opencode-agent-skill 13.0.0-beta.2 → 14.4.0

package/pi/prompts/ues-audit.md

@@ -0,0 +1,9 @@
+---
+description: Audit a codebase or change for correctness, security, integration and verification gaps.
+---
+
+Audit this scope: $@
+
+Use targeted repository evidence before conclusions. Prefer a fresh `ues-reviewer`, and use domain skills for auth, payment, database, API, browser or deployment boundaries when applicable. Distinguish confirmed defects from risks that require more evidence.
+
+Report findings by severity with file/location, impact, evidence, and a concrete verification/fix direction. Do not make edits unless the user asks for them.

package/pi/prompts/ues-critique.md

@@ -0,0 +1,9 @@
+---
+description: Challenge a proposed implementation or plan for hidden assumptions, failure modes and missing evidence.
+---
+
+Critique this proposal or implementation: $@
+
+Use `ues_dispatch` with `ues-critic` for independent fresh context when useful. Look for incorrect assumptions, missing dependencies, unsafe ordering, inadequate rollback, weak acceptance criteria, test gaps, and unnecessary complexity. Ground each objection in concrete repository or requirement evidence.
+
+Do not turn critique into an implementation unless asked.

package/pi/prompts/ues-debug.md

@@ -0,0 +1,9 @@
+---
+description: Diagnose a failure from reproducible evidence before applying a bounded fix.
+---
+
+Debug this problem: $@
+
+Reproduce or capture the exact failure first. Use `ues_cli` for deterministic repo/test evidence and `ues_dispatch` with `ues-debugger` when fresh context helps. Trace where the state/value first becomes wrong, test one causal hypothesis at a time, and avoid speculative patch stacking.
+
+If a code change is requested, make the smallest supported fix and verify the original failure plus affected checks. Preserve unrelated user changes.

package/pi/prompts/ues-feature.md

@@ -0,0 +1,9 @@
+---
+description: Implement a feature through adaptive UES planning, bounded edits and evidence-backed verification.
+---
+
+Implement this feature: $@
+
+Use the same adaptive admission rules as `/ues-run`. Determine scope with `ues_cli task-policy`; avoid durable state for small work and use `.ues-work/<slug>/` for long/high-risk work. For complex changes, use a fresh `ues-architect` or `ues-plan-checker` before implementation, then `ues-executor` and `ues-verifier`.
+
+Keep changes file-aware and dependency-aware, preserve existing contracts unless the requirement changes them, and finish with fresh tests plus final diff/status evidence.

package/pi/prompts/ues-fix.md

@@ -0,0 +1,9 @@
+---
+description: Fix a verified bug with UES diagnosis, bounded implementation and fresh verification.
+---
+
+Fix this problem: $@
+
+First establish the failure and root-cause evidence. For non-trivial bugs, use `ues_dispatch` as a chain: `ues-debugger` to diagnose, `ues-executor` to implement the smallest supported fix, then `ues-verifier` to independently verify. Pass prior output with `{previous}` where useful.
+
+Do not stack speculative fixes. Preserve unrelated changes. Run the exact failing check again and then affected checks. Do not push, publish, deploy or perform destructive operations without explicit approval.

package/pi/prompts/ues-plan.md

@@ -0,0 +1,9 @@
+---
+description: Produce an implementation-ready UES plan on Pi without editing code.
+---
+
+Plan this engineering task without editing files: $@
+
+Inspect repository instructions, relevant entry points, interfaces, callers, tests, nearest working analogues, and constraints. Use `ues_cli` for deterministic repository/evidence commands when useful. For a complex plan, use `ues_dispatch` with `ues-architect` and optionally `ues-plan-checker`.
+
+Define observable acceptance criteria, blast radius, ordered implementation steps, dependencies, file/resource scopes, rollback or compatibility concerns, and verification for each risky boundary. Call out unresolved decisions rather than inventing them.

package/pi/prompts/ues-research.md

@@ -0,0 +1,9 @@
+---
+description: Research an engineering question with source verification and repository-aware synthesis.
+---
+
+Research this engineering question: $@
+
+Use repository evidence for project-specific claims and authoritative current sources when external facts may have changed. A fresh `ues-researcher` may be used through `ues_dispatch` to keep exploration out of the main context.
+
+Separate verified facts, assumptions, and unresolved questions. Return only findings relevant to the requested decision or implementation.

package/pi/prompts/ues-resume.md

@@ -0,0 +1,9 @@
+---
+description: Resume an interrupted durable UES work item on Pi from filesystem and Git evidence.
+---
+
+Resume this UES work item: $@
+
+Treat only `.ues-work/<slug>/` as canonical durable UES state. Read SPEC, PLAN, STATE, EVIDENCE, task reports and current Git status. Use `ues_cli` with `["work","resume","<slug>","."]` (and `work recover` when needed) before deciding the next dependency-safe action.
+
+Trust durable state and current repository evidence over conversational recollection. Do not repeat completed tasks unless fresh evidence invalidates them. Use `ues_dispatch` for fresh executor/verifier context. Parallel writers require distinct isolated cwd/worktrees. After all tasks complete, use a fresh `ues-integration-verifier`, record the integration result through `ues_cli`, and finalize only after PASS with an unchanged workspace fingerprint.

package/pi/prompts/ues-review.md

@@ -0,0 +1,7 @@
+---
+description: Review code changes for correctness, regressions, safety and missing verification using a fresh UES reviewer.
+---
+
+Review this change or repository scope: $@
+
+Inspect the current diff and affected call paths. Use `ues_dispatch` with `ues-reviewer` for fresh context when useful. Prioritize concrete correctness bugs, regressions, security boundaries, data loss risks, race conditions, broken contracts, and missing tests. Ground findings in repository evidence and include exact files/locations. Do not invent issues to fill a checklist.

package/pi/prompts/ues-run.md

@@ -0,0 +1,17 @@
+---
+description: Execute engineering work through the deterministic UES runtime controller on Pi, with adaptive context, model routing, retries, and evidence-gated verification.
+---
+
+Run this task with UES on Pi: $@
+
+Preserve the user's requested outcome and approval boundaries.
+
+1. If the request is directly answerable and needs no repository evidence, edits, or machine-checkable verification, answer directly.
+2. Otherwise prefer the `ues_execute` tool for end-to-end engineering work. Pass a concise but complete task and the current repository cwd. The controller owns task policy, bounded context construction, model-tier routing, optional diagnosis/plan gating, implementation, retries, independent verification, integration verification, and performance telemetry.
+3. Do not manually reproduce the controller workflow unless `ues_execute` is unavailable or the user explicitly asks for plan-only/review-only/research-only work.
+4. Use `ues_cli` for deterministic inspection, durable `.ues-work/` state, task graphs, receipts, evidence, worktrees, browser/visual helpers, and explicit policy/config operations.
+5. Use `ues_dispatch` when you intentionally need one specialist, a custom chain, or bounded parallel read-only work. Routed dispatch automatically applies model policy and adaptive context.
+6. Parallel read-only agents may share the repository. Parallel writer agents must use explicit distinct isolated cwd/worktrees; otherwise run writers serially. Never bypass this guard.
+7. Preserve unrelated user changes. Do not force-clean a repository.
+8. Do not merge, push, publish, deploy, rewrite history, or perform destructive operations without explicit user approval.
+9. Final completion claims must come from a verified controller PASS or equivalent fresh command/test evidence plus the final diff/status.

package/pi/prompts/ues-verify.md

@@ -0,0 +1,9 @@
+---
+description: Verify requested behavior with fresh evidence and no unsupported completion claims.
+---
+
+Verify this engineering work: $@
+
+Start from the acceptance criteria and the actual current diff/status. Prefer the narrowest project-native checks that prove the claim, then expand according to blast radius. Use `ues_cli` for deterministic UES evidence/receipt commands and `ues_dispatch` with `ues-verifier` or `ues-integration-verifier` for independent fresh context.
+
+Do not edit merely to make verification pass unless the user asked for a fix. Report failed checks, skipped checks, unresolved gaps, and exactly what the evidence proves.

package/scripts/check-release-consistency.mjs

@@ -8,236 +8,170 @@ const DEFAULT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)),
 
 function readJson(root, relative) {
   const file = path.join(root, relative)
-  if (!existsSync(file)) {
-    return { ok: false, error: `${relative}: file not found`, value: null }
-  }
+  if (!existsSync(file)) return { ok: false, error: `${relative}: file not found`, value: null }
   try {
     return { ok: true, error: null, value: JSON.parse(readFileSync(file, "utf8")) }
-  } catch (e) {
-    return { ok: false, error: `${relative}: invalid JSON (${e.message})`, value: null }
+  } catch (error) {
+    return {
+      ok: false,
+      error: `${relative}: invalid JSON (${error instanceof Error ? error.message : String(error)})`,
+      value: null,
+    }
   }
 }
 
 function readText(root, relative) {
   const file = path.join(root, relative)
-  if (!existsSync(file)) {
-    return { ok: false, error: `${relative}: file not found`, value: null }
-  }
+  if (!existsSync(file)) return { ok: false, error: `${relative}: file not found`, value: null }
   return { ok: true, error: null, value: readFileSync(file, "utf8") }
 }
 
-function countSkillDirs(root) {
-  const fullPath = path.join(root, "global-config", "skills")
-  if (!existsSync(fullPath)) return { ok: false, error: "global-config/skills: directory not found", value: 0 }
-  const entries = readdirSync(fullPath, { withFileTypes: true })
-  const count = entries.filter((entry) => entry.isDirectory() && existsSync(path.join(fullPath, entry.name, "SKILL.md"))).length
-  return { ok: true, error: null, value: count }
+function countDir(root, relative, predicate) {
+  const dir = path.join(root, relative)
+  if (!existsSync(dir)) return { ok: false, error: `${relative}: directory not found`, value: 0 }
+  const entries = readdirSync(dir, { withFileTypes: true })
+  return {
+    ok: true,
+    error: null,
+    value: predicate ? entries.filter(predicate).length : entries.length,
+  }
 }
 
-function countDir(root, dirPath, filter) {
-  const fullPath = path.join(root, dirPath)
-  if (!existsSync(fullPath)) {
-    return { ok: false, error: `${dirPath}: directory not found`, value: 0 }
-  }
-  const entries = readdirSync(fullPath, { withFileTypes: true })
-  const count = filter ? entries.filter(filter).length : entries.length
-  return { ok: true, error: null, value: count }
+function countSkills(root) {
+  return countDir(root, path.join("global-config", "skills"), (entry) =>
+    entry.isDirectory() && existsSync(path.join(root, "global-config", "skills", entry.name, "SKILL.md"))
+  )
+}
+
+function requireText(errors, result, relative) {
+  if (result.ok) return result.value
+  errors.push(result.error || `${relative}: unavailable`)
+  return ""
 }
 
-export function checkReleaseConsistency(root) {
-  root = root || DEFAULT_ROOT
+export function checkReleaseConsistency(root = DEFAULT_ROOT) {
   const errors = []
   const warnings = []
 
-  function rJson(relative) {
-    return readJson(root, relative)
-  }
-  function rText(relative) {
-    return readText(root, relative)
+  const pkgResult = readJson(root, "package.json")
+  const lockResult = readJson(root, "package-lock.json")
+  const pkg = pkgResult.ok ? pkgResult.value : null
+  const lock = lockResult.ok ? lockResult.value : null
+  if (!pkgResult.ok) errors.push(pkgResult.error)
+  if (!lockResult.ok) errors.push(lockResult.error)
+
+  const version = pkg?.version || "unknown"
+  if (pkg && lock && pkg.version !== lock.version) {
+    errors.push(`package.json version (${pkg.version}) != package-lock.json version (${lock.version})`)
   }
-  function rCount(dirPath, filter) {
-    return countDir(root, dirPath, filter)
+  if (pkg && lock?.packages?.[""]?.version && pkg.version !== lock.packages[""].version) {
+    errors.push(`package-lock root package version (${lock.packages[""].version}) != package.json version (${pkg.version})`)
   }
 
-  // 1. package.json version == package-lock.json version
-  const pkg = rJson("package.json")
-  const lock = rJson("package-lock.json")
-  if (pkg.ok && lock.ok) {
-    const pkgVersion = pkg.value.version
-    const lockVersion = lock.value.version
-    if (pkgVersion !== lockVersion) {
-      errors.push(`package.json version (${pkgVersion}) != package-lock.json version (${lockVersion})`)
+  const expectedBins = { ues: "bin/ocskill.mjs", ocskill: "bin/ocskill.mjs" }
+  if (pkg) {
+    for (const [name, target] of Object.entries(expectedBins)) {
+      if (pkg.bin?.[name] !== target) errors.push(`package.json: bin.${name} must be ${target}`)
+      if (lock?.packages?.[""]?.bin?.[name] !== target) {
+        errors.push(`package-lock.json: root bin.${name} must be ${target}`)
+      }
     }
-  } else {
-    if (!pkg.ok) errors.push(pkg.error)
-    if (!lock.ok) errors.push(lock.error)
   }
 
-  // 2. Count skills, commands, subagents
-  const skillRes = countSkillDirs(root)
-  const commandRes = rCount("global-config/commands", (e) => e.isFile() && e.name.endsWith(".md"))
-  const agentRes = rCount("global-config/agents", (e) => e.isFile() && e.name.endsWith(".md"))
-  const skillCount = skillRes.ok ? skillRes.value : 0
-  const commandCount = commandRes.ok ? commandRes.value : 0
-  const agentCount = agentRes.ok ? agentRes.value : 0
-  if (!skillRes.ok) errors.push(skillRes.error)
-  if (!commandRes.ok) errors.push(commandRes.error)
-  if (!agentRes.ok) errors.push(agentRes.error)
+  const skillResult = countSkills(root)
+  const commandResult = countDir(root, path.join("global-config", "commands"), (entry) => entry.isFile() && entry.name.endsWith(".md"))
+  const agentResult = countDir(root, path.join("global-config", "agents"), (entry) => entry.isFile() && entry.name.endsWith(".md"))
+  const promptResult = countDir(root, path.join("pi", "prompts"), (entry) => entry.isFile() && entry.name.endsWith(".md"))
+  for (const result of [skillResult, commandResult, agentResult, promptResult]) {
+    if (!result.ok) errors.push(result.error)
+  }
+  const skillCount = skillResult.value || 0
+  const commandCount = commandResult.value || 0
+  const subagentCount = agentResult.value || 0
+  const promptCount = promptResult.value || 0
 
-  const expectedVersion = pkg.ok ? pkg.value.version : "unknown"
-  const routing = rJson("evals/routing.json")
-  const routerTriggers = rJson("evals/router-triggers.json")
-  const staticScenarioCount = routing.ok && Array.isArray(routing.value.scenarios) ? routing.value.scenarios.length : 0
-  const routerCaseCount = routerTriggers.ok && Array.isArray(routerTriggers.value.cases) ? routerTriggers.value.cases.length : 0
+  const routing = readJson(root, path.join("evals", "routing.json"))
+  const routerTriggers = readJson(root, path.join("evals", "router-triggers.json"))
   if (!routing.ok) errors.push(routing.error)
   if (!routerTriggers.ok) errors.push(routerTriggers.error)
+  const staticScenarioCount = routing.ok && Array.isArray(routing.value.scenarios) ? routing.value.scenarios.length : 0
+  const routerCaseCount = routerTriggers.ok && Array.isArray(routerTriggers.value.cases) ? routerTriggers.value.cases.length : 0
 
-  // 3. Check README current version block
-  const readme = rText("README.md")
-  if (readme.ok) {
-    const versionMatch = readme.value.match(/Phiên bản hiện tại:\s*\n```text\n(\S+)/)
-    if (versionMatch && versionMatch[1] !== expectedVersion) {
-      errors.push(`README.md: current version says ${versionMatch[1]}, expected ${expectedVersion}`)
-    } else if (!versionMatch) {
-      errors.push("README.md: could not find current version block")
-    }
-    if (staticScenarioCount && !readme.value.includes("**" + staticScenarioCount + " static skill-routing scenarios**")) {
-      errors.push("README.md: static routing scenario count drift (actual: " + staticScenarioCount + ")")
-    }
-    if (routerCaseCount && !readme.value.includes("**" + routerCaseCount + " V2 router cases**")) {
-      errors.push("README.md: router case count drift (actual: " + routerCaseCount + ")")
+  const readme = requireText(errors, readText(root, "README.md"), "README.md")
+  if (readme) {
+    const versionMatches = [
+      readme.match(/Phiên bản package hiện tại:\*\*\s*<code>([^<]+)<\/code>/i),
+      readme.match(/Phiên bản hiện tại:\s*\n```text\n(\S+)/i),
+    ].filter(Boolean)
+    const readmeVersion = versionMatches[0]?.[1] || null
+    if (!readmeVersion) errors.push("README.md: could not find current package version")
+    else if (readmeVersion !== version) errors.push(`README.md: current version says ${readmeVersion}, expected ${version}`)
+    for (const marker of ["**Pi Agent**", "ues_execute", "ues_dispatch", "ues_cli", "V14.2 Turbo Weak-Model Runtime"]) {
+      if (!readme.includes(marker)) errors.push(`README.md: missing Pi runtime marker ${marker}`)
     }
-  } else {
-    errors.push(readme.error)
   }
 
-  // 4. Check V11 docs for stale status markers
-  const v11Docs = ["docs/V11-PERCEPTION-ADAPTIVE.md", "docs/V11-PERCEPTION-ADAPTIVE-EXECUTION.md"]
-  for (const doc of v11Docs) {
-    const content = rText(doc)
-    if (!content.ok) {
-      errors.push(content.error)
-      continue
-    }
-    if (content.value.includes("Status: development")) {
-      errors.push(`${doc}: still marked as development`)
-    }
-    if (content.value.includes("11.0.0-dev.")) {
-      errors.push(`${doc}: still references dev version 11.0.0-dev.*`)
-    }
-    if (content.value.includes("npm `latest` remains V10")) {
-      errors.push(`${doc}: still says V10 remains npm latest`)
+  const piCompat = requireText(errors, readText(root, path.join("docs", "PI-COMPAT.md")), "docs/PI-COMPAT.md")
+  if (piCompat) {
+    for (const marker of ["# Pi Agent runtime", "ues_execute", "ues_dispatch", "ues_cli", "manifest is Pi-only", "V14.2 Turbo Weak-Model Runtime"]) {
+      if (!piCompat.includes(marker)) errors.push(`docs/PI-COMPAT.md: missing current Pi contract marker ${marker}`)
     }
   }
 
-  // 4b. V13 prerelease contract must stay synchronized with compatibility docs.
-  if (expectedVersion.startsWith("13.")) {
-    const v13 = rText("docs/V13-PARALLEL-WEAK-MODEL-RUNTIME.md")
-    if (!v13.ok) {
-      errors.push(v13.error)
-    } else {
-      if (!v13.value.includes("Status: beta prerelease (`" + expectedVersion + "`).")) {
-        errors.push("docs/V13-PARALLEL-WEAK-MODEL-RUNTIME.md: prerelease version/status drift")
-      }
-      for (const required of ["ues.dispatch_parallel", "same configured model", "OpenCode"]) {
-        if (!v13.value.includes(required)) {
-          errors.push("docs/V13-PARALLEL-WEAK-MODEL-RUNTIME.md: missing V13 contract marker " + required)
-        }
-      }
-    }
-
-    const compat = rText("docs/OPENCODE-COMPAT.md")
-    if (!compat.ok) {
-      errors.push(compat.error)
-    } else {
-      if (!compat.value.includes("V13 ships one npm package")) {
-        errors.push("docs/OPENCODE-COMPAT.md: current compatibility header is stale for V13")
-      }
-      if (!compat.value.includes("ues.dispatch_parallel")) {
-        errors.push("docs/OPENCODE-COMPAT.md: missing V13 parallel capability boundary")
-      }
+  const openCodeCompat = requireText(errors, readText(root, path.join("docs", "OPENCODE-COMPAT.md")), "docs/OPENCODE-COMPAT.md")
+  if (openCodeCompat) {
+    for (const marker of ["Deprecated compatibility surface", "supported runtime in this repository is **Pi Agent**", "canonical runtime lives under `pi/` and `lib/`", "compatibility shim"]) {
+      if (!openCodeCompat.includes(marker)) errors.push(`docs/OPENCODE-COMPAT.md: missing legacy-boundary marker ${marker}`)
     }
   }
 
-  // 5. Verify docs reflect actual counts (skip historical sections)
-  const docsToCheck = ["README.md", "docs/ENGINEERING-DESIGN.md", "docs/OPENCODE-COMPAT.md"]
-  for (const doc of docsToCheck) {
-    const content = rText(doc)
-    if (!content.ok) {
-      errors.push(content.error)
-      continue
-    }
-    const sections = content.value.split(/\n(?=#{1,6}\s)/)
-    for (const section of sections) {
-      const isHistorical = /^\s*#{1,6}\s+.*(V\d+\.|UES\s+\d+\.|historical|Historical)/im.test(section)
-      if (isHistorical) continue
-      if (section.includes("39 skills") || section.includes("39 namespaced skills")) {
-        errors.push(`${doc}: current section still references 39 skills (actual: ${skillCount})`)
-      }
-      if (section.includes("10 namespaced subagents") || section.includes("10 subagents")) {
-        errors.push(`${doc}: current section still references 10 subagents (actual: ${agentCount})`)
-      }
-      if (section.includes("34 static") && section.includes("scenarios")) {
-        errors.push(`${doc}: current section still references 34 static scenarios (actual: ${staticScenarioCount})`)
-      }
-    }
+  const orchestrator = requireText(errors, readText(root, path.join("lib", "orchestrator-policy.mjs")), "lib/orchestrator-policy.mjs")
+  const legacyPolicy = requireText(errors, readText(root, path.join("global-config", "plugins", "ues-router", "policy-runtime.js")), "global-config/plugins/ues-router/policy-runtime.js")
+  const canonicalPolicy = requireText(errors, readText(root, path.join("lib", "task-policy.mjs")), "lib/task-policy.mjs")
+  if (orchestrator && !/from "\.\/task-policy\.mjs"/.test(orchestrator)) {
+    errors.push("lib/orchestrator-policy.mjs: must delegate to Pi-native lib/task-policy.mjs")
   }
-
-  // 6. Check CI workflow
-  const ciYaml = rText(".github/workflows/ci.yml")
-  if (ciYaml.ok) {
-    if (!ciYaml.value.includes("evals:v11:validate")) {
-      errors.push(".github/workflows/ci.yml: missing evals:v11:validate job")
-    }
-    if (!/^\s*name:\s*CI Gate\s*$/m.test(ciYaml.value)) errors.push(".github/workflows/ci.yml: missing CI Gate aggregate job name")
-    if (!/needs:\s*\[\s*static\s*,\s*unit\s*,\s*package\s*\]/m.test(ciYaml.value)) errors.push(".github/workflows/ci.yml: CI Gate must depend on static, unit and package")
-    if (!/if:\s*always\(\)/m.test(ciYaml.value)) errors.push(".github/workflows/ci.yml: aggregate gate must use if: always()")
-    if (!ciYaml.value.includes("docs:check")) errors.push(".github/workflows/ci.yml: missing docs:check job")
-    for (const check of ["evals:v12:validate", ...(expectedVersion.startsWith("13.") ? ["evals:v13"] : []), "evals:repo-scale:validate"]) {
-      if (!ciYaml.value.includes(check)) errors.push(".github/workflows/ci.yml: missing " + check + " job")
-    }
-  } else {
-    errors.push(ciYaml.error)
+  if (legacyPolicy && !/from "\.\.\/\.\.\/\.\.\/lib\/task-policy\.mjs"/.test(legacyPolicy)) {
+    errors.push("global-config/plugins/ues-router/policy-runtime.js: must remain a shim to lib/task-policy.mjs")
   }
-
-  // 7. Check Security workflow
-  const securityYaml = rText(".github/workflows/security.yml")
-  if (securityYaml.ok) {
-    if (!/^\s*name:\s*Security Gate\s*$/m.test(securityYaml.value)) errors.push(".github/workflows/security.yml: missing Security Gate aggregate job name")
-    if (!/needs:\s*\[\s*codeql\s*,\s*dependency-review\s*\]/m.test(securityYaml.value)) errors.push(".github/workflows/security.yml: Security Gate must depend on codeql and dependency-review")
-  } else {
-    errors.push(securityYaml.error)
+  if (canonicalPolicy) {
+    if (!/export function classifyEngineeringTask/.test(canonicalPolicy)) errors.push("lib/task-policy.mjs: missing classifyEngineeringTask")
+    if (!/export function recoveryPolicyForAttempt/.test(canonicalPolicy)) errors.push("lib/task-policy.mjs: missing recoveryPolicyForAttempt")
   }
 
-  // 8. Check publish workflow idempotency
-  const publishYaml = rText(".github/workflows/publish.yml")
-  if (publishYaml.ok) {
-    if (!publishYaml.value.includes("already published")) {
-      errors.push(".github/workflows/publish.yml: missing idempotency check for existing versions")
-    }
-  } else {
-    errors.push(publishYaml.error)
+  if (pkg) {
+    const scripts = pkg.scripts || {}
+    if (scripts.test !== "node --test") errors.push("package.json: npm test must run portable full Node test discovery")
+    if (scripts["test:pi"] !== "node --test test/pi-package.test.mjs") errors.push("package.json: missing focused test:pi script")
+    if (scripts["docs:check"] !== "node scripts/check-release-consistency.mjs") errors.push("package.json: missing docs:check release-consistency script")
+    if (scripts["release:check-tag"] !== "node scripts/check-release-tag.mjs") errors.push("package.json: missing release:check-tag script")
+    if (scripts["eval:pi"] !== "node scripts/eval-pi.mjs") errors.push("package.json: missing Pi-native eval:pi script")
+    if (!String(scripts.ci || "").includes("npm run integrity")) errors.push("package.json: ci must include source-integrity gate")
+    if (scripts["runtime:exports"] !== "node scripts/check-runtime-exports.mjs") errors.push("package.json: missing runtime:exports import/export gate")
+    if (!String(scripts.ci || "").includes("npm run runtime:exports")) errors.push("package.json: ci must include runtime export gate")
+    if (!String(scripts.ci || "").includes("npm run docs:check")) errors.push("package.json: ci must include docs:check")
+    if (!String(scripts.ci || "").includes("npm test")) errors.push("package.json: ci must include full npm test")
+    if (!String(scripts.ci || "").includes("npm run smoke:packed")) errors.push("package.json: ci must include smoke:packed")
+    if (pkg.pi?.extensions?.[0] !== "./pi/extensions/ues.ts") errors.push("package.json: Pi extension entry drift")
+    if (!Array.isArray(pkg.pi?.skills) || !pkg.pi.skills.includes("./global-config/skills")) errors.push("package.json: Pi skills entry drift")
+    if (!Array.isArray(pkg.pi?.prompts) || !pkg.pi.prompts.includes("./pi/prompts/*.md")) errors.push("package.json: Pi prompts entry drift")
+    if (!Array.isArray(pkg.files) || !pkg.files.includes("global-config/AGENTS.md")) errors.push("package.json: installer runtime data global-config/AGENTS.md must be packed")
+    if (!pkg.files.includes("docs/V14.2-TURBO-WEAK-MODEL-RUNTIME.md")) errors.push("package.json: V14.2 runtime documentation must be packed")
+    if (scripts["smoke:packed"] !== "node scripts/smoke-packed-install.mjs") errors.push("package.json: missing smoke:packed integration script")
   }
 
-  // 9. Check npm script docs:check exists
-  if (pkg.ok) {
-    const pkgScripts = pkg.value.scripts || {}
-    if (!pkgScripts["docs:check"]) {
-      warnings.push("package.json: missing docs:check npm script")
-    }
-    if (expectedVersion.startsWith("13.") && !pkgScripts["evals:v13"]) {
-      errors.push("package.json: V13 requires evals:v13 regression script")
-    }
-  }
+  if (skillCount < 40) warnings.push(`skill catalog unexpectedly small: ${skillCount}`)
+  if (promptCount < 10) warnings.push(`Pi prompt catalog unexpectedly small: ${promptCount}`)
 
   return {
     pass: errors.length === 0,
     errors,
     warnings,
-    version: expectedVersion,
+    version,
     skillCount,
     commandCount,
-    subagentCount: agentCount,
+    subagentCount,
+    promptCount,
     staticScenarioCount,
     routerCaseCount,
   }
@@ -247,14 +181,14 @@ if (process.argv[1] === fileURLToPath(import.meta.url)) {
   const result = checkReleaseConsistency(process.env.UES_BUNDLE_ROOT || DEFAULT_ROOT)
   if (result.warnings.length) {
     console.warn("Warnings:")
-    for (const w of result.warnings) console.warn(`  WARN: ${w}`)
+    for (const warning of result.warnings) console.warn(`  WARN: ${warning}`)
   }
   if (result.errors.length) {
     console.error("Release consistency check FAILED:")
-    for (const e of result.errors) console.error(`  - ${e}`)
+    for (const error of result.errors) console.error(`  - ${error}`)
     process.exit(1)
   }
   console.log(
-    `Release consistency check PASS: package=${result.version}, skills=${result.skillCount}, commands=${result.commandCount}, subagents=${result.subagentCount}`,
+    `Release consistency check PASS: package=${result.version}, skills=${result.skillCount}, prompts=${result.promptCount}, subagents=${result.subagentCount}`,
   )
-}
+}

package/scripts/check-runtime-exports.mjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+
+import assert from "node:assert/strict"
+import { readFile } from "node:fs/promises"
+import path from "node:path"
+import { fileURLToPath, pathToFileURL } from "node:url"
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..")
+const extensionFiles = [
+  "pi/extensions/ues.ts",
+  "pi/extensions/ues-child-runtime.ts",
+]
+
+function parseNamedLibImports(source) {
+  const rows = []
+  const pattern = /import\s*\{([^}]*)\}\s*from\s*["'](\.\.\/\.\.\/lib\/[^"']+\.mjs)["']\s*;?/g
+  let match
+  while ((match = pattern.exec(source))) {
+    const names = match[1]
+      .split(",")
+      .map((value) => value.trim())
+      .filter(Boolean)
+      .map((value) => {
+        const parts = value.split(/\s+as\s+/)
+        return { imported: parts[0].trim(), local: (parts[1] || parts[0]).trim() }
+      })
+    rows.push({ specifier: match[2], names })
+  }
+  return rows
+}
+
+const failures = []
+let checked = 0
+for (const relative of extensionFiles) {
+  const absolute = path.join(root, ...relative.split("/"))
+  const source = await readFile(absolute, "utf8")
+  for (const row of parseNamedLibImports(source)) {
+    const modulePath = path.resolve(path.dirname(absolute), row.specifier)
+    let imported
+    try {
+      imported = await import(pathToFileURL(modulePath).href)
+    } catch (error) {
+      failures.push(
+        `${relative}: unable to import ${row.specifier}: ${error instanceof Error ? error.message : String(error)}`,
+      )
+      continue
+    }
+    for (const name of row.names) {
+      checked += 1
+      if (!(name.imported in imported)) {
+        failures.push(
+          `${relative}: ${row.specifier} does not export named binding ${name.imported}`,
+        )
+      }
+    }
+  }
+}
+
+assert.deepEqual(
+  failures,
+  [],
+  "Pi extension runtime import/export validation failed:\n" +
+    failures.map((item) => "- " + item).join("\n"),
+)
+
+console.log(`Runtime exports passed for ${checked} Pi-extension named imports.`)