contextdevkit 1.8.0

package/templates/github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,27 @@
+<!-- ContextDevKit PR template — edit freely for your project. -->
+
+## What & why
+
+<!-- What does this change do, and why? Link the issue/ADR if any. -->
+
+## Type
+
+- [ ] feat
+- [ ] fix
+- [ ] refactor
+- [ ] docs
+- [ ] test
+- [ ] chore
+
+## Checklist
+
+- [ ] Follows the constitution in `CLAUDE.md` (file size, SRP, naming, language policy)
+- [ ] No new file over the line limit without a recorded coherence reason
+- [ ] Tests added/updated for the change (and they would catch the bug)
+- [ ] Architectural decision recorded with `/new-adr` (if applicable)
+- [ ] Session registered with `/log-session`
+- [ ] `CHANGELOG.md` `[Unreleased]` updated
+
+## Notes for reviewers
+
+<!-- Anything reviewers should focus on, risks, follow-ups. -->

package/templates/github/dependabot.yml

@@ -0,0 +1,27 @@
+# Dependabot — keep dependencies patched automatically.
+# Docs: https://docs.github.com/code-security/dependabot/dependabot-version-updates
+# Scaffolded by ContextDevKit (/security-setup). Uncomment / add the ecosystems your
+# project uses (npm, pip, gomod, cargo, maven, bundler, composer, docker, ...).
+version: 2
+updates:
+  # GitHub Actions used by your workflows (valid in any repo; harmless if none).
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels: ["dependencies", "security"]
+
+  # Node / npm — uncomment if the project has a package.json at the root.
+  # - package-ecosystem: "npm"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "weekly"
+  #   open-pull-requests-limit: 10
+  #   labels: ["dependencies", "security"]
+
+  # Python — uncomment for requirements.txt / pyproject.toml.
+  # - package-ecosystem: "pip"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "weekly"

package/templates/github/workflows/quality.yml

@@ -0,0 +1,36 @@
+# Quality gates — contract drift + tech-debt RED zone.
+# Scaffolded by ContextDevKit. Each job FAILS the run on a regression; to make it
+# BLOCK merges, add it as a required status check in branch protection.
+name: quality
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  contract-drift:
+    # Fails if a public export was removed/renamed since the committed baseline
+    # (contextkit/memory/contract-baseline.json). No-op until you set `l5.contractGlobs`
+    # and save a baseline (`contract-scan.mjs --save`).
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 20
+      - run: node contextkit/tools/scripts/contract-scan.mjs
+
+  tech-debt:
+    # Fails on any RED-zone finding (a file over the hard line-budget limit).
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 20
+      - run: node contextkit/tools/scripts/tech-debt-scan.mjs --ci

package/templates/github/workflows/security.yml

@@ -0,0 +1,54 @@
+# Security checks — ADVISORY by default (they report, they don't block the merge).
+# Scaffolded by ContextDevKit (/security-setup). To ENFORCE: mark a job a required
+# status check in branch protection, or remove its `continue-on-error`.
+name: security
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write # CodeQL uploads results here
+
+jobs:
+  dependency-review:
+    # GitHub's native diff of dependency changes on a PR (CVEs + license).
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    continue-on-error: true # advisory — remove to block on a vulnerable bump
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
+        with:
+          fail-on-severity: high
+
+  deps-audit:
+    # ContextDevKit's deterministic supply-chain check (lockfile, pinning, license, CVEs).
+    runs-on: ubuntu-latest
+    continue-on-error: true # advisory — remove to block
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 20
+      - run: node contextkit/tools/scripts/deps-audit.mjs
+
+  codeql:
+    # SAST. Set `language` to your stack: c-cpp, csharp, go, java-kotlin,
+    # javascript-typescript, python, ruby, swift. Remove this job if you enable
+    # CodeQL "default setup" in repository settings instead.
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    strategy:
+      matrix:
+        language: ["javascript-typescript"]
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3
+        with:
+          languages: ${{ matrix.language }}
+      - uses: github/codeql-action/autobuild@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3
+      - uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3

package/tools/install/cli.mjs

@@ -0,0 +1,62 @@
+/**
+ * CLI surface for the installer: argument parsing, the `--help` text, the
+ * interactive prompt helper, and the human-readable level labels.
+ */
+export { LEVEL_LABELS } from '../../templates/contextkit/runtime/config/levels.mjs';
+
+export function parseArgs(argv) {
+  const args = { yes: false, rewire: false, force: false, uninstall: false, help: false, version: false, purge: false, update: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--yes' || a === '-y') args.yes = true;
+    else if (a === '--update') { args.update = true; args.yes = true; }
+    else if (a === '--rewire') args.rewire = true;
+    else if (a === '--force') args.force = true;
+    else if (a === '--uninstall') args.uninstall = true;
+    else if (a === '--purge') args.purge = true;
+    else if (a === '--help' || a === '-h') args.help = true;
+    else if (a === '--version' || a === '-v') args.version = true;
+    else if (a === '--target') args.target = argv[++i];
+    else if (a === '--level') args.level = Number(argv[++i]);
+    else if (a === '--name') args.name = argv[++i];
+    else if (a === '--mode') args.mode = argv[++i];
+    else if (a === '--preset') args.preset = argv[++i];
+  }
+  return args;
+}
+
+export const HELP = `
+🌀 ContextDevKit installer
+
+Usage:
+  node install.mjs [--target <path>] [--level <1-7>] [--name <str>]
+                   [--mode greenfield|existing] [--yes] [--force]
+  node install.mjs --update                   safe update: refresh engine + commands,
+                                              keep your level/config/memory/CLAUDE.md
+  node install.mjs --rewire --level <1-7>     only recompose .claude/settings.json
+  node install.mjs --uninstall [--purge]      unwire hooks (--purge also removes engine)
+  node install.mjs --help | --version
+
+Flags:
+  --target <path>   destination project root (default: current directory)
+  --level <1-7>     activation level (default: prompt, else 2)
+  --name <string>   project name for the CLAUDE.md header
+  --mode <m>        greenfield | existing (default: auto-detect)
+  --preset <name>   stack preset to merge into config: next | go | python
+  --yes, -y         non-interactive (use flags/defaults, no prompts)
+  --force           overwrite CLAUDE.md / memory seeds if they exist
+  --update          safe update: refresh engine/commands/agents + re-wire hooks for
+                    the CURRENT level; never touches CLAUDE.md, config, or memory
+  --rewire          only recompose settings.json for the given --level
+  --uninstall       remove ContextDevKit hook wiring + git hooks (keeps memory)
+  --purge           with --uninstall, also delete contextkit/ engine + commands/agents
+  --help, -h        show this help
+  --version, -v     print the kit version
+
+After installing, open the project in Claude Code and run /setupcontextdevkit.
+`;
+
+export async function prompt(rl, q, def) {
+  const a = (await rl.question(`${q}${def ? ` (${def})` : ''}: `)).trim();
+  return a || def || '';
+}

package/tools/install/fs.mjs

@@ -0,0 +1,56 @@
+/**
+ * File-system helpers for the ContextDevKit installer.
+ *
+ * Thin wrappers over `node:fs`: idempotent writes, BOM-stripped reads
+ * (Windows-safe), recursive copies (clobbering vs write-if-missing), and
+ * `{{var}}` template rendering. Zero third-party deps — the installer must run
+ * via `npx` on a machine with nothing else installed.
+ */
+import { cp, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { existsSync, readdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+export async function ensureDir(p) {
+  await mkdir(p, { recursive: true });
+}
+
+/** Reads a file, stripping a leading UTF-8 BOM so `JSON.parse` never trips. */
+export async function read(path) {
+  return (await readFile(path, 'utf-8')).replace(/^/, '');
+}
+
+/** Writes `content` only if `path` is absent (or `force`). Returns whether it wrote. */
+export async function writeIfMissing(path, content, force) {
+  if (existsSync(path) && !force) return false;
+  await ensureDir(dirname(path));
+  await writeFile(path, content, 'utf-8');
+  return true;
+}
+
+export async function overwrite(path, content) {
+  await ensureDir(dirname(path));
+  await writeFile(path, content, 'utf-8');
+}
+
+export async function copyTree(src, dest) {
+  if (!existsSync(src)) return;
+  await cp(src, dest, { recursive: true, force: true });
+}
+
+/** Recursively copies `src` into `dest`, writing each file ONLY if absent. */
+export async function copyTreeIfMissing(src, dest) {
+  if (!existsSync(src)) return 0;
+  let count = 0;
+  for (const entry of readdirSync(src, { withFileTypes: true })) {
+    const from = join(src, entry.name);
+    const to = join(dest, entry.name);
+    if (entry.isDirectory()) count += await copyTreeIfMissing(from, to);
+    else if (await writeIfMissing(to, await readFile(from, 'utf-8'), false)) count++;
+  }
+  return count;
+}
+
+/** Replaces `{{var}}` placeholders from `vars`; leaves unknown ones intact. */
+export function render(tpl, vars) {
+  return tpl.replace(/\{\{(\w+)\}\}/g, (_, k) => (k in vars ? vars[k] : `{{${k}}}`));
+}

package/tools/install/git.mjs

@@ -0,0 +1,114 @@
+/**
+ * Git integration for the installer: drop the L≥3 git-hook wrappers, and patch
+ * `.gitignore` / `.gitattributes` idempotently (never double-append).
+ */
+import { writeFile, chmod, rename, stat } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { ensureDir, read } from './fs.mjs';
+
+/**
+ * Resolves a `.git` path to the *actual* git directory.
+ *
+ * In a regular repo, `.git` is a directory — return it as-is. In a git
+ * worktree (or a submodule), `.git` is a regular **file** containing
+ * `gitdir: <absolute-or-relative-path>`. We follow that pointer so hooks
+ * land in the worktree-specific git dir (`<main>/.git/worktrees/<name>/hooks/`),
+ * which is what git actually looks at when running hooks for a worktree.
+ *
+ * Returns `null` when the pointer is malformed — the installer treats that
+ * as "no git" and skips hook installation (rule 2: never break real work).
+ *
+ * @param {string} dotGit — path to the project's `.git` (file or dir)
+ * @param {string} target — project root, for resolving relative gitdir pointers
+ * @returns {Promise<string | null>}
+ */
+export async function resolveGitDir(dotGit, target) {
+  try {
+    const st = await stat(dotGit);
+    if (st.isDirectory()) return dotGit;
+    if (!st.isFile()) return null;
+    const text = (await read(dotGit)).trim();
+    const match = text.match(/^gitdir:\s*(.+)$/m);
+    if (!match) return null;
+    const pointer = match[1].trim();
+    return isAbsolute(pointer) ? pointer : resolve(target, pointer);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Installs thin git-hook wrappers that call the engine scripts. Needs a `.git`.
+ *
+ * If a hook file already exists and is NOT one of ours (e.g. a husky/lint-staged
+ * hook), it is backed up to `<name>.bak` before being replaced — so the user's
+ * own hook is never silently clobbered. An existing `.bak` is preserved (the
+ * first backup wins) so re-running the installer can't overwrite the original.
+ *
+ * @returns {Promise<{ installed: boolean, backedUp: string[] }>}
+ */
+export async function installGitHooks(target) {
+  const dotGit = join(target, '.git');
+  if (!existsSync(dotGit)) return { installed: false, backedUp: [] };
+  // Worktrees + submodules have `.git` as a FILE pointing at the real gitdir.
+  // Follow the pointer so hooks land where git will actually invoke them
+  // (and so `ensureDir` doesn't trip on ENOTDIR — bug 038, ADR-0015 session).
+  const gitDir = await resolveGitDir(dotGit, target);
+  if (!gitDir) return { installed: false, backedUp: [] };
+  const hooksDir = join(gitDir, 'hooks');
+  await ensureDir(hooksDir);
+  const wrappers = {
+    'pre-commit': '#!/bin/sh\nnode contextkit/runtime/git-hooks/pre-commit.mjs\n',
+    'commit-msg': '#!/bin/sh\nnode contextkit/runtime/git-hooks/commit-msg.mjs "$1"\n',
+    'pre-push': '#!/bin/sh\nnode contextkit/runtime/git-hooks/pre-push.mjs\n',
+  };
+  const backedUp = [];
+  for (const [name, body] of Object.entries(wrappers)) {
+    const p = join(hooksDir, name);
+    if (existsSync(p) && !(await read(p)).includes('contextkit/runtime/git-hooks')) {
+      const backup = `${p}.bak`;
+      if (!existsSync(backup)) {
+        await rename(p, backup);
+        backedUp.push(name);
+      }
+    }
+    await writeFile(p, body, 'utf-8');
+    await chmod(p, 0o755).catch(() => {});
+  }
+  return { installed: true, backedUp };
+}
+
+const GITIGNORE_BLOCK = [
+  '',
+  '# ContextDevKit — local runtime state (do not commit)',
+  '.claude/.sessions/',
+  '.claude/.workspace/',
+  '.context-snapshot.md',
+  '.distillation-proposal.md',
+  '.agent-tuning-proposal.md',
+  'contextkit/memory/tech-debt-findings.json',
+  'contextkit/memory/deps-findings.json',
+  'contextkit/memory/deep-analysis-findings.json',
+].join('\n');
+
+export async function patchGitignore(target) {
+  const p = join(target, '.gitignore');
+  let current = '';
+  if (existsSync(p)) current = await read(p);
+  if (current.includes('ContextDevKit — local runtime state')) return false;
+  await writeFile(p, current + (current.endsWith('\n') || current === '' ? '' : '\n') + GITIGNORE_BLOCK + '\n', 'utf-8');
+  return true;
+}
+
+export async function patchGitattributes(target, tplDir) {
+  const tplPath = join(tplDir, 'gitattributes');
+  if (!existsSync(tplPath)) return false;
+  const block = await read(tplPath);
+  const p = join(target, '.gitattributes');
+  let current = '';
+  if (existsSync(p)) current = await read(p);
+  if (current.includes('ContextDevKit — keep engine scripts')) return false;
+  await writeFile(p, current + (current.endsWith('\n') || current === '' ? '' : '\n') + block, 'utf-8');
+  return true;
+}

package/tools/install/project.mjs

@@ -0,0 +1,51 @@
+/**
+ * Target-project inspection for the installer: detect the stack (for the
+ * CLAUDE.md header on existing projects), decide whether a folder looks
+ * greenfield, and derive a safe project basename.
+ */
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { read } from './fs.mjs';
+
+/** Best-effort, human-readable stack summary for the CLAUDE.md header. */
+export async function detectStack(target) {
+  const hints = [];
+  const pkgPath = join(target, 'package.json');
+  if (existsSync(pkgPath)) {
+    try {
+      const pkg = JSON.parse(await read(pkgPath));
+      const deps = Object.keys({ ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) });
+      const known = ['react', 'next', 'expo', 'react-native', 'vue', 'svelte', 'hono', 'express', 'fastify', 'nestjs', 'vite', 'astro', 'drizzle-orm', 'prisma', 'typescript'];
+      const found = known.filter((k) => deps.includes(k));
+      hints.push(`Node/TypeScript project. Detected: ${found.length ? found.join(', ') : 'no well-known frameworks'}.`);
+    } catch {
+      hints.push('Node project (package.json present).');
+    }
+  }
+  for (const [f, label] of [['pyproject.toml', 'Python'], ['go.mod', 'Go'], ['Cargo.toml', 'Rust'], ['pom.xml', 'Java/Maven'], ['Gemfile', 'Ruby']]) {
+    if (existsSync(join(target, f))) hints.push(`${label} (${f}).`);
+  }
+  return hints.length ? hints.join(' ') : '_TBD — fill in your stack._';
+}
+
+export function requireBasename(p) {
+  return p.replace(/[\\/]+$/, '').split(/[\\/]/).pop() || 'project';
+}
+
+export function looksGreenfield(target) {
+  try {
+    const entries = existsSync(target) ? readdirSyncSafe(target) : [];
+    const meaningful = entries.filter((e) => !['.git', '.gitignore', 'README.md', 'LICENSE', '.claude', 'contextkit'].includes(e));
+    return meaningful.length === 0;
+  } catch {
+    return true;
+  }
+}
+
+function readdirSyncSafe(p) {
+  try {
+    return readdirSync(p);
+  } catch {
+    return [];
+  }
+}

package/tools/install/uninstall.mjs

@@ -0,0 +1,54 @@
+/**
+ * `--uninstall` [`--purge`]: remove ContextDevKit's hook wiring + git hooks (and,
+ * with purge, the engine/commands/agents) while ALWAYS keeping the user's
+ * memory (ADRs/sessions) and CLAUDE.md.
+ */
+import { rm } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { read, overwrite } from './fs.mjs';
+
+export async function uninstall(target, purge) {
+  const report = [];
+  // 1. Strip ContextDevKit hook entries from settings.json (keep the user's own).
+  const settingsPath = join(target, '.claude', 'settings.json');
+  if (existsSync(settingsPath)) {
+    try {
+      const settings = JSON.parse(await read(settingsPath));
+      const hooks = settings.hooks || {};
+      for (const evt of Object.keys(hooks)) {
+        if (!Array.isArray(hooks[evt])) continue;
+        hooks[evt] = hooks[evt]
+          .map((g) => ({ ...g, hooks: (g.hooks || []).filter((h) => !String(h.command || '').includes('contextkit/runtime/hooks')) }))
+          .filter((g) => (g.hooks || []).length > 0);
+        if (hooks[evt].length === 0) delete hooks[evt];
+      }
+      settings.hooks = hooks;
+      await overwrite(settingsPath, JSON.stringify(settings, null, 2) + '\n');
+      report.push('✓ removed ContextDevKit hook wiring from .claude/settings.json');
+    } catch {
+      report.push('⚠️  could not parse .claude/settings.json — left untouched');
+    }
+  }
+  // 2. Remove the git hook wrappers we installed.
+  for (const h of ['pre-commit', 'commit-msg', 'pre-push']) {
+    const p = join(target, '.git', 'hooks', h);
+    if (existsSync(p)) {
+      await rm(p, { force: true });
+      report.push(`✓ removed git hook ${h}`);
+    }
+  }
+  // 3. With --purge, delete the engine + commands/agents (KEEP memory).
+  if (purge) {
+    for (const rel of ['contextkit/runtime', 'contextkit/tools', '.claude/commands', '.claude/agents']) {
+      const p = join(target, rel);
+      if (existsSync(p)) {
+        await rm(p, { recursive: true, force: true });
+        report.push(`✓ purged ${rel}`);
+      }
+    }
+    report.push('ℹ️  kept contextkit/memory/ (your ADRs + session history) and CLAUDE.md');
+  }
+  console.log('\n' + report.join('\n'));
+  console.log('\n✅ ContextDevKit uninstalled.' + (purge ? '' : ' Engine files kept; re-run without --uninstall to re-enable.'));
+}

package/tools/integration-test-compozy.mjs

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+/**
+ * ContextDevKit integration test — COMPOZY follow-through features.
+ *
+ * Sibling of `integration-test-guards.mjs`. Extracted as a responsibility seam
+ * (guards is for input-rejection safety nets; the Compozy follow-throughs are
+ * positive-path lifecycle tests of new features). Mirrors the
+ * ADR-0016/ticket-047 split pattern.
+ *
+ * Tickets covered: 041 (/workflow macro), 043 (distill-detect), 046 (/resume).
+ *
+ * Run:  node tools/integration-test-compozy.mjs   (exit 0 = healthy)
+ */
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { KIT, run, reporter } from './it-helpers.mjs';
+
+const rep = reporter();
+const { ok, bad } = rep;
+console.log('\n🌀 ContextDevKit integration test — Compozy follow-throughs\n');
+
+const importKit = (rel) => import('file://' + join(KIT, rel).replaceAll('\\', '/'));
+const tmp = (tag) => mkdtempSync(join(tmpdir(), `contextkit-${tag}-`));
+
+/** 041 — /workflow macro lifecycle: new → 3× advance → completion → status. */
+function testWorkflowMacro() {
+  const proj = tmp('wf');
+  run([join(KIT, 'install.mjs'), '--target', proj, '--level', '5', '--name', 'WF', '--yes']);
+  const cli = (...a) => run([join(proj, 'contextkit', 'tools', 'scripts', 'workflow.mjs'), ...a], { cwd: proj });
+  cli('new', 'BAD!!').status === 1 ? ok('/workflow refuses invalid slug (ticket 041)') : bad('bad slug accepted');
+  cli('new', 'demo').status === 0 && existsSync(join(proj, 'contextkit/memory/workflows/demo.md')) ? ok('/workflow new creates breadcrumb (ticket 041)') : bad('breadcrumb missing');
+  cli('new', 'demo').status === 1 ? ok('/workflow refuses duplicate slug') : bad('duplicate accepted');
+  ['r1', 'ADR-0023', '[052]'].forEach((r) => cli('advance', 'demo', r));
+  /complete/i.test(cli('advance', 'demo', 'merged').stdout) ? ok('/workflow lifecycle completes after 4 phases (ticket 041)') : bad('final advance missing complete');
+  const data = JSON.parse(cli('status', '--json').stdout || '[]');
+  data[0]?.slug === 'demo' && data[0].phases.roadmap.ref === 'r1' && data[0].phases.adr.ref === 'ADR-0023' ? ok('/workflow status surfaces phases + refs (ticket 041)') : bad(`status wrong: ${JSON.stringify(data[0])}`);
+  rmSync(proj, { recursive: true, force: true });
+}
+
+/** 043 — distill-detect surfaces rule-like phrases (positive + negative + skip-headers). */
+async function testDistillDetect() {
+  const mod = await importKit('templates/contextkit/tools/scripts/distill-detect.mjs');
+  mod.detect('We decided that all auth flows must use refresh tokens. From now on, always validate JWTs.').length >= 2
+    ? ok('distill-detect surfaces multiple rule-like phrases (ticket 043)') : bad('seeded sentence produced no candidates');
+  mod.detect('Today we fixed a minor bug in the login flow.').length === 0
+    ? ok('distill-detect is quiet on neutral narrative (ticket 043 false-positive guard)') : bad('neutral paragraph triggered a candidate');
+  mod.detect('# We decided X\n> from now on Y').length === 0
+    ? ok('distill-detect skips headings + blockquotes (ticket 043)') : bad('heading/blockquote triggered');
+}
+
+/** 046 — /resume lifecycle: list, refuse unknown, refuse claim conflict, happy path. */
+function testResumeCommand() {
+  const proj = tmp('resume');
+  run([join(KIT, 'install.mjs'), '--target', proj, '--level', '5', '--name', 'ResumeIT', '--yes']);
+  mkdirSync(join(proj, '.claude', '.sessions'), { recursive: true });
+  mkdirSync(join(proj, '.claude', '.workspace'), { recursive: true });
+  const sess = (id, extra) => JSON.stringify({ sessionId: id, startedAt: Date.now() - 3600000, modifications: [{ path: 'src/a.js', tool: 'Edit', at: Date.now() }], registered: false, stopWarnedAt: null, simulations: [], ...extra });
+  const ws = (id, claims) => JSON.stringify({ sessionId: id, branch: 'main', user: 'rt', startedAt: Date.now() - 3600000, lastHeartbeat: Date.now(), claims });
+  writeFileSync(join(proj, '.claude', '.sessions', 'sess-target.json'), sess('sess-target'));
+  writeFileSync(join(proj, '.claude', '.workspace', 'sess-target.json'), ws('sess-target', [{ path: 'src/a.js', claimedAt: Date.now() }]));
+  writeFileSync(join(proj, '.claude', '.sessions', 'sess-other.json'), sess('sess-other'));
+  const cli = (...args) => run([join(proj, 'contextkit', 'tools', 'scripts', 'resume.mjs'), ...args], { cwd: proj });
+  const listOut = cli();
+  listOut.stdout.includes('sess-target') && listOut.stdout.includes('sess-other') ? ok('/resume lists unregistered drift candidates (ticket 046)') : bad(`list: ${listOut.stdout}`);
+  const badId = cli('nope-not-real');
+  badId.status === 1 && /not found among unregistered/.test(badId.stderr + badId.stdout) ? ok('/resume refuses unknown session id (rule 8)') : bad(`unknown-id: ${badId.stderr}`);
+  writeFileSync(join(proj, '.claude', '.workspace', 'sess-active.json'), ws('sess-active', [{ path: 'src/a.js', claimedAt: Date.now() }]));
+  const conflict = cli('sess-target');
+  conflict.status === 1 && /claimed by another active session/.test(conflict.stderr + conflict.stdout) ? ok('/resume refuses cross-session claim conflict (ticket 046)') : bad(`conflict: ${conflict.stderr}`);
+  writeFileSync(join(proj, '.claude', '.workspace', 'sess-active.json'), ws('sess-active', []));
+  const happy = cli('sess-target');
+  const pointer = existsSync(join(proj, '.claude', '.sessions', '.last-touched')) ? JSON.parse(readFileSync(join(proj, '.claude', '.sessions', '.last-touched'), 'utf-8')) : {};
+  happy.status === 0 && pointer.sessionId === 'sess-target' ? ok('/resume rewrites .last-touched on success') : bad(`happy: status=${happy.status}, pointer=${JSON.stringify(pointer)}`);
+  rmSync(proj, { recursive: true, force: true });
+}
+
+async function main() {
+  testWorkflowMacro();
+  await testDistillDetect();
+  testResumeCommand();
+  rep.finish('Integration (Compozy)');
+}
+
+main().catch((err) => {
+  bad(`Compozy crashed: ${err?.stack || err}`);
+  rep.finish('Integration (Compozy)');
+});