b2c-app-builder 0.221.39

package/checks/validation/repository/fixtures/repository-profile.fixtures.ts

@@ -0,0 +1,244 @@
+import { cpSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { stringify as stringifyYaml } from "yaml";
+import { REPOSITORY_PROFILE_REVISION, repositoryProfileIds } from "../../../../catalog/repository-profiles/types.js";
+import { writeCompleteAiProviderControls } from "./_builders-ops.js";
+import { skillRoot, type Harness, readState, writeState } from "./_harness.js";
+
+const GATE = "check-repository-profile.ts";
+
+function acceptProfile(root: string, id: (typeof repositoryProfileIds)[number]): void {
+  const state = readState(root);
+  const project = state.project as Record<string, unknown>;
+  project.repositoryProfile = {
+    id,
+    revision: REPOSITORY_PROFILE_REVISION,
+    acceptedAt: "2026-08-24T00:00:00.000Z",
+  };
+  writeState(root, state);
+}
+
+function writeOverlay(root: string, body: Record<string, unknown>): void {
+  mkdirSync(path.join(root, "state"), { recursive: true });
+  writeFileSync(path.join(root, "state/repository-profile.yaml"), stringifyYaml(body), "utf8");
+}
+
+function writeCommunityFrontDoor(root: string): void {
+  writeFileSync(path.join(root, "CONTRIBUTING.md"), "# Contributing\n\nOpen a pull request.\n", "utf8");
+  mkdirSync(path.join(root, ".github"), { recursive: true });
+  writeFileSync(path.join(root, ".github/SECURITY.md"), "# Security\n\nReport issues to security@example.com.\n", "utf8");
+  writeFileSync(path.join(root, ".github/CODE_OF_CONDUCT.md"), "# Code Of Conduct\n\nBe respectful.\n", "utf8");
+}
+
+function writeNamedNotApplicablePaidGeneration(root: string): void {
+  mkdirSync(path.join(root, "trust"), { recursive: true });
+  writeFileSync(
+    path.join(root, "trust/AI_PROVIDER_CONTROLS.md"),
+    "# AI Provider Controls\n\nPaid generation: not applicable — on-device models with no provider API\n",
+    "utf8",
+  );
+}
+
+function appendPaidProviderEvidence(root: string): void {
+  const specPath = path.join(root, "PRODUCT.md");
+  writeFileSync(specPath, `${readFileSync(specPath, "utf8")}\nThe product calls the OpenAI Responses API for paid generation.\n`, "utf8");
+}
+
+export function register(harness: Harness): void {
+  const run = (label: string, root: string, expectedCode: number, expectedText?: string, extraArgs: string[] = [], forbiddenText?: string): void => {
+    harness.runFixture(label, root, GATE, expectedCode, expectedText, extraArgs, undefined, forbiddenText);
+  };
+
+  {
+    const root = harness.makeFixture("repository-profile-default-routing");
+    run("repository-profile without an explicit profile uses default routing", root, 0, "0 error(s)");
+  }
+
+  for (const id of repositoryProfileIds) {
+    const root = harness.makeFixture(`repository-profile-${id}`);
+    acceptProfile(root, id);
+    if (id === "public-package") writeCommunityFrontDoor(root);
+    run(`repository-profile ${id} compiles`, root, 0, "0 error(s)");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-write-inventory");
+    acceptProfile(root, "founder-operating");
+    run("repository-profile writes the generated inventory", root, 0, "0 error(s)", ["--write"]);
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-founder-no-community");
+    acceptProfile(root, "founder-operating");
+    run("repository-profile founder-operating does not require community files", root, 0, "0 error(s)");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-public-missing-front-door");
+    acceptProfile(root, "public-package");
+    run("repository-profile public-package missing community files fails", root, 1, "repository_profile.front_door_missing");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-missing-canonical");
+    acceptProfile(root, "app-source");
+    rmSync(path.join(root, "PRODUCT.md"), { force: true });
+    run("repository-profile fails when a required canonical artifact is missing", root, 1, "repository_profile.canonical_missing");
+  }
+
+  {
+    const root = harness.makeEmptyFixture("repository-profile-overlay-missing-canonical");
+    writeOverlay(root, {
+      id: "founder-operating",
+      revision: REPOSITORY_PROFILE_REVISION,
+      acceptedAt: "2026-08-24T00:00:00.000Z",
+    });
+    run("repository-profile overlay-only founder-operating misses business-state.json", root, 1, "repository_profile.canonical_missing");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-suppression");
+    acceptProfile(root, "founder-operating");
+    writeOverlay(root, {
+      id: "founder-operating",
+      revision: REPOSITORY_PROFILE_REVISION,
+      acceptedAt: "2026-08-24T00:00:00.000Z",
+      suppress_gates: ["check:privacy"],
+    });
+    run("repository-profile fails when a profile suppresses a safety gate", root, 1, "repository_profile.safety_suppressed");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-generated-as-source");
+    acceptProfile(root, "app-source");
+    writeOverlay(root, {
+      id: "app-source",
+      revision: REPOSITORY_PROFILE_REVISION,
+      acceptedAt: "2026-08-24T00:00:00.000Z",
+      canonical_paths: ["state/generated/requirement-inventory.json"],
+    });
+    run("repository-profile fails when a generated projection is listed as source", root, 1, "repository_profile.generated_as_source");
+  }
+
+  {
+    const root = harness.makeEmptyFixture("repository-profile-unknown-id");
+    writeOverlay(root, { id: "private-lab", revision: REPOSITORY_PROFILE_REVISION, acceptedAt: "2026-08-24T00:00:00.000Z" });
+    run("repository-profile fails on an unknown profile id", root, 1, "repository_profile.unknown_id");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-revision-stale");
+    acceptProfile(root, "founder-operating");
+    const state = readState(root);
+    (state.project as Record<string, unknown>).repositoryProfile = {
+      id: "founder-operating",
+      revision: "rev-stale",
+      acceptedAt: "2026-08-24T00:00:00.000Z",
+    };
+    writeState(root, state);
+    run("repository-profile fails on a stale revision", root, 1, "repository_profile.revision_stale");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-id-conflict");
+    acceptProfile(root, "founder-operating");
+    writeOverlay(root, {
+      id: "app-source",
+      revision: REPOSITORY_PROFILE_REVISION,
+      acceptedAt: "2026-08-24T00:00:00.000Z",
+    });
+    run("repository-profile fails when overlay and project ids conflict", root, 1, "repository_profile.id_conflict");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-paid-ai-pack-missing");
+    writeCompleteAiProviderControls(root);
+    run("repository-profile fails when paid AI is active without the control pack", root, 1, "repository_profile.paid_ai_pack_missing");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-paid-ai-pack-pinned");
+    writeCompleteAiProviderControls(root);
+    writeOverlay(root, { composition_packs: ["capability.paid-generative-ai"] });
+    run("repository-profile passes when paid AI is pinned to the control pack", root, 0, "0 error(s)");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-paid-ai-unanchored-not-applicable");
+    writeCompleteAiProviderControls(root);
+    writeFileSync(
+      path.join(root, "trust/AI_PROVIDER_CONTROLS.md"),
+      `${readFileSync(path.join(root, "trust/AI_PROVIDER_CONTROLS.md"), "utf8")}\nThe feature paid generation: not applicable in some regions.\n`,
+      "utf8",
+    );
+    run("repository-profile does not skip the paid-AI pack on an unanchored not-applicable phrase", root, 1, "repository_profile.paid_ai_pack_missing");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-paid-ai-not-applicable-with-evidence");
+    writeNamedNotApplicablePaidGeneration(root);
+    appendPaidProviderEvidence(root);
+    run("repository-profile fails when product evidence overrides a named not-applicable line", root, 1, "repository_profile.paid_ai_pack_missing");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-paid-ai-not-applicable-named-skip");
+    writeNamedNotApplicablePaidGeneration(root);
+    run("repository-profile passes a named not-applicable paid-generation skip without product evidence", root, 0, "0 error(s)");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-overlay-invalid-yaml");
+    writeFileSync(
+      path.join(root, "state/repository-profile.yaml"),
+      ["- id: public-package", `  revision: ${REPOSITORY_PROFILE_REVISION}`, '  acceptedAt: "2026-08-24T00:00:00.000Z"', ""].join("\n"),
+      "utf8",
+    );
+    run("repository-profile fails when overlay YAML is not a mapping", root, 1, "repository_profile.overlay_invalid", [], "front_door_missing");
+  }
+
+  {
+    const root = harness.makeFixture("repository-profile-acceptance-incomplete");
+    writeOverlay(root, { id: "public-package" });
+    run(
+      "repository-profile does not activate a profile from an incomplete overlay",
+      root,
+      1,
+      "repository_profile.acceptance_incomplete",
+      [],
+      "front_door_missing",
+    );
+  }
+
+  {
+    const root = harness.makeEmptyFixture("no-slop-founder-operating-front-door");
+    const repoRoot = path.join(root, "repo");
+    const fixtureSkillRoot = path.join(repoRoot, "skill", "pkg");
+    mkdirSync(path.join(fixtureSkillRoot, "knowledge", "words"), { recursive: true });
+    mkdirSync(path.join(repoRoot, "state"), { recursive: true });
+    writeFileSync(path.join(repoRoot, "README.md"), "# Example\n\nA plain description of what this project does.\n", "utf8");
+    writeFileSync(path.join(repoRoot, "AGENTS.md"), "# Agents\n\nFollow the repository conventions documented here.\n", "utf8");
+    writeFileSync(path.join(repoRoot, "CLAUDE.md"), "# Claude Instructions\n\nFollow the repository conventions documented here.\n", "utf8");
+    writeFileSync(
+      path.join(repoRoot, "state/business-state.json"),
+      JSON.stringify({
+        schemaVersion: "2.0.0",
+        project: {
+          repositoryProfile: {
+            id: "founder-operating",
+            revision: REPOSITORY_PROFILE_REVISION,
+            acceptedAt: "2026-08-24T00:00:00.000Z",
+          },
+        },
+      }),
+      "utf8",
+    );
+    cpSync(path.join(skillRoot, "knowledge/words/no-slop-writing.md"), path.join(fixtureSkillRoot, "knowledge/words/no-slop-writing.md"));
+    harness.runScriptArgs(
+      "no-slop skips public community files for founder-operating",
+      "check-no-slop.ts",
+      ["--repo-root", repoRoot, "--skill-root", fixtureSkillRoot],
+      0,
+    );
+  }
+}

package/checks/validation/repository/fixtures/roster.fixtures.ts

@@ -0,0 +1,62 @@
+import { copyFileSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { type Harness } from "./_harness.js";
+
+const AGENTS_DIR = "engineering/app-agent-roster/agents";
+
+export function register(h: Harness): void {
+  const { makeFixture, runFixture, runFixtureJson } = h;
+
+  const baseline = makeFixture("roster-baseline");
+  runFixture("shipped roster has no near-duplicate role pair", baseline, "check-roster-overlap.ts", 0);
+  runFixture("shipped roster carries no human-in-the-loop language", baseline, "check-roster-headless-safety.ts", 0);
+
+  const duplicate = makeFixture("roster-overlap-duplicate");
+  copyFileSync(path.join(duplicate, AGENTS_DIR, "mobile-engineer.md"), path.join(duplicate, AGENTS_DIR, "backend-infrastructure-engineer.md"));
+  runFixture(
+    "a role file copied onto another fails the overlap check as a warning",
+    duplicate,
+    "check-roster-overlap.ts",
+    0,
+    "roster_overlap.jaccard_similarity_high",
+  );
+  runFixtureJson(
+    "overlap warning still passes --json (warning-tier, not error-tier)",
+    duplicate,
+    "check-roster-overlap.ts",
+    0,
+    "roster_overlap.jaccard_similarity_high",
+  );
+
+  const distinct = makeFixture("roster-overlap-distinct");
+  runFixtureJson("distinct roster reports no overlap warning over --json", distinct, "check-roster-overlap.ts", 0);
+
+  const humanInTheLoop = makeFixture("roster-headless-unsafe");
+  const targetPath = path.join(humanInTheLoop, AGENTS_DIR, "mobile-engineer.md");
+  writeFileSync(targetPath, `${readFileSync(targetPath, "utf8")}\nIf unsure, ask the founder before continuing.\n`);
+  runFixture(
+    "human-in-the-loop language in a role file fails the headless-safety check",
+    humanInTheLoop,
+    "check-roster-headless-safety.ts",
+    1,
+    "roster_headless_safety.if_unsure_ask",
+  );
+  runFixtureJson(
+    "headless-safety failure reports the matched phrase's rule over --json",
+    humanInTheLoop,
+    "check-roster-headless-safety.ts",
+    1,
+    "roster_headless_safety.if_unsure_ask",
+  );
+
+  const waitForApproval = makeFixture("roster-headless-unsafe-wait-for-approval");
+  const waitTargetPath = path.join(waitForApproval, AGENTS_DIR, "customer-success.md");
+  writeFileSync(waitTargetPath, `${readFileSync(waitTargetPath, "utf8")}\nWait for approval before sending any reply.\n`);
+  runFixture(
+    "'wait for approval' language fails the headless-safety check",
+    waitForApproval,
+    "check-roster-headless-safety.ts",
+    1,
+    "roster_headless_safety.wait_for_approval",
+  );
+}

package/checks/validation/repository/fixtures/runtime-sync.fixtures.ts

@@ -0,0 +1,286 @@
+import { spawnSync } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { skillRoot, type Harness } from "./_harness.js";
+
+/**
+ * Fixtures for the ownership-tracked installed-runtime sync. Conflicts block,
+ * bootstrap requires --adopt, unowned files survive, owned orphans are deleted,
+ * and a clean tree reports no drift.
+ */
+
+function git(cwd: string, args: string[]): void {
+  const result = spawnSync("git", ["-c", "user.email=fixture@test", "-c", "user.name=fixture", ...args], { cwd, encoding: "utf8" });
+  if (result.status !== 0) throw new Error(`git ${args.join(" ")} failed in ${cwd}: ${result.stderr}`);
+}
+
+/** A git-tracked source tree (git ls-files is the tool's source manifest). */
+function writeSourceTree(root: string): string {
+  const source = path.join(root, "source");
+  mkdirSync(path.join(source, "sub"), { recursive: true });
+  writeFileSync(path.join(source, "a.txt"), "alpha v1\n");
+  writeFileSync(path.join(source, "sub", "b.txt"), "beta v1\n");
+  writeFileSync(path.join(source, "skill-version.json"), JSON.stringify({ version: "0.0.1-fixture" }));
+  git(source, ["init", "-q"]);
+  git(source, ["add", "-A"]);
+  git(source, ["commit", "-qm", "fixture"]);
+  return source;
+}
+
+export function register(harness: Harness): void {
+  // Real verified sync: npm installs a local Prettier package, then the actual
+  // audit runner executes its genuine formatting validator and excludes the
+  // repository-only boundary check. The selected plan avoids recursive audits.
+  {
+    const root = harness.makeEmptyFixture("runtime-sync-verified-audit");
+    const source = writeSourceTree(root);
+    const runtime = path.join(root, "runtime");
+    for (const relative of ["tooling/run-audit.ts", "tooling/lib/audit-plan.ts", "tooling/lib/runtime-sync-lib.ts"]) {
+      mkdirSync(path.dirname(path.join(source, relative)), { recursive: true });
+      copyFileSync(path.join(skillRoot, relative), path.join(source, relative));
+    }
+    mkdirSync(path.join(source, ".github"));
+    writeFileSync(path.join(source, ".github", "fixture.yml"), "name: fixture\n");
+    writeFileSync(path.join(source, "payload.json"), '{ "fixture": true }\n');
+    const original = JSON.parse(readFileSync(path.join(skillRoot, "package.json"), "utf8"));
+    const boundaryScript = original.scripts["check:repository-boundary"].replace("tsx ", `tsx ${skillRoot}/`);
+    writeFileSync(
+      path.join(source, "package.json"),
+      JSON.stringify(
+        {
+          name: "verified-runtime-fixture",
+          version: "0.0.1",
+          type: "module",
+          private: true,
+          devDependencies: { prettier: `file:${path.join(skillRoot, "node_modules/prettier")}` },
+          scripts: {
+            audit: `node ${JSON.stringify(path.join(skillRoot, "node_modules/tsx/dist/cli.mjs"))} tooling/run-audit.ts --only lint:format --only check:repository-boundary`,
+            "lint:format": "prettier --check payload.json",
+            "check:repository-boundary": boundaryScript,
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+    git(source, ["add", "-A"]);
+    git(source, ["commit", "-qm", "verified audit fixture"]);
+    const args = ["sync", "--source", source, "--installed", runtime, "--runtimes-root", path.join(root, "clients")];
+    harness.runScriptArgs("verified runtime sync succeeds despite copied github metadata", "runtime-sync.ts", args, 0, "Maintainer audit (skill layout");
+    const success = harness.results.at(-1)!.output;
+    if (!success.includes("lint:format — ok") || success.includes("[2/2] check:repository-boundary"))
+      throw new Error("Verified sync did not run its real formatter with repository gates excluded.");
+    writeFileSync(path.join(source, "payload.json"), '{"fixture":true}');
+    git(source, ["add", "payload.json"]);
+    git(source, ["commit", "-qm", "invalid format fixture"]);
+    harness.runScriptArgs("verified runtime sync propagates an actual installed formatting failure", "runtime-sync.ts", args, 1, "lint:format — FAILED");
+    const failed = harness.results.at(-1)!.output;
+    if (!failed.includes("Runtime audit failed") || failed.includes("Runtime now at source version"))
+      throw new Error("Failed installed validator did not fail sync before success reporting.");
+  }
+  const tool = "runtime-sync.ts";
+  const run = (label: string, args: string[], expectedCode: number, expectedText?: string): void => {
+    const isolatedArgs = args.includes("--runtimes-root") ? args : [...args, "--runtimes-root", path.join(harness.tempRoot, "isolated-client-roots")];
+    harness.runScriptArgs(label, tool, isolatedArgs, expectedCode, expectedText);
+  };
+  const syncArgs = (source: string, runtime: string, ...extra: string[]): string[] => [
+    "sync",
+    "--source",
+    source,
+    "--installed",
+    runtime,
+    "--no-verify",
+    ...extra,
+  ];
+
+  {
+    const root = harness.makeEmptyFixture("runtime-sync-invalid-manifest");
+    const source = writeSourceTree(root);
+    const runtime = path.join(root, "runtime");
+    mkdirSync(runtime);
+    const marker = path.join(runtime, ".runtime-sync-manifest.json");
+    writeFileSync(path.join(runtime, "a.txt"), "preserve runtime edit\n");
+    const valid = { schemaVersion: 1, sourceVersion: "unknown", syncedAt: "2026-09-08T00:00:00Z", files: {} };
+    for (const value of [
+      "{",
+      "null",
+      "[]",
+      JSON.stringify({ ...valid, files: null }),
+      JSON.stringify({ ...valid, files: [] }),
+      JSON.stringify({ ...valid, files: { "../escape": "a".repeat(64) } }),
+      JSON.stringify({ ...valid, files: { "a.txt": 7 } }),
+    ]) {
+      writeFileSync(marker, value);
+      run("invalid ownership manifest cannot grant adopt or force authority", syncArgs(source, runtime, "--adopt", "--force"), 1);
+      if (readFileSync(marker, "utf8") !== value || readFileSync(path.join(runtime, "a.txt"), "utf8") !== "preserve runtime edit\n")
+        throw new Error("Invalid manifest rejection mutated runtime.");
+    }
+  }
+
+  {
+    const root = harness.makeEmptyFixture("runtime-sync-flow");
+    const source = writeSourceTree(root);
+    const runtime = path.join(root, "runtime");
+    mkdirSync(runtime, { recursive: true });
+    writeFileSync(path.join(runtime, "custom.txt"), "user-owned\n");
+
+    run("runtime-sync check reports drift with exit 1", ["check", "--source", source, "--installed", runtime], 1, "Drift detected");
+
+    // Bootstrap with a differing runtime file: ownership unprovable, must refuse without --adopt.
+    writeFileSync(path.join(runtime, "a.txt"), "runtime edit\n");
+    run("runtime-sync refuses bootstrap conflicts without --adopt", syncArgs(source, runtime), 1, "Bootstrap conflicts");
+    if (existsSync(path.join(runtime, ".runtime-sync-manifest.json"))) {
+      throw new Error("runtime-sync wrote a manifest despite refusing the bootstrap");
+    }
+
+    run("runtime-sync bootstraps with --adopt", syncArgs(source, runtime, "--adopt"), 0, "0.0.1-fixture");
+    run("runtime-sync clean check after sync", ["check", "--source", source, "--installed", runtime], 0, "Runtime matches source");
+    if (!existsSync(path.join(runtime, "custom.txt"))) {
+      throw new Error("runtime-sync deleted an unowned file");
+    }
+
+    // Post-sync runtime edit: the drift-ahead failure. Sync must stop, not clobber.
+    writeFileSync(path.join(runtime, "a.txt"), "edited after sync\n");
+    run("runtime-sync blocks on a runtime edited since the last sync", syncArgs(source, runtime), 1, "edited since the last sync");
+    run("runtime-sync --force overwrites a conflicting edit deliberately", syncArgs(source, runtime, "--force"), 0, "Copied");
+
+    // Orphan-edit conflict under --force: the file was edited in the runtime AND
+    // dropped from source. Force means "adopt the source's state", and the
+    // source's state for a dropped path is absence — the file must be deleted,
+    // not silently kept and dropped from the manifest.
+    writeFileSync(path.join(runtime, "a.txt"), "edited orphan\n");
+    git(source, ["rm", "-q", "a.txt"]);
+    git(source, ["commit", "-qm", "drop a.txt"]);
+    run("runtime-sync refuses an orphan-edit conflict without --force", syncArgs(source, runtime), 1, "edited since the last sync");
+    if (!existsSync(path.join(runtime, "a.txt"))) {
+      throw new Error("runtime-sync deleted an orphan-edit conflict without --force");
+    }
+    run("runtime-sync --force deletes an orphan-edit conflict", syncArgs(source, runtime, "--force"), 0, "deleted 1");
+    if (existsSync(path.join(runtime, "a.txt"))) {
+      throw new Error("runtime-sync failed to delete a forced orphan-edit conflict");
+    }
+    if (!existsSync(path.join(runtime, "custom.txt"))) {
+      throw new Error("runtime-sync deleted an unowned file during orphan cleanup");
+    }
+  }
+
+  {
+    const root = harness.makeEmptyFixture("runtime-sync-scoped-aliases");
+    const source = writeSourceTree(root);
+    const runtime = path.join(root, "runtime");
+    const clientRoots = path.join(root, "clients");
+    const aliases = path.join(clientRoots, ".claude", "skills");
+    mkdirSync(aliases, { recursive: true });
+    const alias = path.join(aliases, "runtime");
+    symlinkSync(runtime, alias);
+    run(
+      "runtime-sync scopes alias diagnostics to --runtimes-root",
+      syncArgs(source, runtime, "--runtimes-root", clientRoots),
+      0,
+      `Alias ${alias}: resolves to the synced runtime`,
+    );
+  }
+
+  {
+    const root = harness.makeEmptyFixture("runtime-sync-retired-presentation");
+    const source = writeSourceTree(root);
+    const retired = ["tooling/render-launch-cockpit.ts", "examples/workspace/business/operations/business-control-plane.html"];
+    for (const relative of retired) {
+      const target = path.join(source, relative);
+      mkdirSync(path.dirname(target), { recursive: true });
+      writeFileSync(target, `managed retired file: ${relative}\n`);
+    }
+    git(source, ["add", "-A"]);
+    git(source, ["commit", "-qm", "presentation before retirement"]);
+    const managedRuntime = path.join(root, "managed-runtime");
+    const editedRuntime = path.join(root, "edited-runtime");
+    for (const runtime of [managedRuntime, editedRuntime]) {
+      run("runtime-sync records ownership before presentation retirement", syncArgs(source, runtime), 0);
+      writeFileSync(path.join(runtime, "unowned-notes.md"), "local notes survive retirement\n");
+    }
+    const editedPath = path.join(editedRuntime, retired[0]!);
+    writeFileSync(editedPath, "hand-edited retired renderer\n");
+    const oldManifest = readFileSync(path.join(editedRuntime, ".runtime-sync-manifest.json"), "utf8");
+    git(source, ["rm", "-q", ...retired]);
+    git(source, ["commit", "-qm", "retire presentation files"]);
+
+    run("runtime-sync removes unchanged managed retired files", syncArgs(source, managedRuntime), 0, "deleted 2");
+    for (const relative of retired) {
+      if (existsSync(path.join(managedRuntime, relative))) throw new Error(`Managed retired file survived cleanup: ${relative}`);
+    }
+    const manifest = JSON.parse(readFileSync(path.join(managedRuntime, ".runtime-sync-manifest.json"), "utf8")) as { files: Record<string, string> };
+    if (retired.some((relative) => Object.hasOwn(manifest.files, relative))) throw new Error("Retired paths remain in the ownership manifest.");
+    run("runtime-sync refuses retirement when an owned file has a hand edit", syncArgs(source, editedRuntime), 1, "edited since the last sync");
+    if (readFileSync(editedPath, "utf8") !== "hand-edited retired renderer\n") throw new Error("Retirement overwrote a hand-edited renderer.");
+    if (!existsSync(path.join(editedRuntime, retired[1]!))) throw new Error("Retirement partly deleted a runtime despite its conflict.");
+    if (readFileSync(path.join(editedRuntime, ".runtime-sync-manifest.json"), "utf8") !== oldManifest) {
+      throw new Error("A refused retirement changed ownership records.");
+    }
+    for (const runtime of [managedRuntime, editedRuntime]) {
+      if (readFileSync(path.join(runtime, "unowned-notes.md"), "utf8") !== "local notes survive retirement\n") {
+        throw new Error("Retirement changed an unowned runtime file.");
+      }
+    }
+  }
+
+  {
+    // Symlinked runtime directory: source paths under it must hard-block the
+    // sync (no force override), and the external tree must stay untouched.
+    const root = harness.makeEmptyFixture("runtime-sync-symlink");
+    const source = writeSourceTree(root);
+    const runtime = path.join(root, "runtime");
+    const outside = path.join(root, "outside");
+    mkdirSync(runtime, { recursive: true });
+    mkdirSync(outside, { recursive: true });
+    writeFileSync(path.join(outside, "b.txt"), "external content\n");
+    symlinkSync(outside, path.join(runtime, "sub"));
+
+    run("runtime-sync blocks source paths under a runtime symlink", syncArgs(source, runtime, "--adopt", "--force"), 1, "BLOCKED");
+    const external = readFileSync(path.join(outside, "b.txt"), "utf8");
+    if (external !== "external content\n") {
+      throw new Error("runtime-sync wrote through a symlinked runtime directory");
+    }
+    if (existsSync(path.join(runtime, ".runtime-sync-manifest.json"))) {
+      throw new Error("runtime-sync wrote a manifest despite a symlink block");
+    }
+  }
+
+  {
+    const root = harness.makeEmptyFixture("runtime-sync-all-clients");
+    const source = writeSourceTree(root);
+    const home = path.join(root, "home");
+    const claude = path.join(home, ".claude", "skills", "b2c-app-builder");
+    const codex = path.join(home, ".codex", "skills", "b2c-app-builder");
+    const agents = path.join(home, ".agents", "skills", "b2c-app-builder");
+    const cursor = path.join(home, ".cursor", "skills", "b2c-app-builder");
+    for (const client of [claude, agents, cursor]) mkdirSync(client, { recursive: true });
+
+    run("runtime-sync bootstraps Claude at v1", syncArgs(source, claude, "--adopt"), 0);
+    run("runtime-sync bootstraps Agents at v1", syncArgs(source, agents, "--adopt"), 0);
+    run("runtime-sync bootstraps Cursor at v1", syncArgs(source, cursor, "--adopt"), 0);
+    writeFileSync(path.join(source, "a.txt"), "alpha v2\n");
+    writeFileSync(path.join(source, "skill-version.json"), JSON.stringify({ version: "0.0.2-fixture" }));
+    git(source, ["add", "-A"]);
+    git(source, ["commit", "-qm", "bump"]);
+    mkdirSync(codex, { recursive: true });
+    run("runtime-sync writes Codex only without --all-clients", syncArgs(source, codex, "--adopt"), 0);
+    const allClientsArgs = ["--source", source, "--installed", codex, "--all-clients", "--runtimes-root", home];
+    run("runtime-sync check --all-clients fails while Claude, Agents, and Cursor are behind", ["check", ...allClientsArgs], 1, "behind");
+    run("runtime-sync sync --all-clients updates every configured client", ["sync", ...allClientsArgs, "--no-verify"], 0);
+    run("runtime-sync check --all-clients passes after sync", ["check", ...allClientsArgs], 0);
+    for (const [id, client] of [
+      ["Claude", claude],
+      ["Codex", codex],
+      ["Agents", agents],
+      ["Cursor", cursor],
+    ] as const) {
+      const clientVersion = JSON.parse(readFileSync(path.join(client, "skill-version.json"), "utf8")) as { version?: string };
+      if (clientVersion.version !== "0.0.2-fixture") {
+        throw new Error(`${id} runtime stayed at ${clientVersion.version ?? "unknown"} after --all-clients sync`);
+      }
+      if (readFileSync(path.join(client, "a.txt"), "utf8") !== "alpha v2\n") {
+        throw new Error(`${id} runtime files stayed stale after --all-clients sync`);
+      }
+    }
+  }
+}