mustflow 2.108.2 → 2.108.3

package/README.md

@@ -309,6 +309,9 @@ mf run mustflow_update_apply
 | `mf script-pack run code/export-diff compare --base HEAD --json` | Compare exported TypeScript or JavaScript declarations, return metadata, and package surface hints against a git base. |
 | `mf script-pack run docs/reference-drift check [path...] --json` | Check documentation references to `mf` commands, script-pack refs, schema files, and repository paths against current local surfaces. |
 | `mf script-pack run repo/config-chain inspect <path...> --json` | Inspect nearby package, TypeScript, ESLint, Vite, Tailwind, test, and mustflow config files plus static inheritance edges without executing dynamic config code. |
+| `mf script-pack run repo/toolchain-provenance inspect --json` | Inspect repository-visible runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running those tools. |
+| `mf script-pack run repo/automation-surface inspect --json` | Inventory package scripts, task runners, CI workflows, and mustflow command-intent coverage before adopting automation advice. |
+| `mf script-pack run repo/dependency-surface inspect --json` | Inspect dependency manifests, lockfiles, update automation, and policy surfaces without installing or updating packages. |
 | `mf script-pack run repo/env-contract scan [path...] --json` | Scan code, CI, docs, config, and env examples for environment-variable contract drift without reading or printing real secret env values. |
 | `mf script-pack run repo/secret-risk-scan scan [path...] --json` | Scan code, docs, config, CI, and examples for plausible hardcoded secrets while reporting only redacted fingerprints. |
 | `mf script-pack run repo/generated-boundary check <path...> --json` | Check whether candidate paths cross generated, ignored, protected, vendor, or cache boundaries before or after edits. |

package/dist/cli/commands/script-pack.js

@@ -75,6 +75,9 @@ export function getScriptPackHelp(lang = 'en') {
             'mf script-pack run test/performance-report summarize --json',
             'mf script-pack run test/regression-selector select --base HEAD --json',
             'mf script-pack run repo/config-chain inspect src/cli/index.ts --json',
+            'mf script-pack run repo/toolchain-provenance inspect --json',
+            'mf script-pack run repo/automation-surface inspect --json',
+            'mf script-pack run repo/dependency-surface inspect --json',
             'mf script-pack run repo/env-contract scan --json',
             'mf script-pack run repo/secret-risk-scan scan src README.md --json',
             'mf script-pack run repo/security-pattern-scan scan src .github/workflows --json',

package/dist/cli/i18n/en.js

@@ -806,6 +806,9 @@ Read these files before working:
     "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.script.testPerformanceReport.summary": "Summarize retained mf run performance evidence and test-suite bottlenecks",
     "scriptPack.script.testRegressionSelector.summary": "Select likely regression tests and conservative fallback verification",
+    "scriptPack.script.toolchainProvenance.summary": "Inspect repository toolchain version contract sources and lockfile provenance",
+    "scriptPack.script.automationSurface.summary": "Inventory automation surfaces and mustflow command-intent coverage",
+    "scriptPack.script.dependencySurface.summary": "Inspect dependency manifests, lockfiles, update automation, and policy surfaces",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "actions",
     "scriptPack.label.schema": "schema",
@@ -1189,6 +1192,40 @@ Read these files before working:
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
     "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
+    "toolchainProvenance.help.summary": "Inspect repository runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running tools.",
+    "toolchainProvenance.help.exit.ok": "The toolchain-provenance report was generated without blocking findings",
+    "toolchainProvenance.help.exit.fail": "The toolchain-provenance report found provenance drift or unreadable metadata",
+    "toolchainProvenance.title": "mustflow toolchain provenance",
+    "toolchainProvenance.label.sources": "Sources",
+    "toolchainProvenance.label.lockfiles": "Lockfiles",
+    "toolchainProvenance.label.sourceDetails": "Source details",
+    "toolchainProvenance.label.findings": "Findings",
+    "toolchainProvenance.label.issues": "Issues",
+    "toolchainProvenance.clean": "No repository toolchain provenance sources were detected.",
+    "toolchainProvenance.error.missingAction": "Specify a toolchain-provenance action: inspect",
+    "toolchainProvenance.error.unknownAction": "Unknown toolchain-provenance action: {action}",
+    "automationSurface.help.summary": "Inventory package scripts, task runners, CI workflows, and mustflow intents without executing automation.",
+    "automationSurface.help.exit.ok": "The automation-surface report was generated without blocking findings",
+    "automationSurface.help.exit.fail": "The automation-surface report found risky automation or unreadable metadata",
+    "automationSurface.title": "mustflow automation surface",
+    "automationSurface.label.surfaces": "Surfaces",
+    "automationSurface.label.risky": "Risky surfaces",
+    "automationSurface.label.surfaceDetails": "Surface details",
+    "automationSurface.label.findings": "Findings",
+    "automationSurface.label.issues": "Issues",
+    "automationSurface.error.missingAction": "Specify an automation-surface action: inspect",
+    "automationSurface.error.unknownAction": "Unknown automation-surface action: {action}",
+    "dependencySurface.help.summary": "Inspect dependency manifests, lockfiles, update automation, audit, license, and SBOM policy surfaces without installing packages.",
+    "dependencySurface.help.exit.ok": "The dependency-surface report was generated without blocking findings",
+    "dependencySurface.help.exit.fail": "The dependency-surface report found dependency policy drift or unreadable metadata",
+    "dependencySurface.title": "mustflow dependency surface",
+    "dependencySurface.label.surfaces": "Surfaces",
+    "dependencySurface.label.ecosystems": "Ecosystems",
+    "dependencySurface.label.surfaceDetails": "Surface details",
+    "dependencySurface.label.findings": "Findings",
+    "dependencySurface.label.issues": "Issues",
+    "dependencySurface.error.missingAction": "Specify a dependency-surface action: inspect",
+    "dependencySurface.error.unknownAction": "Unknown dependency-surface action: {action}",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",

package/dist/cli/i18n/es.js

@@ -806,6 +806,9 @@ Lee estos archivos antes de trabajar:
     "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.script.testPerformanceReport.summary": "Summarize retained mf run performance evidence and test-suite bottlenecks",
     "scriptPack.script.testRegressionSelector.summary": "Select likely regression tests and conservative fallback verification",
+    "scriptPack.script.toolchainProvenance.summary": "Inspect repository toolchain version contract sources and lockfile provenance",
+    "scriptPack.script.automationSurface.summary": "Inventory automation surfaces and mustflow command-intent coverage",
+    "scriptPack.script.dependencySurface.summary": "Inspect dependency manifests, lockfiles, update automation, and policy surfaces",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "actions",
     "scriptPack.label.schema": "schema",
@@ -1189,6 +1192,40 @@ Lee estos archivos antes de trabajar:
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
     "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
+    "toolchainProvenance.help.summary": "Inspect repository runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running tools.",
+    "toolchainProvenance.help.exit.ok": "The toolchain-provenance report was generated without blocking findings",
+    "toolchainProvenance.help.exit.fail": "The toolchain-provenance report found provenance drift or unreadable metadata",
+    "toolchainProvenance.title": "mustflow toolchain provenance",
+    "toolchainProvenance.label.sources": "Sources",
+    "toolchainProvenance.label.lockfiles": "Lockfiles",
+    "toolchainProvenance.label.sourceDetails": "Source details",
+    "toolchainProvenance.label.findings": "Findings",
+    "toolchainProvenance.label.issues": "Issues",
+    "toolchainProvenance.clean": "No repository toolchain provenance sources were detected.",
+    "toolchainProvenance.error.missingAction": "Specify a toolchain-provenance action: inspect",
+    "toolchainProvenance.error.unknownAction": "Unknown toolchain-provenance action: {action}",
+    "automationSurface.help.summary": "Inventory package scripts, task runners, CI workflows, and mustflow intents without executing automation.",
+    "automationSurface.help.exit.ok": "The automation-surface report was generated without blocking findings",
+    "automationSurface.help.exit.fail": "The automation-surface report found risky automation or unreadable metadata",
+    "automationSurface.title": "mustflow automation surface",
+    "automationSurface.label.surfaces": "Surfaces",
+    "automationSurface.label.risky": "Risky surfaces",
+    "automationSurface.label.surfaceDetails": "Surface details",
+    "automationSurface.label.findings": "Findings",
+    "automationSurface.label.issues": "Issues",
+    "automationSurface.error.missingAction": "Specify an automation-surface action: inspect",
+    "automationSurface.error.unknownAction": "Unknown automation-surface action: {action}",
+    "dependencySurface.help.summary": "Inspect dependency manifests, lockfiles, update automation, audit, license, and SBOM policy surfaces without installing packages.",
+    "dependencySurface.help.exit.ok": "The dependency-surface report was generated without blocking findings",
+    "dependencySurface.help.exit.fail": "The dependency-surface report found dependency policy drift or unreadable metadata",
+    "dependencySurface.title": "mustflow dependency surface",
+    "dependencySurface.label.surfaces": "Surfaces",
+    "dependencySurface.label.ecosystems": "Ecosystems",
+    "dependencySurface.label.surfaceDetails": "Surface details",
+    "dependencySurface.label.findings": "Findings",
+    "dependencySurface.label.issues": "Issues",
+    "dependencySurface.error.missingAction": "Specify a dependency-surface action: inspect",
+    "dependencySurface.error.unknownAction": "Unknown dependency-surface action: {action}",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",

package/dist/cli/i18n/fr.js

@@ -806,6 +806,9 @@ Lisez ces fichiers avant de travailler :
     "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.script.testPerformanceReport.summary": "Summarize retained mf run performance evidence and test-suite bottlenecks",
     "scriptPack.script.testRegressionSelector.summary": "Select likely regression tests and conservative fallback verification",
+    "scriptPack.script.toolchainProvenance.summary": "Inspect repository toolchain version contract sources and lockfile provenance",
+    "scriptPack.script.automationSurface.summary": "Inventory automation surfaces and mustflow command-intent coverage",
+    "scriptPack.script.dependencySurface.summary": "Inspect dependency manifests, lockfiles, update automation, and policy surfaces",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "actions",
     "scriptPack.label.schema": "schema",
@@ -1189,6 +1192,40 @@ Lisez ces fichiers avant de travailler :
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
     "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
+    "toolchainProvenance.help.summary": "Inspect repository runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running tools.",
+    "toolchainProvenance.help.exit.ok": "The toolchain-provenance report was generated without blocking findings",
+    "toolchainProvenance.help.exit.fail": "The toolchain-provenance report found provenance drift or unreadable metadata",
+    "toolchainProvenance.title": "mustflow toolchain provenance",
+    "toolchainProvenance.label.sources": "Sources",
+    "toolchainProvenance.label.lockfiles": "Lockfiles",
+    "toolchainProvenance.label.sourceDetails": "Source details",
+    "toolchainProvenance.label.findings": "Findings",
+    "toolchainProvenance.label.issues": "Issues",
+    "toolchainProvenance.clean": "No repository toolchain provenance sources were detected.",
+    "toolchainProvenance.error.missingAction": "Specify a toolchain-provenance action: inspect",
+    "toolchainProvenance.error.unknownAction": "Unknown toolchain-provenance action: {action}",
+    "automationSurface.help.summary": "Inventory package scripts, task runners, CI workflows, and mustflow intents without executing automation.",
+    "automationSurface.help.exit.ok": "The automation-surface report was generated without blocking findings",
+    "automationSurface.help.exit.fail": "The automation-surface report found risky automation or unreadable metadata",
+    "automationSurface.title": "mustflow automation surface",
+    "automationSurface.label.surfaces": "Surfaces",
+    "automationSurface.label.risky": "Risky surfaces",
+    "automationSurface.label.surfaceDetails": "Surface details",
+    "automationSurface.label.findings": "Findings",
+    "automationSurface.label.issues": "Issues",
+    "automationSurface.error.missingAction": "Specify an automation-surface action: inspect",
+    "automationSurface.error.unknownAction": "Unknown automation-surface action: {action}",
+    "dependencySurface.help.summary": "Inspect dependency manifests, lockfiles, update automation, audit, license, and SBOM policy surfaces without installing packages.",
+    "dependencySurface.help.exit.ok": "The dependency-surface report was generated without blocking findings",
+    "dependencySurface.help.exit.fail": "The dependency-surface report found dependency policy drift or unreadable metadata",
+    "dependencySurface.title": "mustflow dependency surface",
+    "dependencySurface.label.surfaces": "Surfaces",
+    "dependencySurface.label.ecosystems": "Ecosystems",
+    "dependencySurface.label.surfaceDetails": "Surface details",
+    "dependencySurface.label.findings": "Findings",
+    "dependencySurface.label.issues": "Issues",
+    "dependencySurface.error.missingAction": "Specify a dependency-surface action: inspect",
+    "dependencySurface.error.unknownAction": "Unknown dependency-surface action: {action}",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",

package/dist/cli/i18n/hi.js

@@ -806,6 +806,9 @@ export const hiMessages = {
     "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.script.testPerformanceReport.summary": "Summarize retained mf run performance evidence and test-suite bottlenecks",
     "scriptPack.script.testRegressionSelector.summary": "Select likely regression tests and conservative fallback verification",
+    "scriptPack.script.toolchainProvenance.summary": "Inspect repository toolchain version contract sources and lockfile provenance",
+    "scriptPack.script.automationSurface.summary": "Inventory automation surfaces and mustflow command-intent coverage",
+    "scriptPack.script.dependencySurface.summary": "Inspect dependency manifests, lockfiles, update automation, and policy surfaces",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "actions",
     "scriptPack.label.schema": "schema",
@@ -1189,6 +1192,40 @@ export const hiMessages = {
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
     "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
+    "toolchainProvenance.help.summary": "Inspect repository runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running tools.",
+    "toolchainProvenance.help.exit.ok": "The toolchain-provenance report was generated without blocking findings",
+    "toolchainProvenance.help.exit.fail": "The toolchain-provenance report found provenance drift or unreadable metadata",
+    "toolchainProvenance.title": "mustflow toolchain provenance",
+    "toolchainProvenance.label.sources": "Sources",
+    "toolchainProvenance.label.lockfiles": "Lockfiles",
+    "toolchainProvenance.label.sourceDetails": "Source details",
+    "toolchainProvenance.label.findings": "Findings",
+    "toolchainProvenance.label.issues": "Issues",
+    "toolchainProvenance.clean": "No repository toolchain provenance sources were detected.",
+    "toolchainProvenance.error.missingAction": "Specify a toolchain-provenance action: inspect",
+    "toolchainProvenance.error.unknownAction": "Unknown toolchain-provenance action: {action}",
+    "automationSurface.help.summary": "Inventory package scripts, task runners, CI workflows, and mustflow intents without executing automation.",
+    "automationSurface.help.exit.ok": "The automation-surface report was generated without blocking findings",
+    "automationSurface.help.exit.fail": "The automation-surface report found risky automation or unreadable metadata",
+    "automationSurface.title": "mustflow automation surface",
+    "automationSurface.label.surfaces": "Surfaces",
+    "automationSurface.label.risky": "Risky surfaces",
+    "automationSurface.label.surfaceDetails": "Surface details",
+    "automationSurface.label.findings": "Findings",
+    "automationSurface.label.issues": "Issues",
+    "automationSurface.error.missingAction": "Specify an automation-surface action: inspect",
+    "automationSurface.error.unknownAction": "Unknown automation-surface action: {action}",
+    "dependencySurface.help.summary": "Inspect dependency manifests, lockfiles, update automation, audit, license, and SBOM policy surfaces without installing packages.",
+    "dependencySurface.help.exit.ok": "The dependency-surface report was generated without blocking findings",
+    "dependencySurface.help.exit.fail": "The dependency-surface report found dependency policy drift or unreadable metadata",
+    "dependencySurface.title": "mustflow dependency surface",
+    "dependencySurface.label.surfaces": "Surfaces",
+    "dependencySurface.label.ecosystems": "Ecosystems",
+    "dependencySurface.label.surfaceDetails": "Surface details",
+    "dependencySurface.label.findings": "Findings",
+    "dependencySurface.label.issues": "Issues",
+    "dependencySurface.error.missingAction": "Specify a dependency-surface action: inspect",
+    "dependencySurface.error.unknownAction": "Unknown dependency-surface action: {action}",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",

package/dist/cli/i18n/ko.js

@@ -806,6 +806,9 @@ export const koMessages = {
     "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.script.testPerformanceReport.summary": "Summarize retained mf run performance evidence and test-suite bottlenecks",
     "scriptPack.script.testRegressionSelector.summary": "Select likely regression tests and conservative fallback verification",
+    "scriptPack.script.toolchainProvenance.summary": "Inspect repository toolchain version contract sources and lockfile provenance",
+    "scriptPack.script.automationSurface.summary": "Inventory automation surfaces and mustflow command-intent coverage",
+    "scriptPack.script.dependencySurface.summary": "Inspect dependency manifests, lockfiles, update automation, and policy surfaces",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "작업",
     "scriptPack.label.schema": "스키마",
@@ -1189,6 +1192,40 @@ export const koMessages = {
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
     "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
+    "toolchainProvenance.help.summary": "Inspect repository runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running tools.",
+    "toolchainProvenance.help.exit.ok": "The toolchain-provenance report was generated without blocking findings",
+    "toolchainProvenance.help.exit.fail": "The toolchain-provenance report found provenance drift or unreadable metadata",
+    "toolchainProvenance.title": "mustflow toolchain provenance",
+    "toolchainProvenance.label.sources": "Sources",
+    "toolchainProvenance.label.lockfiles": "Lockfiles",
+    "toolchainProvenance.label.sourceDetails": "Source details",
+    "toolchainProvenance.label.findings": "Findings",
+    "toolchainProvenance.label.issues": "Issues",
+    "toolchainProvenance.clean": "No repository toolchain provenance sources were detected.",
+    "toolchainProvenance.error.missingAction": "Specify a toolchain-provenance action: inspect",
+    "toolchainProvenance.error.unknownAction": "Unknown toolchain-provenance action: {action}",
+    "automationSurface.help.summary": "Inventory package scripts, task runners, CI workflows, and mustflow intents without executing automation.",
+    "automationSurface.help.exit.ok": "The automation-surface report was generated without blocking findings",
+    "automationSurface.help.exit.fail": "The automation-surface report found risky automation or unreadable metadata",
+    "automationSurface.title": "mustflow automation surface",
+    "automationSurface.label.surfaces": "Surfaces",
+    "automationSurface.label.risky": "Risky surfaces",
+    "automationSurface.label.surfaceDetails": "Surface details",
+    "automationSurface.label.findings": "Findings",
+    "automationSurface.label.issues": "Issues",
+    "automationSurface.error.missingAction": "Specify an automation-surface action: inspect",
+    "automationSurface.error.unknownAction": "Unknown automation-surface action: {action}",
+    "dependencySurface.help.summary": "Inspect dependency manifests, lockfiles, update automation, audit, license, and SBOM policy surfaces without installing packages.",
+    "dependencySurface.help.exit.ok": "The dependency-surface report was generated without blocking findings",
+    "dependencySurface.help.exit.fail": "The dependency-surface report found dependency policy drift or unreadable metadata",
+    "dependencySurface.title": "mustflow dependency surface",
+    "dependencySurface.label.surfaces": "Surfaces",
+    "dependencySurface.label.ecosystems": "Ecosystems",
+    "dependencySurface.label.surfaceDetails": "Surface details",
+    "dependencySurface.label.findings": "Findings",
+    "dependencySurface.label.issues": "Issues",
+    "dependencySurface.error.missingAction": "Specify a dependency-surface action: inspect",
+    "dependencySurface.error.unknownAction": "Unknown dependency-surface action: {action}",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",

package/dist/cli/i18n/zh.js

@@ -806,6 +806,9 @@ export const zhMessages = {
     "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
     "scriptPack.script.testPerformanceReport.summary": "Summarize retained mf run performance evidence and test-suite bottlenecks",
     "scriptPack.script.testRegressionSelector.summary": "Select likely regression tests and conservative fallback verification",
+    "scriptPack.script.toolchainProvenance.summary": "Inspect repository toolchain version contract sources and lockfile provenance",
+    "scriptPack.script.automationSurface.summary": "Inventory automation surfaces and mustflow command-intent coverage",
+    "scriptPack.script.dependencySurface.summary": "Inspect dependency manifests, lockfiles, update automation, and policy surfaces",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "actions",
     "scriptPack.label.schema": "schema",
@@ -1189,6 +1192,40 @@ export const zhMessages = {
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
     "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
+    "toolchainProvenance.help.summary": "Inspect repository runtime, package-manager, lockfile, Docker, and CI toolchain provenance without running tools.",
+    "toolchainProvenance.help.exit.ok": "The toolchain-provenance report was generated without blocking findings",
+    "toolchainProvenance.help.exit.fail": "The toolchain-provenance report found provenance drift or unreadable metadata",
+    "toolchainProvenance.title": "mustflow toolchain provenance",
+    "toolchainProvenance.label.sources": "Sources",
+    "toolchainProvenance.label.lockfiles": "Lockfiles",
+    "toolchainProvenance.label.sourceDetails": "Source details",
+    "toolchainProvenance.label.findings": "Findings",
+    "toolchainProvenance.label.issues": "Issues",
+    "toolchainProvenance.clean": "No repository toolchain provenance sources were detected.",
+    "toolchainProvenance.error.missingAction": "Specify a toolchain-provenance action: inspect",
+    "toolchainProvenance.error.unknownAction": "Unknown toolchain-provenance action: {action}",
+    "automationSurface.help.summary": "Inventory package scripts, task runners, CI workflows, and mustflow intents without executing automation.",
+    "automationSurface.help.exit.ok": "The automation-surface report was generated without blocking findings",
+    "automationSurface.help.exit.fail": "The automation-surface report found risky automation or unreadable metadata",
+    "automationSurface.title": "mustflow automation surface",
+    "automationSurface.label.surfaces": "Surfaces",
+    "automationSurface.label.risky": "Risky surfaces",
+    "automationSurface.label.surfaceDetails": "Surface details",
+    "automationSurface.label.findings": "Findings",
+    "automationSurface.label.issues": "Issues",
+    "automationSurface.error.missingAction": "Specify an automation-surface action: inspect",
+    "automationSurface.error.unknownAction": "Unknown automation-surface action: {action}",
+    "dependencySurface.help.summary": "Inspect dependency manifests, lockfiles, update automation, audit, license, and SBOM policy surfaces without installing packages.",
+    "dependencySurface.help.exit.ok": "The dependency-surface report was generated without blocking findings",
+    "dependencySurface.help.exit.fail": "The dependency-surface report found dependency policy drift or unreadable metadata",
+    "dependencySurface.title": "mustflow dependency surface",
+    "dependencySurface.label.surfaces": "Surfaces",
+    "dependencySurface.label.ecosystems": "Ecosystems",
+    "dependencySurface.label.surfaceDetails": "Surface details",
+    "dependencySurface.label.findings": "Findings",
+    "dependencySurface.label.issues": "Issues",
+    "dependencySurface.error.missingAction": "Specify a dependency-surface action: inspect",
+    "dependencySurface.error.unknownAction": "Unknown dependency-surface action: {action}",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",

package/dist/cli/lib/command-registry.js

@@ -169,6 +169,9 @@ export const COMMAND_DEFINITIONS = [
             'repo-manifest-lock-drift-report',
             'skill-route-audit-report',
             'repo-version-source-report',
+            'repo-toolchain-provenance-report',
+            'repo-automation-surface-report',
+            'repo-dependency-surface-report',
             'repo-approval-gate-report',
             'repo-deploy-surface-report',
             'config-chain-report',

package/dist/cli/lib/script-pack-registry.js

@@ -436,6 +436,90 @@ export const SCRIPT_PACKS = [
                 reportSchemaFile: 'config-chain-report.schema.json',
                 loadRunner: async () => (await import('../script-packs/repo-config-chain.js')).runRepoConfigChainScript,
             },
+            {
+                packId: 'repo',
+                id: 'toolchain-provenance',
+                ref: scriptRef('repo', 'toolchain-provenance'),
+                usage: 'mf script-pack run repo/toolchain-provenance inspect [options]',
+                summaryKey: 'scriptPack.script.toolchainProvenance.summary',
+                actions: ['inspect'],
+                useWhen: [
+                    'Inspect repository runtime, package-manager, lockfile, Docker, and CI version contract sources before debugging local environment drift.',
+                    'Review toolchain provenance when package metadata, CI, Docker, setup, bootstrap, or doctor automation changes.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: [],
+                outputs: ['human_summary', 'json_report', 'toolchain_sources', 'lockfiles', 'toolchain_findings'],
+                relatedSkills: [
+                    'command-intent-mapping-gate',
+                    'config-env-change',
+                    'dependency-reality-check',
+                    'version-freshness-check',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'repo-toolchain-provenance-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-toolchain-provenance.js')).runRepoToolchainProvenanceScript,
+            },
+            {
+                packId: 'repo',
+                id: 'automation-surface',
+                ref: scriptRef('repo', 'automation-surface'),
+                usage: 'mf script-pack run repo/automation-surface inspect [options]',
+                summaryKey: 'scriptPack.script.automationSurface.summary',
+                actions: ['inspect'],
+                useWhen: [
+                    'Inventory package scripts, task runners, CI workflows, and mustflow command intents before mapping external automation advice to safe actions.',
+                    'Review raw automation surfaces, long-running commands, release/deploy scripts, and missing command-contract coverage.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: [],
+                outputs: ['human_summary', 'json_report', 'automation_surfaces', 'automation_findings'],
+                relatedSkills: [
+                    'command-intent-mapping-gate',
+                    'completion-evidence-gate',
+                    'proactive-risk-surfacing',
+                    'release-publish-change',
+                ],
+                riskLevel: 'medium',
+                cost: 'low',
+                reportSchemaFile: 'repo-automation-surface-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-automation-surface.js')).runRepoAutomationSurfaceScript,
+            },
+            {
+                packId: 'repo',
+                id: 'dependency-surface',
+                ref: scriptRef('repo', 'dependency-surface'),
+                usage: 'mf script-pack run repo/dependency-surface inspect [options]',
+                summaryKey: 'scriptPack.script.dependencySurface.summary',
+                actions: ['inspect'],
+                useWhen: [
+                    'Inspect dependency manifests, lockfiles, update-bot config, audit, license, and SBOM surfaces before dependency automation work.',
+                    'Review package-manager lockfile conflicts, missing update automation, and missing dependency policy evidence.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: [],
+                outputs: ['human_summary', 'json_report', 'dependency_surfaces', 'dependency_findings'],
+                relatedSkills: [
+                    'dependency-reality-check',
+                    'dependency-upgrade-review',
+                    'provenance-license-gate',
+                    'public-json-contract-change',
+                ],
+                riskLevel: 'medium',
+                cost: 'low',
+                reportSchemaFile: 'repo-dependency-surface-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-dependency-surface.js')).runRepoDependencySurfaceScript,
+            },
             {
                 packId: 'repo',
                 id: 'env-contract',

package/dist/cli/script-packs/repo-automation-surface.js

@@ -0,0 +1,88 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { inspectRepoAutomationSurface, REPO_AUTOMATION_SURFACE_SCRIPT_REF, } from '../../core/repo-automation-surface.js';
+const REPO_AUTOMATION_SURFACE_OPTIONS = [{ name: '--json', kind: 'boolean' }];
+export function getRepoAutomationSurfaceHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/automation-surface inspect [options]',
+        summary: t(lang, 'automationSurface.help.summary'),
+        options: [
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/automation-surface inspect',
+            'mf script-pack run repo/automation-surface inspect --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'automationSurface.help.exit.ok') },
+            { label: '1', description: t(lang, 'automationSurface.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseRepoAutomationSurfaceOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, REPO_AUTOMATION_SURFACE_OPTIONS, { allowPositionals: false });
+    const json = hasParsedCliOption(parsed, '--json');
+    if (action !== 'inspect') {
+        return {
+            action: 'inspect',
+            json,
+            error: action
+                ? t(lang, 'automationSurface.error.unknownAction', { action })
+                : t(lang, 'automationSurface.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return { action, json, error: formatCliOptionParseError(parsed.error, lang) };
+    }
+    return { action, json };
+}
+function renderRepoAutomationSurfaceSummary(report, lang) {
+    const lines = [
+        t(lang, 'automationSurface.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${REPO_AUTOMATION_SURFACE_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'automationSurface.label.surfaces')}: ${report.summary.surface_count}`,
+        `${t(lang, 'automationSurface.label.risky')}: ${report.summary.risky_surface_count}`,
+        `${t(lang, 'automationSurface.label.findings')}: ${report.findings.length}`,
+    ];
+    if (report.surfaces.length > 0) {
+        lines.push(t(lang, 'automationSurface.label.surfaceDetails'));
+        for (const surface of report.surfaces.slice(0, 30)) {
+            const location = surface.line === null ? surface.path : `${surface.path}:${surface.line}`;
+            const mapped = surface.mapped_intent === null ? 'unmapped' : `intent ${surface.mapped_intent}`;
+            lines.push(`- ${surface.name} (${surface.category}, ${surface.kind}, ${mapped}) at ${location}`);
+        }
+    }
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'automationSurface.label.findings'));
+        for (const finding of report.findings) {
+            lines.push(`- ${finding.path}: ${finding.code} (${finding.message})`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'automationSurface.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    return lines.join('\n');
+}
+export function runRepoAutomationSurfaceScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoAutomationSurfaceHelp(lang));
+        return 0;
+    }
+    const options = parseRepoAutomationSurfaceOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/automation-surface --help', getRepoAutomationSurfaceHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectRepoAutomationSurface(resolveMustflowRoot());
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderRepoAutomationSurfaceSummary(report, lang));
+    return report.ok ? 0 : 1;
+}

package/dist/cli/script-packs/repo-dependency-surface.js

@@ -0,0 +1,87 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { inspectRepoDependencySurface, REPO_DEPENDENCY_SURFACE_SCRIPT_REF, } from '../../core/repo-dependency-surface.js';
+const REPO_DEPENDENCY_SURFACE_OPTIONS = [{ name: '--json', kind: 'boolean' }];
+export function getRepoDependencySurfaceHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/dependency-surface inspect [options]',
+        summary: t(lang, 'dependencySurface.help.summary'),
+        options: [
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/dependency-surface inspect',
+            'mf script-pack run repo/dependency-surface inspect --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'dependencySurface.help.exit.ok') },
+            { label: '1', description: t(lang, 'dependencySurface.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseRepoDependencySurfaceOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, REPO_DEPENDENCY_SURFACE_OPTIONS, { allowPositionals: false });
+    const json = hasParsedCliOption(parsed, '--json');
+    if (action !== 'inspect') {
+        return {
+            action: 'inspect',
+            json,
+            error: action
+                ? t(lang, 'dependencySurface.error.unknownAction', { action })
+                : t(lang, 'dependencySurface.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return { action, json, error: formatCliOptionParseError(parsed.error, lang) };
+    }
+    return { action, json };
+}
+function renderRepoDependencySurfaceSummary(report, lang) {
+    const lines = [
+        t(lang, 'dependencySurface.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${REPO_DEPENDENCY_SURFACE_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'dependencySurface.label.surfaces')}: ${report.summary.surface_count}`,
+        `${t(lang, 'dependencySurface.label.ecosystems')}: ${report.summary.ecosystem_count}`,
+        `${t(lang, 'dependencySurface.label.findings')}: ${report.summary.finding_count}`,
+    ];
+    if (report.surfaces.length > 0) {
+        lines.push(t(lang, 'dependencySurface.label.surfaceDetails'));
+        for (const surface of report.surfaces) {
+            const location = surface.line === null ? surface.path : `${surface.path}:${surface.line}`;
+            lines.push(`- ${surface.ecosystem} ${surface.kind} ${surface.name} at ${location}`);
+        }
+    }
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'dependencySurface.label.findings'));
+        for (const finding of report.findings) {
+            lines.push(`- ${finding.path}: ${finding.code} (${finding.message})`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'dependencySurface.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    return lines.join('\n');
+}
+export function runRepoDependencySurfaceScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoDependencySurfaceHelp(lang));
+        return 0;
+    }
+    const options = parseRepoDependencySurfaceOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/dependency-surface --help', getRepoDependencySurfaceHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectRepoDependencySurface(resolveMustflowRoot());
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderRepoDependencySurfaceSummary(report, lang));
+    return report.ok ? 0 : 1;
+}