetDir, ".arcane.json"));
+  } catch (err) {
+    if (!(err instanceof ManifestFlagError)) throw err;
+    console.error(`
+  \u2717 ${err.message}
+`);
+    process.exit(1);
+    return;
+  }
   try {
     await readManifest(targetDir);
     console.log(chalk2.hex("#a855f7")(`
   \u2726 Arcane v${packageVersion}
 `));
     console.log('Already initialized. Run "spell update" to update existing files.');
+    if (hasManifestFlags(options.manifestFlags)) {
+      console.log("Pass the same manifest-question flags to `spell update` to record them here.");
+    }
     return;
   } catch (err) {
     if (!(err instanceof ManifestNotFoundError)) throw err;
@@ -3421,8 +3932,10 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
   \u2726 Arcane v${packageVersion}
 `));
   let repoNotFound = false;
+  let repoHasCommits = false;
   if (!options.dryRun) {
     const gitState = await inspectGitRepository(targetDir);
+    repoHasCommits = gitState.status !== "not-repository" && gitState.status !== "no-commits";
     if (gitState.status === "not-repository") {
       repoNotFound = true;
     } else {
@@ -3444,7 +3957,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
         );
         printInfo("Running spell init will add new files to your working tree.");
         console.log();
-        const continueAnyway = await confirm({
+        const continueAnyway = await confirm2({
           message: "Continue anyway?",
           default: true
         });
@@ -3465,7 +3978,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
   let profile = options.profile;
   if (!profile) {
     const profiles = listProfiles();
-    profile = await select2({
+    profile = await select3({
       message: "Select an installation profile:\n",
       choices: profiles.map((p) => {
         const profileComponents2 = getProfile(p.id);
@@ -3490,7 +4003,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
     }
     if (storeVersion !== void 0) {
       console.log();
-      const useTier = await confirm({
+      const useTier = await confirm2({
         message: `This machine has an Arcane user tier (v${storeVersion}). Use it for this repository's spells instead of installing copies here?`,
         default: preferred === "user"
       });
@@ -3513,7 +4026,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
   console.log(`  ${previewParts.join(" \xB7 ")}`);
   console.log();
   if (!options.dryRun && !options.profile) {
-    const proceed = await confirm({
+    const proceed = await confirm2({
       message: "Proceed with installation?",
       default: true
     });
@@ -3528,7 +4041,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
     const installedFiles = [];
     const fileHashes = {};
     for (const file of component.files) {
-      const srcPath = join6(assetsDir, component.sourceOverrides?.[file] ?? file);
+      const srcPath = join7(assetsDir, component.sourceOverrides?.[file] ?? file);
       if (options.dryRun) {
         printDryRun(`Would copy: ${file}`);
       } else {
@@ -3545,7 +4058,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
       fileCount++;
     }
     for (const dir of component.directories ?? []) {
-      const srcDirPath = join6(assetsDir, dir);
+      const srcDirPath = join7(assetsDir, dir);
       if (options.dryRun) {
         printDryRun(`Would copy directory: ${dir}/`);
       } else {
@@ -3574,7 +4087,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
   if (options.dryRun) {
     if (hasAgents) {
       const agentFiles = await import("fs").then(
-        (fsModule) => fsModule.promises.readdir(join6(assetsDir, "agents"))
+        (fsModule) => fsModule.promises.readdir(join7(assetsDir, "agents"))
       );
       const yamlFiles = agentFiles.filter((f) => f.endsWith(".yaml")).sort();
       printDryRun("Would run agent setup (interactive):");
@@ -3586,10 +4099,10 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
     printDryRun(`Would initialize with profile "${profile}" \u2014 ${fileCount} files`);
     return;
   }
-  let role;
-  if (!options.profile) {
+  let role = flags.role;
+  if (role === void 0 && !options.profile) {
     console.log();
-    const isHub = await confirm({
+    const isHub = await confirm2({
       message: "Will this repo manage other ventures as a hub? (idea books, spell-manifest promotion, venture registry)",
       default: false
     });
@@ -3597,36 +4110,20 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
   }
   let tracking_mode;
   let external_provider;
-  if (profile === "governance-only" || profile === "methodology" || profile === "docs") {
+  if (flags.tracking_mode !== void 0) {
+    tracking_mode = flags.tracking_mode;
+    external_provider = flags.external_provider ?? null;
+  } else if (profile === "governance-only" || profile === "methodology" || profile === "docs") {
     tracking_mode = "internal";
     external_provider = null;
   } else if (!options.profile) {
     console.log();
-    tracking_mode = await select2({
-      message: "How will work be tracked in this repo?",
-      choices: [
-        { value: "internal", name: "Track work in this repo (TODO.md / PRDs)" },
-        { value: "external", name: "Track work in an external tracker (Azure DevOps / GitHub / Jira / other)" }
-      ]
-    });
-    if (tracking_mode === "external") {
-      external_provider = await select2({
-        message: "Which external tracker?",
-        choices: [
-          { value: "ado", name: "Azure DevOps" },
-          { value: "github", name: "GitHub Issues" },
-          { value: "jira", name: "Jira" },
-          { value: "other", name: "Other" }
-        ]
-      });
-    } else {
-      external_provider = null;
-    }
+    ({ tracking_mode, external_provider } = await askTrackingQuestions(targetDir));
   }
-  let subject_root;
-  if (profile === "docs" && !options.profile) {
+  let subject_root = flags.subject_root;
+  if (subject_root === void 0 && profile === "docs" && !options.profile) {
     console.log();
-    const shape = await select2({
+    const shape = await select3({
       message: "What does this repository hold?",
       choices: [
         {
@@ -3640,7 +4137,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
     if (shape === "root") {
       subject_root = ".";
     } else if (shape === "subdir") {
-      const answer = await input2({
+      const answer = await input3({
         message: "Directory holding the subject's documents:",
         default: "docs",
         validate: (v) => isValidSubjectRoot(v.trim() || "docs") || "Must be a relative path inside the repository (no leading /, drive letter, or ..)."
@@ -3650,10 +4147,10 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
       subject_root = null;
     }
   }
-  let content_sensitivity;
-  if (!options.profile) {
+  let content_sensitivity = flags.content_sensitivity;
+  if (content_sensitivity === void 0 && !options.profile) {
     console.log();
-    content_sensitivity = await select2({
+    content_sensitivity = await select3({
       message: "How should agents treat this repository's contents?",
       choices: [
         { value: "standard", name: "Standard \u2014 agents may quote contents in journals and decisions" },
@@ -3665,10 +4162,10 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
       default: "standard"
     });
   }
-  let push_policy;
-  if (!options.profile) {
+  let push_policy = flags.push_policy;
+  if (push_policy === void 0 && !options.profile) {
     console.log();
-    push_policy = await select2({
+    push_policy = await select3({
       message: "Should this repository be allowed to push to a remote?",
       choices: [
         { value: "open", name: "Yes \u2014 normal repository" },
@@ -3695,43 +4192,23 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
   };
   await writeManifest(targetDir, manifest);
   printSuccess(`Initialized with profile "${profile}" \u2014 ${fileCount} files installed`);
+  const flagLine = options.profile ? manifestFlagLine(manifest) : void 0;
+  if (flagLine) {
+    printInfo("Some setup questions were left unanswered. Answer them without a prompt with:");
+    for (const line of flagLine) printInfo(`  ${line}`);
+  }
   if (push_policy === "blocked" || push_policy === "guarded") {
     try {
       if (push_policy === "blocked") {
-        const hook = await installPrePushHook(targetDir);
-        if (hook.status === "refused-unreadable-config") {
-          printWarning(
-            "Did not install the pre-push hook: git could not report the current core.hooksPath (unreadable config, or a git too old for `--show-scope`). Installing without knowing whether another hook manager owns that setting could silently disable it. Fix the config and run `spell doctor`."
-          );
-        } else if (hook.status === "refused-default-hooks") {
-          printWarning(
-            `Did not install the pre-push hook: this repository has hooks in git's default directory (${hook.hooks.join(", ")}). Setting core.hooksPath would silently stop them running. Move them under \`${ARCANE_HOOKS_DIR}\` yourself and re-run, or add the push guard to your existing pre-push hook.`
-          );
-        } else if (hook.status === "refused-foreign-hooks-path") {
-          printWarning(
-            `Did not install the pre-push hook: core.hooksPath is already "${hook.existing}" (${describeConfigScope(hook.scope)}), so another hook manager owns it. Overwriting would silently disable those hooks. Chain an Arcane pre-push guard into that directory yourself, or unset core.hooksPath first.`
-          );
-        } else {
-          printInfo("Installed a pre-push hook that blocks pushes from this repository.");
-        }
-        const urls = await disablePushUrls(targetDir);
-        const unprotected = urls.filter((u) => u.status === "failed");
-        if (unprotected.length > 0) {
+        const controls = await applyBlockedPushControls(targetDir, {
+          emit: (m) => m.level === "warning" ? printWarning(m.text) : printInfo(m.text)
+        });
+        if (!hookInForce(controls.hook) || controls.urls.some((u) => u.status === "failed")) {
           printWarning(
-            `Could not disable the push URL for: ${unprotected.map((u) => `${u.remote} (${u.reason ?? "unknown error"})`).join("; ")}. Those remotes are still pushable with \`--no-verify\`. Run \`spell doctor\` \u2014 it lists exactly which remotes are still live.`
+            'push_policy is recorded as "blocked", but the block is not fully in force. Resolve the cause above, then run `spell block-push`; `spell doctor` shows exactly what is missing.'
           );
+          process.exitCode = 1;
         }
-        if (urls.length === 0) {
-          printWarning(
-            "No remote is configured, so only the pre-push hook is active. A remote added later will NOT have its push URL disabled automatically, and a `--no-verify` push to it would succeed. Run `spell doctor` after adding one \u2014 it reports this gap."
-          );
-        } else {
-          const covered = urls.filter((u) => u.status !== "failed").map((u) => u.remote);
-          if (covered.length > 0) {
-            printInfo(`Disabled the push URL for: ${covered.join(", ")} (fetch still works).`);
-          }
-        }
-        printInfo("Run `spell unblock-push` from a terminal to undo this.");
       } else {
         printInfo(
           "Marked as push-guarded. No technical control was installed \u2014 check the remote is the one you intend before pushing. `spell doctor` will keep reminding you."
@@ -3777,7 +4254,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
   let agentsConfigured = false;
   if (hasAgents && !options.profile) {
     console.log();
-    const setupAgents = await confirm({
+    const setupAgents = await confirm2({
       message: "\u{1F916} Set up your agent team? (names, roles, AI tool configs)",
       default: true
     });
@@ -3811,9 +4288,15 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
       'Initialize Git for this project: `git init -b main` (avoids defaulting to "master" on systems where that\'s the system default)'
     );
   }
+  const wroteGitattributes = installedComponents.some((c) => c.files.includes(".gitattributes"));
+  if (wroteGitattributes && repoHasCommits) {
+    printWarning(
+      "Installed .gitattributes, which normalizes text to LF. In a repository with history, files committed with CRLF can show as modified once Git renormalizes them (for example after `git add --renormalize .`). Review and commit that as its own change."
+    );
+  }
   printNextStep(
     step++,
-    "Commit the new files: git add .arcane .github .claude AGENTS.md CLAUDE.md .arcane.json"
+    `Commit the new files: git add .arcane .github .claude AGENTS.md CLAUDE.md .arcane.json${wroteGitattributes ? " .gitattributes" : ""}`
   );
   console.log();
 }
@@ -3823,6 +4306,11 @@ async function runInitUser(options, storeRoot, assetsDir, packageVersion) {
       '"--profile" does not apply to "--user": the user tier always installs every spell and nothing else.'
     );
   }
+  if (hasManifestFlags(options.manifestFlags)) {
+    throw new Error(
+      'The manifest-question flags do not apply to "--user": they describe a repository, and the user tier is not one.'
+    );
+  }
   try {
     await readManifest(storeRoot);
     console.log(chalk2.hex("#a855f7")(`
@@ -3856,7 +4344,7 @@ async function runInitUser(options, storeRoot, assetsDir, packageVersion) {
     for (const id of spellIds) {
       for (const client of ["codex", "claude"]) {
         const relativePath = USER_FANOUT_PATHS[client](id);
-        if (await fileExists(join6(homeDir, relativePath))) {
+        if (await fileExists(join7(homeDir, relativePath))) {
           printDryRun(`Would leave alone (exists, not written by Arcane): ~/${relativePath}`);
         } else {
           printDryRun(`Would write: ~/${relativePath}`);
@@ -3874,7 +4362,7 @@ async function runInitUser(options, storeRoot, assetsDir, packageVersion) {
     const installedFiles = [];
     const fileHashes = {};
     for (const file of component.files) {
-      const srcPath = join6(assetsDir, component.sourceOverrides?.[file] ?? file);
+      const srcPath = join7(assetsDir, component.sourceOverrides?.[file] ?? file);
       fileHashes[file] = await copyFile(srcPath, storeRoot, file, { force: options.force });
       installedFiles.push(file);
       fileCount++;
@@ -3920,7 +4408,7 @@ async function runInitUser(options, storeRoot, assetsDir, packageVersion) {
 }
 
 // src/commands/add.ts
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 async function runAdd(name, options, targetDir, assetsDir, packageVersion) {
   let manifest;
   try {
@@ -3956,7 +4444,7 @@ async function runAdd(name, options, targetDir, assetsDir, packageVersion) {
   const installedFiles = [];
   const fileHashes = {};
   for (const file of component.files) {
-    const srcPath = join7(assetsDir, component.sourceOverrides?.[file] ?? file);
+    const srcPath = join8(assetsDir, component.sourceOverrides?.[file] ?? file);
     if (options.dryRun) {
       console.log(`  [dry-run] Would copy: ${file}`);
     } else {
@@ -3966,7 +4454,7 @@ async function runAdd(name, options, targetDir, assetsDir, packageVersion) {
     fileCount++;
   }
   for (const dir of component.directories ?? []) {
-    const srcDirPath = join7(assetsDir, dir);
+    const srcDirPath = join8(assetsDir, dir);
     if (options.dryRun) {
       console.log(`  [dry-run] Would copy directory: ${dir}/`);
     } else {
@@ -4000,197 +4488,9 @@ async function runAdd(name, options, targetDir, assetsDir, packageVersion) {
 }
 
 // src/commands/update.ts
-import { dirname as dirname5, join as join9 } from "path";
+import { dirname as dirname5, join as join10 } from "path";
 import { readFile as readFile7, writeFile as writeFile9 } from "fs/promises";
 
-// src/modules/hub.ts
-import { confirm as confirm2, select as select3, input as input3 } from "@inquirer/prompts";
-import { readdir as readdir6, writeFile as writeFile8 } from "fs/promises";
-import { join as join8 } from "path";
-var MANIFEST_RETROFITS = [
-  {
-    field: "role",
-    needsRetrofit: (m) => m.role === void 0,
-    ask: async () => {
-      const isHub = await confirm2({
-        message: "Will this repo manage other ventures as a hub? (idea books, spell-manifest promotion, venture registry)",
-        default: false
-      });
-      return { role: isHub ? "hub" : "consumer" };
-    }
-  },
-  {
-    field: "tracking_mode",
-    needsRetrofit: (m) => m.tracking_mode === void 0,
-    // Mirrors init.ts's Step 5b branching exactly (EF-14 D5): docs-only
-    // profiles get a silent default, full/lite get asked.
-    ask: async (manifest) => {
-      if (manifest.profile === "governance-only" || manifest.profile === "methodology" || manifest.profile === "docs") {
-        return { tracking_mode: "internal", external_provider: null };
-      }
-      const tracking_mode = await select3({
-        message: "How will work be tracked in this repo?",
-        choices: [
-          { value: "internal", name: "Track work in this repo (TODO.md / PRDs)" },
-          { value: "external", name: "Track work in an external tracker (Azure DevOps / GitHub / Jira / other)" }
-        ]
-      });
-      if (tracking_mode === "external") {
-        const external_provider = await select3({
-          message: "Which external tracker?",
-          choices: [
-            { value: "ado", name: "Azure DevOps" },
-            { value: "github", name: "GitHub Issues" },
-            { value: "jira", name: "Jira" },
-            { value: "other", name: "Other" }
-          ]
-        });
-        return { tracking_mode, external_provider };
-      }
-      return { tracking_mode, external_provider: null };
-    }
-  },
-  {
-    field: "content_sensitivity",
-    needsRetrofit: (m) => m.content_sensitivity === void 0,
-    // EF-12. Asked for every profile -- a code repo can hold sensitive records
-    // too -- and defaults to "standard", so an operator who just presses enter
-    // keeps today's behaviour exactly.
-    ask: async () => {
-      const content_sensitivity = await select3({
-        message: "How should agents treat this repository's contents?",
-        choices: [
-          {
-            value: "standard",
-            name: "Standard \u2014 agents may quote contents in journals and decisions"
-          },
-          {
-            value: "sensitive",
-            name: "Sensitive \u2014 agents reference documents by path, never transcribe them"
-          }
-        ],
-        default: "standard"
-      });
-      return { content_sensitivity };
-    }
-  },
-  {
-    field: "subject_root",
-    // EF-07. Only the docs profile is asked: other profiles describe code or a
-    // venture portfolio, where "what is this repo about" is already answered.
-    // A docs install that legitimately holds several subjects answers
-    // "portfolio" and stays unset -- so this retrofit deliberately does NOT
-    // re-ask on every update. It is gated on the field being absent AND the
-    // profile being docs, and once answered (either way) it never fires again,
-    // because "portfolio" writes an explicit empty marker.
-    needsRetrofit: (m) => m.profile === "docs" && m.subject_root === void 0,
-    ask: async () => {
-      const shape = await select3({
-        message: "What does this repository hold?",
-        choices: [
-          {
-            value: "root",
-            name: "One subject, at the repository root (documents sit alongside Arcane's files)"
-          },
-          { value: "subdir", name: "One subject, in its own directory" },
-          { value: "portfolio", name: "Several subjects or ventures" }
-        ]
-      });
-      if (shape === "root") return { subject_root: "." };
-      if (shape === "subdir") {
-        const answer = await input3({
-          message: "Directory holding the subject's documents:",
-          default: "docs",
-          validate: (v) => isValidSubjectRoot(v.trim() || "docs") || "Must be a relative path inside the repository (no leading /, drive letter, or ..)."
-        });
-        return { subject_root: answer.trim() || "docs" };
-      }
-      return { subject_root: null };
-    }
-  },
-  {
-    field: "push_policy",
-    needsRetrofit: (m) => m.push_policy === void 0,
-    // EF-09. Defaults to "open", so an operator who just presses enter keeps
-    // today's behaviour exactly. NOTE: this only records the choice -- unlike
-    // init, the retrofit does not install the hook or disable the push URL,
-    // because an update should not silently start blocking pushes in a repo
-    // someone is mid-workflow in. doctor reports the gap instead.
-    ask: async () => {
-      const push_policy = await select3({
-        message: "Should this repository be allowed to push to a remote?",
-        choices: [
-          { value: "open", name: "Yes \u2014 normal repository" },
-          { value: "guarded", name: "Sensitive, but keep push working \u2014 remind me instead" },
-          { value: "blocked", name: "No \u2014 block pushes" }
-        ],
-        default: "open"
-      });
-      return { push_policy };
-    }
-  }
-];
-async function runManifestRetrofits(manifest) {
-  const applicable = MANIFEST_RETROFITS.filter((r) => r.needsRetrofit(manifest));
-  if (applicable.length === 0) return {};
-  console.log();
-  console.log(
-    `This install predates ${applicable.length} manifest field${applicable.length === 1 ? "" : "s"} -- a couple of quick questions:`
-  );
-  let patch = {};
-  for (const retrofit of applicable) {
-    const answer = await retrofit.ask({ ...manifest, ...patch });
-    patch = { ...patch, ...answer };
-  }
-  return patch;
-}
-async function offerRegistryScaffold(targetDir, businessRoot) {
-  const registryPath = join8(targetDir, businessRoot, "registry.json");
-  if (await fileExists(registryPath)) return;
-  const businessRootPath = join8(targetDir, businessRoot);
-  let ventureDirs;
-  try {
-    const entries = await readdir6(businessRootPath, { withFileTypes: true });
-    ventureDirs = entries.filter((e) => e.isDirectory() && e.name !== "_template").map((e) => e.name);
-  } catch {
-    return;
-  }
-  if (ventureDirs.length === 0) return;
-  console.log();
-  const scaffold = await confirm2({
-    message: `Found ${ventureDirs.length} folder${ventureDirs.length === 1 ? "" : "s"} under ${businessRoot}/ -- scaffold ${businessRoot}/registry.json from them?`,
-    default: true
-  });
-  if (!scaffold) return;
-  const ventures = {};
-  for (const slug of ventureDirs) {
-    const include = await confirm2({ message: `  Include "${slug}"?`, default: true });
-    if (!include) continue;
-    ventures[slug] = {
-      name: slug,
-      aliases: [],
-      status: "active",
-      visibility: "private",
-      ownership: "llc",
-      tracking: "none",
-      repos: []
-    };
-  }
-  if (Object.keys(ventures).length === 0) {
-    console.log("  No ventures selected -- registry not created.");
-    return;
-  }
-  const registry = {
-    _comment: "Hub-owned venture registry. Private. Never installed or modified by spell update. Seeded by the retrofit wizard -- review and enrich (aliases, ownership, tracking, clones) before relying on it.",
-    updated: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
-    ventures
-  };
-  await writeFile8(registryPath, JSON.stringify(registry, null, 2) + "\n", "utf-8");
-  console.log(
-    `  \u2713 Scaffolded ${businessRoot}/registry.json with ${Object.keys(ventures).length} venture(s).`
-  );
-}
-
 // src/modules/merge3.ts
 var CONFLICT_START = "<<<<<<< yours (edited)";
 var CONFLICT_MID = "=======";
@@ -4319,6 +4619,101 @@ function merge3(base, ours, theirs) {
   return { content: resultLines.join("\n"), hasConflict };
 }
 
+// src/modules/registry-changes.ts
+import { join as join9 } from "path";
+function findMissingRequires(installed, profile) {
+  const names = new Set(installed.flatMap((c) => LEGACY_COMPONENT_MIGRATIONS[c.name] ?? [c.name]));
+  const promised = listProfiles().find((p) => p.id === profile)?.components;
+  const missing = /* @__PURE__ */ new Map();
+  for (const name of names) {
+    let requires;
+    try {
+      requires = getComponent(name).requires ?? [];
+    } catch (err) {
+      if (err instanceof ComponentNotFoundError) continue;
+      throw err;
+    }
+    for (const required of requires) {
+      if (names.has(required)) continue;
+      if (promised && !promised.includes(required)) continue;
+      missing.set(required, [...missing.get(required) ?? [], name]);
+    }
+  }
+  return [...missing].map(([name, requiredBy]) => ({ name, requiredBy }));
+}
+var SPELL_ID_IN_PATH = /(?:^|\/)(spell-[a-z0-9-]+)(?:\/SKILL\.md|\.prompt\.md|\.md)$/;
+function spellIdFromTrackedPath(file) {
+  return SPELL_ID_IN_PATH.exec(file)?.[1];
+}
+function findTrackedRetirements(components) {
+  const componentNames = new Set(components.map((c) => c.name));
+  const spellIds = new Set(
+    components.flatMap((c) => c.files).map(spellIdFromTrackedPath).filter((id) => id !== void 0)
+  );
+  return REGISTRY_RETIREMENTS.filter(
+    (entry) => entry.kind === "component" ? componentNames.has(entry.name) : spellIds.has(entry.name)
+  );
+}
+async function findNewlyAvailable(targetDir, profile, installed, spellScope) {
+  const definition = listProfiles().find((p) => p.id === profile);
+  if (!definition) return [];
+  const installedNames = new Set(installed.map((c) => c.name));
+  const found = [];
+  for (const name of definition.components) {
+    if (installedNames.has(name)) continue;
+    if (spellScope === "user" && SPELL_COMPONENT_NAMES.includes(name)) continue;
+    const component = getComponent(name);
+    const alreadyPresent = [];
+    if (component.skipExisting) {
+      for (const file of component.files) {
+        if (await fileExists(join9(targetDir, file))) alreadyPresent.push(file);
+      }
+      if (component.files.length > 0 && alreadyPresent.length === component.files.length) continue;
+    }
+    found.push({ name, description: component.description, alreadyPresent });
+  }
+  return found;
+}
+function formatRegistryChanges(changes) {
+  const missingRequires = changes.missingRequires ?? [];
+  const newlyAvailable = (changes.newlyAvailable ?? []).filter(
+    (c) => !missingRequires.some((m) => m.name === c.name)
+  );
+  if (changes.retired.length === 0 && newlyAvailable.length === 0 && missingRequires.length === 0) return [];
+  const lines = ["", "Registry changes since your install:"];
+  if (changes.retired.length > 0) {
+    lines.push("  Renamed or retired, still tracked here:");
+    for (const entry of changes.retired) {
+      const successor = entry.successors.length > 0 ? entry.successors.join(", ") : "no successor";
+      lines.push(`    ${entry.name} (${entry.kind}) \u2192 ${successor}: ${entry.reason}`);
+    }
+    lines.push(
+      "    Nothing is deleted because of this list: their files go through the orphan handling above, which removes an untouched one only under `spell update --prune`."
+    );
+  }
+  if (newlyAvailable.length > 0) {
+    const profile = changes.profile ? ` "${changes.profile}"` : "";
+    lines.push(`  Newly available for your${profile} profile, not installed \u2014 nothing was added:`);
+    for (const component of newlyAvailable) {
+      lines.push(`    ${component.name} \u2014 ${component.description}`);
+      lines.push(`      spell add ${component.name}`);
+      if (component.alreadyPresent.length > 0) {
+        lines.push(
+          `      (already here and yours: ${component.alreadyPresent.join(", ")} \u2014 \`spell add\` stops at an existing file rather than overwrite it)`
+        );
+      }
+    }
+  }
+  if (missingRequires.length > 0) {
+    lines.push("  Missing prerequisites \u2014 installed components cite these, and they are not installed:");
+    for (const { name, requiredBy } of missingRequires) {
+      lines.push(`    ${name} (required by ${requiredBy.join(", ")})`);
+      lines.push(`      spell add ${name}`);
+    }
+  }
+  return lines;
+}
+
 // src/modules/npm-registry.ts
 var NPM_PACKAGE_NAME = "arcane-cli";
 async function fetchPublishedFile(version, relativeAssetPath) {
@@ -4354,6 +4749,14 @@ async function missingTierWarning(scope, spellScope, homeDir) {
     ];
   }
 }
+function reportFlagPatch(flagPatch, before, after, dryRun) {
+  console.log(`
+${dryRun ? "[dry-run] Would record" : "Recorded"} from flags:`);
+  for (const line of describeFlagPatch(flagPatch)) console.log(`    ${line}`);
+  if (!dryRun && after.push_policy !== before.push_policy) {
+    for (const line of pushPolicyNotice(after.push_policy)) console.log(line);
+  }
+}
 function defaultScopePatch(options, manifest) {
   if (options.defaultScope === void 0) return void 0;
   if (manifest.default_spell_scope === options.defaultScope) return void 0;
@@ -4392,6 +4795,44 @@ function migrateLegacyComponents(components) {
     inherited: { files: inheritedFiles, fileHashes: inheritedHashes, carrier }
   };
 }
+function moveComponentFiles(components, present = () => true) {
+  let out = components;
+  for (const move of COMPONENT_FILE_MOVES) {
+    const from = out.find((c) => c.name === move.from);
+    const tracked = from?.files.filter((f) => move.files.includes(f)) ?? [];
+    if (!from || tracked.length === 0) continue;
+    const moving = tracked.filter(present);
+    const dropped = tracked.filter((f) => !present(f));
+    const movedHashes = {};
+    const keptHashes = {};
+    for (const [file, hash] of Object.entries(from.fileHashes ?? {})) {
+      if (dropped.includes(file)) continue;
+      (moving.includes(file) ? movedHashes : keptHashes)[file] = hash;
+    }
+    const newFrom = {
+      ...from,
+      files: from.files.filter((f) => !tracked.includes(f)),
+      ...from.fileHashes ? { fileHashes: keptHashes } : {}
+    };
+    const existing = out.find((c) => c.name === move.to);
+    const newTo = existing ? {
+      ...existing,
+      files: [...existing.files, ...moving.filter((f) => !existing.files.includes(f))],
+      fileHashes: { ...movedHashes, ...existing.fileHashes }
+    } : {
+      name: move.to,
+      files: moving,
+      installedVersion: from.installedVersion,
+      ...from.fileHashes ? { fileHashes: movedHashes } : {}
+    };
+    out = out.flatMap((c) => {
+      if (c === from) return existing || moving.length === 0 ? [newFrom] : [newFrom, newTo];
+      if (c === existing) return [newTo];
+      return [c];
+    });
+  }
+  return out;
+}
 async function resolveOrphan(targetDir, file, recordedHash, prune) {
   try {
     validateTargetPath(targetDir, file);
@@ -4399,7 +4840,7 @@ async function resolveOrphan(targetDir, file, recordedHash, prune) {
     console.log(`  ! Refused (path escapes the target directory): ${file}`);
     return "reported";
   }
-  const filePath = join9(targetDir, file);
+  const filePath = join10(targetDir, file);
   if (!await fileExists(filePath)) return "not-found";
   if (!prune) return "reported";
   if (recordedHash === void 0) {
@@ -4421,7 +4862,7 @@ async function retainReportedOrphan(targetDir, file, recordedHash, into) {
   } catch {
     return;
   }
-  if (!await fileExists(join9(targetDir, file))) return;
+  if (!await fileExists(join10(targetDir, file))) return;
   if (!into.files.includes(file)) into.files.push(file);
   if (recordedHash !== void 0) {
     into.fileHashes ??= {};
@@ -4450,7 +4891,7 @@ async function findMissingTrackedFiles(targetDir, components, scope = "repo", sp
     const candidates = readopted.has(installed.name) ? component.files : installed.files;
     for (const file of candidates) {
       if (!component.files.includes(file)) continue;
-      if (!await fileExists(join9(targetDir, file))) missing.push(file);
+      if (!await fileExists(join10(targetDir, file))) missing.push(file);
     }
   }
   return missing;
@@ -4489,6 +4930,16 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
     }
     throw err;
   }
+  const movedFilesPresent = /* @__PURE__ */ new Set();
+  for (const move of COMPONENT_FILE_MOVES) {
+    for (const file of move.files) {
+      if (await fileExists(join10(targetDir, file))) movedFilesPresent.add(file);
+    }
+  }
+  manifest = {
+    ...manifest,
+    components: moveComponentFiles(manifest.components, (f) => movedFilesPresent.has(f))
+  };
   const resolvedScope = resolveInstallScope(targetDir, manifest.scope, options.user);
   if (resolvedScope.misplacedUserManifest) {
     console.error(misplacedUserManifestMessage(targetDir));
@@ -4496,6 +4947,27 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
     return;
   }
   const scope = resolvedScope.scope;
+  let flagPatch = {};
+  if (hasManifestFlags(options.manifestFlags)) {
+    if (scope !== "repo") {
+      console.error(
+        "\n  \u2717 The manifest-question flags describe a repository; the user tier has none of those fields.\n"
+      );
+      process.exit(1);
+      return;
+    }
+    try {
+      flagPatch = resolveManifestFlags(options.manifestFlags, manifest, join10(targetDir, ".arcane.json"));
+    } catch (err) {
+      if (!(err instanceof ManifestFlagError)) throw err;
+      console.error(`
+  \u2717 ${err.message}
+`);
+      process.exit(1);
+      return;
+    }
+  }
+  const answered = { ...manifest, ...flagPatch };
   const spellScope = effectiveSpellScope(manifest);
   const readopted = findReadoptedSpellComponents(manifest.components, scope, spellScope);
   const homeDir = dirname5(targetDir);
@@ -4530,12 +5002,33 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
       return;
     }
   }
+  const registryChanges = {
+    retired: findTrackedRetirements(manifest.components),
+    ...scope === "repo" ? {
+      profile: manifest.profile,
+      newlyAvailable: await findNewlyAvailable(
+        targetDir,
+        manifest.profile,
+        migrateLegacyComponents(manifest.components).components,
+        spellScope
+      ),
+      missingRequires: findMissingRequires(manifest.components, manifest.profile)
+    } : {}
+  };
+  const printRegistryChanges = () => {
+    for (const line of formatRegistryChanges(registryChanges)) console.log(line);
+  };
   let sameVersionRestore = false;
   if (manifest.version === packageVersion && manifest.components.length > 0) {
     const missing = await findMissingTrackedFiles(targetDir, manifest.components, scope, spellScope, readopted);
     const unmanaged = findUnmanagedTrackedFiles(manifest.components, scope, spellScope);
     if (missing.length === 0 && unmanaged.length === 0) {
       console.log("Already up to date.");
+      printRegistryChanges();
+      if (scope === "repo" && Object.keys(flagPatch).length > 0) {
+        if (!options.dryRun) await writeManifest(targetDir, answered);
+        reportFlagPatch(flagPatch, manifest, answered, options.dryRun);
+      }
       if (scope === "user") {
         const fanout = await syncUserTierFanout({
           ownedClients: SPELL_FANOUT_CLIENTS,
@@ -4568,6 +5061,10 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
   }
   if (manifest.components.length === 0) {
     console.log("No components installed. Nothing to update.");
+    if (scope === "repo" && Object.keys(flagPatch).length > 0) {
+      if (!options.dryRun) await writeManifest(targetDir, answered);
+      reportFlagPatch(flagPatch, manifest, answered, options.dryRun);
+    }
     return;
   }
   let fileCount = 0;
@@ -4616,8 +5113,8 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
     const updatedFiles = [];
     const fileHashes = {};
     for (const file of component.files) {
-      const srcPath = join9(assetsDir, component.sourceOverrides?.[file] ?? file);
-      const targetExists = await fileExists(join9(targetDir, file));
+      const srcPath = join10(assetsDir, component.sourceOverrides?.[file] ?? file);
+      const targetExists = await fileExists(join10(targetDir, file));
       const preserveExisting = Boolean(component.skipExisting) && targetExists;
       const recordedHash = installed.fileHashes?.[file];
       if (component.initOnly && !targetExists) {
@@ -4637,7 +5134,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
           continue;
         }
       }
-      const editedByOperator = recordedHash !== void 0 && targetExists && !preserveExisting && !await fileMatchesHash(join9(targetDir, file), recordedHash);
+      const editedByOperator = recordedHash !== void 0 && targetExists && !preserveExisting && !await fileMatchesHash(join10(targetDir, file), recordedHash);
       if (preserveExisting) {
         console.log(`  ${options.dryRun ? "[dry-run] Would preserve" : "Preserved"}: ${file}`);
       } else if (editedByOperator && isClientShimPath(file)) {
@@ -4664,11 +5161,11 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
             handled = true;
           } else {
             const [currentContent, newContent] = await Promise.all([
-              readFile7(join9(targetDir, file), "utf-8"),
+              readFile7(join10(targetDir, file), "utf-8"),
               readFile7(srcPath, "utf-8")
             ]);
             const result = merge3(oldVendorContent, currentContent, newContent);
-            await writeFile9(join9(targetDir, file), result.content, "utf-8");
+            await writeFile9(join10(targetDir, file), result.content, "utf-8");
             fileHashes[file] = await hashFile(srcPath);
             if (result.hasConflict) {
               conflictedFiles.push(file);
@@ -4690,7 +5187,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
       }
     }
     for (const dir of component.directories ?? []) {
-      const srcDirPath = join9(assetsDir, dir);
+      const srcDirPath = join10(assetsDir, dir);
       if (options.dryRun) {
         console.log(`  [dry-run] Would update directory: ${dir}/`);
       } else {
@@ -4757,6 +5254,7 @@ ${verb} ${orphansToReport.length} orphaned file(s) (tracked before this update,
       console.log("  Run `spell update --prune` to remove the ones that are safe to delete.");
     }
   }
+  printRegistryChanges();
   if (customizedShims.length > 0) {
     const verb = options.dryRun ? "[dry-run] Would keep" : "Kept";
     console.log(
@@ -4789,7 +5287,8 @@ ${verb} ${orphansToReport.length} orphaned file(s) (tracked before this update,
       `
 [dry-run] Would update ${fileCount} files.`
     );
-    const applicableRetrofits = scope === "repo" ? MANIFEST_RETROFITS.filter((r) => r.needsRetrofit(manifest)) : [];
+    if (Object.keys(flagPatch).length > 0) reportFlagPatch(flagPatch, manifest, answered, true);
+    const applicableRetrofits = scope === "repo" ? MANIFEST_RETROFITS.filter((r) => r.needsRetrofit(answered)) : [];
     if (applicableRetrofits.length > 0) {
       console.log(
         `[dry-run] Would ask ${applicableRetrofits.length} manifest retrofit question${applicableRetrofits.length === 1 ? "" : "s"}: ${applicableRetrofits.map((r) => r.field).join(", ")}.`
@@ -4798,19 +5297,21 @@ ${verb} ${orphansToReport.length} orphaned file(s) (tracked before this update,
     return;
   }
   const interactive = Boolean(process.stdin.isTTY) && scope === "repo";
-  const retrofitPatch = interactive ? await runManifestRetrofits(manifest) : {};
+  const retrofitPatch = interactive ? await runManifestRetrofits(answered, targetDir) : {};
   if (!interactive && scope === "repo") {
-    const pending = MANIFEST_RETROFITS.filter((r) => r.needsRetrofit(manifest));
+    const pending = MANIFEST_RETROFITS.filter((r) => r.needsRetrofit(answered));
     if (pending.length > 0) {
       console.log(
-        `  ! Skipped ${pending.length} manifest question${pending.length === 1 ? "" : "s"} (${pending.map((r) => r.field).join(", ")}) \u2014 no interactive terminal. Run \`spell update\` from a terminal to answer.`
+        `  ! Skipped ${pending.length} manifest question${pending.length === 1 ? "" : "s"} (${pending.map((r) => r.field).join(", ")}) \u2014 no interactive terminal. Run \`spell update\` from a terminal, or answer by flags:`
       );
+      for (const line of manifestFlagLine(answered) ?? []) console.log(`      ${line}`);
     }
   }
   const updated = {
     ...manifest,
     version: packageVersion,
     components: updatedComponents,
+    ...flagPatch,
     ...retrofitPatch,
     ...fanoutRecord !== void 0 ? { fanout: fanoutRecord } : {},
     ...defaultScopePatch(options, manifest)
@@ -4820,6 +5321,11 @@ ${verb} ${orphansToReport.length} orphaned file(s) (tracked before this update,
     `
 \u2713 Updated ${fileCount} files.`
   );
+  if (Object.keys(flagPatch).length > 0) {
+    reportFlagPatch(flagPatch, manifest, updated, false);
+  } else if (updated.push_policy !== manifest.push_policy) {
+    for (const line of pushPolicyNotice(updated.push_policy)) console.log(line);
+  }
   if (conflictedFiles.length > 0) {
     console.log(
       `
@@ -4829,7 +5335,13 @@ ${verb} ${orphansToReport.length} orphaned file(s) (tracked before this update,
     );
   }
   if (scope === "repo" && manifest.role !== "hub" && updated.role === "hub") {
-    await offerRegistryScaffold(targetDir, updated.business_root ?? "ventures");
+    if (process.stdin.isTTY) {
+      await offerRegistryScaffold(targetDir, updated.business_root ?? "ventures");
+    } else {
+      console.log(
+        `  This repository is now a hub. Run \`spell update\` from a terminal to scaffold ${updated.business_root ?? "ventures"}/registry.json from existing venture folders.`
+      );
+    }
   }
 }
 
@@ -4838,7 +5350,7 @@ import { dirname as dirname7 } from "path";
 
 // src/modules/version-check.ts
 import { readFile as readFile8, writeFile as writeFile10, mkdir as mkdir6 } from "fs/promises";
-import { dirname as dirname6, join as join10 } from "path";
+import { dirname as dirname6, join as join11 } from "path";
 import { homedir as homedir3 } from "os";
 import { createRequire } from "module";
 var require2 = createRequire(import.meta.url);
@@ -4852,7 +5364,7 @@ function getFeedUrl() {
   }
   return url;
 }
-var DEFAULT_CACHE_PATH = join10(homedir3(), ".arcane", "version-cache.json");
+var DEFAULT_CACHE_PATH = join11(homedir3(), ".arcane", "version-cache.json");
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 async function readCache(cachePath) {
   try {
@@ -5071,7 +5583,7 @@ async function runStatus(targetDir, packageVersion, options = {}) {
 
 // src/commands/uninstall.ts
 import { rm as rm5 } from "fs/promises";
-import { dirname as dirname8, join as join11 } from "path";
+import { dirname as dirname8, join as join12 } from "path";
 import { confirm as confirm3 } from "@inquirer/prompts";
 async function runUninstall(options, targetDir) {
   let manifest;
@@ -5154,16 +5666,16 @@ Run \`spell unblock-push\` first (interactive), then uninstall.`
       }
     }
   }
-  await rm5(join11(targetDir, ".arcane.json"), { force: true });
+  await rm5(join12(targetDir, ".arcane.json"), { force: true });
   const agentDirs = [
     ".github/agents",
     ".arcane/agents",
     ".arcane/generated"
   ];
   for (const dir of agentDirs) {
-    await rm5(join11(targetDir, dir), { recursive: true, force: true });
+    await rm5(join12(targetDir, dir), { recursive: true, force: true });
   }
-  await rm5(join11(targetDir, ".arcane/agents.yaml"), { force: true });
+  await rm5(join12(targetDir, ".arcane/agents.yaml"), { force: true });
   const markerFiles = [
     "CLAUDE.md",
     "AGENTS.md",
@@ -5225,10 +5737,10 @@ async function uninstallUserTier(options, storeRoot, manifest) {
       console.log(`  ! Skipped ${file}: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
-  await rm5(join11(storeRoot, ".arcane.json"), { force: true });
-  await rm5(join11(storeRoot, "agents"), { recursive: true, force: true });
-  await rm5(join11(storeRoot, "agents.yaml"), { force: true });
-  await removeDirectoryIfEmpty(join11(storeRoot, USER_TIER_SPELLS_DIR));
+  await rm5(join12(storeRoot, ".arcane.json"), { force: true });
+  await rm5(join12(storeRoot, "agents"), { recursive: true, force: true });
+  await rm5(join12(storeRoot, "agents.yaml"), { force: true });
+  await removeDirectoryIfEmpty(join12(storeRoot, USER_TIER_SPELLS_DIR));
   await removeDirectoryIfEmpty(storeRoot);
   for (const line of describeFanoutOutcomes(fanout.outcomes)) console.log(`  ${line}`);
   const pruned = fanout.outcomes.filter((o) => o.status === "pruned").length;
@@ -5240,8 +5752,8 @@ async function uninstallUserTier(options, storeRoot, manifest) {
 }
 
 // src/commands/doctor.ts
-import { access as access4, readdir as readdir8, readFile as readFile10, mkdir as mkdir7, copyFile as fsCopyFile } from "fs/promises";
-import { join as join13, dirname as dirname9 } from "path";
+import { access as access4, readdir as readdir9, readFile as readFile11, mkdir as mkdir7, copyFile as fsCopyFile } from "fs/promises";
+import { join as join15, dirname as dirname9 } from "path";
 
 // src/config/incidents.ts
 var INCIDENT_QUEUE = [
@@ -5310,7 +5822,7 @@ function evaluateIncidentGate(records) {
 
 // src/modules/denylist-scan.ts
 import { readFile as readFile9, readdir as readdir7 } from "fs/promises";
-import { join as join12, relative } from "path";
+import { join as join13, relative } from "path";
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -5361,7 +5873,7 @@ async function collectScannableFiles(root, repoRoot = root, extensions = DEFAULT
     return collected;
   }
   for (const entry of entries) {
-    const absolutePath = join12(root, entry.name);
+    const absolutePath = join13(root, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRECTORIES.has(entry.name)) continue;
       collected.push(...await collectScannableFiles(absolutePath, repoRoot, extensions));
@@ -5576,6 +6088,133 @@ function parseAdoRemote(url) {
   return null;
 }
 
+// src/modules/placeholders.ts
+import { readdir as readdir8, readFile as readFile10 } from "fs/promises";
+import { join as join14 } from "path";
+var PLACEHOLDER_STANDARD_FILE = "spell-authoring-standards.md";
+var RUNTIME_PLACEHOLDERS_START = "<!-- runtime-placeholders:start -->";
+var RUNTIME_PLACEHOLDERS_END = "<!-- runtime-placeholders:end -->";
+var PLACEHOLDER_PATTERN = /(?<!\$)\{([A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*)\}/g;
+var FRONTMATTER_PATTERN2 = /^---\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/;
+function parseFrontmatterStatus(content) {
+  const block = FRONTMATTER_PATTERN2.exec(content);
+  if (!block) return null;
+  const status = /^status:[ \t]*["']?([^"'\s#]+)/m.exec(block[1]);
+  return status ? status[1] : null;
+}
+function stripFrontmatter(content) {
+  const block = FRONTMATTER_PATTERN2.exec(content);
+  return block ? content.slice(block[0].length) : content;
+}
+function stripFencedCode(text) {
+  const kept = [];
+  let fence = null;
+  for (const line of text.split(/\r?\n/)) {
+    if (fence) {
+      const close = /^ {0,3}(`{3,}|~{3,})[ \t]*$/.exec(line);
+      if (close && close[1][0] === fence.char && close[1].length >= fence.length) fence = null;
+      kept.push("");
+      continue;
+    }
+    const open = /^ {0,3}(`{3,}|~{3,})/.exec(line);
+    if (open && !(open[1][0] === "`" && line.slice(open[0].length).includes("`"))) {
+      fence = { char: open[1][0], length: open[1].length };
+      kept.push("");
+      continue;
+    }
+    kept.push(line);
+  }
+  return kept.join("\n");
+}
+function stripInlineCode(text) {
+  return text.split(/\n[ \t]*\n/).map((paragraph) => {
+    let out = "";
+    let i = 0;
+    while (i < paragraph.length) {
+      if (paragraph[i] !== "`") {
+        out += paragraph[i];
+        i += 1;
+        continue;
+      }
+      let runEnd = i;
+      while (paragraph[runEnd] === "`") runEnd += 1;
+      const run = runEnd - i;
+      let close = -1;
+      let j = runEnd;
+      while (j < paragraph.length) {
+        if (paragraph[j] !== "`") {
+          j += 1;
+          continue;
+        }
+        let k = j;
+        while (paragraph[k] === "`") k += 1;
+        if (k - j === run) {
+          close = j;
+          break;
+        }
+        j = k;
+      }
+      if (close === -1) {
+        out += paragraph.slice(i, runEnd);
+        i = runEnd;
+      } else {
+        out += " ";
+        i = close + run;
+      }
+    }
+    return out;
+  }).join("\n\n");
+}
+function findPlaceholderTokens(content) {
+  const prose = stripInlineCode(stripFencedCode(stripFrontmatter(content)));
+  const seen = /* @__PURE__ */ new Set();
+  for (const match of prose.matchAll(PLACEHOLDER_PATTERN)) seen.add(`{${match[1]}}`);
+  return [...seen];
+}
+function parseRuntimePlaceholders(standardContent) {
+  const start = standardContent.indexOf(RUNTIME_PLACEHOLDERS_START);
+  const end = standardContent.indexOf(RUNTIME_PLACEHOLDERS_END);
+  if (start === -1 || end === -1 || end < start) return null;
+  const region = standardContent.slice(start + RUNTIME_PLACEHOLDERS_START.length, end);
+  const tokens = /* @__PURE__ */ new Set();
+  for (const match of region.matchAll(/^[ \t]*[-*][ \t]+`(\{[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*\})`/gm)) {
+    tokens.add(match[1]);
+  }
+  return tokens;
+}
+async function scanGovernancePlaceholders(governanceDir) {
+  let standard;
+  try {
+    standard = await readFile10(join14(governanceDir, PLACEHOLDER_STANDARD_FILE), "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { status: "skipped", reason: `${PLACEHOLDER_STANDARD_FILE} is not installed` };
+    }
+    throw err;
+  }
+  const runtimeTokens = parseRuntimePlaceholders(standard);
+  if (!runtimeTokens) {
+    return {
+      status: "skipped",
+      reason: `${PLACEHOLDER_STANDARD_FILE} has no runtime-placeholders list (an older version?)`
+    };
+  }
+  const files = (await readdir8(governanceDir, { withFileTypes: true })).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name).sort();
+  const activeDocs = [];
+  const templateDocs = [];
+  const findings = [];
+  for (const file of files) {
+    const content = await readFile10(join14(governanceDir, file), "utf8");
+    const status = parseFrontmatterStatus(content);
+    if (status === "template") templateDocs.push(file);
+    if (status !== "active") continue;
+    activeDocs.push(file);
+    const unknown = findPlaceholderTokens(content).filter((token) => !runtimeTokens.has(token));
+    if (unknown.length > 0) findings.push({ file, tokens: unknown });
+  }
+  return { status: "scanned", runtimeTokens, activeDocs, templateDocs, findings };
+}
+
 // src/commands/doctor.ts
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -5596,14 +6235,14 @@ async function checkNodeVersion() {
 async function checkVSCodeExtension(id, label, homeDir = resolveHomeDir()) {
   const name = `VS Code extension: ${label}`;
   const flavours = [
-    { dir: join13(homeDir, ".vscode", "extensions"), bin: "code" },
-    { dir: join13(homeDir, ".vscode-insiders", "extensions"), bin: "code-insiders" }
+    { dir: join15(homeDir, ".vscode", "extensions"), bin: "code" },
+    { dir: join15(homeDir, ".vscode-insiders", "extensions"), bin: "code-insiders" }
   ];
   let installBin = null;
   for (const flavour of flavours) {
     let entries;
     try {
-      entries = await readdir8(flavour.dir);
+      entries = await readdir9(flavour.dir);
     } catch {
       continue;
     }
@@ -5625,13 +6264,13 @@ async function checkVSCodeExtension(id, label, homeDir = resolveHomeDir()) {
 }
 async function checkArcaneManifest(targetDir) {
   const name = "Arcane manifest (.arcane.json)";
-  const manifestPath2 = join13(targetDir, ".arcane.json");
+  const manifestPath2 = join15(targetDir, ".arcane.json");
   try {
     await access4(manifestPath2);
   } catch {
-    const selfHostedManifestPath = join13(targetDir, "src", "assets", ".arcane.json");
+    const selfHostedManifestPath = join15(targetDir, "src", "assets", ".arcane.json");
     try {
-      const raw = await readFile10(selfHostedManifestPath, "utf8");
+      const raw = await readFile11(selfHostedManifestPath, "utf8");
       const manifest = JSON.parse(raw);
       if (isRecord3(manifest) && manifest["selfHosted"] === true && manifest["tracking_mode"] === "internal") {
         return {
@@ -5650,7 +6289,7 @@ async function checkArcaneManifest(targetDir) {
     };
   }
   try {
-    const raw = await readFile10(manifestPath2, "utf8");
+    const raw = await readFile11(manifestPath2, "utf8");
     const manifest = JSON.parse(raw);
     if (!isRecord3(manifest) || typeof manifest["version"] !== "string" || !manifest["version"] || !Array.isArray(manifest["components"])) {
       return {
@@ -5735,7 +6374,7 @@ async function checkSessionContinuity(targetDir) {
   const results = [];
   for (const file of SESSION_CONTINUITY_FILES) {
     const name = `Session file: ${file}`;
-    const filePath = join13(targetDir, file);
+    const filePath = join15(targetDir, file);
     try {
       await access4(filePath);
       results.push({ name, passed: true, message: "present" });
@@ -5753,11 +6392,11 @@ async function checkSessionContinuity(targetDir) {
 async function fixSessionContinuity(targetDir, assetsDir) {
   const created = [];
   for (const file of SESSION_CONTINUITY_FILES) {
-    const destPath = join13(targetDir, file);
+    const destPath = join15(targetDir, file);
     try {
       await access4(destPath);
     } catch {
-      const srcPath = join13(assetsDir, file);
+      const srcPath = join15(assetsDir, file);
       await mkdir7(dirname9(destPath), { recursive: true });
       await fsCopyFile(srcPath, destPath);
       created.push(file);
@@ -5877,15 +6516,73 @@ async function checkPushPolicy(targetDir) {
     name,
     passed: false,
     blocking: false,
-    message: `declared "blocked" but not enforced \u2014 ${missing.join("; ")}. The manifest claims a protection this repository does not have.`
+    // ARC-049 decision 3: name the command that closes the gap.
+    message: `declared "blocked" but not enforced \u2014 ${missing.join("; ")}. The manifest claims a protection this repository does not have. Run \`spell block-push\` to install the controls.`
+  };
+}
+async function checkGovernancePlaceholders(targetDir) {
+  const name = "Governance placeholders (ARC-051)";
+  let scan;
+  try {
+    scan = await scanGovernancePlaceholders(join15(targetDir, ".arcane", "governance"));
+  } catch (err) {
+    return {
+      name,
+      passed: false,
+      blocking: false,
+      message: `could not scan .arcane/governance (${err instanceof Error ? err.message : String(err)})`
+    };
+  }
+  if (scan.status === "skipped") {
+    return { name, passed: true, blocking: false, skipped: true, message: `skipped \u2014 ${scan.reason}` };
+  }
+  if (scan.findings.length === 0) {
+    return {
+      name,
+      passed: true,
+      blocking: false,
+      message: `${scan.activeDocs.length} active doc(s) scanned, no unknown placeholders`
+    };
+  }
+  const listed = scan.findings.map(({ file, tokens }) => `.arcane/governance/${file}: ${tokens.join(", ")}`);
+  return {
+    name,
+    passed: false,
+    blocking: false,
+    message: `unknown placeholder(s) in status: active doc(s) \u2014 ${listed.join("; ")}. Fill each one in; or, if an agent resolves it at use time, add it to the runtime-placeholders list in .arcane/governance/${PLACEHOLDER_STANDARD_FILE}; or, if the document is meant to be filled in by hand, mark it \`status: template\`.`
+  };
+}
+async function checkComponentRequires(targetDir) {
+  const name = "Component prerequisites";
+  let manifest;
+  try {
+    manifest = await readManifest(targetDir);
+  } catch {
+    return { name, passed: true, blocking: false, skipped: true, message: "skipped \u2014 no readable .arcane.json" };
+  }
+  if (manifest.scope === "user") {
+    return { name, passed: true, blocking: false, skipped: true, message: "skipped \u2014 the user tier holds spells only" };
+  }
+  if (!Array.isArray(manifest.components)) {
+    return { name, passed: true, blocking: false, skipped: true, message: "skipped \u2014 .arcane.json lists no components" };
+  }
+  const missing = findMissingRequires(manifest.components, manifest.profile);
+  if (missing.length === 0) {
+    return { name, passed: true, blocking: false, message: "every installed component's prerequisites are installed" };
+  }
+  return {
+    name,
+    passed: false,
+    blocking: false,
+    message: missing.map(({ name: required, requiredBy }) => `${requiredBy.join(", ")} cites ${required}, which is not installed \u2014 \`spell add ${required}\``).join("; ")
   };
 }
 async function checkMcpConfig(targetDir) {
   const name = "MCP config (per-server timeout, I12)";
-  const filePath = join13(targetDir, ".mcp.json");
+  const filePath = join15(targetDir, ".mcp.json");
   let raw;
   try {
-    raw = await readFile10(filePath, "utf8");
+    raw = await readFile11(filePath, "utf8");
   } catch {
     return { name, passed: true, blocking: false, message: "no .mcp.json \u2014 nothing to check" };
   }
@@ -5938,10 +6635,10 @@ function isDelegationsFile(value) {
 }
 async function checkDelegations(targetDir) {
   const name = "Standing delegations (T13)";
-  const filePath = join13(targetDir, ".arcane", "delegations.json");
+  const filePath = join15(targetDir, ".arcane", "delegations.json");
   let raw;
   try {
-    raw = await readFile10(filePath, "utf8");
+    raw = await readFile11(filePath, "utf8");
   } catch {
     return { name, passed: true, blocking: false, message: "no delegations recorded" };
   }
@@ -6051,7 +6748,7 @@ async function checkSpellScope(targetDir, homeDir = resolveHomeDir()) {
   let probed = false;
   const probe = "spell-status.md";
   try {
-    const entries = await readdir8(join13(storeRoot, USER_TIER_SPELLS_DIR));
+    const entries = await readdir9(join15(storeRoot, USER_TIER_SPELLS_DIR));
     const spells = entries.filter((e) => e.startsWith("spell-") && e.endsWith(".md"));
     spellCount = spells.length;
     probed = spells.includes(probe);
@@ -6114,16 +6811,19 @@ async function runDoctor(targetDir, options = {}, assetsDir) {
     checkDelegations(targetDir),
     checkMcpConfig(targetDir),
     checkUserTier(resolveHomeDir(), options.packageVersion),
-    checkSpellScope(targetDir)
+    checkSpellScope(targetDir),
+    checkGovernancePlaceholders(targetDir),
+    checkComponentRequires(targetDir)
   ]);
   const sessionResults = await checkSessionContinuity(targetDir);
   results.push(...sessionResults);
   let allPassed = true;
   for (const result of results) {
-    const icon = result.passed ? "\u2713" : result.blocking === false ? "\u26A0" : "\u2717";
-    const label = result.passed ? "pass" : result.blocking === false ? "warn" : "FAIL";
+    const skipped = result.passed && result.skipped === true;
+    const icon = skipped ? "\u2013" : result.passed ? "\u2713" : result.blocking === false ? "\u26A0" : "\u2717";
+    const label = skipped ? "skip" : result.passed ? "pass" : result.blocking === false ? "warn" : "FAIL";
     console.log(`  ${icon} [${label}] ${result.name}`);
-    if (!result.passed) {
+    if (!result.passed || skipped) {
       console.log(`         ${result.message}`);
     }
     if (!result.passed && result.blocking !== false) {
@@ -6157,16 +6857,16 @@ async function runDoctor(targetDir, options = {}, assetsDir) {
 }
 
 // src/commands/ward.ts
-import { readFile as readFile12 } from "fs/promises";
+import { readFile as readFile13 } from "fs/promises";
 
 // src/modules/ward.ts
-import { readdir as readdir9, readFile as readFile11 } from "fs/promises";
-import { join as join14, relative as relative2 } from "path";
+import { readdir as readdir10, readFile as readFile12 } from "fs/promises";
+import { join as join16, relative as relative2 } from "path";
 async function scanFileAllRules(absolutePath, displayPath, rules) {
   const findings = [];
   let content;
   try {
-    content = await readFile11(absolutePath, "utf8");
+    content = await readFile12(absolutePath, "utf8");
   } catch {
     return findings;
   }
@@ -6219,12 +6919,12 @@ async function scanFilenames(root, rules, repoRoot = root) {
   const findings = [];
   let entries;
   try {
-    entries = await readdir9(root, { withFileTypes: true });
+    entries = await readdir10(root, { withFileTypes: true });
   } catch {
     return findings;
   }
   for (const entry of entries) {
-    const absolutePath = join14(root, entry.name);
+    const absolutePath = join16(root, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRECTORIES.has(entry.name)) continue;
       findings.push(...await scanFilenames(absolutePath, rules, repoRoot));
@@ -6261,7 +6961,7 @@ async function runWard(repoRoot, options = {}) {
     const findings2 = await scanFileAllRules(absolutePath, displayPath, allRules);
     if (findings2.length > 0) {
       try {
-        fileLines.set(displayPath, (await readFile11(absolutePath, "utf8")).split("\n"));
+        fileLines.set(displayPath, (await readFile12(absolutePath, "utf8")).split("\n"));
       } catch {
       }
     }
@@ -6289,7 +6989,7 @@ function parseTermsFileContent(raw) {
 }
 async function readTermsFile(filePath) {
   try {
-    return parseTermsFileContent(await readFile12(filePath, "utf8"));
+    return parseTermsFileContent(await readFile13(filePath, "utf8"));
   } catch (error) {
     console.warn(
       `\u26A0 arcane: could not read --terms-file "${filePath}": ${error.message}`
@@ -6436,17 +7136,80 @@ Name did not match ("${typed.trim()}" \u2260 "${repoName}"). Nothing changed.`);
   );
 }
 
+// src/commands/block-push.ts
+async function runBlockPush(targetDir) {
+  let manifest;
+  try {
+    manifest = await readManifest(targetDir);
+  } catch (err) {
+    if (err instanceof ManifestNotFoundError) {
+      console.error('Not initialized. Run "spell init" first.');
+      process.exit(1);
+      return;
+    }
+    throw err;
+  }
+  if (manifest.scope === "user") {
+    console.error(
+      "spell block-push applies to a repository, not the user tier: push_policy describes a repository."
+    );
+    process.exit(1);
+    return;
+  }
+  if ((await inspectGitRepository(targetDir)).status === "not-repository") {
+    console.error("spell block-push needs a Git repository: there is nothing here to block.");
+    process.exit(1);
+    return;
+  }
+  const recorded = manifest.push_policy ?? "open";
+  const alreadyEnforced = recorded === "blocked" && await isHookEnforced(targetDir) && (await undisabledRemotes(targetDir)).length === 0;
+  if (alreadyEnforced) {
+    printSuccess("Push is already blocked and enforced here. Nothing changed.");
+    if ((await listRemotes(targetDir)).length === 0) {
+      printWarning(
+        "No remote is configured, so only the pre-push hook is active. Re-run `spell block-push` after adding a remote to disable its push URL too."
+      );
+    }
+    printInfo("Run `spell unblock-push` from a terminal to undo this.");
+    return;
+  }
+  const outcome = await applyBlockedPushControls(targetDir, {
+    stopOnHookRefusal: true,
+    emit: (m) => m.level === "warning" ? printWarning(m.text) : printInfo(m.text)
+  });
+  const failedRemotes = outcome.urls.filter((u) => u.status === "failed");
+  if (!hookInForce(outcome.hook) || failedRemotes.length > 0) {
+    printWarning(
+      outcome.stoppedAtHook ? "Nothing was changed. Resolve the refusal above and re-run `spell block-push`." : "Push is NOT fully blocked: the remotes named above can still be pushed to. Fix them and re-run `spell block-push`."
+    );
+    if (recorded !== "blocked") {
+      printInfo(
+        `The manifest still records push_policy: "${recorded}" \u2014 it is not changed to "blocked" until both controls are in force.`
+      );
+    }
+    process.exit(1);
+    return;
+  }
+  if (recorded !== "blocked") {
+    await writeManifest(targetDir, { ...manifest, push_policy: "blocked" });
+    printSuccess(`Push blocked. Recorded push_policy: "blocked" (was "${recorded}") in .arcane.json.`);
+    printInfo("Commit that change so the repository's posture stays visible to everyone.");
+  } else {
+    printSuccess('Push blocked. The manifest already recorded push_policy: "blocked"; it is now enforced.');
+  }
+}
+
 // src/commands/report.ts
 import { access as access5 } from "fs/promises";
-import { join as join17 } from "path";
+import { join as join19 } from "path";
 
 // src/modules/show-report/generate.ts
-import { mkdir as mkdir8, readdir as readdir10, readFile as readFile14, writeFile as writeFile11 } from "fs/promises";
-import { basename as basename3, dirname as dirname10, isAbsolute, join as join16, relative as relative3, resolve as resolve4 } from "path";
+import { mkdir as mkdir8, readdir as readdir11, readFile as readFile15, writeFile as writeFile11 } from "fs/promises";
+import { basename as basename3, dirname as dirname10, isAbsolute, join as join18, relative as relative3, resolve as resolve4 } from "path";
 
 // src/modules/show-report/model.ts
-import { readFile as readFile13 } from "fs/promises";
-import { join as join15 } from "path";
+import { readFile as readFile14 } from "fs/promises";
+import { join as join17 } from "path";
 
 // src/modules/show-report/plan-parser.ts
 function parseFrontmatter(content) {
@@ -6716,7 +7479,7 @@ async function getCast(cwd, fromRef, toRef, generatedOutputs = []) {
 // src/modules/show-report/model.ts
 async function readOptional(path4) {
   try {
-    return await readFile13(path4, "utf8");
+    return await readFile14(path4, "utf8");
   } catch {
     return null;
   }
@@ -6812,13 +7575,13 @@ function buildCorrections(ledgerRows, programName) {
   };
 }
 async function buildShowReportModel(options) {
-  const planAbsPath = join15(options.rootDir, options.planRelPath);
-  const queueAbsPath = join15(options.rootDir, options.queueRelPath);
+  const planAbsPath = join17(options.rootDir, options.planRelPath);
+  const queueAbsPath = join17(options.rootDir, options.queueRelPath);
   const ledgerRelPath = "docs/verification-ledger.md";
-  const ledgerAbsPath = join15(options.rootDir, ledgerRelPath);
-  const decisionsAbsPath = join15(options.rootDir, "DECISIONS.md");
+  const ledgerAbsPath = join17(options.rootDir, ledgerRelPath);
+  const decisionsAbsPath = join17(options.rootDir, "DECISIONS.md");
   const [planContent, queueContent, ledgerContent, decisionsContent] = await Promise.all([
-    readFile13(planAbsPath, "utf8"),
+    readFile14(planAbsPath, "utf8"),
     readOptional(queueAbsPath),
     readOptional(ledgerAbsPath),
     readOptional(decisionsAbsPath)
@@ -6987,7 +7750,7 @@ function toPosix(path4) {
 async function programFromPlan(rootDir, slug, planRelPath) {
   let planContent;
   try {
-    planContent = await readFile14(join16(rootDir, planRelPath), "utf8");
+    planContent = await readFile15(join18(rootDir, planRelPath), "utf8");
   } catch {
     return { skipped: { slug, reason: `no PLAN.md at ${planRelPath}` } };
   }
@@ -6999,16 +7762,16 @@ async function programFromPlan(rootDir, slug, planRelPath) {
     program: {
       slug,
       planRelPath,
-      queueRelPath: toPosix(join16(dirname10(planRelPath), "OPERATOR-QUEUE.md")),
+      queueRelPath: toPosix(join18(dirname10(planRelPath), "OPERATOR-QUEUE.md")),
       ledgerProgramName: programNameFromTitle(frontmatter.title ?? slug)
     }
   };
 }
 async function discoverPrograms(rootDir) {
-  const plansDir = join16(rootDir, "docs", "plans");
+  const plansDir = join18(rootDir, "docs", "plans");
   let entries;
   try {
-    entries = (await readdir10(plansDir, { withFileTypes: true })).filter((e) => e.isDirectory());
+    entries = (await readdir11(plansDir, { withFileTypes: true })).filter((e) => e.isDirectory());
   } catch (error) {
     if (error.code === "ENOENT") return { programs: [], skipped: [] };
     throw error;
@@ -7032,14 +7795,14 @@ function normalizeLineEndings2(content) {
 }
 async function readOptionalFile(path4) {
   try {
-    return await readFile14(path4, "utf8");
+    return await readFile15(path4, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
   }
 }
 async function generateReport(rootDir, program2, templateHtml) {
-  const planContent = await readFile14(join16(rootDir, program2.planRelPath), "utf8");
+  const planContent = await readFile15(join18(rootDir, program2.planRelPath), "utf8");
   const frontmatter = parseFrontmatter(planContent);
   const model = await buildShowReportModel({
     rootDir,
@@ -7057,7 +7820,7 @@ async function generateReport(rootDir, program2, templateHtml) {
   };
 }
 async function runReportGeneration(options) {
-  const templateHtml = await readFile14(options.templatePath, "utf8");
+  const templateHtml = await readFile15(options.templatePath, "utf8");
   const drifted = [];
   const repaired = [];
   const unwritten = [];
@@ -7072,12 +7835,12 @@ async function runReportGeneration(options) {
       [`${outRel}/show-report.html`, generated.html]
     ];
     for (const [relPath, expected] of outputs) {
-      const actual = await readOptionalFile(join16(options.rootDir, relPath));
+      const actual = await readOptionalFile(join18(options.rootDir, relPath));
       if (actual === null || normalizeLineEndings2(actual) !== normalizeLineEndings2(expected)) {
         drifted.push(`${relPath} does not match a regeneration from its sources.`);
         if (options.mode === "write") {
           await mkdir8(outAbs, { recursive: true });
-          await writeFile11(join16(options.rootDir, relPath), expected, "utf8");
+          await writeFile11(join18(options.rootDir, relPath), expected, "utf8");
           repaired.push(relPath);
         }
       }
@@ -7088,7 +7851,7 @@ async function runReportGeneration(options) {
 
 // src/commands/report.ts
 async function runReport(targetDir, options = {}, assetsDir) {
-  const templatePath = join17(assetsDir, "report", "show-report.template.html");
+  const templatePath = join19(assetsDir, "report", "show-report.template.html");
   try {
     await access5(templatePath);
   } catch {
@@ -7151,13 +7914,29 @@ async function runReport(targetDir, options = {}, assetsDir) {
 import { realpathSync } from "fs";
 var require3 = createRequire2(import.meta.url);
 var pkg = require3("../package.json");
-var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join18(dirname11(fileURLToPath(import.meta.url)), "assets");
+var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join20(dirname11(fileURLToPath(import.meta.url)), "assets");
 var program = new Command();
 var USER_FLAG_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 spells shared by every repository on this machine, fanned out to ~/.agents/skills (Codex, Copilot) and ~/.claude/commands (Claude Code)";
 var USER_TIER_AGENTS_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 one agent roster shared by every repository on this machine, rendered to ~/.copilot/agents (VS Code agent modes)";
 function targetDirFor(opts) {
   return opts.user ? userTierRoot() : process.cwd();
 }
+function withManifestFlags(command) {
+  return command.option("--role <role>", "Answer the hub question: hub | consumer").option("--tracking-mode <mode>", "Answer the tracking question: internal | external (external needs --external-provider)").option("--external-provider <provider>", "With --tracking-mode external: ado | github | jira | other").option("--content-sensitivity <level>", "Answer the content question: standard | sensitive").option(
+    "--push-policy <policy>",
+    "Answer the push question: open | guarded | blocked. Can tighten a recorded policy, never loosen it (use `spell unblock-push`)"
+  ).option("--subject-root <path>", "Answer the subject question with a directory (docs profile)");
+}
+function manifestFlagsFrom(opts) {
+  return {
+    role: opts.role,
+    trackingMode: opts.trackingMode,
+    externalProvider: opts.externalProvider,
+    contentSensitivity: opts.contentSensitivity,
+    pushPolicy: opts.pushPolicy,
+    subjectRoot: opts.subjectRoot
+  };
+}
 program.name("spell").description("Arcane framework CLI \u2014 scaffold and manage governance files").version(pkg.version).action(async () => {
   if (program.args.length > 0) {
     const [attempted] = program.args;
@@ -7177,14 +7956,17 @@ program.name("spell").description("Arcane framework CLI \u2014 scaffold and mana
   await printWelcome(pkg.version, process.cwd());
   program.outputHelp();
 });
-program.command("init").description("Scaffold Arcane framework files into the current repository").option("--profile <profile>", "Profile: full | lite | methodology | docs | governance-only").option("--force", "Overwrite existing files without error").option("--dry-run", "Preview what would be installed without making changes").option("--user", USER_FLAG_DESCRIPTION).action(
+withManifestFlags(
+  program.command("init").description("Scaffold Arcane framework files into the current repository").option("--profile <profile>", "Profile: full | lite | methodology | docs | governance-only").option("--force", "Overwrite existing files without error").option("--dry-run", "Preview what would be installed without making changes").option("--user", USER_FLAG_DESCRIPTION)
+).action(
   async (opts) => {
     await runInit(
       {
         profile: opts.profile,
         force: opts.force,
         dryRun: opts.dryRun,
-        user: opts.user
+        user: opts.user,
+        manifestFlags: manifestFlagsFrom(opts)
       },
       targetDirFor(opts),
       ASSETS_DIR,
@@ -7203,12 +7985,14 @@ program.command("add <component>").description("Add a component to an existing A
     );
   }
 );
-program.command("update").description("Update installed components to the current package version").option("--dry-run", "Preview what would be updated without making changes").option(
-  "--prune",
-  "Also delete orphaned managed files (tracked before this update, no longer part of any current component). Hash-checked: an edited file is reported, never silently deleted"
-).option("--user", USER_FLAG_DESCRIPTION).option(
-  "--default-scope <scope>",
-  "With --user: remember repo | user as the answer `spell init` pre-selects for NEW repositories on this machine. Never rewrites an existing repository, and the question is still asked"
+withManifestFlags(
+  program.command("update").description("Update installed components to the current package version").option("--dry-run", "Preview what would be updated without making changes").option(
+    "--prune",
+    "Also delete orphaned managed files (tracked before this update, no longer part of any current component). Hash-checked: an edited file is reported, never silently deleted"
+  ).option("--user", USER_FLAG_DESCRIPTION).option(
+    "--default-scope <scope>",
+    "With --user: remember repo | user as the answer `spell init` pre-selects for NEW repositories on this machine. Never rewrites an existing repository, and the question is still asked"
+  )
 ).action(async (opts) => {
   if (opts.defaultScope !== void 0) {
     if (!opts.user) {
@@ -7229,6 +8013,7 @@ program.command("update").description("Update installed components to the curren
       dryRun: opts.dryRun,
       prune: opts.prune,
       user: opts.user,
+      manifestFlags: manifestFlagsFrom(opts),
       ...opts.defaultScope === void 0 ? {} : { defaultScope: opts.defaultScope }
     },
     targetDirFor(opts),
@@ -7242,6 +8027,9 @@ program.command("status").description("Show installed components and check for u
 program.command("uninstall").description("Remove all installed Arcane framework files").option("--yes", "Skip confirmation prompt").option("--dry-run", "Preview what would be removed without deleting files").option("--user", USER_FLAG_DESCRIPTION).action(async (opts) => {
   await runUninstall({ yes: opts.yes, dryRun: opts.dryRun, user: opts.user }, targetDirFor(opts));
 });
+program.command("block-push").description("Enforce push_policy: blocked on this repository (pre-push hook + disabled push URLs); only ever tightens").action(async () => {
+  await runBlockPush(process.cwd());
+});
 program.command("unblock-push").description("Lift this repository's push block (interactive terminal only)").action(async () => {
   await runUnblockPush(process.cwd());
 });