spine-framework 0.1.0

package/scripts/app-install-cli.ts

@@ -0,0 +1,286 @@
+#!/usr/bin/env tsx
+
+/**
+ * @module scripts/app-install-cli
+ * @audience installer
+ * @layer cli
+ * @stability orphaned
+ *
+ * Spine App Installation CLI - Validates and executes app installation instruction files.
+ * **ORPHANED**: References non-existent schema and template files at `../docs/app-installation/`.
+ * 
+ * **Intended Purpose**: Validate YAML instruction files against JSON schema and execute
+ * multi-step app installations (pack installation, app creation, migrations, verification).
+ * 
+ * **Current State**: Cannot function - missing required schema.json and template files.
+ * 
+ * **Dependencies**: commander, js-yaml, ajv for CLI operations and validation.
+ * 
+ * @tags orphaned, cli, app-installation, validation
+ */
+
+import { readFileSync, existsSync, writeFileSync } from 'fs'
+import { resolve, dirname } from 'path'
+import { program } from 'commander'
+import yaml from 'js-yaml'
+import Ajv from 'ajv'
+import { fileURLToPath } from 'url'
+
+// Fix __dirname for ES modules
+const __filename = fileURLToPath(import.meta.url)
+const __dirname = dirname(__filename)
+
+// Load JSON schema
+const schemaPath = resolve(__dirname, '../docs/app-installation/schema.json')
+const schema = JSON.parse(readFileSync(schemaPath, 'utf8'))
+
+const ajv = new Ajv()
+const validate = ajv.compile(schema)
+
+interface InstallationContext {
+  TARGET_ACCOUNT_ID?: string
+  PACK_INSTALLATION_ID?: string
+  [key: string]: string | undefined
+}
+
+// ─── CHUNK_START: APP_INSTALL_CLI_SUBSTITUTE_VARIABLES ──────────────────────────────────────────────
+/**
+ * @chunk-id    APP_INSTALL_CLI_SUBSTITUTE_VARIABLES_1_0_0
+ * @version     1.0.0
+ * @hash        122ca9e63f2310e8a01f76dc9c962319d8e267d8737c39895425440489a747bd
+ * @macro       Variable Substitution Engine
+ * @micro       Recursively replaces ${VAR} placeholders with context values
+ * @inputs      obj: any — Object containing ${VAR} placeholders
+ * @inputs      context: InstallationContext — Variable name to value mapping
+ * @outputs     any — Object with all placeholders substituted
+ * @depends-on  [none]
+ * @depended-by [validateInstructionFile, executeInstallation]
+ * @side-effects [none]
+ * @tags        orphaned, variable-substitution, template-engine
+ */
+function substituteVariables(obj: any, context: InstallationContext): any {
+  if (typeof obj === 'string') {
+    return obj.replace(/\$\{([^}]+)\}/g, (match, varName) => {
+      return context[varName] || match
+    })
+  } else if (Array.isArray(obj)) {
+    return obj.map(item => substituteVariables(item, context))
+  } else if (obj && typeof obj === 'object') {
+    const result: any = {}
+    for (const [key, value] of Object.entries(obj)) {
+      result[key] = substituteVariables(value, context)
+    }
+    return result
+  }
+  return obj
+}
+// ─── CHUNK_END: APP_INSTALL_CLI_SUBSTITUTE_VARIABLES ────────────────────────────────────────────────
+
+// ─── CHUNK_START: APP_INSTALL_CLI_VALIDATE_INSTRUCTION_FILE ──────────────────────────────────────────────
+/**
+ * @chunk-id    APP_INSTALL_CLI_VALIDATE_INSTRUCTION_FILE_1_0_0
+ * @version     1.0.0
+ * @hash        c673609fd3442632d832e0c4c3ef2dbda0a51e381bb469e55b7e2cc59005b5e2
+ * @macro       Installation File Validation
+ * @micro       Validates YAML instruction files against JSON schema
+ * @inputs      filePath: string — Path to YAML instruction file
+ * @outputs     boolean — true if valid, false otherwise
+ * @depends-on  [schema, validate, substituteVariables]
+ * @depended-by [executeInstallation]
+ * @side-effects [console output, file system reads]
+ * @tags        orphaned, validation, yaml, json-schema
+ */
+async function validateInstructionFile(filePath: string): Promise<void> {
+  try {
+    console.log(`🔍 Validating ${filePath}...`)
+    
+    if (!existsSync(filePath)) {
+      console.error(`❌ File not found: ${filePath}`)
+      process.exit(1)
+    }
+
+    const content = readFileSync(filePath, 'utf8')
+    const data = yaml.load(content) as any
+
+    // Validate against schema
+    if (!validate(data)) {
+      console.error('❌ Validation failed:')
+      console.error(JSON.stringify(validate.errors, null, 2))
+      process.exit(1)
+    }
+
+    console.log('✅ Schema validation passed')
+  } catch (error) {
+    console.error(`❌ Error validating ${filePath}:`, error)
+    process.exit(1)
+  }
+}
+// ─── CHUNK_END: APP_INSTALL_CLI_VALIDATE_INSTRUCTION_FILE ────────────────────────────────────────────────
+
+// ─── CHUNK_START: APP_INSTALL_CLI_EXECUTE_INSTALLATION ──────────────────────────────────────────────
+/**
+ * @chunk-id    APP_INSTALL_CLI_EXECUTE_INSTALLATION_1_0_0
+ * @version     1.0.0
+ * @hash        c84aa57769569e4b00ebde4d8b29b7059e6b0d6e8eb3d82cfa51c15e1451e04a
+ * @macro       Multi-Step App Installation Executor
+ * @micro       Orchestrates pack installation, app creation, migrations, and verification
+ * @inputs      filePath: string — Path to YAML instruction file
+ * @inputs      options: any — CLI options including accountId
+ * @outputs     void — Console output only
+ * @depends-on  [validateInstructionFile, substituteVariables, yaml, fs]
+ * @depended-by [CLI program command handler]
+ * @side-effects [console output, file system reads, process.exit on failure]
+ * @tags        orphaned, installation, orchestration, multi-step
+ */
+async function executeInstallation(filePath: string, options: any): Promise<void> {
+  try {
+    console.log(`🚀 Executing installation from ${filePath}...`)
+
+    // First validate
+    await validateInstructionFile(filePath)
+
+    const content = readFileSync(filePath, 'utf8')
+    const instructions = yaml.load(content) as any
+
+    // Set up context
+    const context: InstallationContext = {
+      TARGET_ACCOUNT_ID: options.accountId,
+      ...instructions.variables
+    }
+
+    console.log('📋 Installation plan:')
+    console.log(`  App: ${instructions.app.name} v${instructions.app.version}`)
+    console.log(`  Target Account: ${context.TARGET_ACCOUNT_ID}`)
+    console.log()
+
+    // Step 1: Pack installation
+    console.log('📦 Step 1: Installing pack...')
+    const packInstall = substituteVariables(instructions.installation.pack_installation, context)
+    console.log('  Pack installation config:', JSON.stringify(packInstall, null, 2))
+    
+    // Simulate pack installation - in real implementation, this would call the API
+    const packInstallationId = 'simulated-pack-id-' + Date.now()
+    context.PACK_INSTALLATION_ID = packInstallationId
+    console.log(`  ✅ Pack installed with ID: ${packInstallationId}`)
+
+    // Step 2: App creation
+    console.log('⚙️  Step 2: Creating app definitions...')
+    if (instructions.installation.app_creation) {
+      for (const appDef of instructions.installation.app_creation) {
+        const appConfig = substituteVariables(appDef, context)
+        console.log(`  Creating app: ${appConfig.slug}`)
+        console.log('  App config:', JSON.stringify(appConfig, null, 2))
+        console.log(`  ✅ App ${appConfig.slug} created`)
+      }
+    }
+
+    // Step 3: Migrations
+    console.log('🔄 Step 3: Running migrations...')
+    if (instructions.installation.migrations) {
+      for (const migration of instructions.installation.migrations) {
+        console.log(`  Running migration: ${migration.file}`)
+        console.log(`    Description: ${migration.description}`)
+        if (migration.dependencies) {
+          console.log(`    Dependencies: ${migration.dependencies.join(', ')}`)
+        }
+        console.log(`  ✅ Migration completed`)
+      }
+    }
+
+    // Step 4: Verification
+    console.log('✅ Step 4: Verifying installation...')
+    if (instructions.installation.verification) {
+      for (const verification of instructions.installation.verification) {
+        console.log(`  Verifying: ${verification.check}`)
+        if (verification.slug) console.log(`    Slug: ${verification.slug}`)
+        if (verification.integration_id) console.log(`    Integration: ${verification.integration_id}`)
+        console.log(`  ✅ Verification passed`)
+      }
+    }
+
+    console.log()
+    console.log('🎉 Installation completed successfully!')
+    console.log(`📱 App "${instructions.app.name}" is ready to use`)
+
+  } catch (error) {
+    console.error('❌ Installation failed:', error)
+    process.exit(1)
+  }
+}
+// ─── CHUNK_END: APP_INSTALL_CLI_EXECUTE_INSTALLATION ────────────────────────────────────────────────
+
+// ─── CHUNK_START: APP_INSTALL_CLI_GENERATE_TEMPLATE ──────────────────────────────────────────────
+/**
+ * @chunk-id    APP_INSTALL_CLI_GENERATE_TEMPLATE_1_0_0
+ * @version     1.0.0
+ * @hash        4ea17e0556f329f835cec106f09cb570c9e4ea8a92bc82e5fe9ccf4b5dd52aa9
+ * @macro       Template Generator
+ * @micro       Outputs YAML templates for app installations or migrations
+ * @inputs      type: string — Template type ("app" or "migration")
+ * @inputs      options: any — CLI options including output file path
+ * @outputs     void — Console output or file write
+ * @depends-on  [fs, path]
+ * @depended-by [CLI program command handler]
+ * @side-effects [console output, file system reads/writes, process.exit on failure]
+ * @tags        orphaned, template-generation, yaml, cli
+ */
+async function generateTemplate(type: string, options: any): Promise<void> {
+  try {
+    const templateDir = resolve(__dirname, '../docs/app-installation/templates')
+    let templateFile: string
+
+    switch (type) {
+      case 'app':
+        templateFile = resolve(templateDir, 'app-install.yaml')
+        break
+      case 'migration':
+        templateFile = resolve(templateDir, 'migration.yaml')
+        break
+      default:
+        console.error('❌ Unknown template type. Use "app" or "migration"')
+        process.exit(1)
+    }
+
+    const template = readFileSync(templateFile, 'utf8')
+    
+    if (options.output) {
+      writeFileSync(options.output, template)
+      console.log(`✅ Template generated: ${options.output}`)
+    } else {
+      console.log(template)
+    }
+  } catch (error) {
+    console.error('❌ Error generating template:', error)
+    process.exit(1)
+  }
+}
+// ─── CHUNK_END: APP_INSTALL_CLI_GENERATE_TEMPLATE ────────────────────────────────────────────────
+
+// CLI setup
+program
+  .name('app-install-cli')
+  .description('Spine App Installation CLI - Validate and execute app installation instructions')
+  .version('1.0.0')
+
+program
+  .command('validate')
+  .description('Validate an instruction file against the schema')
+  .argument('<file>', 'Instruction file path')
+  .action(validateInstructionFile)
+
+program
+  .command('install')
+  .description('Execute app installation from instruction file')
+  .argument('<file>', 'Instruction file path')
+  .option('-a, --account-id <id>', 'Target account ID')
+  .option('-d, --dry-run', 'Simulate installation without making changes')
+  .action(executeInstallation)
+
+program
+  .command('template')
+  .description('Generate a new instruction template')
+  .argument('<type>', 'Template type: app or migration')
+  .option('-o, --output <path>', 'Output file path (optional, prints to stdout)')
+  .action(generateTemplate)
+
+program.parse()

package/scripts/assemble-frontend.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+
+# Frontend Assembly - Merge .framework/src + custom/apps/*/src → .assembled/src
+#
+# Purpose: Create unified frontend source directory for Vite build process.
+# - .framework/src is the canonical Spine frontend
+# - custom/apps/*/src are your application sources
+# - Vite expects a single src directory, so we assemble at build time
+#
+# Process:
+# 1. Clean target directory
+# 2. Copy core src files
+# 3. Overlay custom src files (overwrites existing)
+#
+# Dependencies: standard bash utilities, find, cp, rsync
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
+
+CORE_SRC_DIR="$PROJECT_ROOT/.framework/src"
+CUSTOM_SRC_DIR="$PROJECT_ROOT/custom/apps"
+TARGET_SRC_DIR="$PROJECT_ROOT/.assembled/src"
+
+echo "🔧 Assembling frontend → $TARGET_SRC_DIR"
+
+# 1. Clean target (except .gitkeep if exists)
+if [ -d "$TARGET_SRC_DIR" ]; then
+  find "$TARGET_SRC_DIR" -mindepth 1 -not -name '.gitkeep' -delete 2>/dev/null || true
+else
+  mkdir -p "$TARGET_SRC_DIR"
+fi
+
+# 2. Copy core src (base layer)
+if [ -d "$CORE_SRC_DIR" ]; then
+  # Ensure subdirectories are copied properly
+  cp -r "$CORE_SRC_DIR"/* "$TARGET_SRC_DIR"/ 2>/dev/null || true
+  echo "  ✓ Core: $(find "$CORE_SRC_DIR" -name '*.tsx' -o -name '*.ts' -o -name '*.css' | wc -l | tr -d ' ') files"
+else
+  echo "  ⚠ Core: $CORE_SRC_DIR not found"
+fi
+
+# 4. Copy public files from .framework
+if [ -f "$PROJECT_ROOT/.framework/index.html" ]; then
+  # Copy and fix the script src path for assembled structure
+  sed 's|/src/main.tsx|./main.tsx|g' "$PROJECT_ROOT/.framework/index.html" > "$TARGET_SRC_DIR/index.html"
+  echo "  ✓ Core: index.html (paths fixed)"
+fi
+
+# 3. Copy public assets from .framework → assembled public dir (Vite serves from <root>/public)
+if [ -d "$PROJECT_ROOT/.framework/public" ]; then
+  mkdir -p "$TARGET_SRC_DIR/public"
+  cp -r "$PROJECT_ROOT/.framework/public"/* "$TARGET_SRC_DIR/public/" 2>/dev/null || true
+  echo "  ✓ Core: $(find "$PROJECT_ROOT/.framework/public" -type f | wc -l | tr -d ' ') public files"
+fi
+
+# 3.5. Copy _redirects to Vite-served directory for Netlify dev
+if [ -f "$PROJECT_ROOT/.framework/public/_redirects" ]; then
+  cp "$PROJECT_ROOT/.framework/public/_redirects" "$TARGET_SRC_DIR/_redirects"
+  echo "  ✓ Core: _redirects copied to Vite-served directory for Netlify dev"
+fi
+
+# 6. Overlay custom src (overrides + additions)
+if [ -d "$CUSTOM_SRC_DIR" ]; then
+  # Copy files and subdirectories
+  cp -r "$CUSTOM_SRC_DIR"/* "$TARGET_SRC_DIR"/ 2>/dev/null || true
+  
+  # Handle subdirectories properly
+  find "$CUSTOM_SRC_DIR" -mindepth 1 -type d -exec sh -c 'dir="$1"; base=$(basename "$dir"); mkdir -p "'"$TARGET_SRC_DIR"'/$base" && cp -r "$dir"/* "'"$TARGET_SRC_DIR"'/$base/"' _ {} \; 2>/dev/null || true
+  
+  CUSTOM_COUNT=$(find "$CUSTOM_SRC_DIR" -name '*.tsx' -o -name '*.ts' -o -name '*.css' 2>/dev/null | wc -l | tr -d ' ')
+  echo "  ✓ Custom: $CUSTOM_COUNT files"
+else
+  echo "  ○ Custom: (empty)"
+fi
+
+echo "  ✓ Assembled: $(find "$TARGET_SRC_DIR" -name '*.tsx' -o -name '*.ts' -o -name '*.css' | wc -l | tr -d ' ') total files"
+echo "✅ Done"

package/scripts/assemble-functions.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+
+# Functions Assembly - Merge .framework + custom functions into .assembled/
+# 
+# Purpose: Create unified functions directory for Netlify deployment.
+# - .framework/functions are the canonical Spine runtime
+# - custom/functions are your custom extensions
+# - Netlify requires a single functions directory, so we assemble at build time
+# 
+# Process: 
+# 1. Assemble into temp directory first (prevents Netlify observing half-deleted dir)
+# 2. Copy core functions
+# 3. Overlay custom functions (overwrites existing)
+# 4. Atomic move to target directory
+# 
+# Dependencies: standard bash utilities, find, cp, rsync, mv
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
+
+CORE_DIR="$PROJECT_ROOT/.framework/functions"
+CUSTOM_DIR="$PROJECT_ROOT/custom"
+TARGET_DIR="$PROJECT_ROOT/.assembled/netlify/functions"
+TMP_DIR="$PROJECT_ROOT/.functions-assemble-tmp"
+
+echo "🔧 Assembling functions → $TARGET_DIR"
+
+# 1. Assemble into a temp directory first so Netlify never observes a half-deleted functions dir
+rm -rf "$TMP_DIR"
+mkdir -p "$TMP_DIR"
+
+# 2. Copy core functions (base layer), excluding _quarantine and test files
+if [ -d "$CORE_DIR" ]; then
+  # Copy all files except _quarantine directory and test files (*-test.ts, *.test.ts)
+  find "$CORE_DIR" -maxdepth 1 -name '*.ts' ! -name '*-test.ts' ! -name '*.test.ts' -exec cp {} "$TMP_DIR"/ \;
+  # Copy subdirectories except _quarantine
+  find "$CORE_DIR" -maxdepth 1 -mindepth 1 -type d ! -name '_quarantine' -exec cp -r {} "$TMP_DIR"/ \;
+  echo "  ✓ Core: $(find "$CORE_DIR" -name '*.ts' | grep -v '_quarantine' | grep -v '\-test\.ts$' | grep -v '\.test\.ts$' | wc -l | tr -d ' ') files"
+fi
+
+# 3. Overlay custom functions (overrides + additions), excluding test files
+CUSTOM_COUNT=0
+if [ -d "$CUSTOM_DIR/functions" ]; then
+  # Copy all files except test files (*-test.ts, *.test.ts)
+  find "$CUSTOM_DIR/functions" -maxdepth 1 -name '*.ts' ! -name '*-test.ts' ! -name '*.test.ts' -exec cp {} "$TMP_DIR"/ \; 2>/dev/null || true
+  # Copy subdirectories if any
+  find "$CUSTOM_DIR/functions" -mindepth 1 -type d -exec sh -c 'dir="$1"; base=$(basename "$dir"); mkdir -p "'"$TMP_DIR"'/$base" && cp -r "$dir"/* "'"$TMP_DIR"'/$base/"' _ {} \; 2>/dev/null || true
+  CUSTOM_COUNT=$(find "$CUSTOM_DIR/functions" -name '*.ts' ! -name '*-test.ts' ! -name '*.test.ts' 2>/dev/null | wc -l | tr -d ' ')
+  echo "  ✓ Custom: $CUSTOM_COUNT files"
+else
+  echo "  ○ Custom: (empty)"
+fi
+
+# 4. Atomically swap temp into place
+rm -rf "$TARGET_DIR"
+mkdir -p "$(dirname "$TARGET_DIR")"
+mv "$TMP_DIR" "$TARGET_DIR"
+
+echo "  ✓ Assembled: $(find "$TARGET_DIR" -name '*.ts' ! -name '*-test.ts' ! -name '*.test.ts' | wc -l | tr -d ' ') total functions"
+echo "✅ Done"

package/scripts/assemble.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+# Assembly Orchestrator - Assemble .framework + custom into .assembled/
+# 
+# Purpose: Main assembly script that orchestrates the complete build process.
+# - Calls frontend and functions assembly scripts
+# - Removes stale dist/ to prevent Netlify CLI conflicts
+# - Coordinates multi-step assembly process
+# 
+# Process: 
+# 1. Clean dist/ directory
+# 2. Assemble functions to .assembled/netlify/functions/
+# 3. Assemble frontend to .assembled/src/
+# 
+# Dependencies: assemble-functions.sh, assemble-frontend.sh
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
+
+echo "Assembling Spine..."
+
+# Remove stale dist/ so Netlify CLI never reads its _redirects during dev
+rm -rf "$PROJECT_ROOT/dist"
+
+# Step 1: Assemble functions
+echo "Assembling functions..."
+bash "$SCRIPT_DIR/assemble-functions.sh"
+
+# Step 2: Assemble frontend
+echo "Assembling frontend..."
+bash "$SCRIPT_DIR/assemble-frontend.sh"
+
+echo "Spine assembly complete"

package/scripts/boundary-check.sh

@@ -0,0 +1,106 @@
+#!/bin/bash
+#
+# Boundary Check Script
+#
+# Prevents Core→Custom violations by blocking PRs that import custom code
+# into the core framework. This enforces the architectural boundary where
+# Core provides mechanism and Custom provides data.
+#
+# Usage: ./scripts/boundary-check.sh
+# Exit code: 0 if clean, 1 if violations found
+#
+
+set -e
+
+echo "🔍 Checking Core→Custom boundary violations..."
+echo ""
+
+VIOLATIONS=0
+
+# Check 1: Core importing from custom/ directory
+echo "1. Checking for imports from custom/ in core..."
+if grep -r "from.*custom/\|import.*@custom" .framework/ --include="*.ts" --include="*.tsx" --exclude-dir=tests 2>/dev/null; then
+    echo "   ❌ FAIL: Core files import from custom/"
+    VIOLATIONS=$((VIOLATIONS + 1))
+else
+    echo "   ✅ PASS: No custom/ imports in core"
+fi
+echo ""
+
+# Check 2: Core importing custom_ prefixed modules
+echo "2. Checking for custom_ module imports in core..."
+if grep -r "from.*custom_\|import.*custom_" .framework/ --include="*.ts" --include="*.tsx" 2>/dev/null; then
+    echo "   ❌ FAIL: Core files import custom_ modules"
+    VIOLATIONS=$((VIOLATIONS + 1))
+else
+    echo "   ✅ PASS: No custom_ imports in core"
+fi
+echo ""
+
+# Check 2b: Custom apps using relative paths to .framework/ (should use @core alias instead)
+echo "2b. Checking custom apps use @core alias (not relative paths to .framework/)..."
+if grep -r "from.*\.\./.*\.framework\|from.*\.framework/" custom/ --include="*.ts" --include="*.tsx" 2>/dev/null; then
+    echo "   ❌ FAIL: Custom apps use relative paths to .framework/ — use @core alias instead"
+    VIOLATIONS=$((VIOLATIONS + 1))
+else
+    echo "   ✅ PASS: Custom apps use @core alias correctly"
+fi
+echo ""
+
+# Check 3: App-specific references in core
+echo "3. Checking for app-specific references in core..."
+APP_REFS=$(grep -r "cortex\|funnel\|support-triage\|kb-chunker\|portal-signals" .framework/src/ --include="*.ts" --include="*.tsx" 2>/dev/null | grep -v "manifest.json\|webhook-registry" || true)
+if [ -n "$APP_REFS" ]; then
+    echo "   ❌ FAIL: App-specific references found in core:"
+    echo "$APP_REFS"
+    VIOLATIONS=$((VIOLATIONS + 1))
+else
+    echo "   ✅ PASS: No app-specific references in core"
+fi
+echo ""
+
+# Check 4: Verify manifest files exist for custom apps
+echo "4. Checking custom apps have manifest.json..."
+MANIFEST_COUNT=$(find custom/apps -name "manifest.json" | wc -l)
+if [ "$MANIFEST_COUNT" -eq 0 ]; then
+    echo "   ⚠️  WARNING: No manifest.json files found in custom/apps/"
+else
+    echo "   ✅ PASS: $MANIFEST_COUNT manifest.json files found"
+    find custom/apps -name "manifest.json" | while read -r manifest; do
+        echo "      - $manifest"
+    done
+fi
+echo ""
+
+# Check 5: Verify webhook registry is used (not static imports)
+echo "5. Checking integration-routes uses dynamic registry..."
+if grep -q "webhookHandlers\|custom_webhook-handlers" .framework/functions/integration-routes.ts 2>/dev/null; then
+    echo "   ❌ FAIL: integration-routes still uses static imports"
+    VIOLATIONS=$((VIOLATIONS + 1))
+else
+    echo "   ✅ PASS: integration-routes uses dynamic registry"
+fi
+echo ""
+
+# Check 6: Sidebar components should not be in core
+echo "6. Checking app-specific components removed from core..."
+if [ -d ".framework/src/components/cortex" ] || [ -d ".framework/src/components/crm" ]; then
+    echo "   ❌ FAIL: App-specific component directories still exist in core"
+    ls -la .framework/src/components/ | grep -E "cortex|crm" || true
+    VIOLATIONS=$((VIOLATIONS + 1))
+else
+    echo "   ✅ PASS: App-specific component directories removed from core"
+fi
+echo ""
+
+# Summary
+echo "========================================"
+if [ $VIOLATIONS -eq 0 ]; then
+    echo "✅ ALL CHECKS PASSED"
+    echo "Core→Custom boundary is clean."
+    exit 0
+else
+    echo "❌ $VIOLATIONS VIOLATION(S) FOUND"
+    echo "Fix violations before merging."
+    exit 1
+fi

package/scripts/build-manifest.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+
+/**
+ * @module scripts/build-manifest
+ * @audience installer
+ * @layer build
+ * @stability orphaned
+ *
+ * Build Manifest Generator - Generate a signed manifest of core file hashes.
+ * **ORPHANED**: References non-existent `core/` directory (should be `v2-core/`).
+ * 
+ * **Intended Purpose**: Used for build-time integrity verification.
+ * - In dev mode (SPINE_INTEGRITY=warn), mismatches log warnings
+ * - In production (SPINE_INTEGRITY=enforce), mismatches fail the build
+ * 
+ * **Current State**: Cannot function - references wrong directory paths.
+ * 
+ * **Dependencies**: shasum, standard bash utilities
+ * 
+ * @tags orphaned, build, integrity, manifest, verification
+ */
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
+
+CORE_DIR="$PROJECT_ROOT/.framework"
+CORE_SRC_DIR="$PROJECT_ROOT/.framework/src"
+MANIFEST_FILE="$PROJECT_ROOT/.spine-manifest.json"
+
+INTEGRITY_MODE="${SPINE_INTEGRITY:-warn}"
+
+echo "🔒 Generating core integrity manifest (mode: $INTEGRITY_MODE)"
+
+# Collect hashes of all core files
+HASHES="{"
+FIRST=true
+
+# Core functions
+while IFS= read -r -d '' file; do
+  REL_PATH="${file#$PROJECT_ROOT/}"
+  HASH=$(shasum -a 256 "$file" | cut -d' ' -f1)
+  if [ "$FIRST" = true ]; then
+    FIRST=false
+  else
+    HASHES="$HASHES,"
+  fi
+  HASHES="$HASHES\"$REL_PATH\":\"$HASH\""
+done < <(find "$CORE_DIR" -type f -name '*.ts' -print0 | sort -z)
+
+# Core src components (shared, layout, hooks, lib)
+for SUBDIR in components/shared components/layout hooks lib; do
+  DIR="$CORE_SRC_DIR/$SUBDIR"
+  if [ -d "$DIR" ]; then
+    while IFS= read -r -d '' file; do
+      REL_PATH="${file#$PROJECT_ROOT/}"
+      HASH=$(shasum -a 256 "$file" | cut -d' ' -f1)
+      HASHES="$HASHES,\"$REL_PATH\":\"$HASH\""
+    done < <(find "$DIR" -type f \( -name '*.ts' -o -name '*.tsx' \) -print0 | sort -z)
+  fi
+done
+
+HASHES="$HASHES}"
+
+# Write manifest
+TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+cat > "$MANIFEST_FILE" <<EOF
+{
+  "version": "1",
+  "generated_at": "$TIMESTAMP",
+  "integrity_mode": "$INTEGRITY_MODE",
+  "file_count": $(echo "$HASHES" | tr ',' '\n' | wc -l | tr -d ' '),
+  "hashes": $HASHES
+}
+EOF
+
+echo "  ✓ Manifest written to $MANIFEST_FILE"
+echo "  ✓ $(echo "$HASHES" | tr ',' '\n' | wc -l | tr -d ' ') files hashed"
+echo "✅ Done"