contextdevkit 1.8.0

package/tools/selfcheck-source.mjs

@@ -0,0 +1,326 @@
+/**
+ * Self-check — SOURCE / STRUCTURAL invariants.
+ *
+ * Owns the static-pattern checks that scan SHIPPED source files for
+ * properties that would silently regress if removed:
+ *   - `checkSourceInvariants`  — required patterns per file (timeouts,
+ *     atomic writes, sid sanitization, single-sourced labels, etc.).
+ *   - `checkNoHardcodedPaths`  — rule 4 enforcement (no `contextkit/` path
+ *     constructed via `resolve(...)`/`join(...)` in shipped runtime/scripts).
+ *   - `checkWorkflowsPinned`   — shipped GitHub Actions are SHA-pinned;
+ *     CI declares least-privilege permissions.
+ *
+ * Split out of the legacy `selfcheck-checks.mjs` (ADR-0016 H1 / task 037 —
+ * by invariant category). The recursive-`.mjs`-listing helper `listMjs`
+ * lives here because this is the module that scans source trees; it is
+ * imported by `selfcheck-agent-forge.mjs` for the same reason.
+ *
+ * Every function takes the reporter `rep` ({ ok, bad }) plus only what it
+ * needs. Entry point: `runSourceChecks(rep, ctx)` where `ctx = { KIT }`.
+ */
+import { readFile, readdir } from 'node:fs/promises';
+import { resolve } from 'node:path';
+
+const srcTextFor = (KIT) => (rel) => readFile(resolve(KIT, rel), 'utf-8').catch(() => '');
+
+/** All `.mjs` under a directory, recursively. Shared with the agent-forge selfcheck. */
+export async function listMjs(absDir) {
+  const out = [];
+  let entries = [];
+  try {
+    entries = await readdir(absDir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const e of entries) {
+    const p = resolve(absDir, e.name);
+    if (e.isDirectory()) out.push(...(await listMjs(p)));
+    else if (e.name.endsWith('.mjs')) out.push(p);
+  }
+  return out;
+}
+
+/** Source-level invariants — structural guarantees that would silently regress. */
+async function checkSourceInvariants(rep, KIT) {
+  const { ok, bad } = rep;
+  const srcText = srcTextFor(KIT);
+  console.log('Checking source-level invariants...');
+  const cases = [
+    ['network git calls time out (git.mjs)', 'templates/contextkit/tools/scripts/git.mjs', /timeout:\s*\w/],
+    ['network git calls time out (pre-push.mjs)', 'templates/contextkit/runtime/git-hooks/pre-push.mjs', /timeout:\s*\w/],
+    ['ledger writes are atomic', 'templates/contextkit/runtime/hooks/ledger.mjs', /writeFileAtomic/],
+    ['pipeline writers are atomic', 'templates/contextkit/tools/scripts/pipeline.mjs', /writeFileAtomicSync/],
+    ['workspace-sync write is atomic', 'templates/contextkit/tools/scripts/workspace-sync.mjs', /writeFileAtomic/],
+    ['pipeline allocates ids with exclusive create', 'templates/contextkit/tools/scripts/pipeline.mjs', /flag:\s*'wx'/],
+    ['claim sanitizes the session id', 'templates/contextkit/tools/scripts/claim.mjs', /sanitizeSid/],
+    ['release sanitizes the session id', 'templates/contextkit/tools/scripts/release.mjs', /sanitizeSid/],
+    ['track-edits sanitizes the session id', 'templates/contextkit/runtime/hooks/track-edits.mjs', /sanitizeSid/],
+    ['session-start guards live ledgers from deletion', 'templates/contextkit/runtime/hooks/session-start.mjs', /maybeLive/],
+    ['config schema is passthrough', 'templates/contextkit/runtime/config/schema.mjs', /\.passthrough\(\)/],
+    ['config schema bounds level by MAX_LEVEL', 'templates/contextkit/runtime/config/schema.mjs', /max\(MAX_LEVEL\)/],
+    ['installer labels single-sourced from levels.mjs', 'tools/install/cli.mjs', /levels\.mjs/],
+    ['context-level labels single-sourced from levels.mjs', 'templates/contextkit/tools/scripts/context-level.mjs', /levels\.mjs/],
+    ['squad detection single-sourced (squad.mjs)', 'templates/contextkit/tools/scripts/squad.mjs', /squad-meta/],
+    ['squad detection single-sourced (agent-tuning.mjs)', 'templates/contextkit/tools/scripts/agent-tuning.mjs', /squad-meta/],
+    ['installer backs up an existing git hook', 'tools/install/git.mjs', /\.bak/],
+    ['installer follows .git pointer in worktrees (bug 038)', 'tools/install/git.mjs', /resolveGitDir/],
+    ['installer parses the gitdir: pointer', 'tools/install/git.mjs', /gitdir:\\s\*\(\.\+\)/],
+    ['agent-forge yaml loader uses optional dynamic import', 'templates/contextkit/squads/agent-forge/lib/yaml.mjs', /import\(\s*['"]yaml['"]\s*\)/],
+    ['installer copies the agent-forge squad at L>=4', 'install.mjs', /copyTree\(join\(TPL, 'contextkit', 'squads', 'agent-forge'\)/],
+    ['installer copies curated-stack starters', 'install.mjs', /copyTree\(join\(TPL, 'contextkit', 'starters'\)/],
+    ['detect-stack recognises TanStack family', 'templates/contextkit/tools/scripts/detect-stack.mjs', /@tanstack\/react-router/],
+    ['tanstack playbook present', 'templates/contextkit/workflows/playbooks/tanstack.md', /Playbook — TanStack/],
+    ['tanstack starter declares react-router dep', 'templates/contextkit/starters/tanstack/package.json', /@tanstack\/react-router/],
+    ['tanstack starter declares react-query dep', 'templates/contextkit/starters/tanstack/package.json', /@tanstack\/react-query/],
+    ['tanstack starter mounts QueryClientProvider', 'templates/contextkit/starters/tanstack/src/main.tsx', /QueryClientProvider/],
+    ['tanstack starter mounts RouterProvider', 'templates/contextkit/starters/tanstack/src/main.tsx', /RouterProvider/],
+    // ADR-0015 §B — DevPipeline working/ stage.
+    ['pipeline STAGES includes working (ADR-0015 §B)', 'templates/contextkit/tools/scripts/pipeline.mjs', /STAGES\s*=\s*\{[^}]*working:\s*'working'/],
+    ['pipeline STATUS includes working', 'templates/contextkit/tools/scripts/pipeline.mjs', /STATUS\s*=\s*\{[^}]*working:\s*'working'/],
+    ['pipeline.mjs wires start subcommand (ADR-0015 §B)', 'templates/contextkit/tools/scripts/pipeline.mjs', /cmd === 'start'/],
+    ['pipeline.mjs wires stop subcommand', 'templates/contextkit/tools/scripts/pipeline.mjs', /cmd === 'stop'/],
+    ['claim.mjs exports attachTask (ADR-0015 §B)', 'templates/contextkit/tools/scripts/claim.mjs', /export async function attachTask/],
+    ['claim.mjs exports detachTask', 'templates/contextkit/tools/scripts/claim.mjs', /export async function detachTask/],
+    ['workspace-sync evicts stale tasks (ADR-0015 §B)', 'templates/contextkit/tools/scripts/workspace-sync.mjs', /evictStaleTasks/],
+    ['pipeline-board renders the Working stage', 'templates/contextkit/tools/scripts/pipeline-board.mjs', /## 🔵 Working/],
+    ['defaults expose workingStaleAfterMinutes', 'templates/contextkit/runtime/config/defaults.mjs', /workingStaleAfterMinutes:\s*\d+/],
+    // ADR-0015 §C — canonical state.json substrate + /runs command.
+    ['state-io exports readState (ADR-0015 §C)', 'templates/contextkit/runtime/state/state-io.mjs', /export function readState/],
+    ['state-io exports writeState', 'templates/contextkit/runtime/state/state-io.mjs', /export function writeState/],
+    ['state-io exports listStates', 'templates/contextkit/runtime/state/state-io.mjs', /export function listStates/],
+    ['state-io exports prune', 'templates/contextkit/runtime/state/state-io.mjs', /export function prune/],
+    ['pipeline-session stamps state.json on start (ADR-0015 §C)', 'templates/contextkit/tools/scripts/pipeline-session.mjs', /writeState\(pipeDir,\s*id,\s*\{\s*kind:\s*'task'/],
+    ['pipeline-session stamps endedAt on stop', 'templates/contextkit/tools/scripts/pipeline-session.mjs', /endedAt:\s*Date\.now\(\)/],
+    ['workspace-sync mirrors heartbeat into state.json', 'templates/contextkit/tools/scripts/workspace-sync.mjs', /lastHeartbeat:\s*task\.lastHeartbeat/],
+    ['/runs reads listStates from state-io (ADR-0015 §C follow-up)', 'templates/contextkit/tools/scripts/runs.mjs', /import\s*\{\s*listStates\s*\}\s*from\s*['"]\.\.\/\.\.\/runtime\/state\/state-io\.mjs/],
+    ['/runs supports --kind filter', 'templates/contextkit/tools/scripts/runs.mjs', /\bkind:\s*kindFilter/],
+    ['/runs supports --json output', 'templates/contextkit/tools/scripts/runs.mjs', /flag\(['"]json['"]\)/],
+    ['/runs refuses cleanly when no states exist', 'templates/contextkit/tools/scripts/runs.mjs', /No runs yet/],
+    ['/runs command briefing ships', 'templates/claude/commands/pipeline/runs.md', /Lists the \*\*last N in-flight items\*\*/],
+    // ADR-0019 — MCP injection convention seeded in agent template (commented).
+    ['agent _TEMPLATE documents mcpServers convention (ADR-0019)', 'templates/claude/agents/_TEMPLATE.md', /mcpServers/],
+    ['agent _TEMPLATE flags rationale requirement (ADR-0019)', 'templates/claude/agents/_TEMPLATE.md', /rationale/],
+    // ADR-0021 — review-provider adapter contract + seed adapter.
+    ['provider _adapter exports validateAdapter (ADR-0021)', 'templates/contextkit/runtime/providers/review/_adapter.mjs', /export function validateAdapter/],
+    ['provider _adapter defines ProviderError (ADR-0021)', 'templates/contextkit/runtime/providers/review/_adapter.mjs', /export class ProviderError/],
+    ['provider gh adapter declares id (ADR-0021)', 'templates/contextkit/runtime/providers/review/gh.mjs', /export const id\s*=\s*'gh'/],
+    ['provider gh adapter declares cliBinary (ADR-0021)', 'templates/contextkit/runtime/providers/review/gh.mjs', /export const cliBinary/],
+    ['provider gh adapter exports detectsRemote (ADR-0021)', 'templates/contextkit/runtime/providers/review/gh.mjs', /export const detectsRemote/],
+    ['provider gh adapter exports createPullRequest (ADR-0021)', 'templates/contextkit/runtime/providers/review/gh.mjs', /export async function createPullRequest/],
+    ['provider detect exports resolveAdapter (ADR-0021)', 'templates/contextkit/runtime/providers/review/detect.mjs', /export async function resolveAdapter/],
+    // Ticket 045 — /watch slash command + script.
+    ['watch script exports parseLedgerEntry (ticket 045)', 'templates/contextkit/tools/scripts/watch.mjs', /export function parseLedgerEntry/],
+    ['watch command file present (ticket 045)', 'templates/claude/commands/watch.md', /watch the active session ledger/i],
+    // Ticket 042 — two-tier memory: per-task scratch gitignored under pipeline/.
+    ['pipeline .gitignore excludes scratch files (ticket 042)', 'templates/contextkit/pipeline/.gitignore', /\*\.scratch\.md/],
+    ['dev-start documents per-task scratch convention (ticket 042)', 'templates/claude/commands/pipeline/dev-start.md', /scratch\.md/],
+    // Ticket 048 / ADR-0020 — home.mjs helper for ~/.contextdevkit/ access.
+    ['home.mjs exports resolveHome (ADR-0020)', 'templates/contextkit/tools/scripts/home.mjs', /export function resolveHome/],
+    ['home.mjs exports readHomeFile (ADR-0020)', 'templates/contextkit/tools/scripts/home.mjs', /export function readHomeFile/],
+    ['home.mjs exports writeHomeFile (ADR-0020)', 'templates/contextkit/tools/scripts/home.mjs', /export function writeHomeFile/],
+    ['home.mjs writes atomically via renameSync (ADR-0020)', 'templates/contextkit/tools/scripts/home.mjs', /renameSync\(tmp, path\)/],
+    ['home.mjs honours CONTEXTDEVKIT_HOME override (ADR-0020)', 'templates/contextkit/tools/scripts/home.mjs', /CONTEXTDEVKIT_HOME/],
+    ['fleet.mjs delegates to home helper (ticket 048)', 'templates/contextkit/tools/scripts/fleet.mjs', /from '\.\/home\.mjs'/],
+    // Ticket 051 — /dashboard (snapshot + --watch live mode).
+    ['dashboard-data exports buildDashboardData (ticket 051)', 'templates/contextkit/tools/scripts/dashboard-data.mjs', /export function buildDashboardData/],
+    ['dashboard-data exports parseFrontmatter helper', 'templates/contextkit/tools/scripts/dashboard-data.mjs', /export function parseFrontmatter/],
+    ['dashboard-data single-sources PLATFORM_DIR (rule 4)', 'templates/contextkit/tools/scripts/dashboard-data.mjs', /PLATFORM_DIR/],
+    ['dashboard-html exports renderDashboardHTML (ticket 051)', 'templates/contextkit/tools/scripts/dashboard-html.mjs', /export function renderDashboardHTML/],
+    ['dashboard-html escapes user content', 'templates/contextkit/tools/scripts/dashboard-html.mjs', /escapeHtml/],
+    ['dashboard-server exports startDashboardServer', 'templates/contextkit/tools/scripts/dashboard-server.mjs', /export async function startDashboardServer/],
+    ['dashboard-server exports resolvePort', 'templates/contextkit/tools/scripts/dashboard-server.mjs', /export function resolvePort/],
+    ['dashboard-server binds 127.0.0.1 only (no remote access)', 'templates/contextkit/tools/scripts/dashboard-server.mjs', /listen\(port,\s*'127\.0\.0\.1'/],
+    ['dashboard-server emits SSE Content-Type', 'templates/contextkit/tools/scripts/dashboard-server.mjs', /text\/event-stream/],
+    ['dashboard.mjs dispatches snapshot vs --watch', 'templates/contextkit/tools/scripts/dashboard.mjs', /WANT_WATCH\s*\?\s*runLive/],
+    ['dashboard command file ships (ticket 051)', 'templates/claude/commands/dashboard.md', /Visual dashboard/i],
+    // Ticket 040 — task metadata v2 (DAG dependencies + complexity + extended types).
+    ['pipeline-validate exports detectCycles (ticket 040)', 'templates/contextkit/tools/scripts/pipeline-validate.mjs', /export function detectCycles/],
+    ['pipeline-validate exports blockedBy', 'templates/contextkit/tools/scripts/pipeline-validate.mjs', /export function blockedBy/],
+    ['pipeline-validate exports parseInlineArray', 'templates/contextkit/tools/scripts/pipeline-validate.mjs', /export function parseInlineArray/],
+    ['pipeline-validate enum covers spike + docs (ticket 040)', 'templates/contextkit/tools/scripts/pipeline-validate.mjs', /VALID_TYPES.*spike.*docs|VALID_TYPES.*docs.*spike/s],
+    ['pipeline.mjs writes complexity + dependencies fields', 'templates/contextkit/tools/scripts/pipeline.mjs', /complexity:\s*\$\{complexity\}/],
+    ['pipeline.mjs parses dependencies inline array', 'templates/contextkit/tools/scripts/pipeline.mjs', /parseInlineArray\(fm\.dependencies\)/],
+    ['pipeline.mjs wires validate subcommand', 'templates/contextkit/tools/scripts/pipeline.mjs', /cmd === 'validate'/],
+    ['pipeline-board renders blocked-by hint', 'templates/contextkit/tools/scripts/pipeline-board.mjs', /blocked by/],
+    // Ticket 046 — /resume for interrupted sessions.
+    ['/resume reads listAllLedgers from runtime (ticket 046)', 'templates/contextkit/tools/scripts/resume.mjs', /import.*listAllLedgers.*runtime\/hooks\/ledger\.mjs/],
+    ['/resume refuses unknown session id', 'templates/contextkit/tools/scripts/resume.mjs', /not found among unregistered drift candidates/],
+    ['/resume refuses cross-session claim conflict', 'templates/contextkit/tools/scripts/resume.mjs', /claimed by another active session/],
+    ['/resume rewrites LAST_TOUCHED_PATH atomically', 'templates/contextkit/tools/scripts/resume.mjs', /writeFileAtomicSync\(LAST_TOUCHED_PATH/],
+    ['/resume command briefing ships', 'templates/claude/commands/pipeline/resume.md', /Re-bind the current Claude Code session/],
+    // Ticket 043 — distill-detect proposal-only at /log-session end.
+    ['distill-detect exports detect (ticket 043)', 'templates/contextkit/tools/scripts/distill-detect.mjs', /export function detect/],
+    ['distill-detect surfaces "we decided" pattern', 'templates/contextkit/tools/scripts/distill-detect.mjs', /we\|i\)\\s\+decided/],
+    ['distill-detect surfaces "from now on" pattern', 'templates/contextkit/tools/scripts/distill-detect.mjs', /from now on/],
+    ['log-session briefing wires distill-detect (ticket 043)', 'templates/claude/commands/log-session.md', /distill-detect\.mjs/],
+    ['log-session briefing flags distill as proposal-only', 'templates/claude/commands/log-session.md', /proposal-only/],
+    // Ticket 041 — /workflow macro chains roadmap → ADR → pipeline → ship.
+    ['workflow.mjs ships 4 phases (ticket 041)', 'templates/contextkit/tools/scripts/workflow.mjs', /PHASES\s*=\s*\['roadmap',\s*'adr',\s*'tickets',\s*'ship'\]/],
+    ['workflow.mjs exposes new subcommand', 'templates/contextkit/tools/scripts/workflow.mjs', /cmd === 'new'/],
+    ['workflow.mjs exposes advance subcommand', 'templates/contextkit/tools/scripts/workflow.mjs', /cmd === 'advance'/],
+    ['workflow.mjs exposes status subcommand', 'templates/contextkit/tools/scripts/workflow.mjs', /cmd === 'status'/],
+    ['workflow.mjs slug regex blocks invalid slugs', 'templates/contextkit/tools/scripts/workflow.mjs', /SLUG_RE\s*=\s*\/\^/],
+    ['/workflow command briefing ships (ticket 041)', 'templates/claude/commands/pipeline/workflow.md', /chain \/roadmap → \/new-adr → \/pipeline → \/ship/],
+    // ADR-0023 / ticket 052 — landing-page posture (playbook + slash command).
+    ['landing-page playbook ships fold rules (ADR-0023)', 'templates/contextkit/workflows/playbooks/landing-page.md', /Folds — the strategic minimum/],
+    ['landing-page playbook lists anti-Lovable refusals', 'templates/contextkit/workflows/playbooks/landing-page.md', /Anti-Lovable refusals/],
+    ['landing-page playbook references seo-aiso gate', 'templates/contextkit/workflows/playbooks/landing-page.md', /seo-aiso\.md/],
+    ['/landing-page command briefing ships', 'templates/claude/commands/landing-page.md', /anti-cookie-cutter/i],
+    // ADR-0024 / ticket 053 — media-gen (Veo + Nano Banana adapters).
+    ['media _adapter exports validateAdapter (ADR-0024)', 'templates/contextkit/runtime/providers/media/_adapter.mjs', /export function validateAdapter/],
+    ['media _adapter defines MediaProviderError', 'templates/contextkit/runtime/providers/media/_adapter.mjs', /export class MediaProviderError/],
+    ['media _adapter exports assertCredentials', 'templates/contextkit/runtime/providers/media/_adapter.mjs', /export function assertCredentials/],
+    ['media _adapter exports noteCostOrThrow', 'templates/contextkit/runtime/providers/media/_adapter.mjs', /export function noteCostOrThrow/],
+    ['media _adapter exports MEDIA_ERROR_CODES', 'templates/contextkit/runtime/providers/media/_adapter.mjs', /export const MEDIA_ERROR_CODES/],
+    ['nano-banana adapter declares id (ADR-0024)', 'templates/contextkit/runtime/providers/media/nano-banana.mjs', /export const id\s*=\s*'nano-banana'/],
+    ['nano-banana adapter declares kind=image', 'templates/contextkit/runtime/providers/media/nano-banana.mjs', /export const kind\s*=\s*'image'/],
+    ['nano-banana adapter exports generate()', 'templates/contextkit/runtime/providers/media/nano-banana.mjs', /export async function generate/],
+    ['nano-banana adapter declares GOOGLE_AI_API_KEY env var', 'templates/contextkit/runtime/providers/media/nano-banana.mjs', /GOOGLE_AI_API_KEY/],
+    ['veo adapter declares id', 'templates/contextkit/runtime/providers/media/veo.mjs', /export const id\s*=\s*'veo'/],
+    ['veo adapter declares kind=video', 'templates/contextkit/runtime/providers/media/veo.mjs', /export const kind\s*=\s*'video'/],
+    ['veo adapter exports generate()', 'templates/contextkit/runtime/providers/media/veo.mjs', /export async function generate/],
+    ['veo adapter polls long-running operation', 'templates/contextkit/runtime/providers/media/veo.mjs', /predictLongRunning/],
+    ['media-gen CLI dispatches image|video kinds', 'templates/contextkit/tools/scripts/media-gen.mjs', /image['"]?\s*&&\s*kind\s*!==\s*['"]video/],
+    ['media-gen CLI honours --dry-run', 'templates/contextkit/tools/scripts/media-gen.mjs', /args\.dryRun/],
+    ['/media-gen command briefing ships', 'templates/claude/commands/media-gen.md', /Veo \+ Nano Banana/i],
+    ['.env.example template references GOOGLE_AI_API_KEY (ADR-0024)', 'templates/contextkit/.env.example', /GOOGLE_AI_API_KEY/],
+    ['.env.example template references cost cap', 'templates/contextkit/.env.example', /CONTEXTDEVKIT_MEDIA_MAX_USD/],
+    ['installer copies .env.example template (ADR-0024)', 'install.mjs', /\.env\.example/],
+    // ADR-0025 / ticket 054 — SEO + AISO audit + seo-specialist agent.
+    ['seo-specialist agent ships', 'templates/claude/agents/seo-specialist.md', /SEO \+ AISO specialist/],
+    ['seo-specialist refuses unindexable SPAs', 'templates/claude/agents/seo-specialist.md', /Refuse-on-unindexable/],
+    ['seo-aiso playbook ships (ADR-0025)', 'templates/contextkit/workflows/playbooks/seo-aiso.md', /Two indexes, two rule sets/],
+    ['seo-aiso playbook lists llms.txt convention', 'templates/contextkit/workflows/playbooks/seo-aiso.md', /`llms\.txt`/],
+    ['seo-aiso playbook lists FAQ schema as load-bearing', 'templates/contextkit/workflows/playbooks/seo-aiso.md', /FAQ schema — the load-bearing AISO move/],
+    ['audit-shared exports walkProject', 'templates/contextkit/tools/scripts/audit-shared.mjs', /export function\* walkProject/],
+    ['audit-shared exports detectFramework', 'templates/contextkit/tools/scripts/audit-shared.mjs', /export function detectFramework/],
+    ['audit-shared exports renderFindings', 'templates/contextkit/tools/scripts/audit-shared.mjs', /export function renderFindings/],
+    ['audit-shared exports exitCodeFor', 'templates/contextkit/tools/scripts/audit-shared.mjs', /export const exitCodeFor/],
+    ['seo-audit exports runSeoAudit', 'templates/contextkit/tools/scripts/seo-audit.mjs', /export function runSeoAudit/],
+    ['seo-audit flags SPA_ENTRYPOINT as critical', 'templates/contextkit/tools/scripts/seo-audit.mjs', /SPA_ENTRYPOINT:\s*'critical'/],
+    ['aiso-audit exports runAisoAudit', 'templates/contextkit/tools/scripts/aiso-audit.mjs', /export function runAisoAudit/],
+    ['aiso-audit names the AI crawlers list', 'templates/contextkit/tools/scripts/aiso-audit.mjs', /GPTBot.*ClaudeBot.*PerplexityBot/s],
+    ['/seo-audit command in audit/ pack', 'templates/claude/commands/audit/seo-audit.md', /SEO \+ AISO audit/i],
+    // landing-architect agent — closes the gap left by ADR-0023 / ticket 052.
+    ['landing-architect agent ships (ADR-0023)', 'templates/claude/agents/landing-architect.md', /Landing-page & high-conversion site specialist/],
+    ['landing-architect refuses cookie-cutter on sight', 'templates/claude/agents/landing-architect.md', /refuses the cookie-cutter/],
+    ['landing-architect names the three decisions in order', 'templates/claude/agents/landing-architect.md', /three decisions, in order/],
+    ['landing-architect delegation matrix points at seo-specialist gate', 'templates/claude/agents/landing-architect.md', /seo-specialist.*mandatory gate/],
+    // ADR-0026 — GitHub sync awareness (sync-check.mjs: preflight + prepr).
+    ['sync-check exposes preflight mode (ADR-0026)', 'templates/contextkit/tools/scripts/sync-check.mjs', /function preflight\(\)/],
+    ['sync-check exposes prepr mode (ADR-0026)', 'templates/contextkit/tools/scripts/sync-check.mjs', /function prepr\(\)/],
+    ['sync-check times out network calls (ADR-0026)', 'templates/contextkit/tools/scripts/sync-check.mjs', /timeout:\s*\w/],
+    ['sync-check degrades without gh — skip, not pass (rule 8)', 'templates/contextkit/tools/scripts/sync-check.mjs', /PR checks skipped/],
+    ['sync-check queries PR status fields', 'templates/contextkit/tools/scripts/sync-check.mjs', /PR_FIELDS\s*=/],
+    ['/dev-start runs sync-check preflight (ADR-0026)', 'templates/claude/commands/pipeline/dev-start.md', /sync-check\.mjs\s+preflight/],
+    ['/dev-start re-checks with sync-check prepr before a PR', 'templates/claude/commands/pipeline/dev-start.md', /sync-check\.mjs\s+prepr/],
+    ['/git pr runs sync-check prepr first (ADR-0026)', 'templates/claude/commands/vcs/git.md', /sync-check\.mjs\s+prepr/],
+    // ADR-0028 — Proactive Advisor (six-lane improvement engine).
+    ['defaults expose the advisor config block (ADR-0028)', 'templates/contextkit/runtime/config/defaults.mjs', /advisor:\s*\{/],
+    ['advisor config declares the six lanes in order', 'templates/contextkit/runtime/config/defaults.mjs', /architecture:[\s\S]*features:[\s\S]*deepen:[\s\S]*security:[\s\S]*ux:[\s\S]*growth:/],
+    ['advisor wires all six lanes to an owner (ADR-0028)', 'templates/contextkit/runtime/config/defaults.mjs', /deepen:\s*\{\s*owner:\s*'product-owner'\s*\},[\s\S]*growth:\s*\{\s*owner:\s*'growth'\s*\}/],
+    ['Stop hook proposes the advisor after real work (ADR-0028)', 'templates/contextkit/runtime/hooks/check-registration.mjs', /maybeProposeAdvisor/],
+    ['advisor nudge is debounced like distill', 'templates/contextkit/runtime/hooks/check-registration.mjs', /ADVISOR_NUDGE_DEBOUNCE_MS/],
+    ['/advise command ships the six lanes (ADR-0028)', 'templates/claude/commands/advise.md', /architecture[\s\S]*features[\s\S]*deepen[\s\S]*security[\s\S]*ux[\s\S]*growth/i],
+    ['/advise runs before/after modes', 'templates/claude/commands/advise.md', /--before|--after/],
+    ['/advise feeds the DevPipeline backlog', 'templates/claude/commands/advise.md', /pipeline\.mjs/],
+    ['/advise skips unowned lanes, never fakes them (rule 8)', 'templates/claude/commands/advise.md', /no\s+owner/i],
+    ['/advise growth lane routes to retention (ADR-0028)', 'templates/claude/commands/advise.md', /retention/i],
+    // ADR-0028 — growth-team squad (growth + retention) + product-owner deepen lens.
+    ['growth agent ships in growth-team (ADR-0028)', 'templates/claude/agents/growth.md', /\(growth-team squad\)/],
+    ['growth agent refuses dark patterns', 'templates/claude/agents/growth.md', /dark pattern/i],
+    ['retention agent ships in growth-team', 'templates/claude/agents/retention.md', /\(growth-team squad\)/],
+    ['retention agent splits voluntary vs involuntary churn', 'templates/claude/agents/retention.md', /involuntary/i],
+    ['product-owner owns the deepen-existing-features lens (ADR-0028)', 'templates/claude/agents/product-owner.md', /deepen[- ]existing[- ]features/i],
+    ['squads README registers the growth-team', 'templates/contextkit/squads/README.md', /growth-team/],
+    // ADR-0029 — Behavioral discipline layer (Karpathy-derived, MIT).
+    ['behaviors.md ships the four guidelines (ADR-0029)', 'templates/contextkit/behaviors.md', /Think before coding[\s\S]*Simplicity first[\s\S]*Surgical changes[\s\S]*Goal-driven execution/i],
+    ['behaviors.md credits the MIT Karpathy source', 'templates/contextkit/behaviors.md', /MIT-licensed[\s\S]*Karpathy|Karpathy[\s\S]*MIT-licensed/],
+    ['behaviors.md reconciles surgical vs deliberate refactor', 'templates/contextkit/behaviors.md', /deliberate.{0,24}task|opportunistic/i],
+    ['behaviors-examples ships before/after diffs (ADR-0029)', 'templates/contextkit/behaviors-examples.md', /Disciplined/],
+    ['constitution template adds the behavioral-discipline section (ADR-0029)', 'templates/CLAUDE.md.tpl', /Behavioral discipline/],
+    ['constitution names ask-when-ambiguous (think before coding)', 'templates/CLAUDE.md.tpl', /ask when the request is ambiguous/i],
+    ['defaults expose the behaviors flag (ADR-0029)', 'templates/contextkit/runtime/config/defaults.mjs', /behaviors:\s*\{\s*active:\s*true\s*\}/],
+    ['boot reminds behavioral discipline when active', 'templates/contextkit/runtime/hooks/session-start.mjs', /Behavioral discipline is ACTIVE/],
+    ['installer seeds behaviors.md (ADR-0029)', 'install.mjs', /'behaviors\.md'/],
+    ['installer seeds behaviors-examples.md', 'install.mjs', /'behaviors-examples\.md'/],
+    // ADR-0027 — token-economy digest layer (session/ADR pre-digestion).
+    ['md-extract exposes shared section() helper (ADR-0027)', 'templates/contextkit/runtime/hooks/md-extract.mjs', /export function section/],
+    ['md-extract exposes firstParagraph() helper (ADR-0027)', 'templates/contextkit/runtime/hooks/md-extract.mjs', /export function firstParagraph/],
+    ['session-digest-core parses a session log (ADR-0027)', 'templates/contextkit/runtime/hooks/session-digest-core.mjs', /export function parseSessionLog/],
+    ['session-digest-core renders a compact digest (ADR-0027)', 'templates/contextkit/runtime/hooks/session-digest-core.mjs', /export function renderDigest/],
+    ['session-digest single-sources the parser (ADR-0027)', 'templates/contextkit/tools/scripts/session-digest.mjs', /session-digest-core/],
+    ['session-digest exposes --last mode (ADR-0027)', 'templates/contextkit/tools/scripts/session-digest.mjs', /--last/],
+    ['/distill-sessions reasons over the session digest (ADR-0027)', 'templates/claude/commands/distill-sessions.md', /session-digest\.mjs/],
+    ['/retro reasons over the session digest (ADR-0027)', 'templates/claude/commands/pipeline/retro.md', /session-digest\.mjs/],
+    ['boot exposes digestLatestSession (ADR-0027)', 'templates/contextkit/runtime/hooks/boot-context-readers.mjs', /export async function digestLatestSession/],
+    ['boot keeps the raw extractor as a fallback (ADR-0027)', 'templates/contextkit/runtime/hooks/boot-context-readers.mjs', /export async function extractLatestSession/],
+    ['boot digest degrades to raw — never empty (rule 2/8)', 'templates/contextkit/runtime/hooks/boot-context-readers.mjs', /mode:\s*'raw'/],
+    ['session-start renders the session digest (ADR-0027)', 'templates/contextkit/runtime/hooks/session-start.mjs', /digestLatestSession/],
+    ['context-pack reuses the boot session digest (ADR-0027)', 'templates/contextkit/tools/scripts/context-pack.mjs', /digestLatestSession/],
+    ['context-pack reuses the ADR core (ADR-0027)', 'templates/contextkit/tools/scripts/context-pack.mjs', /adr-digest-core/],
+    ['/dev-start opens with the context pack (ADR-0027)', 'templates/claude/commands/pipeline/dev-start.md', /context-pack\.mjs/],
+    ['/state opens with the context pack (ADR-0027)', 'templates/claude/commands/state.md', /context-pack\.mjs/],
+    ['adr-digest-core parses an ADR (ADR-0027)', 'templates/contextkit/tools/scripts/adr-digest-core.mjs', /export function parseAdr/],
+    ['adr-digest single-sources the parser (ADR-0027)', 'templates/contextkit/tools/scripts/adr-digest.mjs', /adr-digest-core/],
+    ['adr-digest supports keyword search (ADR-0027)', 'templates/contextkit/tools/scripts/adr-digest.mjs', /--search/],
+    ['adr-digest excludes the ADR template (ADR-0027)', 'templates/contextkit/tools/scripts/adr-digest.mjs', /_TEMPLATE\.md/],
+    ['/ship scopes via the ADR catalog (ADR-0027)', 'templates/claude/commands/pipeline/ship.md', /adr-digest\.mjs/],
+    ['/new-adr checks for an existing decision first (ADR-0027)', 'templates/claude/commands/new-adr.md', /adr-digest\.mjs/],
+    ['/deep-analysis scans existing ADRs before drafting (ADR-0027)', 'templates/claude/commands/audit/deep-analysis.md', /adr-digest\.mjs/],
+  ];
+  for (const [label, rel, re] of cases) {
+    re.test(await srcText(rel)) ? ok(label) : bad(`${label} — pattern ${re} missing in ${rel}`);
+  }
+}
+
+/** Rule 4: no shipped runtime/script constructs a `contextkit/` path via resolve/join. */
+async function checkNoHardcodedPaths(rep, KIT) {
+  const { ok, bad } = rep;
+  console.log('Checking platform paths are single-sourced (rule 4)...');
+  const re = /\b(resolve|join)\(.*['"]contextkit\//;
+  const offenders = [];
+  for (const d of ['templates/contextkit/runtime', 'templates/contextkit/tools/scripts']) {
+    for (const file of await listMjs(resolve(KIT, d))) {
+      const lines = (await readFile(file, 'utf-8').catch(() => '')).split('\n');
+      lines.forEach((line, i) => {
+        if (/^\s*(\*|\/\/)/.test(line)) return;
+        if (re.test(line)) offenders.push(`${file.replace(KIT, '').replaceAll('\\', '/')}:${i + 1}`);
+      });
+    }
+  }
+  offenders.length === 0
+    ? ok('no hardcoded contextkit/ path construction (all via pathsFor/PLATFORM_DIR)')
+    : offenders.forEach((o) => bad(`hardcoded contextkit/ path: ${o}`));
+}
+
+/** Shipped GitHub Actions must be SHA-pinned; CI must be least-privilege. */
+async function checkWorkflowsPinned(rep, KIT) {
+  const { ok, bad } = rep;
+  const srcText = srcTextFor(KIT);
+  console.log('Checking GitHub Actions are SHA-pinned...');
+  const files = [
+    '.github/workflows/ci.yml',
+    '.github/workflows/release.yml',
+    'templates/github/workflows/quality.yml',
+    'templates/github/workflows/security.yml',
+  ];
+  const floating = /uses:\s*[\w./-]+@v\d/;
+  for (const rel of files) {
+    const text = await srcText(rel);
+    if (!text) {
+      bad(`workflow missing: ${rel}`);
+      continue;
+    }
+    floating.test(text) ? bad(`${rel} has an unpinned (floating) action tag`) : ok(`${rel} actions are SHA-pinned`);
+  }
+  /permissions:[\s\S]*?contents:\s*read/.test(await srcText('.github/workflows/ci.yml'))
+    ? ok('ci.yml declares least-privilege permissions (contents: read)') : bad('ci.yml missing contents:read permissions');
+}
+
+/** Runs every source/structural check in order. `ctx` = { KIT }. */
+export async function runSourceChecks(rep, { KIT }) {
+  await checkSourceInvariants(rep, KIT);
+  await checkNoHardcodedPaths(rep, KIT);
+  await checkWorkflowsPinned(rep, KIT);
+}

package/tools/selfcheck.mjs

@@ -0,0 +1,268 @@
+#!/usr/bin/env node
+/**
+ * ContextDevKit self-check — smoke test for the kit BEFORE you ship it.
+ *
+ * - Imports every library engine module to catch syntax / import errors.
+ *   (Does NOT import the hook entrypoints — those self-execute `main()`.)
+ * - Asserts `composeSettings` wires the right hooks per level + config defaults.
+ * - Confirms the expected template files are present.
+ * - Delegates the deeper invariants to sibling modules split by category
+ *   (ADR-0016 H1 / task 037):
+ *     - `selfcheck-runtime.mjs`     — boot readers, atomic I/O, sid, squad meta.
+ *     - `selfcheck-config.mjs`      — level taxonomy + zod schema agreement.
+ *     - `selfcheck-source.mjs`      — source-level patterns, rule 4, SHA-pinning.
+ *     - `selfcheck-agent-forge.mjs` / `-ops.mjs` — agent-forge squad checks.
+ *
+ * Cohesion note (line budget): this file is the harness — engine-module
+ * loading, settings composition, config/loader checks, paths/presets,
+ * template inventory, plus dispatch to the five runners. They share one
+ * `ok`/`bad` reporter and run in a single `main()`. Splitting harness from
+ * inventory would scatter the one concern this file exists to express
+ * (smoke-test the kit before ship). Kept whole within the +10% tolerance.
+ *
+ * Run:  node tools/selfcheck.mjs   (exit 0 = healthy)
+ */
+import { existsSync } from 'node:fs';
+import { readdir } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { runRuntimeChecks } from './selfcheck-runtime.mjs';
+import { runConfigChecks } from './selfcheck-config.mjs';
+import { runSourceChecks } from './selfcheck-source.mjs';
+import { runAgentForgeChecks } from './selfcheck-agent-forge.mjs';
+import { runAgentForgeOpsChecks } from './selfcheck-agent-forge-ops.mjs';
+
+const KIT = dirname(dirname(fileURLToPath(import.meta.url)));
+const RT = resolve(KIT, 'templates/contextkit/runtime');
+let failures = 0;
+const ok = (m) => console.log(`  ✓ ${m}`);
+const bad = (m) => {
+  console.error(`  ✗ ${m}`);
+  failures++;
+};
+
+async function importLibs() {
+  console.log('Loading engine library modules...');
+  const libs = [
+    'config/paths.mjs',
+    'config/levels.mjs',
+    'config/defaults.mjs',
+    'config/load.mjs',
+    'config/settings-compose.mjs',
+    'config/presets.mjs',
+    'hooks/path-classification.mjs',
+    'hooks/safe-io.mjs',
+    'hooks/boot-context-readers.mjs',
+    'hooks/boot-signals.mjs',
+    'hooks/ledger.mjs',
+  ];
+  const mods = {};
+  for (const rel of libs) {
+    try {
+      mods[rel] = await import('file://' + resolve(RT, rel).replaceAll('\\', '/'));
+      ok(rel);
+    } catch (err) {
+      bad(`${rel} — ${err?.message ?? err}`);
+    }
+  }
+  return mods;
+}
+
+function checkCompose(composeSettings) {
+  console.log('Checking settings composition per level...');
+  const events = (lvl) => Object.keys(composeSettings(null, lvl).hooks || {}).sort();
+  const expect = {
+    1: ['SessionStart'],
+    2: ['PostToolUse', 'SessionStart', 'Stop'],
+    3: ['PostToolUse', 'PreToolUse', 'SessionStart', 'Stop'],
+    4: ['PostToolUse', 'PreToolUse', 'SessionStart', 'Stop'],
+    5: ['PostToolUse', 'PreToolUse', 'SessionStart', 'Stop'],
+    6: ['PostToolUse', 'PreToolUse', 'SessionStart', 'Stop'],
+    7: ['PostToolUse', 'PreToolUse', 'SessionStart', 'Stop'],
+  };
+  for (const [lvl, want] of Object.entries(expect)) {
+    const got = events(Number(lvl));
+    if (JSON.stringify(got) === JSON.stringify(want.sort())) ok(`L${lvl} → ${got.join(', ')}`);
+    else bad(`L${lvl} expected [${want}] got [${got}]`);
+  }
+  // Idempotency: re-composing existing settings must not duplicate entries.
+  const once = composeSettings(null, 5);
+  const twice = composeSettings(structuredClone(once), 5);
+  const dup = (twice.hooks.PostToolUse || []).length;
+  if (dup === 1) ok('re-running installer is idempotent (no duplicate hooks)');
+  else bad(`idempotency broken — PostToolUse has ${dup} groups after re-compose`);
+  // Status-line widget wired at L1+, and a user's own statusLine is preserved.
+  const sl = composeSettings(null, 1).statusLine;
+  sl && String(sl.command).includes('contextkit/runtime/statusline') ? ok('statusLine widget wired (L1+)') : bad('statusLine widget not wired');
+  composeSettings({ statusLine: { type: 'command', command: 'mine' } }, 5).statusLine?.command === 'mine'
+    ? ok('composeSettings preserves a user statusLine') : bad('composeSettings clobbered a user statusLine');
+}
+
+function checkConfig(load) {
+  console.log('Checking zero-dep config loader...');
+  const cfg = load.loadConfigSync(KIT);
+  if (Array.isArray(cfg?.ledger?.important) && cfg.ledger.important.length > 0) ok('defaults.ledger.important populated');
+  else bad('config defaults missing ledger.important');
+  if (Number.isInteger(load.getLevel(KIT))) ok(`getLevel() → L${load.getLevel(KIT)}`);
+  else bad('getLevel() did not return an integer');
+}
+
+function checkPresets(presets) {
+  if (!presets?.applyPreset) {
+    bad('presets.applyPreset not exported');
+    return;
+  }
+  const merged = presets.applyPreset({ ledger: { important: ['x/'] } }, 'next');
+  merged.ledger.important.includes('app/') && merged.ledger.important.includes('x/')
+    ? ok('applyPreset merges a stack preset (array union)') : bad('applyPreset did not merge the preset');
+  // 013 — a partial/custom preset (omits l5 + qa) must merge, not crash.
+  presets.PRESETS.__sc_partial = { ledger: { important: ['z/'] } };
+  try {
+    const partial = presets.applyPreset({}, '__sc_partial');
+    partial.ledger.important.includes('z/') && Array.isArray(partial.l5.highRiskPaths) && Array.isArray(partial.qa.criticalPaths)
+      ? ok('applyPreset tolerates a partial preset (missing l5/qa keys)') : bad('applyPreset partial-preset result malformed');
+  } catch (err) {
+    bad(`applyPreset crashed on a partial preset — ${err?.message ?? err}`);
+  } finally {
+    delete presets.PRESETS.__sc_partial;
+  }
+}
+
+function checkPaths(paths) {
+  if (!paths?.pathsFor) {
+    bad('pathsFor not exported');
+    return;
+  }
+  const pf = paths.pathsFor('/tmp/proj');
+  pf.pipeline.replaceAll('\\', '/').endsWith('contextkit/pipeline') && pf.sessions.replaceAll('\\', '/').endsWith('contextkit/memory/sessions')
+    ? ok('pathsFor resolves canonical absolute paths') : bad(`pathsFor wrong: ${pf.pipeline}`);
+}
+
+async function checkTemplates() {
+  console.log('Checking template inventory...');
+  // Ticket 047 — commands live in domain subfolders + at root. Walk recursively
+  // and assert (a) every expected command resolves by basename, (b) no two
+  // commands collide on basename (Claude Code resolves by basename).
+  async function walkCmds(dir, acc = []) {
+    for (const ent of await readdir(dir, { withFileTypes: true }).catch(() => [])) {
+      const full = resolve(dir, ent.name);
+      if (ent.isDirectory()) await walkCmds(full, acc);
+      else if (ent.name.endsWith('.md') && ent.name !== 'README.md') acc.push(ent.name);
+    }
+    return acc;
+  }
+  const cmds = await walkCmds(resolve(KIT, 'templates/claude/commands'));
+  cmds.length >= 35 ? ok(`${cmds.length} slash commands present (across packs + root)`) : bad(`only ${cmds.length} slash commands`);
+  const seen = new Map();
+  for (const c of cmds) seen.set(c, (seen.get(c) || 0) + 1);
+  const collisions = [...seen.entries()].filter(([, n]) => n > 1);
+  collisions.length === 0 ? ok('no command basename collides across packs (ticket 047)') : bad(`basename collisions: ${collisions.map(([n]) => n).join(', ')}`);
+  for (const c of ['setupcontextdevkit.md', 'distill-sessions.md', 'distill-apply.md', 'context-doctor.md', 'context-config.md', 'test-plan.md', 'scaffold-tests.md', 'qa-signoff.md', 'audit.md', 'ship.md', 'retro.md', 'context-stats.md', 'contract-check.md', 'aidevtool-from0.md', 'analyze-code-ia-practices.md', 'pipeline.md', 'roadmap.md', 'claude-md.md', 'git.md', 'squad.md', 'deps-audit.md', 'deep-analysis.md', 'security-setup.md', 'fleet.md', 'tune-agents.md', 'playbook.md', 'token-report.md', 'visual-test.md', 'forge-new.md',
+    'forge-list.md', 'forge-show.md', 'forge-doctor.md', 'forge-policy.md', 'forge-budget.md', 'forge-audit.md',
+    'forge-eval.md', 'forge-redteam.md', 'forge-route.md', 'forge-fallback-test.md',
+    'forge-refresh-matrix.md', 'forge-killswitch.md', 'forge-deprecate.md', 'runs.md']) {
+    cmds.includes(c) ? ok(`command ${c.replace('.md', '')} present`) : bad(`missing command ${c}`);
+  }
+  const agents = await readdir(resolve(KIT, 'templates/claude/agents')).catch(() => []);
+  agents.length >= 20 ? ok(`${agents.length} agent archetypes present`) : bad(`only ${agents.length} agents`);
+  for (const a of ['qa-orchestrator.md', 'qa-unit.md', 'qa-integration.md', 'qa-fuzzer.md', 'qa-perf.md', 'qa-e2e.md', 'privacy-lgpd.md', 'ux-designer.md', 'ui-designer.md', 'accessibility.md', 'product-owner.md', 'devops.md', 'infra-security.md', 'code-security.md',
+    'forge-orchestrator.md', 'agent-architect.md', 'model-router.md', 'prompt-engineer.md', 'tool-designer.md', 'packager.md',
+    'eval-designer.md', 'governance-officer.md', 'rag-designer.md']) {
+    agents.includes(a) ? ok(`agent ${a.replace('.md', '')} present`) : bad(`missing agent ${a}`);
+  }
+  existsSync(resolve(KIT, '.github/workflows/release.yml')) ? ok('release workflow present') : bad('missing release workflow');
+  const scripts = await readdir(resolve(KIT, 'templates/contextkit/tools/scripts')).catch(() => []);
+  for (const s of ['detect-stack.mjs', 'setup-complete.mjs', 'context-config.mjs', 'doctor.mjs', 'mark-simulation.mjs', 'predictions-review.mjs', 'tech-debt-scan.mjs', 'tech-debt-detectors.mjs', 'stats.mjs', 'contract-scan.mjs', 'pipeline.mjs', 'roadmap.mjs', 'claude-md.mjs', 'git.mjs', 'deps-audit.mjs', 'gh-alerts.mjs', 'pipeline-prioritize.mjs', 'pipeline-board.mjs', 'deep-analysis.mjs', 'squad.mjs', 'squad-meta.mjs', 'fleet.mjs', 'agent-tuning.mjs', 'playbook.mjs', 'token-report.mjs', 'visual-test.mjs', 'squad-pipeline.mjs', 'squad-pipeline-condition.mjs', 'pipeline-session.mjs', 'runs.mjs', 'pipeline-validate.mjs', 'resume.mjs', 'distill-detect.mjs', 'workflow.mjs']) {
+    scripts.includes(s) ? ok(`script ${s} present`) : bad(`missing script ${s}`);
+  }
+  const ghTpl = await readdir(resolve(KIT, 'templates/github')).catch(() => []);
+  ghTpl.includes('PULL_REQUEST_TEMPLATE.md') ? ok('GitHub PR template present') : bad('missing PR template');
+  ghTpl.includes('dependabot.yml') ? ok('Dependabot config template present') : bad('missing dependabot.yml');
+  existsSync(resolve(KIT, 'templates/github/workflows/security.yml')) ? ok('security workflow template present') : bad('missing security workflow template');
+  existsSync(resolve(KIT, 'templates/github/workflows/quality.yml')) ? ok('quality workflow template present') : bad('missing quality workflow template');
+  for (const f of [
+    'templates/CLAUDE.md.tpl', 'templates/docs/CHANGELOG.md.tpl', 'templates/contextkit/config.json',
+    'templates/contextkit/instrucoes.md', 'templates/gitattributes', 'install.mjs',
+    '.github/workflows/ci.yml', 'CHANGELOG.md', 'instrucoes.md', 'docs/ROADMAP.md',
+    'templates/contextkit/runtime/hooks/concurrency-guard.mjs', 'templates/contextkit/runtime/git-hooks/pre-push.mjs',
+    'templates/contextkit/runtime/hooks/safe-io.mjs', 'templates/contextkit/runtime/config/levels.mjs',
+    'templates/contextkit/runtime/statusline.mjs', 'templates/contextkit/runtime/config/presets.mjs',
+    'templates/contextkit/best-practices.md', 'templates/contextkit/pipeline/devpipeline.md',
+    'templates/contextkit/pipeline/working/.gitkeep',
+    'templates/contextkit/runtime/state/state-io.mjs',
+    'templates/contextkit/detectors/README.md', 'templates/contextkit/detectors/example-detector.mjs.example',
+    'templates/contextkit/memory/roadmap.md', 'templates/contextkit/CLAUDE.child.md.tpl',
+    'templates/contextkit/squads/README.md', 'templates/contextkit/squads/_BRIEFING.md.tpl',
+    'templates/contextkit/squads/agent-forge/README.md', 'templates/contextkit/squads/agent-forge/best-practices.md',
+    'templates/contextkit/squads/agent-forge/ROADMAP.md',
+    'templates/contextkit/squads/agent-forge/lib/yaml.mjs',
+    'templates/contextkit/squads/agent-forge/lib/router.mjs',
+    'templates/contextkit/squads/agent-forge/lib/architect.mjs',
+    'templates/contextkit/squads/agent-forge/lib/prompt-gen.mjs',
+    'templates/contextkit/squads/agent-forge/lib/tool-gen.mjs',
+    'templates/contextkit/squads/agent-forge/lib/packager.mjs',
+    'templates/contextkit/squads/agent-forge/router/capability-matrix.json',
+    'templates/contextkit/squads/agent-forge/router/decision-rules.json',
+    'templates/contextkit/squads/agent-forge/cli/forge-new.mjs',
+    'templates/contextkit/squads/agent-forge/cli/forge-ops.mjs',
+    'templates/contextkit/squads/agent-forge/cli/forge-eval-cli.mjs',
+    'templates/contextkit/squads/agent-forge/cli/forge-admin.mjs',
+    'templates/contextkit/squads/agent-forge/lib/package-ops.mjs',
+    'templates/contextkit/squads/agent-forge/lib/eval-designer.mjs',
+    'templates/contextkit/squads/agent-forge/lib/eval-runner.mjs',
+    'templates/contextkit/squads/agent-forge/lib/governance-officer.mjs',
+    'templates/contextkit/squads/agent-forge/lib/rag-designer.mjs',
+    'templates/contextkit/squads/agent-forge/pipeline.yaml',
+    'tools/selfcheck-agent-forge-ops.mjs',
+    'templates/claude/commands/forge/forge-new.md',
+    'templates/claude/commands/README.md',
+    'docs/SQUADS/agent-forge.md', 'docs/AGENT-PACKAGE-FORMAT.md',
+    'docs/SQUAD-PIPELINE-FORMAT.md',
+    'templates/contextkit/squads/agent-forge/templates/agent-package/manifest.yaml',
+    'templates/contextkit/squads/agent-forge/templates/agent-package/README.md',
+    'templates/contextkit/squads/agent-forge/templates/agent-package/.agentforgerc',
+    'templates/contextkit/squads/agent-forge/templates/agent-package/prompts/system.canonical.md',
+    'templates/contextkit/squads/agent-forge/templates/agent-package/tools/schemas.canonical.json',
+    'templates/contextkit/squads/agent-forge/templates/agent-package/evals/golden.jsonl',
+    'templates/contextkit/squads/agent-forge/templates/agent-package/evals/thresholds.yaml',
+    'templates/contextkit/squads/agent-forge/templates/agent-package/governance/cost.policy.yaml',
+    'templates/contextkit/squads/agent-forge/templates/agent-package/governance/compliance.policy.yaml',
+    'templates/contextkit/squads/agent-forge/templates/agent-package/governance/quality.policy.yaml',
+    'templates/contextkit/squads/agent-forge/templates/agent-package/governance/audit.schema.json',
+    'templates/contextkit/memory/business-rules/_TEMPLATE.md',
+    'templates/contextkit/memory/predictions/.gitkeep',
+    'templates/contextkit/memory/workflows/.gitkeep',
+  ]) {
+    existsSync(resolve(KIT, f)) ? ok(f) : bad(`missing ${f}`);
+  }
+  const wf = await readdir(resolve(KIT, 'templates/contextkit/workflows')).catch(() => []);
+  for (const f of ['README.md', 'L1-static-loading.md', 'L2-session-ledger.md', 'L3-multi-session.md', 'L4-squads.md', 'L5-proactive.md']) {
+    wf.includes(f) ? ok(`workflow ${f} present`) : bad(`missing workflow ${f}`);
+  }
+  const playbooks = await readdir(resolve(KIT, 'templates/contextkit/workflows/playbooks')).catch(() => []);
+  for (const f of ['tech-debt-sweep.md', 'simulate-impact.md', 'distillation-cycle.md', 'security-batch.md']) {
+    playbooks.includes(f) ? ok(`playbook ${f} present`) : bad(`missing playbook ${f}`);
+  }
+}
+
+async function main() {
+  console.log('\n🌀 ContextDevKit self-check\n');
+  const mods = await importLibs();
+  if (mods['config/settings-compose.mjs']?.composeSettings) checkCompose(mods['config/settings-compose.mjs'].composeSettings);
+  if (mods['config/load.mjs']?.loadConfigSync) checkConfig(mods['config/load.mjs']);
+  checkPaths(mods['config/paths.mjs']);
+  checkPresets(mods['config/presets.mjs']);
+  await runRuntimeChecks({ ok, bad }, { KIT, mods });
+  await runConfigChecks({ ok, bad }, { RT, mods });
+  await runSourceChecks({ ok, bad }, { KIT });
+  await runAgentForgeChecks({ ok, bad }, KIT);
+  await runAgentForgeOpsChecks({ ok, bad }, KIT);
+  await checkTemplates();
+  console.log(failures === 0 ? '\n✅ All checks passed.\n' : `\n❌ ${failures} check(s) failed.\n`);
+  process.exit(failures === 0 ? 0 : 1);
+}
+
+main().catch((err) => {
+  console.error('self-check crashed:', err);
+  process.exit(1);
+});