pumuki 6.3.7

package/docs/rule-packs/ios.md

@@ -0,0 +1,22 @@
+# iOS Rule Pack
+
+## Pack
+
+- `iosEnterpriseRuleSet@1.0.0`
+- Platform: `ios`
+
+## Source
+
+- `core/rules/presets/iosEnterpriseRuleSet.ts`
+
+## Scope
+
+- Swift code (`.swift`)
+- Enforced through shared evaluator in `PRE_COMMIT`, `PRE_PUSH`, and `CI`
+
+## Typical checks
+
+- No GCD / `OperationQueue`
+- No `AnyView`
+- No force unwrap patterns
+- No completion handlers outside allowed scopes

package/docs/skills-repo-enforcement-migration.md

@@ -0,0 +1,73 @@
+# Skills Migration Guide: Personal to Repository-Enforced
+
+## Purpose
+
+This guide describes how to move from personal, machine-local skills usage to deterministic repository-enforced skills in Pumuki.
+
+Target state:
+
+- the team evaluates the same `skills.lock.json` and `skills.policy.json`
+- CI reproduces local gate behavior
+- evidence traces active skills bundles in `.ai_evidence.json`
+
+## Scope and Constraints
+
+- Runtime gate enforcement must not depend on `~/.codex/**`.
+- Repository contracts are the source of truth for enforcement.
+- Skills remain additive to baseline + project rules (no core coupling).
+
+## Migration Checklist
+
+1. Define repository skill sources in `skills.sources.json`.
+2. Compile and commit lock contract:
+   - `npm run skills:compile`
+3. Validate lock freshness:
+   - `npm run skills:lock:check`
+4. Define stage policies and bundle toggles in `skills.policy.json`.
+5. Run local stage gates (`PRE_COMMIT`, `PRE_PUSH`, `CI`) and inspect `.ai_evidence.json`:
+   - confirm `rulesets[]` includes active skills bundles and policy trace.
+6. Open PR and ensure CI passes `Skills Lock Freshness`.
+
+## Recommended Rollout
+
+1. Soft rollout:
+   - keep strict block thresholds unchanged
+   - enable skills bundles with warn-first calibration where appropriate
+2. Calibration:
+   - promote selected rules in `skills.policy.json` for `PRE_PUSH/CI`
+3. Hardening:
+   - require lock freshness in CI (already enforced in `.github/workflows/ci.yml`)
+   - reject stale lock updates in PR review
+
+## Team Operating Model
+
+- Owners:
+  - platform leads curate skills templates and policy behavior
+  - release/quality owners approve lock updates
+- Update flow:
+  1. edit sources/policy
+  2. recompile lock
+  3. run lock check + stage tests
+  4. commit contracts and rationale in PR
+
+## Failure Modes and Recovery
+
+- Symptom: CI fails with stale lock.
+  - Action: re-run `npm run skills:compile`, commit updated `skills.lock.json`, re-run checks.
+- Symptom: local gate differs from CI.
+  - Action: verify committed `skills.policy.json`, branch refs used by stage runners, and evidence trace in `rulesets[]`.
+- Symptom: unexpected skills violations.
+  - Action: verify bundle enablement in `skills.policy.json` and compiled mapping entries in `skills.lock.json`.
+
+## Verification Criteria
+
+Migration is complete when all conditions hold:
+
+- contracts are committed and validated
+- CI lock freshness check is green
+- stage outcomes are deterministic across local/CI
+- evidence includes active skills bundles and policy trace for each stage
+
+Execution runbook for consumer-repository rollout validation:
+
+- `docs/validation/skills-rollout-consumer-repositories.md`

package/docs/validation/README.md

@@ -0,0 +1,82 @@
+# Validation Docs Policy
+
+This folder mixes two categories:
+
+1. Versioned runbooks/playbooks (kept in git).
+2. Generated execution reports (local outputs, not baseline documentation).
+
+Validation runbooks in this folder are operational adapters. They support rollout diagnostics and incident handling, but they are not required inputs for deterministic PRE_COMMIT/PRE_PUSH/CI gate decisions.
+
+## Versioned Documents
+
+Keep these as source-of-truth operational references:
+
+- `consumer-ci-startup-failure-playbook.md`
+- `consumer-startup-escalation-handoff-latest.md`
+- `github-support-ticket-template-startup-failure.md`
+- `phase5-execution-closure.md`
+- `phase8-external-rollout-pack.md`
+- `skills-rollout-consumer-repositories.md`
+- `adapter-hook-runtime-validation.md`
+- `adapter-hook-runtime-local-report.md`
+- `adapter-real-session-report-template.md`
+- `enterprise-consumer-isolation-policy.md`
+- `mock-consumer-integration-runbook.md`
+
+## Archived Historical Reports
+
+Historical execution reports are isolated under:
+
+- `archive/`
+
+## Generated Outputs (Do Not Keep as Baseline Docs)
+
+These files are command outputs and should be generated per execution context:
+
+- `consumer-ci-auth-check.md`
+- `consumer-ci-artifacts-report.md`
+- `consumer-workflow-lint-report.md`
+- `consumer-startup-failure-support-bundle.md`
+- `consumer-support-ticket-draft.md`
+- `consumer-startup-unblock-status.md`
+- `consumer-startup-triage-report.md`
+- `phase5-blockers-readiness.md`
+- `phase5-execution-closure-status.md`
+- `adapter-readiness.md`
+- `adapter-session-status.md`
+- `adapter-real-session-report.md`
+
+Generate them on demand with:
+
+- `npm run validation:consumer-ci-auth-check -- --repo <owner>/<repo>`
+- `npm run validation:consumer-ci-artifacts -- --repo <owner>/<repo>`
+- `npm run validation:consumer-workflow-lint -- --repo-path <path>`
+- `npm run validation:consumer-support-bundle -- --repo <owner>/<repo>`
+- `npm run validation:consumer-support-ticket-draft -- --repo <owner>/<repo>`
+- `npm run validation:consumer-startup-unblock-status -- --repo <owner>/<repo>`
+- `npm run validation:consumer-startup-triage -- --repo <owner>/<repo> --skip-workflow-lint`
+- `npm run validation:phase5-blockers-readiness`
+- optional strict mode:
+  - `npm run validation:phase5-blockers-readiness -- --require-adapter-report --adapter-report .audit-reports/adapter/adapter-real-session-report.md --consumer-triage-report .audit-reports/consumer-triage/consumer-startup-triage-report.md`
+- `npm run validation:phase5-execution-closure-status`
+- one-shot orchestrator:
+  - `npm run validation:phase5-execution-closure -- --repo <owner>/<repo> --out-dir .audit-reports/phase5 --skip-workflow-lint`
+- optional strict adapter mode:
+  - `npm run validation:phase5-execution-closure-status -- --require-adapter-readiness --phase5-blockers-report .audit-reports/phase5/phase5-blockers-readiness.md --consumer-unblock-report .audit-reports/consumer-triage/consumer-startup-unblock-status.md --adapter-readiness-report .audit-reports/adapter/adapter-readiness.md`
+- `npm run validation:adapter-readiness`
+- `npm run validation:adapter-session-status`
+- `npm run validation:adapter-real-session-report`
+
+## Hygiene Check
+
+Run documentation hygiene validation with:
+
+- `npm run validation:docs-hygiene`
+
+The same check is available in `npm run framework:menu` under the docs hygiene action.
+
+For repository skills drift protection, run:
+
+- `npm run skills:lock:check`
+
+That lock-freshness check is also available in `npm run framework:menu`.

package/docs/validation/adapter-hook-runtime-local-report.md

@@ -0,0 +1,45 @@
+# Adapter Hook Runtime - Local Validation Baseline
+
+## Purpose
+
+Define the expected local validation flow for Adapter hook runtime behavior before requesting a real IDE session replay.
+
+This document is a stable operational baseline and must not store machine-specific paths or one-off execution timestamps.
+
+## Required Commands
+
+1. `npm run install:adapter-hooks-config`
+2. `npm run verify:adapter-hooks-runtime`
+3. `npm run validate:adapter-hooks-local`
+4. `npm run assess:adapter-hooks-session:any`
+5. `bash legacy/scripts/hooks-system/infrastructure/cascade-hooks/collect-runtime-diagnostics.sh`
+
+Optional simulated payload checks:
+
+- `run-hook-with-node.sh pre-write-code-hook.js`
+- `run-hook-with-node.sh post-write-code-hook.js`
+
+## Expected Outcomes
+
+- Hooks config verification returns `verify OK`.
+- Simulated `pre_write_code` can block on known violations (for example, `common.error.empty_catch`).
+- Simulated `post_write_code` returns success when no violations are introduced.
+- Runtime diagnostics resolve a valid Node binary and version.
+- Session helper `assess:adapter-hooks-session:any` reports `PASS`.
+
+## Artifact Targets
+
+Capture local diagnostics under:
+
+- `docs/validation/adapter/artifacts/`
+- `.audit_tmp/`
+
+Store timestamped outputs there, not in this runbook.
+
+## Follow-Up
+
+After local baseline is green, execute the real IDE validation flow:
+
+- `docs/validation/adapter-hook-runtime-validation.md`
+
+If real-session checks fail, attach diagnostics in `docs/validation/adapter/artifacts/` and update the support status report.

package/docs/validation/adapter-hook-runtime-validation.md

@@ -0,0 +1,82 @@
+# Adapter Hook Runtime Validation
+
+Objective: validate `pre_write_code` and `post_write_code` runtime behavior in a real Adapter session after Node wrapper hardening.
+
+Scope note: this is an optional adapter-validation runbook and does not alter PRE_COMMIT/PRE_PUSH/CI gate decisions.
+
+## Preconditions
+
+- Repo checked out with latest `enterprise-refactor`.
+- Adapter config refreshed from current repo path:
+  - `npm run install:adapter-hooks-config`
+  - (alternative) `npm run print:adapter-hooks-config` and manually apply to your adapter hooks config file
+- Runtime/config wiring pre-check:
+  - `npm run verify:adapter-hooks-runtime`
+- Adapter hook config uses:
+  - `run-hook-with-node.sh pre-write-code-hook.js`
+  - `run-hook-with-node.sh post-write-code-hook.js`
+- Optional env toggles:
+  - `PUMUKI_HOOK_DIAGNOSTIC=1` (recommended during validation)
+  - `PUMUKI_HOOK_STRICT_NODE=1` (validate only after diagnostics are stable)
+
+## Steps
+
+1. Run local runtime diagnostics collector:
+   - `bash legacy/scripts/hooks-system/infrastructure/cascade-hooks/collect-runtime-diagnostics.sh`
+2. Open Adapter and trigger a normal write (`post_write_code` expected).
+3. Trigger a blocked write candidate (`pre_write_code` expected) with a known blocked pattern.
+4. Capture generated logs:
+   - `.audit_tmp/cascade-hook-runtime-*.log`
+   - `.audit_tmp/cascade-hook-smoke-*.log`
+   - `.audit_tmp/cascade-hook.log`
+   - `.audit_tmp/cascade-writes.log`
+5. Validate strict mode behavior:
+   - Enable `PUMUKI_HOOK_STRICT_NODE=1`.
+   - Repeat one `pre_write_code` write and confirm no false positive block when Node runtime is present.
+6. Record outcome summary:
+   - `PASS` if hooks execute and logs contain resolved `node_bin` and expected events.
+   - `FAIL` if runtime resolution is unstable or events are missing.
+
+7. Optional automatic assessment (last 24h by default):
+   - `npm run assess:adapter-hooks-session`
+   - default mode excludes simulated local events (`__pumuki_simulated__`)
+   - include simulated events:
+     - `npm run assess:adapter-hooks-session:any`
+   - custom lower bound:
+     - `bash legacy/scripts/hooks-system/infrastructure/cascade-hooks/assess-adapter-session.sh "2026-02-07T00:00:00.000Z"`
+   - consolidated report:
+     - `npm run validation:adapter-session-status -- --out .audit-reports/adapter/adapter-session-status.md`
+   - pre-filled real-session report:
+     - `npm run validation:adapter-real-session-report -- --status-report .audit-reports/adapter/adapter-session-status.md --out .audit-reports/adapter/adapter-real-session-report.md`
+
+## Known Failure Signature and Remediation
+
+If Adapter shows hook failures with:
+
+- `bash: node: command not found`
+- command path similar to:
+  - `.../node_modules/pumuki/.../pre-write-code-hook.js`
+  - `.../node_modules/pumuki/.../post-write-code-hook.js`
+
+then the active adapter hooks config is using a stale direct `node` invocation.
+
+Remediation:
+
+1. Reinstall hook config from the active framework repository:
+   - `npm run install:adapter-hooks-config`
+2. Verify wrapper wiring and runtime resolution:
+   - `npm run verify:adapter-hooks-runtime`
+3. Re-run a real Adapter write event and confirm hooks execute via:
+   - `run-hook-with-node.sh pre-write-code-hook.js`
+   - `run-hook-with-node.sh post-write-code-hook.js`
+4. Attach the updated adapter hooks config snippet and `.audit_tmp/cascade-hook-runtime-*.log` tail to validation evidence.
+
+## Evidence to attach
+
+- Hook config snippet (active adapter hooks config file).
+- Tail output from relevant `.audit_tmp` files.
+- Any console output showing runtime resolution failures.
+- Completed report based on:
+  - `docs/validation/adapter-real-session-report-template.md`
+  - or generated with:
+    - `npm run validation:adapter-real-session-report -- --status-report .audit-reports/adapter/adapter-session-status.md --out .audit-reports/adapter/adapter-real-session-report.md`

package/docs/validation/adapter-real-session-report-template.md

@@ -0,0 +1,63 @@
+# Adapter Hook Runtime - Real Session Report Template
+
+Use this template after executing `docs/validation/adapter-hook-runtime-validation.md`.
+
+You can generate a pre-filled report from available logs with:
+
+```bash
+npm run validation:adapter-real-session-report -- \
+  --status-report .audit-reports/adapter/adapter-session-status.md \
+  --out .audit-reports/adapter/adapter-real-session-report.md
+```
+
+## Metadata
+
+- Date:
+- Operator:
+- Branch:
+- Repository:
+- Adapter version:
+- Node runtime:
+- Hook config path:
+
+## Preconditions Check
+
+- `npm run install:adapter-hooks-config`: PASS/FAIL
+- `npm run verify:adapter-hooks-runtime`: PASS/FAIL
+- `PUMUKI_HOOK_DIAGNOSTIC=1`: ON/OFF
+- `PUMUKI_HOOK_STRICT_NODE=1`: ON/OFF
+
+## Real Session Steps
+
+1. Normal write action triggered in Adapter: PASS/FAIL
+2. Blocked candidate write action triggered in Adapter: PASS/FAIL
+3. Strict-node validation write action triggered: PASS/FAIL
+
+## Observed Runtime Signals
+
+- `pre_write_code` event observed: YES/NO
+- `post_write_code` event observed: YES/NO
+- `node_bin` resolved in runtime logs: YES/NO
+- Missing runtime events: YES/NO
+- Any `bash: node: command not found`: YES/NO
+
+## Captured Evidence
+
+- Active adapter hooks config snippet attached: YES/NO
+- `.audit_tmp/cascade-hook-runtime-*.log` tail attached: YES/NO
+- `.audit_tmp/cascade-hook-smoke-*.log` tail attached: YES/NO
+- `.audit_tmp/cascade-hook.log` tail attached: YES/NO
+- `.audit_tmp/cascade-writes.log` tail attached: YES/NO
+
+## Outcome
+
+- Validation result: PASS / FAIL
+- Summary:
+- Root cause (if failed):
+- Corrective action:
+- Re-test required: YES/NO
+
+## Follow-up
+
+- Update `docs/TODO.md` Adapter item status.
+- If failed, attach remediation plan and rerun command outputs.

package/docs/validation/consumer-ci-startup-failure-playbook.md

@@ -0,0 +1,184 @@
+# Consumer CI Startup Failure Playbook
+
+## Purpose
+
+Provide a deterministic troubleshooting sequence when consumer repository GitHub Actions runs fail with:
+
+- `conclusion: startup_failure`
+- `workflowName: ""`
+- run metadata `path: "BuildFailed"`
+- no emitted artifacts
+
+## Scope
+
+Use this playbook before expecting CI artifact URLs for rollout validation reports.
+
+This playbook is an operational diagnostics flow for external consumer repositories. It does not participate in deterministic PRE_COMMIT/PRE_PUSH/CI gate decisions inside this framework repository.
+
+## Diagnostic Steps
+
+1. Confirm Actions status and permissions:
+
+```bash
+gh api repos/<owner>/<repo>/actions/permissions
+gh api repos/<owner>/<repo>/actions/permissions/workflow
+gh api repos/<owner>/<repo>/actions/permissions/access
+```
+
+2. Inspect latest failed runs:
+
+```bash
+gh run list --repo <owner>/<repo> --limit 20 \
+  --json databaseId,workflowName,status,conclusion,url,createdAt,event
+```
+
+Alternative (framework helper, generates Markdown report):
+
+```bash
+npm run validation:consumer-ci-auth-check -- --repo <owner>/<repo> \
+  --out docs/validation/<repo>-consumer-ci-auth-check.md
+
+npm run validation:consumer-ci-artifacts -- --repo <owner>/<repo> --limit 20 \
+  --out docs/validation/<repo>-consumer-ci-artifacts-scan.md
+```
+
+Generate support payload bundle:
+
+```bash
+# One-shot triage orchestration (recommended)
+npm run validation:consumer-startup-triage -- \
+  --repo <owner>/<repo> \
+  --out-dir .audit-reports/consumer-triage \
+  --skip-workflow-lint
+
+# Optional: include workflow lint in the orchestration
+npm run validation:consumer-startup-triage -- \
+  --repo <owner>/<repo> \
+  --repo-path /absolute/path/to/consumer-repo \
+  --actionlint-bin /tmp/actionlint-bin/actionlint
+
+# Equivalent individual commands:
+npm run validation:consumer-support-bundle -- --repo <owner>/<repo> --limit 20 \
+  --out docs/validation/<repo>-consumer-support-bundle.md
+
+npm run validation:consumer-support-ticket-draft -- \
+  --repo <owner>/<repo> \
+  --support-bundle docs/validation/<repo>-consumer-support-bundle.md \
+  --auth-report docs/validation/<repo>-consumer-ci-auth-check.md \
+  --out docs/validation/<repo>-consumer-support-ticket-draft.md
+
+npm run validation:consumer-startup-unblock-status -- \
+  --repo <owner>/<repo> \
+  --support-bundle docs/validation/<repo>-consumer-support-bundle.md \
+  --auth-report docs/validation/<repo>-consumer-ci-auth-check.md \
+  --workflow-lint-report .audit-reports/consumer-triage/consumer-workflow-lint-report.md \
+  --out docs/validation/<repo>-consumer-startup-unblock-status.md
+```
+
+3. Inspect failing run metadata:
+
+```bash
+gh api repos/<owner>/<repo>/actions/runs/<run_id>
+```
+
+Check for:
+
+- empty `name`
+- `path: "BuildFailed"`
+- no `referenced_workflows`
+
+4. Inspect Actions check-suite metadata:
+
+```bash
+gh api repos/<owner>/<repo>/check-suites/<check_suite_id>
+```
+
+Check for:
+
+- `conclusion: startup_failure`
+- `latest_check_runs_count: 0`
+
+5. Validate workflow registration:
+
+```bash
+gh api repos/<owner>/<repo>/actions/workflows
+```
+
+If workflows are listed as `active` but runs still fail at startup, continue with YAML and policy verification.
+
+6. Validate workflow YAML locally:
+
+- Ensure every `.github/workflows/*.yml` parses cleanly.
+- Check for invalid keys, indentation issues, or disallowed expressions.
+- Verify reusable workflow references resolve and are accessible.
+- Run semantic lint checks (recommended `actionlint`) to catch invalid runner labels and unsupported action inputs.
+
+Framework helper (optional):
+
+```bash
+npm run validation:consumer-workflow-lint -- \
+  --repo-path /absolute/path/to/consumer-repo \
+  --actionlint-bin /tmp/actionlint-bin/actionlint \
+  --out .audit-reports/consumer-triage/consumer-workflow-lint-report.md
+```
+
+7. Validate repository/org policy constraints:
+
+- Required workflow policies
+- Organization restrictions on external actions
+- Required SHA pinning settings
+- Billing/quota limits for Actions
+- Public/private visibility constraints in current GitHub plan
+
+If billing visibility is blocked by token scopes:
+
+- refresh auth with `gh auth refresh -h github.com -s user`
+- complete device/browser authorization
+- query billing endpoint again:
+  - `gh api users/<username>/settings/billing/actions`
+
+8. Re-trigger a minimal workflow and verify:
+
+- run no longer exits at startup
+- workflow name is present
+- job graph is created
+- artifact API returns non-zero artifacts when upload steps exist
+
+Optional controlled check:
+
+- Temporarily change `actions/permissions/access` and trigger one `workflow_dispatch` run.
+- If startup failure is unchanged, revert to original value and continue policy/billing investigation.
+- Attempt to cancel one queued run:
+  - `gh run cancel <run_id> --repo <owner>/<repo>`
+  - if this returns `HTTP 500`, include it as additional escalation evidence.
+- Optionally apply a temporary branch-only workflow lint fix set and re-test:
+  - if startup failure is unchanged, treat repository/account-level constraints as primary suspects.
+
+Known example of semantic lint findings correlated with startup failures:
+
+- `runs-on: macos-13` unknown label (in affected consumer repo context)
+- unsupported input key (`assertions`) for `treosh/lighthouse-ci-action@v12`
+
+## Exit Criteria
+
+Startup-failure incident is considered resolved when:
+
+- new runs have valid workflow names and job graph
+- no startup-failure conclusions for target pipeline
+- artifact endpoints return expected evidence artifacts
+
+If unresolved after workflow and access-level checks:
+
+- escalate to repository owner account settings/billing review
+- open GitHub Support ticket with run URLs and check-suite metadata
+- use template: `docs/validation/github-support-ticket-template-startup-failure.md`
+
+## Related Reports
+
+- `.audit-reports/consumer-triage/consumer-ci-auth-check.md`
+- `docs/validation/archive/skills-rollout-consumer-ci-artifacts.md`
+- `docs/validation/archive/skills-rollout-mock_consumer-multi-platform-report.md`
+- `docs/validation/archive/private-actions-healthcheck.md`
+- `.audit-reports/consumer-triage/consumer-startup-failure-support-bundle.md`
+- `.audit-reports/consumer-triage/consumer-startup-triage-report.md`
+- `docs/validation/phase5-execution-closure.md`