novahiz 0.5.2 → 0.7.0

package/CHANGELOG.md

@@ -5,6 +5,93 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-10-08
+
+Feature release: the Obsidian vault becomes a first-class citizen of the
+workflow, and the install ships a self-sufficient runtime — the MCP trio is
+wired statically, the docs index is seeded, and the LSP section is declared.
+
+### Added
+
+- **Vault auto-consult**: the plugin reads the `second-memory` vault during
+  session setup (`memory.auto.vault`), so decisions and next steps from the
+  vault reach the model without a manual read. `instructions.md` now states
+  the Obsidian/second-memory consultation rules (T2, T3).
+- **`novahiz docs` command** (`src/commands/docs.ts`): `status` reports the
+  local documentation index per library, `ingest <id>|--all [--dry]` fills it
+  over the network. Backed by new CLI modes on the docs MCP itself
+  (`node mcp/novahiz-docs/index.mjs --ingest … | --status`) — `src/ingest.ts`
+  finally has an entry point (D1).
+- **Docs index seed at install**: the installer fills the core bouquet
+  (react, nextjs, typescript, nodejs, tailwindcss, dart, flutter, expo) in a
+  non-blocking step; offline installs still succeed and the fill command stays
+  available. `read_docs` now names the command when a library is unindexed.
+- **`novahiz second-memory search`** (T1) and **`doctor --apply` regenerates a
+  drifted `STRUCTURE.md`** (T6, `structureDrift`).
+- **`stitchConfigured()`**: `novahiz init` recommends `novahiz stitch` only
+  when the API key is absent (T5); new `src/commands/stitch.ts`.
+- **`novahiz upgrade`** command and the `/novahiz-upgrade` in-session command
+  (`src/commands/upgrade.ts`, `adapters/opencode/commands/novahiz-upgrade.md`).
+- **Installer UI**: dedicated `install/ui.mjs` (+ `.d.mts`), plain/ASCII banner,
+  step layout — `tests/installer-ui.test.ts`.
+- **Obsidian vault step (10/10)**: the installer creates the `second-memory`
+  vault structure and its ten community plugins when missing (T7).
+
+### Fixed
+
+- **MCP trio wired statically (D2)**: `novahiz-core`, `novahiz-gate` and
+  `novahiz-scan` are written into the generated `opencode.jsonc`, and the
+  plugin transform registers them *before* the awaited `providers --mcp-json`
+  spawn — a transform landing after MCP resolution never binds servers (audit
+  2026-10-08: no connection, no warning). The trio now connects on install;
+  the plugin skips ids already present, so no duplicates.
+- **Plugin renamed `novahiz` → `novahiz-workflow`** (descriptive id in the
+  image of `novahiz-token-economy`), and the live plugin copy is resynced from
+  the source on install — the running session no longer lags the repo.
+- **Gate tests are hermetic to `NOVAHIZ_GATE`**: an operator running
+  `novahiz gate off` no longer turns two MCP gate tests red — child processes
+  get a sanitized environment.
+- **`tsconfig.build.json` restored**: `npm run prepare` referenced a file that
+  was missing from the working copy.
+
+### Changed
+
+- **LSP declared**: the live opencode config carries an `lsp` object with five
+  servers verified present on the machine (dart, typescript, bash, yaml, json);
+  the generated config writes `lsp: true` (portable — no dead entries on user
+  machines). Verified against OpenCode v2.0.24: the config is accepted and
+  preserved (`config.get` echoes it), but V2 has no LSP runtime yet — no server
+  is started until upstream ships one.
+
+## [0.6.0] - 2026-10-06
+
+Feature release: the gate learns project scope, and Stitch design projects
+get a capture → composite → fidelity-verdict loop.
+
+### Added
+
+- **`R16-stitch-fidelity` gate rule**: editing a UI file (`*.tsx`, `*.jsx`,
+  `*.vue`, `*.svelte`, `*.dart`, `*.css`, `*.scss`, `*.html`) now requires
+  the `novahiz-stitch-fidelity` skill — but only inside a project that
+  carries `stitch/**` references. This is the new `projectGlobs` selector
+  (`src/spec.ts`, `src/gate.ts`): nearest ancestor of the edited file
+  holding `.git`, `package.json` or `pubspec.yaml`, globs written from that
+  root. Projects without Stitch references are unaffected.
+- **`novahiz-stitch-fidelity` skill**: `scripts/stitch_capture.mjs` (adb:
+  uiautomator dump, screencap, input, adb.autoStart), `scripts/stitch_composite.mjs`
+  (screenshot ↔ design overlay), the fidelity judgment grid, capture
+  recipes and a `verify.config.defaults.json`.
+- **`stitch-fidelity` provider** (`kind: commands`): adb prerequisite with
+  per-OS bootstrap (winget / brew / apt), categories `design-ui`, `expo`,
+  `flutter`; `stitch_capture.mjs --check` reports the seven readiness items.
+- Optional `stitch-verify` roadmap step (`kind: verify`) in two roadmaps.
+- Tests: `tests/gate-stitch-fidelity.test.ts` — project-scoped enforcement.
+
+### Changed
+
+- README headline and counts refreshed: 99 skills, 13 gate rules, 8 MCP
+  providers, version line at 0.6.0 (was advertising 96/11/7 and 0.4.1).
+
 ## [0.5.2] - 2026-10-05
 
 Maintenance release closing the three leftovers traced right after `0.5.1`:

package/README.md

@@ -2,9 +2,9 @@
 
 > **Couche d'application sans dépendance pour les agents de code IA** — classe les prompts, attribue des roadmaps d'exécution, bloque les éditions non sûres tant que les bonnes skills ne sont pas chargées, et persiste les décisions d'une session à l'autre — tout cela de façon déterministe, sans appel de modèle.
 
-17 catégories, 96 skills, 11 gate rules, 7 MCP providers — tout déterministe, tout local, tout JSON.
+17 catégories, 99 skills, 13 gate rules, 8 MCP providers — tout déterministe, tout local, tout JSON.
 
-> **Version 0.4.1** — publiée sur npm (`npm install -g --allow-scripts=novahiz novahiz` installe et configure tout : core, plugin, agent, skills packs et Playwright MCP). `CHANGELOG.md` et `scripts/` sont dans le tarball.
+> **Version 0.6.0** — publiée sur npm (`npm install -g --allow-scripts=novahiz novahiz` installe et configure tout : core, plugin, agent, skills packs et Playwright MCP). `CHANGELOG.md` et `scripts/` sont dans le tarball.
 
 ```
 ┌──────────────────────────────────────────────────────────────────────────┐
@@ -35,7 +35,7 @@
                  └─ tier, skills ──────│         └─ block : charger les skills nommées, retry une fois
 ```
 
-**17 catégories**, **96 skills**, **11 gate rules**, **7 MCP providers** — tout déterministe, tout local, tout JSON.
+**17 catégories**, **99 skills**, **13 gate rules**, **8 MCP providers** — tout déterministe, tout local, tout JSON.
 
 ---
 
@@ -310,7 +310,7 @@ Deux pièces complémentaires : la session consomme moins sans perdre en puissan
 
 ## Skills installées
 
-Novahiz livre 98 skills couvrant toutes les catégories :
+Novahiz livre 99 skills couvrant toutes les catégories :
 
 | Catégorie | Skills | Objectif |
 |-----------|--------|----------|

package/adapters/opencode/commands/novahiz-upgrade.md

@@ -0,0 +1,13 @@
+---
+description: Check for a new Novahiz version and update it via npm. Arguments: $ARGUMENTS
+---
+
+1. Run the version check. Prefer the global CLI when available: `novahiz upgrade`. If `novahiz` is not on PATH, locate the Novahiz home (`NOVAHIZ_HOME` if set, otherwise `~/.config/novahiz`) and run `node src/cli.ts upgrade` from there.
+
+2. If the output reports "up to date", confirm it in one sentence and stop.
+
+3. If an update is available, report the installed -> latest versions, then ask the user for explicit approval. Never run the update without that approval (skip this confirmation only when `$ARGUMENTS` contains `--yes`).
+
+4. After approval, run `novahiz upgrade --apply` (same CLI used in step 1). This runs `npm install -g novahiz@latest` for npm installs, or `git pull --ff-only` plus a catalog rebuild for source checkouts. Report the exact result, including any npm/git error verbatim — never claim success you did not observe.
+
+5. Finish by telling the user to restart OpenCode completely so the new version loads. Offer `novahiz doctor` as the follow-up check.

package/adapters/opencode/instructions.md

@@ -1,17 +1,29 @@
 # System Instructions
 
-## Obsidian Memory
+## Obsidian Memory — the `second-memory` vault
 
-Obsidian (`C:\Users\hiz\Documents\Novahiz`) is the user's second memory.
+The system's official vault is **`~/Documents/second-memory`** (`NOVAHIZ_SM_VAULT` overrides it for tests). It is created by the installer together with the plugins and skills: it is part of Novahiz itself, not an optional add-on. The old `~/Documents/Novahiz` path does not exist — never reference it.
+
+### Automatic consultation (already done for you)
+The plugin auto-consults the vault (`memory.auto.vault`, enabled by default): every `every` prompts (default 3) it runs `novahiz second-memory search <prompt head> --k=3 --min-score=0.25 --json` and injects the top hits under `[Novahiz memory] vault second-memory auto-consulted`. Treat those hits as leads, not conclusions: open the referenced note with the read tool before relying on a snippet.
+
+### When to consult the vault proactively
+Search it yourself (`novahiz second-memory search "<terms>"`, then read the note) when:
+- the user asks what was decided or learned earlier (project, strategy, preference, decision);
+- you are about to redo work that has likely already happened (design, migration, analysis, troubleshooting);
+- the topic matches a vault domain (Trading, AI, Design, DevOps, Security, Business, Learning, Wiki, Projects, Journal);
+- the user says « dans ma mémoire », « dans le vault », « comme on avait décidé », "second memory";
+- an answer must survive this session.
+Do **not** consult it for trivial edits, unrelated questions, or when the prompt already carries the needed context.
 
 ### Rules
-1. When the user asks to **save / memorize / update obsidian memory**, load the `memory` skill (alias for `novahiz-memory`) and follow its procedure without exception.
-2. Determine the target folder **only** from the `Novahiz\_meta\routing.md` table (source of truth). Never guess. When ambiguous, ask the user.
-3. Display the chosen path before writing.
-4. Never write to `index.md`, `log.md`, `hot.md`, `.manifest.json`, `_meta/`, or `.obsidian/`. No installed skill covers maintenance of those files: if the user asks for it, do it step by step in front of them, with a backup first for anything under `.obsidian/`. The `memory` skill writes only to the targeted content page.
-5. Never create a root folder on your own. Every new category requires user agreement and an update to `routing.md`.
-6. Include mandatory frontmatter: `title, category, tags, sources, created, updated, summary`. Use tags from `_meta/taxonomy.md`.
-7. Link pages with `[[wikilinks]]`. Merge rather than duplicate.
+1. When the user asks to **save / memorize / update** memory, load the `memory` skill (alias for `novahiz-memory`) and follow its procedure without exception. For vault-only writes and structure questions, load `novahiz-second-memory` instead: it owns the vault's fixed, predefined arborescence.
+2. Vault routing comes from the predefined structure (`catalog/vault-structure.json`, surfaced by the `novahiz-second-memory` skill) — never guess a location. When ambiguous, ask the user, and display the chosen path before writing.
+3. Search before you write: `novahiz second-memory search "<terms>"` — merge into an existing note rather than creating a duplicate. Link pages with `[[wikilinks]]`.
+4. Never write to `index.md`, `log.md`, `hot.md`, `.manifest.json`, `_meta/`, or `.obsidian/`. If the user asks for it, do it step by step in front of them, with a backup first for anything under `.obsidian/`.
+5. Never create a root domain on your own: every new domain requires user agreement and a structure update.
+6. Include mandatory frontmatter: `title, category, tags, sources, created, updated, summary`.
+7. Structure maintenance is CLI work: `novahiz second-memory [init|doctor|fix|sync|status]` (dry-run by default, `--apply` to write).
 
 ## Playwright Browser — Persistent Profile
 

package/adapters/opencode/novahiz-plugin.ts

@@ -397,10 +397,23 @@ type MemoryAutoReadConfig = {
   // sessions precedentes + resumes de pertinence compris. Defaut 1500.
   budgetTokens: number;
 };
+// V-AUTO: consultation automatique du vault second-memory (vault Obsidian
+// officiel du systeme, cree a l'installation). every = cadence en occurrences
+// de prompt (1 = chaque prompt, defaut 3 = "de temps en temps"), budgetTokens
+// = plafond d'injection du bloc vault (~4 chars/token). Miroir de
+// MemoryAutoVaultConfig dans src/spec.ts.
+type MemoryAutoVaultConfig = {
+  enabled: boolean;
+  k: number;
+  minScore: number;
+  every: number;
+  budgetTokens: number;
+};
 type MemoryAutoConfig = {
   enabled: boolean;
   write: MemoryAutoWriteConfig;
   read: MemoryAutoReadConfig;
+  vault: MemoryAutoVaultConfig;
 };
 type NovahizConfig = { gate?: GateConfig; memory?: unknown };
 
@@ -442,7 +455,18 @@ export function resolveMemoryAuto(raw: unknown, envValue: string | undefined): M
     postCompaction: bool(readRaw.postCompaction, true),
     budgetTokens: inRange(readRaw.budgetTokens, 100, 4000) ? Math.trunc(readRaw.budgetTokens) : 1500
   };
-  return { enabled: true, write, read };
+  // V-AUTO: vault second-memory — defauts full-on aussi (actif partout par
+  // defaut, comme write/read), kill-switch partage NOVAHIZ_MEM_AUTO + reset
+  // local memory.auto.vault.enabled=false. Miroir de src/spec.ts.
+  const vaultRaw = auto.vault && typeof auto.vault === "object" ? (auto.vault as Record<string, unknown>) : {};
+  const vault: MemoryAutoVaultConfig = {
+    enabled: bool(vaultRaw.enabled, true),
+    k: inRange(vaultRaw.k, 1, 10) ? Math.trunc(vaultRaw.k) : 3,
+    minScore: inRange(vaultRaw.minScore, 0, 1) ? vaultRaw.minScore : 0.25,
+    every: inRange(vaultRaw.every, 1, 100) ? Math.trunc(vaultRaw.every) : 3,
+    budgetTokens: inRange(vaultRaw.budgetTokens, 100, 2000) ? Math.trunc(vaultRaw.budgetTokens) : 600
+  };
+  return { enabled: true, write, read, vault };
 }
 
 function readConfig(): NovahizConfig {
@@ -826,6 +850,39 @@ export function mergeSummaryWindow(
   return { ids, details };
 }
 
+// V-AUTO: vault officiel du systeme — cree par l'installateur a
+// `~/Documents/second-memory` (NOVAHIZ_SM_VAULT pour tests/overrides).
+export const VAULT_ROOT: string =
+  process.env.NOVAHIZ_SM_VAULT && process.env.NOVAHIZ_SM_VAULT.trim().length > 0
+    ? process.env.NOVAHIZ_SM_VAULT
+    : join(homedir(), "Documents", "second-memory");
+
+type VaultHitLike = { rel?: unknown; title?: unknown; score?: unknown; snippet?: unknown };
+
+// V-AUTO: formatage des hits `second-memory search --json` en lignes
+// d'injection (une ligne chemin+titre+score, une ligne extrait tronque),
+// filtres k / minScore. Exporte tel quel pour les tests (pure function).
+export function buildVaultLines(
+  hits: readonly VaultHitLike[],
+  cfg: MemoryAutoVaultConfig
+): { injectedRels: string[]; details: string[] } {
+  const injectedRels: string[] = [];
+  const details: string[] = [];
+  for (const hit of hits) {
+    if (injectedRels.length >= cfg.k) break;
+    if (!hit || typeof hit.rel !== "string" || hit.rel.length === 0) continue;
+    if (typeof hit.score === "number" && hit.score < cfg.minScore) continue;
+    const title = typeof hit.title === "string" && hit.title.length > 0 ? hit.title : hit.rel;
+    const score = typeof hit.score === "number" ? hit.score.toFixed(2) : "-";
+    injectedRels.push(hit.rel);
+    details.push(`- ${hit.rel} [${score}] — ${title}`);
+    if (typeof hit.snippet === "string" && hit.snippet.trim().length > 0) {
+      details.push(`  ${hit.snippet.replace(/\s+/g, " ").trim().slice(0, 220)}`);
+    }
+  }
+  return { injectedRels, details };
+}
+
 // --- P3: heritage inter-sessions (injection au demarrage) -----------------
 // L'index porte id/title/updated/status/tags (SlotMeta, src/memory.ts); le
 // plugin installe ne resout pas ../../src/*, donc le type est re-declare ici.
@@ -1047,6 +1104,10 @@ async function setup(ctx: Context): Promise<Cleanup> {
   // chaque prompt, chunk de resumes courant (remplacement post-compaction)
   // et cles de directive T3 deja posees.
   const autoReadBySession = new Map<string, { ids: string[]; details: string[] }>();
+  // V-AUTO: fenetre de notes vault re-injectee entre deux consultations, et
+  // compteur de prompts pour la cadence memory.auto.vault.every.
+  const vaultWindowBySession = new Map<string, { rels: string[]; details: string[] }>();
+  const vaultCountBySession = new Map<string, number>();
   const lastPromptBySession = new Map<string, string>();
   const directivesBySession = new Map<string, string[]>();
   const summaryChunkBySession = new Map<string, string[]>();
@@ -1261,21 +1322,81 @@ async function setup(ctx: Context): Promise<Cleanup> {
     }
   };
 
-  // V1 `config` hook → MCP transform. The CLI is queried first: transform
-  // callbacks must stay synchronous and free of one-time side effects.
-  if (!DISABLED) {
+  // V-AUTO: consultation automatique du vault second-memory. Aller simple via
+  // la CLI (`second-memory search --json`) : le plugin installe ne peut pas
+  // importer src/*, donc le ranking reel est celui de la CLI — une seule
+  // source de verite pour l'agent et pour l'injection. Cadence every (defaut
+  // 3) : le 1er prompt consulte toujours, la fenetre est re-emise entre deux
+  // consultations pour que les notes restent dans le contexte.
+  const buildVaultRead = async (
+    sessionID: string,
+    query: string
+  ): Promise<{ lines: string[]; newCount: number }> => {
+    if (!MEMORY_AUTO || !MEMORY_AUTO.vault.enabled) return { lines: [], newCount: 0 };
     try {
-      const providers = await run(["providers", "--mcp-json"]);
-      const entries: Record<string, unknown> = {};
-      if (providers.status === 0 && providers.stdout.trim().length > 0) {
-        try {
-          Object.assign(entries, JSON.parse(providers.stdout) as Record<string, unknown>);
-        } catch {
-          await log("warn", "Providers returned invalid JSON, MCP auto-register skipped");
+      let state = vaultWindowBySession.get(sessionID) ?? { rels: [], details: [] };
+      let newCount = 0;
+      const n = (vaultCountBySession.get(sessionID) ?? 0) + 1;
+      vaultCountBySession.set(sessionID, n);
+      if ((n - 1) % MEMORY_AUTO.vault.every === 0) {
+        if (!existsSync(VAULT_ROOT)) {
+          if (n === 1) void log("info", `vault auto-consult skipped: ${VAULT_ROOT} absent`);
+        } else {
+          const call = await run([
+            "second-memory",
+            "search",
+            autoReadQuery(query, 24),
+            `--k=${MEMORY_AUTO.vault.k}`,
+            `--min-score=${MEMORY_AUTO.vault.minScore}`,
+            "--json"
+          ]);
+          if (call.status !== 0 || call.stdout.trim().length === 0) {
+            void log("info", `vault auto-consult failed: ${call.stderr.slice(0, 200) || `exit ${call.status}`}`);
+          } else {
+            try {
+              const parsed = JSON.parse(call.stdout) as { hits?: unknown };
+              const hits = Array.isArray(parsed.hits) ? (parsed.hits as VaultHitLike[]) : [];
+              const fresh = buildVaultLines(hits, MEMORY_AUTO.vault);
+              if (fresh.injectedRels.length > 0) {
+                newCount = fresh.injectedRels.length;
+                state = { rels: fresh.injectedRels, details: fresh.details };
+              } else {
+                void log(
+                  "info",
+                  `vault auto-consult: ${hits.length} hit(s), 0 injected (minScore ${MEMORY_AUTO.vault.minScore})`
+                );
+              }
+            } catch {
+              void log("info", "vault auto-consult: invalid JSON from second-memory search");
+            }
+          }
         }
-      } else if (providers.status !== 0) {
-        await log("warn", `Providers command failed (exit ${providers.status}), MCP auto-register skipped`);
       }
+      if (state.rels.length === 0) return { lines: [], newCount };
+      vaultWindowBySession.set(sessionID, state);
+      const kept = applyInjectionBudget(state.details, MEMORY_AUTO.vault.budgetTokens * 4);
+      const lines = [
+        `[Novahiz memory] vault second-memory auto-consulted (${state.rels.length}/${MEMORY_AUTO.vault.k}):`,
+        ...kept,
+        `Vault: ${VAULT_ROOT} — read a full note with the read tool on <vault>/<rel>; re-search: novahiz second-memory search "<terms>".`
+      ];
+      return { lines, newCount };
+    } catch (error) {
+      void log("info", `vault auto-consult failed: ${String(error).slice(0, 200)}`);
+      return { lines: [], newCount: 0 };
+    }
+  };
+
+  // V1 `config` hook → MCP transform. Audit 2026-10-08 : le transform partait
+  // APRES l'attente du spawn `providers --mcp-json` (~0,5-1s) et arrivait trop
+  // tard — aucun serveur lié, aucun avertissement au log. Le trio runtime part
+  // donc en premier, avant toute await ; le catalogue compose en second
+  // transform (les transforms se cumulent dans leur domaine). Les callbacks
+  // restent synchrones et sans effet de bord un seul. En pratique la config
+  // statique de l'installateur porte deja les entrees : editor.get(id) les
+  // saute, sans doublon.
+  if (!DISABLED) {
+    try {
       await ctx.mcp.transform((editor) => {
         // A server configured by the user wins over the catalog registration.
         // Audit 2026-09-25 (P2): novahiz-scan joined the hard-coded trio — when
@@ -1290,23 +1411,38 @@ async function setup(ctx: Context): Promise<Cleanup> {
         if (!editor.get("novahiz-scan")) {
           editor.set("novahiz-scan", { type: "local", command: [NODE, join(HOME, "mcp", "argus", "src", "cli.mjs")], timeout: MCP_TIMEOUT });
         }
-        for (const [id, raw] of Object.entries(entries)) {
-          if (editor.get(id)) continue;
-          const entry = raw as { type?: unknown; command?: unknown; url?: unknown; enabled?: unknown };
-          // V2 replaced `enabled` with `disabled`: an explicit `enabled: false`
-          // is carried across instead of silently flipping the server on.
-          const disabled = entry.enabled === false ? { disabled: true as const } : {};
-          if (entry.type === "remote" && typeof entry.url === "string") {
-            editor.set(id, { type: "remote", url: entry.url, timeout: MCP_TIMEOUT, ...disabled });
-          } else if (
-            entry.type === "local" &&
-            Array.isArray(entry.command) &&
-            entry.command.every((part) => typeof part === "string")
-          ) {
-            editor.set(id, { type: "local", command: entry.command as string[], timeout: MCP_TIMEOUT, ...disabled });
-          }
-        }
       });
+      const providers = await run(["providers", "--mcp-json"]);
+      const entries: Record<string, unknown> = {};
+      if (providers.status === 0 && providers.stdout.trim().length > 0) {
+        try {
+          Object.assign(entries, JSON.parse(providers.stdout) as Record<string, unknown>);
+        } catch {
+          await log("warn", "Providers returned invalid JSON, MCP auto-register skipped");
+        }
+      } else if (providers.status !== 0) {
+        await log("warn", `Providers command failed (exit ${providers.status}), MCP auto-register skipped`);
+      }
+      if (Object.keys(entries).length > 0) {
+        await ctx.mcp.transform((editor) => {
+          for (const [id, raw] of Object.entries(entries)) {
+            if (editor.get(id)) continue;
+            const entry = raw as { type?: unknown; command?: unknown; url?: unknown; enabled?: unknown };
+            // V2 replaced `enabled` with `disabled`: an explicit `enabled: false`
+            // is carried across instead of silently flipping the server on.
+            const disabled = entry.enabled === false ? { disabled: true as const } : {};
+            if (entry.type === "remote" && typeof entry.url === "string") {
+              editor.set(id, { type: "remote", url: entry.url, timeout: MCP_TIMEOUT, ...disabled });
+            } else if (
+              entry.type === "local" &&
+              Array.isArray(entry.command) &&
+              entry.command.every((part) => typeof part === "string")
+            ) {
+              editor.set(id, { type: "local", command: entry.command as string[], timeout: MCP_TIMEOUT, ...disabled });
+            }
+          }
+        });
+      }
     } catch (error) {
       await log("warn", `MCP registration failed: ${String(error).slice(0, 200)}`);
     }
@@ -1454,7 +1590,13 @@ async function setup(ctx: Context): Promise<Cleanup> {
         // chemin lecture a tourne, y compris quand il ressort vide.
         await log("info", `memory auto-read prompt: ${auto.lines.length} line(s), ${auto.newCount} new`);
         lines.push(...auto.lines);
-        summaryChunkBySession.set(sessionID, auto.lines);
+        // V-AUTO: bloc vault second-memory — meme contrat que les resumes :
+        // reconstruit a chaque prompt, fenetre persistante entre deux
+        // consultations, log inconditionnel pour prouver la consultation.
+        const vault = await buildVaultRead(sessionID, text);
+        await log("info", `vault auto-consult prompt: ${vault.lines.length} line(s), ${vault.newCount} new`);
+        lines.push(...vault.lines);
+        summaryChunkBySession.set(sessionID, [...auto.lines, ...vault.lines]);
         const directives = directivesBySession.get(sessionID) ?? [];
         lines.push(...directives);
       }
@@ -1712,5 +1854,5 @@ async function setup(ctx: Context): Promise<Cleanup> {
   return () => events.abort();
 }
 
-const novahizPlugin: Plugin = { id: "novahiz", setup };
+const novahizPlugin: Plugin = { id: "novahiz-workflow", setup };
 export default novahizPlugin;

package/catalog/categories.json

@@ -198,6 +198,13 @@
           "kind": "skill",
           "requireSkills": ["dart-add-unit-test"]
         },
+        {
+          "id": "stitch-verify",
+          "label": "Verify screens against Stitch references (projects carrying stitch/**)",
+          "kind": "verify",
+          "requireSkills": ["novahiz-stitch-fidelity"],
+          "optional": true
+        },
         {
           "id": "impeccable-critique",
           "label": "Impeccable critique (UI work)",
@@ -307,6 +314,13 @@
           "kind": "edit",
           "requireSkills": ["novahiz-implement"]
         },
+        {
+          "id": "stitch-verify",
+          "label": "Verify screens against Stitch references (projects carrying stitch/**)",
+          "kind": "verify",
+          "requireSkills": ["novahiz-stitch-fidelity"],
+          "optional": true
+        },
         {
           "id": "converge",
           "label": "Converge",

package/catalog/providers.json

@@ -108,6 +108,31 @@
     "categories": ["audit"],
     "purpose": "Local stdio static-analysis server (zero npm dependency): scans files and directories with local security rules (SQL injection, XSS, command injection, hardcoded secrets, insecure deserialization), creates custom rules behind a ReDoS gate, exports json/sarif/csv/html. Original clean-room implementation for the audit category."
   },
+  {
+    "id": "stitch-fidelity",
+    "label": "Stitch fidelity capture (adb + Android emulator)",
+    "kind": "commands",
+    "requires": ["adb"],
+    "bootstrap": {
+      "win32": [
+        "winget install --id Google.PlatformTools",
+        "winget install --id Google.AndroidStudio"
+      ],
+      "darwin": [
+        "brew install --cask android-platform-tools",
+        "brew install --cask android-commandlinetools"
+      ],
+      "linux": [
+        "sudo apt-get install -y adb",
+        "sudo apt-get install -y android-sdk"
+      ],
+      "default": ["install Android platform-tools (adb) and the Android emulator on PATH"]
+    },
+    "source": "https://github.com/novahiz/novahiz",
+    "license": "Apache-2.0",
+    "categories": ["design-ui", "expo", "flutter"],
+    "purpose": "Prerequisite for skill novahiz-stitch-fidelity: `adb` drives the capture (uiautomator dump, screencap, input). `emulator` is only needed to auto-start a device when nothing is online (adb.autoStart); `stitch_capture.mjs --check` reports all seven readiness items."
+  },
   {
     "id": "novahiz-gate",
     "label": "novahiz-gate",

package/catalog/rules.json

@@ -156,5 +156,24 @@
       ]
     },
     "require": ["token-economy"]
+  },
+  {
+    "id": "R16-stitch-fidelity",
+    "description": "Load novahiz-stitch-fidelity before editing the UI of a project that carries Stitch references (stitch/**): capture, composite and fidelity verdict must be part of that loop.",
+    "when": {
+      "match": "all",
+      "pathGlobs": [
+        "**/*.tsx",
+        "**/*.jsx",
+        "**/*.vue",
+        "**/*.svelte",
+        "**/*.dart",
+        "**/*.css",
+        "**/*.scss",
+        "**/*.html"
+      ],
+      "projectGlobs": ["stitch/**"]
+    },
+    "require": ["novahiz-stitch-fidelity"]
   }
 ]