godpowers 3.13.0 → 3.13.2

package/CHANGELOG.md

@@ -7,6 +7,103 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.13.2] - 2026-06-17
+
+Maintenance release that drives a third self-audit (`codeaudit.md`) to zero: one
+Medium and twelve Low findings across de-duplication, error handling, security
+hardening, the test gate, and docs. No public command/agent/workflow/recipe
+surface change (counts stay 120 / 40 / 13 / 44); lib module count 90 -> 91.
+
+### Changed
+- **Shared sync check-builder (ARC-001):** the four `*-sync` modules no longer
+  copy-paste `addCheck`/`listFiles`; they share `lib/sync-check.js` (full
+  `addCheck` for the aggregator, area-bound `makeAddCheck` for the rest).
+- **Per-file coverage floor (TEST-001):** `coverage:lib` now emits a json-summary
+  and `scripts/check-per-file-coverage.js` (in `release:check`) fails any lib
+  module below 70% lines (excluding the two environment-bound browser drivers),
+  so a single file can no longer rot while the aggregate stays green.
+- **De-duplication and cleanup (QUAL-001/002/003):** removed dead helpers
+  (two unused `rel()`, an unused `sha`), added `sync-fs.readTextOrNull` adopted by
+  `requirements.js` (which now sources PRD/ROADMAP paths from `artifact-map`), and
+  fixed a boolean/string status wart in `repo-surface-sync`.
+- **Pillars delineation (ARC-002):** `pillars.js` now has section dividers
+  separating the model and artifact-sync halves (a full split was deferred; the
+  halves share construction functions that are public API).
+
+### Fixed
+- **Reverse-sync error visibility (ERR-001):** the requirements step now writes
+  state before the ledger and surfaces a caught error as `requirementsError`
+  instead of silently nulling it.
+
+### Security
+- **MCP module-name guard (SEC-001):** `requireRuntime` rejects any name that is
+  not a plain lib basename (defense-in-depth).
+- **YAML recursion cap (SEC-002):** `intent.cleanArrays` caps recursion depth so a
+  pathologically deep file cannot overflow the stack.
+
+### Performance
+- **have-nots regex (PERF-001):** `findPositions` compiles its regex once instead
+  of per line. The whole-ledger read in `evidence.readJsonl` is documented as
+  bounded/acceptable with an opt-in prune noted for the future (PERF-002).
+
+### Docs
+- **Absolute README doc links (DOC-001):** `docs/` is deliberately excluded from
+  the package, so the README's `docs/*` links are now absolute GitHub URLs that
+  resolve on the npm page and in the tarball.
+
+## [3.13.1] - 2026-06-16
+
+Maintenance release that drives a full self-audit (`codeaudit.md`) to zero: one
+High finding, plus the Medium and Low findings, fixed across runtime correctness,
+security hardening, the test gate, documentation, and de-duplication. No public
+command, agent, workflow, or recipe surface changes (counts stay 120 / 40 / 13 / 44).
+
+### Fixed
+- **Ledger record loss under concurrency (ERR-001):** `lib/evidence.js`
+  `appendJsonlAtomic` did a read-modify-write of the whole ledger, so two
+  concurrent `verify`/`outcome check` processes lost each other's records and
+  every append was O(n). It now uses `fs.appendFileSync` (O_APPEND), mirroring
+  `lib/events.js`; a concurrency regression test asserts 8 writers x 25 records
+  all survive.
+- **Buffer-overflow verdicts (ERR-003):** a `maxBuffer` (ENOBUFS) overflow was
+  recorded as a plain command failure; it is now surfaced distinctly. The 16 MB
+  cap is the named constant `MAX_OUTPUT_BYTES`.
+- **Doc accuracy:** `SECURITY.md` no longer recommends the non-existent
+  `npm install --verify` (use `npm audit signatures`); the stale
+  `ARCHITECTURE-MAP.md` counts are regenerated and now machine-guarded.
+
+### Security
+- **Advisory hook (SEC-001):** `hooks/pre-tool-use.sh` is reframed as a
+  best-effort typo guard (not a security boundary) and now normalizes whitespace
+  and matches common destructive-command variants (`rm -fr`, `-r -f`, `./`
+  prefix, `git push -f`/`--force-with-lease`). Covered by `scripts/test-hooks.js`.
+- **Disk-sourced verifier (SEC-002):** `outcome check` now announces the verifier
+  command and its `goal.json` source path before executing, so running it in an
+  untrusted cloned repo cannot silently run a planted command.
+- **Ledger secrets (SEC-003):** the human-readable `LEDGER-LOG.md` command echo
+  masks obvious secret shapes; `SECURITY.md` documents that `.godpowers/ledger/`
+  may capture command output.
+- **Codex sandbox (SEC-004):** `SECURITY.md` documents the Codex
+  `sandbox_mode = "workspace-write"` install default.
+
+### Changed
+- **Test gate (TEST-001/002/003):** `coverage:lib` now enforces `--branches 75`;
+  new `scripts/test-runtime-audit.js` raises `runtime-audit.js` line coverage
+  68.8% -> 77.8%; `scripts/test-router.js` no longer shares cumulative state and
+  cleans up its temp dirs.
+- **De-duplication (ARC-001/002, QUAL-001/002):** the five `*-sync` modules share
+  `lib/sync-fs.js`; the ANSI logger moves to `lib/cli-log.js` and `slugify` to
+  `lib/text-util.js`; `installer-args.parseArgs` is now table-driven (was a
+  358-line function); `state.STATE_FILE` is the canonical state-file constant and
+  `artifact-map.js`'s scope is documented accurately.
+- **Re-audit follow-ups (ARC-003, QUAL-003, DOC-004/005, ERR-004, TEST-005):** a
+  fresh self-audit of the above confirmed no regressions and closed the residual
+  gaps: `installer-core.js` now imports the shared logger; `dashboard.js`/
+  `planning-systems.js` use `sync-fs`; the `lib/README` module catalog is complete
+  and guarded by a completeness check; the corrupt-state error is typed
+  (`err.code = 'CORRUPT_STATE'`) instead of message-matched; and the hook tests
+  assert each warning's text, not just its exit code.
+
 ## [3.13.0] - 2026-06-16
 
 ### Changed

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/aihxp/godpowers/actions/workflows/ci.yml/badge.svg)](https://github.com/aihxp/godpowers/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-3.13.0-blue)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-3.13.2-blue)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/godpowers.svg)](https://www.npmjs.com/package/godpowers)
 
 **Ship fast. Ship right. Ship everything. Ship accountably.**
@@ -12,26 +12,34 @@ idea to hardened production. It runs as **slash commands inside your AI coding
 tool** (Claude Code, Codex, Cursor, etc.) that orchestrate **specialist agents**
 in fresh contexts to do the work.
 
-Want the short proof first? Start with [Quick Proof](docs/quick-proof.md) to
+Want the short proof first? Start with [Quick Proof](https://github.com/aihxp/godpowers/blob/main/docs/quick-proof.md) to
 run `npx godpowers quick-proof --project=. --brief`, see outcome metrics, pick
 a starter command set, and understand runtime expectations before reading the
-full reference. The [First 10 Minute Proof Case Study](docs/case-studies/first-10-minute-proof.md)
+full reference. The [First 10 Minute Proof Case Study](https://github.com/aihxp/godpowers/blob/main/docs/case-studies/first-10-minute-proof.md)
 shows the same evidence as a before-and-after adoption story. External
-CLI-verifiable canaries now cover [sindresorhus/is](docs/case-studies/sindresorhus-is-adoption-canary.md),
-[expressjs/cors](docs/case-studies/expressjs-cors-adoption-canary.md), and
-[tinyhttp/tinyhttp](docs/case-studies/tinyhttp-adoption-canary.md), with host
+CLI-verifiable canaries now cover [sindresorhus/is](https://github.com/aihxp/godpowers/blob/main/docs/case-studies/sindresorhus-is-adoption-canary.md),
+[expressjs/cors](https://github.com/aihxp/godpowers/blob/main/docs/case-studies/expressjs-cors-adoption-canary.md), and
+[tinyhttp/tinyhttp](https://github.com/aihxp/godpowers/blob/main/docs/case-studies/tinyhttp-adoption-canary.md), with host
 slash-command gaps called out rather than hidden.
-Host-run proof studies now cover [slugify-cli](docs/case-studies/run-a.md),
-[Countdown](docs/case-studies/run-b.md), and
-[react-github-readme-button](docs/case-studies/run-c.md), including one
+Host-run proof studies now cover [slugify-cli](https://github.com/aihxp/godpowers/blob/main/docs/case-studies/run-a.md),
+[Countdown](https://github.com/aihxp/godpowers/blob/main/docs/case-studies/run-b.md), and
+[react-github-readme-button](https://github.com/aihxp/godpowers/blob/main/docs/case-studies/run-c.md), including one
 blocked harden run recorded as evidence instead of hidden as success.
 
 Godpowers makes AI coding accountable: every serious run should leave disk
 state, artifacts, validation gates, host guarantees, and a next action. Code is
 only one output. The project memory and proof trail matter too.
 
-Version 3.13.0 makes the default greenfield arc (`/god-mode`) miss less. The
-one-shot `full-arc` workflow now runs a whole-codebase code audit after the
+Version 3.13.2 is a maintenance release that drives a third self-audit to zero:
+the `*-sync` modules now share one check-builder, the coverage gate enforces a
+per-file floor, the corrupt-state error is typed, dead helpers are removed, and
+the MCP module loader and YAML parser gain defense-in-depth guards. Version
+3.13.1 drove a full self-audit to zero: the runtime ledger no longer loses
+verification records under concurrent writes, the `outcome check` verifier and
+the pre-tool-use hook are hardened, the `*-sync` modules share one filesystem
+helper, the argument parser is table-driven, and branch coverage is gated.
+Version 3.13.0 makes the default greenfield arc (`/god-mode`) miss
+less. The one-shot `full-arc` workflow now runs a whole-codebase code audit after the
 build (so it catches what the per-slice reviews missed in AI-generated code) and
 a documentation pass after harden (so the shipped product has docs verified
 against the code, not vibes). The arc goes build, code-audit, deploy, observe,
@@ -178,7 +186,7 @@ instead of pretending a background agent ran.
 | Other install targets | Skills and agent contracts install, while host-native spawning depends on the tool. |
 | Degraded hosts | Godpowers must report local-only or simulated agent behavior instead of hiding the limitation. |
 
-See [Host capabilities](docs/host-capabilities.md) for the detailed guarantee
+See [Host capabilities](https://github.com/aihxp/godpowers/blob/main/docs/host-capabilities.md) for the detailed guarantee
 model.
 
 ## Usage
@@ -329,17 +337,17 @@ dependency to the main `godpowers` package:
 
 ```bash
 npx godpowers mcp-info --project=.
-npx -y -p godpowers@3.13.0 -p @godpowers/mcp@3.13.0 godpowers-mcp serve --project=.
+npx -y -p godpowers@3.13.2 -p @godpowers/mcp@3.13.2 godpowers-mcp serve --project=.
 ```
 
 The companion exposes `status`, `next`, `gate_check`, `lint_artifact`, and
 `trace_requirement`. Host registration is opt-in:
 
 ```bash
-npx -y -p godpowers@3.13.0 -p @godpowers/mcp@3.13.0 godpowers-mcp setup --host=codex --project=. --write
+npx -y -p godpowers@3.13.2 -p @godpowers/mcp@3.13.2 godpowers-mcp setup --host=codex --project=. --write
 ```
 
-See [MCP Companion](docs/mcp.md) for package boundaries and setup details.
+See [MCP Companion](https://github.com/aihxp/godpowers/blob/main/docs/mcp.md) for package boundaries and setup details.
 
 ### Slash Commands
 
@@ -613,16 +621,16 @@ Pi. T3 Code inherits from the underlying agent (Codex / Claude / OpenCode).
 
 ## Full reference
 
-- [Getting Started](docs/getting-started.md)
-- [Quick Proof](docs/quick-proof.md)
-- [First 10 Minute Proof Case Study](docs/case-studies/first-10-minute-proof.md)
-- [Concepts](docs/concepts.md)
-- [Command reference (all 120 skills + 40 agents)](docs/reference.md)
-- [Feature awareness](docs/feature-awareness.md)
-- [Adoption Canary](docs/adoption-canary.md)
-- [Repository documentation sync](docs/repo-doc-sync.md)
-- [Repository surface sync](docs/repo-surface-sync.md)
-- [Roadmap](docs/ROADMAP.md)
+- [Getting Started](https://github.com/aihxp/godpowers/blob/main/docs/getting-started.md)
+- [Quick Proof](https://github.com/aihxp/godpowers/blob/main/docs/quick-proof.md)
+- [First 10 Minute Proof Case Study](https://github.com/aihxp/godpowers/blob/main/docs/case-studies/first-10-minute-proof.md)
+- [Concepts](https://github.com/aihxp/godpowers/blob/main/docs/concepts.md)
+- [Command reference (all 120 skills + 40 agents)](https://github.com/aihxp/godpowers/blob/main/docs/reference.md)
+- [Feature awareness](https://github.com/aihxp/godpowers/blob/main/docs/feature-awareness.md)
+- [Adoption Canary](https://github.com/aihxp/godpowers/blob/main/docs/adoption-canary.md)
+- [Repository documentation sync](https://github.com/aihxp/godpowers/blob/main/docs/repo-doc-sync.md)
+- [Repository surface sync](https://github.com/aihxp/godpowers/blob/main/docs/repo-surface-sync.md)
+- [Roadmap](https://github.com/aihxp/godpowers/blob/main/docs/ROADMAP.md)
 - [Release Notes](RELEASE.md)
 - [Changelog](CHANGELOG.md)
 - [Inspiration](INSPIRATION.md)

package/RELEASE.md

@@ -1,41 +1,40 @@
-# Godpowers 3.13.0 Release
+# Godpowers 3.13.2 Release
 
 > Status: Prepared
-> Date: 2026-06-16
+> Date: 2026-06-17
 
-[DECISION] Godpowers 3.13.0 is a minor release that hardens the default greenfield arc. The one-shot `full-arc` workflow run by `/god-mode` now audits the whole codebase after the build and writes verified documentation after harden, so a long-running idea-to-production run ships audited and documented without a separate manual pass.
-[DECISION] No new skill, agent, workflow, or recipe surface is added: both new steps reuse existing agents (`god-debt-assessor`, `god-docs-writer`). Surface counts are unchanged from 3.12.1.
-[DECISION] This release keeps `core` as the omitted installer profile, keeps `--profile=full` as the complete compatibility surface, and keeps the full 3.1.0-3.12.1 surface (fusion + codeauditor-grade audit + remediation loop).
+[DECISION] Godpowers 3.13.2 is a maintenance release that drives a third self-audit (`codeaudit.md`, codeauditor-grade, nine weighted dimensions) to zero. It fixes one Medium finding and twelve Low findings across de-duplication, error handling, security hardening, the test gate, and documentation.
+[DECISION] No new skill, agent, workflow, or recipe surface is added or removed. Surface counts are unchanged from 3.13.1: 120 slash commands, 40 specialist agents, 13 workflows, 44 recipes. The lib module count rises from 90 to 91 (`lib/sync-check.js`).
+[DECISION] This release keeps `core` as the omitted installer profile, keeps `--profile=full` as the complete compatibility surface, and keeps the full 3.1.0-3.13.1 surface.
 
 ## What's in this release
 
-- [DECISION] `full-arc` gains a `code-audit` job (`god-debt-assessor`, `mode: post-build-audit`) that runs after `build` and before `deploy`/`harden`. It gives the whole AI-generated codebase a scored, prioritized audit that catches issues the per-slice `god-spec-reviewer` + `god-quality-reviewer` reviews cannot see across files.
-- [DECISION] `full-arc` gains a `docs` job (`god-docs-writer`, `mode: product-docs-verify`) that runs after `harden` and before `launch`. It writes the project documentation and verifies every claim against the code (drift detected) before the product ships.
-- [DECISION] Dependencies were rewired: `deploy` and `harden` now `need` `code-audit`; `launch` now `needs` `docs`. The greenfield arc is build, code-audit, deploy, observe, harden, docs, launch, final-sync. The `full-arc` plan goes from 11 to 13 steps.
-- [DECISION] `GOD-ORCHESTRATOR-RUNBOOK` documents the audit and docs positions in the greenfield arc.
-- [DECISION] 120 slash commands, 40 specialist agents, 13 executable workflows, 44 intent recipes, and the full fusion + audit surface remain available.
+- [DECISION] De-duplication (ARC-001, QUAL-001/002/003): the four `*-sync` modules share `lib/sync-check.js` (`addCheck`/`makeAddCheck`/`listFiles`) instead of copy-pasting them; removed dead helpers (two unused `rel()`, an unused `sha`); added `sync-fs.readTextOrNull` adopted by `requirements.js`, which now sources PRD/ROADMAP paths from `artifact-map`; fixed a boolean/string status wart in `repo-surface-sync`.
+- [DECISION] Test gate (TEST-001, TEST-002): `coverage:lib` now emits a json-summary and `scripts/check-per-file-coverage.js` (in `release:check`) fails any lib module below 70% lines, excluding the two environment-bound browser drivers, so a single file can no longer rot while the aggregate stays green; the `run()`/`appendLog()` write path of the three sync siblings is now tested for the no-banned-dash invariant.
+- [DECISION] Error handling (ERR-001): reverse-sync writes state before the ledger and surfaces a caught error as `requirementsError` instead of silently nulling it.
+- [DECISION] Security hardening (SEC-001, SEC-002): the MCP `requireRuntime` rejects any module name that is not a plain lib basename; `intent.cleanArrays` caps recursion depth so a pathologically deep YAML cannot overflow the stack.
+- [DECISION] Performance and docs (PERF-001/002, DOC-001, ARC-002): `have-nots` `findPositions` compiles its regex once per call; the bounded whole-ledger read is documented with an opt-in prune noted; the README's `docs/*` links are now absolute GitHub URLs (docs are deliberately excluded from the package); and `pillars.js` is delineated into its model and artifact-sync halves (a full split was deferred because the halves share public-API construction functions).
 
 ## Changes
 
-- [DECISION] `package.json`, `package-lock.json`, and `packages/mcp/package.json` now publish the 3.13.0 version.
-- [DECISION] `workflows/full-arc.yaml` adds the `code-audit` and `docs` jobs and rewires `deploy`/`harden`/`launch` dependencies. No lib change.
-- [DECISION] CHANGELOG, RELEASE notes, README, roadmap, reference, architecture, and the MCP docs now reflect 3.13.0. SECURITY supported-version table adds the `3.13.x` row and moves `3.12.x` to security fixes only.
+- [DECISION] `package.json`, `package-lock.json`, and `packages/mcp/package.json` now publish the 3.13.2 version.
+- [DECISION] New runtime module `lib/sync-check.js` (lib module count 90 -> 91). No public command/agent/workflow/recipe surface change.
+- [DECISION] CHANGELOG, RELEASE notes, README, roadmap, reference, architecture, and the architecture map now reflect 3.13.2. The SECURITY supported-version table already carries the `3.13.x` row.
 
 ## Validation
 
-- [DECISION] `npm run lint` passed with 29 static checks (agent contract + size + refs intact).
-- [DECISION] `node tests/integration/full-arc.test.js`, `node scripts/test-workflow-runner.js`, and `node scripts/test-agent-refs.js` passed: `full-arc` plans to 13 steps with a valid DAG and both `god-debt-assessor` and `god-docs-writer` are real agents.
-- [DECISION] `npm run release:check` passed `coverage:lib` above the 90 percent line floor for `lib/**/*.js`.
-- [DECISION] `npm run release:check` passed `npm audit --omit=dev` with 0 vulnerabilities.
-- [DECISION] `npm run release:check` passed public surface docs for version 3.13.0 with 120 skills, 40 agents, 13 workflows, and 44 recipes.
+- [DECISION] `npm test` passed all command groups.
+- [DECISION] `npm run release:check` passed `coverage:lib` above the 90 percent line floor and the 75 percent branch floor, and the new per-file floor (>= 70 percent lines across 88 lib modules).
+- [DECISION] `npm run release:check` passed `npm audit --omit=dev` with 0 vulnerabilities and `git diff --check`.
+- [DECISION] `npm run release:check` passed public surface docs for version 3.13.2 with 120 skills, 40 agents, 13 workflows, and 44 recipes.
 - [DECISION] `npm run release:check` passed root and `@godpowers/mcp` package contents.
 
 ## Upgrade
 
-- [DECISION] Use `npm install -g godpowers@3.13.0` or `npx godpowers@3.13.0`.
-- [DECISION] No migration is required. Existing projects are unaffected; the change only adds steps to the greenfield one-shot arc, which now takes longer in exchange for an audited and documented product.
+- [DECISION] Use `npm install -g godpowers@3.13.2` or `npx godpowers@3.13.2`.
+- [DECISION] No migration is required. The changes are internal de-duplication, error-visibility, security, test-gate, and documentation improvements with no surface change.
 
 ## Notes
 
-- [DECISION] The publish targets are npm `godpowers@3.13.0`, npm `@godpowers/mcp@3.13.0`, and GitHub release `https://github.com/aihxp/godpowers/releases/tag/v3.13.0`.
+- [DECISION] The publish targets are npm `godpowers@3.13.2`, npm `@godpowers/mcp@3.13.2`, and GitHub release `https://github.com/aihxp/godpowers/releases/tag/v3.13.2`.
 - [DECISION] The tag-triggered GitHub publish workflow remains the preferred npm path because it publishes with provenance. This release has not been tagged or published to npm yet.

package/bin/install.js

@@ -21,6 +21,7 @@ const { describeProfiles } = require('../lib/install-profiles');
 const commandFamilies = require('../lib/command-families');
 const identity = require('../lib/package-identity');
 const cliDispatch = require('../lib/cli-dispatch');
+const { log, success, warn, error } = require('../lib/cli-log');
 
 const VERSION = identity.PACKAGE_VERSION;
 
@@ -29,22 +30,6 @@ const BANNER = `
   Ship fast. Ship right. Ship everything.
 `;
 
-function log(msg) {
-  console.log(`  ${msg}`);
-}
-
-function success(msg) {
-  console.log(`  \x1b[32m+\x1b[0m ${msg}`);
-}
-
-function warn(msg) {
-  console.log(`  \x1b[33m!\x1b[0m ${msg}`);
-}
-
-function error(msg) {
-  console.error(`  \x1b[31mx\x1b[0m ${msg}`);
-}
-
 function showHelp() {
   console.log(BANNER);
   log('Usage: npx godpowers [command] [options]\n');

package/hooks/pre-tool-use.sh

@@ -1,52 +1,64 @@
 #!/usr/bin/env bash
-# Godpowers PreToolUse Safety Hook
-# Runs before destructive tool calls in a Godpowers project.
-# Warns on: rm -rf, git reset --hard, force push to main, deleting .godpowers/,
-# and irreversible public release actions.
+# Godpowers PreToolUse advisory hook (best-effort, NOT a security boundary).
+#
+# Warns before some common destructive command spellings when run inside a
+# Godpowers project: deleting .godpowers/, git reset --hard, force push,
+# npm publish, gh release create. It matches command text heuristically after
+# normalizing whitespace, so it tolerates spacing and short-flag variants
+# (rm -fr, -r -f, ./ prefix, trailing slash, push -f). It is still deliberately
+# conservative and is easily bypassed by uncommon spellings, quoting, aliases,
+# or a child process that does the deletion. Treat it as a typo guard that buys
+# a confirmation prompt, not as a guarantee. See SECURITY.md.
 
 set -euo pipefail
 
-TOOL_NAME="${CLAUDE_TOOL_NAME:-}"
 TOOL_INPUT="${CLAUDE_TOOL_INPUT:-}"
 
 if [ ! -d ".godpowers" ]; then
   exit 0
 fi
 
-# Pattern matches that should warn
-case "$TOOL_INPUT" in
-  *"rm -rf .godpowers"*)
-    echo "WARNING: About to delete the .godpowers/ directory."
-    echo "This destroys all PROGRESS, PRD, ARCH, ROADMAP, and other artifacts."
-    echo "If this is intentional, confirm in chat before proceeding."
-    exit 1
-    ;;
-  *"git reset --hard"*)
-    echo "WARNING: git reset --hard discards uncommitted work."
-    echo "If you have artifacts not yet committed, they will be lost."
-    echo "Consider git stash first."
-    exit 1
-    ;;
-  *"git push --force"*)
-    echo "WARNING: Force pushing. If pushing to main/master, this can"
-    echo "destroy collaborators' work."
-    exit 1
-    ;;
-  *"npm publish"*)
-    echo "WARNING: npm publish is a public release action."
-    echo "Confirm release checklist, repo-doc-sync, repo-surface-sync,"
-    echo "release-surface-sync, package contents, and installer smoke first."
-    exit 1
-    ;;
-  *"gh release create"*)
-    echo "WARNING: gh release create publishes public release notes."
-    echo "Confirm README, badges, CHANGELOG, RELEASE, package, tag, and npm version agree."
-    exit 1
-    ;;
-  *"rm -rf node_modules"*)
-    # Allowed: this is just cache
-    exit 0
-    ;;
-esac
+# Collapse tabs and runs of spaces so spacing variants normalize to one form.
+norm="$(printf '%s' "$TOOL_INPUT" | tr '\t' ' ' | tr -s ' ')"
+
+matches() {
+  printf '%s' "$norm" | grep -Eq -- "$1"
+}
+
+# rm targeting .godpowers (optional ./ or / prefix, optional trailing slash)
+# that carries a recursive flag in any spelling: -rf, -fr, -r -f, -R, --recursive.
+if matches 'rm( +-[a-zA-Z]+)* +\.?/?\.godpowers(/|$| )' && matches ' -[a-zA-Z]*[rR]|--recursive'; then
+  echo "WARNING: About to delete the .godpowers/ directory."
+  echo "This destroys all PROGRESS, PRD, ARCH, ROADMAP, and other artifacts."
+  echo "If this is intentional, confirm in chat before proceeding."
+  exit 1
+fi
+
+if matches 'git +reset +--hard'; then
+  echo "WARNING: git reset --hard discards uncommitted work."
+  echo "If you have artifacts not yet committed, they will be lost."
+  echo "Consider git stash first."
+  exit 1
+fi
+
+# git push with a force flag: --force, --force-with-lease, or a standalone -f.
+if matches 'git +push +' && matches '(--force(-with-lease)?| -f( |$))'; then
+  echo "WARNING: Force pushing. If pushing to main/master, this can"
+  echo "destroy collaborators' work."
+  exit 1
+fi
+
+if matches 'npm +publish'; then
+  echo "WARNING: npm publish is a public release action."
+  echo "Confirm release checklist, repo-doc-sync, repo-surface-sync,"
+  echo "release-surface-sync, package contents, and installer smoke first."
+  exit 1
+fi
+
+if matches 'gh +release +create'; then
+  echo "WARNING: gh release create publishes public release notes."
+  echo "Confirm README, badges, CHANGELOG, RELEASE, package, tag, and npm version agree."
+  exit 1
+fi
 
 exit 0

package/lib/README.md

@@ -28,6 +28,8 @@ package-level integrations.
 | `cost-tracker.js` | Track token and cost estimates from event streams. |
 | `atomic-write.js` | Write load-bearing files through temp-file validation and atomic rename. |
 | `fs-async.js` | Promise-based file read/write helpers for non-blocking runtime paths. |
+| `sync-fs.js` | Shared project-relative read/write/exists/readJson helpers for the `*-sync` modules. |
+| `sync-check.js` | Shared check-builder (`addCheck`/`makeAddCheck`) and file-lister for the `*-sync` modules. |
 
 ## Events and observability
 
@@ -38,12 +40,17 @@ package-level integrations.
 | `otel-exporter.js` | Export Godpowers events in an OpenTelemetry-shaped format. |
 | `runtime-audit.js` | Audit runtime health and expected project state. |
 | `runtime-test.js` | Provide runtime checks used by package tests. |
+| `evidence.js` | Enforced producer of executed/attested verification records, the state.json rollup, gate events, reflections, memory, lessons, and outcome loops. |
+| `evidence-import.js` | Import an existing `.mythify/` ledger into `.godpowers/ledger/`. |
+| `work-report.js` | Render the verification play-by-play from the evidence ledger. |
+| `adoption-metrics.js` | Derive adoption and outcome metrics from event streams. |
 
 ## Routing and execution
 
 | Module | Purpose |
 |--------|---------|
 | `router.js` | Resolve user intent to skills, agents, recipes, and workflows. |
+| `quarterback.js` | Entry router that classifies a prompt into a play and refuses new work when the project is on red. |
 | `command-families.js` | Define UX command families, status views, decision ladders, and trigger precedence helpers. |
 | `recipes.js` | Load and validate routing recipes. |
 | `workflow-parser.js` | Parse workflow YAML into executable steps. |
@@ -59,7 +66,7 @@ package-level integrations.
 
 | Module | Purpose |
 |--------|---------|
-| `artifact-map.js` | Centralize canonical artifact paths for dashboards, gates, and helpers. |
+| `artifact-map.js` | Tier gate artifact map: the per-tier required artifacts and state steps used by dashboards, gates, and doc-count checks. (Module-local paths stay in their owning module; `state.json` is named via `state.STATE_FILE`.) |
 | `artifact-linter.js` | Check artifacts for required labels, evidence, and domain precision. |
 | `artifact-diff.js` | Compare artifact changes for review and release workflows. |
 | `gate.js` | Run executable artifact gates for Phase 1 tier completion checks. |
@@ -98,6 +105,7 @@ package-level integrations.
 | `drift-detector.js` | Detect context drift between artifacts and implementation. |
 | `impact.js` | Summarize expected impact of proposed changes. |
 | `linkage.js` | Connect artifacts, stories, and implementation files. |
+| `requirements.js` | Track which PRD requirements are done, in progress, or untouched from disk evidence. |
 | `multi-repo-detector.js` | Detect multi-repository workspaces. |
 | `reverse-sync.js` | Reflect implementation changes back into artifacts. |
 | `review-required.js` | Decide when review gates should block progress. |
@@ -111,6 +119,9 @@ package-level integrations.
 | `installer-files.js` | File-copy helpers shared by the installer and its tests. |
 | `installer-args.js` | Parse `bin/install.js` arguments and subcommands. |
 | `cli-dispatch.js` | Dispatch local CLI helper commands such as status, quick-proof, gate, dogfood, and extension-scaffold. |
+| `cli-log.js` | Shared ANSI console logger (log/success/warn/error) for the binary and CLI dispatch. |
+| `text-util.js` | Small shared string helpers (the canonical `slugify`). |
+| `mcp-info.js` | Render read-only MCP companion setup instructions for `npx godpowers mcp-info`. |
 | `install-profiles.js` | Select smaller role-specific slash-command install surfaces. |
 | `surface-profile.js` | Preview and apply runtime command surface profile switches after install. |
 | `installer-runtimes.js` | Map supported runtimes to their config directories. |

package/lib/artifact-map.js

@@ -1,5 +1,11 @@
 /**
  * Shared tier artifact map for dashboard, gates, and documentation checks.
+ *
+ * Scope: this owns the per-tier *gate artifacts* (which files a tier requires
+ * and the state step it maps to). It is not a flat registry of every
+ * `.godpowers/...` path: module-local artifacts (a sync module's log file, the
+ * evidence ledger) live in their owning module, and `state.json` is named via
+ * `state.STATE_FILE`.
  */
 
 const TIER_ARTIFACTS = {

package/lib/cli-dispatch.js

@@ -5,25 +5,10 @@
 const gate = require('./gate');
 const identity = require('./package-identity');
 const stateAdvance = require('./state-advance');
+const { log, success, warn, error } = require('./cli-log');
 
 const VERSION = identity.PACKAGE_VERSION;
 
-function log(msg) {
-  console.log(`  ${msg}`);
-}
-
-function success(msg) {
-  console.log(`  \x1b[32m+\x1b[0m ${msg}`);
-}
-
-function warn(msg) {
-  console.log(`  \x1b[33m!\x1b[0m ${msg}`);
-}
-
-function error(msg) {
-  console.error(`  \x1b[31mx\x1b[0m ${msg}`);
-}
-
 function runAutomationCommand(opts) {
   const automation = require('./automation-providers');
   const result = opts.command === 'automation-setup'
@@ -501,7 +486,20 @@ function runOutcomeCommand(opts) {
       projectRoot
     });
   } else if (action === 'check') {
-    payload = evidence.outcome.check(opts.outcomeSlug, { projectRoot });
+    payload = evidence.outcome.check(opts.outcomeSlug, {
+      projectRoot,
+      // SEC-002: announce the disk-sourced verifier before it runs, so running
+      // `outcome check` inside an untrusted cloned repo cannot silently execute
+      // a planted command. Goes to stderr so it never corrupts --json on stdout.
+      notice: ({ verifier, source }) => {
+        const rel = relLedger({ project: projectRoot }, source) || source;
+        process.stderr.write(
+          `  notice: outcome '${opts.outcomeSlug}' runs a verifier loaded from ${rel}\n` +
+          `          command: ${verifier}\n` +
+          `          (.godpowers/ledger/ carries executable state; only run 'outcome check' in repos you trust)\n`
+        );
+      }
+    });
   } else if (action === 'stop') {
     payload = evidence.outcome.stop(opts.outcomeSlug, opts.reason || undefined, { projectRoot });
   } else {
@@ -626,11 +624,22 @@ const COMMAND_RUNNERS = {
 
 function runCommand(opts) {
   const runner = COMMAND_RUNNERS[opts.command];
-  if (runner) {
+  if (!runner) return false;
+  try {
     runner(opts);
-    return true;
+  } catch (err) {
+    // ERR-002: a corrupt state.json throws from state.read(). Surface the
+    // helpful message as a clean one-liner with a non-zero exit instead of a
+    // raw stack trace. Match the typed error code (ERR-004), not the message
+    // prose. Re-throw anything else so genuine bugs still surface.
+    if (err && err.code === 'CORRUPT_STATE') {
+      error(err.message);
+      process.exitCode = 1;
+    } else {
+      throw err;
+    }
   }
-  return false;
+  return true;
 }
 
 module.exports = {

package/lib/cli-log.js

@@ -0,0 +1,24 @@
+/**
+ * Shared ANSI console logger for the installer binary and CLI dispatch (QUAL-002).
+ *
+ * bin/install.js and lib/cli-dispatch.js previously defined these four helpers
+ * verbatim. They now share one copy so the prefix/colour convention lives once.
+ */
+
+function log(msg) {
+  console.log(`  ${msg}`);
+}
+
+function success(msg) {
+  console.log(`  \x1b[32m+\x1b[0m ${msg}`);
+}
+
+function warn(msg) {
+  console.log(`  \x1b[33m!\x1b[0m ${msg}`);
+}
+
+function error(msg) {
+  console.error(`  \x1b[31mx\x1b[0m ${msg}`);
+}
+
+module.exports = { log, success, warn, error };

package/lib/dashboard.js

@@ -17,6 +17,7 @@ const repoDocSync = require('./repo-doc-sync');
 const repoSurfaceSync = require('./repo-surface-sync');
 const hostCapabilities = require('./host-capabilities');
 const artifactMap = require('./artifact-map');
+const { read: readText, exists } = require('./sync-fs');
 
 const GOD_DIR = '.godpowers';
 const PRD_PATH = artifactMap.requiredArtifactsForTier('prd')[0].path;
@@ -25,16 +26,6 @@ const CHECKPOINT_PATH = '.godpowers/CHECKPOINT.md';
 const SYNC_LOG_PATH = '.godpowers/SYNC-LOG.md';
 const REVIEW_PATH = '.godpowers/REVIEW-REQUIRED.md';
 
-function exists(projectRoot, relPath) {
-  return fs.existsSync(path.join(projectRoot, relPath));
-}
-
-function readText(projectRoot, relPath) {
-  const file = path.join(projectRoot, relPath);
-  if (!fs.existsSync(file)) return '';
-  return fs.readFileSync(file, 'utf8');
-}
-
 function mtimeMs(projectRoot, relPath) {
   const file = path.join(projectRoot, relPath);
   if (!fs.existsSync(file)) return null;