etymd 0.9.1 → 0.11.0

package/CHANGELOG.md

@@ -1,10 +1,116 @@
 # etymd
 
+## 0.11.0
+
+### Minor Changes
+
+- 1193d71: Content screen: allow-file entries carry provenance, and the env bypasses are gone
+
+  Every exemption is a hole in the gate, and a hole with no name on it lives forever — nobody can
+  ask "is this still needed?" about an entry nobody signed. Repo-level exceptions now live in
+  `.etymd-screen-allow` (the previous `.artifact-check-allow` is still honoured) as records of
+  labeled lines:
+
+  ```
+  pattern ^/Users/someone
+  reason test fixture for machine-path detector
+  date 2026-08-15
+  author owner
+  ```
+
+  The pattern is the rest of its line, verbatim — it may contain any character, `|` included,
+  without escaping. Delimiting a free-form field in-band would be an ambiguity in the format
+  itself, and every parser-side guard against it only makes the misparses you imagined loud while
+  leaving the rest silent; the line break is the one boundary the field cannot contain.
+
+  An entry naming the repo itself needs no provenance — a bare `^widget$` line is a complete
+  record, the exemption being exactly as wide as the name. Anything else missing a field is
+  reported and does not apply, so an unprovenanced file reads as noise to fix, not as silence to
+  trust.
+
+  The two environment bypasses the generated hooks carried — `CONTENT_GATE_PREPUSH` and
+  `ARTIFACT_CHECK_SKIP` — are removed. They were off-switches invisible in the tree: nothing in
+  the repo records that a gate was skipped, or why. The allow file is the one bypass path left,
+  and every entry in it says who exempted what, when, and for what reason.
+
+  Generated hooks now resolve their screener in a defined order: an explicit `CONTENT_GATE`, then
+  the repo's own `./dist/cli.js` when it builds one, then the `etymd` on PATH. The middle step is
+  the dogfood case — a repo developing the screener must gate on its own unreleased build, or its
+  hooks enforce the last published behaviour against a tree that has moved past it. Repos without
+  a `dist/` resolve exactly as before. Pack v8 — run `etymd gates` to pick it up.
+
+### Patch Changes
+
+- 652a353: Dependency advisories, 2026-08 batch: vitest 2.1.8 → 4.1.10, @changesets/cli 2.27.11 → 2.31.1,
+  tsup 8.3.5 → 8.5.1, plus in-range transitive fixes (js-yaml, nanoid, postcss, tmp)
+
+  Clears the whole advisory list reachable in range, then the vitest 2 → 4 major the rest of it
+  needed — the deliberate migration, not an audit-chased one: all 260 tests pass on 4.1.10
+  unchanged, config needed nothing, and the esbuild/vite/vitest development-server exposure class
+  (file read and execution via a listening dev server) is closed rather than reasoned around.
+
+  What remains is one low: esbuild 0.27.3–0.28.0, arbitrary file read when running a development
+  server on Windows, reached only through tsup (which pins ^0.27.0). Forcing an override past
+  tsup's declared range is audit-chasing a code path this repo never enters — nothing in it
+  starts a listening dev server — so it waits for a tsup release that carries esbuild 0.28.
+
+- 9521732: Content screen: a clean run reports itself, with the file count
+
+  A clean `etymd screen` printed nothing at all — the summary header, file count and binary-skip
+  count only appeared when there were findings. From inside a hook, where the exit code is the
+  only other signal, "silent" and "never looked" were indistinguishable, which is the exact
+  failure the binary-skip disclosure exists to prevent (0.9.1 claimed the count is always
+  reported; on a clean run it never was).
+
+  Every run now prints its summary line — scope, files scanned, binary skipped — and a clean run
+  says so. Hooks gain one line per successful commit; a silent screen remains possible only
+  where the screener is absent, which the tool already reports as inert rather than clean.
+
+## 0.10.0
+
+### Minor Changes
+
+- 2efbd34: `etymd gates` can now check the commit subject against Conventional Commits, at the commit-msg
+  door the content screen already used. Pack v7 — run `etymd gates` to pick it up.
+
+  **Off unless you ask for it.** Set `gates.commitFormat: true` in `.etymd/config.json`; anything
+  else, including leaving the key out, writes exactly the hook you got before this release. It is
+  the one generated check that needs nothing installed and would therefore run for everyone who
+  clones your repo — every other check the pack writes is either derived from what your repo
+  already does, or inert without a checker you installed yourself. A commit convention is neither.
+  It is an opinion, and this tool does not hold opinions on your behalf.
+
+  Where you do turn it on, it is a format check and not a taste check: it asks whether a machine
+  can classify the subject and stops there. An over-long subject is advice and never blocks, and
+  the subjects git writes for you (merge, revert, fixup, squash, amend) are exempt.
+
+### Patch Changes
+
+- 5104394: Content screen: recognise a repo's own name however the pattern spells it
+
+  The self-name exemption compared a pattern's raw source to the repo's directory name. Once a
+  pattern file started listing names word-anchored — `\bwidget\b` rather than `widget` — no source
+  matched any name, and the exemption silently stopped applying: a repo began reporting its own
+  `package.json`, its own contract titles and its own storage keys as leaks, enough of them to bury
+  anything else in the report. Nothing failed; the code, its comment and its test all still read as
+  correct.
+
+  The comparison is now of meaning rather than spelling. A pattern is exempt when the single
+  string it matches is one of the names the repo can prove is its own, with word anchors accepted
+  because they change where a match may begin, never which string matches. Any pattern that can
+  match more than one string — a class, a quantifier, an alternation — is never exempt, so an
+  exemption stays exactly as wide as a name.
+
+  "Its own name" also widens from the worktree directory to the union of the directory, the
+  `name` in `package.json` (npm scope stripped) and the basename of the `origin` remote, since
+  those three routinely disagree. Each is read from the repo being screened, so a repo can only
+  ever exempt itself; where none can be read the union is empty and every pattern stays active.
+
 ## 0.9.1
 
 ### Patch Changes
 
-- 8967d26: Content screen: skip binary files, and say how many were skipped
+- 91ddb97: Content screen: skip binary files, and say how many were skipped
 
   Compressed bytes contain any short sequence eventually, so a short pattern
   matches inside binary assets by accident and is reported as a "line" of
@@ -24,7 +130,7 @@
 
 ### Minor Changes
 
-- 3cf2e53: State documents are now checked for truth, not only for age: the instruction-truth lens runs its
+- 35dbeab: State documents are now checked for truth, not only for age: the instruction-truth lens runs its
   command-claim and path-claim checks over detected state docs, and resolves their `D-NNN` decision
   references against the repo's decisions file — a citation of an entry that was never written is a
   gap finding. References naming another record ("peer D-050") and citations against directory
@@ -35,12 +141,12 @@
 
 ### Minor Changes
 
-- f2c1bfd: `etymd gates` no longer writes a gate that cannot fail. It derives whether any risk-tier finding is
+- bad1380: `etymd gates` no longer writes a gate that cannot fail. It derives whether any risk-tier finding is
   reachable in the repo (a package manifest to contradict, a state document to fall behind); where
   none is, the generated hook drops to `--fail-on gap` and the output says so and why. A `failOn`
   recorded in `.etymd/config.json` is never adjusted, and `gates` now states which tier it wrote and
   where that tier came from — the config key was previously unmentioned anywhere in its output.
-- 743ad44: Declared-field checks are forward-only from the marker's position, not from the file. A decisions
+- e873664: Declared-field checks are forward-only from the marker's position, not from the file. A decisions
   file that declares required entry fields mid-life no longer demands them from the entries appended
   above the marker — an append-only record cannot backfill them. The built-in `Scope:` check shares
   the same gate; `Revisit:` keeps whole-file reach, since it fires only where the entry already wrote
@@ -50,7 +156,7 @@
 
 ### Minor Changes
 
-- 7371c8b: Decisions records can require fields of their own, and etymd holds no opinion about which.
+- d27d635: Decisions records can require fields of their own, and etymd holds no opinion about which.
 
   A decisions file already opts into per-entry format checks with a marker. It can now append field
   names to it — `<!-- decisions-format: 1 fields=Owner,Rollback -->` — and every entry after the
@@ -86,7 +192,7 @@
 
 ### Minor Changes
 
-- b02943b: Local gates: the tool now reads and rewrites what it generated, instead of guessing about it.
+- 47c5032: Local gates: the tool now reads and rewrites what it generated, instead of guessing about it.
 
   Two defects in the local-gate machinery, both silent, both affecting every project using
   `etymd gates`. Decision record:
@@ -164,7 +270,7 @@
 
 ### Minor Changes
 
-- e199ccc: `fleet add --profile corp` now records the alias-to-directory mapping too, not just the entry.
+- e265713: `fleet add --profile corp` now records the alias-to-directory mapping too, not just the entry.
 
   A corp entry in the tracked manifest is deliberately alias-only — no path, no remote — which is
   what keeps employer names out of a file that gets pushed. It also means the entry resolves to
@@ -185,7 +291,7 @@
   without an entry is inert, while an entry without a mapping is a broken registration sitting in
   the file that gets committed.
 
-- 9546979: `fleet add` no longer records a remote URL in the manifest.
+- e8ed2ba: `fleet add` no longer records a remote URL in the manifest.
 
   The field was write-only: nothing in the tool ever read it back. It was persisted because it
   happened to be derivable at registration time, and it stayed because no one asked what consumed
@@ -204,7 +310,7 @@
 
 ### Patch Changes
 
-- 52ebca8: Fix: `fleet add --profile corp` was silently ignored, registering employer repos as personal.
+- 88492b5: Fix: `fleet add --profile corp` was silently ignored, registering employer repos as personal.
 
   `fleet` declares its own `--profile` (the sweep filter), and commander hands a parent-declared
   option the value even when it is typed after the subcommand. So `fleet add <dir> --profile corp`
@@ -225,7 +331,7 @@
 
 ### Patch Changes
 
-- 915ae78: Fix: the shell gate now actually prints the sub-warning findings it documented.
+- 821f144: Fix: the shell gate now actually prints the sub-warning findings it documented.
 
   0.4.0 said "style and info print as advice" and did not do it — the generated hook ran only
   `shellcheck -S warning` and discarded everything below that bar. The generated file made no such
@@ -246,7 +352,7 @@
 
 ### Minor Changes
 
-- 69d1aad: Gate the shell surface: `etymd gates` now installs a shellcheck step in repos that have one.
+- 59c506d: Gate the shell surface: `etymd gates` now installs a shellcheck step in repos that have one.
 
   Package scripts are not the only executable surface a repo has, and in some repos they are not
   the main one. A tools or infra repo can be entirely `bootstrap/*.sh` plus `.githooks/*` with no
@@ -363,7 +469,7 @@
 
 ### Patch Changes
 
-- 80db483: Gate integrity: detect scripts regardless of how the package manager is invoked.
+- 7bc6cf5: Gate integrity: detect scripts regardless of how the package manager is invoked.
 
   Script expansion guessed the script name positionally — the token straight after the
   manager. That only holds for `npm run x`, `yarn x` and `pnpm x`. Every other live shape
@@ -392,7 +498,7 @@
 
 ### Patch Changes
 
-- fdf6b6e: Fleet sweep: recurring classes + `placement: "none"` honored.
+- 983c0e5: Fleet sweep: recurring classes + `placement: "none"` honored.
 
   - **Recurring classes** — the sweep report groups open findings by their engine-minted
     class prefix and lists every class present in ≥2 projects (worst tier first). A class
@@ -410,7 +516,7 @@
 
 ### Minor Changes
 
-- a58d3bd: Fleet mode — the truth guard across your repositories (design record `docs/decisions/004-fleet-truth-guard.md`; registry + fleet `--json` schemas EXPERIMENTAL through 0.2.x).
+- a336902: Fleet mode — the truth guard across your repositories (design record `docs/decisions/004-fleet-truth-guard.md`; registry + fleet `--json` schemas EXPERIMENTAL through 0.2.x).
 
   - New `state-freshness` truth lens: state/decisions artifacts dated by git committer dates only (never mtime); staleness is relative, so a dormant repo's old state is current; state char budget against the ~10k session-hook truncation; marker-gated decisions format checks (`Scope:`, duplicate/out-of-order `D-NNN` ids, past `Revisit:` dates as due review debt); ADR conventions (`docs/adr/`, `docs/decisions/`, `NNNN-*.md`) recognized natively.
   - New `etymd fleet` command family. The sweep runs a read-only audit per registered repo (`--manifest` required unless the cwd holds `registry.json` — no env var, no global pointer) and renders one line per project with a delta against `last.fleet.json`; detail only for new or risk findings. `fleet check` validates the manifest pair alone (dangling mappings, duplicate names, privacy leaks, machine paths). `fleet dismiss`/`fleet accept` resolve a project's finding from any cwd.

package/README.md

@@ -223,6 +223,7 @@ Every key is optional; omit the file entirely and the defaults below apply.
     "commands": ["typecheck", "lint"], // pre-push steps, in order
     "failOn": "risk", // audit tier that fails the push: risk | gap | polish
     "publishGate": true, // screen the published artifact
+    "commitFormat": true, // check the commit subject — Conventional Commits, off unless set
     "allowWriting": [], // commands allowed into a gate despite writing
     // Why a value here is what it is. Each key mirrors the field it explains, so the
     // note says what it refers to instead of sitting near it and hoping. Etymd keeps
@@ -337,8 +338,55 @@ packaged into a published release while every git-scoped check passes forever.
 
 Every generated hook resolves the screener at run time and **no-ops when it is absent**, so the
 same hook file is safe to commit to a public repo: it carries no patterns and imposes no policy
-on anyone who clones it. A deliberate exception is marked inline with `allow-published-string`,
-visible in the diff rather than hidden in an allowlist.
+on anyone who clones it. A deliberate exception on a line you can edit is marked inline with
+`allow-published-string`, visible in the diff.
+
+Some exemptions cannot live on the line itself: a scanner's own source contains the strings it
+screens for, its tests contain fixtures that must match, and a bundler strips comments so an
+inline marker would not survive into the artifact. Those live in `.etymd-screen-allow` at the
+repo root — one labeled line per field, so the pattern is never delimited:
+
+```
+pattern ^AcmeCorp|BetaCorp$
+reason fixture proving the detector fires on either name
+date 2026-08-15
+author someone
+```
+
+A pattern may contain any character, including the `|` shown above, without escaping: a
+free-form field delimited in-band is an ambiguity in the format itself, and no amount of
+parser-side guarding fixes that class — labels move the boundary to the line break, which the
+field cannot contain. An entry naming the repo itself needs no provenance — a bare `^widget$`
+line is a complete record, the exemption being exactly as wide as the name. Anything else
+missing a field is reported and does not apply: an exemption is a hole in the gate, and a hole
+nobody signed cannot be audited later. The file is read from the repo being screened, never a
+shared location, and it screens itself out (it necessarily contains every string it exempts).
+
+### The commit subject, if you ask for it
+
+Off unless you turn it on:
+
+```json
+{ "gates": { "commitFormat": true } }
+```
+
+in `.etymd/config.json`. Then the `commit-msg` hook also checks the subject against
+[Conventional Commits](https://www.conventionalcommits.org) — `<type>[(scope)][!]: <summary>`,
+with `feat fix docs style refactor perf test build ci chore revert` as the types. It is a format
+check and not a taste check: it asks whether a machine can classify the line, and stops there.
+An over-long subject is reported as advice and never blocks, and the subjects git writes for you
+— merge, revert, fixup, squash, amend — are exempt, since gating those would ask you to rewrite
+text you did not write.
+
+It is the one generated check that needs nothing installed, and therefore the one that would run
+for everyone who clones your repo. That is exactly why it is off by default. Every other check
+the pack writes is either derived from what your repo already does or inert without a checker you
+installed yourself; a commit convention is neither — it is an opinion, and this tool does not
+hold opinions on your behalf.
+
+Turn it on where the convention is already yours. A convention nobody gates does not get
+abandoned in a decision you could point at: it erodes one hurried commit at a time, and by the
+time the log reads as a mixture, every commit in it is already published.
 
 Modeled on this repo's own workflow (Etymd guards its own instructions with Etymd — its CI runs
 the same gate against its own freshly built CLI):

package/dist/{approve-HED3NCTE.js → approve-OUJ4UPGK.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { section, theme, print, renderBaselineDrift, glyph } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-UN7IAYM6.js';
-import { VERSION } from './chunk-AQM4GYGN.js';
-import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-C7LBUFNU.js';
-import { PACK_VERSION } from './chunk-6DUDIVIC.js';
-import './chunk-IV3FYVTS.js';
+import { scanProject } from './chunk-5GQ52DK6.js';
+import { VERSION } from './chunk-J7XVOTZL.js';
+import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-JHZ2BN4U.js';
+import { PACK_VERSION } from './chunk-LSZGCKIQ.js';
+import './chunk-4VPBP6K6.js';
 
 // src/commands/approve.ts
 async function run(opts) {

package/dist/audit-A75FVXHD.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+export { run } from './chunk-2KVQBL4E.js';
+import './chunk-JVLWM27I.js';
+import './chunk-F75Q43BC.js';
+import './chunk-3E2IPCRY.js';
+import './chunk-DWL2IKZH.js';
+import './chunk-5BVKFJWM.js';
+import './chunk-5GQ52DK6.js';
+import './chunk-J7XVOTZL.js';
+import './chunk-JHZ2BN4U.js';
+import './chunk-LSZGCKIQ.js';
+import './chunk-4VPBP6K6.js';

package/dist/{brief-2CXAUDNN.js → brief-MYUESUMM.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { print, theme } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-UN7IAYM6.js';
-import './chunk-AQM4GYGN.js';
-import { ETYMD_DIR } from './chunk-C7LBUFNU.js';
-import './chunk-6DUDIVIC.js';
-import './chunk-IV3FYVTS.js';
-import { promises } from 'node:fs';
-import path from 'node:path';
+import { scanProject } from './chunk-5GQ52DK6.js';
+import './chunk-J7XVOTZL.js';
+import { ETYMD_DIR } from './chunk-JHZ2BN4U.js';
+import './chunk-LSZGCKIQ.js';
+import './chunk-4VPBP6K6.js';
+import { promises } from 'fs';
+import path from 'path';
 
 async function run(opts) {
   const facts = await scanProject(opts.cwd);

package/dist/{chunk-ULM25GWG.js → chunk-2KVQBL4E.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-KGVRZ6WC.js';
+import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-JVLWM27I.js';
 import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-5BVKFJWM.js';
 
 // src/commands/audit.ts

package/dist/{chunk-V2SOHPXF.js → chunk-2VLNI3L2.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { readLedger, resolveEntry, writeLedger } from './chunk-OAFYLBVG.js';
+import { readLedger, resolveEntry, writeLedger } from './chunk-3E2IPCRY.js';
 import { print, renderLedger, glyph, theme } from './chunk-5BVKFJWM.js';
 
 // src/commands/ledger.ts

package/dist/{chunk-OAFYLBVG.js → chunk-3E2IPCRY.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { readJson } from './chunk-IV3FYVTS.js';
-import { promises } from 'node:fs';
-import path from 'node:path';
+import { readJson } from './chunk-4VPBP6K6.js';
+import { promises } from 'fs';
+import path from 'path';
 
 function ledgerPath(root) {
   return path.join(root, ".etymd", "ledger.json");

package/dist/{chunk-IV3FYVTS.js → chunk-4VPBP6K6.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
-import { execFile } from 'node:child_process';
-import { promises } from 'node:fs';
-import { promisify } from 'node:util';
+import { execFile } from 'child_process';
+import { promises } from 'fs';
+import 'path';
+import { promisify } from 'util';
 
 var pExecFile = promisify(execFile);
 async function pathExists(p) {

package/dist/{chunk-UN7IAYM6.js → chunk-5GQ52DK6.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-AQM4GYGN.js';
-import { PACK_VERSION } from './chunk-6DUDIVIC.js';
-import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-IV3FYVTS.js';
-import path from 'node:path';
-import { promises } from 'node:fs';
+import { VERSION } from './chunk-J7XVOTZL.js';
+import { PACK_VERSION } from './chunk-LSZGCKIQ.js';
+import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-4VPBP6K6.js';
+import path from 'path';
+import { promises } from 'fs';
 
 var IGNORED_DIRS = /* @__PURE__ */ new Set([
   "node_modules",

package/dist/{chunk-D2RI3CCT.js → chunk-DWL2IKZH.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { ETYMD_DIR } from './chunk-C7LBUFNU.js';
-import { pathExists, readText } from './chunk-IV3FYVTS.js';
-import path from 'node:path';
+import { ETYMD_DIR } from './chunk-JHZ2BN4U.js';
+import { pathExists, readText } from './chunk-4VPBP6K6.js';
+import path from 'path';
 
 var CONFIG_FILE = path.join(ETYMD_DIR, "config.json");
 var DEFAULT_CONFIG = {
@@ -70,6 +70,14 @@ async function readConfig(root) {
     }
     return gates.publishGate;
   })();
+  const commitFormat = (() => {
+    if (gates.commitFormat === void 0) return void 0;
+    if (typeof gates.commitFormat !== "boolean") {
+      problems.push(`${CONFIG_FILE}: \`gates.commitFormat\` must be true or false \u2014 ignored.`);
+      return void 0;
+    }
+    return gates.commitFormat;
+  })();
   return {
     present: true,
     problems,
@@ -91,6 +99,7 @@ async function readConfig(root) {
         commands: readGlobList(gates.commands, "gates.commands", problems) ?? DEFAULT_CONFIG.gates.commands,
         failOn: failOn ?? DEFAULT_CONFIG.gates.failOn,
         publishGate,
+        commitFormat,
         allowWriting: readGlobList(gates.allowWriting, "gates.allowWriting", problems) ?? DEFAULT_CONFIG.gates.allowWriting
       }
     }

package/dist/{chunk-JSUYV26K.js → chunk-F75Q43BC.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { DEFAULT_CONFIG } from './chunk-D2RI3CCT.js';
-import { readText, wordCount, approxTokens, pathExists } from './chunk-IV3FYVTS.js';
-import { promises } from 'node:fs';
-import path from 'node:path';
+import { DEFAULT_CONFIG } from './chunk-DWL2IKZH.js';
+import { readText, wordCount, approxTokens, pathExists } from './chunk-4VPBP6K6.js';
+import { promises } from 'fs';
+import path from 'path';
 
 var ALWAYS_LOADED = [
   { path: "AGENTS.md", role: "operating contract" },

package/dist/{chunk-EF6BPBG6.js → chunk-GWGKEPRX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { promises } from 'node:fs';
-import path from 'node:path';
+import { promises } from 'fs';
+import path from 'path';
 
 async function applyFiles(root, files, overwrite = /* @__PURE__ */ new Set()) {
   const written = [];

package/dist/{chunk-WENIJMVV.js → chunk-HRJJQCMT.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { DEFAULT_CONFIG } from './chunk-D2RI3CCT.js';
-import { PACK_VERSION } from './chunk-6DUDIVIC.js';
-import { readText, pathExists } from './chunk-IV3FYVTS.js';
-import path from 'node:path';
-import { createHash } from 'node:crypto';
+import { DEFAULT_CONFIG } from './chunk-DWL2IKZH.js';
+import { PACK_VERSION } from './chunk-LSZGCKIQ.js';
+import { readText, pathExists } from './chunk-4VPBP6K6.js';
+import path from 'path';
+import { createHash } from 'crypto';
 
 var GENERATION_MARKER_RE = /^(?:# |<!-- )etymd:generated pack-v\S+ ([0-9a-f]{16})(?: -->)?$/;
 function digestOf(body) {
@@ -132,7 +132,7 @@ ${[
     "md"
   );
 }
-var CONTENT_GATE_RESOLUTION = `GATE="\${CONTENT_GATE:-$(command -v etymd || true)}"`;
+var CONTENT_GATE_RESOLUTION = `GATE="\${CONTENT_GATE:-$(if [ -x ./dist/cli.js ]; then echo ./dist/cli.js; else command -v etymd || true; fi)}"`;
 function localHookCall(hook) {
   return `# Repo-owned checks. This file is generated and will be overwritten; \`.githooks/${hook}.local\`
 # is yours \u2014 etymd never reads, writes, or regenerates it. Put project-specific guards there.
@@ -161,9 +161,48 @@ fi
 exit 0
 `);
 }
-function generateCommitMsgHook() {
+var COMMIT_TYPES = [
+  "feat",
+  "fix",
+  "docs",
+  "style",
+  "refactor",
+  "perf",
+  "test",
+  "build",
+  "ci",
+  "chore",
+  "revert"
+];
+var SUBJECT_ADVISORY_LENGTH = 72;
+function commitFormatStep() {
+  const types = COMMIT_TYPES.join("|");
+  return `
+# Message format \u2014 <type>[(scope)][!]: <summary>. Needs nothing installed, so it always runs.
+subject=$(sed -e '/^#/d' -e '/^[[:space:]]*$/d' "$1" | head -1)
+case "$subject" in
+  "Merge "*|"Revert "*|fixup!*|squash!*|amend!*) ;;
+  *)
+    if ! printf '%s' "$subject" | grep -qE '^(${types})(\\([a-z0-9._/-]+\\))?!?: .+'; then
+      echo "\u2717 commit message: expected '<type>[(scope)][!]: <summary>'"
+      echo "  got:   $subject"
+      echo "  types: ${COMMIT_TYPES.join(" ")}"
+      echo "  a '!' after the type or scope marks a breaking change"
+      exit 1
+    fi
+    # Length is advice, not a block: the format is what tooling reads, the length is what a
+    # person reads, and only one of the two can break anything.
+    if [ "\${#subject}" -gt ${SUBJECT_ADVISORY_LENGTH} ]; then
+      echo "\u203A note: subject is \${#subject} characters; ${SUBJECT_ADVISORY_LENGTH} or fewer reads better in git log"
+    fi
+    ;;
+esac`;
+}
+function generateCommitMsgHook(gates) {
+  const format = gates?.commitFormat === true ? `${commitFormatStep()}
+` : "";
   return stampGenerated(`#!/usr/bin/env sh
-# etymd: content screen \u2014 the commit message itself.
+# etymd: the commit message itself \u2014 content screen, then format.
 #
 # The staged-content gate reads file bytes and never sees the message, yet a message is as
 # permanently published as any file. No-op where no checker is installed.
@@ -173,7 +212,7 @@ GATE="\${COMMIT_MSG_GATE:-$(command -v etymd || true)}"
 if [ -x "$GATE" ]; then
   "$GATE" screen --message "$1" || exit 1
 fi
-
+${format}
 ${localHookCall("commit-msg")}
 
 exit 0
@@ -241,7 +280,7 @@ ${auditStep}
 # with --no-verify and anything a rebase or merge brought in from elsewhere. Advisory here (it
 # never blocks the push): the blocking decision belongs at commit time, where the fix is cheap.
 ${CONTENT_GATE_RESOLUTION}
-if [ -x "$GATE" ] && [ "\${CONTENT_GATE_PREPUSH:-1}" = "1" ]; then
+if [ -x "$GATE" ]; then
   "$GATE" screen --tree --advisory || true
 fi
 
@@ -255,14 +294,10 @@ function generateArtifactCheckScript() {
 # Wire it into the irreversible moment:
 #   package.json \u2192 "prepublishOnly": "./scripts/artifact-check.sh"
 #
-# No-op where no checker is installed. Bypass is deliberate and loud: ARTIFACT_CHECK_SKIP=1.
+# The artifact gate is the one check that sees what actually SHIPS \u2014 bypass with
+# .etymd-screen-allow entries (with provenance) if you must exempt a string.
 set -eu
 
-if [ "\${ARTIFACT_CHECK_SKIP:-0}" = "1" ]; then
-  echo "\u203A artifact-check: SKIPPED by ARTIFACT_CHECK_SKIP=1"
-  exit 0
-fi
-
 ${CONTENT_GATE_RESOLUTION}
 [ -x "$GATE" ] || { echo "\u203A artifact-check: no checker installed \u2014 skipping."; exit 0; }
 
@@ -336,14 +371,15 @@ async function planWorkflow(root, facts, opts) {
     await add(".githooks/pre-commit", generatePreCommitHook(), "Process gate (pre-commit)", true);
     await add(
       ".githooks/commit-msg",
-      generateCommitMsgHook(),
-      "Content screen (commit message)",
+      generateCommitMsgHook(opts.gateConfig),
+      "Message gate (content screen, format)",
       true
     );
     const gateConfig = opts.gateConfig?.commands?.length ? opts.gateConfig : {
       commands: derivedCommands(facts, existingPrePush ?? void 0),
       failOn: opts.gateConfig?.failOn ?? DEFAULT_CONFIG.gates.failOn,
       publishGate: opts.gateConfig?.publishGate,
+      commitFormat: opts.gateConfig?.commitFormat,
       allowWriting: opts.gateConfig?.allowWriting ?? []
     };
     await add(

package/dist/{chunk-AQM4GYGN.js → chunk-J7XVOTZL.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // package.json
 var package_default = {
-  version: "0.9.1"};
+  version: "0.11.0"};
 
 // src/version.ts
 var VERSION = package_default.version;

package/dist/{chunk-C7LBUFNU.js → chunk-JHZ2BN4U.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { readJson } from './chunk-IV3FYVTS.js';
-import { promises } from 'node:fs';
-import path from 'node:path';
+import { readJson } from './chunk-4VPBP6K6.js';
+import { promises } from 'fs';
+import path from 'path';
 
 var ETYMD_DIR = ".etymd";
 var CACHE_DIR = path.join(ETYMD_DIR, "cache");

package/dist/{chunk-KGVRZ6WC.js → chunk-JVLWM27I.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import { measureContext } from './chunk-JSUYV26K.js';
-import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-OAFYLBVG.js';
-import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-D2RI3CCT.js';
-import { scanProject, expandFileGlobs } from './chunk-UN7IAYM6.js';
-import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-C7LBUFNU.js';
-import { PACK_VERSION } from './chunk-6DUDIVIC.js';
-import { pathExists, readJson, readText, isDirectory, matchesAnyGlob, git, normalizeRelPath, isCiEnvironment, isExecutable } from './chunk-IV3FYVTS.js';
-import path from 'node:path';
+import { measureContext } from './chunk-F75Q43BC.js';
+import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-3E2IPCRY.js';
+import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-DWL2IKZH.js';
+import { scanProject, expandFileGlobs } from './chunk-5GQ52DK6.js';
+import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-JHZ2BN4U.js';
+import { PACK_VERSION } from './chunk-LSZGCKIQ.js';
+import { pathExists, readJson, readText, isDirectory, matchesAnyGlob, git, normalizeRelPath, isCiEnvironment, isExecutable } from './chunk-4VPBP6K6.js';
+import path from 'path';
 import YAML from 'yaml';
-import { promises } from 'node:fs';
+import { promises } from 'fs';
 
 // src/engine/finding.ts
 var TIER_ORDER = { risk: 0, gap: 1, polish: 2 };

package/dist/{chunk-6DUDIVIC.js → chunk-LSZGCKIQ.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 // src/pack/version.ts
-var PACK_VERSION = "6";
+var PACK_VERSION = "8";
 
 export { PACK_VERSION };