simt-dev 0.2.1 → 0.2.2

package/rules/stacks/dart.md

@@ -2,6 +2,8 @@
 simt-id: dart
 simt-title: Dart
 simt-applies: [has-pubspec]
+simt-priority: convention
+simt-scope: ["pubspec.yaml", "**/*.dart"]
 ---
 
 # Stack profile: Dart

package/rules/stacks/deno.md

@@ -2,6 +2,8 @@
 simt-id: deno
 simt-title: Deno
 simt-applies: [has-deno-config]
+simt-priority: convention
+simt-scope: ["deno.json", "deno.jsonc", "**/*.ts"]
 ---
 
 # Stack profile: Deno

package/rules/stacks/dotnet.md

@@ -2,6 +2,8 @@
 simt-id: dotnet
 simt-title: .NET
 simt-applies: [has-nuget]
+simt-priority: convention
+simt-scope: ["*.csproj", "*.sln", "*.fsproj"]
 ---
 
 # Stack profile: .NET

package/rules/stacks/elixir.md

@@ -2,6 +2,8 @@
 simt-id: elixir
 simt-title: Elixir
 simt-applies: [has-mix]
+simt-priority: convention
+simt-scope: ["mix.exs", "lib/**/*.ex"]
 ---
 
 # Stack profile: Elixir

package/rules/stacks/go.md

@@ -2,6 +2,8 @@
 simt-id: go
 simt-title: Go
 simt-applies: [has-go-mod]
+simt-priority: convention
+simt-scope: ["go.mod", "**/*.go"]
 ---
 
 # Stack profile: Go

package/rules/stacks/jvm.md

@@ -6,6 +6,8 @@ simt-title: JVM backend
 # or Ktor service received rules about Compose, Wear OS application ids and
 # instrumentation tests — advice with nothing to apply it to (S28, ADR-047).
 simt-applies: [gradle, has-maven-pom, kotlin, java]
+simt-priority: convention
+simt-scope: ["build.gradle", "build.gradle.kts", "pom.xml", "settings.gradle", "settings.gradle.kts"]
 ---
 
 # Stack profile: JVM backend

package/rules/stacks/node.md

@@ -2,6 +2,8 @@
 simt-id: node
 simt-title: Node (general)
 simt-applies: [node]
+simt-priority: convention
+simt-scope: ["package.json", "tsconfig.json", "jsconfig.json", ".nvmrc"]
 simt-fallback: true
 ---
 

package/rules/stacks/python.md

@@ -2,6 +2,8 @@
 simt-id: python
 simt-title: Python
 simt-applies: [python]
+simt-priority: convention
+simt-scope: ["pyproject.toml", "requirements.txt", "setup.py", "*.py"]
 ---
 
 # Stack profile: Python

package/rules/stacks/react-native.md

@@ -6,6 +6,8 @@ simt-title: React Native
 # CSS logical properties, a browser matrix, WCAG reflow at 400 % — none of which a
 # native surface has (S28, ADR-047).
 simt-applies: [react-native]
+simt-priority: convention
+simt-scope: ["app.json", "metro.config.js", "ios/**", "android/**"]
 ---
 
 # Stack profile: React Native

package/rules/stacks/react-web.md

@@ -6,6 +6,8 @@ simt-title: React web
 # listing the bare language tags (`typescript`, `vitest`, `node-web`, `less`) put
 # this profile on backend and static repositories that share them (S28, ADR-047).
 simt-applies: [react-dom, react-router, maplibre, firebase]
+simt-priority: convention
+simt-scope: ["src/**/*.{ts,tsx,js,jsx}", "index.html"]
 ---
 
 # Stack profile: React web

package/rules/stacks/ruby.md

@@ -2,6 +2,8 @@
 simt-id: ruby
 simt-title: Ruby
 simt-applies: [has-gemfile]
+simt-priority: convention
+simt-scope: ["Gemfile", "**/*.rb"]
 ---
 
 # Stack profile: Ruby

package/rules/stacks/rust.md

@@ -2,6 +2,8 @@
 simt-id: rust
 simt-title: Rust
 simt-applies: [has-cargo-toml]
+simt-priority: convention
+simt-scope: ["Cargo.toml", "src/**/*.rs"]
 ---
 
 # Stack profile: Rust

package/rules/stacks/swift.md

@@ -2,6 +2,8 @@
 simt-id: swift
 simt-title: Swift
 simt-applies: [has-swift-package]
+simt-priority: convention
+simt-scope: ["Package.swift", "**/*.swift"]
 ---
 
 # Stack profile: Swift

package/rules/stacks/typescript.md

@@ -7,6 +7,8 @@ simt-title: TypeScript
 # repositories are selected for. Two fallbacks both apply when nothing more specific
 # matched.
 simt-applies: [typescript]
+simt-priority: convention
+simt-scope: ["tsconfig.json", "*.ts", "*.tsx"]
 simt-fallback: true
 ---
 

package/rules/stacks/uv.md

@@ -5,6 +5,8 @@ simt-title: uv
 # `uv.lock` in its body while selecting on any Python marker, so a Poetry project was
 # told to run a tool manager it does not use (S28, ADR-047).
 simt-applies: [has-uv-lock]
+simt-priority: convention
+simt-scope: ["uv.lock", "pyproject.toml"]
 ---
 
 # Stack profile: uv

package/src/argv.mjs

@@ -34,9 +34,23 @@ export const BOOL_FLAGS = new Set([
   'plan',
   'help',
   'version',
+  // JSON output: indent it. Off by default because a pipe is not a person, and the
+  // bytes an agent pays for indentation are bytes it never reads.
+  'pretty',
   'accept-conflicts',
   'backup',
   'list',
+  // tokens: measure every repository under the root, not just the one. Plan 0003 R06
+  // names this flag `--workspace`, and that name has been a VALUE flag since plan
+  // 0002 - it is where the skill sources live. One flag with two meanings is the
+  // silent-ignore defect this file's header refuses, so the meter's switch is named
+  // for what it selects.
+  'repos',
+  // harness detect: also report the directories in the user's home. Off by default
+  // because the home directory belongs to the reader rather than the repository, and a
+  // command whose output changes because something was installed elsewhere is one a
+  // reader stops trusting.
+  'user',
 ]);
 
 export const VALUE_FLAGS = new Set([
@@ -52,6 +66,11 @@ export const VALUE_FLAGS = new Set([
   'variant',
   'from',
   'surfaces',
+  // graph lint: which specification to check the skills against. A value rather than a
+  // boolean because "lint against the spec" would not say WHICH spec, and a lint that
+  // silently applied an unnamed set of rules is the decoration this repository exists
+  // to refuse. One is on offer today, so the command rejects any other by name.
+  'spec',
 ]);
 
 /**

package/src/commands/compare.mjs

@@ -98,6 +98,8 @@ export async function compareCommand(positional, flags) {
         noRegion: summary.noRegion,
         malformed: summary.malformed,
         staleRuleFiles: summary.staleRuleFiles,
+        packageRegions: summary.packageRegions,
+        stalePackages: summary.stalePackages,
         hooksRouted: summary.hooksRouted,
         withProblems: summary.withProblems,
         withOwnHooks: summary.withOwnHooks,
@@ -155,6 +157,14 @@ function render(rows, summary, found) {
     `repos     ${summary.repos} (${summary.adopted} adopted, ${summary.unmanaged} unmanaged${summary.broken > 0 ? `, ${summary.broken} broken` : ''})`,
     `region    ${summary.current} current, ${summary.drifted} drifted, ${summary.noRegion} with no region, ${summary.malformed} malformed`,
     `rules     ${summary.staleRuleFiles === 0 ? 'every rule file current' : `${summary.staleRuleFiles} rule file${summary.staleRuleFiles === 1 ? '' : 's'} not current`}`,
+    // One line, and only when there is a package region to report. A workspace of
+    // single-repository members is the common case and must not grow a line that
+    // always reads "none".
+    ...(summary.packageRegions > 0
+      ? [
+          `packages  ${summary.stalePackages === 0 ? `every package region current (${summary.packageRegions})` : `${summary.stalePackages} of ${summary.packageRegions} package region${summary.packageRegions === 1 ? '' : 's'} not current`}`,
+        ]
+      : []),
     `hooks     ${summary.hooksRouted}/${summary.adopted} adopted repos route the shared dispatcher`,
     `          ${summary.withOwnHooks} repo${summary.withOwnHooks === 1 ? '' : 's'} run their own hooks; adopting replaces them (a note, not a problem)`,
     `problems  ${summary.withProblems} repo${summary.withProblems === 1 ? '' : 's'}`,
@@ -167,6 +177,11 @@ function render(rows, summary, found) {
     lines.push(`          adoption ${r.adoption}${r.id && r.id !== r.name ? ` (id ${r.id})` : ''}`);
     lines.push(`          stack   ${r.stack.length > 0 ? r.stack.join(', ') : '(none)'}${r.declaredStack.length > 0 ? ` (manifest declares ${r.declaredStack.join(', ')})` : ''}`);
     if (r.facts.length > 0) lines.push(`          facts   ${r.facts.join(', ')}`);
+    // Per package, and only for a repository that has packages: a single-repository
+    // member must not print an empty list of packages on every line of every run.
+    for (const p of r.packages) {
+      lines.push(`          package ${p.path} ${p.status}${p.profiles.length > 0 ? ` (${p.profiles.join(', ')})` : ''}`);
+    }
     lines.push(`          region  ${r.region}${r.regionDetail ? ` (${r.regionDetail})` : ''}`);
     // The rule files are the answer to "does every editor see the same rule?".
     lines.push(

package/src/commands/graph.mjs

@@ -6,11 +6,18 @@
 // Output is line-oriented and bounded (plan 0002 section 6). A lint failure names
 // the offending node, the file it disagrees with, and both numbers.
 
-import { EXIT, emit, fail, isJson } from '../output/index.mjs';
+import { EXIT, emit, emitJson, fail, isJson } from '../output/index.mjs';
 import { loadRegistry } from '../graph/load.mjs';
+import { lintSpec } from '../graph/speccheck.mjs';
+import { SPEC, SPEC_SOURCE } from '../graph/spec.mjs';
 import { CLI } from '../name.mjs';
 
 export async function lintCommand(positional, flags) {
+  const spec = flags.spec ?? null;
+  if (spec !== null && spec !== SPEC) {
+    return fail(`unknown --spec "${spec}"`, EXIT.USAGE, `the one specification this lints is: ${SPEC}`);
+  }
+
   // The resolved path comes back from the loader, because when no positional is given it
   // falls back to the member that holds the registry in this workspace (ADR-061) - and the
   // reader should see where it actually looked, not a constant that no longer exists.
@@ -19,27 +26,38 @@ export async function lintCommand(positional, flags) {
     flags,
   );
 
+  // The conformance pass is separate from the registry pass on purpose. The registry
+  // answers "does the bookkeeping match the files"; the specification answers "would a
+  // client accept these files", and the second question needs no registry at all. A
+  // reader with no registry can still lint a skill directory, so the two are additive
+  // rather than one gating the other.
+  const specReport = registry && workspace?.root
+    ? await lintSpec(registry, workspace.root)
+    : { errors: [], warnings: [], checked: 0 };
+  errors.push(...specReport.errors);
+  warnings.push(...specReport.warnings);
+
   if (isJson(flags)) {
-    emit(
-      `${JSON.stringify(
-        {
-          ok,
-          registry: path,
-          capabilities: registry?.capabilities?.length ?? 0,
-          skills: registry?.skills?.length ?? 0,
-          // `verified: false` means the byte counts in the registry were NOT
-          // checked against files on disk. It is not a failure - it is the difference
-          // between "the registry is right" and "the registry could not be checked",
-          // and an agent that cannot see the difference will trust a number nobody
-          // measured (ADR-014).
-          verified,
-          workspace,
-          errors,
-          warnings,
-        },
-        null,
-        2,
-      )}\n`,
+    emitJson(
+      {
+        ok,
+        registry: path,
+        capabilities: registry?.capabilities?.length ?? 0,
+        skills: registry?.skills?.length ?? 0,
+        // `verified: false` means the byte counts in the registry were NOT
+        // checked against files on disk. It is not a failure - it is the difference
+        // between "the registry is right" and "the registry could not be checked",
+        // and an agent that cannot see the difference will trust a number nobody
+        // measured (ADR-014).
+        verified,
+        workspace,
+        // Present only when asked for, so a reader of the default output is not told
+        // about a pass that never ran. `null` is the honest value; `true` would be a
+        // claim about conformance nobody checked.
+        spec: spec === null ? null : { name: SPEC, source: SPEC_SOURCE, checked: specReport.checked },
+        errors,
+        warnings,
+      },
       { maxBytes: flags.maxBytes ?? 0 },
     );
     return ok ? EXIT.OK : EXIT.REGISTRY;
@@ -57,6 +75,12 @@ export async function lintCommand(positional, flags) {
     `nodes     ${registry.skills.length} skills, ${registry.capabilities.length} capabilities`,
     `verified  ${verified ? 'byte counts checked against disk' : 'NOT checked - see WARN below'}`,
   ];
+  if (spec !== null) {
+    lines.push(
+      `spec      ${specReport.checked} skills checked against ${SPEC_SOURCE}` +
+        `${specReport.checked === 0 ? ' (none had a readable SKILL.md)' : ''}`,
+    );
+  }
 
   const deferred = registry.skills.filter((s) => s.deferred);
   lines.push(

package/src/commands/harness.mjs

@@ -0,0 +1,150 @@
+// `simt harness detect` - which harnesses this repository (and this user) is set up
+// for, and which of them simt-dev has a channel for.
+//
+// Why this is a command and not a sentence in the docs: the question "which harness
+// reads my rules" has two halves that used to be answered in different places, and the
+// second half was answered by a reader's guess. What is present on disk is observable
+// and belongs to the tool; what a given harness actually loads is a vendor fact, and a
+// vendor fact is only trustworthy when it names its source. So the table that says "we
+// have a channel for this" and the table that says "we have not verified one" are kept
+// apart, and this command reports both without collapsing them into a verdict.
+//
+// It exits 0 whatever it finds. A harness with no channel is a fact about coverage, not
+// a defect in the repository: the rules in AGENTS.md still reach whichever harnesses
+// read that file, and a reader who wanted a failing command could not tell the
+// difference between "no channel" and "broken".
+
+import { stat } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+import { EXIT, emit, emitJson, isJson, note } from '../output/index.mjs';
+import { SURFACES, CANDIDATE_DIRS } from '../projection/surfaces.mjs';
+
+/**
+ * `simt-dev harness detect`. The subcommand is validated by dispatch, which rejects a
+ * second token that is not in the group registry rather than silently routing to the
+ * default; this function therefore has exactly one thing to do and no second spelling
+ * to keep in step with it.
+ *
+ * @param {string[]} positional arguments after the command path
+ * @param {object} flags
+ * @returns {Promise<number>} process exit code
+ */
+export async function harnessCommand(positional, flags) {
+  const root = flags.root ?? process.cwd();
+
+  const repo = await scan(root);
+  // Only on request. The home directory is the reader's, not the repository's, and a
+  // command that reports both by default is a command whose output changes because
+  // somebody installed something elsewhere.
+  const user = flags.user === true ? await scan(homedir()) : null;
+
+  if (isJson(flags)) {
+    emitJson({
+      ok: true,
+      command: 'harness detect',
+      root,
+      repo,
+      ...(user === null ? {} : { user }),
+    });
+    return EXIT.OK;
+  }
+
+  emit(render(root, repo, user));
+  if (repo.rows.length === 0) {
+    note(
+      `note     no harness configuration directory found in ${root}. That is a repository ` +
+        'nobody has set an agent up in - not a finding.',
+    );
+  }
+  const unclaimed = countUnclaimed(repo);
+  if (unclaimed > 0) {
+    note(
+      `note     ${unclaimed} present configur${unclaimed === 1 ? 'ation has' : 'ations have'} ` +
+        'no rule channel in this release. Each one is reported as present, not as ' +
+        'unsupported: whether it reads AGENTS.md is a vendor question this tool does not ' +
+        'answer without a source, and a guess here would be the reader\'s problem later.',
+    );
+  }
+  return EXIT.OK;
+}
+
+/**
+ * Every harness directory present under one root, sorted by directory name.
+ *
+ * A directory whose stat fails for any reason other than absence is treated as absent
+ * rather than raised: a permissions error on one candidate must not make the whole
+ * command fail, and the difference between "could not look" and "not there" is one
+ * note in the output rather than a second failure mode nobody asked for.
+ */
+async function scan(root) {
+  const rows = [];
+  for (const s of SURFACES) {
+    for (const dir of s.configDirs ?? []) {
+      if (await present(root, dir)) {
+        rows.push(row(dir, s.label, { id: s.id, verified: s.verified ?? null, readsAgentsMd: s.readsAgentsMd, rule: s.rule }));
+      }
+    }
+  }
+  for (const c of CANDIDATE_DIRS) {
+    if (await present(root, c.dir)) rows.push(row(c.dir, c.harness, {}));
+  }
+  rows.sort((a, b) => (a.dir < b.dir ? -1 : a.dir > b.dir ? 1 : 0));
+  return { root, rows };
+}
+
+async function present(root, dir) {
+  try {
+    return (await stat(join(root, dir))).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/** One present directory, and what - if anything - this tool can project into it. */
+function row(dir, label, surface) {
+  const id = surface.id ?? null;
+  return {
+    dir,
+    label,
+    surface: id,
+    // `channel: false` is the honest half of the answer: the directory exists and this
+    // release has no rule file to write there. Reported as its own field rather than
+    // left implicit, because "we found it and did nothing" and "we found nothing" look
+    // identical in a list of names.
+    channel: id !== null && surface.rule != null,
+    readsAgentsMd: surface.readsAgentsMd ?? null,
+    verified: surface.verified ?? null,
+  };
+}
+
+function countUnclaimed(scan) {
+  return scan.rows.filter((r) => r.surface === null).length;
+}
+
+/**
+ * One line per present directory, in the order the scanner found them.
+ *
+ * `surface` is printed when there is one, and `AGENTS.md` is named when the surface
+ * loads it - because the answer a reader actually wants is "do my rules reach this",
+ * and the channel column alone does not answer it.
+ */
+function render(root, repo, user) {
+  const lines = [`repo     ${root}`];
+  lines.push(...block(repo, '        '));
+  if (user !== null) {
+    lines.push(`user     ${user.root}`);
+    lines.push(...block(user, '        '));
+  }
+  return `${lines.join('\n')}\n`;
+}
+
+function block(scan, pad) {
+  if (scan.rows.length === 0) return [`${pad}(none present)`];
+  return scan.rows.map((r) => {
+    const through = r.surface === null ? 'no rule channel in this release' : r.channel ? 'projected rule file' : 'AGENTS.md';
+    const agents = r.readsAgentsMd === 'all' ? ' (reads AGENTS.md)' : r.readsAgentsMd === 'some' ? ' (some readers read AGENTS.md)' : '';
+    return `${pad}${r.dir.padEnd(12)} ${r.label.padEnd(38)} ${through}${agents}`;
+  });
+}

package/src/commands/help.mjs

@@ -46,11 +46,20 @@ ${CLI} ci                     simt-dev's own .github files: create or refresh th
 ${CLI} compare                org-wide matrix across every sibling repo
                            (read-only; exits non-zero on defects, not on
                            repos that have not adopted yet)
+${CLI} tokens [--repos]       what a reader loads at session start, in bytes
+                           (read-only; exits 0 whatever it finds, because a
+                           measurement is not a verdict; --repos measures every
+                           repository under the root and what repeats an earlier)
+${CLI} harness detect         which harnesses this repo (and, with --user, you)
+                           are set up for, and which have a rule channel here
+                           (presence only: a directory found is not a claim about
+                           what its owner reads; exits 0 whatever it finds)
 ${CLI} mcp                    the read-only surface as MCP tools over stdio
                            (--list prints it without reading stdin; init, sync,
                            upgrade and the installers stay CLI-only by design)`;
 
-const FLAGS = `--json                 structured output
+const FLAGS = `--json                 structured output (compact; one document, one line)
+--pretty                indent --json for a human
 --max-bytes <n>         hard ceiling on emitted bytes (0 = unlimited, default 0)
 --budget <n>            context budget for skills brief (default 20480)
 --plan                  emit a fetch plan instead of inlining skill bodies
@@ -74,6 +83,11 @@ const FLAGS = `--json                 structured output
 --accept-conflicts      init: adopt rules that collide with hand-written ones
 --backup                init: tag the pre-adoption commit and branch onto
                         simt-dev/adopt before writing (the undo path)
+--spec <name>           graph lint: also check every skill against a named
+                        specification (one exists: agentskills)
+--user                  harness detect: also report the directories in your home
+--repos                 tokens: measure every repository under the root, not
+                        just the one, and report what repeats an earlier one
 --help                  this text
 --version               the version, and the SHA it was built from`;
 

package/src/commands/index.mjs

@@ -6,7 +6,15 @@
 // succeeds. An agent that calls `simt-dev compare` on an unreleased build must get a
 // failure, not an empty result it will read as "no drift".
 
-import { EXIT, emit, fail, isJson } from '../output/index.mjs';
+import {
+  EXIT,
+  emit,
+  emitJson,
+  fail,
+  isJson,
+  jsonFailMode,
+  jsonIndentDefault,
+} from '../output/index.mjs';
 import { help } from './help.mjs';
 import { lintCommand } from './graph.mjs';
 import {
@@ -26,6 +34,8 @@ import { upgradeCommand } from './upgrade.mjs';
 import { mcpCommand } from './mcp.mjs';
 import { installCommand } from './skillsinstall.mjs';
 import { listCommand as rulesList, showCommand as rulesShow, whyCommand as rulesWhy } from './rules.mjs';
+import { tokensCommand } from './tokens.mjs';
+import { harnessCommand } from './harness.mjs';
 import { parse } from '../argv.mjs';
 import { fingerprint } from '../resolve/fingerprint.mjs';
 import { resolveWorkspace } from '../workspace.mjs';
@@ -43,6 +53,7 @@ const GROUPS = new Map([
   ['graph', 'lint'],
   ['rules', 'list'],
   ['hooks', 'status'],
+  ['harness', 'detect'],
 ]);
 
 /**
@@ -58,7 +69,7 @@ const GROUPS = new Map([
  * Module scope so `test/cli.test.mjs` can assert help against it. Module scope is also
  * just correct: nothing in the map depends on the call.
  */
-const IMPLEMENTED = {
+export const IMPLEMENTED = {
   doctor: runDoctor,
   'graph lint': lintCommand,
   'skills index': skillsIndex,
@@ -79,6 +90,8 @@ const IMPLEMENTED = {
   'hooks status': (args, flags) => hooksCommand('status', args, flags),
   'hooks run': (args, flags) => hooksCommand('run', args, flags),
   compare: compareCommand,
+  tokens: tokensCommand,
+  'harness detect': harnessCommand,
   upgrade: upgradeCommand,
   mcp: mcpCommand,
 };
@@ -92,6 +105,17 @@ export const COMMANDS = Object.keys(IMPLEMENTED).sort();
 export async function dispatch(argv) {
   const { flags, positional } = parseOrExit(argv);
 
+  // The JSON shape is decided once, here, and every command inherits it. Threading a
+  // `--pretty` through twenty-five call sites would mean twenty-five places to forget,
+  // and the one that forgot would be the one a reader pipes into a script.
+  //
+  // Both halves are set before anything can fail, because a command that fails under
+  // `--json` has still produced a result: the reason it failed. Set here, an unknown
+  // command answers in the same shape a working one does, and the caller's parse
+  // never sees an empty document.
+  jsonIndentDefault(flags.pretty === true);
+  jsonFailMode(flags.json === true);
+
   // Help is shown only when explicitly asked for. An unknown command must fail with
   // a usage code, not print 40 lines of prose and exit 0 — an agent that mistyped
   // needs to be told so, not handed a wall of text it may misread as output.
@@ -191,29 +215,23 @@ async function runDoctor(positional, flags) {
   const code = failure ? EXIT.CONFIG : EXIT.OK;
 
   if (isJson(flags)) {
-    emit(
-      `${JSON.stringify(
-        {
-          ok: code === EXIT.OK,
-          command: 'doctor',
-          root,
-          ...result,
-          // The workspace answer is a fact about which directory the tool would
-          // act on next (ADR-014). It is printed in the text report; leaving it
-          // out of the JSON meant a machine-readable caller could not see it at
-          // all, which is the one-question-two-answers defect again.
-          workspace: {
-            root: ws.root ?? null,
-            source: ws.source,
-            detail: ws.detail,
-            error: ws.error ?? null,
-          },
-          ...(failure ?? {}),
-        },
-        null,
-        2,
-      )}\n`,
-    );
+    emitJson({
+      ok: code === EXIT.OK,
+      command: 'doctor',
+      root,
+      ...result,
+      // The workspace answer is a fact about which directory the tool would
+      // act on next (ADR-014). It is printed in the text report; leaving it
+      // out of the JSON meant a machine-readable caller could not see it at
+      // all, which is the one-question-two-answers defect again.
+      workspace: {
+        root: ws.root ?? null,
+        source: ws.source,
+        detail: ws.detail,
+        error: ws.error ?? null,
+      },
+      ...(failure ?? {}),
+    });
     return code;
   }
   if (result.error) {