code-ai-installer 4.0.0 → 4.0.1-a

package/dist/mcp/tools/review_proposal.js

@@ -0,0 +1,99 @@
+import { loadCodeAiConfig } from "../config.js";
+import { appendReviewEvent, readProposals } from "../proposal_store.js";
+import { readDomainSkillMeta, findOverlaps } from "../proposal_dedup.js";
+/**
+ * Authorize a proposal status transition, enforcing the autonomy matrix + toggle.
+ *
+ * 4b is the AUTHORIZATION seam, not the write seam (mirrors sign_off: it authorizes a gate
+ * without doing the gate's work). The actual byte write into the asset is a separate
+ * submit_artifact/edit step the caller performs after approval — see next_step.
+ *
+ * Transitions:
+ *   approve  pending  → approved   (matrix/toggle-gated when decided_by=auditor_auto)
+ *   reject   pending  → rejected
+ *   applied  approved → applied    (bookkeeping marker after the caller wrote the asset)
+ *
+ * Matrix (ADR-DEV-122): auditor_auto may approve only low/additive AND only when the approval
+ * gate is OFF; destructive (high) and gate-ON always require den. den may always act.
+ */
+export async function reviewProposal(input) {
+    const proposals = await readProposals();
+    const p = proposals.find((x) => x.id === input.id);
+    if (!p) {
+        throw new Error(`review_proposal: no proposal '${input.id}' in the store`);
+    }
+    // Transition validity.
+    if (input.decision === "approve" || input.decision === "reject") {
+        if (p.status !== "pending") {
+            throw new Error(`review_proposal: '${input.id}' is '${p.status}', not 'pending' — cannot ${input.decision}`);
+        }
+    }
+    else {
+        // "applied"
+        if (p.status !== "approved") {
+            throw new Error(`review_proposal: '${input.id}' is '${p.status}', not 'approved' — cannot mark applied`);
+        }
+    }
+    // Matrix + toggle enforcement on the capability-granting direction (approve).
+    if (input.decision === "approve" && input.decided_by === "auditor_auto") {
+        const cfg = await loadCodeAiConfig();
+        if (cfg.auditor.approval_gate) {
+            throw new Error(`review_proposal: approval gate is ON — '${input.id}' requires den approval, not auditor_auto`);
+        }
+        if (p.risk === "high") {
+            throw new Error(`review_proposal: '${input.id}' is high-risk (destructive) — always requires den, even in autonomy`);
+        }
+        // Additive-dedup guard (ADR-DEV-125): before auto-adding a NEW skill, block silent
+        // library bloat — if it overlaps an existing skill, route to den instead of auto-adding.
+        if (p.change_kind === "add_asset" && p.target.asset === "skill") {
+            const skills = await readDomainSkillMeta(p.target.domain);
+            const overlaps = findOverlaps({
+                proposalName: p.target.name,
+                text: `${p.rationale}\n${p.draft}`,
+                skills,
+            });
+            if (overlaps.length > 0) {
+                const summary = overlaps
+                    .map((o) => `${o.skill} (${o.reasons.join("; ")})`)
+                    .join("; ");
+                throw new Error(`review_proposal: '${input.id}' may duplicate existing skill(s) [${summary}] — additive-dedup guard routes it to den, not auto-add`);
+            }
+        }
+    }
+    const status = input.decision === "approve"
+        ? "approved"
+        : input.decision === "reject"
+            ? "rejected"
+            : "applied";
+    await appendReviewEvent({
+        kind: "review",
+        id: input.id,
+        status,
+        decided_by: input.decided_by,
+        ...(input.note !== undefined ? { note: input.note } : {}),
+        reviewed_at: new Date().toISOString(),
+    });
+    return {
+        id: input.id,
+        status,
+        risk: p.risk,
+        decided_by: input.decided_by,
+        target: p.target,
+        next_step: buildNextStep(status, p.target, p.draft, input.decided_by, p.change_kind),
+    };
+}
+/** Mandatory report — every decision (especially autonomous) returns a plain-language next step. */
+function buildNextStep(status, target, draft, decided_by, change_kind) {
+    const who = decided_by === "auditor_auto" ? "Auditor (autonomous)" : "den";
+    const asset = `${target.asset} '${target.name}' in domain '${target.domain}'`;
+    if (status === "approved") {
+        const bloatNote = decided_by === "auditor_auto" && change_kind === "add_asset"
+            ? " NEW ADDITION (autonomous) — passed the dedup guard; tracked for later pruning review."
+            : "";
+        return `Approved by ${who}. Apply the draft to ${asset} via submit_artifact (class=${target.asset === "agent" ? "role" : "skill"}) or a targeted edit, then call review_proposal decision='applied'.${bloatNote} Draft:\n${draft}`;
+    }
+    if (status === "rejected") {
+        return `Rejected by ${who}. No change applied; the proposal stays on record.`;
+    }
+    return `Marked applied by ${who}. The change is now written to ${asset}; the proposal lifecycle is closed.`;
+}

package/dist/mcp/tools/run_drift_audit.d.ts

@@ -0,0 +1,11 @@
+import { type RunDriftAuditInput, type RunDriftAuditOutput } from "../../shared/index.js";
+/**
+ * Drift audit uses a PERMISSIVE YAML parser — strict SkillFrontmatter
+ * validation (e.g. `owners: z.array(AgentName).min(1)`) would silently skip
+ * the very skills the audit needs to surface. We only require:
+ *   - frontmatter block exists
+ *   - `name` field is a string matching the folder name
+ * Everything else (type, domain, owners empty/missing) is reported, not
+ * rejected.
+ */
+export declare function runDriftAudit(input: RunDriftAuditInput): Promise<RunDriftAuditOutput>;

package/dist/mcp/tools/run_drift_audit.js

@@ -0,0 +1,79 @@
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { resolveDomainRoot, resolveSkillsRoot } from "../paths.js";
+/**
+ * Drift audit uses a PERMISSIVE YAML parser — strict SkillFrontmatter
+ * validation (e.g. `owners: z.array(AgentName).min(1)`) would silently skip
+ * the very skills the audit needs to surface. We only require:
+ *   - frontmatter block exists
+ *   - `name` field is a string matching the folder name
+ * Everything else (type, domain, owners empty/missing) is reported, not
+ * rejected.
+ */
+export async function runDriftAudit(input) {
+    const domainRoot = resolveDomainRoot(input.domain);
+    const agentsYamlPath = join(domainRoot, "AGENTS.yaml");
+    const yamlList = await readSkillsFromAgentsYaml(agentsYamlPath);
+    const { onDisk, unowned } = await scanSkillsFromDisk(input.domain);
+    const yamlSet = new Set(yamlList);
+    const diskSet = new Set(onDisk);
+    const orphan_skills = yamlList.filter((s) => !diskSet.has(s)).sort();
+    const phantom_skills = onDisk.filter((s) => !yamlSet.has(s)).sort();
+    return {
+        orphan_skills,
+        phantom_skills,
+        yaml_skew: [],
+        unowned: unowned.sort(),
+        missing_backlinks: [],
+    };
+}
+async function readSkillsFromAgentsYaml(file) {
+    const raw = await readFile(file, "utf8").catch(() => "");
+    if (!raw)
+        return [];
+    let parsed;
+    try {
+        parsed = parseYaml(raw);
+    }
+    catch {
+        return [];
+    }
+    const skills = parsed?.skills;
+    return Array.isArray(skills) ? [...skills] : [];
+}
+async function scanSkillsFromDisk(domain) {
+    const root = resolveSkillsRoot(domain);
+    const entries = await readdir(root, { withFileTypes: true }).catch(() => []);
+    const onDisk = [];
+    const unowned = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const file = join(root, entry.name, "SKILL.md");
+        const raw = await readFile(file, "utf8").catch(() => null);
+        if (!raw)
+            continue;
+        const stripped = raw.startsWith("") ? raw.slice(1) : raw;
+        const m = stripped.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+        if (!m)
+            continue;
+        let parsed;
+        try {
+            parsed = parseYaml(m[1]);
+        }
+        catch {
+            continue;
+        }
+        const obj = parsed;
+        const name = obj?.name;
+        if (typeof name !== "string" || name !== entry.name)
+            continue;
+        onDisk.push(name);
+        const owners = obj?.owners;
+        if (!Array.isArray(owners) || owners.length === 0) {
+            unowned.push(name);
+        }
+    }
+    return { onDisk, unowned };
+}

package/dist/mcp/tools/run_tests.d.ts

@@ -0,0 +1,2 @@
+import { type RunTestsInput, type RunTestsOutput } from "../../shared/index.js";
+export declare function runTests(input: RunTestsInput): Promise<RunTestsOutput>;

package/dist/mcp/tools/run_tests.js

@@ -0,0 +1,92 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { readFile, unlink } from "node:fs/promises";
+import { npmCommand, spawnWithOutput, tail } from "./_subprocess.js";
+export async function runTests(input) {
+    const cwd = input.cwd ?? process.cwd();
+    const outFile = join(tmpdir(), `code-ai-vitest-${randomUUID()}.json`);
+    const args = ["test", "--", "--reporter=json", `--outputFile=${outFile}`];
+    if (input.filter)
+        args.push(input.filter);
+    const result = await spawnWithOutput(npmCommand(), args, { cwd });
+    let raw = null;
+    try {
+        raw = await readFile(outFile, "utf8");
+        await unlink(outFile).catch(() => undefined);
+    }
+    catch {
+        // no JSON file — subprocess crashed before writing
+    }
+    if (raw === null) {
+        return {
+            passed: 0,
+            failed: 0,
+            duration_ms: result.durationMs,
+            failures: [
+                {
+                    code: "subprocess-error",
+                    message: `npm test did not produce a vitest JSON report (exit=${result.exitCode})`,
+                    evidence: {
+                        stderr: tail(result.stderr, 2000),
+                        stdout: tail(result.stdout, 2000),
+                        spawnError: result.spawnError?.message,
+                    },
+                },
+            ],
+        };
+    }
+    let report;
+    try {
+        report = JSON.parse(raw);
+    }
+    catch (err) {
+        return {
+            passed: 0,
+            failed: 0,
+            duration_ms: result.durationMs,
+            failures: [
+                {
+                    code: "json-parse-error",
+                    message: `Failed to parse vitest JSON report: ${err.message}`,
+                    evidence: { raw: raw.slice(0, 500) },
+                },
+            ],
+        };
+    }
+    return mapReport(report, result.durationMs);
+}
+function mapReport(report, durationMs) {
+    const failures = [];
+    const totalTests = report.numTotalTests ?? 0;
+    if (totalTests === 0 && report.success === false) {
+        failures.push({
+            code: "no-tests-found",
+            message: "vitest ran but found no test files in this project",
+        });
+    }
+    for (const file of report.testResults ?? []) {
+        for (const assertion of file.assertionResults ?? []) {
+            if (assertion.status === "failed") {
+                const title = assertion.fullName ??
+                    [...(assertion.ancestorTitles ?? []), assertion.title ?? ""].filter(Boolean).join(" > ");
+                const message = (assertion.failureMessages?.[0] ?? "(no failure message)").split("\n")[0] ?? "";
+                failures.push({
+                    code: "test-failed",
+                    message: `${file.name ?? "<unknown>"} > ${title}: ${message}`,
+                    evidence: {
+                        file: file.name,
+                        title,
+                        failureMessages: assertion.failureMessages,
+                    },
+                });
+            }
+        }
+    }
+    return {
+        passed: report.numPassedTests ?? 0,
+        failed: report.numFailedTests ?? 0,
+        duration_ms: durationMs,
+        failures,
+    };
+}

package/dist/mcp/tools/sign_off.js

@@ -1,6 +1,7 @@
 import { getGateConfig, loadPipeline } from "../pipeline.js";
 import { readTaskState, writeTaskState } from "../task_state.js";
-const DEFAULT_DOMAIN = "development";
+import { recordRunScorecard } from "../audit_ledger.js";
+import { resolveActiveDomain } from "../config.js";
 /**
  * Records a sign-off event for the task's current gate. Validates that:
  *   1. Task exists and is at the named gate.
@@ -14,7 +15,7 @@ const DEFAULT_DOMAIN = "development";
  * records evidence; advance_gate gates on it.
  */
 export async function signOff(input) {
-    const pipeline = await loadPipeline(DEFAULT_DOMAIN);
+    const pipeline = await loadPipeline(await resolveActiveDomain());
     const state = await readTaskState(input.task_id);
     if (!state) {
         throw new Error(`sign_off: no task state for ${input.task_id} (call current_gate or classify_gate first)`);
@@ -54,5 +55,16 @@ export async function signOff(input) {
         evidence: input.evidence,
     });
     await writeTaskState(state);
+    // Auditor telemetry: when the terminal gate is signed, the run is complete —
+    // append a scorecard to the local ledger. Best-effort: a ledger failure must
+    // NEVER break a sign-off (telemetry is not load-bearing for the gate).
+    if (input.gate === "RG") {
+        try {
+            await recordRunScorecard(state);
+        }
+        catch {
+            /* swallow — see contract in audit_ledger.recordRunScorecard */
+        }
+    }
     return { signed: true, signer: input.signer, timestamp };
 }

package/dist/mcp/tools/stubs.js

@@ -16,6 +16,21 @@ import { auditTrail } from "./audit_trail.js";
 import { listArtifacts } from "./list_artifacts.js";
 import { getArtifact } from "./get_artifact.js";
 import { verifyClaim } from "./verify_claim.js";
+import { runTests } from "./run_tests.js";
+import { checkLint } from "./check_lint.js";
+import { build } from "./build.js";
+import { applyDiff } from "./apply_diff.js";
+import { gitCommit } from "./git_commit.js";
+import { runDriftAudit } from "./run_drift_audit.js";
+import { auditBudgetCompliance } from "./audit_budget_compliance.js";
+import { auditBilocaleParity } from "./audit_bilocale_parity.js";
+import { aggregateRunMetrics } from "./aggregate_run_metrics.js";
+import { proposeChange } from "./propose_change.js";
+import { listProposals } from "./list_proposals.js";
+import { reviewProposal } from "./review_proposal.js";
+import { e2ePlaywright } from "./e2e_playwright.js";
+import { dockerCompose } from "./docker_compose.js";
+import { dependencySupplyChain } from "./dependency_supply_chain.js";
 /** Thrown by every stub until the real implementation lands. */
 export class NotImplementedError extends Error {
     constructor(tool) {
@@ -53,13 +68,19 @@ export const DEFAULT_HANDLERS = {
     audit_trail: auditTrail,
     recent_decisions: recentDecisions,
     regenerate_manifest: regenerateManifest,
-    run_drift_audit: stub("run_drift_audit"),
-    run_tests: stub("run_tests"),
-    apply_diff: stub("apply_diff"),
-    git_commit: stub("git_commit"),
-    check_lint: stub("check_lint"),
-    build: stub("build"),
-    dependency_supply_chain: stub("dependency_supply_chain"),
-    docker_compose: stub("docker_compose"),
-    e2e_playwright: stub("e2e_playwright"),
+    run_drift_audit: runDriftAudit,
+    audit_budget_compliance: auditBudgetCompliance,
+    audit_bilocale_parity: auditBilocaleParity,
+    aggregate_run_metrics: aggregateRunMetrics,
+    propose_change: proposeChange,
+    list_proposals: listProposals,
+    review_proposal: reviewProposal,
+    run_tests: runTests,
+    apply_diff: applyDiff,
+    git_commit: gitCommit,
+    check_lint: checkLint,
+    build,
+    dependency_supply_chain: dependencySupplyChain,
+    docker_compose: dockerCompose,
+    e2e_playwright: e2ePlaywright,
 };

package/dist/mcp/tools/verify_claim.js

@@ -3,6 +3,9 @@ import { join } from "node:path";
 import { parse as parseYaml } from "yaml";
 import { SkillFrontmatter, TechSeed, TopicSeed, } from "../../shared/index.js";
 import { resolveSkillsRoot } from "../paths.js";
+import { runTests } from "./run_tests.js";
+import { checkLint } from "./check_lint.js";
+import { build } from "./build.js";
 /**
  * Code-verifiable claims. Per the silent-by-default contract, every claim a
  * gate makes ("tests pass", "no orphan skills", "vocab clean") should be
@@ -31,17 +34,41 @@ export async function verifyClaim(input) {
             const result = await checkVocab(domain);
             return result;
         }
-        case "tests_pass":
-        case "build_succeeds":
-        case "lint_clean":
+        case "tests_pass": {
+            const cwd = input.args.cwd ?? undefined;
+            const r = await runTests({ task_id: input.task_id, cwd });
+            return {
+                verified: r.failed === 0 && r.failures.length === 0,
+                evidence: { passed: r.passed, failed: r.failed, duration_ms: r.duration_ms },
+                failures: r.failures,
+            };
+        }
+        case "lint_clean": {
+            const cwd = input.args.cwd ?? undefined;
+            const r = await checkLint({ task_id: input.task_id, cwd });
+            return {
+                verified: r.clean,
+                evidence: { clean: r.clean },
+                failures: r.issues,
+            };
+        }
+        case "build_succeeds": {
+            const cwd = input.args.cwd ?? undefined;
+            const r = await build({ task_id: input.task_id, cwd });
+            return {
+                verified: r.succeeded,
+                evidence: { succeeded: r.succeeded },
+                failures: r.errors,
+            };
+        }
         case "custom": {
             return {
                 verified: false,
-                evidence: { reason: `claim_type='${input.claim_type}' not wired yet (Phase 2 tool dependency)` },
+                evidence: { reason: `claim_type='custom' not wired (project-specific dispatcher needed)` },
                 failures: [
                     {
-                        code: `${input.claim_type}-unwired`,
-                        message: `verify_claim: claim_type='${input.claim_type}' will be enabled once the corresponding Phase 2 auto-check tool lands.`,
+                        code: `custom-unwired`,
+                        message: `verify_claim: claim_type='custom' requires a project-specific dispatcher (not part of DEV-101).`,
                     },
                 ],
             };

package/dist/mcp_setup.d.ts

@@ -1,3 +1,4 @@
+import type { DomainId } from "./shared/index.js";
 /**
  * MCP auto-setup for `--target=claude` installs.
  *
@@ -34,6 +35,12 @@ export interface McpSetupOptions {
     wantMempalace: boolean;
     /** When true, no files are written; the report still reflects planned actions. */
     dryRun: boolean;
+    /**
+     * The selected domain, written into `.code-ai/config.json` so the gate tools
+     * read this project's pipeline. Undefined for the legacy flat layout (no
+     * domains) — then the config omits it and the runtime defaults to development.
+     */
+    domain?: DomainId;
 }
 export interface McpSetupReport {
     mempalaceUsed: boolean;
@@ -83,6 +90,7 @@ export declare function mergeMcpJson(destinationDir: string, servers: Record<str
  */
 export declare function writeCodeAiConfig(destinationDir: string, config: {
     decision_store: "jsonl" | "mempalace";
+    domain?: DomainId;
 }, dryRun?: boolean): Promise<{
     path: string;
 }>;

package/dist/mcp_setup.js

@@ -158,7 +158,10 @@ export async function setupMcp(opts) {
     }
     const mcp = await mergeMcpJson(opts.destinationDir, servers, opts.dryRun);
     notices.push(...mcp.notices);
-    const cfg = await writeCodeAiConfig(opts.destinationDir, { decision_store: mempalaceUsed ? "mempalace" : "jsonl" }, opts.dryRun);
+    const cfg = await writeCodeAiConfig(opts.destinationDir, {
+        decision_store: mempalaceUsed ? "mempalace" : "jsonl",
+        ...(opts.domain ? { domain: opts.domain } : {}),
+    }, opts.dryRun);
     return {
         mempalaceUsed,
         mempalaceInstallAttempted,

package/dist/shared/frontmatter.d.ts

@@ -1,4 +1,11 @@
 import { z } from "zod";
+/**
+ * Single source of truth for the `budget_lines` schema caps. Used by the zod
+ * schemas below AND imported by audit_budget_compliance (which previously
+ * hardcoded duplicate copies — ADR-DEV-108 R1). Change here, not in two places.
+ */
+export declare const SKILL_BUDGET_LINES_MAX = 800;
+export declare const ROLE_BUDGET_LINES_MAX = 650;
 /**
  * Skill frontmatter — the structural anti-drift contract.
  *
@@ -49,8 +56,24 @@ export declare const SkillFrontmatter: z.ZodObject<{
         OPS: "OPS";
         TEST: "TEST";
         RG: "RG";
+        STRATEGIST: "STRATEGIST";
+        RESEARCHER: "RESEARCHER";
+        COPYWRITER: "COPYWRITER";
+        VISUAL_CONCEPT: "VISUAL_CONCEPT";
+        REVIEWER: "REVIEWER";
+        RELEASE_GATE: "RELEASE_GATE";
+        INTERVIEWER: "INTERVIEWER";
+        DATA_ANALYST: "DATA_ANALYST";
+        MEDIATOR: "MEDIATOR";
+        DESIGNER: "DESIGNER";
+        LAYOUTER: "LAYOUTER";
+        DISCOVERY: "DISCOVERY";
+        PRODUCT_STRATEGIST: "PRODUCT_STRATEGIST";
+        UX_DESIGNER: "UX_DESIGNER";
+        TECH_LEAD: "TECH_LEAD";
     }>>>;
     tech: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        mcp: "mcp";
         typescript: "typescript";
         node: "node";
         react: "react";
@@ -133,7 +156,11 @@ export declare const RoleFrontmatter: z.ZodObject<{
         analytics: "analytics";
         product: "product";
     }>;
-    signs_off_at: z.ZodArray<z.ZodEnum<{
+    kind: z.ZodDefault<z.ZodEnum<{
+        gate: "gate";
+        meta: "meta";
+    }>>;
+    signs_off_at: z.ZodDefault<z.ZodArray<z.ZodEnum<{
         PM: "PM";
         UX: "UX";
         ARCH: "ARCH";
@@ -142,7 +169,22 @@ export declare const RoleFrontmatter: z.ZodObject<{
         OPS: "OPS";
         TEST: "TEST";
         RG: "RG";
-    }>>;
+        STRATEGIST: "STRATEGIST";
+        RESEARCHER: "RESEARCHER";
+        COPYWRITER: "COPYWRITER";
+        VISUAL_CONCEPT: "VISUAL_CONCEPT";
+        REVIEWER: "REVIEWER";
+        RELEASE_GATE: "RELEASE_GATE";
+        INTERVIEWER: "INTERVIEWER";
+        DATA_ANALYST: "DATA_ANALYST";
+        MEDIATOR: "MEDIATOR";
+        DESIGNER: "DESIGNER";
+        LAYOUTER: "LAYOUTER";
+        DISCOVERY: "DISCOVERY";
+        PRODUCT_STRATEGIST: "PRODUCT_STRATEGIST";
+        UX_DESIGNER: "UX_DESIGNER";
+        TECH_LEAD: "TECH_LEAD";
+    }>>>;
     tool_allowlist: z.ZodString;
     budget_lines: z.ZodDefault<z.ZodNumber>;
     schema_version: z.ZodDefault<z.ZodLiteral<1>>;

package/dist/shared/frontmatter.js

@@ -1,5 +1,12 @@
 import { z } from "zod";
-import { DomainId, GateName, SkillType, TechSeed, TopicSeed, } from "./vocabulary.js";
+import { DomainId, GateName, SkillType, TechSeed, TopicSeed, gateBelongsToDomain, } from "./vocabulary.js";
+/**
+ * Single source of truth for the `budget_lines` schema caps. Used by the zod
+ * schemas below AND imported by audit_budget_compliance (which previously
+ * hardcoded duplicate copies — ADR-DEV-108 R1). Change here, not in two places.
+ */
+export const SKILL_BUDGET_LINES_MAX = 800; // ADR-DEV-034 (state-zustand-beast-practices-reference at 750)
+export const ROLE_BUDGET_LINES_MAX = 650; // ADR-DEV-107 (raised 250→500); 500→550 for content agents; 550→650 for product agents (layouter 614, data_analyst 558 + frontmatter, Phase 3)
 /**
  * Skill frontmatter — the structural anti-drift contract.
  *
@@ -55,25 +62,66 @@ export const SkillFrontmatter = z.object({
      *  up to 400 (precedent ADR-DEV-021 raised k8s-manifests-conventions workflow to 350).
      *  Raised to 800 in ADR-DEV-034 for state-zustand-beast-practices-reference (750)
      *  — densest examples skill in codebase, DEN-locked rule prevents trim. */
-    budget_lines: z.number().int().positive().max(800).default(300),
+    budget_lines: z.number().int().positive().max(SKILL_BUDGET_LINES_MAX).default(300),
     /** Frontmatter version. Bumped when SkillFrontmatter shape changes. */
     schema_version: z.literal(1).default(1),
     /** Optional provenance preserved from pre-migration frontmatter (license/source). */
     license: z.string().optional(),
     source: z.string().url().or(z.string().min(1)).optional(),
+}).superRefine((val, ctx) => {
+    // Domain isolation: every gate a skill applies at must belong to the skill's
+    // own domain. GateName is the cross-domain union, so without this clause a
+    // skill could silently declare a foreign-domain gate. Mirrors the identical
+    // RoleFrontmatter clause for agents (signs_off_at).
+    for (const gate of val.gates) {
+        if (!gateBelongsToDomain(gate, val.domain)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["gates"],
+                message: `gate '${gate}' does not belong to domain '${val.domain}'`,
+            });
+        }
+    }
 });
 /**
  * Role frontmatter — agent.md header. Defines the role's tool allowlist (referenced by name;
  * MCP resolves to concrete tool set) and which gates the role can sign off on.
  */
-export const RoleFrontmatter = z.object({
+export const RoleFrontmatter = z
+    .object({
     name: AgentName,
     description: z.string().min(1).max(1000),
     domain: DomainId,
-    /** Gates where this role is authorized to sign off. */
-    signs_off_at: z.array(GateName).min(1),
+    /**
+     * "gate"  — orchestra role that signs delivery gates (the 8 dev agents).
+     * "meta"  — maintenance agent beside the pipeline that signs NO gates
+     *           (the Auditor, ADR-DEV-122). Default keeps every existing
+     *           agent.md (which omits the field) a gate role.
+     */
+    kind: z.enum(["gate", "meta"]).default("gate"),
+    /** Gates where this role signs off. Required for gate roles; empty for meta. */
+    signs_off_at: z.array(GateName).default([]),
     /** Named tool-allowlist policy. MCP looks up the concrete tool list by name. */
     tool_allowlist: z.string().min(1),
-    budget_lines: z.number().int().positive().max(250).default(250),
+    budget_lines: z.number().int().positive().max(ROLE_BUDGET_LINES_MAX).default(250),
     schema_version: z.literal(1).default(1),
+})
+    .superRefine((val, ctx) => {
+    if (val.kind === "gate" && val.signs_off_at.length === 0) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["signs_off_at"],
+            message: "gate-kind role must sign off on at least one gate",
+        });
+    }
+    // Domain isolation: every signed gate must belong to the role's own domain.
+    for (const gate of val.signs_off_at) {
+        if (!gateBelongsToDomain(gate, val.domain)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["signs_off_at"],
+                message: `gate '${gate}' does not belong to domain '${val.domain}'`,
+            });
+        }
+    }
 });

package/dist/shared/index.d.ts

@@ -8,11 +8,6 @@
  * Pre-DEV-100 this lived as a separate `@denish1209/types` npm package;
  * DEV-100 consolidated it into `code-ai-installer/src/shared/`. The legacy
  * `@denish1209/types@0.1.0` is deprecated on npm.
- *
- * See ../../../docs/architecture-redesign/ for the source-of-truth specs:
- *   - persona-base.md / persona-architecture.md
- *   - 2026-05-23-context.md (paradigm shift, principles, artifact caps)
- *   - dev-domain-planning-kickoff.md (pipeline.yaml scope)
  */
 export declare const VERSION = "0.0.0";
 export * from "./vocabulary.js";

package/dist/shared/index.js

@@ -8,11 +8,6 @@
  * Pre-DEV-100 this lived as a separate `@denish1209/types` npm package;
  * DEV-100 consolidated it into `code-ai-installer/src/shared/`. The legacy
  * `@denish1209/types@0.1.0` is deprecated on npm.
- *
- * See ../../../docs/architecture-redesign/ for the source-of-truth specs:
- *   - persona-base.md / persona-architecture.md
- *   - 2026-05-23-context.md (paradigm shift, principles, artifact caps)
- *   - dev-domain-planning-kickoff.md (pipeline.yaml scope)
  */
 export const VERSION = "0.0.0";
 export * from "./vocabulary.js";