motionloom 2.0.0 → 2.2.0

package/scripts/capture-runtime-telemetry.py

@@ -0,0 +1,119 @@
+"""Cross-platform runtime telemetry capture for MotionLoom.
+
+This is the platform-neutral replacement for capture-runtime-telemetry.sh.
+It intentionally shells out only to the repository's npm runtime:test script,
+using pathlib and subprocess APIs that work on Ubuntu, macOS and Windows.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+
+SCENE_RE = re.compile(r"^[A-Za-z0-9._-]+$")
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="Capture and verify runtime telemetry")
+    parser.add_argument("scene")
+    parser.add_argument("task_dir")
+    parser.add_argument("--max-age-days", type=int, default=1)
+    return parser.parse_args()
+
+
+def load_json(path: Path) -> dict:
+    try:
+        value = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as exc:
+        raise SystemExit(f"capture-runtime-telemetry: invalid JSON {path}: {exc}") from exc
+    if not isinstance(value, dict):
+        raise SystemExit(f"capture-runtime-telemetry: expected object in {path}")
+    return value
+
+
+def main() -> int:
+    args = parse_args()
+    if not SCENE_RE.fullmatch(args.scene):
+        print(f"capture-runtime-telemetry: unsafe scene identifier: {args.scene}", file=sys.stderr)
+        return 2
+    if args.max_age_days < 0:
+        print("capture-runtime-telemetry: --max-age-days must be non-negative", file=sys.stderr)
+        return 2
+
+    root = Path(__file__).resolve().parents[1]
+    task_dir = Path(args.task_dir).expanduser()
+    task_dir = task_dir.resolve() if task_dir.is_absolute() else (root / task_dir).resolve()
+    scene_dir = (root / "src" / "output" / args.scene).resolve()
+    manifest_path = scene_dir / "manifest.json"
+    task_path = task_dir / "task.json"
+    if not manifest_path.is_file() or not task_path.is_file():
+        print("capture-runtime-telemetry: missing scene manifest or task.json", file=sys.stderr)
+        return 2
+
+    manifest = load_json(manifest_path)
+    task = load_json(task_path)
+    source = manifest.get("file")
+    task_id = task.get("task_id")
+    if not isinstance(source, str) or not source or Path(source).is_absolute() or ".." in Path(source).parts:
+        print("capture-runtime-telemetry: manifest.file must be a safe relative path", file=sys.stderr)
+        return 2
+    if not isinstance(task_id, str) or not task_id:
+        print("capture-runtime-telemetry: task.json.task_id is required", file=sys.stderr)
+        return 2
+
+    source_path = (scene_dir / source).resolve()
+    if scene_dir not in source_path.parents or not source_path.is_file():
+        print("capture-runtime-telemetry: manifest source must remain inside scene directory", file=sys.stderr)
+        return 2
+
+    output_dir = task_dir / "runtime-adapters"
+    if output_dir.exists():
+        shutil.rmtree(output_dir)
+    output_dir.mkdir(parents=True, exist_ok=True)
+
+    env = os.environ.copy()
+    env.update(
+        {
+            "RUNTIME_EVIDENCE_DIR": str(output_dir),
+            "RUNTIME_SCENE": args.scene,
+            "RUNTIME_TASK_ID": task_id,
+            "RUNTIME_SOURCE_PATH": str(source_path),
+            "RUNTIME_MANIFEST_PATH": str(manifest_path),
+            "RUNTIME_MOTION_IR_PATH": str(task_dir / "motion-ir.json"),
+        }
+    )
+    npm = "npm.cmd" if os.name == "nt" else "npm"
+    runtime = subprocess.run([npm, "run", "runtime:test"], cwd=root, env=env, check=False)
+    if runtime.returncode != 0:
+        return runtime.returncode
+
+    verifier = subprocess.run(
+        [
+            sys.executable,
+            str(root / "scripts" / "evidence-verifier.py"),
+            "--scene-dir",
+            str(scene_dir),
+            "--task-dir",
+            str(task_dir),
+            "--runtime-evidence",
+            "runtime-adapters/runtime-evidence.json",
+            "--max-age-days",
+            str(args.max_age_days),
+            "--output",
+            str(task_dir / "evidence-verifier-report.json"),
+        ],
+        cwd=root,
+        check=False,
+    )
+    return verifier.returncode
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/devlab.py

@@ -0,0 +1,126 @@
+"""Cross-platform Dev Lab scene/task preparation and local serving helper."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+
+SAFE_NAME = re.compile(r"^[A-Za-z0-9._-]+$")
+TASK_ARTIFACTS = (
+    "task.json", "browser-review.json", "review.json", "execution-report.json",
+    "handoff.json", "quality-report.json", "artifact-manifest.json",
+    "issue-register.json", "decision-log.jsonl", "project-memory.json",
+    "project-graph.json", "provenance.json", "capability-registry.json",
+    "motion-ir.json", "replay-bundle.json", "semantic-lint-report.json",
+    "continuity-report.json", "fix-plan.json", "visual-truth.json", "browser-observation.md",
+)
+
+
+def fail(message: str) -> "NoReturn":
+    print(f"MotionLoom Dev Lab error: {message}", file=sys.stderr)
+    raise SystemExit(1)
+
+
+def read_json(path: Path) -> dict:
+    try:
+        value = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as exc:
+        fail(f"cannot read JSON {path}: {exc}")
+    return value if isinstance(value, dict) else {}
+
+
+def safe_name(value: str, label: str) -> None:
+    if not value or value in {".", ".."} or not SAFE_NAME.fullmatch(value):
+        fail(f"{label} contains unsafe path characters: {value!r}")
+
+
+def inside(child: Path, parent: Path) -> bool:
+    try:
+        child.relative_to(parent)
+        return True
+    except ValueError:
+        return False
+
+
+def prepare_scene(root: Path, lab: Path, scene: str, task_dir: Path | None) -> tuple[Path, Path | None, str | None]:
+    safe_name(scene, "scene")
+    scene_dir = (root / "src" / "output" / scene).resolve()
+    if not scene_dir.is_dir():
+        fail(f"scene directory not found: {scene_dir}; render the scene first")
+    if not (scene_dir / "browser-review.json").is_file():
+        fail("browser-review.json is required; run review-hook prepare first")
+    lab_root = lab.resolve()
+    destination = (lab_root / "public" / "scenes" / scene).resolve()
+    if not inside(destination, (lab_root / "public" / "scenes").resolve()):
+        fail("scene destination escaped Dev Lab public directory")
+    if destination.exists():
+        shutil.rmtree(destination)
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    shutil.copytree(scene_dir, destination)
+
+    task_destination: Path | None = None
+    task_id: str | None = None
+    if task_dir is not None:
+        task_dir = task_dir.resolve()
+        if not inside(task_dir, root.resolve()):
+            fail("task bundle must be inside the MotionLoom repository")
+        task = read_json(task_dir / "task.json")
+        task_id = str(task.get("task_id") or "")
+        safe_name(task_id, "task_id")
+        task_destination = (lab_root / "public" / "tasks" / task_id).resolve()
+        if not inside(task_destination, (lab_root / "public" / "tasks").resolve()):
+            fail("task destination escaped Dev Lab public directory")
+        if task_destination.exists():
+            shutil.rmtree(task_destination)
+        task_destination.mkdir(parents=True, exist_ok=True)
+        for name in TASK_ARTIFACTS:
+            source = task_dir / name
+            if source.is_file():
+                shutil.copy2(source, task_destination / name)
+    return destination, task_destination, task_id
+
+
+def pnpm_executable() -> str:
+    candidate = "pnpm.cmd" if os.name == "nt" else "pnpm"
+    return shutil.which(candidate) or candidate
+
+
+def serve(lab: Path, port: int) -> int:
+    if not (lab / "public").is_dir():
+        fail(f"Dev Lab public directory not found: {lab / 'public'}")
+    if not (lab / "node_modules").is_dir():
+        print("== installing Dev Lab dependencies (first run) ==")
+        subprocess.run([pnpm_executable(), "install", "--silent"], cwd=lab, check=True)
+    print(f"== Dev Lab ready: http://localhost:{port}/ ==")
+    return subprocess.run([sys.executable, "-m", "http.server", str(port), "--directory", str(lab / "public")], check=False).returncode
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("scene")
+    parser.add_argument("--task-dir")
+    parser.add_argument("--lab-dir")
+    parser.add_argument("--port", type=int, default=int(os.environ.get("PORT", "3300")))
+    parser.add_argument("--prepare-only", action="store_true")
+    args = parser.parse_args()
+    root = Path(__file__).resolve().parents[1]
+    lab = Path(args.lab_dir or os.environ.get("MOTIONLOOM_DEV_LAB") or root / "dev-lab").expanduser().resolve()
+    task_dir = Path(args.task_dir).expanduser().resolve() if args.task_dir else None
+    destination, task_destination, task_id = prepare_scene(root, lab, args.scene, task_dir)
+    print(f"== Dev Lab scene prepared: {destination} ==")
+    if task_destination:
+        print(f"== Dev Lab task bundle prepared: {task_destination} (task_id={task_id}) ==")
+    if args.prepare_only:
+        return 0
+    return serve(lab, args.port)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/scripts/discovery.py

@@ -0,0 +1,257 @@
+#!/usr/bin/env python3
+"""Validate and expose MotionLoom's cross-agent discovery contract.
+
+The command is deliberately offline and read-only. It verifies that every
+Agent-facing surface points back to the canonical root SKILL.md, that install
+recipes name a deterministic verification command, and that the package can be
+discovered from a clean npm/Git/local checkout without inferring approval.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import platform
+import subprocess
+import sys
+from pathlib import Path
+from typing import Any
+
+
+SCHEMA_VERSION = "1.0"
+EXIT_OK = 0
+EXIT_USAGE = 2
+EXIT_INVALID = 11
+
+
+def repo_root() -> Path:
+    return Path(__file__).resolve().parent.parent
+
+
+def load_json(path: Path) -> Any:
+    return json.loads(path.read_text(encoding="utf-8"))
+
+
+def relpath(path: Path, root: Path) -> str:
+    return path.relative_to(root).as_posix()
+
+
+def read_package(root: Path) -> dict[str, Any]:
+    package = load_json(root / "package.json")
+    return package if isinstance(package, dict) else {}
+
+
+def git_remote(root: Path) -> str | None:
+    try:
+        result = subprocess.run(
+            ["git", "-C", str(root), "config", "--get", "remote.origin.url"],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except OSError:
+        return None
+    value = result.stdout.strip()
+    return value or None
+
+
+def source_identity(root: Path) -> dict[str, Any]:
+    package = read_package(root)
+    return {
+        "name": package.get("name"),
+        "version": package.get("version"),
+        "root": str(root.resolve()),
+        "git_remote": git_remote(root),
+        "platform": platform.system().lower(),
+        "node_entrypoint": str((root / "bin" / "motionloom.mjs").resolve()),
+        "canonical_skill": str((root / "SKILL.md").resolve()),
+    }
+
+
+def validate(root: Path) -> dict[str, Any]:
+    errors: list[str] = []
+    warnings: list[str] = []
+    root = root.resolve()
+    manifest_path = root / "agent-surfaces.json"
+
+    if not manifest_path.is_file():
+        return {"status": "fail", "errors": ["missing agent-surfaces.json"], "warnings": [], "root": str(root)}
+
+    try:
+        manifest = load_json(manifest_path)
+    except (OSError, json.JSONDecodeError) as exc:
+        return {"status": "fail", "errors": [f"invalid agent-surfaces.json: {exc}"], "warnings": [], "root": str(root)}
+
+    if manifest.get("schema_version") != SCHEMA_VERSION:
+        errors.append(f"unsupported schema_version: {manifest.get('schema_version')!r}")
+    package = read_package(root)
+    if manifest.get("name") != package.get("name"):
+        errors.append("manifest name does not match package.json")
+    if manifest.get("version") != package.get("version"):
+        errors.append("manifest version does not match package.json")
+    if manifest.get("canonical") != {
+        "skill": "SKILL.md",
+        "agent_card": "agent-card.json",
+        "cli": "bin/motionloom.mjs",
+    }:
+        errors.append("canonical paths do not match the package contract")
+
+    for required in ("SKILL.md", "agent-card.json", "bin/motionloom.mjs", "package.json"):
+        path = root / required
+        if not path.is_file():
+            errors.append(f"missing canonical file: {required}")
+
+    surfaces = manifest.get("surfaces")
+    if not isinstance(surfaces, list) or not surfaces:
+        errors.append("surfaces must be a non-empty array")
+        surfaces = []
+    ids: set[str] = set()
+    paths: set[str] = set()
+    for surface in surfaces:
+        if not isinstance(surface, dict):
+            errors.append("surface entry must be an object")
+            continue
+        surface_id = surface.get("id")
+        surface_path = surface.get("path")
+        if surface_id in ids:
+            errors.append(f"duplicate surface id: {surface_id}")
+        if isinstance(surface_id, str):
+            ids.add(surface_id)
+        if not isinstance(surface_path, str) or surface_path.startswith("/") or ".." in Path(surface_path).parts:
+            errors.append(f"surface path is not safe: {surface_path!r}")
+            continue
+        if surface_path in paths:
+            errors.append(f"duplicate surface path: {surface_path}")
+        paths.add(surface_path)
+        file_path = root / surface_path
+        if not file_path.is_file():
+            errors.append(f"missing surface file: {surface_path}")
+        if file_path.is_symlink():
+            errors.append(f"symlinked surface is not portable: {surface_path}")
+        if surface.get("canonical") != "SKILL.md":
+            errors.append(f"surface {surface_id!r} does not point to SKILL.md")
+        if surface.get("load_mode") not in {"alias", "router"}:
+            errors.append(f"surface {surface_id!r} has invalid load_mode")
+        if not isinstance(surface.get("agents"), list) or not surface.get("agents"):
+            errors.append(f"surface {surface_id!r} has no supported agents")
+
+    installations = manifest.get("installations")
+    if not isinstance(installations, list) or not installations:
+        errors.append("installations must be a non-empty array")
+        installations = []
+    installation_ids: set[str] = set()
+    for item in installations:
+        if not isinstance(item, dict):
+            errors.append("installation entry must be an object")
+            continue
+        item_id = item.get("id")
+        if item_id in installation_ids:
+            errors.append(f"duplicate installation id: {item_id}")
+        if isinstance(item_id, str):
+            installation_ids.add(item_id)
+        for key in ("source_kind", "command", "verification", "provenance"):
+            if not item.get(key):
+                errors.append(f"installation {item_id!r} missing {key}")
+
+    compatibility = manifest.get("compatibility", {})
+    for key in ("operating_systems", "node", "python", "agents"):
+        if not compatibility.get(key):
+            errors.append(f"compatibility missing {key}")
+    rules = manifest.get("rules", {})
+    if rules.get("canonical_instruction_source") != "SKILL.md":
+        errors.append("canonical_instruction_source must be SKILL.md")
+    for key in ("no_surface_copy", "no_network_required_for_check", "approval_is_never_inferred"):
+        if rules.get(key) is not True:
+            errors.append(f"rule {key} must remain true")
+
+    package_files = package.get("files", [])
+    for required_package_path in ("agent-surfaces.json", ".agents", ".claude", ".codex", "AGENTS.md"):
+        if required_package_path not in package_files:
+            warnings.append(f"package.json files does not explicitly include {required_package_path}")
+
+    return {
+        "status": "pass" if not errors else "fail",
+        "schema_version": SCHEMA_VERSION,
+        "root": str(root),
+        "source": source_identity(root),
+        "surface_count": len(surfaces),
+        "installation_count": len(installations),
+        "errors": errors,
+        "warnings": warnings,
+    }
+
+
+def install_matrix(root: Path) -> dict[str, Any]:
+    result = validate(root)
+    manifest = load_json(root / "agent-surfaces.json") if (root / "agent-surfaces.json").is_file() else {}
+    rows = []
+    for item in manifest.get("installations", []):
+        rows.append({
+            "id": item.get("id"),
+            "source_kind": item.get("source_kind"),
+            "command": item.get("command"),
+            "verification": item.get("verification"),
+            "provenance": item.get("provenance"),
+            "status": "available" if result.get("status") == "pass" else "blocked_by_contract",
+        })
+    return {"status": result.get("status"), "matrix": rows, "compatibility": manifest.get("compatibility", {}), "errors": result.get("errors", [])}
+
+
+def parser() -> argparse.ArgumentParser:
+    root_default = str(repo_root())
+    command = argparse.ArgumentParser(prog="motionloom discovery", description=__doc__)
+    sub = command.add_subparsers(dest="action", required=True)
+    for name, help_text in (
+        ("check", "Validate Agent surfaces and installation contract"),
+        ("show", "Print the canonical discovery manifest"),
+        ("source", "Print source identity for this checkout"),
+        ("install-matrix", "Print supported installation sources and verification commands"),
+    ):
+        child = sub.add_parser(name, help=help_text)
+        child.add_argument("--root", default=root_default, help="MotionLoom checkout root")
+        child.add_argument("--json", action="store_true", help="Emit machine-readable JSON")
+    return command
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = parser().parse_args(argv)
+    root = Path(args.root).expanduser().resolve()
+    if args.action == "check":
+        result = validate(root)
+    elif args.action == "show":
+        try:
+            result = load_json(root / "agent-surfaces.json")
+        except (OSError, json.JSONDecodeError) as exc:
+            result = {"status": "fail", "errors": [str(exc)]}
+    elif args.action == "source":
+        result = source_identity(root)
+    else:
+        result = install_matrix(root)
+
+    if args.json:
+        print(json.dumps(result, ensure_ascii=False, indent=2, sort_keys=True))
+    else:
+        if args.action == "show":
+            print(json.dumps(result, ensure_ascii=False, indent=2))
+        elif args.action == "source":
+            print(f"{result.get('name')}@{result.get('version')} — {result.get('platform')} — {result.get('root')}")
+            if result.get("git_remote"):
+                print(f"remote: {result['git_remote']}")
+        elif args.action == "install-matrix":
+            print(f"installation matrix: {result.get('status')}")
+            for row in result.get("matrix", []):
+                print(f"- {row['id']}: {row['command']} -> {row['verification']}")
+        else:
+            print(f"discovery contract: {result.get('status')}")
+            for error in result.get("errors", []):
+                print(f"error: {error}")
+            for warning in result.get("warnings", []):
+                print(f"warning: {warning}")
+    return EXIT_OK if result.get("status") in {None, "pass"} else EXIT_INVALID
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except KeyboardInterrupt:
+        raise SystemExit(EXIT_USAGE)

package/scripts/docs-audit.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""Validate public documentation, links and workflow safety without network access."""
+
+from __future__ import annotations
+
+import json
+import re
+import sys
+from pathlib import Path
+
+
+ROOT = Path(sys.argv[1] if len(sys.argv) > 1 else Path(__file__).resolve().parents[1])
+errors: list[str] = []
+
+for markdown in sorted(ROOT.rglob("*.md")):
+    if any(part in {".git", "node_modules"} for part in markdown.parts):
+        continue
+    text = markdown.read_text(encoding="utf-8")
+    for target in re.findall(r"\[[^\]]+\]\(([^)]+)\)", text):
+        target = target.strip().split("#", 1)[0].split("?", 1)[0]
+        if not target or target.startswith(("http://", "https://", "mailto:", "#")):
+            continue
+        if not (markdown.parent / target).resolve().exists():
+            errors.append(f"{markdown.relative_to(ROOT)} -> missing {target}")
+
+for relative in ["package.json", "agent-card.json", "agent-surfaces.json", "schemas/agent-surfaces.schema.json", "schemas/visual-truth.schema.json", "schemas/remediation-history.schema.json", "project-context.example.json", "tests/evals/project-corpus.json"]:
+    path = ROOT / relative
+    try:
+        json.loads(path.read_text(encoding="utf-8"))
+    except Exception as exc:
+        errors.append(f"{relative}: invalid JSON: {exc}")
+
+package = json.loads((ROOT / "package.json").read_text(encoding="utf-8"))
+for required in ["author", "repository", "homepage", "bugs", "license", "engines", "files"]:
+    if not package.get(required):
+        errors.append(f"package.json: missing public metadata {required}")
+if package.get("packageManager") != "pnpm@11.20.0":
+    errors.append("package.json: packageManager must pin pnpm@11.20.0")
+for required_surface in [".agents", ".claude", ".codex", "AGENTS.md", "agent-surfaces.json"]:
+    if required_surface not in package.get("files", []):
+        errors.append(f"package.json: files must include Agent surface {required_surface}")
+
+sys.path.insert(0, str(ROOT))
+try:
+    from scripts.discovery import validate as validate_discovery
+    discovery = validate_discovery(ROOT)
+    for discovery_error in discovery.get("errors", []):
+        errors.append(f"agent discovery: {discovery_error}")
+except Exception as exc:
+    errors.append(f"agent discovery: validator could not load: {exc}")
+
+for required_doc in ["docs/AGENT-INTEGRATION.md", "references/agent-interoperability.md"]:
+    if not (ROOT / required_doc).is_file():
+        errors.append(f"missing Agent interoperability document: {required_doc}")
+
+readme = (ROOT / "README.md").read_text(encoding="utf-8")
+for heading in ["Why MotionLoom", "Quick start", "Durable Project Memory", "Evidence, trust and review", "Documentation map"]:
+    if f"## {heading}" not in readme:
+        errors.append(f"README.md: missing heading {heading}")
+
+workflow_dir = ROOT / ".github" / "workflows"
+for workflow in sorted(workflow_dir.glob("*.yml")):
+    text = workflow.read_text(encoding="utf-8")
+    top_level_keys: dict[str, int] = {}
+    for line_number, line in enumerate(text.splitlines(), start=1):
+        match = re.match(r"^([A-Za-z_][A-Za-z0-9_-]*):(?:\s|$)", line)
+        if not match:
+            continue
+        key = match.group(1)
+        if key in top_level_keys:
+            errors.append(
+                f"{workflow.relative_to(ROOT)}: duplicate top-level key {key!r} "
+                f"at lines {top_level_keys[key]} and {line_number}"
+            )
+        else:
+            top_level_keys[key] = line_number
+    for required in ["name:", "on:", "jobs:", "permissions:"]:
+        if required not in text:
+            errors.append(f"{workflow.relative_to(ROOT)}: missing {required}")
+    if "pull_request:" in text and "secrets." in text:
+        errors.append(f"{workflow.relative_to(ROOT)}: secrets referenced in pull_request workflow")
+
+release = (workflow_dir / "release.yml").read_text(encoding="utf-8")
+for required in ["workflow_dispatch:", "environment: npm-release", "id-token: write", "release_version:", "scripts/release-verify.py"]:
+    if required not in release:
+        errors.append(f"release.yml: missing release safety control {required}")
+
+devlab = (workflow_dir / "devlab.yml").read_text(encoding="utf-8")
+for required in [
+    "cp -R src/output/browser-review-smoke dev-lab/public/scenes/browser-review-smoke",
+    "scenes/browser-review-smoke/manifest.json",
+    "scenes/browser-review-smoke/motion-spec.json",
+    "--diagnostics /tmp/motionloom-devlab-diagnostics",
+    "id: fixture",
+    "steps.fixture.outputs.task_id",
+    "steps.fixture.outputs.candidate_id",
+    'payload["expires_at"] = "2099-01-01T00:00:00Z"',
+]:
+    if required not in devlab:
+        errors.append(f"devlab.yml: missing fixture/readiness control {required}")
+
+if errors:
+    print("Documentation/workflow audit: FAIL")
+    print("\n".join(f"- {error}" for error in errors))
+    raise SystemExit(1)
+
+print("Documentation/workflow audit: PASS")
+print(f"markdown_files={len(list(ROOT.rglob('*.md')))}")
+print(f"workflow_files={len(list(workflow_dir.glob('*.yml')))}")
+print("internal_links=PASS")
+print("json_metadata=PASS")
+print("workflow_safety=PASS")

package/scripts/eval-intelligence.py

@@ -23,6 +23,7 @@ from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 
 ROOT = Path(__file__).resolve().parents[1]
 INTELLIGENCE = ROOT / "scripts/intelligence.py"
+PROJECT_EVAL = ROOT / "scripts/eval-projects.py"
 REPORT = ROOT / "scripts/report.py"
 VERIFIER = ROOT / "scripts/evidence-verifier.py"
 ATTESTATION = ROOT / "scripts/attestation.py"
@@ -134,6 +135,27 @@ def run_attestation_cases(root: Path, results: list[dict[str, object]]) -> None:
     record(results, "p2-attestation-unknown-signer", unknown_result.returncode == 13, unknown_result.stdout + unknown_result.stderr)
 
 
+def run_project_corpus_cases(root: Path, results: list[dict[str, object]]) -> None:
+    """Keep first-party analyzer evidence separate from unavailable external evidence."""
+    first_party = invoke([
+        str(PROJECT_EVAL), "--workspace", str(ROOT), "--require-external", "0", "--allow-insufficient"
+    ])
+    first_doc = json.loads(first_party.stdout) if first_party.stdout.strip().startswith("{") else {}
+    first_pass = any(item.get("id") == "motionloom-first-party" and item.get("status") == "pass" for item in first_doc.get("results", []))
+    record(results, "project-corpus-first-party-pass", first_party.returncode == 0 and first_doc.get("status") == "pass" and first_pass, first_party.stdout + first_party.stderr)
+
+    insufficient = invoke([
+        str(PROJECT_EVAL), "--workspace", str(ROOT), "--allow-insufficient"
+    ])
+    insufficient_doc = json.loads(insufficient.stdout) if insufficient.stdout.strip().startswith("{") else {}
+    record(
+        results,
+        "project-corpus-insufficient-external-explicit",
+        insufficient.returncode == 0 and insufficient_doc.get("status") == "insufficient_evidence" and insufficient_doc.get("unavailable_external_projects") == 3,
+        insufficient.stdout + insufficient.stderr,
+    )
+
+
 def run_p1_cases(root: Path, task_dir: Path, results: list[dict[str, object]]) -> None:
     """Exercise P1 semantic, continuity and feedback contracts in isolated copies."""
     lint_task = root / "p1-human-review"
@@ -364,6 +386,7 @@ def main() -> int:
         run_performance_perceptual_cases(root, task_dir, results)
         run_runtime_verifier_cases(root, results)
         run_attestation_cases(root, results)
+        run_project_corpus_cases(root, results)
 
     missing = expected - {str(item["id"]) for item in results}
     for case_id in sorted(missing):