bigpowers 2.87.6 → 2.87.8

package/.gemini/extensions/bigpowers/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.87.6",
+  "version": "2.87.8",
   "description": "81 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "gemini-extension"

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.87.6",
+  "version": "2.87.8",
   "description": "81 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [2.87.8](https://github.com/danielvm-git/bigpowers/compare/v2.87.7...v2.87.8) (2026-09-01)
+
+
+### Bug Fixes
+
+* **cli:** bigpowers init provisions scripts/ + specs/ into consumer projects ([#117](https://github.com/danielvm-git/bigpowers/issues/117)) ([37bc0bf](https://github.com/danielvm-git/bigpowers/commit/37bc0bf72875cd66898d35138870982c8af2d310)), closes [#116](https://github.com/danielvm-git/bigpowers/issues/116) [#116](https://github.com/danielvm-git/bigpowers/issues/116) [#114](https://github.com/danielvm-git/bigpowers/issues/114) [#116](https://github.com/danielvm-git/bigpowers/issues/116) [#114](https://github.com/danielvm-git/bigpowers/issues/114)
+
+## [2.87.7](https://github.com/danielvm-git/bigpowers/compare/v2.87.6...v2.87.7) (2026-09-01)
+
+
+### Bug Fixes
+
+* **packaging:** ship wire-ci CI templates in the npm tarball ([#115](https://github.com/danielvm-git/bigpowers/issues/115)) ([26df32b](https://github.com/danielvm-git/bigpowers/commit/26df32bc88310950863715dc26ca9c97dcaa4601)), closes [#113](https://github.com/danielvm-git/bigpowers/issues/113)
+
 ## [2.87.6](https://github.com/danielvm-git/bigpowers/compare/v2.87.5...v2.87.6) (2026-09-01)
 
 

package/README.md

@@ -216,6 +216,25 @@ pi install .
 pi install npm:bigpowers
 ```
 
+### Provision a consumer project (`bigpowers init`)
+
+pi's package contract registers **skills and prompts only** — it has no resource
+type for arbitrary project files, and no lifecycle script runs on install. Skills
+reference the package's `scripts/*.sh` tooling project-relative (e.g.
+`bash scripts/run-skill-verify.sh`, verify gates like `test -f scripts/... &&
+test -d specs/bugs`), so after installing the package, run **one command per
+consumer project** to provision what the skills expect:
+
+```bash
+cd <your-project>
+npx bigpowers init        # or: bigpowers init
+```
+
+This symlinks `<project>/scripts` → the installed package's `scripts/` tree and
+scaffolds `specs/bugs/` + `specs/verifications/`. It refuses (never clobbers) a
+`scripts/` you already own; `bigpowers init --remove` undoes it. The same step
+applies to `npm i -g bigpowers` / `npx bigpowers setup` consumers.
+
 **What you get:**
 - **pi skills** in `.pi/skills/` (one per SKILL.md) — loaded automatically into pi's system prompt as `<available_skills>`
 - **pi prompt templates** in `.pi/prompts/` — slash commands like `/survey-context`, `/plan-work`

package/bin/bigpowers.js

@@ -75,6 +75,13 @@ if (cmd === 'setup' || cmd === 'install') {
   return;
 }
 
+if (cmd === 'init') {
+  // Provision the CURRENT project (cwd): scripts/ link + specs/ scaffolding (#116)
+  const initScript = path.join(ROOT, 'bin', 'init.js');
+  require(initScript);
+  return;
+}
+
 if (cmd === 'update') {
   // Pull the newest release first (global installs), then re-sync + refresh symlinks.
   selfUpdateGlobalPackage();
@@ -106,6 +113,7 @@ bigpowers — agent skills for spec-driven, test-first development
 
 Commands:
   bigpowers setup    Install skills into ~/.claude/skills/
+  bigpowers init     Provision the CURRENT project: scripts/ link + specs/ scaffolding (run per project)
   bigpowers update   Fetch the latest release (global installs) + re-sync and refresh symlinks
   bigpowers status   Show installed version and skill count (warns if a newer release exists)
   bigpowers help     This message

package/bin/init.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+// bigpowers init — provision the CURRENT project (cwd) for skill tooling.
+// story: BUG-2026-08-31-pi-scripts-provisioning (#116)
+//
+// Package installs (pi install npm:bigpowers, npm i -g, npx) register skills
+// but never provision a project-local scripts/ tree — pi's package contract
+// has no resource type for project files and no lifecycle script runs — so
+// SKILL.md commands (`bash scripts/*.sh`) and `→ verify:` gates fail in every
+// consumer project. `bigpowers init` (or `npx bigpowers init`) links the
+// package's scripts/ into the project and scaffolds specs/{bugs,verifications}.
+
+'use strict';
+
+const path = require('path');
+
+const ROOT = path.dirname(path.dirname(__filename));
+const { initProject, initProjectRemove } = require('../scripts/lib/install-helpers.js');
+
+if (process.argv.includes('--remove')) {
+  initProjectRemove(ROOT);
+  console.log('bigpowers init --remove: removed the managed scripts/ link');
+  console.log('  (and specs/ scaffolding dirs only where untouched).');
+  process.exit(0);
+}
+
+try {
+  const result = initProject(ROOT);
+  if (result.skipped === 'cwd-is-package') {
+    console.log('bigpowers init: already inside the bigpowers package — nothing to provision.');
+  } else {
+    console.log('bigpowers init: linked scripts/ → package scripts tree.');
+    console.log('bigpowers init: ensured specs/bugs/ + specs/verifications/ scaffolding.');
+    console.log('Skill commands and verify gates (fix-bug, verify-work, wire-ci, …) now resolve here.');
+  }
+} catch (e) {
+  // e.g. Refusing to replace a user-owned scripts/ — surface it, don't stack-trace.
+  console.error(`bigpowers init: ${e.message}`);
+  process.exit(1);
+}

package/docs/templates/AGENTS.md

@@ -0,0 +1,89 @@
+# story: e37s01
+# story: e45s21
+# story: e81s01
+# scenario: SC-e37s01-P1-01
+# [Project Name] — AI Agents
+
+> **Multi-agent context** — This file is the canonical project context for **Cline**, **Aider**, **OpenCode**, and other AGENTS.md-native tools. Claude Code and Cursor read it via the `CLAUDE.md` symlink.
+
+Read CONVENTIONS.md before any GitHub or git operation.
+
+<!-- BEGIN bigpowers:context-routing -->
+## Context Routing
+
+Load subdirectory context by file glob — see project-specific routing table (seeded by `seed-conventions`).
+<!-- END bigpowers:context-routing -->
+
+<!-- BEGIN bigpowers:learned-preferences -->
+## Learned User Preferences
+
+- (none yet — updated via `session-state`)
+
+## Workspace Facts
+
+- (none yet — durable facts discovered across sessions)
+<!-- END bigpowers:learned-preferences -->
+
+<!-- BEGIN bigpowers:project -->
+## Project
+
+[One sentence. What this codebase does.]
+Stack: [language, framework, runtime]
+
+## Commands
+
+| Action | Command |
+|--------|---------|
+| Run | `[cmd]` |
+| Test | `[cmd]` or N/A |
+| Build | `[cmd]` |
+| Lint | `[cmd]` |
+| Preflight | `[test && lint && build chain — or user-named full-green cmd]` |
+| CI | `gh pr checks` (when a PR is open) |
+
+## Test
+
+`[cmd]` or N/A
+
+## Lint
+
+`[cmd]` or N/A
+
+## Build
+
+`[cmd]` or N/A
+
+## Architecture
+
+[1–2 sentences. Key modules and their relationships.]
+
+## Conventions
+
+- [e.g. Named exports only]
+- [e.g. All queries go through the repository layer]
+
+## Never
+
+- Never dismiss reproducible gate failures as pre-existing or out of scope
+- Never proceed on red Preflight or red CI — invoke quick-fix or fix-bug first
+- [Hard stop — e.g. Never touch legacy/]
+
+## Agent Rules
+
+- **Workflow Mandate:** Use bigpowers skills (e.g. `plan-work`, `develop-tdd`) for structured work.
+- **Always Green:** Preflight and CI must be green before forward work.
+- Read specs/ and CONVENTIONS.md before writing code.
+- Write the minimum code that solves the stated problem.
+- Run tests after every change. Show evidence before declaring done.
+- All planning output goes in specs/.
+
+## Token Economy — Minimal Footprint
+
+> Production-safe subset of the 8-rule AGENTS.md pattern (Vercel engineer, ~60B tokens).
+> Rule 1 ("no backward compatibility") is excluded deliberately: it risks data loss in production.
+
+1. **Check existing dependencies first.** DO inspect what your current dependencies already do before adding a package or writing your own code.
+2. **Prefer mature, maintained libraries.** DO NOT rewrite a capability a maintained library provides without a documented reason.
+3. **Copy validated patterns.** DO study how established products solve the same problem before inventing a new approach.
+4. **Keep the simplest working implementation.** DO write the least code that satisfies the stated requirement. NEVER add preventive abstraction or unused config layers.
+<!-- END bigpowers:project -->

package/docs/templates/ci/github/test-build-release-go.yml

@@ -0,0 +1,68 @@
+# Bundled bigpowers CI template — Go. See test-build-release-node.yml for
+# the override mechanism (BIGPOWERS_CI_TEMPLATES). GH #104.
+name: Test Build Release
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      # Read the version from go.mod so `go vet` cannot drift from the module.
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+      - run: go vet ./...
+
+  test:
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+      - run: go test ./... -race
+
+  build:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+      - run: go build ./...
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: bin/
+          if-no-files-found: ignore
+
+  release:
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: bin/
+        continue-on-error: true
+      - run: echo "Add your release step (goreleaser, gh release create, ...) here"

package/docs/templates/ci/github/test-build-release-node.yml

@@ -0,0 +1,87 @@
+# Bundled bigpowers CI template — Node.
+# Ships inside the npm package so `wire-ci` has no network dependency on any
+# third party's repository (GH #104). Override the source with
+# BIGPOWERS_CI_TEMPLATES=/path/to/your/templates to use your own org templates.
+#
+# Keep `name:` as "Test Build Release" — deploy.yml listens for it via workflow_run.
+name: Test Build Release
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run lint --if-present
+
+  test:
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm test
+
+  build:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run build --if-present
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: ignore
+
+  release:
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      # Reuse the build output rather than rebuilding — a rebuilt binary is not
+      # the artifact that was tested.
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+        continue-on-error: true
+      - run: npx semantic-release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

package/docs/templates/ci/github/test-build-release-python.yml

@@ -0,0 +1,74 @@
+# Bundled bigpowers CI template — Python. See test-build-release-node.yml for
+# the override mechanism (BIGPOWERS_CI_TEMPLATES). GH #104.
+name: Test Build Release
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+env:
+  PYTHON_VERSION: '3.12'
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache: pip
+      - run: pip install -r requirements.txt
+      - run: ruff check .
+
+  test:
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          cache: pip
+      - run: pip install -r requirements.txt
+      - run: pytest
+
+  build:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      - run: pip install build
+      - run: python -m build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: ignore
+
+  release:
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true

package/docs/templates/ci/github/test-build-release-rust.yml

@@ -0,0 +1,67 @@
+# Bundled bigpowers CI template — Rust. See test-build-release-node.yml for
+# the override mechanism (BIGPOWERS_CI_TEMPLATES). GH #104.
+name: Test Build Release
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo fmt --check
+      # Pin clippy to the stable toolchain above: new nightly lints otherwise
+      # break CI on days nobody changed the code.
+      - run: cargo clippy --all-targets -- -D warnings
+
+  test:
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo test --all
+
+  build:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo build --release
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: target/release/
+          if-no-files-found: ignore
+
+  release:
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo publish --no-verify
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.87.6",
+  "version": "2.87.8",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/lib/install-helpers.js

@@ -36,7 +36,11 @@ function assertReplaceable(dst) {
   }
   if (st.isSymbolicLink()) {
     const target = fs.readlinkSync(dst);
-    if (target.startsWith(REPO_ROOT)) return; // managed by bigpowers — safe to re-link
+    // Path-separator boundary: a string-prefix sibling of the package root
+    // (e.g. <ROOT>-evil) is NOT managed by this package.
+    if (target === REPO_ROOT || target.startsWith(REPO_ROOT + path.sep)) {
+      return; // managed by bigpowers — safe to re-link
+    }
   }
   throw new Error(
     `Refusing to replace ${dst}: it exists and is not a bigpowers-managed symlink. ` +
@@ -416,6 +420,52 @@ function installLocal(tool, repoRoot) {
   }
 }
 
+// ── Project provisioning (bigpowers init) ────────────────────────────────────
+
+// Provision the CURRENT project (cwd) with the package's scripts/ tree and the
+// specs/ scaffolding skill bodies assume. Package installs (pi, npm -g, npx)
+// register skills but pi's package contract has no resource type for project
+// files and no lifecycle script runs — so `bash scripts/*.sh` invocations and
+// `→ verify:` gates in SKILL.md files fail outside a bigpowers checkout. (#116)
+function initProject(repoRoot) {
+  const cwd = process.cwd();
+  if (path.resolve(cwd) === path.resolve(repoRoot)) {
+    return { skipped: 'cwd-is-package' };
+  }
+  linkDir(path.join(repoRoot, 'scripts'), path.join(cwd, 'scripts'));
+  const created = [];
+  for (const rel of [path.join('specs', 'bugs'), path.join('specs', 'verifications')]) {
+    const dir = path.join(cwd, rel);
+    if (!fs.existsSync(dir)) {
+      fs.mkdirSync(dir, { recursive: true });
+      created.push(rel);
+    }
+  }
+  return { skipped: null, scriptsLinked: true, created };
+}
+
+// Inverse of initProject: remove ONLY the managed scripts symlink and specs/
+// scaffolding dirs we created (and only while untouched — user content survives).
+function initProjectRemove(repoRoot) {
+  const cwd = process.cwd();
+  const scriptsLink = path.join(cwd, 'scripts');
+  try {
+    if (fs.lstatSync(scriptsLink).isSymbolicLink()
+      && fs.readlinkSync(scriptsLink) === path.join(repoRoot, 'scripts')) {
+      fs.unlinkSync(scriptsLink);
+    }
+  } catch {}
+  for (const rel of [path.join('specs', 'bugs'), path.join('specs', 'verifications'), 'specs']) {
+    const dir = path.join(cwd, rel);
+    try {
+      if (fs.existsSync(dir) && fs.statSync(dir).isDirectory()
+        && fs.readdirSync(dir).length === 0) {
+        fs.rmdirSync(dir);
+      }
+    } catch {}
+  }
+}
+
 // ── Uninstall per tool ───────────────────────────────────────────────────────
 
 function uninstallTool(toolId, repoRoot) {
@@ -694,6 +744,8 @@ module.exports = {
   linkHook,
   installGlobal,
   installLocal,
+  initProject,
+  initProjectRemove,
   uninstallTool,
   removeSymlink,
   detectExistingInstall,

package/scripts/test-install-helpers.js

@@ -230,6 +230,7 @@ try {
       '.cursor/rules',
       '.pi/skills',
       'skills/audit-code/SKILL.md',
+      'docs/templates/ci/github/test-build-release-node.yml',
     ];
     const isIgnored = (p) =>
       npmignore.some((pat) => {
@@ -244,6 +245,118 @@ try {
     }
   }
 
+  // story: #113 — wire-ci templates must actually ship in the npm tarball.
+  // The .npmignore pattern check above is necessary but not sufficient (it
+  // cannot model gitignore negation); prove it with a real pack listing.
+  {
+    const { execSync } = require('child_process');
+    const packOut = execSync('npm pack --dry-run 2>&1', {
+      cwd: ROOT,
+      encoding: 'utf8',
+      maxBuffer: 16 * 1024 * 1024,
+    });
+    for (const tpl of [
+      'docs/templates/ci/github/test-build-release-node.yml',
+      'docs/templates/ci/github/test-build-release-rust.yml',
+      'docs/templates/ci/github/test-build-release-python.yml',
+      'docs/templates/ci/github/test-build-release-go.yml',
+      'docs/templates/AGENTS.md',
+    ]) {
+      assert.ok(
+        packOut.includes(tpl),
+        `npm tarball must include ${tpl} (wire-ci templates, #113)`
+      );
+    }
+  }
+
+  // story: BUG-2026-08-31-pi-scripts-provisioning (#116)
+  // A package consumer project needs bigpowers' scripts/ + specs/ scaffolding
+  // so SKILL.md bodies ("bash scripts/run-skill-verify.sh") and verify gates
+  // ("test -f scripts/... && test -d specs/bugs") resolve outside a checkout.
+  {
+    const { initProject, initProjectRemove } = require('../scripts/lib/install-helpers.js');
+    const savedInitCwd = process.cwd();
+    const consumerDir = mkdtempSync(path.join(os.tmpdir(), 'bp-init-project-'));
+    try {
+      process.chdir(consumerDir);
+
+      // (a) init provisions scripts/ + specs/ scaffolding
+      initProject(ROOT);
+      assert.ok(
+        fs.lstatSync(path.join(consumerDir, 'scripts')).isSymbolicLink(),
+        'init must symlink scripts/ into the consumer project'
+      );
+      assert.strictEqual(
+        fs.readlinkSync(path.join(consumerDir, 'scripts')),
+        path.join(ROOT, 'scripts'),
+        'scripts symlink must point at the package scripts tree'
+      );
+      assert.ok(
+        fs.existsSync(path.join(consumerDir, 'scripts', 'run-skill-verify.sh')),
+        'scripts/run-skill-verify.sh must resolve through the link (skill verify gate)'
+      );
+      assert.ok(
+        fs.existsSync(path.join(consumerDir, 'specs', 'bugs')),
+        'init must scaffold specs/bugs (fix-bug verify gate probes it)'
+      );
+      assert.ok(
+        fs.existsSync(path.join(consumerDir, 'specs', 'verifications')),
+        'init must scaffold specs/verifications'
+      );
+
+      // (b) init --remove cleans managed artifacts only
+      initProjectRemove(ROOT);
+      assert.ok(
+        !fs.existsSync(path.join(consumerDir, 'scripts')),
+        'init --remove must remove the managed scripts symlink'
+      );
+      assert.ok(
+        !fs.existsSync(path.join(consumerDir, 'specs')),
+        'init --remove must remove the untouched scaffolded specs tree'
+      );
+
+      // (c) refuses a pre-existing non-managed scripts/ (never clobbers)
+      fs.mkdirSync(path.join(consumerDir, 'scripts'));
+      fs.writeFileSync(path.join(consumerDir, 'scripts', 'mine.sh'), 'echo mine\n');
+      assert.throws(
+        () => initProject(ROOT),
+        /Refusing to replace/,
+        'init must refuse a user-owned scripts/ dir'
+      );
+      assert.ok(
+        fs.existsSync(path.join(consumerDir, 'scripts', 'mine.sh')),
+        'user-owned scripts/ content must survive the refusal'
+      );
+    } finally {
+      process.chdir(savedInitCwd);
+      rmSync(consumerDir, { recursive: true, force: true });
+    }
+
+    // (d) CLI dispatch drift guard: `bigpowers init` must stay wired
+    const bigpowersSrc = fs.readFileSync(path.join(ROOT, 'bin', 'bigpowers.js'), 'utf8');
+    assert.ok(
+      /'init'/.test(bigpowersSrc),
+      "bin/bigpowers.js must dispatch the 'init' command"
+    );
+    assert.ok(
+      fs.existsSync(path.join(ROOT, 'bin', 'init.js')),
+      'bin/init.js must exist'
+    );
+  }
+
+  // story: BUG-2026-08-31-pi-scripts-provisioning (follow-up from PR #114 review)
+  // The managed-symlink check must not treat a string-prefix sibling of the
+  // package root (e.g. <ROOT>-evil) as managed — needs a path-separator boundary.
+  {
+    const dst = path.join(tmpHome, 'prefix-boundary-hook.sh');
+    fs.symlinkSync(path.join(`${ROOT}-evil`, 'x.sh'), dst); // dangling foreign link
+      assert.throws(
+        () => linkHook(rtkSrc, dst),
+        /Refusing to replace/,
+        'managed-symlink check must require a path-separator boundary (prefix sibling is NOT managed)'
+      );
+  }
+
   console.log('test-install-helpers: ALL PASS');
 } finally {
   rmSync(tmpHome, { recursive: true, force: true });