phasegate 0.191.0 → 0.222.0

package/scripts/harness/ci-governance/infrastructure/adapters/integrity-manifest-json-repository-adapter.ts

@@ -0,0 +1,83 @@
+// @unit ci-governance
+// @layer infrastructure
+
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import type { IntegrityManifestRepositoryPort } from "../../domain/ports/integrity-manifest-repository-port.js";
+import { IntegrityManifest } from "../../domain/value-objects/integrity-manifest.js";
+
+interface IntegrityJsonV1 {
+  readonly version: 1;
+  readonly algorithm: "sha256";
+  readonly files: Readonly<Record<string, string>>;
+}
+
+/**
+ * phasegate.integrity.json（ルート）の読み書きアダプタ。
+ * files は path 昇順キーで決定的に書き出す。
+ */
+export class IntegrityManifestJsonRepositoryAdapter implements IntegrityManifestRepositoryPort {
+  private readonly filePath: string;
+
+  constructor(baseDir: string, relativePath = "phasegate.integrity.json") {
+    this.filePath = path.isAbsolute(relativePath) ? relativePath : path.join(baseDir, relativePath);
+  }
+
+  getPath(): string {
+    return this.filePath;
+  }
+
+  async exists(): Promise<boolean> {
+    try {
+      await fs.access(this.filePath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  async save(manifest: IntegrityManifest): Promise<string> {
+    const files: Record<string, string> = {};
+    for (const [p, digest] of manifest.sortedEntries()) {
+      files[p] = digest;
+    }
+    const data: IntegrityJsonV1 = {
+      version: 1,
+      algorithm: "sha256",
+      files,
+    };
+    await fs.mkdir(path.dirname(this.filePath), { recursive: true });
+    await fs.writeFile(this.filePath, `${JSON.stringify(data, null, 2)}\n`, "utf-8");
+    return this.filePath;
+  }
+
+  async load(): Promise<IntegrityManifest | null> {
+    let content: string;
+    try {
+      content = await fs.readFile(this.filePath, "utf-8");
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code === "ENOENT") return null;
+      throw err;
+    }
+
+    let parsed: IntegrityJsonV1;
+    try {
+      parsed = JSON.parse(content) as IntegrityJsonV1;
+    } catch (err) {
+      throw new Error(`Invalid integrity JSON at ${this.filePath}: ${String(err)}`);
+    }
+
+    if (
+      !parsed ||
+      parsed.version !== 1 ||
+      parsed.algorithm !== "sha256" ||
+      typeof parsed.files !== "object" ||
+      parsed.files === null
+    ) {
+      throw new Error(`Invalid integrity JSON schema at ${this.filePath}`);
+    }
+
+    const files = new Map<string, string>(Object.entries(parsed.files));
+    return IntegrityManifest.create({ files });
+  }
+}

package/scripts/harness/ci-governance/presentation/handlers/integrity-handler.ts

@@ -0,0 +1,76 @@
+// @unit ci-governance
+// @layer presentation
+
+import type { PinIntegrityUseCase } from "../../application/usecases/pin-integrity-usecase.js";
+import type { VerifyIntegrityUseCase } from "../../application/usecases/verify-integrity-usecase.js";
+import type { IntegrityDriftKind } from "../../domain/value-objects/integrity-drift.js";
+
+export interface IntegrityPinArgs {
+  readonly dryRun?: boolean;
+  readonly format?: "human" | "json";
+}
+
+export interface IntegrityVerifyArgs {
+  readonly format?: "human" | "json";
+}
+
+export interface IntegrityHandlerResult {
+  readonly exitCode: number;
+  readonly output: string;
+}
+
+const DRIFT_LABEL: Record<IntegrityDriftKind, string> = {
+  mismatch: "MISMATCH (digest 不一致)",
+  added: "ADDED (manifest 未登録)",
+  missing: "MISSING (実ファイル欠落)",
+  "manifest-absent": "MANIFEST-ABSENT (manifest 欠落)",
+};
+
+export class IntegrityHandler {
+  constructor(
+    private readonly pinUseCase: PinIntegrityUseCase,
+    private readonly verifyUseCase: VerifyIntegrityUseCase,
+  ) {}
+
+  async pin(args: IntegrityPinArgs): Promise<IntegrityHandlerResult> {
+    const format = args.format ?? "human";
+    const result = await this.pinUseCase.execute({ dryRun: args.dryRun });
+
+    if (format === "json") {
+      return { exitCode: 0, output: JSON.stringify(result, null, 2) };
+    }
+
+    const header = result.dryRun
+      ? `[dry run] integrity manifest を生成しました（保存先想定: ${result.savedPath}）`
+      : `integrity manifest を保存しました: ${result.savedPath}`;
+    return {
+      exitCode: 0,
+      output: [header, `エントリ数: ${result.entryCount}`].join("\n"),
+    };
+  }
+
+  async verify(args: IntegrityVerifyArgs): Promise<IntegrityHandlerResult> {
+    const format = args.format ?? "human";
+    const result = await this.verifyUseCase.execute();
+    const exitCode = result.ok ? 0 : 2;
+
+    if (format === "json") {
+      return { exitCode, output: JSON.stringify(result, null, 2) };
+    }
+
+    if (result.ok) {
+      return {
+        exitCode: 0,
+        output: `integrity 照合 OK: drift はありません（${result.manifestPath}）`,
+      };
+    }
+
+    const lines = [
+      `integrity drift を ${result.drifts.length} 件検出しました（${result.manifestPath}）:`,
+      ...result.drifts.map((d) => `- [${DRIFT_LABEL[d.kind]}] ${d.path}`),
+      "",
+      "意図的な変更であれば `phasegate integrity:pin` で manifest を更新してください。",
+    ];
+    return { exitCode: 2, output: lines.join("\n") };
+  }
+}

package/scripts/harness/config-foundation/application/mappers/validator-system-config-mapper.ts

@@ -4,50 +4,77 @@
  * @work-item-id WI-133 / WI-156
  * @work-item-id WI-217
  * @work-item-id WI-212
+ * @work-item-id WI-258
+ * @work-item-id WI-259
+ * @work-item-id WI-268
  */
-import type { HarnessConfigV2 } from '../../domain/harness-config.js';
+import type { HarnessConfigV2 } from "../../domain/harness-config.js";
 
 export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefined): object | undefined {
   if (!resolvedConfig) return undefined;
 
-  const l3Validators = normalizeValidators(resolvedConfig.layers.L3.validators, {
-    security: 'L3-001',
-    performance: 'L3-002',
-    coverage: 'L3-003',
-    nyquist: 'L3-004',
-    'ac-bound-coverage': 'L3-005',
-  }, /^L3-\d{3}$/);
-  const l4Validators = normalizeValidators(resolvedConfig.layers.L4.validators, {
-    'drift-detect': 'L4-001',
-    'drift-detector': 'L4-001',
-    'consistency-check': 'L4-002',
-    'consistency-checker': 'L4-002',
-    'dead-code': 'L4-003',
-    'dead-code-detector': 'L4-003',
-    'doc-freshness': 'L4-004',
-    'doc-freshness-checker': 'L4-004',
-    'pointer-validation': 'L4-005',
-    'pointer-validator': 'L4-005',
-    'skill-catalog-drift': 'L4-006',
-  }, /^L4-\d{3}$/);
+  const l3Validators = normalizeValidators(
+    resolvedConfig.layers.L3.validators,
+    {
+      security: "L3-001",
+      performance: "L3-002",
+      coverage: "L3-003",
+      nyquist: "L3-004",
+      "ac-bound-coverage": "L3-005",
+      "injection-scan": "L3-006",
+      "coverage-attestation-verification": "L3-007",
+    },
+    /^L3-\d{3}$/,
+  );
+  const l4Validators = normalizeValidators(
+    resolvedConfig.layers.L4.validators,
+    {
+      "drift-detect": "L4-001",
+      "drift-detector": "L4-001",
+      "consistency-check": "L4-002",
+      "consistency-checker": "L4-002",
+      "dead-code": "L4-003",
+      "dead-code-detector": "L4-003",
+      "doc-freshness": "L4-004",
+      "doc-freshness-checker": "L4-004",
+      "pointer-validation": "L4-005",
+      "pointer-validator": "L4-005",
+      "skill-catalog-drift": "L4-006",
+    },
+    /^L4-\d{3}$/,
+  );
   const effectiveL4Validators = usesCustomDocumentRoots(resolvedConfig)
-    ? includeValidator(l4Validators, 'L4-002')
+    ? includeValidator(l4Validators, "L4-002")
     : l4Validators;
 
   return {
     project: {
       preset: resolvedConfig.project.preset,
-      languages: resolvedConfig.project.languages ?? ['typescript'],
+      languages: resolvedConfig.project.languages ?? ["typescript"],
     },
     paths: {
       designDocs: resolvedConfig.paths.designDocs,
       inceptionDocs: resolvedConfig.paths.inceptionDocs,
     },
     layers: {
-      L2: { enabled: resolvedConfig.layers.L2.enabled, validators: ['L2-001', 'L2-002', 'L2-003', 'L2-013', 'L2-014', 'L2-015'] },
+      // WI-258 / ADR-030 §Decision.3.②: L2-016 (coverage-attestation-gating) を default-ON でリストに含める。
+      L2: {
+        enabled: resolvedConfig.layers.L2.enabled,
+        validators: ["L2-001", "L2-002", "L2-003", "L2-013", "L2-014", "L2-015", "L2-016"],
+      },
       L3: {
         enabled: resolvedConfig.layers.L3.enabled,
-        validators: l3Validators.length > 0 ? l3Validators : ['L3-001', 'L3-002', 'L3-003', 'L3-004'],
+        // WI-259 / ADR-030 §Decision.3.④: L3-006 (injection-scan) は advisory default-ON。
+        // WI-268 / ADR-030 §Decision.1・§Decision.3.② 第2段: L3-007 (coverage-attestation-verification)
+        // は fail-closed default-ON。いずれも fallback 判定の後に force-include し、normalize 結果でも
+        // fallback でも常に含める（L3-007 は fail-closed だが現 corpus は実参照 0 件ゆえ緑）。
+        validators: includeValidator(
+          includeValidator(
+            l3Validators.length > 0 ? l3Validators : ["L3-001", "L3-002", "L3-003", "L3-004"],
+            "L3-006",
+          ),
+          "L3-007",
+        ),
         coverageThreshold: resolvedConfig.layers.L3.coverageThreshold,
         requirementMatrixPath: resolvedConfig.layers.L3.requirementMatrixPath,
         // WI-227 / H16-03: L3-005 のスコープ（additive-safe。未設定は []）
@@ -55,7 +82,10 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
       },
       L4: {
         enabled: resolvedConfig.layers.L4.enabled,
-        validators: effectiveL4Validators.length > 0 ? effectiveL4Validators : ['L4-001', 'L4-002', 'L4-003', 'L4-004', 'L4-005', 'L4-006'],
+        validators:
+          effectiveL4Validators.length > 0
+            ? effectiveL4Validators
+            : ["L4-001", "L4-002", "L4-003", "L4-004", "L4-005", "L4-006"],
       },
     },
     harnesses: {
@@ -70,8 +100,10 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
 }
 
 function usesCustomDocumentRoots(resolvedConfig: HarnessConfigV2): boolean {
-  return resolvedConfig.paths.designDocs !== 'docs/product/construction'
-    || resolvedConfig.paths.inceptionDocs !== 'docs/inception';
+  return (
+    resolvedConfig.paths.designDocs !== "docs/product/construction" ||
+    resolvedConfig.paths.inceptionDocs !== "docs/inception"
+  );
 }
 
 function includeValidator(validators: readonly string[], validatorId: string): readonly string[] {

package/scripts/harness/harness-api/domain/value-objects/ci-check-result.ts

@@ -2,7 +2,7 @@
 // @unit harness-api
 // ci-check-result.ts — CiCheckResult Value Object
 
-import type { HarnessError } from './harness-api-response.js';
+import type { HarnessError } from "./harness-api-response.js";
 
 export interface ValidatorCheckItem {
   validatorId: string;
@@ -14,6 +14,30 @@ export interface ValidatorCheckItem {
 export interface CiCheckResultProps {
   validatorResults: readonly ValidatorCheckItem[];
   allPassed: boolean;
+  /** WI-260 / ADR-017: warning-only failure を fail 扱いにする opt-in（既定 false）。 */
+  failOnWarning?: boolean;
+}
+
+/**
+ * WI-260 / ADR-017: validator 1件が「実質 pass」か判定する severity-aware ルール。
+ * `validate` 経路の AggregateValidationResultsUseCase と同一の判定式を harness-api の
+ * domain VO 側に持たせ、ci-check と validate の集約挙動を一致させる（レイヤー越境回避のため
+ * usecase を直接 import せず判定ロジックを共有）。
+ *
+ * - skipped: 実質 pass
+ * - passed=true: 実質 pass
+ * - passed=false かつ error severity（!= warning）を含む: fail
+ * - passed=false かつ errors=[]（severity 判定不能）: 安全側に倒して fail
+ * - passed=false かつ warning のみ: failOnWarning=false（既定）で実質 pass、true で fail
+ */
+function isEffectivelyPassed(item: ValidatorCheckItem, failOnWarning: boolean): boolean {
+  if (item.skipped || item.passed) return true;
+  const errors = item.errors ?? [];
+  const hasNonWarningError = errors.some((e) => e.severity !== "warning");
+  const hasWarnings = errors.some((e) => e.severity === "warning");
+  const isEmptyFail = errors.length === 0;
+  const hasFail = isEmptyFail || hasNonWarningError || (failOnWarning && hasWarnings);
+  return !hasFail;
 }
 
 export class CiCheckResult {
@@ -29,23 +53,24 @@ export class CiCheckResult {
   static create(props: CiCheckResultProps): CiCheckResult {
     // INV-5: validatorResults は 1件以上
     if (!props.validatorResults || props.validatorResults.length === 0) {
-      throw new Error('EmptyValidatorResultsError: validatorResults must have at least one item (INV-5)');
+      throw new Error("EmptyValidatorResultsError: validatorResults must have at least one item (INV-5)");
     }
-    // INV-6: allPassed === validatorResults.every(r => r.passed || r.skipped)
-    const computedAllPassed = props.validatorResults.every((r) => r.passed || r.skipped);
+    // INV-6 (WI-260/ADR-017 更新): allPassed === validatorResults.every(実質pass)
+    const failOnWarning = props.failOnWarning ?? false;
+    const computedAllPassed = props.validatorResults.every((r) => isEffectivelyPassed(r, failOnWarning));
     if (props.allPassed !== computedAllPassed) {
       throw new Error(
-        `HarnessApiDomainError: allPassed=${props.allPassed} does not match validatorResults state (computed: ${computedAllPassed})`
+        `HarnessApiDomainError: allPassed=${props.allPassed} does not match validatorResults state (computed: ${computedAllPassed})`,
       );
     }
     return new CiCheckResult(props.validatorResults, props.allPassed);
   }
 
-  static fromResults(validatorResults: readonly ValidatorCheckItem[]): CiCheckResult {
+  static fromResults(validatorResults: readonly ValidatorCheckItem[], failOnWarning = false): CiCheckResult {
     if (!validatorResults || validatorResults.length === 0) {
-      throw new Error('EmptyValidatorResultsError: validatorResults must have at least one item (INV-5)');
+      throw new Error("EmptyValidatorResultsError: validatorResults must have at least one item (INV-5)");
     }
-    const allPassed = validatorResults.every((r) => r.passed || r.skipped);
+    const allPassed = validatorResults.every((r) => isEffectivelyPassed(r, failOnWarning));
     return new CiCheckResult(validatorResults, allPassed);
   }
 

package/scripts/harness/harness-api/domain/value-objects/known-harness-commands.ts

@@ -0,0 +1,90 @@
+// @unit harness-api
+// @layer domain
+// @work-item-id WI-250
+// known-harness-commands.ts — CLI 実サーフェスの canonical 既知コマンド一覧
+//
+// main.ts の CLI dispatch（`switch (command)`）が受理する全トップレベルコマンド名の
+// 単一ソース。`phasegate:` prefix 必須の CommandRegistry では表現できない
+// 非 prefix コマンド（lint / init / baseline 等）を含む完全なサーフェスを表す。
+//
+// 不変条件（conformance テストで強制）:
+// - main.ts の `case "..."` ラベル集合と集合一致すること
+//   （__tests__/integration/harness-api/known-harness-commands-conformance.test.ts）
+// - エントリは重複なくソート済みであること
+//
+// main.ts にコマンドを追加/削除した場合は、必ずこのリストも同期更新すること。
+
+export const KNOWN_HARNESS_COMMANDS: readonly string[] = Object.freeze([
+  "baseline",
+  "bypass:audit",
+  "check-change-category",
+  "check-phase-gate",
+  "ci-check",
+  "ci:auto-refresh-agent-context",
+  "ci:check-repetition",
+  "ci:generate-template",
+  "ci:migrate-agents-md",
+  "commit-msg",
+  "complete-check",
+  "config:plan",
+  "delegate-sonnet",
+  "disable-feature",
+  "doctor",
+  "emit-agent-rules",
+  "enable-feature",
+  "hook",
+  "init",
+  "install",
+  "integrity:pin",
+  "integrity:verify",
+  "lint",
+  "list-adrs",
+  "list-errors",
+  "list-features",
+  "migrate",
+  "p2:check-agent-context",
+  "p2:check-freshness",
+  "p2:check-initial-creation",
+  "p2:generate-e2e-template",
+  "p2:validate-pointers",
+  "phasegate:attest",
+  "phasegate:check-phase",
+  "phasegate:check-ready",
+  "phasegate:ci-check",
+  "phasegate:complete-check",
+  "phasegate:detect-drift",
+  "phasegate:generate-matrix",
+  "phasegate:impact-analysis",
+  "phasegate:lint",
+  "phasegate:status",
+  "phasegate:verify-attestation",
+  "pre-commit",
+  "reconcile",
+  "refresh-claude-md",
+  "regression:analyze-migration",
+  "regression:configure-ci-gate",
+  "regression:migrate-v0-tests",
+  "regression:run-agent-guard",
+  "regression:run-gng-gate",
+  "regression:run-k-requirements",
+  "regression:run-k14-k15",
+  "render-errors",
+  "scaffold-design",
+  "scaffold-wi",
+  "session",
+  "setup:agent",
+  "skill:apply-cascade-update",
+  "skill:check-coverage",
+  "skill:collect-lessons",
+  "skill:execute-tdd-cycle",
+  "skill:validate-structure",
+  "skills",
+  "status",
+  "uninstall",
+  "update-skills",
+  "validate",
+  "validate-adr",
+  "validate-fix",
+  "validate-metadata",
+  "work-items:status",
+]);

package/scripts/harness/harness-error/infrastructure/registry/l1-error-definitions.ts

@@ -67,24 +67,24 @@ export const L1_ERROR_DEFINITIONS = Object.freeze([
   }),
   createDefinition({
     code: 'L1-006',
-    title: '参照されないファイルが残っている',
+    title: '重複コードが検出された',
     category: 'architecture',
     ownerValidatorId: 'architecture',
-    defaultFixExample: 'export const actual = "shared";',
+    defaultFixExample:
+      'function buildValue(): string { return "shared"; }\nconst actual = buildValue();',
   }),
   createDefinition({
     code: 'L1-007',
-    title: 'コメント量が過剰である',
-    category: 'quality',
+    title: '参照されないファイルが残っている',
+    category: 'architecture',
     ownerValidatorId: 'architecture',
-    defaultFixExample: 'const actual = "keep comments concise";',
+    defaultFixExample: 'export const actual = "shared";',
   }),
   createDefinition({
     code: 'L1-008',
-    title: '重複コードが検出された',
-    category: 'architecture',
+    title: 'コメント量が過剰である',
+    category: 'quality',
     ownerValidatorId: 'architecture',
-    defaultFixExample:
-      'function buildValue(): string { return "shared"; }\nconst actual = buildValue();',
+    defaultFixExample: 'const actual = "keep comments concise";',
   }),
 ]);

package/scripts/harness/installation/application/bundled-skill-selection.ts

@@ -8,17 +8,15 @@ const CORE_SKILLS = [
   "cascade-updater",
   "codebase-mapper",
   "consistency-checker",
-  "doc-freshness-checker",
+  "doc-health-checker",
   "engineering-perspective",
   "implementation-readiness-checker",
-  "pointer-validator",
   "test-coverage-checker",
 ] as const;
 
 const AIDLC_SKILLS = [
   "domain-designer",
   "environment-designer",
-  "implementation-planner",
   "it-test-designer",
   "it-test-logic-designer",
   "logical-designer",
@@ -37,10 +35,9 @@ const AIDLC_SKILLS = [
 ] as const;
 
 const UTILITY_SKILLS = ["codex-delegator", "skill-creator"] as const;
-const GUIDANCE_SKILLS = ["phasegate-toolkit-guide", "phasegate-config-doctor"] as const;
+const GUIDANCE_SKILLS = ["phasegate-toolkit-guide", "phasegate-config-doctor", "release-publisher"] as const;
 
 export function getBundledSkillsForSet(skillSet: SkillSet): string[] {
   if (skillSet === "core") return [...CORE_SKILLS];
   return [...CORE_SKILLS, ...AIDLC_SKILLS, ...UTILITY_SKILLS, ...GUIDANCE_SKILLS];
 }
-

package/scripts/harness/installation/application/usecases/run-reconcile.ts

@@ -6,6 +6,7 @@
 // @work-item-id WI-210
 // @work-item-id WI-216
 // @work-item-id WI-219
+// @work-item-id WI-264
 
 import { access, chmod, copyFile, lstat, mkdir, readFile, readlink, readdir, rm, symlink, writeFile } from "node:fs/promises";
 import { dirname, join, relative, resolve } from "node:path";
@@ -18,7 +19,7 @@ import type { HashCalculatorPort } from "../ports/hash-calculator-port.js";
 import type { ManifestRepositoryPort } from "../ports/manifest-repository-port.js";
 import type { ModelDelegationPort } from "../ports/model-delegation-port.js";
 
-type ReconcileAction = "missing-manifest" | "update" | "add" | "link" | "skip" | "refuse";
+type ReconcileAction = "missing-manifest" | "update" | "add" | "link" | "skip" | "refuse" | "prune";
 type StrategyType = "json" | "shell" | "yaml-add" | "package-json" | "markdown-managed" | "copy-dir" | "symlink" | "unknown";
 
 export interface ReconcilePlanItem {
@@ -62,6 +63,8 @@ const SHELL_END = "# === phasegate managed (END) ===";
 const MARKDOWN_BEGIN = "<!-- phasegate:managed-section:start -->";
 const MARKDOWN_END = "<!-- phasegate:managed-section:end -->";
 const SHARED_SKILLS_VERSION_PATH = "skills/.harness-version";
+const HARNESS_VERSION_BASENAME = ".harness-version";
+const SKILL_ROOT_PREFIXES = ["skills", ".claude/skills", ".codex/skills"] as const;
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -302,6 +305,7 @@ export class RunReconcileUseCase {
     const outcomes: Array<{
       readonly item: ReconcilePlanItem;
       readonly needsBackup: boolean;
+      readonly prune?: boolean;
       readonly apply: () => Promise<string | null>;
     }> = [];
 
@@ -346,12 +350,23 @@ export class RunReconcileUseCase {
       }
     }
 
+    for (const outcome of this.planOrphanSkills(input, manifest)) {
+      outcomes.push(outcome);
+      plan.push(outcome.item);
+    }
+
     if (!input.apply || refused.length > 0) {
       return { plan, refused, changed, backupDir: null };
     }
 
     for (const outcome of outcomes) {
       if (!outcome.item.changed) continue;
+      if (outcome.prune === true) {
+        await outcome.apply();
+        nextManifest = nextManifest.removeEntry(outcome.item.path);
+        changed.push(outcome.item);
+        continue;
+      }
       if (outcome.needsBackup) {
         backupDir ??= join(input.projectRoot, ".phasegate", "backups", backupStamp);
         await this.backup(input.projectRoot, outcome.item.path, backupDir);
@@ -616,6 +631,59 @@ export class RunReconcileUseCase {
     };
   }
 
+  private planOrphanSkills(input: RunReconcileInput, manifest: DeploymentManifest): Array<{
+    readonly item: ReconcilePlanItem;
+    readonly needsBackup: boolean;
+    readonly prune: boolean;
+    readonly apply: () => Promise<string | null>;
+  }> {
+    const allowed = new Set(getBundledSkillsForSet("all"));
+    const outcomes: Array<{
+      readonly item: ReconcilePlanItem;
+      readonly needsBackup: boolean;
+      readonly prune: boolean;
+      readonly apply: () => Promise<string | null>;
+    }> = [];
+    for (const entry of manifest.entries) {
+      if (entry.mode !== "created") continue;
+      const skillName = this.orphanSkillName(entry.path, allowed);
+      if (skillName === null) continue;
+      const absolutePath = this.resolveProjectPath(input.projectRoot, entry.path);
+      outcomes.push({
+        item: this.item(
+          entry.path,
+          "prune",
+          "mechanical",
+          "copy-dir",
+          true,
+          `${entry.path}: prune orphan skill (not in current bundle)`,
+          "- skill directory",
+          null,
+        ),
+        needsBackup: false,
+        prune: true,
+        apply: async () => {
+          await rm(absolutePath, { recursive: true, force: true });
+          return null;
+        },
+      });
+    }
+    return outcomes;
+  }
+
+  private orphanSkillName(entryPath: string, allowed: ReadonlySet<string>): string | null {
+    for (const prefix of SKILL_ROOT_PREFIXES) {
+      const marker = `${prefix}/`;
+      if (!entryPath.startsWith(marker)) continue;
+      const remainder = entryPath.slice(marker.length);
+      if (remainder.length === 0 || remainder.includes("/")) return null;
+      if (remainder === HARNESS_VERSION_BASENAME) return null;
+      if (allowed.has(remainder)) return null;
+      return remainder;
+    }
+    return null;
+  }
+
   private createdEntry(path: string, hashInput: string): DeploymentEntry {
     return DeploymentEntry.create({
       path,