skillwiki 0.10.21 → 0.10.22

package/dist/cli.js

@@ -83,7 +83,7 @@ import {
   upsertIndexEntry,
   validateLogEvent,
   writeLogEvent
-} from "./chunk-UNPZDCWN.js";
+} from "./chunk-7YDWC6D3.js";
 import {
   normalizeDistTag,
   readCache,
@@ -105,11 +105,11 @@ import {
   scanVault,
   splitFrontmatter,
   writeRootIndexProjection
-} from "./chunk-I5JD3BQZ.js";
+} from "./chunk-54JVBNWK.js";
 import {
   runManagedWritePreflight,
   runManagedWriteTransaction
-} from "./chunk-65Q5UGND.js";
+} from "./chunk-BASWDOQB.js";
 import {
   FLEET_REL_PATH,
   canSupersedeJournal,
@@ -137,18 +137,20 @@ import {
   snapshotterAliasForLocalHost,
   supersedeStaleReviewRequiredJournals,
   writeDotenv
-} from "./chunk-GNS2ZV5P.js";
+} from "./chunk-PQG26AGJ.js";
 import {
   ExitCode,
   MetaSchema,
   RawSourceSchema,
+  TypedKnowledgeSchema,
+  detectSchema,
   err,
   isBlockedHost,
   ok
-} from "./chunk-Y6KRDGI2.js";
+} from "./chunk-C2DKFJFA.js";
 
 // src/cli.ts
-import { join as join36 } from "path";
+import { join as join38 } from "path";
 import { Command } from "commander";
 
 // src/utils/output.ts
@@ -1000,7 +1002,7 @@ import { mkdtempSync, writeFileSync, rmSync } from "fs";
 import { tmpdir } from "os";
 import { join as join7 } from "path";
 var ENTRY_RE = /^## \[/m;
-var OPERATION_MARKER_RE = /<!--\s*skillwiki-(?:page-publish|log-op):([a-f0-9]{64})\s*-->/i;
+var OPERATION_MARKER_RE = /<!--\s*skillwiki-(?:page-publish|project-page-publish|log-op):([a-f0-9]{64})\s*-->/i;
 function splitLog(text) {
   const normalized = text.replace(/\r\n/g, "\n");
   const match = ENTRY_RE.exec(normalized);
@@ -1196,21 +1198,21 @@ function rollbackPath(vault, path, stage2, stage3) {
 function hasMarkers(path, text) {
   const lines = text.split(/\r?\n/);
   let open2 = false;
-  let sep2 = false;
+  let sep3 = false;
   for (const line of lines) {
     if (line.startsWith("<<<<<<< ")) {
       open2 = true;
-      sep2 = false;
+      sep3 = false;
       continue;
     }
     if (line === "=======" && open2) {
-      sep2 = true;
+      sep3 = true;
       continue;
     }
-    if (line.startsWith(">>>>>>> ") && open2 && sep2) return true;
+    if (line.startsWith(">>>>>>> ") && open2 && sep3) return true;
     if (line.startsWith(">>>>>>> ")) {
       open2 = false;
-      sep2 = false;
+      sep3 = false;
     }
   }
   return false;
@@ -1322,10 +1324,12 @@ function marker(event) {
   return `<!-- skillwiki-log-event:${event.operation_id} -->`;
 }
 function bodyFor(event) {
-  if (event.kind === "page-publish") {
+  if (event.kind === "page-publish" || event.kind === "project-page-publish") {
     const tax = Array.isArray(event.metadata.taxonomy_added) ? event.metadata.taxonomy_added : [];
+    const project = typeof event.metadata.project === "string" ? event.metadata.project : void 0;
     return [
       `- Published: [[${event.target.replace(/\.md$/, "")}]]`,
+      ...event.kind === "project-page-publish" && project ? [`- Project: [[${project}]]`] : [],
       `- Taxonomy: ${tax.length > 0 ? `added ${tax.join(", ")}` : "no additions"}`,
       event.note ? `- Note: ${event.note}` : ""
     ].filter(Boolean).join("\n");
@@ -1496,7 +1500,7 @@ function operationId(namespace, parts) {
 
 // src/commands/log-migrate-legacy.ts
 var BLOCK_RE = /^## \[(\d{4}-\d{2}-\d{2})\][^\n]*$/gm;
-var PUBLISH_RE = /<!--\s*skillwiki-page-publish:([a-f0-9]{64})\s*-->/i;
+var PUBLISH_RE = /<!--\s*skillwiki-(?:page-publish|project-page-publish):([a-f0-9]{64})\s*-->/i;
 function splitLegacyBlocks(text) {
   const matches = [...text.matchAll(BLOCK_RE)];
   if (matches.length === 0) return [];
@@ -3204,7 +3208,7 @@ ${fmRewritten}
   await rename2(join18(input.vault, relPath), join18(input.vault, archivePath));
   let indexUpdated = false;
   if (!isRaw) {
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-HAXDEM2F.js");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-Q6WL76SO.js");
     const before = await readFile7(join18(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
@@ -3313,10 +3317,10 @@ async function runRemove(input) {
   const tombstonePath = await writeDeleteIntent(input.vault, intent);
   await unlink2(join19(input.vault, relPath));
   if (relPath.endsWith(".md") && !relPath.startsWith("raw/")) {
-    const { readFile: readFile17 } = await import("fs/promises");
+    const { readFile: readFile18 } = await import("fs/promises");
     const { join: pathJoin } = await import("path");
-    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-HAXDEM2F.js");
-    const before = await readFile17(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
+    const { renderRootIndex: renderRootIndex2, writeRootIndexProjection: writeRootIndexProjection2 } = await import("./index-projection-Q6WL76SO.js");
+    const before = await readFile18(pathJoin(input.vault, "index.md"), "utf8").catch(() => "");
     const fullTarget = relPath.replace(/\.md$/, "");
     const bare = fullTarget.split("/").pop() ?? fullTarget;
     const hadIndexEntry = before.includes(`[[${fullTarget}]]`) || before.includes(`[[${bare}]]`);
@@ -4728,12 +4732,239 @@ function dateFromPath(path) {
 // src/commands/ingest.ts
 import { readFile as readFile13, open, unlink as unlink4, mkdir as mkdir9 } from "fs/promises";
 import { join as join26 } from "path";
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 
 // src/commands/page-publish.ts
-import { realpathSync } from "fs";
+import { readFileSync as readFileSync12, realpathSync } from "fs";
 import { readFile as readFile12 } from "fs/promises";
 import { join as join25, resolve as resolve3 } from "path";
+
+// src/utils/publication-approval.ts
+import { createHash as createHash4 } from "crypto";
+var APPROVAL_CONTRACT = "skillwiki-publication-approval-v1";
+var APPROVAL_TOKEN_VERSION = "swpub1";
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var PUBLISHERS = /* @__PURE__ */ new Set(["page", "project-page"]);
+function sha256Hex(bytes) {
+  return createHash4("sha256").update(bytes).digest("hex");
+}
+function normalizeLogNote(note) {
+  if (note === void 0) return "";
+  return note.normalize("NFC").trim();
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function canonicalApprovalJson(payload) {
+  const ordered = {
+    contract: payload.contract,
+    publisher: payload.publisher,
+    draft_sha256: payload.draft_sha256,
+    target: payload.target
+  };
+  if (payload.publisher === "project-page" && payload.project !== void 0) {
+    ordered.project = payload.project;
+  }
+  ordered.log_note = payload.log_note;
+  ordered.prior_target_sha256 = payload.prior_target_sha256;
+  return JSON.stringify(ordered);
+}
+function base64UrlEncode(text) {
+  return Buffer.from(text, "utf8").toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlDecode(segment) {
+  if (!/^[A-Za-z0-9_-]+$/.test(segment)) {
+    return err("APPROVAL_INVALID", { message: "payload is not base64url" });
+  }
+  const padded = segment + "=".repeat((4 - segment.length % 4) % 4);
+  const b64 = padded.replace(/-/g, "+").replace(/_/g, "/");
+  try {
+    return ok(Buffer.from(b64, "base64").toString("utf8"));
+  } catch (error) {
+    return err("APPROVAL_INVALID", { message: `payload decode failed: ${String(error)}` });
+  }
+}
+function validatePayloadShape(value) {
+  if (!isPlainObject2(value)) {
+    return err("APPROVAL_INVALID", { message: "payload must be a JSON object" });
+  }
+  if (value.contract !== APPROVAL_CONTRACT) {
+    return err("APPROVAL_INVALID", { message: "unknown approval contract version" });
+  }
+  if (typeof value.publisher !== "string" || !PUBLISHERS.has(value.publisher)) {
+    return err("APPROVAL_INVALID", { message: "unknown publisher kind" });
+  }
+  const publisher = value.publisher;
+  if (typeof value.draft_sha256 !== "string" || !SHA256_HEX.test(value.draft_sha256)) {
+    return err("APPROVAL_INVALID", { message: "draft_sha256 must be 64 lowercase hex chars" });
+  }
+  if (typeof value.target !== "string" || value.target.length === 0 || value.target.length > 500) {
+    return err("APPROVAL_INVALID", { message: "invalid target" });
+  }
+  if (typeof value.log_note !== "string" || /[\r\n]/.test(value.log_note)) {
+    return err("APPROVAL_INVALID", { message: "log_note must be a single line string" });
+  }
+  if (Buffer.byteLength(value.log_note, "utf8") > 500) {
+    return err("APPROVAL_INVALID", { message: "log_note exceeds 500 UTF-8 bytes" });
+  }
+  const prior = value.prior_target_sha256;
+  if (typeof prior !== "string" || prior !== "absent" && !SHA256_HEX.test(prior)) {
+    return err("APPROVAL_INVALID", { message: "prior_target_sha256 must be hex or absent" });
+  }
+  if (publisher === "project-page") {
+    if (typeof value.project !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(value.project)) {
+      return err("APPROVAL_INVALID", { message: "project-page token requires a valid project slug" });
+    }
+    return ok({
+      contract: APPROVAL_CONTRACT,
+      publisher,
+      draft_sha256: value.draft_sha256,
+      target: value.target,
+      project: value.project,
+      log_note: value.log_note,
+      prior_target_sha256: prior
+    });
+  }
+  if (value.project !== void 0 && value.project !== null) {
+    return err("APPROVAL_INVALID", { message: "page publisher token must omit project" });
+  }
+  return ok({
+    contract: APPROVAL_CONTRACT,
+    publisher,
+    draft_sha256: value.draft_sha256,
+    target: value.target,
+    log_note: value.log_note,
+    prior_target_sha256: prior
+  });
+}
+function buildApprovalPayload(input) {
+  const base = {
+    contract: APPROVAL_CONTRACT,
+    publisher: input.publisher,
+    draft_sha256: input.draft_sha256,
+    target: input.target,
+    log_note: normalizeLogNote(input.log_note),
+    prior_target_sha256: input.prior_target_sha256,
+    ...input.publisher === "project-page" ? { project: input.project } : {}
+  };
+  return validatePayloadShape(base);
+}
+function encodeApprovalToken(payload) {
+  const validated = validatePayloadShape(payload);
+  if (!validated.ok) return validated;
+  const json = canonicalApprovalJson(validated.data);
+  const middle = base64UrlEncode(json);
+  const checksum = sha256Hex(middle);
+  return ok(`${APPROVAL_TOKEN_VERSION}.${middle}.${checksum}`);
+}
+function decodeApprovalToken(token) {
+  if (typeof token !== "string" || token.length === 0) {
+    return err("APPROVAL_INVALID", { message: "empty approval token" });
+  }
+  if (token.includes("\n") || token.includes("---\n") || token.includes("```")) {
+    return err("APPROVAL_INVALID", { message: "token must not contain raw draft content" });
+  }
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return err("APPROVAL_INVALID", { message: "token must have three segments" });
+  }
+  const [version, middle, checksum] = parts;
+  if (version !== APPROVAL_TOKEN_VERSION) {
+    return err("APPROVAL_INVALID", { message: "unknown token version" });
+  }
+  if (!SHA256_HEX.test(checksum)) {
+    return err("APPROVAL_INVALID", { message: "checksum must be 64 lowercase hex chars" });
+  }
+  const expectedChecksum = sha256Hex(middle);
+  if (expectedChecksum !== checksum) {
+    return err("APPROVAL_INVALID", { message: "checksum mismatch" });
+  }
+  const decoded = base64UrlDecode(middle);
+  if (!decoded.ok) return decoded;
+  let parsed;
+  try {
+    parsed = JSON.parse(decoded.data);
+  } catch {
+    return err("APPROVAL_INVALID", { message: "payload is not valid JSON" });
+  }
+  const shaped = validatePayloadShape(parsed);
+  if (!shaped.ok) return shaped;
+  if (base64UrlEncode(canonicalApprovalJson(shaped.data)) !== middle) {
+    return err("APPROVAL_INVALID", { message: "payload is not in canonical form" });
+  }
+  return shaped;
+}
+function verifyApprovalToken(token, expected) {
+  const decoded = decodeApprovalToken(token);
+  if (!decoded.ok) return decoded;
+  const payload = decoded.data;
+  if (payload.publisher !== expected.publisher) {
+    return err("APPROVAL_MISMATCH", {
+      field: "publisher",
+      expected: expected.publisher,
+      actual: payload.publisher
+    });
+  }
+  if (payload.draft_sha256 !== expected.draft_sha256) {
+    return err("APPROVAL_MISMATCH", {
+      field: "draft_sha256",
+      expected: expected.draft_sha256,
+      actual: payload.draft_sha256
+    });
+  }
+  if (payload.target !== expected.target) {
+    return err("APPROVAL_MISMATCH", {
+      field: "target",
+      expected: expected.target,
+      actual: payload.target
+    });
+  }
+  if (payload.prior_target_sha256 !== expected.prior_target_sha256) {
+    return err("APPROVAL_MISMATCH", {
+      field: "prior_target_sha256",
+      expected: expected.prior_target_sha256,
+      actual: payload.prior_target_sha256
+    });
+  }
+  const expectedNote = normalizeLogNote(expected.log_note);
+  if (payload.log_note !== expectedNote) {
+    return err("APPROVAL_MISMATCH", {
+      field: "log_note",
+      expected: expectedNote,
+      actual: payload.log_note
+    });
+  }
+  if (expected.publisher === "project-page") {
+    if (payload.project !== expected.project) {
+      return err("APPROVAL_MISMATCH", {
+        field: "project",
+        expected: expected.project,
+        actual: payload.project
+      });
+    }
+  } else if (payload.project !== void 0) {
+    return err("APPROVAL_MISMATCH", {
+      field: "project",
+      expected: null,
+      actual: payload.project
+    });
+  }
+  return ok(payload);
+}
+function operationIdFromApproval(payload) {
+  const namespace = `${payload.contract}:${payload.publisher}`;
+  return operationId(namespace, [
+    payload.draft_sha256,
+    payload.target,
+    payload.project ?? "",
+    payload.log_note
+  ]);
+}
+function redactApprovalTokens(text) {
+  return text.replace(/swpub1\.[A-Za-z0-9_-]+\.[0-9a-f]{64}/g, "swpub1.[REDACTED]");
+}
+
+// src/commands/page-publish.ts
 var DEFAULT_DEPS2 = {
   afterStage: async () => void 0,
   preflight: (input) => runManagedWritePreflight(input)
@@ -4758,6 +4989,16 @@ function errorExitCode(error) {
       return ExitCode.SYNC_LOCK_HELD;
     case "PREFLIGHT_FAILED":
       return ExitCode.PREFLIGHT_FAILED;
+    case "APPROVAL_REQUIRED":
+      return ExitCode.APPROVAL_REQUIRED;
+    case "APPROVAL_INVALID":
+      return ExitCode.APPROVAL_INVALID;
+    case "APPROVAL_MISMATCH":
+      return ExitCode.APPROVAL_MISMATCH;
+    case "TARGET_DRIFT":
+      return ExitCode.TARGET_DRIFT;
+    case "USAGE":
+      return ExitCode.USAGE;
     case "EVENT_IDENTITY_COLLISION":
     case "WRITE_FAILED":
       return ExitCode.WRITE_FAILED;
@@ -4765,9 +5006,6 @@ function errorExitCode(error) {
       return ExitCode.INVALID_FRONTMATTER;
   }
 }
-function publicationId(target, content, logNote = "") {
-  return operationId("skillwiki-page-publish-v1", [target, content, logNote]);
-}
 function resolveRootAggregateMode(env = process.env) {
   if (env.SKILLWIKI_ROOT_AGGREGATE_MODE === "source-only") return "source-only";
   return "dual";
@@ -4780,7 +5018,7 @@ function prepareFrozenPublication(input, source) {
   if (input.logNote !== void 0 && /[\r\n]/.test(input.logNote)) {
     return err("SCHEME_REJECTED", { message: "log note must be one line" });
   }
-  const logNote = input.logNote?.trim() || void 0;
+  const logNote = normalizeLogNote(input.logNote) || void 0;
   if (logNote && Buffer.byteLength(logNote, "utf8") > 500) {
     return err("SCHEME_REJECTED", { message: "log note must be one line and at most 500 UTF-8 bytes" });
   }
@@ -4790,14 +5028,41 @@ function prepareFrozenPublication(input, source) {
   const date = (input.now ?? /* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const taxonomyComment = taxonomyCommentForPage(input.target, date);
   if (!taxonomyComment.ok) return taxonomyComment;
+  const draftSha256 = sha256Hex(input.content);
+  let priorTargetSha256 = input.priorTargetSha256;
+  if (priorTargetSha256 === void 0) {
+    try {
+      const existing = readFileSync12(target.data.absolutePath, "utf8");
+      priorTargetSha256 = sha256Hex(existing);
+    } catch (error) {
+      if (error.code === "ENOENT") priorTargetSha256 = "absent";
+      else {
+        return err("WRITE_FAILED", {
+          path: target.data.absolutePath,
+          message: String(error)
+        });
+      }
+    }
+  }
+  const approvalPayload = buildApprovalPayload({
+    publisher: "page",
+    draft_sha256: draftSha256,
+    target: input.target,
+    log_note: logNote ?? "",
+    prior_target_sha256: priorTargetSha256
+  });
+  if (!approvalPayload.ok) return approvalPayload;
   return ok({
     page: page.data,
     source,
     targetPath: target.data.absolutePath,
     logNote,
-    operationId: publicationId(input.target, input.content, logNote),
+    operationId: operationIdFromApproval(approvalPayload.data),
     date,
-    taxonomyComment: taxonomyComment.data
+    taxonomyComment: taxonomyComment.data,
+    draftSha256,
+    priorTargetSha256,
+    approvalPayload: approvalPayload.data
   });
 }
 function preparePagePublicationFromContent(input) {
@@ -4944,7 +5209,7 @@ function redactDetail(detail) {
   if (detail === void 0) return void 0;
   try {
     const encoded = JSON.stringify(detail);
-    return JSON.parse(redactSensitiveContent(encoded).text);
+    return JSON.parse(redactApprovalTokens(redactSensitiveContent(encoded).text));
   } catch {
     return { message: "unserializable error detail omitted" };
   }
@@ -4964,7 +5229,7 @@ function phaseFailure(stage, input, published, cause, context = {}, exitCode = E
     })
   };
 }
-function successReceipt(input, taxonomyAdded, pageChanged, indexUpdated, logAppended, filesChanged, dryRun = false, receipt = null) {
+function successReceipt(input, taxonomyAdded, pageChanged, indexUpdated, logAppended, filesChanged, dryRun = false, receipt = null, approvalToken) {
   return {
     exitCode: ExitCode.OK,
     result: ok({
@@ -4980,6 +5245,9 @@ function successReceipt(input, taxonomyAdded, pageChanged, indexUpdated, logAppe
       files_changed: filesChanged,
       base_oid: receipt?.base_oid ?? null,
       write_mode: receipt?.mode ?? null,
+      draft_sha256: input.draftSha256,
+      target_before: input.priorTargetSha256,
+      ...approvalToken ? { approval_token: approvalToken } : {},
       ...receipt ? {
         mutation_vault: receipt.mutation_vault,
         git_vault: receipt.git_vault,
@@ -5053,6 +5321,8 @@ async function previewPreparedPagePublication(input, vault) {
     ...index.data.changed ? ["index.md"] : [],
     ...logAppended ? ["log.md"] : []
   ];
+  const token = encodeApprovalToken(input.approvalPayload);
+  if (!token.ok) return { exitCode: errorExitCode(token.error), result: token };
   return successReceipt(
     input,
     reconciled.data.added,
@@ -5060,7 +5330,9 @@ async function previewPreparedPagePublication(input, vault) {
     index.data.changed,
     logAppended,
     filesChanged,
-    true
+    true,
+    null,
+    token.data
   );
 }
 async function publishPreparedPageWithReceipt(input, vault, writeReceipt, deps = DEFAULT_DEPS2) {
@@ -5223,9 +5495,30 @@ async function publishPreparedPage(input, vault, deps = DEFAULT_DEPS2) {
   });
 }
 async function runPagePublish(input, deps = DEFAULT_DEPS2) {
+  if (input.approve && !input.write) {
+    return {
+      exitCode: ExitCode.USAGE,
+      result: err("USAGE", { message: "--approve requires --write" })
+    };
+  }
   const prepared = await preparePagePublication(input);
   if (!prepared.ok) return { exitCode: errorExitCode(prepared.error), result: prepared };
   if (!input.write) return previewPreparedPagePublication(prepared.data, input.vault);
+  if (input.approve) {
+    const verified = verifyApprovalToken(input.approve, {
+      publisher: "page",
+      draft_sha256: prepared.data.draftSha256,
+      target: prepared.data.page.target,
+      log_note: prepared.data.logNote ?? "",
+      prior_target_sha256: prepared.data.priorTargetSha256
+    });
+    if (!verified.ok) {
+      return {
+        exitCode: errorExitCode(verified.error),
+        result: err(verified.error, redactDetail(verified.detail))
+      };
+    }
+  }
   return publishPreparedPage(prepared.data, input.vault, deps);
 }
 
@@ -5372,7 +5665,7 @@ async function acquireRawCaptureLock(path) {
       if (error.code !== "EEXIST") {
         return err("WRITE_FAILED", { path: lockPath, phase: "raw-lock", message: String(error) });
       }
-      await new Promise((resolve4) => setTimeout(resolve4, 10));
+      await new Promise((resolve6) => setTimeout(resolve6, 10));
     }
   }
   return err("WRITE_FAILED", { path: lockPath, phase: "raw-lock", message: "raw capture lock held" });
@@ -5464,7 +5757,7 @@ async function runIngest(input, pagePublishDeps = defaultPagePublishDeps()) {
       })
     };
   }
-  const sha256 = createHash4("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
+  const sha256 = createHash5("sha256").update(Buffer.from(sourceContent, "utf8")).digest("hex");
   const today = todayIso();
   const slug = slugify2(input.title);
   const tags = input.tags && input.tags.length > 0 ? input.tags : [];
@@ -6005,131 +6298,1410 @@ async function runTagReconcile(input) {
   };
 }
 
-// src/commands/sync.ts
-import { existsSync as existsSync8 } from "fs";
-import { join as join28 } from "path";
-import { execFileSync as execFileSync3 } from "child_process";
+// src/commands/project-page-publish.ts
+import { realpathSync as realpathSync4 } from "fs";
+import { mkdir as mkdir10, readFile as readFile15 } from "fs/promises";
+import { dirname as dirname8, join as join29, resolve as resolve5 } from "path";
 
-// src/utils/vault-git-pathspec.ts
-var VAULT_GENERATED_COMMIT_PATHS = [
-  ".skillwiki/last-op.json",
-  ".skillwiki/memory",
-  ".skillwiki/memory-topics.json"
-];
-var VAULT_GENERATED_COMMIT_EXCLUDES = [
-  ...VAULT_GENERATED_COMMIT_PATHS.map((path) => `:!${path}`)
-];
-var VAULT_COMMIT_PATHSPEC = [".", ...VAULT_GENERATED_COMMIT_EXCLUDES];
-function stageVaultContentChanges(vault) {
-  gitStrict(vault, ["add", "-A", "--", "."]);
-  for (const generatedPath of VAULT_GENERATED_COMMIT_PATHS) {
+// src/utils/architecture-page.ts
+import { lstatSync, realpathSync as realpathSync2 } from "fs";
+import { dirname as dirname6, posix as posix2, relative as relative2, resolve as resolve4, sep as sep2 } from "path";
+var PROJECT_SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+var ARCH_TARGET_RE = /^projects\/([a-z0-9][a-z0-9-]*)\/architecture\/([a-z0-9][a-z0-9._-]*\.md)$/;
+function invalidFrontmatter(target, issues) {
+  return err("INVALID_FRONTMATTER", {
+    target,
+    errors: issues.map((issue) => ({ path: issue.path.join("."), message: issue.message }))
+  });
+}
+function validateProjectSlug(slug) {
+  if (!PROJECT_SLUG_RE.test(slug)) {
+    return err("VAULT_PATH_INVALID", { project: slug, message: "invalid project slug" });
+  }
+  return ok(slug);
+}
+function validateArchitectureTarget(target, project) {
+  const slug = validateProjectSlug(project);
+  if (!slug.ok) return slug;
+  if (target.length === 0 || posix2.isAbsolute(target) || target.includes("\\") || posix2.normalize(target) !== target || target.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
+    return err("VAULT_PATH_INVALID", { target, message: "unsafe architecture target" });
+  }
+  const match = ARCH_TARGET_RE.exec(target);
+  if (!match) {
+    return err("VAULT_PATH_INVALID", {
+      target,
+      message: "target must be projects/{slug}/architecture/{filename}.md"
+    });
+  }
+  if (match[1] !== project) {
+    return err("VAULT_PATH_INVALID", {
+      target,
+      project,
+      message: "project slug does not match architecture target path"
+    });
+  }
+  return ok(target);
+}
+function assertArchitectureTargetInsideVault(vault, target, project) {
+  const validated = validateArchitectureTarget(target, project);
+  if (!validated.ok) return validated;
+  let vaultReal;
+  try {
+    vaultReal = realpathSync2(vault);
+  } catch {
+    return err("VAULT_PATH_INVALID", { target, message: "vault realpath failed" });
+  }
+  const absolutePath = resolve4(vaultReal, target);
+  const parent = dirname6(absolutePath);
+  let parentReal;
+  try {
+    parentReal = realpathSync2(parent);
+  } catch {
+    return err("VAULT_PATH_INVALID", { target, message: "target parent realpath failed" });
+  }
+  const parentRelative = relative2(vaultReal, parentReal).split(sep2).join("/");
+  if (parentRelative === ".." || parentRelative.startsWith("../")) {
+    return err("VAULT_PATH_INVALID", { target, message: "target parent escapes vault" });
+  }
+  if (parentReal !== parent) {
+    return err("VAULT_PATH_INVALID", { target, message: "target parent may not be a symlink alias" });
+  }
+  let existingRealPath;
+  try {
+    const targetStat = lstatSync(absolutePath);
+    if (targetStat.isSymbolicLink()) {
+      return err("VAULT_PATH_INVALID", { target, message: "target may not be a symlink" });
+    }
+    if (!targetStat.isFile()) {
+      return err("VAULT_PATH_INVALID", { target, message: "existing target must be a regular file" });
+    }
     try {
-      gitStrict(vault, ["reset", "HEAD", "--", generatedPath]);
-    } catch (_e) {
+      existingRealPath = realpathSync2(absolutePath);
+    } catch {
+      return err("VAULT_PATH_INVALID", { target, message: "target realpath failed" });
     }
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      return err("VAULT_PATH_INVALID", { target, message: "target lstat failed" });
+    }
+  }
+  return ok({ absolutePath, existingRealPath });
+}
+function provenanceIncludesProject(provenanceProjects, project) {
+  if (!provenanceProjects) return false;
+  const wanted = `[[${project}]]`;
+  return provenanceProjects.some((entry) => entry === wanted || entry === project);
+}
+function prepareArchitecturePage(content, target, project, opts = { isNew: true }) {
+  const safeTarget = validateArchitectureTarget(target, project);
+  if (!safeTarget.ok) return safeTarget;
+  const sensitive = scanSensitiveContent(content, { file: target });
+  if (sensitive.length > 0) {
+    return err("SENSITIVE_CONTENT_DETECTED", { file: target, findings: sensitive });
+  }
+  const frontmatter = extractFrontmatter(content);
+  if (!frontmatter.ok) return frontmatter;
+  const detected = detectSchema(frontmatter.data);
+  if (detected.schema !== "typed-knowledge") {
+    return err("SCHEME_REJECTED", {
+      target,
+      message: "architecture pages must use typed-knowledge frontmatter"
+    });
+  }
+  const parsed = TypedKnowledgeSchema.safeParse(frontmatter.data);
+  if (!parsed.success) return invalidFrontmatter(target, parsed.error.issues);
+  if (parsed.data.type !== "concept") {
+    return err("SCHEME_REJECTED", {
+      target,
+      type: parsed.data.type,
+      message: "architecture pages require type: concept"
+    });
+  }
+  const provenance = parsed.data.provenance;
+  if (provenance !== "project" && provenance !== "mixed") {
+    return err("SCHEME_REJECTED", {
+      target,
+      provenance,
+      message: "architecture pages require provenance: project or mixed"
+    });
+  }
+  if (!provenanceIncludesProject(parsed.data.provenance_projects, project)) {
+    return err("SCHEME_REJECTED", {
+      target,
+      project,
+      message: "provenance_projects must include the target project"
+    });
+  }
+  const tags = [...parsed.data.tags];
+  if (opts.isNew && !tags.includes("adr")) {
+    return err("SCHEME_REJECTED", {
+      target,
+      message: "newly created architecture pages require the adr tag"
+    });
   }
+  return ok({
+    target,
+    project,
+    title: parsed.data.title,
+    type: "concept",
+    tags,
+    content,
+    isNew: opts.isNew
+  });
 }
 
-// src/commands/sync.ts
-function parseDirtyPaths(porcelain) {
-  if (!porcelain) return [];
-  return porcelain.split("\n").map((line) => line.trimEnd()).filter((line) => line.length >= 4).map((line) => {
-    const payload = line.length >= 3 && line[2] === " " ? line.slice(3) : line.length >= 2 && line[1] === " " ? line.slice(2) : line;
-    const arrow = payload.lastIndexOf(" -> ");
-    return arrow >= 0 ? payload.slice(arrow + 4) : payload;
-  }).filter((path) => path.length > 0);
+// src/utils/publication-operation-journal.ts
+import {
+  chmodSync,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync13,
+  realpathSync as realpathSync3,
+  renameSync as renameSync3,
+  unlinkSync,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { homedir } from "os";
+import { dirname as dirname7, join as join28 } from "path";
+var PUBLICATION_JOURNAL_SCHEMA = "skillwiki-publication-operation-v1";
+var PHASE_ORDER2 = [
+  "locked",
+  "taxonomy",
+  "page",
+  "verified",
+  "project-index",
+  "unlocked",
+  "event",
+  "log",
+  "complete"
+];
+function phaseIndex2(phase) {
+  return PHASE_ORDER2.indexOf(phase);
 }
-function splitNonEmptyLines(text) {
-  if (!text) return [];
-  return text.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+function isValidPhase(phase) {
+  return PHASE_ORDER2.includes(phase);
 }
-function isTrackedNotePath(path) {
-  if (!path.endsWith(".md")) return false;
-  return !/^\.(skillwiki|claude|obsidian|antigravitycli|playwright-cli)\//.test(path);
+function vaultIdentity(vaultPath) {
+  let real;
+  try {
+    real = realpathSync3(vaultPath);
+  } catch {
+    real = vaultPath;
+  }
+  return sha256Hex(real).slice(0, 16);
 }
-function refHasPath(vault, ref, path) {
+function publicationJournalRoot(home = process.env.HOME || homedir()) {
+  return join28(home, ".skillwiki", "publication-operations");
+}
+function resolveJournalPaths(vaultPath, operationId2, home = process.env.HOME || homedir()) {
+  const identity = vaultIdentity(vaultPath);
+  const rootDir = publicationJournalRoot(home);
+  const vaultDir = join28(rootDir, identity);
+  return {
+    rootDir,
+    vaultDir,
+    journalPath: join28(vaultDir, `${operationId2}.json`)
+  };
+}
+function ensurePrivateDir(dir) {
+  mkdirSync3(dir, { recursive: true, mode: 448 });
   try {
-    execFileSync3("git", ["cat-file", "-e", `${ref}:${path}`], {
-      cwd: vault,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    return true;
+    chmodSync(dir, 448);
   } catch {
-    return false;
   }
 }
-function runSyncStatus(input) {
-  const vault = input.vault;
-  const includeStashes = input.includeStashes ?? false;
-  if (!existsSync8(join28(vault, ".git"))) {
-    return {
-      exitCode: ExitCode.VAULT_PATH_INVALID,
-      result: ok({
-        is_git_repo: false,
-        dirty: 0,
-        ahead: 0,
-        behind: 0,
-        unpromoted_note_paths: 0,
-        unpromoted_note_examples: [],
-        last_commit: "never",
-        status: "not_a_repo",
-        humanHint: "not a git repository"
-      })
-    };
+function atomicWriteJson(path, body) {
+  ensurePrivateDir(dirname7(path));
+  const tmp = `${path}.tmp.${process.pid}.${Date.now()}`;
+  writeFileSync5(tmp, body, { encoding: "utf8", mode: 384 });
+  try {
+    chmodSync(tmp, 384);
+  } catch {
   }
-  enableGitLongPathsOnWindows(vault);
-  const porcelain = git(vault, ["status", "--porcelain"]);
-  const dirty = porcelain ? porcelain.split("\n").filter((l) => l.trim().length > 0).length : 0;
-  const dirtyPaths = parseDirtyPaths(porcelain);
-  const untrackedPaths = splitNonEmptyLines(git(vault, ["ls-files", "--others", "--exclude-standard"]));
-  const revOutput = git(vault, ["rev-list", "--left-right", "--count", "origin/HEAD...HEAD"]);
-  let ahead = 0;
-  let behind = 0;
-  if (revOutput) {
-    const parts = revOutput.split(/\s+/);
-    behind = parseInt(parts[0], 10) || 0;
-    ahead = parseInt(parts[1], 10) || 0;
+  renameSync3(tmp, path);
+  try {
+    chmodSync(path, 384);
+  } catch {
   }
-  const tsRaw = git(vault, ["log", "-1", "--format=%ct"]);
-  let last_commit;
-  if (tsRaw) {
-    const ts = parseInt(tsRaw, 10);
-    if (!isNaN(ts) && ts > 0) {
-      last_commit = new Date(ts * 1e3).toISOString();
-    } else {
-      last_commit = "never";
-    }
-  } else {
-    last_commit = "never";
+}
+function identityEqual(a, b) {
+  return a.publisher === b.publisher && a.draft_sha256 === b.draft_sha256 && a.target === b.target && (a.project ?? "") === (b.project ?? "") && a.log_note_sha256 === b.log_note_sha256;
+}
+function validateRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return err("SCHEME_REJECTED", { message: "journal record must be an object" });
   }
-  const remoteRef = git(vault, ["rev-parse", "--verify", "origin/main"]) ? "origin/main" : git(vault, ["rev-parse", "--verify", "origin/HEAD"]) ? "origin/HEAD" : "HEAD";
-  const unpromotedNoteAll = Array.from(/* @__PURE__ */ new Set([...dirtyPaths, ...untrackedPaths])).filter(isTrackedNotePath).filter((path) => !refHasPath(vault, remoteRef, path));
-  const unpromotedNoteExamples = unpromotedNoteAll.slice(0, 5);
-  const unpromotedNotePaths = unpromotedNoteAll.length;
-  let status;
-  if (dirty > 0) {
-    status = "dirty";
-  } else if (ahead > 0) {
-    status = "ahead";
-  } else if (behind > 0) {
-    status = "behind";
-  } else {
-    status = "clean";
+  const rec = value;
+  if (rec.schema !== PUBLICATION_JOURNAL_SCHEMA) {
+    return err("SCHEME_REJECTED", { message: "unknown journal schema" });
   }
-  const hintLines = [
-    `status: ${status}`,
-    `dirty: ${dirty}`,
-    `ahead: ${ahead}`,
-    `behind: ${behind}`,
-    `unpromoted_note_paths: ${unpromotedNotePaths}`,
-    `last_commit: ${last_commit}`
-  ];
-  const exitCode = status === "clean" ? ExitCode.OK : ExitCode.LINT_HAS_WARNINGS;
-  let stashes;
-  if (includeStashes) {
-    stashes = enumerateStashes(vault);
+  if (typeof rec.operation_id !== "string" || !/^[0-9a-f]{64}$/.test(rec.operation_id)) {
+    return err("SCHEME_REJECTED", { message: "invalid operation_id" });
   }
-  const output = {
+  if (typeof rec.phase !== "string" || !isValidPhase(rec.phase)) {
+    return err("SCHEME_REJECTED", { message: "invalid phase" });
+  }
+  if (typeof rec.vault_identity !== "string" || !/^[0-9a-f]{16}$/.test(rec.vault_identity)) {
+    return err("SCHEME_REJECTED", { message: "invalid vault_identity" });
+  }
+  if (typeof rec.published !== "boolean" || typeof rec.verified !== "boolean") {
+    return err("SCHEME_REJECTED", { message: "published/verified must be booleans" });
+  }
+  if (!Array.isArray(rec.files_changed) || !rec.files_changed.every((f) => typeof f === "string")) {
+    return err("SCHEME_REJECTED", { message: "files_changed must be string[]" });
+  }
+  if (typeof rec.updated_at !== "string") {
+    return err("SCHEME_REJECTED", { message: "updated_at must be a string" });
+  }
+  const id = rec.identity;
+  if (typeof id !== "object" || id === null || Array.isArray(id)) {
+    return err("SCHEME_REJECTED", { message: "identity must be an object" });
+  }
+  const identity = id;
+  if (identity.publisher !== "page" && identity.publisher !== "project-page") {
+    return err("SCHEME_REJECTED", { message: "invalid identity.publisher" });
+  }
+  for (const field of ["draft_sha256", "target", "log_note_sha256"]) {
+    if (typeof identity[field] !== "string") {
+      return err("SCHEME_REJECTED", { message: `invalid identity.${field}` });
+    }
+  }
+  if (identity.prior_target_sha256 !== void 0 && typeof identity.prior_target_sha256 !== "string") {
+    return err("SCHEME_REJECTED", { message: "invalid identity.prior_target_sha256" });
+  }
+  for (const forbidden of ["token", "approval_token", "page_body", "content", "log_note", "credential", "password"]) {
+    if (forbidden in rec || forbidden in identity) {
+      return err("SCHEME_REJECTED", { message: `journal must not contain ${forbidden}` });
+    }
+  }
+  return ok({
+    schema: PUBLICATION_JOURNAL_SCHEMA,
+    operation_id: rec.operation_id,
+    phase: rec.phase,
+    vault_identity: rec.vault_identity,
+    identity: {
+      publisher: identity.publisher,
+      draft_sha256: identity.draft_sha256,
+      target: identity.target,
+      ...typeof identity.project === "string" ? { project: identity.project } : {},
+      log_note_sha256: identity.log_note_sha256,
+      ...typeof identity.prior_target_sha256 === "string" ? { prior_target_sha256: identity.prior_target_sha256 } : {}
+    },
+    published: rec.published,
+    verified: rec.verified,
+    files_changed: [...rec.files_changed],
+    updated_at: rec.updated_at
+  });
+}
+function buildIdentitySummary(input) {
+  return {
+    publisher: input.publisher,
+    draft_sha256: input.draft_sha256,
+    target: input.target,
+    ...input.publisher === "project-page" && input.project ? { project: input.project } : {},
+    log_note_sha256: sha256Hex(input.log_note),
+    prior_target_sha256: input.prior_target_sha256
+  };
+}
+function readPublicationJournal(vaultPath, operationId2, home = process.env.HOME || homedir()) {
+  const { journalPath: journalPath2 } = resolveJournalPaths(vaultPath, operationId2, home);
+  if (!existsSync8(journalPath2)) return ok(null);
+  let text;
+  try {
+    text = readFileSync13(journalPath2, "utf8");
+  } catch (error) {
+    return err("WRITE_FAILED", { message: `read journal failed: ${String(error)}` });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return err("SCHEME_REJECTED", { message: "malformed journal JSON" });
+  }
+  return validateRecord(parsed);
+}
+function createPublicationJournal(input) {
+  const home = input.home ?? process.env.HOME ?? homedir();
+  const paths = resolveJournalPaths(input.vaultPath, input.operationId, home);
+  if (existsSync8(paths.journalPath)) {
+    return err("WRITE_FAILED", { message: "journal already exists", path: paths.journalPath });
+  }
+  const record = {
+    schema: PUBLICATION_JOURNAL_SCHEMA,
+    operation_id: input.operationId,
+    phase: "locked",
+    vault_identity: vaultIdentity(input.vaultPath),
+    identity: input.identity,
+    published: false,
+    verified: false,
+    files_changed: [],
+    updated_at: (input.now ?? /* @__PURE__ */ new Date()).toISOString()
+  };
+  const body = `${JSON.stringify(record, null, 2)}
+`;
+  try {
+    ensurePrivateDir(paths.vaultDir);
+    atomicWriteJson(paths.journalPath, body);
+  } catch (error) {
+    return err("WRITE_FAILED", { message: `create journal failed: ${String(error)}` });
+  }
+  return ok(record);
+}
+function advancePublicationJournal(input) {
+  const home = input.home ?? process.env.HOME ?? homedir();
+  const existing = readPublicationJournal(input.vaultPath, input.operationId, home);
+  if (!existing.ok) return existing;
+  if (!existing.data) {
+    return err("RECOVERY_EVIDENCE_MISSING", {
+      operation_id: input.operationId,
+      message: "publication journal not found"
+    });
+  }
+  const current = existing.data;
+  if (!identityEqual(current.identity, input.identity)) {
+    return err("APPROVAL_MISMATCH", {
+      message: "journal identity does not match approved payload",
+      operation_id: input.operationId
+    });
+  }
+  const from = phaseIndex2(current.phase);
+  const to = phaseIndex2(input.nextPhase);
+  if (to < from) {
+    return err("SCHEME_REJECTED", {
+      message: "phase regression refused",
+      from: current.phase,
+      to: input.nextPhase
+    });
+  }
+  if (to === from && input.nextPhase !== current.phase) {
+    return err("SCHEME_REJECTED", { message: "invalid phase transition" });
+  }
+  const record = {
+    ...current,
+    phase: input.nextPhase,
+    published: input.published ?? current.published,
+    verified: input.verified ?? current.verified,
+    files_changed: input.filesChanged ? [.../* @__PURE__ */ new Set([...current.files_changed, ...input.filesChanged])].sort() : current.files_changed,
+    updated_at: (input.now ?? /* @__PURE__ */ new Date()).toISOString()
+  };
+  const paths = resolveJournalPaths(input.vaultPath, input.operationId, home);
+  try {
+    atomicWriteJson(paths.journalPath, `${JSON.stringify(record, null, 2)}
+`);
+  } catch (error) {
+    return err("WRITE_FAILED", { message: `update journal failed: ${String(error)}` });
+  }
+  return ok(record);
+}
+function deletePublicationJournal(vaultPath, operationId2, home = process.env.HOME || homedir()) {
+  const { journalPath: journalPath2 } = resolveJournalPaths(vaultPath, operationId2, home);
+  if (!existsSync8(journalPath2)) return ok({ deleted: false });
+  try {
+    unlinkSync(journalPath2);
+    return ok({ deleted: true });
+  } catch (error) {
+    return err("WRITE_FAILED", { message: `delete journal failed: ${String(error)}` });
+  }
+}
+function completePublicationJournal(input) {
+  const advanced = advancePublicationJournal({
+    ...input,
+    nextPhase: "complete",
+    published: true,
+    verified: true
+  });
+  if (!advanced.ok) return advanced;
+  const deleted = deletePublicationJournal(
+    input.vaultPath,
+    input.operationId,
+    input.home ?? process.env.HOME ?? homedir()
+  );
+  if (!deleted.ok) return deleted;
+  return ok({ completed: true });
+}
+
+// src/commands/project-page-publish.ts
+var DEFAULT_DEPS3 = {
+  afterStage: async () => void 0,
+  preflight: (input) => runManagedWritePreflight(input)
+};
+function errorExitCode3(error) {
+  switch (error) {
+    case "FILE_NOT_FOUND":
+      return ExitCode.FILE_NOT_FOUND;
+    case "MISSING_CLOSING_DELIMITER":
+      return ExitCode.MISSING_CLOSING_DELIMITER;
+    case "SCHEME_REJECTED":
+    case "NO_TAXONOMY_BLOCK":
+      return ExitCode.SCHEME_REJECTED;
+    case "VAULT_PATH_INVALID":
+      return ExitCode.VAULT_PATH_INVALID;
+    case "SENSITIVE_CONTENT_DETECTED":
+      return ExitCode.SENSITIVE_CONTENT_DETECTED;
+    case "SYNC_LOCK_HELD":
+      return ExitCode.SYNC_LOCK_HELD;
+    case "PREFLIGHT_FAILED":
+      return ExitCode.PREFLIGHT_FAILED;
+    case "APPROVAL_REQUIRED":
+      return ExitCode.APPROVAL_REQUIRED;
+    case "APPROVAL_INVALID":
+      return ExitCode.APPROVAL_INVALID;
+    case "APPROVAL_MISMATCH":
+      return ExitCode.APPROVAL_MISMATCH;
+    case "TARGET_DRIFT":
+      return ExitCode.TARGET_DRIFT;
+    case "RECOVERY_EVIDENCE_MISSING":
+      return ExitCode.RECOVERY_EVIDENCE_MISSING;
+    case "PROJECT_NOT_FOUND":
+      return ExitCode.PROJECT_NOT_FOUND;
+    case "USAGE":
+      return ExitCode.USAGE;
+    case "EVENT_IDENTITY_COLLISION":
+    case "WRITE_FAILED":
+      return ExitCode.WRITE_FAILED;
+    default:
+      return ExitCode.INVALID_FRONTMATTER;
+  }
+}
+function redactDetail2(detail) {
+  if (detail === void 0) return void 0;
+  try {
+    const encoded = JSON.stringify(detail);
+    const redacted = redactApprovalTokens(redactSensitiveContent(encoded).text);
+    return JSON.parse(redacted);
+  } catch {
+    return { message: "unserializable error detail omitted" };
+  }
+}
+async function observeStage2(deps, stage) {
+  try {
+    await deps.afterStage(stage);
+    return void 0;
+  } catch (error) {
+    return err("WRITE_FAILED", {
+      message: redactApprovalTokens(`stage hook failed at ${stage}: ${String(error)}`)
+    });
+  }
+}
+async function readPriorTargetSha(targetPath) {
+  try {
+    const text = await readFile15(targetPath, "utf8");
+    return ok(sha256Hex(text));
+  } catch (error) {
+    if (error.code === "ENOENT") return ok("absent");
+    return err("WRITE_FAILED", { path: targetPath, message: String(error) });
+  }
+}
+function validateLogNote(logNote) {
+  if (logNote !== void 0 && /[\r\n]/.test(logNote)) {
+    return err("SCHEME_REJECTED", { message: "log note must be one line" });
+  }
+  const normalized = normalizeLogNote(logNote);
+  if (normalized && Buffer.byteLength(normalized, "utf8") > 500) {
+    return err("SCHEME_REJECTED", { message: "log note must be one line and at most 500 UTF-8 bytes" });
+  }
+  if (normalized && scanSensitiveContent(normalized, { file: "project-page-publish log note" }).length > 0) {
+    return err("SENSITIVE_CONTENT_DETECTED", {
+      message: "log note contains sensitive authentication material"
+    });
+  }
+  return ok(normalized);
+}
+async function prepareProjectPagePublication(input) {
+  let content;
+  try {
+    content = await readFile15(input.draftPath, "utf8");
+  } catch (error) {
+    return err("FILE_NOT_FOUND", { path: input.draftPath, message: String(error) });
+  }
+  let draftRealPath;
+  try {
+    draftRealPath = realpathSync4(input.draftPath);
+  } catch (error) {
+    return err("VAULT_PATH_INVALID", {
+      path: input.draftPath,
+      message: `draft realpath failed: ${String(error)}`
+    });
+  }
+  const target = assertArchitectureTargetInsideVault(input.vault, input.target, input.project);
+  if (!target.ok) return target;
+  if (resolve5(input.draftPath) === target.data.absolutePath || target.data.existingRealPath !== void 0 && draftRealPath === target.data.existingRealPath) {
+    return err("VAULT_PATH_INVALID", { message: "draft must not alias the final target" });
+  }
+  const isNew = target.data.existingRealPath === void 0;
+  const page = prepareArchitecturePage(content, input.target, input.project, { isNew });
+  if (!page.ok) return page;
+  const logNote = validateLogNote(input.logNote);
+  if (!logNote.ok) return logNote;
+  const prior = await readPriorTargetSha(target.data.absolutePath);
+  if (!prior.ok) return prior;
+  const draftSha256 = sha256Hex(content);
+  const approvalPayload = buildApprovalPayload({
+    publisher: "project-page",
+    draft_sha256: draftSha256,
+    target: input.target,
+    project: input.project,
+    log_note: logNote.data,
+    prior_target_sha256: prior.data
+  });
+  if (!approvalPayload.ok) return approvalPayload;
+  const date = (input.now ?? /* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const taxonomyComment = taxonomyCommentForPage(input.target, date);
+  if (!taxonomyComment.ok) return taxonomyComment;
+  const identity = buildIdentitySummary({
+    publisher: "project-page",
+    draft_sha256: draftSha256,
+    target: input.target,
+    project: input.project,
+    log_note: logNote.data,
+    prior_target_sha256: prior.data
+  });
+  return ok({
+    page: page.data,
+    source: { kind: "file", realPath: draftRealPath },
+    targetPath: target.data.absolutePath,
+    logNote: logNote.data,
+    draftSha256,
+    priorTargetSha256: prior.data,
+    approvalPayload: approvalPayload.data,
+    operationId: operationIdFromApproval(approvalPayload.data),
+    identity,
+    date,
+    taxonomyComment: taxonomyComment.data
+  });
+}
+function successReceipt2(prepared, opts) {
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      approval_required: true,
+      ...opts.approvalToken ? { approval_token: opts.approvalToken } : {},
+      operation_id: prepared.operationId,
+      project: prepared.page.project,
+      target: prepared.page.target,
+      page_type: prepared.page.type,
+      tags: [...prepared.page.tags],
+      taxonomy_added: [...opts.taxonomyAdded],
+      page_changed: opts.pageChanged,
+      project_index_changed: opts.projectIndexChanged,
+      log_appended: opts.logAppended,
+      dry_run: opts.dryRun,
+      files_changed: opts.filesChanged,
+      draft_sha256: prepared.draftSha256,
+      target_before: prepared.priorTargetSha256,
+      base_oid: opts.receipt?.base_oid ?? null,
+      write_mode: opts.receipt?.mode ?? null,
+      ...opts.receipt ? {
+        mutation_vault: opts.receipt.mutation_vault,
+        git_vault: opts.receipt.git_vault,
+        convergence_source: opts.receipt.convergence_source
+      } : {},
+      ...opts.receipt?.convergence_vault ? { convergence_vault: opts.receipt.convergence_vault } : {},
+      ...opts.receipt?.host_id ? { host_id: opts.receipt.host_id } : {},
+      humanHint: opts.dryRun ? `dry run: would publish ${prepared.page.target} (${prepared.operationId.slice(0, 12)})` : `published ${prepared.page.target} (${prepared.operationId.slice(0, 12)})`
+    })
+  };
+}
+function phaseFailure2(stage, prepared, published, verified, cause, context = {}, exitCode = ExitCode.WRITE_FAILED) {
+  return {
+    exitCode: exitCode === ExitCode.WRITE_FAILED ? errorExitCode3(cause.error) || ExitCode.WRITE_FAILED : exitCode,
+    result: err(cause.error === "EVENT_IDENTITY_COLLISION" ? "WRITE_FAILED" : cause.error, {
+      ...context,
+      stage,
+      published,
+      verified,
+      target: prepared.page.target,
+      operation_id: prepared.operationId,
+      retry_safe: stage !== "target" && cause.error !== "TARGET_DRIFT",
+      cause_error: cause.error,
+      cause_detail: redactDetail2(cause.detail)
+    })
+  };
+}
+async function previewProjectPagePublication(prepared, vault) {
+  const schemaPath = join29(vault, "SCHEMA.md");
+  let schemaText;
+  try {
+    schemaText = await readFile15(schemaPath, "utf8");
+  } catch (error) {
+    return {
+      exitCode: ExitCode.FILE_NOT_FOUND,
+      result: err("FILE_NOT_FOUND", { path: schemaPath, message: String(error) })
+    };
+  }
+  const reconciled = reconcileTaxonomyDocument(schemaText, {
+    tags: prepared.page.tags,
+    comment: prepared.taxonomyComment
+  });
+  if (!reconciled.ok) return { exitCode: errorExitCode3(reconciled.error), result: reconciled };
+  const prior = await readPriorTargetSha(prepared.targetPath);
+  if (!prior.ok) return { exitCode: errorExitCode3(prior.error), result: prior };
+  const pageChanged = prior.data === "absent" || prior.data !== prepared.draftSha256;
+  const projectIndex = await renderProjectIndex(vault, prepared.page.project, { today: prepared.date });
+  if (!projectIndex.ok) {
+    if (projectIndex.error !== "PROJECT_NOT_FOUND") {
+      return { exitCode: errorExitCode3(projectIndex.error), result: projectIndex };
+    }
+  }
+  let projectIndexChanged = true;
+  if (projectIndex.ok) {
+    const indexPath = join29(vault, projectIndex.data.index_path);
+    try {
+      const existing = await readFile15(indexPath, "utf8");
+      projectIndexChanged = existing !== projectIndex.data.text || pageChanged;
+    } catch {
+      projectIndexChanged = true;
+    }
+  }
+  const logPath = join29(vault, "log.md");
+  let logAppended = true;
+  try {
+    const logText = await readFile15(logPath, "utf8");
+    logAppended = !logText.includes(`<!-- skillwiki-project-page-publish:${prepared.operationId} -->`);
+  } catch {
+    return {
+      exitCode: ExitCode.FILE_NOT_FOUND,
+      result: err("FILE_NOT_FOUND", { path: logPath })
+    };
+  }
+  const token = encodeApprovalToken(prepared.approvalPayload);
+  if (!token.ok) return { exitCode: errorExitCode3(token.error), result: token };
+  const filesChanged = [
+    ...reconciled.data.changed ? ["SCHEMA.md"] : [],
+    ...pageChanged ? [prepared.page.target] : [],
+    ...projectIndexChanged ? [`projects/${prepared.page.project}/knowledge.md`] : [],
+    ...logAppended ? ["log.md"] : []
+  ];
+  return successReceipt2(prepared, {
+    taxonomyAdded: reconciled.data.added,
+    pageChanged,
+    projectIndexChanged,
+    logAppended,
+    filesChanged,
+    dryRun: true,
+    approvalToken: token.data
+  });
+}
+function emptyLockedState2() {
+  return {
+    taxonomyAdded: [],
+    pageChanged: false,
+    projectIndexChanged: false,
+    published: false,
+    verified: false,
+    changed: /* @__PURE__ */ new Set()
+  };
+}
+async function revalidatePriorUnderLock(prepared, vault) {
+  const fresh = assertArchitectureTargetInsideVault(vault, prepared.page.target, prepared.page.project);
+  if (!fresh.ok) return fresh;
+  if (fresh.data.absolutePath !== prepared.targetPath) {
+    return err("VAULT_PATH_INVALID", { message: "target canonical path changed after preparation" });
+  }
+  if (prepared.source.kind === "file" && fresh.data.existingRealPath !== void 0 && fresh.data.existingRealPath === prepared.source.realPath) {
+    return err("VAULT_PATH_INVALID", { message: "draft now aliases the final target" });
+  }
+  const prior = await readPriorTargetSha(fresh.data.absolutePath);
+  if (!prior.ok) return prior;
+  if (prior.data !== prepared.priorTargetSha256) {
+    if (prior.data === prepared.draftSha256) {
+      return ok({ absolutePath: fresh.data.absolutePath });
+    }
+    return err("TARGET_DRIFT", {
+      message: "target changed since approval",
+      expected_prior: prepared.priorTargetSha256,
+      actual: prior.data
+    });
+  }
+  return ok({ absolutePath: fresh.data.absolutePath });
+}
+var PHASE_RANK = {
+  locked: 0,
+  taxonomy: 1,
+  page: 2,
+  verified: 3,
+  "project-index": 4,
+  unlocked: 5,
+  event: 6,
+  log: 7,
+  complete: 8
+};
+function phaseAtLeast(current, needed) {
+  if (!current || !isValidPhase(current)) return false;
+  return PHASE_RANK[current] >= PHASE_RANK[needed];
+}
+async function runLockedStages(prepared, vault, deps, journalHome) {
+  const state = emptyLockedState2();
+  const home = journalHome;
+  const revalidated = await revalidatePriorUnderLock(prepared, vault);
+  if (!revalidated.ok) {
+    return {
+      ok: false,
+      exitCode: errorExitCode3(revalidated.error),
+      stage: "target",
+      state,
+      cause: revalidated
+    };
+  }
+  let currentPhase = "locked";
+  const existingJournal = readPublicationJournal(vault, prepared.operationId, home);
+  if (!existingJournal.ok) {
+    return {
+      ok: false,
+      exitCode: errorExitCode3(existingJournal.error),
+      stage: "journal",
+      state,
+      cause: existingJournal
+    };
+  }
+  if (!existingJournal.data) {
+    const journal = createPublicationJournal({
+      vaultPath: vault,
+      operationId: prepared.operationId,
+      identity: prepared.identity,
+      home
+    });
+    if (!journal.ok) {
+      return {
+        ok: false,
+        exitCode: errorExitCode3(journal.error),
+        stage: "journal",
+        state,
+        cause: journal
+      };
+    }
+  } else {
+    currentPhase = existingJournal.data.phase;
+    state.published = existingJournal.data.published || phaseAtLeast(currentPhase, "page");
+    state.verified = existingJournal.data.verified || phaseAtLeast(currentPhase, "verified");
+    for (const f of existingJournal.data.files_changed) state.changed.add(f);
+  }
+  const journalHook = await observeStage2(deps, "journal");
+  if (journalHook) {
+    return { ok: false, exitCode: ExitCode.WRITE_FAILED, stage: "journal", state, cause: journalHook };
+  }
+  const schemaPath = join29(vault, "SCHEMA.md");
+  {
+    let schemaText;
+    try {
+      schemaText = await readFile15(schemaPath, "utf8");
+    } catch (error) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "taxonomy",
+        state,
+        cause: err("WRITE_FAILED", { message: String(error) })
+      };
+    }
+    const reconciled = reconcileTaxonomyDocument(schemaText, {
+      tags: prepared.page.tags,
+      comment: prepared.taxonomyComment
+    });
+    if (!reconciled.ok) {
+      return {
+        ok: false,
+        exitCode: errorExitCode3(reconciled.error),
+        stage: "taxonomy",
+        state,
+        cause: reconciled
+      };
+    }
+    state.taxonomyAdded = reconciled.data.added;
+    if (reconciled.data.changed) {
+      const schemaWrite = await atomicWriteText(schemaPath, reconciled.data.text);
+      if (!schemaWrite.ok) {
+        return { ok: false, exitCode: ExitCode.WRITE_FAILED, stage: "taxonomy", state, cause: schemaWrite };
+      }
+      if (schemaWrite.data.changed) state.changed.add("SCHEMA.md");
+    }
+    if (!phaseAtLeast(currentPhase, "taxonomy")) {
+      advancePublicationJournal({
+        vaultPath: vault,
+        operationId: prepared.operationId,
+        identity: prepared.identity,
+        nextPhase: "taxonomy",
+        filesChanged: [...state.changed],
+        home
+      });
+      currentPhase = "taxonomy";
+    }
+    const taxonomyHook = await observeStage2(deps, "taxonomy");
+    if (taxonomyHook) {
+      return { ok: false, exitCode: ExitCode.WRITE_FAILED, stage: "taxonomy", state, cause: taxonomyHook };
+    }
+  }
+  if (!phaseAtLeast(currentPhase, "page")) {
+    try {
+      await mkdir10(dirname8(prepared.targetPath), { recursive: true });
+    } catch (error) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "page",
+        state,
+        cause: err("WRITE_FAILED", { message: String(error) })
+      };
+    }
+    const pageWrite = await safeWritePage(prepared.targetPath, prepared.page.content);
+    if (!pageWrite.ok) {
+      return { ok: false, exitCode: errorExitCode3(pageWrite.error), stage: "page", state, cause: pageWrite };
+    }
+    state.pageChanged = pageWrite.data.changed;
+    if (state.pageChanged) state.changed.add(prepared.page.target);
+    state.published = true;
+    advancePublicationJournal({
+      vaultPath: vault,
+      operationId: prepared.operationId,
+      identity: prepared.identity,
+      nextPhase: "page",
+      published: true,
+      filesChanged: [...state.changed],
+      home
+    });
+    currentPhase = "page";
+    const pageHook = await observeStage2(deps, "page");
+    if (pageHook) {
+      return { ok: false, exitCode: ExitCode.WRITE_FAILED, stage: "page", state, cause: pageHook };
+    }
+  } else {
+    state.published = true;
+  }
+  if (!phaseAtLeast(currentPhase, "verified")) {
+    let visible;
+    let visibleSchema;
+    try {
+      [visible, visibleSchema] = await Promise.all([
+        readFile15(prepared.targetPath, "utf8"),
+        readFile15(schemaPath, "utf8")
+      ]);
+    } catch (error) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "verify",
+        state,
+        cause: err("WRITE_FAILED", { message: String(error) })
+      };
+    }
+    const visiblePage = prepareArchitecturePage(visible, prepared.page.target, prepared.page.project, {
+      isNew: false
+    });
+    const visibleTaxonomy = extractTaxonomy(visibleSchema);
+    if (!visiblePage.ok || visible !== prepared.page.content || sha256Hex(visible) !== prepared.draftSha256 || !visibleTaxonomy.ok || prepared.page.tags.some((tag) => !visibleTaxonomy.data.includes(tag))) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "verify",
+        state,
+        cause: err("WRITE_FAILED", { message: "published bytes or taxonomy verification failed" })
+      };
+    }
+    state.verified = true;
+    advancePublicationJournal({
+      vaultPath: vault,
+      operationId: prepared.operationId,
+      identity: prepared.identity,
+      nextPhase: "verified",
+      published: true,
+      verified: true,
+      filesChanged: [...state.changed],
+      home
+    });
+    currentPhase = "verified";
+    const verifyHook = await observeStage2(deps, "verify");
+    if (verifyHook) {
+      return { ok: false, exitCode: ExitCode.WRITE_FAILED, stage: "verify", state, cause: verifyHook };
+    }
+  } else {
+    state.verified = true;
+  }
+  if (!phaseAtLeast(currentPhase, "project-index")) {
+    const rendered = await renderProjectIndex(vault, prepared.page.project, { today: prepared.date });
+    if (!rendered.ok) {
+      return {
+        ok: false,
+        exitCode: errorExitCode3(rendered.error),
+        stage: "project-index",
+        state,
+        cause: rendered
+      };
+    }
+    const knowledgePath = join29(vault, rendered.data.index_path);
+    try {
+      await mkdir10(dirname8(knowledgePath), { recursive: true });
+    } catch (error) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "project-index",
+        state,
+        cause: err("WRITE_FAILED", { message: String(error) })
+      };
+    }
+    const knowledgeWrite = await atomicWriteText(knowledgePath, rendered.data.text);
+    if (!knowledgeWrite.ok) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "project-index",
+        state,
+        cause: knowledgeWrite
+      };
+    }
+    state.projectIndexChanged = knowledgeWrite.data.changed;
+    if (state.projectIndexChanged) state.changed.add(rendered.data.index_path);
+    try {
+      const visibleIndex = await readFile15(knowledgePath, "utf8");
+      if (visibleIndex !== rendered.data.text) {
+        return {
+          ok: false,
+          exitCode: ExitCode.WRITE_FAILED,
+          stage: "project-index",
+          state,
+          cause: err("WRITE_FAILED", { message: "project knowledge.md verification failed" })
+        };
+      }
+    } catch (error) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "project-index",
+        state,
+        cause: err("WRITE_FAILED", { message: String(error) })
+      };
+    }
+    advancePublicationJournal({
+      vaultPath: vault,
+      operationId: prepared.operationId,
+      identity: prepared.identity,
+      nextPhase: "project-index",
+      published: true,
+      verified: true,
+      filesChanged: [...state.changed],
+      home
+    });
+    currentPhase = "project-index";
+    const indexHook = await observeStage2(deps, "project-index");
+    if (indexHook) {
+      return {
+        ok: false,
+        exitCode: ExitCode.WRITE_FAILED,
+        stage: "project-index",
+        state,
+        cause: indexHook
+      };
+    }
+  }
+  return { ok: true, data: state };
+}
+function renderProjectPublicationLog(prepared, added) {
+  return [
+    `## [${prepared.date}] project-page-publish | ${prepared.page.target}`,
+    "",
+    `- Published: [[${prepared.page.target.replace(/\.md$/, "")}]]`,
+    `- Project: [[${prepared.page.project}]]`,
+    `- Taxonomy: ${added.length > 0 ? `added ${added.join(", ")}` : "no additions"}`,
+    ...prepared.logNote ? [`- Note: ${prepared.logNote}`] : []
+  ].join("\n");
+}
+async function publishWithReceipt(prepared, vault, writeReceipt, deps, journalHome) {
+  const canonicalVault = resolve5(vault);
+  if (writeReceipt.mutation_vault !== canonicalVault) {
+    return {
+      exitCode: ExitCode.PREFLIGHT_FAILED,
+      result: err("PREFLIGHT_FAILED", {
+        reason: "mutation-vault-receipt-mismatch",
+        expected: writeReceipt.mutation_vault,
+        actual: canonicalVault
+      })
+    };
+  }
+  if (writeReceipt.base_oid) {
+    const head = writeReceipt.git_vault ? git(writeReceipt.git_vault, ["rev-parse", "HEAD"]) : null;
+    if (head !== writeReceipt.base_oid) {
+      return {
+        exitCode: ExitCode.PREFLIGHT_FAILED,
+        result: err("PREFLIGHT_FAILED", {
+          reason: "base-oid-drift",
+          expected: writeReceipt.base_oid,
+          actual: head,
+          git_vault: writeReceipt.git_vault
+        })
+      };
+    }
+  }
+  const aggregateMode = resolveRootAggregateMode();
+  let lock;
+  try {
+    lock = acquireOwnedSyncLock(vault, {
+      summary: `project-page publish ${prepared.page.target}`,
+      ttlMinutes: 1
+    });
+  } catch (error) {
+    return {
+      exitCode: ExitCode.WRITE_FAILED,
+      result: err("WRITE_FAILED", { stage: "lock", message: String(error) })
+    };
+  }
+  if (!lock.ok) return { exitCode: errorExitCode3(lock.error), result: lock };
+  let primary;
+  let released;
+  try {
+    primary = await runLockedStages(prepared, vault, deps, journalHome);
+  } catch (error) {
+    primary = {
+      ok: false,
+      exitCode: ExitCode.WRITE_FAILED,
+      stage: "taxonomy",
+      state: emptyLockedState2(),
+      cause: err("WRITE_FAILED", { message: `unexpected primary-stage failure: ${String(error)}` })
+    };
+  } finally {
+    released = releaseOwnedSyncLock(lock.data);
+  }
+  const primaryState = primary?.ok ? primary.data : primary?.state;
+  if (released === void 0 || !released.ok || !released.data.released) {
+    return phaseFailure2(
+      "unlock",
+      prepared,
+      primaryState?.published ?? false,
+      primaryState?.verified ?? false,
+      released && !released.ok ? released : err("WRITE_FAILED", { message: "lock release did not run" })
+    );
+  }
+  {
+    const journalNow = readPublicationJournal(vault, prepared.operationId, journalHome);
+    const phase = journalNow.ok && journalNow.data ? journalNow.data.phase : void 0;
+    if (!phaseAtLeast(phase, "unlocked")) {
+      advancePublicationJournal({
+        vaultPath: vault,
+        operationId: prepared.operationId,
+        identity: prepared.identity,
+        nextPhase: "unlocked",
+        published: primaryState?.published,
+        verified: primaryState?.verified,
+        filesChanged: primaryState ? [...primaryState.changed] : void 0,
+        home: journalHome
+      });
+    }
+  }
+  const unlockHook = await observeStage2(deps, "unlock");
+  if (unlockHook) {
+    return phaseFailure2(
+      "unlock",
+      prepared,
+      primaryState?.published ?? false,
+      primaryState?.verified ?? false,
+      unlockHook
+    );
+  }
+  if (primary === void 0) {
+    return phaseFailure2(
+      "taxonomy",
+      prepared,
+      false,
+      false,
+      err("WRITE_FAILED", { message: "locked publication produced no result" })
+    );
+  }
+  if (!primary.ok) {
+    return phaseFailure2(
+      primary.stage,
+      prepared,
+      primary.state.published,
+      primary.state.verified,
+      primary.cause,
+      void 0,
+      primary.exitCode
+    );
+  }
+  const state = primary.data;
+  const event = await writeLogEvent(vault, {
+    schema: "skillwiki-log-event/v1",
+    operation_id: prepared.operationId,
+    occurred_at: `${prepared.date}T00:00:00.000Z`,
+    host_id: writeReceipt.host_id ?? "standalone",
+    actor: "skillwiki-cli",
+    kind: "project-page-publish",
+    target: prepared.page.target,
+    note: prepared.logNote || `Published ${prepared.page.title}`,
+    metadata: {
+      page_type: prepared.page.type,
+      project: prepared.page.project,
+      tags: [...prepared.page.tags].sort(),
+      draft_sha256: prepared.draftSha256
+      // Do not embed mutable base_oid in identity-critical fields; receipt still carries it.
+    }
+  });
+  if (!event.ok) {
+    return phaseFailure2(
+      "event",
+      prepared,
+      true,
+      true,
+      event,
+      void 0,
+      event.error === "EVENT_IDENTITY_COLLISION" ? ExitCode.WRITE_FAILED : errorExitCode3(event.error)
+    );
+  }
+  if (event.data.created) state.changed.add(event.data.path);
+  {
+    const journalNow = readPublicationJournal(vault, prepared.operationId, journalHome);
+    const phase = journalNow.ok && journalNow.data ? journalNow.data.phase : void 0;
+    if (!phaseAtLeast(phase, "event")) {
+      advancePublicationJournal({
+        vaultPath: vault,
+        operationId: prepared.operationId,
+        identity: prepared.identity,
+        nextPhase: "event",
+        published: true,
+        verified: true,
+        filesChanged: [...state.changed],
+        home: journalHome
+      });
+    }
+  }
+  const eventHook = await observeStage2(deps, "event");
+  if (eventHook) return phaseFailure2("event", prepared, true, true, eventHook);
+  let logAppended = false;
+  if (aggregateMode === "dual") {
+    const log = await runLogAppend({
+      vault,
+      content: renderProjectPublicationLog(prepared, state.taxonomyAdded),
+      operationId: prepared.operationId,
+      strictLock: true,
+      recordLastOp: false,
+      eventKind: "project-page-publish"
+    });
+    if (!log.result.ok) return phaseFailure2("log", prepared, true, true, log.result);
+    if (log.exitCode !== ExitCode.OK) {
+      return phaseFailure2(
+        "log",
+        prepared,
+        true,
+        true,
+        err("WRITE_FAILED", { message: "log append returned inconsistent success state" })
+      );
+    }
+    logAppended = log.result.data.appended;
+    if (logAppended) state.changed.add("log.md");
+    {
+      const journalNow = readPublicationJournal(vault, prepared.operationId, journalHome);
+      const phase = journalNow.ok && journalNow.data ? journalNow.data.phase : void 0;
+      if (!phaseAtLeast(phase, "log")) {
+        advancePublicationJournal({
+          vaultPath: vault,
+          operationId: prepared.operationId,
+          identity: prepared.identity,
+          nextPhase: "log",
+          published: true,
+          verified: true,
+          filesChanged: [...state.changed],
+          home: journalHome
+        });
+      }
+    }
+    const logHook = await observeStage2(deps, "log");
+    if (logHook) return phaseFailure2("log", prepared, true, true, logHook);
+  }
+  const completed = completePublicationJournal({
+    vaultPath: vault,
+    operationId: prepared.operationId,
+    identity: prepared.identity,
+    filesChanged: [...state.changed],
+    home: journalHome
+  });
+  if (!completed.ok) {
+    if (completed.error !== "RECOVERY_EVIDENCE_MISSING") {
+      return phaseFailure2("journal-cleanup", prepared, true, true, completed);
+    }
+  }
+  const cleanupHook = await observeStage2(deps, "journal-cleanup");
+  if (cleanupHook) return phaseFailure2("journal-cleanup", prepared, true, true, cleanupHook);
+  return successReceipt2(prepared, {
+    taxonomyAdded: state.taxonomyAdded,
+    pageChanged: state.pageChanged,
+    projectIndexChanged: state.projectIndexChanged,
+    logAppended,
+    filesChanged: [...state.changed],
+    dryRun: false,
+    receipt: writeReceipt
+  });
+}
+async function publishPrepared(prepared, vault, deps, journalHome) {
+  return runManagedWriteTransaction({
+    vault,
+    command: `project-page publish ${prepared.page.target}`,
+    allowImmutableRecord: true,
+    preflight: deps.preflight,
+    mutate: async (receipt) => publishWithReceipt(prepared, vault, receipt, deps, journalHome)
+  });
+}
+async function runProjectPagePublish(input, deps = DEFAULT_DEPS3) {
+  if (input.approve && !input.write) {
+    return {
+      exitCode: ExitCode.USAGE,
+      result: err("USAGE", { message: "--approve requires --write" })
+    };
+  }
+  if (input.write && !input.approve) {
+    return {
+      exitCode: ExitCode.APPROVAL_REQUIRED,
+      result: err("APPROVAL_REQUIRED", {
+        message: "project-page publish --write requires --approve <token> from a prior dry-run",
+        project: input.project,
+        target: input.target
+      })
+    };
+  }
+  const prepared = await prepareProjectPagePublication(input);
+  if (!prepared.ok) return { exitCode: errorExitCode3(prepared.error), result: prepared };
+  if (!input.write) {
+    return previewProjectPagePublication(prepared.data, input.vault);
+  }
+  const verified = verifyApprovalToken(input.approve, {
+    publisher: "project-page",
+    draft_sha256: prepared.data.draftSha256,
+    target: prepared.data.page.target,
+    project: prepared.data.page.project,
+    log_note: prepared.data.logNote,
+    prior_target_sha256: prepared.data.priorTargetSha256
+  });
+  if (!verified.ok) {
+    return {
+      exitCode: errorExitCode3(verified.error),
+      result: err(verified.error, redactDetail2(verified.detail))
+    };
+  }
+  return publishPrepared(prepared.data, input.vault, deps, input.journalHome);
+}
+
+// src/commands/sync.ts
+import { existsSync as existsSync9 } from "fs";
+import { join as join30 } from "path";
+import { execFileSync as execFileSync3 } from "child_process";
+
+// src/utils/vault-git-pathspec.ts
+var VAULT_GENERATED_COMMIT_PATHS = [
+  ".skillwiki/last-op.json",
+  ".skillwiki/memory",
+  ".skillwiki/memory-topics.json"
+];
+var VAULT_GENERATED_COMMIT_EXCLUDES = [
+  ...VAULT_GENERATED_COMMIT_PATHS.map((path) => `:!${path}`)
+];
+var VAULT_COMMIT_PATHSPEC = [".", ...VAULT_GENERATED_COMMIT_EXCLUDES];
+function stageVaultContentChanges(vault) {
+  gitStrict(vault, ["add", "-A", "--", "."]);
+  for (const generatedPath of VAULT_GENERATED_COMMIT_PATHS) {
+    try {
+      gitStrict(vault, ["reset", "HEAD", "--", generatedPath]);
+    } catch (_e) {
+    }
+  }
+}
+
+// src/commands/sync.ts
+function parseDirtyPaths(porcelain) {
+  if (!porcelain) return [];
+  return porcelain.split("\n").map((line) => line.trimEnd()).filter((line) => line.length >= 4).map((line) => {
+    const payload = line.length >= 3 && line[2] === " " ? line.slice(3) : line.length >= 2 && line[1] === " " ? line.slice(2) : line;
+    const arrow = payload.lastIndexOf(" -> ");
+    return arrow >= 0 ? payload.slice(arrow + 4) : payload;
+  }).filter((path) => path.length > 0);
+}
+function splitNonEmptyLines(text) {
+  if (!text) return [];
+  return text.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+}
+function isTrackedNotePath(path) {
+  if (!path.endsWith(".md")) return false;
+  return !/^\.(skillwiki|claude|obsidian|antigravitycli|playwright-cli)\//.test(path);
+}
+function refHasPath(vault, ref, path) {
+  try {
+    execFileSync3("git", ["cat-file", "-e", `${ref}:${path}`], {
+      cwd: vault,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function runSyncStatus(input) {
+  const vault = input.vault;
+  const includeStashes = input.includeStashes ?? false;
+  if (!existsSync9(join30(vault, ".git"))) {
+    return {
+      exitCode: ExitCode.VAULT_PATH_INVALID,
+      result: ok({
+        is_git_repo: false,
+        dirty: 0,
+        ahead: 0,
+        behind: 0,
+        unpromoted_note_paths: 0,
+        unpromoted_note_examples: [],
+        last_commit: "never",
+        status: "not_a_repo",
+        humanHint: "not a git repository"
+      })
+    };
+  }
+  enableGitLongPathsOnWindows(vault);
+  const porcelain = git(vault, ["status", "--porcelain"]);
+  const dirty = porcelain ? porcelain.split("\n").filter((l) => l.trim().length > 0).length : 0;
+  const dirtyPaths = parseDirtyPaths(porcelain);
+  const untrackedPaths = splitNonEmptyLines(git(vault, ["ls-files", "--others", "--exclude-standard"]));
+  const revOutput = git(vault, ["rev-list", "--left-right", "--count", "origin/HEAD...HEAD"]);
+  let ahead = 0;
+  let behind = 0;
+  if (revOutput) {
+    const parts = revOutput.split(/\s+/);
+    behind = parseInt(parts[0], 10) || 0;
+    ahead = parseInt(parts[1], 10) || 0;
+  }
+  const tsRaw = git(vault, ["log", "-1", "--format=%ct"]);
+  let last_commit;
+  if (tsRaw) {
+    const ts = parseInt(tsRaw, 10);
+    if (!isNaN(ts) && ts > 0) {
+      last_commit = new Date(ts * 1e3).toISOString();
+    } else {
+      last_commit = "never";
+    }
+  } else {
+    last_commit = "never";
+  }
+  const remoteRef = git(vault, ["rev-parse", "--verify", "origin/main"]) ? "origin/main" : git(vault, ["rev-parse", "--verify", "origin/HEAD"]) ? "origin/HEAD" : "HEAD";
+  const unpromotedNoteAll = Array.from(/* @__PURE__ */ new Set([...dirtyPaths, ...untrackedPaths])).filter(isTrackedNotePath).filter((path) => !refHasPath(vault, remoteRef, path));
+  const unpromotedNoteExamples = unpromotedNoteAll.slice(0, 5);
+  const unpromotedNotePaths = unpromotedNoteAll.length;
+  let status;
+  if (dirty > 0) {
+    status = "dirty";
+  } else if (ahead > 0) {
+    status = "ahead";
+  } else if (behind > 0) {
+    status = "behind";
+  } else {
+    status = "clean";
+  }
+  const hintLines = [
+    `status: ${status}`,
+    `dirty: ${dirty}`,
+    `ahead: ${ahead}`,
+    `behind: ${behind}`,
+    `unpromoted_note_paths: ${unpromotedNotePaths}`,
+    `last_commit: ${last_commit}`
+  ];
+  const exitCode = status === "clean" ? ExitCode.OK : ExitCode.LINT_HAS_WARNINGS;
+  let stashes;
+  if (includeStashes) {
+    stashes = enumerateStashes(vault);
+  }
+  const output = {
     is_git_repo: true,
     dirty,
     ahead,
@@ -6168,7 +7740,7 @@ function runSyncStatus(input) {
 }
 async function runSyncPush(input) {
   const vault = input.vault;
-  if (!existsSync8(join28(vault, ".git"))) {
+  if (!existsSync9(join30(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("NOT_A_GIT_REPO", { path: vault })
@@ -6328,7 +7900,7 @@ function enableGitLongPathsOnWindows(vault) {
 }
 async function runSyncPull(input) {
   const vault = input.vault;
-  if (!existsSync8(join28(vault, ".git"))) {
+  if (!existsSync9(join30(vault, ".git"))) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("NOT_A_GIT_REPO", { path: vault })
@@ -6443,7 +8015,7 @@ function runSyncPeers(input) {
 }
 function runSyncLock(input) {
   const vault = input.vault;
-  if (!existsSync8(vault)) {
+  if (!existsSync9(vault)) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: vault })
@@ -6478,7 +8050,7 @@ function runSyncLock(input) {
 }
 function runSyncUnlock(input) {
   const vault = input.vault;
-  if (!existsSync8(vault)) {
+  if (!existsSync9(vault)) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err("VAULT_PATH_INVALID", { path: vault })
@@ -6555,11 +8127,11 @@ function runSyncJournalClearStale(input) {
 }
 
 // src/commands/snapshot-maintenance.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, appendFileSync } from "fs";
-import { createHash as createHash5 } from "crypto";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, appendFileSync } from "fs";
+import { createHash as createHash6 } from "crypto";
 import { execSync as execSync3, spawn } from "child_process";
 import { platform as platform2 } from "os";
-import { join as join29, resolve as resolvePath2 } from "path";
+import { join as join31, resolve as resolvePath2 } from "path";
 var MAINTENANCE_SCHEMA_VERSION = 1;
 var MAINTENANCE_COMMAND = "snapshot-maintenance journal clear-stale";
 function canonicalize(p) {
@@ -6581,7 +8153,7 @@ function computeApprovalId(plan) {
     targets,
     normalizeReason(plan.operator_reason)
   ].join("|");
-  return "smap1-" + createHash5("sha256").update(payload).digest("hex").slice(0, 32);
+  return "smap1-" + createHash6("sha256").update(payload).digest("hex").slice(0, 32);
 }
 function normalizeReason(reason) {
   return reason.trim().replace(/\s+/g, " ");
@@ -6622,7 +8194,7 @@ async function runSnapshotMaintenanceDryRun(input) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_WRONG_WORKTREE"));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_WRONG_WORKTREE", `requested path '${requested}' is not the configured snapshot worktree '${canonicalize(configuredWorktree)}'`) };
   }
-  if (!existsSync9(requested) || !existsSync9(join29(requested, ".git"))) {
+  if (!existsSync10(requested) || !existsSync10(join31(requested, ".git"))) {
     audit(makeAuditEvent(input, fleetLoad.hostId, now, "refusal", "MAINTENANCE_MISSING_GIT_REPO"));
     return { exitCode: ExitCode.PROTECTED_SNAPSHOTTER_WRITE_BLOCKED, result: refusalErr("MAINTENANCE_MISSING_GIT_REPO", `snapshot worktree is not a git repository: ${requested}`) };
   }
@@ -6702,14 +8274,14 @@ async function resolveLiveVault(input) {
   return resolved.ok ? canonicalize(resolved.data.path) : void 0;
 }
 function snapshotMaintenanceAuditLogPath(home) {
-  const stateDir = platform2() === "darwin" ? join29(home, "Library", "Application Support", "vault-sync") : join29(home, ".local", "state", "vault-sync");
-  return join29(stateDir, "snapshot-maintenance-audit.jsonl");
+  const stateDir = platform2() === "darwin" ? join31(home, "Library", "Application Support", "vault-sync") : join31(home, ".local", "state", "vault-sync");
+  return join31(stateDir, "snapshot-maintenance-audit.jsonl");
 }
 function defaultAuditSink(home) {
   return (event) => {
     try {
       const logPath = snapshotMaintenanceAuditLogPath(home);
-      mkdirSync3(join29(logPath, ".."), { recursive: true });
+      mkdirSync4(join31(logPath, ".."), { recursive: true });
       appendFileSync(logPath, JSON.stringify(event) + "\n", { encoding: "utf8" });
     } catch {
     }
@@ -6869,8 +8441,8 @@ function releaseSnapshotFlock(handle) {
 }
 
 // src/commands/backup.ts
-import { statSync as statSync2, readdirSync as readdirSync2, readFileSync as readFileSync13, mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join30, relative as relative2, dirname as dirname6 } from "path";
+import { statSync as statSync2, readdirSync as readdirSync2, readFileSync as readFileSync15, mkdirSync as mkdirSync5, writeFileSync as writeFileSync6 } from "fs";
+import { join as join32, relative as relative3, dirname as dirname9 } from "path";
 import { PutObjectCommand, HeadObjectCommand, ListObjectsV2Command, GetObjectCommand, DeleteObjectsCommand } from "@aws-sdk/client-s3";
 
 // src/utils/s3-client.ts
@@ -6894,11 +8466,11 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([".git", ".obsidian", "_archive", "node_
 function* walkMarkdown(dir, base) {
   for (const entry of readdirSync2(dir, { withFileTypes: true })) {
     if (SKIP_DIRS.has(entry.name)) continue;
-    const full = join30(dir, entry.name);
+    const full = join32(dir, entry.name);
     if (entry.isDirectory()) {
       yield* walkMarkdown(full, base);
     } else if (entry.name.endsWith(".md")) {
-      yield relative2(base, full).replace(/\\/g, "/");
+      yield relative3(base, full).replace(/\\/g, "/");
     }
   }
 }
@@ -6917,7 +8489,7 @@ async function runBackupSync(input) {
   let failed = 0;
   const files = [...walkMarkdown(input.vault, input.vault)];
   for (const relPath of files) {
-    const absPath = join30(input.vault, relPath);
+    const absPath = join32(input.vault, relPath);
     const localStat = statSync2(absPath);
     let needsUpload = true;
     try {
@@ -6936,7 +8508,7 @@ async function runBackupSync(input) {
       continue;
     }
     try {
-      const body = readFileSync13(absPath);
+      const body = readFileSync15(absPath);
       await client.send(new PutObjectCommand({ Bucket: input.bucket, Key: relPath, Body: body }));
       uploaded++;
     } catch {
@@ -6993,7 +8565,7 @@ async function runBackupRestore(input) {
     const objects = list.Contents ?? [];
     for (const obj of objects) {
       if (!obj.Key) continue;
-      const localPath = join30(target, obj.Key);
+      const localPath = join32(target, obj.Key);
       try {
         const localStat = statSync2(localPath);
         if (obj.LastModified && localStat.mtime > obj.LastModified) {
@@ -7006,8 +8578,8 @@ async function runBackupRestore(input) {
         const resp = await client.send(new GetObjectCommand({ Bucket: input.bucket, Key: obj.Key }));
         const body = await resp.Body?.transformToByteArray();
         if (body) {
-          mkdirSync4(dirname6(localPath), { recursive: true });
-          writeFileSync5(localPath, Buffer.from(body));
+          mkdirSync5(dirname9(localPath), { recursive: true });
+          writeFileSync6(localPath, Buffer.from(body));
           downloaded++;
         }
       } catch {
@@ -7039,11 +8611,11 @@ async function runBackupRestore(input) {
 }
 
 // src/commands/status.ts
-import { existsSync as existsSync10, statSync as statSync3 } from "fs";
-import { readFile as readFile15 } from "fs/promises";
-import { join as join31 } from "path";
+import { existsSync as existsSync11, statSync as statSync3 } from "fs";
+import { readFile as readFile16 } from "fs/promises";
+import { join as join33 } from "path";
 async function runStatus(input) {
-  if (!existsSync10(input.vault)) {
+  if (!existsSync11(input.vault)) {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { vault: input.vault }) };
   }
   const scan = await scanVault(input.vault);
@@ -7068,7 +8640,7 @@ async function runStatus(input) {
   const compound = scan.data.compound.length;
   let schemaVersion = "v1";
   try {
-    const schemaContent = await readFile15(join31(input.vault, "SCHEMA.md"), "utf8");
+    const schemaContent = await readFile16(join33(input.vault, "SCHEMA.md"), "utf8");
     const versionMatch = schemaContent.match(/version:\s*["']?([^"'\s\n]+)/i);
     if (versionMatch) schemaVersion = versionMatch[1];
   } catch {
@@ -7128,8 +8700,8 @@ async function runStatus(input) {
 }
 
 // src/commands/seed.ts
-import { mkdir as mkdir10, writeFile as writeFile9, stat as stat4 } from "fs/promises";
-import { join as join32 } from "path";
+import { mkdir as mkdir11, writeFile as writeFile9, stat as stat4 } from "fs/promises";
+import { join as join34 } from "path";
 var TODAY = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 var EXAMPLE_PAGES = {
   "entities/example-project.md": `---
@@ -7198,29 +8770,29 @@ Real sources are immutable after ingestion \u2014 never edit them.
 `;
 async function runSeed(input) {
   try {
-    await stat4(join32(input.vault, "SCHEMA.md"));
+    await stat4(join34(input.vault, "SCHEMA.md"));
   } catch {
     return { exitCode: ExitCode.VAULT_PATH_INVALID, result: err("VAULT_PATH_INVALID", { root: input.vault, reason: "SCHEMA.md missing \u2014 run `skillwiki init` first" }) };
   }
   const created = [];
   const skipped = [];
   for (const [relPath, content] of Object.entries(EXAMPLE_PAGES)) {
-    const absPath = join32(input.vault, relPath);
+    const absPath = join34(input.vault, relPath);
     try {
       await stat4(absPath);
       skipped.push(relPath);
     } catch {
-      await mkdir10(join32(absPath, ".."), { recursive: true });
+      await mkdir11(join34(absPath, ".."), { recursive: true });
       await writeFile9(absPath, content, "utf8");
       created.push(relPath);
     }
   }
-  const rawPath = join32(input.vault, "raw", "articles", "example-source.md");
+  const rawPath = join34(input.vault, "raw", "articles", "example-source.md");
   try {
     await stat4(rawPath);
     skipped.push("raw/articles/example-source.md");
   } catch {
-    await mkdir10(join32(rawPath, ".."), { recursive: true });
+    await mkdir11(join34(rawPath, ".."), { recursive: true });
     await writeFile9(rawPath, EXAMPLE_RAW, "utf8");
     created.push("raw/articles/example-source.md");
   }
@@ -7243,9 +8815,9 @@ async function runSeed(input) {
 }
 
 // src/commands/canvas.ts
-import { readFile as readFile16, writeFile as writeFile10 } from "fs/promises";
-import { existsSync as existsSync11 } from "fs";
-import { join as join33 } from "path";
+import { readFile as readFile17, writeFile as writeFile10 } from "fs/promises";
+import { existsSync as existsSync12 } from "fs";
+import { join as join35 } from "path";
 var NODE_WIDTH = 240;
 var NODE_HEIGHT = 60;
 var COLUMN_SPACING = 400;
@@ -7323,8 +8895,8 @@ function buildCanvasEdges(adjacency) {
   return edges;
 }
 async function runCanvasGenerate(input) {
-  const graphPath = input.graphPath ?? join33(input.vault, ".skillwiki", "graph.json");
-  if (!existsSync11(graphPath)) {
+  const graphPath = input.graphPath ?? join35(input.vault, ".skillwiki", "graph.json");
+  if (!existsSync12(graphPath)) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
       result: err("FILE_NOT_FOUND", {
@@ -7335,7 +8907,7 @@ async function runCanvasGenerate(input) {
   }
   let raw;
   try {
-    raw = await readFile16(graphPath, "utf8");
+    raw = await readFile17(graphPath, "utf8");
   } catch (e) {
     return {
       exitCode: ExitCode.FILE_NOT_FOUND,
@@ -7361,7 +8933,7 @@ async function runCanvasGenerate(input) {
   const nodes = buildCanvasNodes(paths);
   const edges = buildCanvasEdges(graph.adjacency);
   const canvas = { nodes, edges };
-  const outPath = join33(input.vault, "vault-graph.canvas");
+  const outPath = join35(input.vault, "vault-graph.canvas");
   try {
     await writeFile10(outPath, JSON.stringify(canvas, null, 2));
   } catch (e) {
@@ -7383,10 +8955,10 @@ written: ${outPath}`
 }
 
 // src/commands/fleet-health.ts
-import { existsSync as existsSync12, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync16 } from "fs";
 import { execSync as nodeExecSync } from "child_process";
 import { hostname as nodeHostname, platform as nodePlatform } from "os";
-import { join as join34 } from "path";
+import { join as join36 } from "path";
 var SSH_TIMEOUT_MS = 15e3;
 var TIMER_UNIT = "agent-memory-trends.timer";
 var SERVICE_UNIT = "agent-memory-trends.service";
@@ -7483,9 +9055,9 @@ function applyServiceFailedOverlay(run, serviceFailed) {
 function probeLocal(vaultPath, deps) {
   const latestPath = satelliteLatestRunPath(vaultPath);
   let parsed = null;
-  if (existsSync12(latestPath)) {
+  if (existsSync13(latestPath)) {
     try {
-      const wire = readSatelliteLatestRunFromText(readFileSync14(latestPath, "utf8"));
+      const wire = readSatelliteLatestRunFromText(readFileSync16(latestPath, "utf8"));
       if (wire) {
         parsed = {
           status: wire.status,
@@ -7616,7 +9188,7 @@ async function runFleetHealth(input) {
   const home = input.home ?? env.HOME ?? "";
   const osHostname = input.osHostname ?? env.HOSTNAME ?? nodeHostname();
   const vault = input.vault ?? env.WIKI_PATH;
-  const file = input.file ?? (vault ? join34(vault, FLEET_REL_PATH) : void 0);
+  const file = input.file ?? (vault ? join36(vault, FLEET_REL_PATH) : void 0);
   if (!file) {
     return {
       exitCode: ExitCode.NO_VAULT_CONFIGURED,
@@ -7700,15 +9272,15 @@ async function runFleetHealth(input) {
 }
 
 // src/utils/auto-commit.ts
-import { existsSync as existsSync13 } from "fs";
-import { join as join35 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { join as join37 } from "path";
 async function postCommit(vault, exitCode) {
   if (exitCode !== 0) return;
   const home = process.env.HOME ?? "";
   const dotenv = await parseDotenvFile(configPath(home));
   const autoCommit = process.env.AUTO_COMMIT ?? dotenv["AUTO_COMMIT"];
   if (autoCommit === "false") return;
-  if (!existsSync13(join35(vault, ".git"))) return;
+  if (!existsSync14(join37(vault, ".git"))) return;
   const lastOps = readLastOp(vault);
   if (lastOps.length === 0) return;
   const porcelain = git(vault, ["status", "--porcelain", "--", ...VAULT_COMMIT_PATHSPEC]);
@@ -7732,9 +9304,9 @@ async function postCommit(vault, exitCode) {
 }
 
 // src/commands/write-preflight.ts
-import { existsSync as existsSync14, readFileSync as readFileSync15, statSync as statSync4 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync17, statSync as statSync4 } from "fs";
 async function runWritePreflightCommand(input) {
-  if (!existsSync14(input.vault) || !statSync4(input.vault).isDirectory()) {
+  if (!existsSync15(input.vault) || !statSync4(input.vault).isDirectory()) {
     return {
       exitCode: ExitCode.VAULT_PATH_INVALID,
       result: err(GateError.VAULT_PATH_INVALID, { path: input.vault })
@@ -7742,13 +9314,13 @@ async function runWritePreflightCommand(input) {
   }
   let priorText = input.priorArtifactText;
   if (input.priorArtifactFile) {
-    if (!existsSync14(input.priorArtifactFile)) {
+    if (!existsSync15(input.priorArtifactFile)) {
       return {
         exitCode: ExitCode.FILE_NOT_FOUND,
         result: err("FILE_NOT_FOUND", { path: input.priorArtifactFile })
       };
     }
-    priorText = readFileSync15(input.priorArtifactFile, "utf8");
+    priorText = readFileSync17(input.priorArtifactFile, "utf8");
   }
   const checkList = input.checks ? input.checks.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
   const result = runWritePreflight({
@@ -7862,7 +9434,7 @@ async function emitManagedVaultWrite(vault, command, mutate, opts) {
   if (dirty) {
     return emit(dirty, void 0, { postCommit: false });
   }
-  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-CTXX2MHQ.js");
+  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-4LPVMP42.js");
   const run = await runManagedWriteTransaction2({
     vault,
     command,
@@ -7892,7 +9464,7 @@ program.command("validate <file>").description("validate vault page frontmatter
   emit(await runValidate({ file, apply: !!opts.apply, vault }), vault);
 });
 program.command("graph").description("graph subcommands").command("build <vault>").option("--out <path>", "graph output path (default: <vault>/.skillwiki/graph.json)").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
-  const out = opts.out ?? join36(vault, ".skillwiki", "graph.json");
+  const out = opts.out ?? join38(vault, ".skillwiki", "graph.json");
   return emitGuardedVaultWrite(vault, "graph build", () => runGraphBuild({ vault, out }));
 });
 var canvasCmd = program.command("canvas").description("manage Obsidian canvas files");
@@ -8014,7 +9586,7 @@ tagCmd.command("reconcile [vault]").description("preview or add prospective page
   );
 });
 var pageCmd = program.command("page").description("validate and publish typed vault pages");
-pageCmd.command("publish <draft> [vault]").description("preview or publish an unpublished typed-page draft").requiredOption("--target <path>", "vault-relative typed page target").option("--log-note <text>", "single-line publication log note").option("--write", "publish SCHEMA, page, index, and log", false).option("--wiki <name>", "wiki profile name").action(async (draft, vault, opts) => {
+pageCmd.command("publish <draft> [vault]").description("preview or publish an unpublished typed-page draft").requiredOption("--target <path>", "vault-relative typed page target").option("--log-note <text>", "single-line publication log note").option("--write", "publish SCHEMA, page, index, and log", false).option("--approve <token>", "target-bound approval token from a prior dry-run").option("--wiki <name>", "wiki profile name").action(async (draft, vault, opts) => {
   const resolved = await resolveVaultArg(vault, opts.wiki);
   if (!resolved.ok) return emit({ exitCode: resolved.exitCode, result: resolved.payload });
   const input = {
@@ -8022,7 +9594,8 @@ pageCmd.command("publish <draft> [vault]").description("preview or publish an un
     draftPath: draft,
     target: opts.target,
     logNote: opts.logNote,
-    write: !!opts.write
+    write: !!opts.write,
+    approve: opts.approve
   };
   if (!opts.write) return emit(await runPagePublish(input), resolved.vault, { postCommit: false });
   return emitGuardedVaultWrite(
@@ -8032,6 +9605,27 @@ pageCmd.command("publish <draft> [vault]").description("preview or publish an un
     { postCommit: false }
   );
 });
+var projectPageCmd = program.command("project-page").description("publish project-local architecture pages");
+projectPageCmd.command("publish <draft> [vault]").description("preview or publish a Layer-3 architecture page under projects/{slug}/architecture/").requiredOption("--project <slug>", "project slug").requiredOption("--target <path>", "vault-relative architecture target").option("--log-note <text>", "single-line publication log note").option("--write", "publish SCHEMA, page, project knowledge index, and log", false).option("--approve <token>", "required with --write; token from a prior dry-run").option("--wiki <name>", "wiki profile name").action(async (draft, vault, opts) => {
+  const resolved = await resolveVaultArg(vault, opts.wiki);
+  if (!resolved.ok) return emit({ exitCode: resolved.exitCode, result: resolved.payload });
+  const input = {
+    vault: resolved.vault,
+    draftPath: draft,
+    project: opts.project,
+    target: opts.target,
+    logNote: opts.logNote,
+    write: !!opts.write,
+    approve: opts.approve
+  };
+  if (!opts.write) return emit(await runProjectPagePublish(input), resolved.vault, { postCommit: false });
+  return emitGuardedVaultWrite(
+    resolved.vault,
+    "project-page publish",
+    () => runProjectPagePublish(input),
+    { postCommit: false }
+  );
+});
 var indexCmd = program.command("index").description("root index projection and checks");
 indexCmd.command("rebuild [vault]").description("preview or write deterministic root index.md projection").option("--write", "write projected index.md", false).option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);