etymd 0.2.1 → 0.3.0

package/dist/index.js

@@ -1,24 +1,127 @@
-import path from 'node:path';
-import { promises } from 'node:fs';
 import { execFile } from 'node:child_process';
+import { promises } from 'node:fs';
 import { promisify } from 'node:util';
+import path from 'node:path';
 import YAML from 'yaml';
 import os from 'node:os';
 
-// src/core/scan.ts
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
 // src/pack/version.ts
-var PACK_VERSION = "2";
+var PACK_VERSION;
+var init_version = __esm({
+  "src/pack/version.ts"() {
+    PACK_VERSION = "3";
+  }
+});
 
 // package.json
-var package_default = {
-  name: "etymd",
-  version: "0.2.1"};
+var package_default;
+var init_package = __esm({
+  "package.json"() {
+    package_default = {
+      name: "etymd",
+      version: "0.3.0",
+      description: "Keep your agent instructions true \u2014 verify AGENTS.md, CLAUDE.md, rules & skills against the actual repo, with drift caught over time and a regression ledger.",
+      keywords: [
+        "cli",
+        "ai",
+        "agents",
+        "agents-md",
+        "claude-md",
+        "instructions",
+        "lint",
+        "drift",
+        "context-engineering",
+        "truth",
+        "developer-tools"
+      ],
+      license: "MIT",
+      author: "Alkis Yuv",
+      repository: {
+        type: "git",
+        url: "git+https://github.com/triartleet/etymd.git"
+      },
+      homepage: "https://github.com/triartleet/etymd#readme",
+      bugs: {
+        url: "https://github.com/triartleet/etymd/issues"
+      },
+      type: "module",
+      bin: {
+        etymd: "./dist/cli.js"
+      },
+      main: "./dist/index.js",
+      module: "./dist/index.js",
+      types: "./dist/index.d.ts",
+      exports: {
+        ".": {
+          types: "./dist/index.d.ts",
+          import: "./dist/index.js"
+        }
+      },
+      files: [
+        "dist",
+        "README.md",
+        "LICENSE",
+        "CHANGELOG.md"
+      ],
+      engines: {
+        node: ">=18.17"
+      },
+      scripts: {
+        build: "tsup",
+        dev: "tsup --watch",
+        start: "node dist/cli.js",
+        typecheck: "tsc --noEmit",
+        test: "vitest run",
+        "test:watch": "vitest",
+        format: "prettier --write . && npm run guard:md",
+        "format:check": "prettier --check . && npm run guard:md",
+        "guard:md": "! grep -rnF --include=*.md --exclude-dir=node_modules --exclude-dir=dist --exclude-dir=.git '\\*\\*' .",
+        prepare: "npm run build",
+        prepublishOnly: "npm run build && artifact-check",
+        changeset: "changeset",
+        "version:packages": "changeset version",
+        release: "npm run build && changeset publish"
+      },
+      dependencies: {
+        "@clack/prompts": "0.7.0",
+        commander: "12.1.0",
+        picocolors: "1.1.1",
+        yaml: "2.7.0"
+      },
+      devDependencies: {
+        "@changesets/cli": "2.27.11",
+        "@types/node": "22.10.2",
+        prettier: "3.4.2",
+        tsup: "8.3.5",
+        typescript: "5.7.2",
+        vitest: "2.1.8"
+      },
+      publishConfig: {
+        access: "public"
+      }
+    };
+  }
+});
 
 // src/version.ts
-var VERSION = package_default.version;
-var NAME = package_default.name;
-var pExecFile = promisify(execFile);
+var VERSION, NAME;
+var init_version2 = __esm({
+  "src/version.ts"() {
+    init_package();
+    VERSION = package_default.version;
+    NAME = package_default.name;
+  }
+});
 async function pathExists(p) {
   try {
     await promises.access(p);
@@ -64,15 +167,6 @@ function wordCount(text) {
 function approxTokens(words) {
   return Math.round(words / 0.75);
 }
-var CI_ENV_VARS = [
-  "CI",
-  "GITHUB_ACTIONS",
-  "GITLAB_CI",
-  "BUILDKITE",
-  "CIRCLECI",
-  "JENKINS_URL",
-  "TF_BUILD"
-];
 function isCiEnvironment() {
   return CI_ENV_VARS.some((v) => Boolean(process.env[v]));
 }
@@ -113,31 +207,21 @@ function matchesGlob(p, glob) {
 function matchesAnyGlob(p, globs) {
   return globs.some((g) => matchesGlob(p, g));
 }
-
-// src/core/detect.ts
-var IGNORED_DIRS = /* @__PURE__ */ new Set([
-  "node_modules",
-  ".git",
-  "dist",
-  "build",
-  "coverage",
-  ".next",
-  ".turbo",
-  ".cache",
-  ".pnpm",
-  "out"
-]);
-var MEANINGFUL_DOT_DIRS = /* @__PURE__ */ new Set([
-  ".github",
-  ".gitlab",
-  ".claude",
-  ".cursor",
-  ".githooks",
-  ".husky",
-  ".changeset",
-  ".vscode",
-  ".storybook"
-]);
+var pExecFile, CI_ENV_VARS;
+var init_util = __esm({
+  "src/core/util.ts"() {
+    pExecFile = promisify(execFile);
+    CI_ENV_VARS = [
+      "CI",
+      "GITHUB_ACTIONS",
+      "GITLAB_CI",
+      "BUILDKITE",
+      "CIRCLECI",
+      "JENKINS_URL",
+      "TF_BUILD"
+    ];
+  }
+});
 async function detectPackageManager(root, pkg) {
   if (pkg?.packageManager) {
     const name = pkg.packageManager.split("@")[0];
@@ -245,66 +329,6 @@ async function expandFileGlobs(root, globs, cap = 500) {
   }
   return [...out].sort();
 }
-var isMeta = (value) => /npm-run-all|run-s\b|run-p\b|concurrently|&&/.test(value);
-var ROLE_LADDERS = [
-  {
-    role: "formatCheck",
-    ladder: [
-      (k) => /^format:check$/.test(k),
-      (k) => /^test:format(:local)?$/.test(k),
-      (k) => /^(prettier:check|check:format|format:ci)$/.test(k),
-      (_k, v) => /prettier(\s|.*\s)(-l\b|--check)/.test(v)
-    ]
-  },
-  {
-    role: "typecheck",
-    exclude: /generate|codegen|build|emit|watch/,
-    ladder: [
-      (k) => /^(typecheck|type-check)$/.test(k),
-      (k) => /^test:types(:local)?$/.test(k),
-      (k) => /^(types|check:types|types:check)$/.test(k),
-      (_k, v) => /tsc\b.*--noemit/i.test(v)
-    ]
-  },
-  {
-    role: "test",
-    exclude: /watch|coverage|snapshot|e2e|integration|debug|notsilent|mdx/,
-    ladder: [
-      (k) => /^test:unit(:local|:ci)?$/.test(k),
-      (k) => /^test:jest$/.test(k),
-      (k, v) => /^test$/.test(k) && !isMeta(v),
-      (k) => /^test$/.test(k)
-    ]
-  },
-  {
-    role: "lint",
-    exclude: /fix|format|staged|watch|style/,
-    ladder: [
-      (k) => /^lint$/.test(k),
-      (k) => /^test:lint(:local)?$/.test(k),
-      (k) => /^lint:/.test(k),
-      (_k, v) => /eslint\b/.test(v) && !/--fix/.test(v)
-    ]
-  },
-  {
-    role: "format",
-    exclude: /check|:ci$/,
-    ladder: [
-      (k) => /^format$/.test(k),
-      (k) => /^(format:write|format:prettier|format:fix|prettier)$/.test(k),
-      (_k, v) => /prettier\b.*--write/.test(v)
-    ]
-  },
-  {
-    role: "build",
-    exclude: /watch|storybook/,
-    ladder: [(k) => /^build$/.test(k), (k) => /^build:/.test(k)]
-  },
-  {
-    role: "dev",
-    ladder: [(k) => /^dev$/.test(k), (k) => /^start$/.test(k), (k) => /^dev:/.test(k)]
-  }
-];
 function classifyCommands(scripts = {}) {
   const out = { raw: scripts };
   const entries = Object.entries(scripts);
@@ -319,27 +343,6 @@ function classifyCommands(scripts = {}) {
   }
   return out;
 }
-var FRAMEWORK_MARKERS = [
-  ["next", "Next.js"],
-  ["@tanstack/react-start", "TanStack Start"],
-  ["@tanstack/start", "TanStack Start"],
-  ["@tanstack/react-router", "TanStack Router"],
-  ["react", "React"],
-  ["vue", "Vue"],
-  ["svelte", "Svelte"],
-  ["@angular/core", "Angular"],
-  ["express", "Express"],
-  ["fastify", "Fastify"],
-  ["@nestjs/core", "NestJS"],
-  ["@trpc/server", "tRPC"],
-  ["vite", "Vite"],
-  ["react-scripts", "CRA"],
-  ["@apollo/client", "Apollo"],
-  ["drizzle-orm", "Drizzle"],
-  ["prisma", "Prisma"],
-  ["@sanity/client", "Sanity"],
-  ["nx", "Nx"]
-];
 function detectFrameworks(pkg) {
   if (!pkg) return [];
   const deps = { ...pkg.dependencies, ...pkg.devDependencies };
@@ -435,71 +438,6 @@ async function detectHooks(root, hooksPath, pkg) {
   }
   return { source: "none", preCommit: false, prePush: false, commitMsg: false, lintStaged };
 }
-var ARTIFACT_SPECS = [
-  { id: "agents", label: "AGENTS.md (operating contract)", path: "AGENTS.md", kind: "contract" },
-  {
-    id: "project-context",
-    label: "PROJECT_CONTEXT.md (ground-truth state)",
-    path: "PROJECT_CONTEXT.md",
-    kind: "state"
-  },
-  {
-    id: "decisions",
-    label: "DECISIONS.md (decision record)",
-    path: "DECISIONS.md",
-    kind: "decisions"
-  },
-  { id: "adr-dir", label: "ADR directory (docs/adr)", path: "docs/adr", kind: "decisions" },
-  {
-    id: "decisions-dir",
-    label: "ADR directory (docs/decisions)",
-    path: "docs/decisions",
-    kind: "decisions"
-  },
-  { id: "claude", label: "CLAUDE.md (Claude Code pointer)", path: "CLAUDE.md", kind: "adapter" },
-  {
-    id: "copilot",
-    label: "Copilot instructions",
-    path: ".github/copilot-instructions.md",
-    kind: "adapter"
-  },
-  {
-    id: "cursorrules",
-    label: ".cursorrules (legacy Cursor)",
-    path: ".cursorrules",
-    kind: "adapter"
-  },
-  { id: "cursor-rules", label: ".cursor/rules", path: ".cursor/rules", kind: "adapter" },
-  { id: "gemini", label: "GEMINI.md", path: "GEMINI.md", kind: "adapter" },
-  { id: "cline", label: ".clinerules", path: ".clinerules", kind: "adapter" },
-  { id: "windsurf", label: ".windsurfrules", path: ".windsurfrules", kind: "adapter" },
-  { id: "skills", label: "Agent skills (.claude/skills)", path: ".claude/skills", kind: "skill" },
-  {
-    id: "failure-modes-skill",
-    label: "Failure-modes register (skill)",
-    path: ".claude/skills/failure-modes",
-    kind: "skill"
-  },
-  {
-    id: "failure-modes-doc",
-    label: "Failure-modes register (doc)",
-    path: "docs/failure-modes.md",
-    kind: "other"
-  },
-  {
-    id: "sessions",
-    label: "Session archive (docs/sessions)",
-    path: "docs/sessions",
-    kind: "sessions"
-  },
-  { id: "githooks", label: "Tracked git hooks (.githooks)", path: ".githooks", kind: "gate" },
-  {
-    id: "inventory",
-    label: "Reuse inventory (docs/INVENTORY.md)",
-    path: "docs/INVENTORY.md",
-    kind: "map"
-  }
-];
 async function detectArtifacts(root) {
   const artifacts = await Promise.all(
     ARTIFACT_SPECS.map(async (spec) => ({
@@ -566,8 +504,187 @@ async function walkTree(root) {
   dirs.sort((a, b) => b.files - a.files);
   return { dirs, truncated: state.truncated };
 }
+var IGNORED_DIRS, MEANINGFUL_DOT_DIRS, isMeta, ROLE_LADDERS, FRAMEWORK_MARKERS, ARTIFACT_SPECS;
+var init_detect = __esm({
+  "src/core/detect.ts"() {
+    init_util();
+    IGNORED_DIRS = /* @__PURE__ */ new Set([
+      "node_modules",
+      ".git",
+      "dist",
+      "build",
+      "coverage",
+      ".next",
+      ".turbo",
+      ".cache",
+      ".pnpm",
+      "out"
+    ]);
+    MEANINGFUL_DOT_DIRS = /* @__PURE__ */ new Set([
+      ".github",
+      ".gitlab",
+      ".claude",
+      ".cursor",
+      ".githooks",
+      ".husky",
+      ".changeset",
+      ".vscode",
+      ".storybook"
+    ]);
+    isMeta = (value) => /npm-run-all|run-s\b|run-p\b|concurrently|&&/.test(value);
+    ROLE_LADDERS = [
+      {
+        role: "formatCheck",
+        ladder: [
+          (k) => /^format:check$/.test(k),
+          (k) => /^test:format(:local)?$/.test(k),
+          (k) => /^(prettier:check|check:format|format:ci)$/.test(k),
+          (_k, v) => /prettier(\s|.*\s)(-l\b|--check)/.test(v)
+        ]
+      },
+      {
+        role: "typecheck",
+        exclude: /generate|codegen|build|emit|watch/,
+        ladder: [
+          (k) => /^(typecheck|type-check)$/.test(k),
+          (k) => /^test:types(:local)?$/.test(k),
+          (k) => /^(types|check:types|types:check)$/.test(k),
+          (_k, v) => /tsc\b.*--noemit/i.test(v)
+        ]
+      },
+      {
+        role: "test",
+        exclude: /watch|coverage|snapshot|e2e|integration|debug|notsilent|mdx/,
+        ladder: [
+          (k) => /^test:unit(:local|:ci)?$/.test(k),
+          (k) => /^test:jest$/.test(k),
+          (k, v) => /^test$/.test(k) && !isMeta(v),
+          (k) => /^test$/.test(k)
+        ]
+      },
+      {
+        role: "lint",
+        exclude: /fix|format|staged|watch|style/,
+        ladder: [
+          (k) => /^lint$/.test(k),
+          (k) => /^test:lint(:local)?$/.test(k),
+          (k) => /^lint:/.test(k),
+          (_k, v) => /eslint\b/.test(v) && !/--fix/.test(v)
+        ]
+      },
+      {
+        role: "format",
+        exclude: /check|:ci$/,
+        ladder: [
+          (k) => /^format$/.test(k),
+          (k) => /^(format:write|format:prettier|format:fix|prettier)$/.test(k),
+          (_k, v) => /prettier\b.*--write/.test(v)
+        ]
+      },
+      {
+        role: "build",
+        exclude: /watch|storybook/,
+        ladder: [(k) => /^build$/.test(k), (k) => /^build:/.test(k)]
+      },
+      {
+        role: "dev",
+        ladder: [(k) => /^dev$/.test(k), (k) => /^start$/.test(k), (k) => /^dev:/.test(k)]
+      }
+    ];
+    FRAMEWORK_MARKERS = [
+      ["next", "Next.js"],
+      ["@tanstack/react-start", "TanStack Start"],
+      ["@tanstack/start", "TanStack Start"],
+      ["@tanstack/react-router", "TanStack Router"],
+      ["react", "React"],
+      ["vue", "Vue"],
+      ["svelte", "Svelte"],
+      ["@angular/core", "Angular"],
+      ["express", "Express"],
+      ["fastify", "Fastify"],
+      ["@nestjs/core", "NestJS"],
+      ["@trpc/server", "tRPC"],
+      ["vite", "Vite"],
+      ["react-scripts", "CRA"],
+      ["@apollo/client", "Apollo"],
+      ["drizzle-orm", "Drizzle"],
+      ["prisma", "Prisma"],
+      ["@sanity/client", "Sanity"],
+      ["nx", "Nx"]
+    ];
+    ARTIFACT_SPECS = [
+      { id: "agents", label: "AGENTS.md (operating contract)", path: "AGENTS.md", kind: "contract" },
+      {
+        id: "project-context",
+        label: "PROJECT_CONTEXT.md (ground-truth state)",
+        path: "PROJECT_CONTEXT.md",
+        kind: "state"
+      },
+      {
+        id: "decisions",
+        label: "DECISIONS.md (decision record)",
+        path: "DECISIONS.md",
+        kind: "decisions"
+      },
+      { id: "adr-dir", label: "ADR directory (docs/adr)", path: "docs/adr", kind: "decisions" },
+      {
+        id: "decisions-dir",
+        label: "ADR directory (docs/decisions)",
+        path: "docs/decisions",
+        kind: "decisions"
+      },
+      { id: "claude", label: "CLAUDE.md (Claude Code pointer)", path: "CLAUDE.md", kind: "adapter" },
+      {
+        id: "copilot",
+        label: "Copilot instructions",
+        path: ".github/copilot-instructions.md",
+        kind: "adapter"
+      },
+      {
+        id: "cursorrules",
+        label: ".cursorrules (legacy Cursor)",
+        path: ".cursorrules",
+        kind: "adapter"
+      },
+      { id: "cursor-rules", label: ".cursor/rules", path: ".cursor/rules", kind: "adapter" },
+      { id: "gemini", label: "GEMINI.md", path: "GEMINI.md", kind: "adapter" },
+      { id: "cline", label: ".clinerules", path: ".clinerules", kind: "adapter" },
+      { id: "windsurf", label: ".windsurfrules", path: ".windsurfrules", kind: "adapter" },
+      { id: "skills", label: "Agent skills (.claude/skills)", path: ".claude/skills", kind: "skill" },
+      {
+        id: "failure-modes-skill",
+        label: "Failure-modes register (skill)",
+        path: ".claude/skills/failure-modes",
+        kind: "skill"
+      },
+      {
+        id: "failure-modes-doc",
+        label: "Failure-modes register (doc)",
+        path: "docs/failure-modes.md",
+        kind: "other"
+      },
+      {
+        id: "sessions",
+        label: "Session archive (docs/sessions)",
+        path: "docs/sessions",
+        kind: "sessions"
+      },
+      { id: "githooks", label: "Tracked git hooks (.githooks)", path: ".githooks", kind: "gate" },
+      {
+        id: "inventory",
+        label: "Reuse inventory (docs/INVENTORY.md)",
+        path: "docs/INVENTORY.md",
+        kind: "map"
+      }
+    ];
+  }
+});
 
 // src/core/scan.ts
+var scan_exports = {};
+__export(scan_exports, {
+  scanProject: () => scanProject
+});
 function inferTicketKey(subjects) {
   const counts = /* @__PURE__ */ new Map();
   for (const m of subjects.matchAll(/\b([A-Z][A-Z0-9]{1,9})-\d+\b/g)) {
@@ -673,15 +790,23 @@ async function scanProject(root, opts = {}) {
     commands: classifyCommands(rootPkg?.scripts),
     ci,
     hooks,
+    publishable: Boolean(rootPkg) && rootPkg?.private !== true,
+    // `engines.vscode` is what makes a package an extension, and extensions publish through
+    // vsce — which never runs prepublishOnly.
+    publishRoute: !rootPkg ? "none" : rootPkg.engines?.vscode ? "vscode" : "npm",
     artifacts,
     freshness,
     tree
   };
 }
-var ETYMD_DIR = ".etymd";
-var CACHE_DIR = path.join(ETYMD_DIR, "cache");
-var CACHE_FACTS_FILE = path.join(CACHE_DIR, "facts.json");
-var BASELINE_FILE = path.join(ETYMD_DIR, "baseline.json");
+var init_scan = __esm({
+  "src/core/scan.ts"() {
+    init_version();
+    init_version2();
+    init_detect();
+    init_util();
+  }
+});
 function cacheFactsPath(root) {
   return path.join(root, CACHE_FACTS_FILE);
 }
@@ -718,14 +843,25 @@ async function readBaseline(root) {
 function deriveProfile(facts) {
   return (facts.git.recentAuthors ?? 1) > 2 ? "team" : "solo";
 }
+var ETYMD_DIR, CACHE_DIR, CACHE_FACTS_FILE, BASELINE_FILE;
+var init_facts = __esm({
+  "src/core/facts.ts"() {
+    init_util();
+    ETYMD_DIR = ".etymd";
+    CACHE_DIR = path.join(ETYMD_DIR, "cache");
+    CACHE_FACTS_FILE = path.join(CACHE_DIR, "facts.json");
+    BASELINE_FILE = path.join(ETYMD_DIR, "baseline.json");
+  }
+});
 
 // src/core/config.ts
-var CONFIG_FILE = path.join(ETYMD_DIR, "config.json");
-var DEFAULT_CONFIG = {
-  instructions: { include: [], exclude: [] },
-  context: { perFileWords: 4e3, totalWords: 8e3 },
-  state: { staleAfterDays: 30, maxChars: 9500 }
-};
+var config_exports = {};
+__export(config_exports, {
+  CONFIG_FILE: () => CONFIG_FILE,
+  DEFAULT_CONFIG: () => DEFAULT_CONFIG,
+  configPath: () => configPath,
+  readConfig: () => readConfig
+});
 function configPath(root) {
   return path.join(root, CONFIG_FILE);
 }
@@ -769,6 +905,23 @@ async function readConfig(root) {
   const instructions = obj.instructions ?? {};
   const context = obj.context ?? {};
   const state = obj.state ?? {};
+  const gates = obj.gates ?? {};
+  const failOn = (() => {
+    if (gates.failOn === void 0) return void 0;
+    if (typeof gates.failOn !== "string" || !["risk", "gap", "polish"].includes(gates.failOn.toLowerCase())) {
+      problems.push(`${CONFIG_FILE}: \`gates.failOn\` must be risk | gap | polish \u2014 ignored.`);
+      return void 0;
+    }
+    return gates.failOn.toLowerCase();
+  })();
+  const publishGate = (() => {
+    if (gates.publishGate === void 0) return void 0;
+    if (typeof gates.publishGate !== "boolean") {
+      problems.push(`${CONFIG_FILE}: \`gates.publishGate\` must be true or false \u2014 ignored.`);
+      return void 0;
+    }
+    return gates.publishGate;
+  })();
   return {
     present: true,
     problems,
@@ -784,63 +937,30 @@ async function readConfig(root) {
       state: {
         staleAfterDays: readBudget(state.staleAfterDays, "state.staleAfterDays", problems) ?? DEFAULT_CONFIG.state.staleAfterDays,
         maxChars: readBudget(state.maxChars, "state.maxChars", problems) ?? DEFAULT_CONFIG.state.maxChars
+      },
+      gates: {
+        commands: readGlobList(gates.commands, "gates.commands", problems) ?? DEFAULT_CONFIG.gates.commands,
+        failOn: failOn ?? DEFAULT_CONFIG.gates.failOn,
+        publishGate,
+        allowWriting: readGlobList(gates.allowWriting, "gates.allowWriting", problems) ?? DEFAULT_CONFIG.gates.allowWriting
       }
     }
   };
 }
-
-// src/core/context.ts
-var ALWAYS_LOADED = [
-  { path: "AGENTS.md", role: "operating contract" },
-  { path: "PROJECT_CONTEXT.md", role: "ground-truth state" },
-  { path: "CLAUDE.md", role: "Claude Code pointer" },
-  { path: "GEMINI.md", role: "Gemini pointer" },
-  { path: ".github/copilot-instructions.md", role: "Copilot instructions" },
-  { path: ".cursorrules", role: "Cursor rules (legacy)" }
-];
-var EXTRACTION_THRESHOLD = DEFAULT_CONFIG.context.perFileWords;
-function isAlwaysAppliedCursorRule(text) {
-  const fm = text.match(/^---\n([\s\S]*?)\n---/);
-  if (!fm) return true;
-  const frontmatter = fm[1] ?? "";
-  return /^\s*alwaysApply\s*:\s*true\s*$/m.test(frontmatter);
-}
-async function measureContext(root, perFileWords = EXTRACTION_THRESHOLD) {
-  const files = [];
-  for (const spec of ALWAYS_LOADED) {
-    const abs = path.join(root, spec.path);
-    const text = await readText(abs);
-    if (text === null) continue;
-    const words = wordCount(text);
-    files.push({ path: spec.path, role: spec.role, words, approxTokens: approxTokens(words) });
-  }
-  const rulesDir = path.join(root, ".cursor", "rules");
-  if (await pathExists(rulesDir)) {
-    try {
-      for (const entry of await promises.readdir(rulesDir)) {
-        if (!entry.endsWith(".mdc") && !entry.endsWith(".md")) continue;
-        const text = await readText(path.join(rulesDir, entry));
-        if (text === null || !isAlwaysAppliedCursorRule(text)) continue;
-        const words = wordCount(text);
-        files.push({
-          path: `.cursor/rules/${entry}`,
-          role: "Cursor rule (always applied)",
-          words,
-          approxTokens: approxTokens(words)
-        });
-      }
-    } catch {
-    }
+var CONFIG_FILE, DEFAULT_CONFIG;
+var init_config = __esm({
+  "src/core/config.ts"() {
+    init_facts();
+    init_util();
+    CONFIG_FILE = path.join(ETYMD_DIR, "config.json");
+    DEFAULT_CONFIG = {
+      instructions: { include: [], exclude: [] },
+      context: { perFileWords: 4e3, totalWords: 8e3 },
+      state: { staleAfterDays: 30, maxChars: 9500 },
+      gates: { commands: [], failOn: "risk", allowWriting: [] }
+    };
   }
-  const totalWords = files.reduce((s, f) => s + f.words, 0);
-  return {
-    files: files.sort((a, b) => b.words - a.words),
-    totalWords,
-    totalApproxTokens: approxTokens(totalWords),
-    perFileWords,
-    extractionCandidates: files.filter((f) => f.words >= perFileWords)
-  };
-}
+});
 
 // src/pack/templates.ts
 function runPrefix(pm) {
@@ -949,26 +1069,133 @@ ${[
 <!-- etymd pack v${PACK_VERSION} -->
 `;
 }
+function localHookCall(hook) {
+  return `# Repo-owned checks. This file is generated and will be overwritten; \`.githooks/${hook}.local\`
+# is yours \u2014 etymd never reads, writes, or regenerates it. Put project-specific guards there.
+LOCAL="$(dirname "$0")/${hook}.local"
+if [ -x "$LOCAL" ]; then
+  "$LOCAL" "$@" || exit 1
+fi`;
+}
 function generatePreCommitHook() {
   return `#!/usr/bin/env sh
 # etymd: process gate. Cheap, locally-knowable checks belong here (fast, blocks the commit).
+
+${localHookCall("pre-commit")}
+
+# Content screen \u2014 staged file bytes. Refuses to commit environment, employer or identity
+# detail into a repo whose history is (or could become) public. The checker and its patterns
+# are machine-local by design, so this is a NO-OP wherever no checker is installed: safe to
+# commit anywhere, active only where you opted in.
+#
+# Bypass, with a reason: git commit --no-verify
+${CONTENT_GATE_RESOLUTION}
+if [ -x "$GATE" ]; then
+  "$GATE" screen --staged || exit 1
+fi
+
+exit 0
+`;
+}
+function generateCommitMsgHook() {
+  return `#!/usr/bin/env sh
+# etymd: content screen \u2014 the commit message itself.
+#
+# The staged-content gate reads file bytes and never sees the message, yet a message is as
+# permanently published as any file. No-op where no checker is installed.
+#
+# Bypass, with a reason: git commit --no-verify
+GATE="\${COMMIT_MSG_GATE:-$(command -v etymd || true)}"
+if [ -x "$GATE" ]; then
+  "$GATE" screen --message "$1" || exit 1
+fi
+
+${localHookCall("commit-msg")}
+
 exit 0
 `;
 }
-function generatePrePushHook(facts) {
+function generatePrePushHook(facts, gates) {
   const run = runPrefix(facts.packageManager);
   const c = facts.commands;
-  const candidates = [c.formatCheck, c.typecheck, c.lint];
-  const steps = candidates.filter((key) => Boolean(key) && isSafeGateCommand(c.raw[key])).map((key) => `${run} ${key}`);
+  const candidates = gates?.commands.length ? gates.commands : [c.formatCheck, c.typecheck, c.lint];
+  const allowed = new Set(gates?.allowWriting ?? []);
+  const steps = candidates.filter(
+    (key) => Boolean(key) && (allowed.has(key) || isSafeGateCommand(c.raw[key]))
+  ).map((key) => `${run} ${key}`);
   const body = steps.length ? steps.map((s) => `echo "\u203A ${s}"
 ${s} || exit 1`).join("\n") : 'echo "etymd: no correctness commands detected \u2014 add format:check / typecheck / lint"';
+  const failOn = gates?.failOn ?? "risk";
+  const auditStep = `
+if command -v etymd >/dev/null 2>&1; then
+  echo "\u203A etymd audit --fail-on ${failOn}"
+  etymd audit --no-ledger --fail-on ${failOn} || exit 1
+else
+  echo "\u203A etymd audit skipped (not on PATH)"
+fi`;
   return `#!/usr/bin/env sh
 # etymd: correctness gate. Mirrors CI cheapest-first; blocks the push on any failure.
+
+${localHookCall("pre-push")}
 ${body}
+${auditStep}
+
+# Content screen, second pass \u2014 the WHOLE TREE rather than one diff. Catches anything committed
+# with --no-verify and anything a rebase or merge brought in from elsewhere. Advisory here (it
+# never blocks the push): the blocking decision belongs at commit time, where the fix is cheap.
+${CONTENT_GATE_RESOLUTION}
+if [ -x "$GATE" ] && [ "\${CONTENT_GATE_PREPUSH:-1}" = "1" ]; then
+  "$GATE" screen --tree --advisory || true
+fi
+
+exit 0
 `;
 }
+function generateArtifactCheckScript() {
+  return `#!/usr/bin/env sh
+# etymd: content screen \u2014 the published ARTIFACT, not the repository.
+#
+# Wire it into the irreversible moment:
+#   package.json \u2192 "prepublishOnly": "./scripts/artifact-check.sh"
+#
+# No-op where no checker is installed. Bypass is deliberate and loud: ARTIFACT_CHECK_SKIP=1.
+set -eu
+
+if [ "\${ARTIFACT_CHECK_SKIP:-0}" = "1" ]; then
+  echo "\u203A artifact-check: SKIPPED by ARTIFACT_CHECK_SKIP=1"
+  exit 0
+fi
+
+${CONTENT_GATE_RESOLUTION}
+[ -x "$GATE" ] || { echo "\u203A artifact-check: no checker installed \u2014 skipping."; exit 0; }
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT INT TERM
+
+# Pack exactly what would ship, then screen the unpacked bytes.
+if [ -f package.json ]; then
+  npm pack --pack-destination "$WORK" >/dev/null 2>&1 || {
+    echo "\u203A artifact-check: npm pack failed \u2014 cannot verify what would ship" >&2; exit 1; }
+  tar -xzf "$WORK"/*.tgz -C "$WORK" 2>/dev/null || true
+fi
+
+"$GATE" screen --dir "$WORK" || exit 1
+exit 0
+`;
+}
+var CONTENT_GATE_RESOLUTION;
+var init_templates = __esm({
+  "src/pack/templates.ts"() {
+    init_version();
+    CONTENT_GATE_RESOLUTION = `GATE="\${CONTENT_GATE:-$(command -v etymd || true)}"`;
+  }
+});
 
 // src/core/generate.ts
+var generate_exports = {};
+__export(generate_exports, {
+  planWorkflow: () => planWorkflow
+});
 async function planWorkflow(root, facts, opts) {
   const out = [];
   const add = async (rel, contents, label, executable = false) => {
@@ -989,10 +1216,96 @@ async function planWorkflow(root, facts, opts) {
   }
   if (opts.gates) {
     await add(".githooks/pre-commit", generatePreCommitHook(), "Process gate (pre-commit)", true);
-    await add(".githooks/pre-push", generatePrePushHook(facts), "Correctness gate (pre-push)", true);
+    await add(
+      ".githooks/commit-msg",
+      generateCommitMsgHook(),
+      "Content screen (commit message)",
+      true
+    );
+    await add(
+      ".githooks/pre-push",
+      generatePrePushHook(facts, opts.gateConfig),
+      "Correctness gate (pre-push)",
+      true
+    );
+    if (opts.gateConfig?.publishGate ?? opts.publishGate ?? facts.publishable) {
+      await add(
+        "scripts/artifact-check.sh",
+        generateArtifactCheckScript(),
+        "Content screen (published artifact)",
+        true
+      );
+    }
   }
   return out;
 }
+var init_generate = __esm({
+  "src/core/generate.ts"() {
+    init_templates();
+    init_util();
+  }
+});
+
+// src/index.ts
+init_scan();
+
+// src/core/context.ts
+init_config();
+init_util();
+var ALWAYS_LOADED = [
+  { path: "AGENTS.md", role: "operating contract" },
+  { path: "PROJECT_CONTEXT.md", role: "ground-truth state" },
+  { path: "CLAUDE.md", role: "Claude Code pointer" },
+  { path: "GEMINI.md", role: "Gemini pointer" },
+  { path: ".github/copilot-instructions.md", role: "Copilot instructions" },
+  { path: ".cursorrules", role: "Cursor rules (legacy)" }
+];
+var EXTRACTION_THRESHOLD = DEFAULT_CONFIG.context.perFileWords;
+function isAlwaysAppliedCursorRule(text) {
+  const fm = text.match(/^---\n([\s\S]*?)\n---/);
+  if (!fm) return true;
+  const frontmatter = fm[1] ?? "";
+  return /^\s*alwaysApply\s*:\s*true\s*$/m.test(frontmatter);
+}
+async function measureContext(root, perFileWords = EXTRACTION_THRESHOLD) {
+  const files = [];
+  for (const spec of ALWAYS_LOADED) {
+    const abs = path.join(root, spec.path);
+    const text = await readText(abs);
+    if (text === null) continue;
+    const words = wordCount(text);
+    files.push({ path: spec.path, role: spec.role, words, approxTokens: approxTokens(words) });
+  }
+  const rulesDir = path.join(root, ".cursor", "rules");
+  if (await pathExists(rulesDir)) {
+    try {
+      for (const entry of await promises.readdir(rulesDir)) {
+        if (!entry.endsWith(".mdc") && !entry.endsWith(".md")) continue;
+        const text = await readText(path.join(rulesDir, entry));
+        if (text === null || !isAlwaysAppliedCursorRule(text)) continue;
+        const words = wordCount(text);
+        files.push({
+          path: `.cursor/rules/${entry}`,
+          role: "Cursor rule (always applied)",
+          words,
+          approxTokens: approxTokens(words)
+        });
+      }
+    } catch {
+    }
+  }
+  const totalWords = files.reduce((s, f) => s + f.words, 0);
+  return {
+    files: files.sort((a, b) => b.words - a.words),
+    totalWords,
+    totalApproxTokens: approxTokens(totalWords),
+    perFileWords,
+    extractionCandidates: files.filter((f) => f.words >= perFileWords)
+  };
+}
+
+// src/index.ts
+init_generate();
 async function applyFiles(root, files, overwrite = /* @__PURE__ */ new Set()) {
   const written = [];
   const skipped = [];
@@ -1010,7 +1323,18 @@ async function applyFiles(root, files, overwrite = /* @__PURE__ */ new Set()) {
   return { written, skipped };
 }
 
+// src/index.ts
+init_facts();
+init_config();
+
+// src/engine/run.ts
+init_facts();
+init_config();
+init_scan();
+init_util();
+
 // src/lenses/context-economy.ts
+init_config();
 var LENS_ID = "context-economy";
 var TOTAL_BUDGET_WORDS = DEFAULT_CONFIG.context.totalWords;
 var contextEconomyLens = {
@@ -1062,6 +1386,12 @@ var contextEconomyLens = {
     };
   }
 };
+
+// src/lenses/gate-integrity/lens.ts
+init_util();
+
+// src/lenses/gate-integrity/inventory.ts
+init_util();
 var TOOL_MATCHERS = [
   ["sonar", /sonar-scanner|sonarqube|\bsonar\b/i],
   ["codecov", /codecov/i],
@@ -1076,24 +1406,78 @@ var TOOL_MATCHERS = [
   ["lint", /\beslint\b/],
   ["test", /\bjest\b|\bvitest\b|react-scripts test|\bnx\b[^&|;]*\btest\b/]
 ];
+var PM_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "run",
+  "run-script",
+  "install",
+  "i",
+  "ci",
+  "add",
+  "remove",
+  "rm",
+  "uninstall",
+  "un",
+  "update",
+  "up",
+  "upgrade",
+  "create",
+  "init",
+  "audit",
+  "publish",
+  "pack",
+  "link",
+  "unlink",
+  "why",
+  "list",
+  "ls",
+  "outdated",
+  "prune",
+  "dedupe",
+  "import",
+  "rebuild",
+  "root",
+  "config",
+  "cache",
+  "login",
+  "logout",
+  "whoami",
+  "version",
+  "workspace",
+  "workspaces",
+  "store",
+  "fund",
+  "deprecate",
+  "access",
+  "bin",
+  "env",
+  "help"
+]);
+var PM_BINARY_RUNNERS = /* @__PURE__ */ new Set(["exec", "dlx", "x"]);
+var NPX_SCRIPT_RUNNERS = /* @__PURE__ */ new Set(["run-s", "run-p", "npm-run-all"]);
 function expandScriptRefs(command, scripts, depth = 2) {
   if (depth <= 0) return command;
   let expanded = command;
-  for (const m of command.matchAll(
-    /(?:yarn|pnpm|npm run|bun run|npx run-s|npx run-p)\s+([A-Za-z0-9:._-]+)/g
-  )) {
-    const name = m[1];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (name) => {
+    if (seen.has(name)) return;
+    seen.add(name);
     const body = scripts[name];
     if (body) expanded += `
 ${expandScriptRefs(body, scripts, depth - 1)}`;
+  };
+  for (const m of command.matchAll(/\b(yarn|pnpm|npm|bun|npx)\b([^&|;]*)/g)) {
+    const manager = m[1];
+    const tokens = (m[2] ?? "").split(/\s+/).map((t) => t.replace(/["']/g, "")).filter(Boolean);
+    if (manager === "npx" && !(tokens[0] && NPX_SCRIPT_RUNNERS.has(tokens[0]))) continue;
+    for (const token of tokens) {
+      if (token.startsWith("-")) continue;
+      if (PM_BINARY_RUNNERS.has(token)) break;
+      if (PM_SUBCOMMANDS.has(token) || NPX_SCRIPT_RUNNERS.has(token)) continue;
+      add(token);
+    }
   }
   if (/npm-run-all|run-s|run-p/.test(command)) {
-    for (const token of command.split(/\s+/)) {
-      const clean = token.replace(/["']/g, "");
-      const body = scripts[clean];
-      if (body) expanded += `
-${expandScriptRefs(body, scripts, depth - 1)}`;
-    }
+    for (const token of command.split(/\s+/)) add(token.replace(/["']/g, ""));
   }
   return expanded;
 }
@@ -1527,6 +1911,16 @@ var gateIntegrityLens = {
     };
   }
 };
+
+// src/lenses/instruction-truth/lens.ts
+init_version();
+init_config();
+init_facts();
+init_util();
+
+// src/lenses/instruction-truth/claims.ts
+init_detect();
+init_util();
 async function listInstructionFiles(root, facts, scope) {
   const files = [];
   const add = async (rel) => {
@@ -2035,6 +2429,10 @@ var instructionTruthLens = {
     };
   }
 };
+
+// src/lenses/state-freshness.ts
+init_config();
+init_util();
 var LENS_ID4 = "state-freshness";
 var DECISIONS_FORMAT_MARKER = "<!-- decisions-format: 1 -->";
 var MS_PER_DAY = 864e5;
@@ -2244,6 +2642,9 @@ function rankFindings(findings) {
     (a, b) => TIER_ORDER[a.tier] - TIER_ORDER[b.tier] || EFFORT_ORDER[a.effort] - EFFORT_ORDER[b.effort]
   );
 }
+
+// src/engine/ledger.ts
+init_util();
 function ledgerPath(root) {
   return path.join(root, ".etymd", "ledger.json");
 }
@@ -2389,6 +2790,13 @@ async function runAudit(root, opts = {}) {
     diff
   };
 }
+
+// src/core/fleet.ts
+init_util();
+var FLEET_TRUST_VALUES = ["public-repo", "public-bound", "private"];
+function isFleetTrust(value) {
+  return typeof value === "string" && FLEET_TRUST_VALUES.includes(value);
+}
 function expandTilde(p) {
   if (p === "~") return os.homedir();
   if (p.startsWith("~/")) return path.join(os.homedir(), p.slice(2));
@@ -2484,7 +2892,10 @@ function loadRegistryEntries(projects, manifest, manifestFile) {
       private: rec.private === true,
       path: asString(rec.path),
       upstream: asString(rec.upstream),
-      trust: asString(rec.trust),
+      // An unknown value is NOT coerced to a default: trust gates content screening, so a typo
+      // must surface as "undeclared" (a finding) rather than quietly picking an answer.
+      trust: isFleetTrust(rec.trust) ? rec.trust : void 0,
+      trustRaw: asString(rec.trust),
       staleAfterDays: typeof rec.staleAfterDays === "number" ? rec.staleAfterDays : void 0,
       stateBudget: typeof rec.stateBudget === "number" ? rec.stateBudget : void 0,
       contract,
@@ -2601,6 +3012,24 @@ async function loadFleetManifest(manifestPath) {
     manifest.machineProfile = local.data.machineProfile === "corp" || local.data.machineProfile === "personal" ? local.data.machineProfile : void 0;
     const rootRaw = asString(local.data.root) ?? asString(parsed.root);
     if (rootRaw) manifest.root = path.resolve(dir, expandTilde(rootRaw));
+    const orientationRec = asRecord(parsed.orientation);
+    if (orientationRec) {
+      const orientationRoot = asString(orientationRec.root);
+      if (orientationRoot) manifest.orientation = { root: orientationRoot };
+      else {
+        manifest.problems.push({
+          kind: "bad-shape",
+          file: manifestFile,
+          detail: "`orientation` declares no `root` name \u2014 the fleet's orientation cannot be resolved"
+        });
+      }
+    } else if (parsed.orientation !== void 0) {
+      manifest.problems.push({
+        kind: "bad-shape",
+        file: manifestFile,
+        detail: '`orientation` must be an object (`{ "root": "<name>" }`) \u2014 ignored'
+      });
+    }
     loadRegistryEntries(parsed.projects, manifest, manifestFile);
   } else if (Array.isArray(parsed.sources)) {
     manifest.shape = "corpus";
@@ -2618,6 +3047,11 @@ async function loadFleetManifest(manifestPath) {
   }
   return manifest;
 }
+
+// src/engine/fleet.ts
+init_config();
+init_facts();
+init_util();
 var pExecFile2 = promisify(execFile);
 var FLEET_LENS = "fleet-manifest";
 var FLEET_JSON_SCHEMA = "fleet-experimental-0.2";
@@ -2743,6 +3177,19 @@ async function checkManifest(manifest) {
       );
     }
     seen.add(entry.name);
+    if (entry.profile !== "corp" && !entry.private && !entry.trust) {
+      const bad = entry.trustRaw;
+      findings.push(
+        finding3(
+          `${FLEET_LENS}/${bad ? "unknown-trust" : "undeclared-trust"}:${entry.name}`,
+          "risk",
+          bad ? `\`${entry.name}\` declares unknown trust \`${bad}\`` : `\`${entry.name}\` declares no \`trust\``,
+          [`${manifestFile}: ${entry.name}${bad ? `.trust = ${bad}` : " has no trust field"}`],
+          "Trust decides whether content screening applies. An unanswered entry is not a private one \u2014 publishing exposes ALL history, so a repo that went public without ever answering is exactly what a default would hide.",
+          `Declare one of ${FLEET_TRUST_VALUES.map((t) => `\`${t}\``).join(", ")}.`
+        )
+      );
+    }
     if (entry.private && entry.path) {
       findings.push(
         finding3(
@@ -2797,6 +3244,18 @@ async function checkManifest(manifest) {
       }
     }
   }
+  if (manifest.orientation && !seen.has(manifest.orientation.root)) {
+    findings.push(
+      finding3(
+        `${FLEET_LENS}/dangling-orientation:${manifest.orientation.root}`,
+        "gap",
+        `\`orientation.root\` names \`${manifest.orientation.root}\`, which is not a registered name`,
+        [`${manifestFile}: orientation.root = ${manifest.orientation.root}`],
+        "Every entry is guided by the orientation root implicitly \u2014 if it resolves to nothing, the whole fleet's orientation is a claim nothing can follow.",
+        "Point it at a registered name, or drop the block if this fleet has no orientation root."
+      )
+    );
+  }
   for (const name of Object.keys(manifest.localDirs)) {
     if (manifest.shape === "registry" && !seen.has(name)) {
       findings.push(
@@ -3007,6 +3466,52 @@ async function checkCorpEmails(manifest, findings, disclosures) {
     }
   }
 }
+async function checkGateDrift(manifest, findings, disclosures) {
+  const { planWorkflow: planWorkflow2 } = await Promise.resolve().then(() => (init_generate(), generate_exports));
+  const { scanProject: scanProject2 } = await Promise.resolve().then(() => (init_scan(), scan_exports));
+  const { readConfig: readConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+  for (const entry of manifest.entries) {
+    const root = entry.resolvedRoot;
+    if (!root || !await isDirectory(root)) continue;
+    if (entry.profile === "corp" || entry.private) continue;
+    const facts = await scanProject2(root);
+    if (!facts.git.isRepo) continue;
+    if (facts.hooks.source === "husky" || facts.hooks.source === "husky-legacy") {
+      disclosures.push(
+        `${entry.name}: hooks managed by ${facts.hooks.source} \u2014 gate drift not comparable against the .githooks pack`
+      );
+      continue;
+    }
+    const { config } = await readConfig2(root);
+    const planned = (await planWorkflow2(root, facts, { agents: false, gates: true, gateConfig: config.gates })).filter((f) => f.executable);
+    const missing = planned.filter((f) => !f.exists).map((f) => f.path);
+    const stale = planned.filter((f) => f.exists && f.differs).map((f) => f.path);
+    if (missing.length) {
+      findings.push(
+        finding3(
+          `${FLEET_LENS}/gate-missing:${entry.name}`,
+          "gap",
+          `\`${entry.name}\` is missing ${missing.length} gate${missing.length === 1 ? "" : "s"} the pack would install`,
+          missing.map((m) => `${entry.name}: no ${m}`),
+          "A gate absent in one repo is invisible from inside it \u2014 every commit there skips a check its siblings run.",
+          "Run `etymd gates` in that repo."
+        )
+      );
+    }
+    if (stale.length) {
+      findings.push(
+        finding3(
+          `${FLEET_LENS}/gate-stale:${entry.name}`,
+          "polish",
+          `\`${entry.name}\` has ${stale.length} gate${stale.length === 1 ? "" : "s"} that differ from what its own inputs generate`,
+          stale.map((s) => `${entry.name}: ${s}`),
+          "A hand-edited or outdated hook drifts from the pack silently \u2014 the repo believes it runs checks the file no longer contains.",
+          "Re-run `etymd gates` (it asks before overwriting), or record the intent in .etymd/config.json."
+        )
+      );
+    }
+  }
+}
 async function collectWallFindings(manifest) {
   const findings = [];
   const disclosures = [];
@@ -3015,6 +3520,7 @@ async function collectWallFindings(manifest) {
   await checkManifestRepoMachinePaths(manifest, findings, disclosures);
   await checkHygieneNeedles(manifest, findings, disclosures);
   await checkCorpEmails(manifest, findings, disclosures);
+  await checkGateDrift(manifest, findings, disclosures);
   return { findings, disclosures };
 }
 function stateAgeDays(facts) {
@@ -3140,4 +3646,8 @@ async function sweepFleet(manifest, opts = {}) {
   };
 }
 
+// src/index.ts
+init_version();
+init_version2();
+
 export { CONFIG_FILE, DECISIONS_FORMAT_MARKER, DEFAULT_CONFIG, EXTRACTION_THRESHOLD, FLEET_JSON_SCHEMA, FLEET_LENS, LENSES, NAME, PACK_VERSION, TOTAL_BUDGET_WORDS, VERSION, applyFiles, baselineCarriesMachinePath, baselinePath, buildGateInventory, cacheFactsPath, checkManifest, collectWallFindings, configPath, contextEconomyLens, corpPersistenceRoot, deriveProfile, expandTilde, extractCommandClaims, extractPathClaims, gateIntegrityLens, instructionTruthLens, isAlwaysAppliedCursorRule, listInstructionFiles, loadFleetManifest, measureContext, planWorkflow, rankFindings, readBaseline, readCachedFacts, readConfig, readLedger, reconcileLedger, runAudit, scanProject, stateFreshnessLens, sweepFleet, withoutMachinePath, writeBaseline, writeCachedFacts, writeLedger };