mustflow 2.84.0 → 2.99.0

package/README.md

@@ -128,9 +128,12 @@ mustflow installs and validates an agent workflow for user projects.
   evidence, and dashboard exports so agents justify new dependencies, helper-style surfaces,
   config/schema churn, and broad structural changes before treating added complexity as free.
 - Lists, suggests, and runs bundled read-only utility scripts through `mf script-pack`, including
-  `code/outline` for source symbol maps, `code/symbol-read` for focused source snippets,
+  `code/outline` for source symbol maps, `code/dependency-graph` for bounded relative import graphs,
+  `code/change-impact` for git-diff impact and verification hints, `code/symbol-read` for focused source snippets,
   `code/route-outline` for Hono, Elysia, Axum, and NestJS route maps, `docs/reference-drift` for stale
   documentation references, `repo/config-chain` for nearby config inheritance,
+  `repo/env-contract` for environment-variable contract drift,
+  `repo/secret-risk-scan` for plausible hardcoded-secret findings without printing values,
   `repo/generated-boundary` for candidate path safety checks, and `core/text-budget`
   for exact file and JSON-field length budgets, so future checks do not sprawl into top-level
   commands.
@@ -292,12 +295,16 @@ mf run mustflow_update_apply
 | `mf script-pack suggest --changed --json` | Rank optional read-only helpers for current changed files without running those helpers or granting command authority. |
 | `mf script-pack suggest --path <path> --phase before_change` | Rank helpers for an explicit path and workflow phase before deciding which script to run. |
 | `mf script-pack run code/outline scan <path...> --json` | Scan supported source files for symbol headers, line ranges, source anchors, return metadata, and content hashes. |
+| `mf script-pack run code/dependency-graph scan <path...> --json` | Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files. |
+| `mf script-pack run code/change-impact analyze --base HEAD --json` | Analyze changed files and return bounded impact candidates, script-pack hints, and verification intent hints. |
 | `mf script-pack run code/symbol-read read <path> --start-line <line> --json` | Read the focused symbol range or bounded source snippet after `code/outline` identifies the relevant location. |
 | `mf script-pack run code/symbol-read read --anchor <id> --json` | Read the conservative target symbol for a structured `mf:anchor` source marker. |
 | `mf script-pack run code/route-outline scan <path...> --json` | Scan Hono, Elysia, Axum, and NestJS files for route methods, paths, handlers, lifecycle chains, line ranges, and content hashes. |
 | `mf script-pack run code/export-diff compare --base HEAD --json` | Compare exported TypeScript or JavaScript declarations, return metadata, and package surface hints against a git base. |
 | `mf script-pack run docs/reference-drift check [path...] --json` | Check documentation references to `mf` commands, script-pack refs, schema files, and repository paths against current local surfaces. |
 | `mf script-pack run repo/config-chain inspect <path...> --json` | Inspect nearby package, TypeScript, ESLint, Vite, Tailwind, test, and mustflow config files plus static inheritance edges without executing dynamic config code. |
+| `mf script-pack run repo/env-contract scan [path...] --json` | Scan code, CI, docs, config, and env examples for environment-variable contract drift without reading or printing real secret env values. |
+| `mf script-pack run repo/secret-risk-scan scan [path...] --json` | Scan code, docs, config, CI, and examples for plausible hardcoded secrets while reporting only redacted fingerprints. |
 | `mf script-pack run repo/generated-boundary check <path...> --json` | Check whether candidate paths cross generated, ignored, protected, vendor, or cache boundaries before or after edits. |
 | `mf script-pack run repo/related-files map <path...> --json` | Map direct imports, importers, same-basename siblings, and nearby config or package boundaries for source navigation. |
 | `mf script-pack run core/text-budget check <path...> --max <count>` | Check exact text length budgets for files using grapheme counts by default. |
@@ -330,7 +337,9 @@ Automation and agents should use `--json` output or `mf api serve --stdio` JSONL
 For script-pack helper selection, start with `mf script-pack suggest --changed --json` or an
 explicit `--path`. The suggestion report is only a ranking aid: it does not run scripts, prove
 verification, or bypass `.mustflow/config/commands.toml`. A common source-orientation flow is
-`code/outline` first, then `code/symbol-read` for the chosen symbol line or source anchor. After
+`code/outline` first, `code/dependency-graph` for relative import impact, then `code/symbol-read`
+for the chosen symbol line or source anchor. After a local diff exists, use `code/change-impact`
+to summarize changed surfaces, likely related files, optional helper scripts, and verification hints. After
 public-ish TypeScript or JavaScript changes, use `code/export-diff` to review exported signatures
 and return metadata against a git base. After docs, schema, CLI, or script-pack surface changes, use
 `docs/reference-drift` to catch stale references before treating docs as synchronized. For

package/dist/cli/commands/script-pack.js

@@ -62,13 +62,27 @@ export function getScriptPackHelp(lang = 'en') {
             'mf script-pack suggest --path src/cli/index.ts --phase before_change',
             'mf script-pack suggest --changed --phase after_change --json',
             'mf script-pack run code/outline scan src --json',
+            'mf script-pack run code/dependency-graph scan src/cli/index.ts --json',
+            'mf script-pack run code/import-cycle check src --json',
+            'mf script-pack run code/change-impact analyze --base HEAD --json',
             'mf script-pack run code/symbol-read read src/cli/index.ts --start-line 25 --json',
             'mf script-pack run code/route-outline scan src/cli/index.ts --json',
             'mf script-pack run code/export-diff compare --base HEAD~1 --head HEAD --json',
             'mf script-pack run core/text-budget check README.md --max 5000',
             'mf script-pack run docs/reference-drift check README.md schemas/README.md --json',
+            'mf script-pack run docs/link-integrity check README.md docs-site/src/content/docs --json',
+            'mf script-pack run test/performance-report summarize --json',
+            'mf script-pack run test/regression-selector select --base HEAD --json',
             'mf script-pack run repo/config-chain inspect src/cli/index.ts --json',
+            'mf script-pack run repo/env-contract scan --json',
+            'mf script-pack run repo/secret-risk-scan scan src README.md --json',
             'mf script-pack run repo/generated-boundary check src/cli/index.ts --json',
+            'mf script-pack run repo/merge-conflict-scan check --json',
+            'mf script-pack run repo/git-ignore-audit audit .env.local dist/app.js --json',
+            'mf script-pack run repo/manifest-lock-drift check AGENTS.md --json',
+            'mf script-pack run repo/skill-route-audit audit --json',
+            'mf script-pack run repo/version-source inspect --json',
+            'mf script-pack run repo/approval-gate check --action git_commit --json',
             'mf script-pack run repo/related-files map src/cli/index.ts --json',
             'mf script-pack run core/text-budget --help',
         ],

package/dist/cli/i18n/en.js

@@ -772,16 +772,23 @@ Read these files before working:
     "scriptPack.pack.code.summary": "Source-code orientation utility scripts",
     "scriptPack.pack.core.summary": "Core built-in utility scripts",
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
+    "scriptPack.pack.test.summary": "Test evidence and performance utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
     "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
+    "scriptPack.script.codeImportCycle.summary": "Detect relative TypeScript and JavaScript import cycles with line evidence",
+    "scriptPack.script.codeChangeImpact.summary": "Analyze changed files for impact, script-pack, and verification hints",
     "scriptPack.script.codeSymbolRead.summary": "Read a bounded source snippet by source anchor, symbol line, or explicit line range",
     "scriptPack.script.codeRouteOutline.summary": "Scan Hono, Elysia, Axum, and NestJS route methods, paths, handlers, and lifecycle chains",
     "scriptPack.script.codeExportDiff.summary": "Compare exported source signatures and return metadata across git refs",
     "scriptPack.script.textBudget.summary": "Check exact text length budgets for files or JSON string fields",
     "scriptPack.script.referenceDrift.summary": "Check documented command, script-pack, schema, and path references for drift",
+    "scriptPack.script.linkIntegrity.summary": "Check Markdown links and anchors for local documentation drift",
     "scriptPack.script.configChain.summary": "Inspect nearby config files and static config inheritance",
     "scriptPack.script.generatedBoundary.summary": "Check whether candidate paths cross generated, ignored, protected, vendor, or cache boundaries",
     "scriptPack.script.relatedFiles.summary": "Map likely related files for source-oriented repository navigation",
+    "scriptPack.script.testPerformanceReport.summary": "Summarize retained mf run performance evidence and test-suite bottlenecks",
+    "scriptPack.script.testRegressionSelector.summary": "Select likely regression tests and conservative fallback verification",
     "scriptPack.label.script": "Script",
     "scriptPack.label.actions": "actions",
     "scriptPack.label.schema": "schema",
@@ -876,6 +883,20 @@ Read these files before working:
     "referenceDrift.error.missingAction": "Specify a reference-drift action: check",
     "referenceDrift.error.unknownAction": "Unknown reference-drift action: {action}",
     "referenceDrift.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "linkIntegrity.help.summary": "Check Markdown and MDX links for missing local files and anchors without fetching external URLs.",
+    "linkIntegrity.help.option.maxFiles": "Maximum number of document files to inspect. Default: 200",
+    "linkIntegrity.help.option.maxFileBytes": "Maximum bytes to read from each document file. Default: 524288",
+    "linkIntegrity.help.exit.ok": "All checked local links and anchors resolved",
+    "linkIntegrity.help.exit.fail": "A local link or anchor was missing, unreadable, or over a configured limit",
+    "linkIntegrity.title": "mustflow link integrity",
+    "linkIntegrity.label.files": "Files",
+    "linkIntegrity.label.links": "Links",
+    "linkIntegrity.label.findings": "Findings",
+    "linkIntegrity.label.issues": "Issues",
+    "linkIntegrity.clean": "No documentation links were found.",
+    "linkIntegrity.error.missingAction": "Specify a link-integrity action: check",
+    "linkIntegrity.error.unknownAction": "Unknown link-integrity action: {action}",
+    "linkIntegrity.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "textBudget.help.summary": "Check exact text length budgets for files or JSON string fields using grapheme counts by default.",
     "textBudget.help.option.min": "Require at least this many units",
     "textBudget.help.option.max": "Require at most this many units",
@@ -912,6 +933,71 @@ Read these files before working:
     "generatedBoundary.error.missingAction": "Specify a generated-boundary action: check",
     "generatedBoundary.error.unknownAction": "Unknown generated-boundary action: {action}",
     "generatedBoundary.error.missingPath": "Provide at least one path to check",
+    "dependencyGraph.help.summary": "Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files.",
+    "dependencyGraph.help.option.maxDepth": "Maximum dependency depth from target files. Default: 2",
+    "dependencyGraph.help.option.maxFiles": "Maximum number of source files to scan. Default: 1000",
+    "dependencyGraph.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "dependencyGraph.help.option.maxNodes": "Maximum number of graph nodes to report. Default: 300",
+    "dependencyGraph.help.option.maxEdges": "Maximum number of graph edges to report. Default: 800",
+    "dependencyGraph.help.exit.ok": "The dependency graph completed without input or scan-limit findings",
+    "dependencyGraph.help.exit.fail": "The dependency graph found invalid input, unreadable paths, or scan limits",
+    "dependencyGraph.title": "mustflow dependency graph",
+    "dependencyGraph.label.targets": "Targets",
+    "dependencyGraph.label.nodes": "Nodes",
+    "dependencyGraph.label.edges": "Edges",
+    "dependencyGraph.label.cycles": "Cycles",
+    "dependencyGraph.label.truncated": "Truncated",
+    "dependencyGraph.label.cycleList": "Cycle hints",
+    "dependencyGraph.label.findings": "Findings",
+    "dependencyGraph.label.issues": "Issues",
+    "dependencyGraph.clean": "No relative dependency edges were found.",
+    "dependencyGraph.error.missingAction": "Specify a dependency-graph action: scan",
+    "dependencyGraph.error.unknownAction": "Unknown dependency-graph action: {action}",
+    "dependencyGraph.error.missingPath": "Provide at least one path to scan",
+    "dependencyGraph.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "importCycle.help.summary": "Detect bounded relative TypeScript and JavaScript import cycles with exact path and line evidence.",
+    "importCycle.help.option.maxDepth": "Maximum dependency depth from target files. Default: 20",
+    "importCycle.help.option.maxFiles": "Maximum number of source files to scan. Default: 1000",
+    "importCycle.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "importCycle.help.option.maxNodes": "Maximum number of graph nodes to inspect. Default: 300",
+    "importCycle.help.option.maxEdges": "Maximum number of graph edges to inspect. Default: 800",
+    "importCycle.help.option.maxCycles": "Maximum number of import cycles to report. Default: 50",
+    "importCycle.help.exit.ok": "No import cycles were detected",
+    "importCycle.help.exit.fail": "Import cycles, invalid input, unreadable paths, or scan limits were found",
+    "importCycle.title": "mustflow import cycle",
+    "importCycle.label.targets": "Targets",
+    "importCycle.label.nodes": "Nodes",
+    "importCycle.label.edges": "Edges",
+    "importCycle.label.cycles": "Cycles",
+    "importCycle.label.truncated": "Truncated",
+    "importCycle.label.cycleList": "Import cycles",
+    "importCycle.label.findings": "Findings",
+    "importCycle.label.issues": "Issues",
+    "importCycle.clean": "No import cycles were found.",
+    "importCycle.error.missingAction": "Specify an import-cycle action: check",
+    "importCycle.error.unknownAction": "Unknown import-cycle action: {action}",
+    "importCycle.error.missingPath": "Provide at least one path to check",
+    "importCycle.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "changeImpact.help.summary": "Analyze git changes and return bounded file-impact, script-pack, and verification hints.",
+    "changeImpact.help.option.base": "Git base ref to compare from. Default: HEAD",
+    "changeImpact.help.option.head": "Git head ref to compare to. Omit to compare the base with the working tree.",
+    "changeImpact.help.option.maxFiles": "Maximum number of changed files to inspect. Default: 200",
+    "changeImpact.help.option.maxImpacts": "Maximum number of impact candidates to report. Default: 300",
+    "changeImpact.help.option.maxFileBytes": "Maximum bytes to read from each source file while tracing dependencies. Default: 262144",
+    "changeImpact.help.exit.ok": "The change-impact analysis completed without input or scan-limit findings",
+    "changeImpact.help.exit.fail": "The change-impact analysis found invalid git input or scan limits",
+    "changeImpact.title": "mustflow change impact",
+    "changeImpact.label.changedFiles": "Changed files",
+    "changeImpact.label.impacts": "Impacts",
+    "changeImpact.label.truncated": "Truncated",
+    "changeImpact.label.scriptHints": "Script hints",
+    "changeImpact.label.verificationHints": "Verification hints",
+    "changeImpact.label.findings": "Findings",
+    "changeImpact.label.issues": "Issues",
+    "changeImpact.clean": "No changed files were found for the selected git range.",
+    "changeImpact.error.missingAction": "Specify a change-impact action: analyze",
+    "changeImpact.error.unknownAction": "Unknown change-impact action: {action}",
+    "changeImpact.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "relatedFiles.help.summary": "Map direct imports, importers, sibling files, and nearby config boundaries for source-oriented repository navigation.",
     "relatedFiles.help.option.maxFiles": "Maximum number of source or related files to scan. Default: 1000",
     "relatedFiles.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
@@ -948,6 +1034,182 @@ Read these files before working:
     "configChain.error.unknownAction": "Unknown config-chain action: {action}",
     "configChain.error.missingPath": "Provide at least one path to inspect",
     "configChain.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "testPerformance.help.summary": "Summarize retained mf run performance evidence, slow intents, timeout pressure, " +
+        "selected-test fallback use, and phase bottlenecks.",
+    "testPerformance.help.option.maxSamples": "Maximum number of recent samples to report. Default: 200",
+    "testPerformance.help.option.maxIntents": "Maximum number of intent summaries to report. Default: 30",
+    "testPerformance.help.option.maxTestFiles": "Maximum number of profiled test files to report. Default: 40",
+    "testPerformance.help.option.maxFindings": "Maximum number of findings to report. Default: 80",
+    "testPerformance.help.option.slowMs": "Duration threshold for slow-sample findings in milliseconds. Default: 120000",
+    "testPerformance.help.option.timeoutRatio": "Timeout budget ratio for timeout-pressure findings, from 0 to 1. Default: 0.75",
+    "testPerformance.help.option.phaseMs": "Phase p95 threshold for phase-bottleneck findings in milliseconds. Default: 30000",
+    "testPerformance.help.exit.ok": "The performance report was generated",
+    "testPerformance.help.exit.fail": "Performance evidence could not be read or the input was invalid",
+    "testPerformance.title": "mustflow test performance report",
+    "testPerformance.label.samples": "Samples",
+    "testPerformance.label.intents": "Intents",
+    "testPerformance.label.testFiles": "Test files",
+    "testPerformance.label.findings": "Findings",
+    "testPerformance.label.truncated": "Truncated",
+    "testPerformance.label.slowestIntents": "Slowest intents",
+    "testPerformance.label.slowestTestFiles": "Slowest test files",
+    "testPerformance.label.slowestPhases": "Slowest phases",
+    "testPerformance.label.failures": "failures",
+    "testPerformance.label.profileEvidence": "Profile evidence",
+    "testPerformance.label.profileGeneratedAt": "Generated at",
+    "testPerformance.label.profileAge": "Age",
+    "testPerformance.label.profileFilesShown": "Files shown",
+    "testPerformance.label.profileCoverage": "Coverage",
+    "testPerformance.label.profileFilesTruncated": "Profile files truncated",
+    "testPerformance.label.nextActions": "Next actions",
+    "testPerformance.label.issues": "Issues",
+    "testPerformance.clean": "No run performance evidence was found under .mustflow/state.",
+    "testPerformance.error.missingAction": "Specify a performance-report action: summarize",
+    "testPerformance.error.unknownAction": "Unknown performance-report action: {action}",
+    "testPerformance.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "testPerformance.error.invalidRatio": "{option} must be a number greater than 0 and less than or equal to 1: {value}",
+    "testRegressionSelector.help.summary": "Select likely regression tests from changed files while reporting unsafe fallback surfaces.",
+    "testRegressionSelector.help.option.base": "Git base ref to compare from. Default: HEAD",
+    "testRegressionSelector.help.option.head": "Git head ref to compare to. Omit to compare the worktree",
+    "testRegressionSelector.help.option.maxFiles": "Maximum number of changed files to inspect. Default: 200",
+    "testRegressionSelector.help.option.maxTests": "Maximum number of selected or missing test candidates to report. Default: 100",
+    "testRegressionSelector.help.exit.ok": "The regression selection report was generated",
+    "testRegressionSelector.help.exit.fail": "Regression selection could not inspect the input",
+    "testRegressionSelector.title": "mustflow test regression selector",
+    "testRegressionSelector.label.selectionStatus": "Selection",
+    "testRegressionSelector.label.changedFiles": "Changed files",
+    "testRegressionSelector.label.selectedTests": "Selected tests",
+    "testRegressionSelector.label.fallbacks": "Fallbacks",
+    "testRegressionSelector.label.recommendedIntent": "Recommended intent",
+    "testRegressionSelector.label.runHint": "Run hint",
+    "testRegressionSelector.label.findings": "Findings",
+    "testRegressionSelector.label.issues": "Issues",
+    "testRegressionSelector.clean": "No changed files were found for regression selection.",
+    "testRegressionSelector.error.missingAction": "Specify a regression-selector action: select",
+    "testRegressionSelector.error.unknownAction": "Unknown regression-selector action: {action}",
+    "testRegressionSelector.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.envContract.summary": "Scan repository environment-variable contracts without reading secret values",
+    "envContract.help.summary": "Scan code, CI, docs, config, and env examples for environment variable contract drift without printing env values.",
+    "envContract.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "envContract.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "envContract.help.option.maxKeys": "Maximum number of env keys to report. Default: 300",
+    "envContract.help.exit.ok": "The env contract scan completed without blocking findings",
+    "envContract.help.exit.fail": "The env contract scan found invalid input, unreadable files, or contract findings",
+    "envContract.title": "mustflow env contract",
+    "envContract.label.files": "Files",
+    "envContract.label.keys": "Keys",
+    "envContract.label.findings": "Findings",
+    "envContract.label.truncated": "Truncated",
+    "envContract.label.issues": "Issues",
+    "envContract.clean": "No environment variable references were found.",
+    "envContract.error.missingAction": "Specify an env-contract action: scan",
+    "envContract.error.unknownAction": "Unknown env-contract action: {action}",
+    "envContract.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.secretRiskScan.summary": "Scan repository files for plausible secrets without printing secret values",
+    "secretRiskScan.help.summary": "Scan code, docs, config, CI, and examples for plausible hardcoded secrets without printing secret values.",
+    "secretRiskScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "secretRiskScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "secretRiskScan.help.option.maxFindings": "Maximum number of findings to report. Default: 200",
+    "secretRiskScan.help.exit.ok": "The secret-risk scan completed without blocking findings",
+    "secretRiskScan.help.exit.fail": "The secret-risk scan found invalid input, unreadable files, or secret-risk findings",
+    "secretRiskScan.title": "mustflow secret risk scan",
+    "secretRiskScan.label.files": "Files",
+    "secretRiskScan.label.findings": "Findings",
+    "secretRiskScan.label.highOrCritical": "High or critical",
+    "secretRiskScan.label.skippedSecretFiles": "Skipped secret files",
+    "secretRiskScan.label.truncated": "Truncated",
+    "secretRiskScan.label.issues": "Issues",
+    "secretRiskScan.clean": "No plausible hardcoded secrets were found.",
+    "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
+    "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
+    "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.skillRouteAudit.summary": "Audit skill routes, template skill copies, manifest profiles, and i18n metadata for drift",
+    "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
+    "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
+    "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
+    "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
+    "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",
+    "skillRouteAudit.help.summary": "Audit mustflow skill route metadata, source skill files, default template skill copies, manifest profiles, and i18n metadata.",
+    "skillRouteAudit.help.exit.ok": "The skill-route audit report was generated",
+    "skillRouteAudit.help.exit.fail": "The skill-route audit command received invalid input or could not read required metadata",
+    "skillRouteAudit.title": "mustflow skill route audit",
+    "skillRouteAudit.label.sourceSkills": "Source skills",
+    "skillRouteAudit.label.routeMetadata": "Route metadata",
+    "skillRouteAudit.label.indexRoutes": "Index routes",
+    "skillRouteAudit.label.templateSkills": "Template skills",
+    "skillRouteAudit.label.findings": "Findings",
+    "skillRouteAudit.clean": "Skill routes, template skill copies, manifest profiles, and i18n metadata are aligned.",
+    "skillRouteAudit.error.missingAction": "Specify a skill-route-audit action: audit",
+    "skillRouteAudit.error.unknownAction": "Unknown skill-route-audit action: {action}",
+    "versionSource.help.summary": "Inspect detected version source files and release versioning preference alignment.",
+    "versionSource.help.exit.ok": "The version-source report was generated without blocking findings",
+    "versionSource.help.exit.fail": "The version-source report found invalid input, unreadable metadata, or missing version sources",
+    "versionSource.title": "mustflow version source",
+    "versionSource.label.versioning": "Versioning preferences",
+    "versionSource.label.sources": "Sources",
+    "versionSource.label.sourceAuthorities": "Source authorities",
+    "versionSource.label.findings": "Findings",
+    "versionSource.label.issues": "Issues",
+    "versionSource.error.missingAction": "Specify a version-source action: inspect",
+    "versionSource.error.unknownAction": "Unknown version-source action: {action}",
+    "approvalGate.help.summary": "Check planned action types against .mustflow/config/mustflow.toml approval gates.",
+    "approvalGate.help.option.action": "Action type to check. May be repeated.",
+    "approvalGate.help.exit.ok": "No requested action requires approval",
+    "approvalGate.help.exit.fail": "A requested action requires approval, metadata was unreadable, or input was invalid",
+    "approvalGate.title": "mustflow approval gate",
+    "approvalGate.label.approvalRequired": "Approval required",
+    "approvalGate.label.configuredRequiredActions": "Configured required actions",
+    "approvalGate.label.decisions": "Decisions",
+    "approvalGate.label.findings": "Findings",
+    "approvalGate.label.issues": "Issues",
+    "approvalGate.error.missingAction": "Specify an approval-gate action: check",
+    "approvalGate.error.unknownAction": "Unknown approval-gate action: {action}",
+    "approvalGate.error.missingActionType": "Specify at least one --action <type>",
+    "mergeConflictScan.help.summary": "Scan changed files or explicit paths for unresolved Git merge conflict markers without printing file content.",
+    "mergeConflictScan.help.option.maxFiles": "Maximum files to scan. Default: 1000",
+    "mergeConflictScan.help.option.maxFileBytes": "Maximum bytes to read from each file. Default: 524288",
+    "mergeConflictScan.help.exit.ok": "No merge conflict markers were detected",
+    "mergeConflictScan.help.exit.fail": "Merge conflict markers were detected, input was invalid, or files could not be scanned",
+    "mergeConflictScan.title": "mustflow merge conflict scan",
+    "mergeConflictScan.label.filesChecked": "Files checked",
+    "mergeConflictScan.label.markersFound": "Markers found",
+    "mergeConflictScan.label.markers": "Markers",
+    "mergeConflictScan.label.findings": "Findings",
+    "mergeConflictScan.label.issues": "Issues",
+    "mergeConflictScan.clean": "No merge conflict markers detected.",
+    "mergeConflictScan.error.missingAction": "Specify a merge-conflict-scan action: check",
+    "mergeConflictScan.error.unknownAction": "Unknown merge-conflict-scan action: {action}",
+    "mergeConflictScan.error.invalidPositiveInteger": "{option} must be a positive integer",
+    "gitIgnoreAudit.help.summary": "Audit explicit paths or changed files against Git ignore rules without reading ignored file content.",
+    "gitIgnoreAudit.help.option.maxPaths": "Maximum paths to audit. Default: 200",
+    "gitIgnoreAudit.help.exit.ok": "No ignored path findings were detected",
+    "gitIgnoreAudit.help.exit.fail": "Ignored paths, invalid input, or Git ignore audit issues were detected",
+    "gitIgnoreAudit.title": "mustflow Git ignore audit",
+    "gitIgnoreAudit.label.pathsChecked": "Paths checked",
+    "gitIgnoreAudit.label.ignoredPaths": "Ignored paths",
+    "gitIgnoreAudit.label.ignoreSources": "Ignore sources",
+    "gitIgnoreAudit.label.paths": "Paths",
+    "gitIgnoreAudit.label.findings": "Findings",
+    "gitIgnoreAudit.label.issues": "Issues",
+    "gitIgnoreAudit.clean": "No Git ignore audit findings detected.",
+    "gitIgnoreAudit.error.missingAction": "Specify a git-ignore-audit action: audit",
+    "gitIgnoreAudit.error.unknownAction": "Unknown git-ignore-audit action: {action}",
+    "gitIgnoreAudit.error.invalidPositiveInteger": "{option} must be a positive integer",
+    "manifestLockDrift.help.summary": "Check .mustflow/config/manifest.lock.toml entries against current file hashes without rewriting the lock.",
+    "manifestLockDrift.help.option.maxEntries": "Maximum lock entries to check. Default: 500",
+    "manifestLockDrift.help.exit.ok": "No manifest-lock drift was detected",
+    "manifestLockDrift.help.exit.fail": "Manifest-lock drift, invalid input, or unreadable lock metadata was detected",
+    "manifestLockDrift.title": "mustflow manifest-lock drift",
+    "manifestLockDrift.label.entriesChecked": "Entries checked",
+    "manifestLockDrift.label.hashMismatches": "Hash mismatches",
+    "manifestLockDrift.label.missingEntries": "Missing entries",
+    "manifestLockDrift.label.entries": "Entries",
+    "manifestLockDrift.label.findings": "Findings",
+    "manifestLockDrift.label.issues": "Issues",
+    "manifestLockDrift.clean": "No manifest-lock drift detected.",
+    "manifestLockDrift.error.missingAction": "Specify a manifest-lock-drift action: check",
+    "manifestLockDrift.error.unknownAction": "Unknown manifest-lock-drift action: {action}",
+    "manifestLockDrift.error.invalidPositiveInteger": "{option} must be a positive integer",
     "run.help.summary": "Run a configured oneshot command from .mustflow/config/commands.toml.",
     "run.help.option.dryRun": "Print a non-executing command plan",
     "run.help.option.planOnly": "Alias for --dry-run",