rvlib-shipkit 0.11.0 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,205 @@
 # Changelog
 
+## 0.14.0 — 2026-07-27
+
+New rule SK008 — the mandated reviewer agent type. A repo declares
+`reviewer: { name, brief, tools? }` in `repo.config.ts`; the rule then
+requires `.claude/agents/<name>.md` to exist, carry that type name, point at
+the brief file (which must itself exist), and keep `tools:` inside a
+read-only ALLOWLIST (default `Read, Grep, Glob, Bash`; widen it deliberately
+with `reviewer.tools`). A denylist of today's edit-tool names would wave
+through anything that edits by proxy, and an ABSENT `tools:` line is the
+worst case: the harness inherits every tool. Fixable and create-only —
+`shipkit check --fix SK008` writes a valid definition when the file is
+missing and never overwrites an existing one, which may be hand-tuned.
+Undeclared repos skip, and `shipkit init` scaffolds the key commented out.
+`reviewerAgentIssues` is exported so a repo's own linter can enforce the same
+invariants in its pre-commit hook without a second implementation. Note the
+written agent file embeds the brief PATH: a repo that may go public should
+gitignore it and let the fixer regenerate it per machine.
+
+Contract rule `png(path, w, h, { atLeast: true })` — the venue's numbers as a
+MINIMUM at a fixed aspect ratio (relative tolerance), for stores that DISPLAY
+a size but accept larger uploads. Without it an exact-size rule fails a better
+2x asset and blocks the release it was meant to gate. Applied to the itch
+cover and the identity/discord image rules; Steam capsules stay exact, Valve
+mandates those.
+
+Dep: `rvlib-ts-tools` ^0.2.0 → ^0.3.0, so the zero-config `imports:check`
+floor task inherits its honest reporting (a run that scanned zero files now
+fails instead of printing green).
+
+MIGRATION: the itch venue contract gains a required `.rv-itch/listing.md`
+(every store-form field answered, paste-ready). A repo already shipping on itch
+will see one new FAIL until the file exists; the docs that own the itch
+contract carry a fill-in template for it.
+
+## 0.13.0 — 2026-07-26
+
+Stable rule ids. Every built-in invariant `shipkit check` enforces is now
+an SK rule — one module per rule (`src/rules/SK###-<slug>.ts`), one
+registry (`rule-registry.ts`, throws at import on a duplicate or malformed
+id), ids never reused or renumbered. The two existing built-ins migrated
+whole: SK001 package.json shape (was `core/package-json-check.ts`, deleted),
+SK002 `.rv-*` contracts fulfillness. Line text changed on every consumer:
+rule-emitted `ok:`/`WARN`/`FAIL:`/`skip:` lines now carry a `[SK###]` tag
+after the wire prefix — on `check`, `shipkit contracts`, AND the ci
+`contracts` task (one tagged rendering path,
+`contracts/apply-contracts.ts`; `contractsConfigFrom`/`activeContracts`/
+`applyContractsResult` moved there, still exported from the barrel). A
+failing/warning rule always carries at least one `fix:` pointer (the
+framework appends `docsBase + rule.owner` when the lint attached none).
+New command: `shipkit rules [--json]` — the id catalog (plain lines, not
+wire). Wire prefixes themselves are unchanged; matchers keying on prefixes
+are unaffected.
+
+`shipkit check --fix [SK### …]`: rules may carry an idempotent `fix()` —
+apply, re-lint, show the real end state; never cached, never under ci;
+unknown/unfixable ids fail loud. First fixers: SK001 (private:true, license
+removal, canonical scripts from the ONE shared module
+`core/canonical-scripts.ts` that `shipkit init` also scaffolds from —
+bodies the vocabulary page doesn't state are named in the summary, never
+invented; rvlib-* roots refused), SK003 CLAUDE.md include-index (new rule:
+prose/extra lines/inverted order/untracked-CLAUDE.local.md FAIL; fix routes
+a missing `@./agent/index.md` on an EXISTING file, never creates one),
+SK004 `.gitignore` policy block (new rule: marker-keyed managed block of
+the always-gitignored contract surfaces + tmp/; a well-formed block is
+rewritten IN PLACE so below-block `!`-overrides keep winning; CRLF files
+keep their EOL; repo lines outside the block never touched;
+`defineRepo({ gitignore: [...] })` contributes repo lines INSIDE the
+block, for names a published lib may not carry; `shipkit init` — fresh or
+re-run on an existing repo — writes it through the same fixer). A failing
+rule's fix pointers advertise `autofix: shipkit check --fix SK###`; the
+post-fix re-lint strips the advertisement and an unchanged fix reports as
+a note, not a WARN; `--fix` rejects `--json` and closes with a count of
+rules no fixer covers. SK001's fixer refuses field flips on anything
+publish-marked (files/exports/publishConfig/prepublishOnly) and never
+duplicates a script a banned alias already satisfies.
+
+SK005 rvlib versions: every `rvlib-*` dep is compared (real semver order,
+so a dist-tag pointing BEHIND the installed version is reported, never a
+silent downgrade) to npm latest on each `shipkit check` (rules may now
+declare `ttl` — SK005 caches clean passes 24h; registry unreachable = loud
+skip, never red; a `link:` dep that does not resolve is a FAIL instead of
+a cryptic import crash). When a newer version is live the rule
+SELF-UPDATES: `bun update --latest`, run by the lint itself, only when
+package.json/lockfile are git-clean (else WARN deferred), never under ci;
+the applied update itself reports as WARN — the repo was mutated and a
+restart+commit is owed, so it lands on the attention surface and is never
+cached. New `shipkit check --frozen` (or standing `SHIPKIT_FROZEN=1`)
+reports drift without touching anything; the flag threads through
+`CheckOpts` so doctor/TUI/hub callers can pass it too. Committing the bump
+stays with the working agent — shipkit never commits. Suite-level fix
+riding along: a TTL'd check that emitted a `skip` line is no longer
+cached — "only clean passes replay" is now literally true (a dead
+registry was being restated as fact for 24h).
+
+SK006 npm publish safety: a `private: true` package carrying publishConfig
+/ prepublish* scripts / an npm-publishing `publish` script FAILs — the
+machinery is dead weight while private holds and a loaded gun the day it
+flips; rvlib-* roots exempt; lint-only on purpose (a `publish` script may
+deploy a site). SK007 github visibility: new repo.config
+`visibility: 'private' | 'public'` (absent = private, defineRepo validates)
+vs `gh repo view --json isPrivate` — mismatch FAILs in BOTH directions
+(public-while-declared-private is the leak case), 7d clean-pass cache,
+every unverifiable path (no gh, no remote, gh error) a loud skip that is
+never red and never cached.
+
+Motherhome reporting: `check`/`ci` (and `init` on an already-configured
+repo) upsert one row for the repo — name, path, version (`+src` suffix
+when consumed by path/link), npm|link|file|path mode, last-seen day —
+into `<docsBase>/build/shipkit/local-projects.md`, ONLY when that page
+already exists on this disk. The lib never creates the page and never
+writes into a relative or URL docsBase — a consumer using docsBase as a
+plain fix-pointer prefix will never find surprise files in its docs tree.
+Whole read-modify-write under a file lock with atomic rename
+(core/locked-write, extracted from write-status — one lock concern),
+dead-path rows pruned, data-change-or->7d churn control, every failure a
+WARN note that never breaks the calling command.
+
+## 0.12.0 — 2026-07-23
+
+ONE server, ONE page. `shipkit serve` runs the repo's single `Bun.serve`,
+and `/` is the single surface: a mobx+react app (Bun HTML import, no build
+step) holding the full media atelier (rolls, compare, pick, geometry
+overlay, custom panels, uploads, generate queue) plus foldable sections
+for asks, creds, posts, health (STATUS.md + streaming check runner) and
+graphs (each lint-checked), with a segmented severity filter (all · needs ·
+red) at `/?f=needs` / `/?f=red` (legacy `/?needs=1` reads as needs) and
+hash deep-links (`#<asset-id>` / `#cat-<Category>`).
+Kit-less repos serve the same page with no media section. Graph canvases
+stay as drill-down pages (`/graph/wiki`, `/graph/agent`) with a home link.
+
+New:
+
+- Navigation on the one page: a thin icon RAIL that scrolls/unfolds to a
+  section (red dot when it holds a red item — never a separate page), a
+  sidebar SEARCH filtering rows and grid cards, a `cmd+j` palette jumping
+  to any item or section.
+- Instances carry `md` (truth-file markdown body, frontmatter stripped,
+  4000-char cap): cards render it via marked (GFM — tables render) behind
+  a sanitize-html allowlist — clamped in the grid, full in the item view.
+- Secret cards presented properly: mono name, service line,
+  present/missing chip, mint link; copy block only when missing.
+- Roll strips: newest first with a stable tiebreak; the generating
+  spinner tile sits at the START of the strip.
+- Every section has BOTH views: title → collection view (one card per
+  instance in the stage), row/card → item view with a back link. A graph's
+  item view EMBEDS the graph (iframe of /graph/*), never a bare link.
+- Sections show everything, always: asks include the done/ archive
+  (quiet, remarkable — consult past answers), the secrets section lists
+  every repo-declared cred (present = quiet, missing = red with the mint
+  artifact); section headers render even at 0 items. "needs" is THE
+  waiting-on-me filter, "red" the hard-blocked cut.
+- Watch mode is the house default for the hub script
+  (`bun --watch … serve`, `shipkit init` scaffolds it): lib/config edits
+  restart the server live. Accepted tradeoff: a restart drops in-memory
+  queue state (`assets fill` recovers).
+- `serve.publicHost` (repo.config): off-machine hostname printed beside
+  localhost and appended to ping messages — a phone can't resolve
+  localhost.
+- `/api/collections.json`: browse-all — every instance of every
+  collection, healthy included (quiet tiles), rendered as foldable
+  sections with red/yellow dots.
+- Trust surface: instances carry `file` (the git file the tile IS — shown
+  on the card; the file always wins) and `img` (thumbnails via the media
+  API).
+- Remarks: cards AND the asset view have a remark box; `/api/act/remark`
+  routes the text into the item's own file (post `## Feedback`, the ask
+  file, or `.rv-assets/notes.md` for media) and it returns as `remarks`
+  on the instance — `shipkit needs --json` briefs agents on them at boot.
+- Posted/rejected post history is VISIBLE (quiet), no longer hidden;
+  media collections list ALL kit assets, not only needing ones.
+- `shipkit reflect [repo…] [--short --out <dir> --json]`: your prompts
+  across every Claude Code session of a repo, chronological md corpus for a
+  retrospective. Corpus fidelity is the whole feature — it unions EVERY
+  config root on the machine (`$CLAUDE_CONFIG_DIR` plus `~/.claude` plus
+  sibling `~/.claude-<account>`; honoring only the env var hides the account
+  you are not currently running as), scans worktree session dirs, includes
+  the prompts you QUEUED while the agent was working (`queue-operation`
+  entries, marked `origin: 'queued'` — they carry mid-run corrections and
+  standing instructions, and when a run ends first they never become user
+  messages at all), drops harness-authored user entries (tool results,
+  command wrappers, compaction summaries, subagent prompts, SDK-driven
+  sessions), rescues the text you typed inside a slash command, strips
+  reminder blocks appended inside real prompts, recovers pruned sessions
+  from `sessions-index.json`, and removes only MECHANICAL copies — a
+  replayed entry, or a queued prompt arriving again as a message — so real
+  repetition (saying it twice) survives in the corpus. `--json` emits one
+  shape whatever the run looked like: `[{repo, prompts, error?}]`.
+
+BREAKING (0.11.0 → 0.12.0):
+
+- `shipkit assets serve` DELETED — the studio UI rides the hub page; the
+  media API mounts at `/media/*` (was `/assets/*` under the hub).
+- `serveStudio`, `Studio`, `studioPage`, `withRail` exports DELETED
+  (`studioRoutes` stays — it IS the media API).
+- `kit.port` DELETED from `defineKit` (nothing standalone listens anymore).
+- `/status` and `/assets/` pages DELETED (404, no redirect); the check
+  stream moved `/status/run` → `/api/check/run`; the vanilla
+  template-string studio SPA and the injected rail are gone — the react
+  app is the only UI code path.
+
 ## 0.11.0 — 2026-07-23
 
 The needs feed: the hub's `/` now answers "what needs a human right now,

package/README.md

@@ -34,16 +34,30 @@ shipkit ci        commit gate: floor (lint/typecheck/test/imports/cycles —
                   + your tasks, parallel DAG; refreshes STATUS.md
                   [--bail --skip g --only id --json]
 shipkit contracts release-contract fulfillness alone       [--venue v --json]
-shipkit check     periodic health: every *.check.ts in the repo,
-                  auto-discovered + TTL-cached              [--json --fresh]
+shipkit check     periodic health: built-in SK rules + every *.check.ts in
+                  the repo, auto-discovered + TTL-cached
+                  [--json --fresh --frozen --fix [SK### …]]
+                  --fix applies rule autofixes then re-lints; --frozen =
+                  self-maintaining rules (rvlib self-update) report only
+shipkit rules     the SK rule catalog: id, what it lints, owning doc,
+                  fixable?                                          [--json]
 shipkit tui       live dashboard: ci tasks + discovered checks + panels
                   the repo injects via repo.config tui.panels
 shipkit asks      human action queue: list · ask "<title>" · asks check (auto-close)
+shipkit needs     everything blocked on a human, red/yellow by collection
+                  report-only, exit 0 always                            [--json]
 shipkit wiki      serve|lint — live md link-graph + orphan/dangling-ref lint
+shipkit mv        rename an md page + its sibling dir, sweeping every ref
 shipkit assets    serve|fill|add|gen|identity|check — the asset atelier
                   (declare kinds in .rv-assets/kit.ts, roll, curate, ship)
+shipkit serve     the repo's ONE server: hub page, graphs, studio, status
+shipkit reflect   your prompts across every Claude Code session of a repo:
+                  all config roots, queued-mid-run ones included, harness
+                  noise out, chronological md corpus for a retrospective
+                                         [repo…] [--short --out <dir> --json]
 shipkit init      scaffold config + scripts, print the resolved floor
                   [--bin <cli.ts path> for in-repo-source consumers]
+shipkit start     ensure <root>/<name> + its CLAUDE.md include; prints the dir
 ```
 
 Output is a stable line protocol — `ok:` / `WARN` / `FAIL:` / `skip:` with
@@ -67,7 +81,7 @@ Ship your own contracts via `contracts: { extra: [defineContract({...})] }`
 Everything the CLI does is importable: `runTasks`, `CheckSuite`,
 `evaluateContracts`, the asks queue, `scanMdGraph`/`lintMd`/`serveMdGraph`,
 and the assets surface (`defineKit`/`defineKind`, `identityKinds`,
-`serveStudio`, `saveEndpoint` via `rvlib-shipkit/vite`).
+`studioRoutes`, `saveEndpoint` via `rvlib-shipkit/vite`).
 Ships TypeScript source; Bun ≥ 1.0.
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "rvlib-shipkit",
-    "version": "0.11.0",
+    "version": "0.14.0",
     "description": "All-in-one repo companion: ci gate (task DAG), auto-discovered health checks, release-contract fulfillness, asks queue, md-wiki tools, asset atelier, live tui",
     "license": "MIT",
     "type": "module",
@@ -21,17 +21,20 @@
     "devDependencies": {
         "@types/bun": "^1.3.14",
         "@types/react": "^19.2.17",
-        "@types/react-dom": "^19.2.3"
+        "@types/react-dom": "^19.2.3",
+        "@types/sanitize-html": "^2.16.1"
     },
     "dependencies": {
         "@napi-rs/canvas": "^1.0.2",
         "clipanion": "^4.0.0-rc.4",
         "ink": "^7.1.1",
+        "marked": "^18.0.7",
         "mobx": "^6.16.1",
         "mobx-react-lite": "^4.1.1",
         "react": "^19.2.7",
         "react-dom": "^19.2.7",
-        "rvlib-ts-tools": "^0.2.0",
+        "rvlib-ts-tools": "^0.3.0",
+        "sanitize-html": "^2.17.6",
         "sharp": "^0.35.3"
     }
 }

package/src/asks/asks-queue.ts

@@ -45,6 +45,14 @@ export function openAsks(dir: string): Ask[] {
     return listAsks(dir).filter((a) => a.status !== 'done')
 }
 
+/** the <dir>/done archive, newest-first — READ-ONLY: never mints the dir
+ *  (numeric filename prefixes are creation order, so reverse-sort = newest) */
+export function doneAsks(dir: string): Ask[] {
+    const done = join(dir, 'done')
+    if (!existsSync(done)) return []
+    return readdirSync(done).filter((f) => f.endsWith('.md')).sort().reverse().map((f) => parse(done, f))
+}
+
 export function checkAsks(dir: string, print: (line: string) => void = console.log): { closed: number } {
     const done = join(dir, 'done')
     mkdirSync(done, { recursive: true })

package/src/assets/kit-config.ts

@@ -112,14 +112,13 @@ export type Kind = {
 }
 
 export type KitConfig = {
-    port?: number
     /** roll workspace root, repo-root-relative; gitignored */
     workspace?: string
     comfy?: { host: string; workflows: string; heal?: string }
     kinds: Kind[]
 }
 
-export type ResolvedKit = KitConfig & { port: number; workspace: string }
+export type ResolvedKit = KitConfig & { workspace: string }
 
 export function validateKit(k: KitConfig): string[] {
     const errs: string[] = []
@@ -190,7 +189,7 @@ export function missingPanelScripts(kit: KitConfig, root: string): string[] {
 export function defineKit(k: KitConfig): ResolvedKit {
     const errs = validateKit(k)
     if (errs.length > 0) throw new Error(`invalid kit:\n  ${errs.join('\n  ')}`)
-    return { ...k, port: k.port ?? 4800, workspace: k.workspace ?? '.rv-assets/out' }
+    return { ...k, workspace: k.workspace ?? '.rv-assets/out' }
 }
 
 export const defineKind = (k: Kind): Kind => k

package/src/assets/roll-workspace.ts

@@ -25,7 +25,8 @@ export function listRolls(dir: string): string[] {
     if (!existsSync(dir)) return []
     return readdirSync(dir)
         .filter(isRollFile)
-        .sort((a, b) => statSync(join(dir, b)).mtimeMs - statSync(join(dir, a)).mtimeMs) // newest first
+        // newest first; filename tiebreak — same-second batches must not shuffle between polls
+        .sort((a, b) => statSync(join(dir, b)).mtimeMs - statSync(join(dir, a)).mtimeMs || a.localeCompare(b))
 }
 
 export const pickPath = (dir: string): string => join(dir, 'pick.json')

package/src/assets/run-assets.ts

@@ -10,8 +10,6 @@ import { loadWorkflows } from './gen/workflow-loader.ts'
 import { allAssets, findAsset, loadKit, type ResolvedKit } from './kit-config.ts'
 import { NO_PICK_FIX, renderIdentity, type Brand } from './kits/identity-kit.ts'
 import { assetDir, listRolls, readPick, readPromptOverlay } from './roll-workspace.ts'
-import { page } from './server/studio-page.ts'
-import { serveStudio } from './server/studio-server.ts'
 
 export type Print = (line: string) => void
 export type AssetsIo = { print: Print; printErr: Print }
@@ -61,15 +59,6 @@ async function guarded(io: AssetsIo, body: () => Promise<number>): Promise<numbe
     }
 }
 
-export const runAssetsServe = (root: string, io: AssetsIo): Promise<number> =>
-    guarded(io, async () => {
-        const kit = await loadKit(root)
-        const studio = await serveStudio({ kit, root, page })
-        io.print(`ok: studio → http://127.0.0.1:${studio.server.port}  (${allAssets(kit).length} assets)`)
-        await new Promise(() => {}) // Bun.serve owns the process — never resolve
-        return 0
-    })
-
 export const runAssetsTopUp = (root: string, io: AssetsIo, o: { mode: 'fill' | 'add'; n: number; categories: string[] }): Promise<number> =>
     guarded(io, async () => {
         const kit = await loadKit(root)

package/src/assets/server/studio-server.ts

@@ -1,6 +1,7 @@
 // The studio HTTP server — roll variants, compare, pick, geometry metadata,
-// category grid data. 127.0.0.1 ONLY, forever. Never run with --watch: the
-// queue is in-memory (fill is the recovery path).
+// category grid data. 127.0.0.1 ONLY, forever. Watch-mode restarts drop the
+// in-memory queue — accepted tradeoff (his order 2026-07-23); `shipkit
+// assets fill` is the recovery path.
 //
 // ids/names are validated against the kit + the roll-file regex — no path
 // from the client ever reaches the filesystem unchecked.
@@ -20,14 +21,11 @@ import { StudioQueue } from './studio-queue.ts'
 export type StudioDeps = {
     kit: ResolvedKit
     root: string
-    page: () => string
     /** test seam — defaults to the real engines. `context` = a derived
      *  asset's resolved parent picks (queue resolves it at run time) */
     generateOne?: (found: FoundAsset, prompt: string, seed: number, destDir: string, onProgress?: OnProgress, context?: ParentContext) => Promise<void>
 }
 
-export type Studio = { server: ReturnType<typeof Bun.serve>; queue: StudioQueue; stop: () => void }
-
 // what the studio detail view shows about an asset's plumbing (W2-2)
 export type AssetInfo = {
     backend: 'canvas' | 'comfy' | 'manual' | 'gemini'
@@ -42,9 +40,9 @@ export type AssetInfo = {
     kitSource: string
 }
 
-// the studio's route table without a server: `handle` answers the studio's
-// own path space ('/', '/api/…', '/img', '/panel/…') so serveStudio can own
-// a port AND the shipkit hub can mount the same routes under /assets/.
+// the studio's route table without a server: `handle` answers the media
+// path space ('/api/…', '/img', '/panel/…'); the hub — the repo's ONE
+// server — mounts it under /media/*. The page itself is the hub's react app.
 export type StudioRoutes = { handle: (req: Request, pathname: string) => Promise<Response>; queue: StudioQueue }
 
 export async function studioRoutes(deps: StudioDeps): Promise<StudioRoutes> {
@@ -220,8 +218,6 @@ export async function studioRoutes(deps: StudioDeps): Promise<StudioRoutes> {
         const q = (k: string): string => url.searchParams.get(k) ?? ''
         const body = async (): Promise<Record<string, unknown>> => (await req.json().catch(() => ({}))) as Record<string, unknown>
 
-        if (pathname === '/') return new Response(deps.page(), { headers: { 'Content-Type': 'text/html; charset=utf-8' } })
-
         if (pathname === '/api/state') {
             const assets = await Promise.all(allAssets(kit).map(async (f) => {
                 const dir = dirOf(f.asset.id)
@@ -242,7 +238,7 @@ export async function studioRoutes(deps: StudioDeps): Promise<StudioRoutes> {
             const dir = dirOf(f.asset.id)
             const pick = await readPick(dir)
             const rolls = listRolls(dir).map((name) => ({ name, picked: name === pick.pick, alt: pick.alts.includes(name), hasMeta: existsSync(metaPath(dir, name)) }))
-            const custom = customPanelsOf(f).map((p) => ({ id: p.id, kind: f.kind.id, url: `./panel/${encodeURIComponent(f.kind.id)}/${encodeURIComponent(p.id)}.js` }))
+            const custom = customPanelsOf(f).map((p) => ({ id: p.id, kind: f.kind.id, url: `panel/${encodeURIComponent(f.kind.id)}/${encodeURIComponent(p.id)}.js` }))
             return json({ asset: { ...f.asset, prompt: await promptOf(f), cat: f.kind.category, geometry: geometryOf(f) != null, custom }, info: infoOf(f), rolls, pick })
         }
 
@@ -472,16 +468,3 @@ export async function studioRoutes(deps: StudioDeps): Promise<StudioRoutes> {
 
     return { handle, queue }
 }
-
-// standalone studio server (`shipkit assets serve`): the same routes on
-// their own port. The hub (`shipkit serve`) mounts studioRoutes under
-// /assets/ instead — one route table, two front doors.
-export async function serveStudio(deps: StudioDeps): Promise<Studio> {
-    const routes = await studioRoutes(deps)
-    const server = Bun.serve({
-        hostname: '127.0.0.1',
-        port: deps.kit.port,
-        fetch: (req) => routes.handle(req, new URL(req.url).pathname),
-    })
-    return { server, queue: routes.queue, stop: () => server.stop(true) }
-}

package/src/cli/cmd_Assets.ts

@@ -2,26 +2,15 @@
 // (ComfyUI or procedural canvas), curate in the studio, ship with metadata
 // write-through. Thin clipanion surfaces; logic in assets/run-assets.ts.
 import { Command, Option } from 'clipanion'
-import { runAssetsCheck, runAssetsGen, runAssetsIdentity, runAssetsServe, runAssetsTopUp, type AssetsIo } from '../assets/run-assets.ts'
+import { runAssetsCheck, runAssetsGen, runAssetsIdentity, runAssetsTopUp, type AssetsIo } from '../assets/run-assets.ts'
 
 const ioOf = (cmd: Command): AssetsIo => ({
     print: (l) => cmd.context.stdout.write(`${l}\n`),
     printErr: (l) => cmd.context.stderr.write(`${l}\n`),
 })
 
-export class AssetsServeCommand extends Command {
-    static override paths = [['assets', 'serve']]
-
-    static override usage = Command.Usage({
-        category: 'Assets',
-        description: 'the studio — roll, curate, pick, ship (127.0.0.1, kit port)',
-        examples: [['launch the studio for the cwd kit', 'shipkit assets serve']],
-    })
-
-    async execute(): Promise<number> {
-        return runAssetsServe(process.cwd(), ioOf(this))
-    }
-}
+// the studio UI has no standalone server command — it rides the hub page
+// (`shipkit serve`, the repo's ONE Bun.serve)
 
 export class AssetsFillCommand extends Command {
     static override paths = [['assets', 'fill']]

package/src/cli/cmd_Check.ts

@@ -1,27 +1,45 @@
-// shipkit check — periodic health, TTL-cached. Thin clipanion surface;
-// logic in core/run-check.ts.
+// shipkit check — periodic health, TTL-cached; `--fix` applies rule
+// autofixes then re-lints. Thin clipanion surface; logic in
+// core/run-check.ts and rules/run-fix.ts. ci NEVER fixes.
 import { Command, Option } from 'clipanion'
 import { runCheck } from '../core/run-check.ts'
+import { runFix } from '../rules/run-fix.ts'
 
 export class CheckCommand extends Command {
     static override paths = [['check']]
 
     static override usage = Command.Usage({
         category: 'Health',
-        description: 'periodic health: contracts + every *.check.ts in the repo (auto-discovered, run as subprocesses), clean passes replay from a TTL cache',
+        description: 'periodic health: SK rules + every *.check.ts in the repo (auto-discovered, run as subprocesses), clean passes replay from a TTL cache; --fix applies rule autofixes',
         examples: [
             ['run (cached where valid)', 'shipkit check'],
             ['bust every cache layer', 'shipkit check --fresh'],
+            ['apply every rule autofix, re-lint', 'shipkit check --fix'],
+            ['fix one rule', 'shipkit check --fix SK004'],
+            ['report-only: self-maintaining rules never write', 'shipkit check --frozen'],
             ['machine-readable', 'shipkit check --json'],
         ],
     })
 
     json = Option.Boolean('--json', false, { description: 'machine-readable result instead of wire lines' })
     fresh = Option.Boolean('--fresh', false, { description: 'bust every TTL cache layer (travels to child checks)' })
+    fix = Option.Boolean('--fix', false, { description: 'apply rule autofixes (all fixable rules, or only the listed SK ids), then re-lint' })
+    frozen = Option.Boolean('--frozen', false, { description: 'report-only mode for self-maintaining rules (SK005 never touches package.json)' })
+    fixIds = Option.Rest()
 
     async execute(): Promise<number> {
         try {
-            return await runCheck(process.cwd(), { json: this.json, fresh: this.fresh, print: (l) => this.context.stdout.write(`${l}\n`) })
+            if (this.fixIds.length > 0 && !this.fix) {
+                this.context.stderr.write(`FAIL: rule ids need --fix (shipkit check --fix ${this.fixIds.join(' ')})\n`)
+                return 2
+            }
+            if (this.fix && this.json) {
+                this.context.stderr.write('FAIL: --fix has no --json shape — run the fix, then `shipkit check --json` for state\n')
+                return 2
+            }
+            if (this.fix)
+                return await runFix(process.cwd(), { ids: this.fixIds, print: (l) => this.context.stdout.write(`${l}\n`) })
+            return await runCheck(process.cwd(), { json: this.json, fresh: this.fresh, frozen: this.frozen, print: (l) => this.context.stdout.write(`${l}\n`) })
         } catch (e) {
             this.context.stderr.write(`FAIL: ${e instanceof Error ? e.message : String(e)}\n`)
             return 1

package/src/cli/cmd_Reflect.ts

@@ -0,0 +1,116 @@
+// shipkit reflect — the user's typed prompts across every Claude Code session
+// of a repo, as a chronological corpus for retrospective extraction passes.
+// REPORT-ONLY: exit 0 with prompts, 1 when a repo has no transcripts (loud,
+// naming the config roots that were searched).
+import { mkdirSync, writeFileSync } from 'fs'
+import { basename, join, resolve } from 'path'
+import { Command, Option } from 'clipanion'
+import { type PromptEntry, collectRepoPrompts, corpusMarkdown, projectSlug } from '../reflect/prompt-corpus.ts'
+
+const SHORT_MAX_LINES = 20
+
+/** the --json unit: one per requested repo, failures carried in-band */
+export type RepoDoc = { repo: string; prompts: PromptEntry[]; error?: string }
+
+export class ReflectCommand extends Command {
+    static override paths = [['reflect']]
+
+    static override usage = Command.Usage({
+        category: 'Health',
+        description:
+            "the user's typed prompts across every Claude Code session of a repo — chronological md corpus for retrospectives",
+        examples: [
+            ['corpus for the current repo', 'shipkit reflect'],
+            ['corpus for other repos', 'shipkit reflect ~/dev/one-repo ~/dev/another-repo'],
+            ['drop the long pastes', 'shipkit reflect --short'],
+            ['batch to files instead of stdout', 'shipkit reflect ~/dev/a ~/dev/b --out stats'],
+            ['machine-readable', 'shipkit reflect --json'],
+        ],
+    })
+
+    repoPaths = Option.Rest()
+    json = Option.Boolean('--json', false, { description: 'emit [{repo, prompts, error?}] JSON — same shape for 1 or N repos' })
+    short = Option.Boolean('--short', false, { description: `only prompts of ${SHORT_MAX_LINES} lines or fewer` })
+    out = Option.String('--out', { description: 'write <repo>[.short].md (or .json) per repo into this dir instead of stdout' })
+
+    async execute(): Promise<number> {
+        const repos = this.repoPaths.length > 0 ? this.repoPaths : [process.cwd()]
+        if (this.out != null) mkdirSync(this.out, { recursive: true })
+        let failed = false
+        const jsonDocs: RepoDoc[] = []
+        for (const repo of repos) {
+            const { prompts, dirs, roots } = collectRepoPrompts(repo)
+            const kept = this.short ? prompts.filter((p) => p.text.split('\n').length <= SHORT_MAX_LINES) : prompts
+            if (kept.length === 0) {
+                const error = this.fail(repo, prompts.length, roots)
+                failed = true
+                if (this.json) jsonDocs.push({ repo: resolve(repo), prompts: [], error })
+                continue
+            }
+            if (this.json) jsonDocs.push({ repo: resolve(repo), prompts: kept })
+            else this.emitMarkdown(repo, kept, dirs)
+        }
+        if (this.json) this.emitJson(jsonDocs)
+        return failed ? 1 : 0
+    }
+
+    /** one FAIL line per repo, and a fix that is not "do what you just did".
+     * Returns the same reason for the --json payload: a consumer must not have
+     * to diff stderr against stdout to learn a repo produced nothing. */
+    private fail(repo: string, total: number, roots: string[]): string {
+        const e = this.context.stderr
+        if (this.short && total > 0) {
+            const reason = `${total} prompts, none of ${SHORT_MAX_LINES} lines or fewer`
+            e.write(`FAIL: ${resolve(repo)}: ${reason}\n`)
+            e.write(`      fix: drop --short\n`)
+            return reason
+        }
+        e.write(`FAIL: no typed prompts for ${resolve(repo)}\n`)
+        e.write(`      looked for projects/${projectSlug(repo)}* under: ${roots.join(' · ')}\n`)
+        e.write(
+            this.repoPaths.length === 0
+                ? `      fix: this repo has no Claude Code sessions — name another, shipkit reflect ~/dev/<repo>\n`
+                : `      fix: check the path (it is slugged verbatim) — a session dir appears only after a session ran there\n`,
+        )
+        return 'no typed prompts'
+    }
+
+    /** ONE shape whatever the run looked like: RepoDoc[], failures included with
+     * their reason. A data-dependent schema breaks every consumer eventually. */
+    private emitJson(docs: RepoDoc[]): void {
+        if (this.out == null) {
+            this.context.stdout.write(`${JSON.stringify(docs, null, 2)}\n`)
+            return
+        }
+        for (const d of docs) {
+            if (d.error != null) continue
+            const file = this.outFile(d.repo, '.json')
+            writeFileSync(file, `${JSON.stringify(d, null, 2)}\n`)
+            this.context.stdout.write(`ok: ${this.counts(d.prompts)} → ${file}\n`)
+        }
+    }
+
+    /** queued prompts are the ones typed mid-run: say how many, so a future hole
+     * in that path is visible instead of silent */
+    private counts(prompts: PromptEntry[]): string {
+        const queued = prompts.filter((p) => p.origin === 'queued').length
+        const base = `${String(prompts.length).padStart(4)} prompts`
+        return queued === 0 ? base : `${base} (${queued} queued mid-run)`
+    }
+
+    private emitMarkdown(repo: string, prompts: PromptEntry[], dirs: string[]): void {
+        const md = corpusMarkdown(repo, prompts)
+        if (this.out == null) {
+            this.context.stdout.write(md)
+            return
+        }
+        const file = this.outFile(repo, '.md')
+        writeFileSync(file, md)
+        this.context.stdout.write(`ok: ${this.counts(prompts)} → ${file} (${dirs.length} session dir(s))\n`)
+    }
+
+    /** --short writes its OWN file: the filtered corpus must never overwrite the full one */
+    private outFile(repo: string, ext: string): string {
+        return join(this.out ?? '.', `${basename(resolve(repo))}${this.short ? '.short' : ''}${ext}`)
+    }
+}