bigpowers 2.75.1 → 2.76.0

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.75.1",
+  "version": "2.76.0",
   "description": "77 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/CHANGELOG.md

@@ -1,3 +1,23 @@
+# [2.76.0](https://github.com/danielvm-git/bigpowers/compare/v2.75.2...v2.76.0) (2026-07-07)
+
+
+### Bug Fixes
+
+* **ci:** add OKF type fields and gate wiki publish on WIKI_PAT ([9628122](https://github.com/danielvm-git/bigpowers/commit/96281227e91ebed19300daed8dd05d51d6021c9e))
+* **ci:** skip estimated commit_range check and wiki publish without PAT ([bf079ad](https://github.com/danielvm-git/bigpowers/commit/bf079ad384c4363980fe30383406d37629718b89))
+
+
+### Features
+
+* **e37:** Reach — Close release: AGENTS.md spine, targets.yaml registry, OSS waves A-E; fix 6 compliance bugs ([5a7f407](https://github.com/danielvm-git/bigpowers/commit/5a7f407008818cec518969a2b46e5ae28ee130bb))
+
+## [2.75.2](https://github.com/danielvm-git/bigpowers/compare/v2.75.1...v2.75.2) (2026-07-07)
+
+
+### Bug Fixes
+
+* **ci:** enforce blocking OKF validation and close bug audit gaps ([e502c62](https://github.com/danielvm-git/bigpowers/commit/e502c62583024df36bed086d8e44a871907632cd))
+
 ## [2.75.1](https://github.com/danielvm-git/bigpowers/compare/v2.75.0...v2.75.1) (2026-07-07)
 
 

package/bin/bigspec

@@ -1,2 +1,36 @@
 #!/usr/bin/env bash
-if [[ "$1" == "--with-wiki" ]]; then echo "wiki enabled"; fi
+# story: e48s10
+# bigspec — minimal project bootstrap helper
+
+print_wiki_setup() {
+  cat <<'EOF'
+Wiki publishing enabled.
+
+1. Create a GitHub Wiki for this repository (or use the .wiki.git remote).
+2. Configure CI secrets: WIKI_PAT (repo scope for wiki push).
+3. Set WIKI_REPO_URL to the wiki clone URL (e.g. https://github.com/org/repo.wiki.git).
+4. Dry-run locally: bash kernel/src/publish-to-wiki.sh --dry-run
+5. Publish on merge: .github/workflows/publish-wiki.yml (gates on validate-okf first).
+
+See docs/references/okf.md for OKF bundle layout and CI integration.
+EOF
+}
+
+case "${1:-}" in
+  init)
+    if [[ "${2:-}" == "--with-wiki" ]]; then
+      print_wiki_setup
+      exit 0
+    fi
+    echo "Usage: bigspec init [--with-wiki]"
+    exit 1
+    ;;
+  --with-wiki)
+    print_wiki_setup
+    exit 0
+    ;;
+  *)
+    echo "Usage: bigspec init [--with-wiki]"
+    exit 1
+    ;;
+esac

package/kernel/src/publish-to-wiki.sh

@@ -3,23 +3,148 @@
 # publish-to-wiki.sh — publish OKF bundles to a .wiki.git repository
 set -euo pipefail
 
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+HEADER="$ROOT/kernel/templates/wiki/header.md"
+EPICS_SRC="$ROOT/specs/epics-wiki"
+ADR_SRC="$ROOT/specs/adr-wiki"
+
 usage() {
   echo "Usage: $0 [--dry-run]"
-  echo "Publishes OKF concept bundles from specs/epics-wiki and specs/adr-wiki to the configured .wiki.git repository, rewriting links to wiki slug format."
+  echo "Publishes OKF concept bundles from specs/epics-wiki and specs/adr-wiki"
+  echo "to the configured wiki git repository, rewriting links to wiki slug format."
   exit 0
 }
 
-if [[ "${1:-}" == "--help" ]]; then
+wiki_slug_from_file() {
+  local base
+  base="$(basename "$1")"
+  base="${base%.okf.md}"
+  base="${base%.md}"
+  echo "$base"
+}
+
+rewrite_links() {
+  sed -E \
+    -e 's/\]\(([^)]*)\.okf\.md\)/](\1)/g' \
+    -e 's/\]\(([^)]*)\.md\)/](\1)/g' \
+    -e 's/\]\(specs\/[^)]+\/([^/)]+)\)/](\1)/g'
+}
+
+stage_bundle() {
+  local src="$1" section="$2" dest_root="$3"
+  local slug dest_dir dest_file
+  slug="$(wiki_slug_from_file "$src")"
+  dest_dir="$dest_root/$section"
+  dest_file="$dest_dir/${slug}.md"
+  mkdir -p "$dest_dir"
+  {
+    if [[ -f "$HEADER" ]]; then cat "$HEADER"; echo ""; fi
+    rewrite_links < "$src"
+  } > "$dest_file"
+  echo "$section/$slug.md"
+}
+
+collect_sources() {
+  local dir="$1"
+  if [[ -d "$dir" ]]; then
+    find "$dir" -maxdepth 1 -name '*.okf.md' -type f | sort
+  fi
+}
+
+publish_bundles() {
+  local dest_root="$1"
+  local -a pages=()
+  local src
+
+  rm -rf "$dest_root"
+  mkdir -p "$dest_root"
+
+  while IFS= read -r src; do
+    [[ -n "$src" ]] || continue
+    pages+=("$(stage_bundle "$src" "Epics" "$dest_root")")
+  done < <(collect_sources "$EPICS_SRC")
+
+  while IFS= read -r src; do
+    [[ -n "$src" ]] || continue
+    pages+=("$(stage_bundle "$src" "ADRs" "$dest_root")")
+  done < <(collect_sources "$ADR_SRC")
+
+  if [[ -f "$ROOT/kernel/templates/wiki/_Sidebar.md" ]]; then
+    cp "$ROOT/kernel/templates/wiki/_Sidebar.md" "$dest_root/_Sidebar.md"
+    pages+=("_Sidebar.md")
+  fi
+
+  printf '%s\n' "${pages[@]}"
+}
+
+push_to_wiki() {
+  local staged_root="$1"
+  local wiki_repo="${WIKI_REPO_URL:-}"
+  local work_dir="${WIKI_WORK_DIR:-}"
+
+  if [[ -z "$wiki_repo" ]]; then
+    echo "publish-to-wiki: WIKI_REPO_URL is not set — skipping push" >&2
+    return 0
+  fi
+
+  local clone_url="$wiki_repo"
+  if [[ -n "${WIKI_PAT:-}" && "$wiki_repo" == https://* ]]; then
+    clone_url="${wiki_repo/https:\/\//https://x-access-token:${WIKI_PAT}@}"
+  fi
+
+  if [[ -z "$work_dir" ]]; then
+    work_dir="$(mktemp -d)"
+    trap 'rm -rf "$work_dir"' EXIT
+  fi
+
+  if [[ -d "$work_dir/.git" ]]; then
+    git -C "$work_dir" pull --rebase origin master 2>/dev/null || git -C "$work_dir" pull --rebase origin main
+  else
+    git clone "$clone_url" "$work_dir"
+  fi
+
+  rsync -a --delete "$staged_root/" "$work_dir/"
+  git -C "$work_dir" add -A
+  if git -C "$work_dir" diff --cached --quiet; then
+    echo "publish-to-wiki: no wiki changes to push"
+    return 0
+  fi
+  git -C "$work_dir" -c user.name="bigpowers-bot" -c user.email="bot@bigpowers.local" \
+    commit -m "chore(wiki): sync OKF bundles from main"
+  git -C "$work_dir" push origin HEAD
+}
+
+if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
   usage
 fi
 
 DRY_RUN=0
 if [[ "${1:-}" == "--dry-run" ]]; then
   DRY_RUN=1
-  echo "[Dry Run] Would publish OKF bundles to wiki."
+fi
+
+STAGING="$(mktemp -d)"
+trap 'rm -rf "$STAGING"' EXIT
+
+mapfile -t PAGES < <(publish_bundles "$STAGING")
+PAGE_COUNT="${#PAGES[@]}"
+
+if [[ "$PAGE_COUNT" -eq 0 ]]; then
+  echo "publish-to-wiki: no OKF bundles found under specs/epics-wiki or specs/adr-wiki" >&2
+  exit 1
+fi
+
+echo "publish-to-wiki: pages: $PAGE_COUNT"
+printf '  - %s\n' "${PAGES[@]}"
+
+if [[ "$DRY_RUN" -eq 1 ]]; then
+  echo "publish-to-wiki: dry-run complete (staged under $STAGING)"
+  exit 0
+fi
+
+if [[ -z "${WIKI_PAT:-}" ]]; then
+  echo "publish-to-wiki: WIKI_PAT not set — skipping wiki push"
   exit 0
 fi
 
-# Logic to map OKF kinds to wiki sections, render markdown, rewrite relative links, and push
-echo "publish-to-wiki: Rewriting links and publishing to wiki..."
-exit 0
+push_to_wiki "$STAGING"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.75.1",
+  "version": "2.76.0",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/audit-compliance.sh

@@ -1,9 +1,8 @@
 #!/usr/bin/env bash
 # audit-compliance.sh — Agentic Gherkin Compliance Harness (LLM-Judge Upgrade)
 
-_LIB="$(dirname "${BASH_SOURCE[0]}")/lib"
-source "$_LIB/audit-compliance-runner.sh"
-source "$_LIB/audit-compliance-report.sh"
+source "$(dirname "${BASH_SOURCE[0]}")/lib/audit-compliance-runner.sh"
+source "$(dirname "${BASH_SOURCE[0]}")/lib/audit-compliance-report.sh"
 
 audit_show_help() {
   cat <<EOF

package/scripts/build-receipts.sh

@@ -6,7 +6,7 @@ source "$(dirname "${BASH_SOURCE[0]}")/lib/python-env.sh"
 ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || { echo "build-receipts: not inside a git repo" >&2; exit 1; }
 OUTFILE="$ROOT/specs/receipts.json"
 TIMESTAMP="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-emit_json() {
+receipts_emit_json() {
   $PYTHON -c "
 import json, sys, os, subprocess, glob as gb
 sections = {}
@@ -103,6 +103,6 @@ for key, sec in sections.items(): print(f'  {key}: source={sec.get(\"source\",\"
 "
 }
 echo "build-receipts: aggregating quality evidence..."
-emit_json
+receipts_emit_json
 echo "build-receipts: done — $(date -u +%H:%M:%SZ)"
 exit 0

package/scripts/build-skill-graph.sh

@@ -12,7 +12,7 @@ GRAPH_JSONL="$REPO_ROOT/bigpowers-mcp/graph.jsonl"
 SKILL_GRAPH_JSON="$REPO_ROOT/specs/skill-graph.json"
 SKILLS_WIKI="$REPO_ROOT/specs/skills-wiki/skills"
 
-show_help() {
+skill_graph_show_help() {
   cat <<EOF
 Usage: $(basename "$0") [OPTION]
 

package/scripts/check-spec-drift.sh

@@ -10,7 +10,7 @@ REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 TRACE_MATRIX="$REPO_ROOT/specs/traceability-matrix.json"
 DRIFT_REPORT="$REPO_ROOT/specs/drift-report.json"
 
-show_help() {
+drift_show_help() {
   cat <<EOF
 Usage: $(basename "$0") [OPTION]
 
@@ -23,7 +23,7 @@ EOF
 }
 
 if [ "$#" -eq 1 ] && [ "$1" = "--help" ]; then
-  show_help
+  drift_show_help
   exit 0
 fi
 

package/scripts/check-spec-version-gap.sh

@@ -5,7 +5,7 @@ source "$(dirname "${BASH_SOURCE[0]}")/lib/python-env.sh"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 BP_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 
-usage() {
+gap_usage() {
   cat <<'EOF'
 Usage: check-spec-version-gap.sh [--help] [--project <dir>] [--json]
 Exit codes: 0=no gap, 1=gap, 2=no specs, 3=blocked, 4=error
@@ -18,7 +18,7 @@ JSON_STDOUT=false
 SKIP_BLOCK=false
 while [[ $# -gt 0 ]]; do
   case "$1" in
-    --help|-h) usage ;;
+    --help|-h) gap_usage ;;
     --project) PROJECT_DIR="${2:?}"; shift 2 ;;
     --json) JSON_STDOUT=true; shift ;;
     --skip-block) SKIP_BLOCK=true; shift ;;
@@ -29,7 +29,7 @@ done
 PROJECT_DIR="$(cd "$PROJECT_DIR" 2>/dev/null && pwd)" || { echo "bad dir: $PROJECT_DIR" >&2; exit 4; }
 SPECS="$PROJECT_DIR/specs"
 
-emit_json() {
+gap_emit_json() {
   if $JSON_STDOUT; then echo "$1"; else echo "$1" >&2; fi
 }
 
@@ -37,7 +37,7 @@ get_installed_version() {
   $PYTHON -c "import json; d=json.load(open('$BP_ROOT/package.json')); print(d.get('version','unknown'))" 2>/dev/null || echo "unknown"
 }
 
-yaml_get() {
+gap_yaml_get() {
   [[ ! -f "$1" ]] && { echo ""; return; }
   $PYTHON -c "
 import sys, yaml
@@ -116,29 +116,29 @@ check_active_work() {
   branch=$(git -C "$PROJECT_DIR" branch --show-current 2>/dev/null || echo "")
   if on_feature_branch "$branch"; then echo "true"; return; fi
   if has_dirty_specs; then echo "true"; return; fi
-  af=$(yaml_get "$SPECS/state.yaml" "active_flow")
+  af=$(gap_yaml_get "$SPECS/state.yaml" "active_flow")
   if is_blocking_active_flow "$af"; then echo "true"; return; fi
   echo "false"
 }
 
 # Main
-[[ ! -d "$SPECS" ]] && { emit_json '{"gap":false,"reason":"NO_SPECS"}'; exit 2; }
+[[ ! -d "$SPECS" ]] && { gap_emit_json '{"gap":false,"reason":"NO_SPECS"}'; exit 2; }
 IV=$(get_installed_version)
 if [ "$SKIP_BLOCK" != "true" ] && [[ "$(check_active_work)" == "true" ]]; then
-  emit_json '{"gap":true,"blocked":true,"reason":"ACTIVE_WORK","installed_version":"'"$IV"'"}'
+  gap_emit_json '{"gap":true,"blocked":true,"reason":"ACTIVE_WORK","installed_version":"'"$IV"'"}'
   exit 3
 fi
 
-SV=$(yaml_get "$SPECS/state.yaml" "bigpowers_version")
+SV=$(gap_yaml_get "$SPECS/state.yaml" "bigpowers_version")
 
 if yaml_value_set "$SV"; then
   if [[ "$SV" == "$IV" ]]; then
-    emit_json '{"gap":false,"stamp":true,"detected_version":"'"$SV"'","installed_version":"'"$IV"'","detection_method":"stamp","confidence":"high"}'
+    gap_emit_json '{"gap":false,"stamp":true,"detected_version":"'"$SV"'","installed_version":"'"$IV"'","detection_method":"stamp","confidence":"high"}'
     exit 0
   fi
   APP=$(find_migrations "$SV")
   CNT=$(echo "$APP" | $PYTHON -c "import json,sys; print(len(json.load(sys.stdin)))" 2>/dev/null || echo 0)
-  emit_json "$($PYTHON -c "import json; a=json.loads('''$APP'''); print(json.dumps({'gap':True,'stamp':True,'detected_version':'$SV','detection_method':'stamp','installed_version':'$IV','applicable_migrations':len(a),'migration_ids':[m['id'] for m in a],'confidence':'high','active_work_blocked':False}))")"
+  gap_emit_json "$($PYTHON -c "import json; a=json.loads('''$APP'''); print(json.dumps({'gap':True,'stamp':True,'detected_version':'$SV','detection_method':'stamp','installed_version':'$IV','applicable_migrations':len(a),'migration_ids':[m['id'] for m in a],'confidence':'high','active_work_blocked':False}))")"
   exit 1
 fi
 
@@ -150,7 +150,7 @@ for f in release-plan.yaml execution-status.yaml product/SCOPE_LATEST.yaml metri
   [[ -f "$SPECS/$f" ]] && { MARKERS+=("$f"); [[ -z "$DV" ]] && DV="2.0.0"; }
 done
 if [[ -f "$SPECS/state.yaml" ]]; then
-  ec=$(yaml_get "$SPECS/state.yaml" "epic_cycle.current_step")
+  ec=$(gap_yaml_get "$SPECS/state.yaml" "epic_cycle.current_step")
   if yaml_value_set "$ec"; then
     MARKERS+=("epic_cycle"); [[ "$DV" == "2.0.0" ]] && DV="2.20.0"
   fi
@@ -161,12 +161,12 @@ fi
 [[ -z "$DV" ]] && { DV="unknown"; CONF="low"; }
 
 if [[ "$DV" != "unknown" ]] && ! version_lt "$DV" "$IV"; then
-  [[ "$DV" == "$IV" ]] && { emit_json '{"gap":false,"stamp":false,"detected_version":"'"$DV"'","installed_version":"'"$IV"'","detection_method":"fingerprint","confidence":"'"$CONF"'"}'; exit 0; }
+  [[ "$DV" == "$IV" ]] && { gap_emit_json '{"gap":false,"stamp":false,"detected_version":"'"$DV"'","installed_version":"'"$IV"'","detection_method":"fingerprint","confidence":"'"$CONF"'"}'; exit 0; }
 fi
 
 APP=$(find_migrations "$DV")
 CNT=$(echo "$APP" | $PYTHON -c "import json,sys; print(len(json.load(sys.stdin)))" 2>/dev/null || echo 0)
 MJ=$(printf '%s\n' "${MARKERS[@]}" | $PYTHON -c "import json,sys; print(json.dumps([l.strip() for l in sys.stdin if l.strip()]))" 2>/dev/null || echo "[]")
 
-emit_json "$($PYTHON -c "import json; a=json.loads('''$APP'''); m=json.loads('''$MJ'''); print(json.dumps({'gap':True,'stamp':False,'detected_version':'$DV','detection_method':'fingerprint','installed_version':'$IV','applicable_migrations':len(a),'migration_ids':[x['id'] for x in a],'confidence':'$CONF','active_work_blocked':False,'matched_markers':m}))")"
+gap_emit_json "$($PYTHON -c "import json; a=json.loads('''$APP'''); m=json.loads('''$MJ'''); print(json.dumps({'gap':True,'stamp':False,'detected_version':'$DV','detection_method':'fingerprint','installed_version':'$IV','applicable_migrations':len(a),'migration_ids':[x['id'] for x in a],'confidence':'$CONF','active_work_blocked':False,'matched_markers':m}))")"
 exit 1

package/scripts/compile-rule-matrix.sh

@@ -10,7 +10,7 @@ CONVENTIONS="$REPO_ROOT/CONVENTIONS.md"
 OUTPUT="$REPO_ROOT/specs/rule-matrix.json"
 MATRIX_VERSION="1.0.0"
 
-show_help() {
+matrix_show_help() {
   cat <<EOF
 Usage: $(basename "$0") [OPTION]
 
@@ -26,7 +26,7 @@ EOF
 STDOUT_ONLY=0
 if [ "$#" -eq 1 ]; then
   case "$1" in
-    --help) show_help; exit 0 ;;
+    --help) matrix_show_help; exit 0 ;;
     --stdout) STDOUT_ONLY=1 ;;
     *) echo "[ERROR] Unknown option: $1" >&2; exit 1 ;;
   esac

package/scripts/decompose-conventions.sh

@@ -11,7 +11,7 @@ CONVENTIONS_WIKI="$REPO_ROOT/specs/conventions-wiki"
 CONVENTIONS_INDEX="$CONVENTIONS_WIKI/index.md"
 SKILL_GRAPH="$REPO_ROOT/specs/skill-graph.json"
 
-show_help() {
+decompose_show_help() {
   cat <<EOF
 Usage: $(basename "$0") [OPTION]
 
@@ -24,7 +24,7 @@ EOF
 }
 
 if [ "$#" -eq 1 ] && [ "$1" = "--help" ]; then
-  show_help
+  decompose_show_help
   exit 0
 fi
 

package/scripts/generate-adr-wiki.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# story: e48s01
 # story: e45s01 e45s06
 # generate-adr-wiki.sh — emit OKF concept bundles from specs/adr/*.md
 set -euo pipefail
@@ -16,7 +17,7 @@ fi
 
 count=0
 
-assign_tier() {
+adr_wiki_assign_tier() {
   local adr_id="$1"
   case "$adr_id" in
     ADR-0001|ADR-0002|ADR-0003|0001-*|0002-*|0003-*) echo "core" ;;
@@ -54,7 +55,7 @@ if len(parts) >= 3:
   fi
   [ -z "$title" ] && title="$adr_name"
 
-  tier=$(assign_tier "$adr_name")
+  tier=$(adr_wiki_assign_tier "$adr_name")
 
   bundle="$WIKI/${adr_name}.okf.md"
 

package/scripts/generate-agent-guide.sh

@@ -9,7 +9,7 @@ REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 CLAUDE_MD="$REPO_ROOT/CLAUDE.md"
 AGENT_GUIDE="$REPO_ROOT/specs/agent-guide"
 
-show_help() {
+agent_guide_show_help() {
   cat <<EOF
 Usage: $(basename "$0") [OPTION]
 
@@ -22,7 +22,7 @@ EOF
 }
 
 if [ "$#" -eq 1 ] && [ "$1" = "--help" ]; then
-  show_help
+  agent_guide_show_help
   exit 0
 fi
 

package/scripts/generate-epics-wiki.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# story: e48s01
 # story: e45s01 e45s06
 # generate-epics-wiki.sh — emit OKF concept bundles from specs/epics/*/epic.yaml
 set -euo pipefail
@@ -15,7 +16,7 @@ extract() {
 
 count=0
 
-assign_tier() {
+epics_wiki_assign_tier() {
   local epic_id="$1"
   case "$epic_id" in
     e28|e38|e40|e41|e44|e45|e46) echo "core" ;;
@@ -42,7 +43,7 @@ for epic_yaml in "$ROOT"/specs/epics/*/epic.yaml "$ROOT"/specs/epics/archive/*/e
 
   [[ -z "$epic_id" ]] && continue
 
-  tier=$(assign_tier "$epic_id")
+  tier=$(epics_wiki_assign_tier "$epic_id")
 
   # Build references array from story list
   story_count=$(grep -c '^\s*- id:' "$epic_yaml" 2>/dev/null || true)

package/scripts/hooks/token-mgmt-pre-tool-use.sh

@@ -7,7 +7,7 @@ READ_MAX_BYTES=102400   # 100KB
 GREP_MAX_MATCHES=200
 BASH_WARN_PATTERNS='^(npm test|pnpm test|yarn test|cargo test|go test|jest|vitest|pytest|rake test|rspec|git log|git diff|docker logs|kubectl logs|find |rg |grep )'
 
-deny() {
+token_mgmt_deny() {
   echo "TOKEN-MGMT BLOCK: $1" >&2
   echo "Use sqz_read_file / sqz_grep / rtk / bts compress per CLAUDE.md § Token Management." >&2
   exit 2
@@ -23,16 +23,16 @@ case "$TOOL" in
     [[ -n "$PATH_ARG" && -f "$PATH_ARG" ]] || exit 0
     SIZE="$(wc -c < "$PATH_ARG" | tr -d ' ')"
     if (( SIZE > READ_MAX_BYTES )); then
-      deny "Read $PATH_ARG is ${SIZE} bytes (max ${READ_MAX_BYTES}). Use sqz_read_file or bts compress."
+      token_mgmt_deny "Read $PATH_ARG is ${SIZE} bytes (max ${READ_MAX_BYTES}). Use sqz_read_file or bts compress."
     fi
     ;;
   Grep|grep)
     LIMIT="$(echo "$TOOL_INPUT" | jq -r '.head_limit // .max_matches // empty')"
     if [[ -z "$LIMIT" || "$LIMIT" == "null" ]]; then
-      deny "Grep without head_limit (max ${GREP_MAX_MATCHES}). Set head_limit<=${GREP_MAX_MATCHES} or use sqz_grep."
+      token_mgmt_deny "Grep without head_limit (max ${GREP_MAX_MATCHES}). Set head_limit<=${GREP_MAX_MATCHES} or use sqz_grep."
     fi
     if [[ "$LIMIT" =~ ^[0-9]+$ ]] && (( LIMIT > GREP_MAX_MATCHES )); then
-      deny "Grep head_limit=${LIMIT} exceeds ${GREP_MAX_MATCHES}. Lower limit or use sqz_grep."
+      token_mgmt_deny "Grep head_limit=${LIMIT} exceeds ${GREP_MAX_MATCHES}. Lower limit or use sqz_grep."
     fi
     ;;
   Bash|bash|Shell|shell)
@@ -42,7 +42,7 @@ case "$TOOL" in
       exit 0
     fi
     if echo "$CMD" | grep -qE "$BASH_WARN_PATTERNS"; then
-      deny "Bash may exceed 500 lines of output. Prefix with rtk or pipe through sqz compress."
+      token_mgmt_deny "Bash may exceed 500 lines of output. Prefix with rtk or pipe through sqz compress."
     fi
     ;;
   *)

package/scripts/land-branch.sh

@@ -13,7 +13,7 @@ usage_land() {
   exit 1
 }
 
-deny() {
+land_branch_deny() {
   echo "ERROR: $1" >&2
   exit 1
 }
@@ -34,16 +34,16 @@ COMMIT_MSG="${ARGS[1]:-}"
 [ -n "$FEATURE_BRANCH" ] && [ -n "$COMMIT_MSG" ] || usage_land
 
 if [[ ! "$COMMIT_MSG" =~ $CONVENTIONAL_REGEX ]]; then
-  deny "Commit message must follow Conventional Commits: <type>(<scope>): <subject>"
+  land_branch_deny "Commit message must follow Conventional Commits: <type>(<scope>): <subject>"
 fi
 
 if [ ${#COMMIT_MSG} -gt 72 ]; then
-  deny "Commit subject line must be 72 characters or less"
+  land_branch_deny "Commit subject line must be 72 characters or less"
 fi
 
 # Primary worktree only (.git is a directory, not a gitdir pointer file)
 if [ -f .git ]; then
-  deny "Run from the primary repository root, not a linked worktree (cd to main repo first)"
+  land_branch_deny "Run from the primary repository root, not a linked worktree (cd to main repo first)"
 fi
 
 detect_default_branch() {
@@ -58,7 +58,7 @@ detect_default_branch() {
   elif git show-ref --verify --quiet refs/heads/master; then
     echo "master"
   else
-    deny "Could not detect default branch (main/master)"
+    land_branch_deny "Could not detect default branch (main/master)"
   fi
 }
 
@@ -69,12 +69,12 @@ echo "==> Land branch: $FEATURE_BRANCH -> $DEFAULT_BRANCH"
 echo "    Repo root: $REPO_ROOT"
 
 if ! git show-ref --verify --quiet "refs/heads/$FEATURE_BRANCH"; then
-  deny "Feature branch '$FEATURE_BRANCH' does not exist"
+  land_branch_deny "Feature branch '$FEATURE_BRANCH' does not exist"
 fi
 
 for protected in main master; do
   if [ "$FEATURE_BRANCH" = "$protected" ]; then
-    deny "Cannot land protected branch '$FEATURE_BRANCH'"
+    land_branch_deny "Cannot land protected branch '$FEATURE_BRANCH'"
   fi
 done
 
@@ -115,15 +115,15 @@ fi
 echo "==> Updating $DEFAULT_BRANCH"
 git checkout "$DEFAULT_BRANCH"
 if ! git diff-index --quiet HEAD -- 2>/dev/null; then
-  deny "Working tree on $DEFAULT_BRANCH is not clean. Stash or commit first."
+  land_branch_deny "Working tree on $DEFAULT_BRANCH is not clean. Stash or commit first."
 fi
 
 if git remote get-url origin >/dev/null 2>&1; then
-  git pull --ff-only origin "$DEFAULT_BRANCH" || deny "git pull --ff-only failed; resolve before landing"
+  git pull --ff-only origin "$DEFAULT_BRANCH" || land_branch_deny "git pull --ff-only failed; resolve before landing"
 fi
 
 if ! git merge-base --is-ancestor "$DEFAULT_BRANCH" "$FEATURE_BRANCH" 2>/dev/null; then
-  deny "Feature branch '$FEATURE_BRANCH' is not based on current $DEFAULT_BRANCH (rebase or recreate branch)"
+  land_branch_deny "Feature branch '$FEATURE_BRANCH' is not based on current $DEFAULT_BRANCH (rebase or recreate branch)"
 fi
 
 export GIT_BIGPOWERS_LAND=1
@@ -131,7 +131,7 @@ export GIT_BIGPOWERS_LAND=1
 echo "==> Squash merge $FEATURE_BRANCH"
 git merge --squash "$FEATURE_BRANCH"
 if git diff-index --quiet HEAD -- 2>/dev/null; then
-  deny "Squash merge produced no changes (already merged?)"
+  land_branch_deny "Squash merge produced no changes (already merged?)"
 fi
 
 git commit -m "$COMMIT_MSG"

package/scripts/lib/audit-compliance-report.sh

@@ -26,6 +26,7 @@ audit_write_okf_report() {
 ---
 okf_kind: verification-report
 okf_version: "0.1"
+type: VerificationReport
 score: ${SCORE}
 gate_status: "${GATE}"
 threshold: 94

package/scripts/lib/emit-okf-metrics.sh

@@ -31,6 +31,7 @@ emit_okf_metrics() {
     printf -- '---\n'
     printf -- 'okf_kind: story-metrics\n'
     printf -- 'okf_version: "0.1"\n'
+    printf -- 'type: StoryMetrics\n'
     printf -- 'id: %s\n' "$story"
     printf -- 'epic: %s\n' "${story%%s*}"
     printf -- 'bcps: %s\n' "$bcps"

package/scripts/lib/golden-suite-report.sh

@@ -80,6 +80,7 @@ YAML_EOF
 ---
 okf_kind: verification-report
 okf_version: "0.1"
+type: VerificationReport
 score: ${PASS_RATE}
 gate_status: "${GATE_STATUS}"
 threshold: ${THRESHOLD}

package/scripts/lib/golden-suite-run.sh

@@ -32,7 +32,11 @@ golden_suite_main() {
     esac
   done
 
-  if $AGENT_MODE && ! command -v gh-aw &>/dev/null && ! command -v gh &>/dev/null; then
+  golden_agent_cli_available() {
+    $AGENT_MODE && ! command -v gh-aw &>/dev/null && ! command -v gh &>/dev/null
+  }
+
+  if golden_agent_cli_available; then
     echo -e "${GOLDEN_YELLOW}WARNING: gh-aw not installed — agent gate skipped${GOLDEN_NC}" >&2
     AGENT_MODE=false
   fi