symphony-forge 0.1.0

package/dist/index.js

@@ -0,0 +1,1459 @@
+#!/usr/bin/env node
+import{program as S}from"commander";import{existsSync as C,readdirSync as D,readFileSync as N,statSync as ye}from"fs";import{join as k}from"path";import{log as b}from"@clack/prompts";var be=/\.md$/,B=(e,t,a,s)=>{if(C(e))for(let o of D(e,{withFileTypes:!0})){if(!o.isDirectory())continue;new RegExp(`^  ${o.name}:`,"m").test(a)||s.push(`${t}/${o.name} not listed in topology.yaml`)}},ve=e=>{let t=k(e,".control","topology.yaml"),a=[];if(!C(t))return{category:"Topology Coverage",issues:[".control/topology.yaml not found (install control layer)"],passed:!1};let s=N(t,"utf-8");return B(k(e,"apps"),"apps",s,a),B(k(e,"packages"),"packages",s,a),{category:"Topology Coverage",issues:a,passed:a.length===0}},we=e=>{let t=k(e,"docs"),a=[];if(!C(t))return{category:"Stale Docs",issues:["docs/ directory not found (install knowledge layer)"],passed:!1};let s=2160*60*60*1e3,o=Date.now(),n=r=>{for(let c of D(r,{withFileTypes:!0})){let m=k(r,c.name);if(c.isDirectory())c.name!=="_templates"&&n(m);else if(c.name.endsWith(".md")){let p=ye(m),d=o-p.mtimeMs;if(d>s){let R=Math.floor(d/864e5),O=m.replace(`${e}/`,"");a.push(`${O} (${R} days old)`)}}}};return n(t),{category:"Stale Docs",issues:a,passed:a.length===0}},$e=e=>{let t=k(e,"docs"),a=k(t,"_index.md"),s=[];if(!C(a))return{category:"Index Coverage",issues:["docs/_index.md not found"],passed:!1};let o=N(a,"utf-8"),n=r=>{for(let c of D(r,{withFileTypes:!0})){let m=k(r,c.name);if(c.isDirectory())c.name!=="_templates"&&n(m);else if(c.name.endsWith(".md")&&c.name!=="_index.md"){let p=m.replace(`${t}/`,""),d=p.replace(be,"");o.includes(d)||o.includes(p)||s.push(`${p} not referenced in _index.md`)}}};return n(t),{category:"Index Coverage",issues:s,passed:s.length===0}},Se=e=>{let t=k(e,".symphony-forge.json"),a=[];if(C(t))try{let s=N(t,"utf-8");JSON.parse(s)}catch{a.push(".symphony-forge.json is not valid JSON")}else a.push(".symphony-forge.json not found (run symphony-forge layer to create)");return{category:"Manifest",issues:a,passed:a.length===0}},H=()=>{b.info(`=== Symphony Forge \u2014 Entropy Audit ===
+`);let e=process.cwd(),t=[Se(e),ve(e),we(e),$e(e)],a=0;for(let s of t){let o=s.passed?"\u2713":"\u2717";if(b.info(`[${o}] ${s.category}`),!s.passed){for(let n of s.issues)b.warn(`    ${n}`);a+=s.issues.length}}b.info(""),a>0?(b.error(`Found ${a} issue(s). Review and address above warnings.`),process.exit(1)):b.info("No issues found. Repository is in good shape.")};import{copyFile as Ae,readdir as xe,readFile as L,rm as j,writeFile as M}from"fs/promises";import{join as h}from"path";import{cancel as Y,intro as Ee,isCancel as z,log as Me,outro as Ie,select as Oe,spinner as De,text as Ne}from"@clack/prompts";import{detectPackageManager as Te,installDependencies as _e}from"nypm";import{spawnSync as Re}from"child_process";import{readFile as Ce}from"fs/promises";import{join as E}from"path";var P="https://github.com/vercel/next-forge",q=e=>e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/\\/g,"/"),Pe=process.platform==="win32",g=(e,t,a)=>{let s=Re(e,t,{stdio:"inherit",shell:Pe,...a});if(s.error)throw s.error;if(s.status!==0){let o=s.stderr?.toString().trim(),n=o?`Command failed: ${e} ${t.join(" ")}
+${o}`:`Command failed with exit code ${s.status}: ${e} ${t.join(" ")}`;throw new Error(n)}return s},T=[E(".github","workflows"),"docs"],_=[E(".github","CONTRIBUTING.md"),E(".github","FUNDING.yml"),E(".github","SECURITY.md"),".changeset","CHANGELOG.md","license.md"],K=[...T,..._];var v="next-forge-update",V=async()=>{let e=await Ce("CHANGELOG.md","utf-8"),t=/# v(\d+\.\d+\.\d+)/g;return[...e.matchAll(t)].map(s=>s[1]).sort((s,o)=>{let[n,r,c]=s.split(".").map(Number),[m,p,d]=o.split(".").map(Number);return n!==m?m-n:r!==p?p-r:d-c})};var X=["bun","npm","yarn","pnpm"],je=(e,t,a)=>{let s=a?`${P}/tree/${a}`:P;g("npx",["create-next-app@latest",e,"--example",s,"--disable-git","--skip-install",`--use-${t}`])},Le=async()=>{for(let e of T)await j(e,{recursive:!0,force:!0});for(let e of _)await j(e,{force:!0})},Fe=async e=>{await _e({packageManager:{name:e,command:e},silent:!0})},Ge=()=>{g("git",["init"]),g("git",["add","."]),g("git",["commit","-m","\u2728 Initial commit"])},Ue=async()=>{let e=[{source:h("apps","api"),target:".env.local"},{source:h("apps","app"),target:".env.local"},{source:h("apps","web"),target:".env.local"},{source:h("packages","cms"),target:".env.local"},{source:h("packages","database"),target:".env"},{source:h("packages","internationalization"),target:".env.local"}];for(let{source:t,target:a}of e)await Ae(h(t,".env.example"),h(t,a))},We=e=>{g(e,["run","build",e==="npm"?"--workspace":"--filter","@repo/database"])},Be=async(e,t)=>{let a=h(e,"package.json"),s=await L(a,"utf8"),o=JSON.parse(s);t==="pnpm"?o.packageManager="pnpm@10.31.0":t==="npm"?o.packageManager="npm@10.8.1":t==="yarn"&&(o.packageManager="yarn@1.22.22");let n=JSON.stringify(o,null,2);await M(a,`${n}
+`)},He=async(e,t)=>{let a=h(e,"package.json"),s=await L(a,"utf8"),o=JSON.parse(s);t==="pnpm"&&(o.workspaces=void 0,await M(h(e,"pnpm-workspace.yaml"),`packages:
+  - 'apps/*'
+  - 'packages/*'
+`));let n=JSON.stringify(o,null,2);await M(a,`${n}
+`),await j("bun.lock",{force:!0})},J=async e=>{let t=await L(e,"utf8"),a=JSON.parse(t);if(a.dependencies){let o=Object.entries(a.dependencies);for(let[n,r]of o)r==="workspace:*"&&(a.dependencies[n]="*")}if(a.devDependencies){let o=Object.entries(a.devDependencies);for(let[n,r]of o)r==="workspace:*"&&(a.devDependencies[n]="*")}let s=JSON.stringify(a,null,2);await M(e,`${s}
+`)},qe=async e=>{let t=h(e,"package.json");await J(t);let a=["apps","packages"];for(let s of a){let o=h(e,s),n=await xe(o);for(let r of n){let c=h(o,r,"package.json");await J(c)}}},Ke=async()=>{let e=await Ne({message:"What is your project named?",placeholder:"my-app",validate(t){if(t.length===0)return"Please enter a project name."}});return z(e)&&(Y("Operation cancelled."),process.exit(0)),e.toString()},Ve=async()=>{let e=await Te(process.cwd());if(e)return e.name;let t=await Oe({message:"Which package manager would you like to use?",options:X.map(a=>({value:a,label:a})),initialValue:"bun"});return z(t)&&(Y("Operation cancelled."),process.exit(0)),t},Q=async e=>{try{Ee("Let's start a next-forge project!");let t=process.cwd(),a=e.name||await Ke(),s=e.packageManager||await Ve();if(!X.includes(s))throw new Error("Invalid package manager");let o=De(),n=h(t,a);o.start("Cloning next-forge..."),je(a,s,e.branch),o.message("Moving into repository..."),process.chdir(n),s!=="bun"&&(o.message("Updating package manager configuration..."),await Be(n,s),o.message("Updating workspace config..."),await He(n,s),s!=="pnpm"&&(o.message("Updating workspace dependencies..."),await qe(n))),o.message("Setting up environment variable files..."),await Ue(),o.message("Deleting internal content..."),await Le(),o.message("Installing dependencies..."),await Fe(s),o.message("Setting up ORM..."),We(s),e.disableGit||(o.message("Initializing Git repository..."),Ge()),o.stop("Project initialized successfully!"),Ie("Please make sure you install the Mintlify CLI and Stripe CLI before starting the project.")}catch(t){let a=t instanceof Error?t.message:`Failed to initialize project: ${t}`;Me.error(a),process.exit(1)}};import{existsSync as Mt}from"fs";import{readFile as ie}from"fs/promises";import{join as U}from"path";import{cancel as ce,confirm as It,intro as Ot,isCancel as le,log as $,outro as Dt,select as Nt,spinner as Tt}from"@clack/prompts";import{detectPackageManager as _t}from"nypm";var u=(e,t,a)=>{let s=["#!/usr/bin/env bash","set -euo pipefail","",`# ${e}`,`# Usage: ${t}`];return a&&s.push(`# Timeout: ${a}`),s.push("",'REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"','cd "$REPO_ROOT"',""),s.join(`
+`)},l=(e,t)=>{switch(e.packageManager){case"bun":return`bun run ${t}`;case"yarn":return`yarn ${t}`;case"pnpm":return`pnpm run ${t}`;default:return`npm run ${t}`}},F=(e,t)=>{switch(e.packageManager){case"bun":return`bunx ${t}`;case"yarn":return`yarn dlx ${t}`;case"pnpm":return`pnpm dlx ${t}`;default:return`npx ${t}`}},y=(e,t=!1)=>{switch(e.packageManager){case"bun":return t?"bun install --frozen-lockfile":"bun install";case"yarn":return t?"yarn install --frozen-lockfile":"yarn install";case"pnpm":return t?"pnpm install --frozen-lockfile":"pnpm install";default:return t?"npm ci":"npm install"}},w=e=>{switch(e.packageManager){case"bun":return"bun.lock";case"yarn":return"yarn.lock";case"pnpm":return"pnpm-lock.yaml";default:return"package-lock.json"}};var i=(e,t)=>e.layers.includes(t);var Je=e=>{let t=i(e,"harness")?"make -f Makefile.control audit":"echo 'Install harness layer for audit'",a=i(e,"harness")?"make -f Makefile.control check":`${e.packageManager} run check`,s=i(e,"harness")?"make -f Makefile.control test":`${e.packageManager} run test`;return`# .control/egri.yaml \u2014 EGRI Self-Improvement Loop for ${e.name}
+# EGRI: Evaluate \u2192 Generate \u2192 Rank \u2192 Integrate
+#
+# This config defines the surfaces the system can mutate, the evaluators
+# that judge mutations, and the criteria for promoting changes.
+
+loop:
+  name: "egri"
+  description: "Continuous improvement loop for ${e.name}"
+
+  # --- Evaluate ---
+  # Metrics and checks that measure current system state
+  evaluators:
+    build:
+      command: "${e.packageManager} run build"
+      description: "Full build must succeed"
+      blocking: true
+
+    typecheck:
+      command: "${a}"
+      description: "Lint + typecheck must pass"
+      blocking: true
+
+    tests:
+      command: "${s}"
+      description: "All tests must pass"
+      blocking: true
+
+    audit:
+      command: "${t}"
+      description: "Entropy audit must pass (topology, stale docs, wikilinks)"
+      blocking: false
+
+  # --- Generate ---
+  # Surfaces the system is allowed to mutate
+  mutable_surfaces:
+    scripts:
+      paths:
+        - "scripts/harness/*.sh"
+      description: "Build automation scripts"
+      constraints:
+        - "Must maintain bash strict mode (set -euo pipefail)"
+        - "Must use REPO_ROOT pattern for path resolution"
+
+    docs:
+      paths:
+        - "docs/**/*.md"
+      description: "Knowledge graph documents"
+      constraints:
+        - "Must have valid frontmatter with tags"
+        - "Must be referenced in docs/_index.md"
+        - "Wikilinks must resolve to existing files"
+
+    control:
+      paths:
+        - ".control/*.yaml"
+      description: "Control metalayer configuration"
+      constraints:
+        - "Must be valid YAML"
+        - "topology.yaml must cover all apps/ and packages/"
+
+    agent_instructions:
+      paths:
+        - "CLAUDE.md"
+        - "AGENTS.md"
+      description: "Agent governance instructions"
+      constraints:
+        - "Must reference installed layers"
+        - "Must include working protocol"
+
+  # Surfaces that must NOT be mutated by the loop
+  immutable_surfaces:
+    - "packages/database/prisma/schema.prisma"
+    - ".env*"
+    - "package.json"
+    - "${w(e)}"
+
+  # --- Rank ---
+  # How to compare before/after states
+  ranking:
+    strategy: "evaluator-pass-count"
+    description: "A mutation is better if it passes more evaluators without breaking any blocking ones"
+    tiebreaker: "fewer-files-changed"
+
+  # --- Integrate ---
+  # When and how to promote successful mutations
+  promotion:
+    criteria:
+      - "All blocking evaluators pass"
+      - "No new lint warnings introduced"
+      - "Audit score equal or better than before"
+    method: "commit-to-branch"
+    branch_prefix: "egri/"
+    requires_review: true
+`},Z={name:"autoany",description:"EGRI self-improvement loop configuration (.control/egri.yaml)",dependsOn:["control"],generate:e=>[{path:".control/egri.yaml",content:Je(e)}]};var Ye=e=>{let t=e.packageManager,a=y(e),s=i(e,"control")?`## Control Harness
+
+Policy gates and automation scripts live alongside the code:
+
+- **\`.control/policy.yaml\`** \u2014 Risk gates for database migrations, dependency updates, env changes, new packages, deploys
+- **\`.control/commands.yaml\`** \u2014 Canonical command definitions (smoke, check, test, build, ci, docs-check, deploy)
+- **\`.control/topology.yaml\`** \u2014 Full repo map: all apps, packages, knowledge entry points
+`:"## Control Harness\n\n> [!warning]\n> The `control` layer is not installed. Run `npx symphony-forge layer control` to add governance gates.\n",o=i(e,"harness")?"- **`scripts/harness/`** \u2014 Executable bash scripts for each command\n- **`Makefile.control`** \u2014 `make -f Makefile.control <target>` to run any harness command\n\nKey commands:\n- `make -f Makefile.control smoke` \u2014 quick validation (~120s)\n- `make -f Makefile.control check` \u2014 lint + typecheck (~60s)\n- `make -f Makefile.control ci` \u2014 full pipeline: check + test + build (~600s)\n- `make -f Makefile.control audit` \u2014 entropy audit: topology coverage, stale docs, broken links\n":"> [!warning]\n> The `harness` layer is not installed. Run `npx symphony-forge layer harness` to add build automation.\n",n=i(e,"knowledge")?"## Knowledge Graph\n\nThe knowledge graph lives in `docs/` using Obsidian-flavored Markdown with frontmatter tags.\n\n- **Entry point**: `docs/_index.md` \u2014 full graph map, tag taxonomy, traversal instructions\n- **Architecture**: `docs/architecture/` \u2014 system diagrams, app descriptions\n- **Decisions**: `docs/decisions/` \u2014 Architecture Decision Records (ADRs)\n- **Runbooks**: `docs/runbooks/` \u2014 step-by-step operational procedures\n- **Templates**: `docs/_templates/` \u2014 templates for new docs\n\nLinking conventions: `[[architecture/overview]]` for wikilinks, Mermaid for diagrams, `> [!decision]` / `> [!warning]` for callouts.\n":"## Knowledge Graph\n\n> [!warning]\n> The `knowledge` layer is not installed. Run `npx symphony-forge layer knowledge` to add the documentation skeleton.\n",r=`## Dependency Management
+
+Library updates and dependency hygiene are a first-class concern:
+
+- **Batch updates by type** \u2014 prefer updating at the workspace root rather than individual packages.
+- **Risk tiers**:
+  - **Patch versions**: Low risk \u2014 batch and merge freely after build passes.
+  - **Minor versions**: Medium risk \u2014 review changelogs, run full test suite.
+  - **Major versions**: High risk \u2014 review migration guides, test thoroughly.
+  - **Type-only updates** (\`@types/*\`): Low risk \u2014 update freely, just ensure typecheck passes.
+- **After updating**: Always run \`${a}\`, then \`make -f Makefile.control check\` and \`make -f Makefile.control test\` at minimum.
+`,c=i(e,"autoany")?`## Self-Improvement (EGRI)
+
+The EGRI (Evaluate \u2192 Generate \u2192 Rank \u2192 Integrate) loop is configured in \`.control/egri.yaml\`.
+
+- **Mutable surfaces**: Things the system can change (scripts, docs, config)
+- **Immutable evaluators**: Metrics that judge changes (build pass, test pass, lint clean)
+- **Promotion criteria**: When to accept a change into the main branch
+`:"",m=`## Working Protocol
+
+Follow this protocol for every task:
+
+1. **Read \`AGENTS.md\`** \u2014 understand commands, constraints, and knowledge graph structure
+${i(e,"knowledge")?"2. **Traverse `docs/`** \u2014 start at `docs/_index.md`, navigate to domain-specific docs\n":""}${i(e,"control")?"3. **Check policy** \u2014 run `make -f Makefile.control policy-check` to see if changes trigger risk gates\n":""}4. **Implement** \u2014 follow the constraints in AGENTS.md
+${i(e,"knowledge")?"5. **Update docs** \u2014 any schema, API, or env var change must have a corresponding doc update in `docs/`\n":""}${i(e,"harness")?"6. **Run checks** \u2014 `make -f Makefile.control check` before committing; `make -f Makefile.control ci` before pushing\n":""}`;return`# CLAUDE.md \u2014 ${e.name}
+
+## Project
+${e.name}${e.description?` \u2014 ${e.description}`:""}
+
+## Stack
+- next-forge (Turborepo + Next.js 15)
+- ${t==="bun"?"Bun":t} as package manager
+
+## Commands
+- \`${a}\` \u2014 install dependencies
+- \`${l(e,"dev")}\` \u2014 start all apps in dev mode
+- \`${l(e,"build")}\` \u2014 build all apps
+- \`${l(e,"check")}\` \u2014 lint all packages
+
+## Conventions
+- App Router (Next.js) \u2014 no pages/ directory
+- Server Components by default, 'use client' only when needed
+- Shared UI components in packages/design-system
+- Database schema in packages/database (Prisma)
+
+${n}
+${s}
+${o}
+${r}
+${c}
+${m}
+`},ze=e=>{let t=e.packageManager,a=i(e,"harness")?`## Commands
+
+All commands are defined in \`.control/commands.yaml\` and accessible via \`Makefile.control\`:
+
+| Command | What it does | When to use |
+|---------|-------------|-------------|
+| \`make -f Makefile.control smoke\` | Install + check + build app | After pulling changes |
+| \`make -f Makefile.control check\` | Lint + typecheck | Before every commit |
+| \`make -f Makefile.control test\` | Run test suite | Before pushing |
+| \`make -f Makefile.control build\` | Full build | Before deploy |
+| \`make -f Makefile.control ci\` | check + test + build | Full local CI simulation |
+| \`make -f Makefile.control docs-check\` | Verify docs freshness | After docs/ changes |
+| \`make -f Makefile.control policy-check\` | Policy gate warnings | Before committing |
+| \`make -f Makefile.control audit\` | Full entropy audit | Periodic health check |
+
+Direct ${t} commands also work:
+- \`${y(e)}\` \u2014 install dependencies
+- \`${l(e,"dev")}\` \u2014 start all apps in dev mode
+- \`${l(e,"build")}\` \u2014 build all apps
+- \`${l(e,"test")}\` \u2014 run tests
+- \`${l(e,"check")}\` \u2014 lint
+`:`## Commands
+
+- \`${y(e)}\` \u2014 install dependencies
+- \`${l(e,"dev")}\` \u2014 start all apps in dev mode
+- \`${l(e,"build")}\` \u2014 build all apps
+- \`${l(e,"test")}\` \u2014 run tests
+
+> [!warning]
+> The \`harness\` layer is not installed. Run \`npx symphony-forge layer harness\` for build automation via \`Makefile.control\`.
+`,s=i(e,"knowledge")?`## Knowledge Graph Traversal
+
+The knowledge graph lives in \`docs/\` using Obsidian-flavored Markdown:
+
+### Entry Point
+Start at \`docs/_index.md\`. It contains:
+- The full graph map (every document listed)
+- Tag taxonomy for filtering
+- Traversal instructions for different tasks
+
+### Loading Order
+When starting a task:
+1. Read \`docs/_index.md\` to orient
+2. Read the domain-specific architecture doc
+3. Read related ADRs in \`docs/decisions/\`
+4. Read the relevant runbook if performing an operational task
+
+### Linking Conventions
+- Wikilinks: \`[[architecture/overview]]\` links to \`docs/architecture/overview.md\`
+- Callouts: \`> [!decision]\`, \`> [!warning]\`, \`> [!context]\`
+- Diagrams: Mermaid code blocks for system diagrams
+`:"",o=`## Pre-Push Checklist
+
+Before pushing any branch:
+
+${i(e,"knowledge")?`- [ ] Documentation updated for any schema, API, or env var changes
+`:""}${i(e,"harness")?"- [ ] `make -f Makefile.control check` passes (lint + typecheck)\n- [ ] `make -f Makefile.control test` passes\n":`- [ ] Lint passes
+- [ ] Tests pass
+`}${i(e,"control")?"- [ ] `make -f Makefile.control policy-check` reviewed\n":""}${i(e,"knowledge")?"- [ ] `docs/_index.md` updated if new docs were added\n- [ ] No broken `[[wikilinks]]`\n":""}- [ ] Commit messages are clear and reference relevant context
+`;return`# AGENTS.md \u2014 ${e.name} Agent Guide
+
+This is the entry point for AI coding agents working on ${e.name}.
+Read this file first. Follow the protocols exactly.
+
+## Quick Start
+
+1. **Read this file** completely before doing any work.
+${i(e,"knowledge")?"2. **Traverse the knowledge graph** starting at `docs/_index.md`.\n":""}${i(e,"control")?"3. **Check policy gates** \u2014 run `bash scripts/harness/check-policy.sh` to see if your changes trigger any policies.\n":""}4. **Implement changes** following the constraints below.
+${i(e,"knowledge")?`5. **Update documentation** \u2014 any code change that affects architecture, APIs, schemas, or env vars must have a corresponding doc update.
+`:""}${i(e,"harness")?"6. **Run checks** \u2014 `make -f Makefile.control check` before committing.\n":""}
+
+## Repository Structure
+
+| Path | Type | Description |
+|------|------|-------------|
+| \`apps/app\` | Next.js | Main application (port 3000) |
+| \`apps/api\` | Next.js | API server (port 3002) |
+| \`apps/web\` | Next.js | Marketing site (port 3001) |
+| \`apps/docs\` | Docs | Public documentation |
+| \`apps/email\` | React Email | Email templates |
+| \`apps/storybook\` | Storybook | Component explorer |
+| \`packages/database\` | Prisma | ORM + schema |
+| \`packages/design-system\` | shadcn/ui | Shared UI components |
+| \`packages/auth\` | Auth | Authentication |
+${i(e,"control")?"| `.control/` | YAML | Policy gates, commands, topology |\n":""}${i(e,"knowledge")?"| `docs/` | Markdown | Knowledge graph (Obsidian-flavored) |\n":""}${i(e,"harness")?"| `scripts/harness/` | Bash | Automation scripts |\n":""}
+
+${a}
+
+## Constraints
+
+These are hard rules. Violations will be caught by CI or pre-commit hooks.
+
+1. **App Router only** \u2014 No \`pages/\` directory. All routes use Next.js App Router.
+2. **Server Components by default** \u2014 Only add \`'use client'\` when the component needs browser APIs, hooks, or event handlers.
+3. **Prisma for database** \u2014 All schema changes go through the Prisma schema.
+4. **No secrets in code** \u2014 Environment variables go in \`.env.local\` (gitignored).
+5. **Workspace imports** \u2014 Use \`@repo/<package>\` imports. Never use relative paths across package boundaries.
+${i(e,"knowledge")?"6. **Update docs on schema changes** \u2014 Any change to the database schema, API contracts, or environment variables requires a documentation update.\n7. **ADR for architectural decisions** \u2014 Major changes need an Architecture Decision Record in `docs/decisions/`.\n":""}${i(e,"control")?"8. **Policy compliance** \u2014 Check `.control/policy.yaml` for risk gates before committing high-risk changes.\n":""}9. **TypeScript strict mode** \u2014 \`noEmit\` typecheck must pass. No \`any\` types without justification.
+
+${s}
+${o}
+`},ee={name:"consciousness",description:"Metalayer-aware CLAUDE.md and AGENTS.md for AI agent governance",dependsOn:["control","harness","knowledge"],generate:e=>[{path:"CLAUDE.md",content:Ye(e)},{path:"AGENTS.md",content:ze(e)}]};var Xe=e=>`# .control/policy.yaml \u2014 Policy gates for ${e.name}
+# Each policy defines risk level, required checks, and approval conditions.
+
+policies:
+  database-migration:
+    description: "Any change to the database schema"
+    risk: high
+    triggers:
+      - "packages/database/prisma/schema.prisma"
+      - "packages/database/prisma/migrations/**"
+    requires:
+      - adr: "Must have an ADR in docs/decisions/ explaining the schema change"
+      - tests: "Migration must include or update relevant tests"
+      - backup: "Ensure a database backup exists before applying to production"
+      - review: "Requires at least one reviewer with database domain knowledge"
+    rollback: "Use prisma migrate resolve to mark failed migrations"
+
+  dependency-update:
+    description: "Adding or updating dependencies in any package.json"
+    risk: medium
+    triggers:
+      - "**/package.json"
+      - "${w(e)}"
+    requires:
+      - audit: "Run audit to check for vulnerabilities"
+      - build: "Full build must pass after dependency change"
+      - test: "All tests must pass"
+    notes: "Prefer exact versions. Document why new dependencies are needed."
+
+  env-variable-change:
+    description: "Adding or modifying environment variables"
+    risk: high
+    triggers:
+      - "**/.env.example"
+      - "**/.env.local.example"
+      - "**/env.ts"
+      - "**/keys.ts"
+    requires:
+      - docs: "Update docs/schemas/env-variables.md with the new variable"
+      - secrets: "Never commit actual secret values"
+      - validation: "Add Zod validation in the relevant env.ts file"
+    notes: "All env vars must be documented and validated at startup."
+
+  new-package:
+    description: "Creating a new workspace package under packages/ or apps/"
+    risk: medium
+    triggers:
+      - "packages/*/package.json"
+      - "apps/*/package.json"
+    requires:
+      - topology: "Update .control/topology.yaml with the new package"
+      - docs: "Add architecture doc in docs/architecture/"
+      - index: "Update docs/_index.md to reference the new doc"
+    notes: "Follow existing package conventions. Use @repo/ scope."
+
+  pr-feedback-loop:
+    description: "PR review comments must be resolved before merge"
+    risk: medium
+    triggers:
+      - manual
+    requires:
+      - triage: "Every review comment must be triaged: accept, fix, or reject with rationale"
+      - commit: "Fixes must be committed and pushed (not amended into prior commits)"
+      - ci: "All CI checks must pass after fixes are applied"
+      - reply: "Each resolved comment must have a reply confirming the resolution"
+    notes: "PR comments are sensors in the control loop. Unresolved comments are entropy \u2014 reduce them to zero before merge."
+
+  production-deploy:
+    description: "Deploying to production"
+    risk: critical
+    triggers:
+      - manual
+    requires:
+      - ci: "All CI checks must pass (lint, typecheck, test, build)"
+      - review: "At least one approved review on the PR"
+      - docs: "All documentation must be up to date"
+      - policy: "All policy gates for included changes must be satisfied"
+      - staging: "Changes should be verified in preview deployment first"
+    rollback: "Use hosting provider's rollback to previous deployment"
+`,Qe=e=>{let t=e.packageManager;return`# .control/commands.yaml \u2014 Canonical commands for ${e.name}
+# Each command maps to a harness script in scripts/harness/.
+
+commands:
+  smoke:
+    description: "Quick validation: install, check, build the main app"
+    script: "scripts/harness/smoke.sh"
+    timeout: 120
+    usage: "make -f Makefile.control smoke"
+    when: "Before starting work, after pulling changes"
+
+  check:
+    description: "Lint + typecheck"
+    script: "scripts/harness/check.sh"
+    timeout: 60
+    usage: "make -f Makefile.control check"
+    when: "Before committing, after any code change"
+
+  test:
+    description: "Run test suite"
+    script: "${t} run test"
+    timeout: 180
+    usage: "make -f Makefile.control test"
+    when: "Before pushing, after logic changes"
+
+  build:
+    description: "Full build"
+    script: "${t} run build"
+    timeout: 300
+    usage: "make -f Makefile.control build"
+    when: "Before deploy, to verify everything compiles"
+
+  ci:
+    description: "Full CI pipeline: check + test + build"
+    script: "scripts/harness/ci.sh"
+    timeout: 600
+    usage: "make -f Makefile.control ci"
+    when: "Simulating the full CI pipeline locally"
+
+  docs-check:
+    description: "Verify documentation freshness and index coverage"
+    script: "scripts/harness/check-docs-freshness.sh"
+    timeout: 10
+    usage: "make -f Makefile.control docs-check"
+    when: "After modifying any file in docs/"
+
+  deploy:
+    description: "Deploy to production"
+    script: "vercel --prod"
+    timeout: 300
+    usage: "make -f Makefile.control deploy"
+    when: "After all CI checks pass and PR is approved"
+`},Ze=e=>`# .control/topology.yaml \u2014 Repository topology map for ${e.name}
+# Describes all apps, packages, and their relationships.
+
+apps:
+  app:
+    path: "apps/app"
+    description: "Main application (Next.js App Router)"
+    port: 3000
+    risk: high
+    domain: dashboard
+    dependencies:
+      - "@repo/auth"
+      - "@repo/database"
+      - "@repo/design-system"
+      - "@repo/observability"
+
+  api:
+    path: "apps/api"
+    description: "API server (Next.js Route Handlers)"
+    port: 3002
+    risk: high
+    domain: api
+    dependencies:
+      - "@repo/auth"
+      - "@repo/database"
+      - "@repo/observability"
+
+  web:
+    path: "apps/web"
+    description: "Marketing website (Next.js)"
+    port: 3001
+    risk: low
+    domain: marketing
+    dependencies:
+      - "@repo/design-system"
+
+  docs:
+    path: "apps/docs"
+    description: "Public documentation site"
+    port: 3004
+    risk: low
+    domain: docs
+    dependencies: []
+
+  email:
+    path: "apps/email"
+    description: "Email templates (React Email)"
+    port: 3003
+    risk: low
+    domain: email
+    dependencies:
+      - "@repo/email"
+
+  storybook:
+    path: "apps/storybook"
+    description: "Component library explorer (Storybook)"
+    port: 6006
+    risk: low
+    domain: design
+    dependencies:
+      - "@repo/design-system"
+
+packages:
+  auth:
+    path: "packages/auth"
+    description: "Authentication"
+    domain: auth
+
+  database:
+    path: "packages/database"
+    description: "Database ORM"
+    domain: database
+    risk: high
+
+  design-system:
+    path: "packages/design-system"
+    description: "UI components"
+    domain: design
+
+  email:
+    path: "packages/email"
+    description: "Email sending"
+    domain: email
+
+  observability:
+    path: "packages/observability"
+    description: "Logging, error tracking, monitoring"
+    domain: observability
+
+  typescript-config:
+    path: "packages/typescript-config"
+    description: "Shared TypeScript configuration"
+    domain: infra
+
+knowledge:
+  entry_point: "docs/_index.md"
+  architecture: "docs/architecture/"
+  decisions: "docs/decisions/"
+  runbooks: "docs/runbooks/"
+  schemas: "docs/schemas/"
+`,te={name:"control",description:"Governance gates, command registry, and repo topology (.control/*.yaml)",generate:e=>[{path:".control/policy.yaml",content:Xe(e)},{path:".control/commands.yaml",content:Qe(e)},{path:".control/topology.yaml",content:Ze(e)}]};var et=e=>e==="bun"?`      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2`:e==="pnpm"?`      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm`:`      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: ${e}`,tt=e=>`${u("smoke.sh \u2014 Quick validation: install, check, build the main app","make -f Makefile.control smoke","~120s")}
+echo "=== Smoke Test ==="
+echo ""
+
+echo "[1/3] Installing dependencies (frozen lockfile)..."
+${y(e,!0)}
+echo ""
+
+echo "[2/3] Running checks (lint + typecheck)..."
+${l(e,"check")}
+echo ""
+
+echo "[3/3] Building main app..."
+${l(e,"build")} ${e.packageManager==="npm"?"--workspace app":"--filter app"}
+echo ""
+
+echo "=== Smoke test passed ==="
+`,at=e=>`${u("check.sh \u2014 Lint + typecheck","make -f Makefile.control check","~60s")}
+echo "=== Check: Lint + Typecheck ==="
+echo ""
+
+echo "[1/2] Running lint..."
+${l(e,"check")}
+echo ""
+
+echo "[2/2] Running TypeScript typecheck..."
+${F(e,"tsc --noEmit")}
+echo ""
+
+echo "=== All checks passed ==="
+`,st=e=>`${u("ci.sh \u2014 Full CI pipeline: check + test + build","make -f Makefile.control ci","~600s")}
+echo "=== CI Pipeline ==="
+echo ""
+
+echo "[1/3] Running checks (lint + typecheck)..."
+bash scripts/harness/check.sh
+echo ""
+
+echo "[2/3] Running tests..."
+${l(e,"test")}
+echo ""
+
+echo "[3/3] Running full build..."
+${l(e,"build")}
+echo ""
+
+echo "=== CI pipeline passed ==="
+`,ot=e=>`${u("check-policy.sh \u2014 Policy compliance checker for staged changes","make -f Makefile.control policy-check")}
+echo "=== Policy Compliance Check ==="
+
+# Get staged files (or all changed files if not in a git context)
+if git rev-parse --is-inside-work-tree > /dev/null 2>&1; then
+  STAGED=$(git diff --cached --name-only 2>/dev/null || git diff --name-only HEAD 2>/dev/null || true)
+else
+  echo "  Not in a git repository. Skipping policy check."
+  exit 0
+fi
+
+if [ -z "$STAGED" ]; then
+  echo "  No staged files. Nothing to check."
+  exit 0
+fi
+
+WARNINGS=0
+
+# Policy: database-migration
+if echo "$STAGED" | grep -q "packages/database/prisma/schema.prisma\\|packages/database/prisma/migrations"; then
+  echo ""
+  echo "  [HIGH RISK] Database migration detected!"
+  echo "    - Required: ADR in docs/decisions/ explaining the change"
+  echo "    - Required: Tests covering the migration"
+  echo "    - Required: Database backup before production apply"
+  WARNINGS=$((WARNINGS + 1))
+fi
+
+# Policy: dependency-update
+if echo "$STAGED" | grep -q "package.json\\|${w(e)}"; then
+  echo ""
+  echo "  [MEDIUM RISK] Dependency change detected!"
+  echo "    - Recommended: Run audit"
+  echo "    - Required: Full build and test pass"
+  WARNINGS=$((WARNINGS + 1))
+fi
+
+# Policy: env-variable-change
+if echo "$STAGED" | grep -qE "\\.env\\.example|\\.env\\.local\\.example|env\\.ts|keys\\.ts"; then
+  echo ""
+  echo "  [HIGH RISK] Environment variable change detected!"
+  echo "    - Required: Update docs/schemas/env-variables.md"
+  echo "    - Required: Add Zod validation in env.ts"
+  echo "    - WARNING: Never commit actual secret values"
+  WARNINGS=$((WARNINGS + 1))
+fi
+
+# Policy: new-package
+if echo "$STAGED" | grep -qE "^(packages|apps)/[^/]+/package\\.json$"; then
+  NEW_PKGS=$(echo "$STAGED" | grep -E "^(packages|apps)/[^/]+/package\\.json$" || true)
+  for pkg in $NEW_PKGS; do
+    if ! git show HEAD:"$pkg" > /dev/null 2>&1; then
+      echo ""
+      echo "  [MEDIUM RISK] New package detected: $pkg"
+      echo "    - Required: Update .control/topology.yaml"
+      echo "    - Required: Add architecture doc in docs/architecture/"
+      echo "    - Required: Update docs/_index.md"
+      WARNINGS=$((WARNINGS + 1))
+    fi
+  done
+fi
+
+echo ""
+if [ "$WARNINGS" -gt 0 ]; then
+  echo "  Found $WARNINGS policy warning(s). Review before proceeding."
+  echo "  (Policy checks are advisory \u2014 they do not block commits.)"
+else
+  echo "  No policy warnings."
+fi
+
+echo "=== Policy check complete ==="
+`,nt=()=>`${u("check-docs-freshness.sh \u2014 Verify documentation index coverage","make -f Makefile.control docs-check")}
+DOCS_DIR="$REPO_ROOT/docs"
+INDEX_FILE="$DOCS_DIR/_index.md"
+
+echo "=== Docs Freshness Check ==="
+
+if [ ! -d "$DOCS_DIR" ]; then
+  echo "  WARN: docs/ directory does not exist yet. Skipping."
+  exit 0
+fi
+
+if [ ! -f "$INDEX_FILE" ]; then
+  echo "  WARN: docs/_index.md does not exist yet. Skipping."
+  exit 0
+fi
+
+MISSING=()
+
+while IFS= read -r -d '' doc; do
+  rel_path="\${doc#"$DOCS_DIR"/}"
+
+  if [[ "$rel_path" == _templates/* ]]; then
+    continue
+  fi
+
+  if [[ "$rel_path" == "_index.md" ]]; then
+    continue
+  fi
+
+  basename_no_ext="\${rel_path%.md}"
+  if ! grep -q "$basename_no_ext" "$INDEX_FILE" && ! grep -q "$rel_path" "$INDEX_FILE"; then
+    MISSING+=("$rel_path")
+  fi
+done < <(find "$DOCS_DIR" -name '*.md' -print0 | sort -z)
+
+if [ \${#MISSING[@]} -gt 0 ]; then
+  echo "  ERROR: The following docs are NOT referenced in docs/_index.md:"
+  for m in "\${MISSING[@]}"; do
+    echo "    - $m"
+  done
+  echo ""
+  echo "  Add references to these files in docs/_index.md."
+  exit 1
+fi
+
+echo "  All docs are referenced in _index.md."
+echo "=== Docs freshness check passed ==="
+`,rt=()=>`${u("check-wikilinks.sh \u2014 Validate [[wikilinks]] in docs/*.md files","make -f Makefile.control wikilinks-check")}
+DOCS_DIR="$REPO_ROOT/docs"
+
+echo "=== Wikilink Validation ==="
+
+if [ ! -d "$DOCS_DIR" ]; then
+  echo "  WARN: docs/ directory does not exist yet. Skipping."
+  exit 0
+fi
+
+BROKEN=()
+CHECKED=0
+
+while IFS= read -r -d '' doc; do
+  while IFS= read -r link; do
+    target="\${link%%|*}"
+    target="\${target%%#*}"
+
+    if [ -z "$target" ]; then
+      continue
+    fi
+
+    if [[ "$target" == ...* ]]; then
+      continue
+    fi
+
+    if [[ "$target" == *NNN* ]] || [[ "$target" == *XXX* ]]; then
+      continue
+    fi
+
+    if [[ "$target" == "wikilinks" ]] || [[ "$target" == "internal-link" ]]; then
+      continue
+    fi
+
+    target="\${target%%#*}"
+    target="\${target%/}"
+
+    if [ -z "$target" ]; then
+      continue
+    fi
+
+    CHECKED=$((CHECKED + 1))
+
+    target_file="$DOCS_DIR/\${target}.md"
+    target_dir="$DOCS_DIR/\${target}"
+
+    if [ ! -f "$target_file" ] && [ ! -d "$target_dir" ]; then
+      rel_doc="\${doc#"$REPO_ROOT"/}"
+      BROKEN+=("$rel_doc -> [[\${target}]] (expected: docs/\${target}.md)")
+    fi
+  done < <(
+    sed '/^\`\`\`/,/^\`\`\`/d' "$doc" \\
+      | sed 's/\`[^\`]*\`//g' \\
+      | grep -oE '\\[\\[[^]]+\\]\\]' 2>/dev/null \\
+      | sed 's/^\\[\\[//; s/\\]\\]$//' \\
+      || true
+  )
+done < <(find "$DOCS_DIR" -name '*.md' -print0 | sort -z)
+
+echo "  Checked $CHECKED wikilinks."
+
+if [ \${#BROKEN[@]} -gt 0 ]; then
+  echo ""
+  echo "  ERROR: Found \${#BROKEN[@]} broken wikilink(s):"
+  for b in "\${BROKEN[@]}"; do
+    echo "    - $b"
+  done
+  echo ""
+  echo "  Create the missing target files or fix the wikilink paths."
+  exit 1
+fi
+
+echo "  No broken wikilinks found."
+echo "=== Wikilink validation passed ==="
+`,it=()=>`${u("audit.sh \u2014 Entropy audit: topology coverage, stale docs, broken wikilinks","make -f Makefile.control audit")}
+echo "=== Entropy Audit ==="
+echo ""
+ISSUES=0
+
+# --- 1. Topology Coverage ---
+echo "[1/3] Checking topology coverage..."
+
+TOPOLOGY_FILE="$REPO_ROOT/.control/topology.yaml"
+if [ ! -f "$TOPOLOGY_FILE" ]; then
+  echo "  ERROR: .control/topology.yaml not found!"
+  ISSUES=$((ISSUES + 1))
+else
+  for app_dir in "$REPO_ROOT"/apps/*/; do
+    app_name=$(basename "$app_dir")
+    if ! grep -q "^  \${app_name}:" "$TOPOLOGY_FILE" 2>/dev/null; then
+      echo "  WARN: apps/$app_name is not listed in .control/topology.yaml"
+      ISSUES=$((ISSUES + 1))
+    fi
+  done
+
+  for pkg_dir in "$REPO_ROOT"/packages/*/; do
+    pkg_name=$(basename "$pkg_dir")
+    if ! grep -q "^  \${pkg_name}:" "$TOPOLOGY_FILE" 2>/dev/null; then
+      echo "  WARN: packages/$pkg_name is not listed in .control/topology.yaml"
+      ISSUES=$((ISSUES + 1))
+    fi
+  done
+
+  echo "  Topology coverage check complete."
+fi
+echo ""
+
+# --- 2. Stale Docs ---
+echo "[2/3] Checking for stale documentation (>90 days)..."
+
+DOCS_DIR="$REPO_ROOT/docs"
+if [ ! -d "$DOCS_DIR" ]; then
+  echo "  WARN: docs/ directory does not exist yet. Skipping stale docs check."
+else
+  STALE_THRESHOLD=$((90 * 24 * 60 * 60))
+  NOW=$(date +%s)
+  STALE_COUNT=0
+
+  while IFS= read -r -d '' doc; do
+    if [[ "$OSTYPE" == "darwin"* ]]; then
+      MOD_TIME=$(stat -f %m "$doc")
+    else
+      MOD_TIME=$(stat -c %Y "$doc")
+    fi
+    AGE=$((NOW - MOD_TIME))
+
+    if [ "$AGE" -gt "$STALE_THRESHOLD" ]; then
+      rel_path="\${doc#"$REPO_ROOT"/}"
+      DAYS_OLD=$((AGE / 86400))
+      echo "  STALE: $rel_path (\${DAYS_OLD} days old)"
+      STALE_COUNT=$((STALE_COUNT + 1))
+    fi
+  done < <(find "$DOCS_DIR" -name '*.md' -print0 2>/dev/null)
+
+  if [ "$STALE_COUNT" -eq 0 ]; then
+    echo "  No stale docs found."
+  else
+    echo "  Found $STALE_COUNT stale doc(s)."
+    ISSUES=$((ISSUES + STALE_COUNT))
+  fi
+fi
+echo ""
+
+# --- 3. Broken Wikilinks ---
+echo "[3/3] Checking for broken wikilinks..."
+if [ -f "$REPO_ROOT/scripts/harness/check-wikilinks.sh" ]; then
+  if ! bash "$REPO_ROOT/scripts/harness/check-wikilinks.sh"; then
+    ISSUES=$((ISSUES + 1))
+  fi
+else
+  echo "  WARN: check-wikilinks.sh not found. Skipping."
+fi
+
+echo ""
+echo "=== Audit Summary ==="
+if [ "$ISSUES" -gt 0 ]; then
+  echo "  Found $ISSUES issue(s). Review and address above warnings."
+  exit 1
+else
+  echo "  No issues found. Repository is in good shape."
+  exit 0
+fi
+`,ct=()=>`${u("install-hooks.sh \u2014 Install git hooks","make -f Makefile.control hooks-install")}
+HOOKS_DIR="$REPO_ROOT/.git/hooks"
+
+if [ ! -d "$REPO_ROOT/.git" ]; then
+  echo "No .git directory found. Skipping hook installation."
+  exit 0
+fi
+
+mkdir -p "$HOOKS_DIR"
+
+cp "$REPO_ROOT/scripts/harness/pre-commit.sh" "$HOOKS_DIR/pre-commit"
+chmod +x "$HOOKS_DIR/pre-commit"
+
+echo "Git hooks installed:"
+echo "  - pre-commit -> scripts/harness/pre-commit.sh"
+`,lt=e=>`${u("pre-commit.sh \u2014 Fast pre-commit hook (<10s)","Installed as .git/hooks/pre-commit via install-hooks.sh")}
+echo "=== Pre-commit Hook ==="
+
+STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\\.(ts|tsx)$' || true)
+
+if [ -n "$STAGED_FILES" ]; then
+  echo "[1/2] Linting staged TypeScript files..."
+  echo "$STAGED_FILES" | xargs ${F(e,"biome check --no-errors-on-unmatched")}
+else
+  echo "[1/2] No staged TypeScript files to lint."
+fi
+
+echo "[2/2] Checking docs freshness..."
+if [ -f "$REPO_ROOT/scripts/harness/check-docs-freshness.sh" ]; then
+  bash "$REPO_ROOT/scripts/harness/check-docs-freshness.sh"
+else
+  echo "  Skipping: check-docs-freshness.sh not found."
+fi
+
+echo "=== Pre-commit passed ==="
+`,pt=e=>`# Makefile.control \u2014 Control harness for ${e.name}
+# Usage: make -f Makefile.control <target>
+# All targets delegate to scripts in scripts/harness/
+
+.PHONY: help smoke check test build ci docs-check wikilinks-check policy-check hooks-install audit
+
+SHELL := /usr/bin/env bash
+
+help: ## Show all available targets
+	@echo "${e.name} \u2014 Control Harness"
+	@echo ""
+	@echo "Usage: make -f Makefile.control <target>"
+	@echo ""
+	@echo "Targets:"
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "  \\033[36m%-18s\\033[0m %s\\n", $$1, $$2}'
+
+smoke: ## Quick validation: install + check + build app (~120s)
+	@bash scripts/harness/smoke.sh
+
+check: ## Lint + typecheck (~60s)
+	@bash scripts/harness/check.sh
+
+test: ## Run test suite (~180s)
+	@${l(e,"test")}
+
+build: ## Full build (~300s)
+	@${l(e,"build")}
+
+ci: ## Full CI pipeline: check + test + build (~600s)
+	@bash scripts/harness/ci.sh
+
+docs-check: ## Verify documentation freshness and index coverage (~10s)
+	@bash scripts/harness/check-docs-freshness.sh
+
+wikilinks-check: ## Validate no broken [[wikilinks]] in docs/ (~10s)
+	@bash scripts/harness/check-wikilinks.sh
+
+policy-check: ## Check staged files against policy gates
+	@bash scripts/harness/check-policy.sh
+
+hooks-install: ## Install git pre-commit hooks
+	@bash scripts/harness/install-hooks.sh
+
+audit: ## Entropy audit: topology, stale docs, broken links
+	@bash scripts/harness/audit.sh
+`,dt=e=>{let t=e.packageManager,a=y(e,!0);return`name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  ci:
+    name: Check, Test, Build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+${et(t)}
+
+      - name: Install dependencies
+        run: ${a}
+
+      - name: Lint + Typecheck
+        run: bash scripts/harness/check.sh
+
+      - name: Test
+        run: ${l(e,"test")}
+
+      - name: Build
+        run: ${l(e,"build")}
+`},ae={name:"harness",description:"Build automation scripts, Makefile.control, git hooks, CI workflow",dependsOn:["control"],generate:e=>[{path:"scripts/harness/smoke.sh",content:tt(e),executable:!0},{path:"scripts/harness/check.sh",content:at(e),executable:!0},{path:"scripts/harness/ci.sh",content:st(e),executable:!0},{path:"scripts/harness/check-policy.sh",content:ot(e),executable:!0},{path:"scripts/harness/check-docs-freshness.sh",content:nt(),executable:!0},{path:"scripts/harness/check-wikilinks.sh",content:rt(),executable:!0},{path:"scripts/harness/audit.sh",content:it(),executable:!0},{path:"scripts/harness/install-hooks.sh",content:ct(),executable:!0},{path:"scripts/harness/pre-commit.sh",content:lt(e),executable:!0},{path:"Makefile.control",content:pt(e)},{path:".github/workflows/ci.yml",content:dt(e)}]};var mt=e=>{switch(e){case"bun":return"Bun";case"pnpm":return"pnpm";case"yarn":return"Yarn";default:return"npm"}},ht=e=>`---
+title: "${e.name} Knowledge Graph"
+type: index
+domain: all
+status: active
+tags:
+  - domain/all
+  - status/active
+  - type/index
+---
+
+# ${e.name} Knowledge Graph
+
+> [!context]
+> This is the entry point for the ${e.name} knowledge system. Every agent session should start here to understand the codebase topology, conventions, and decision history before making changes.
+
+## Graph Map
+
+\`\`\`mermaid
+graph TD
+    INDEX["_index.md<br/>(you are here)"]
+    GLOSS["glossary.md"]
+
+    subgraph Architecture
+        ARCH_OV["architecture/overview.md"]
+    end
+
+    subgraph Decisions
+        ADR1["decisions/adr-001-metalayer.md"]
+    end
+
+    subgraph Runbooks
+        RB_DEV["runbooks/local-dev-setup.md"]
+    end
+
+    INDEX --> GLOSS
+    INDEX --> ARCH_OV
+    INDEX --> ADR1
+    INDEX --> RB_DEV
+
+    ARCH_OV --> GLOSS
+\`\`\`
+
+## Tag Taxonomy
+
+| Prefix | Values | Purpose |
+|--------|--------|---------|
+| \`domain/\` | project-specific domains | Which subsystem the note covers |
+| \`status/\` | \`draft\`, \`active\`, \`deprecated\` | Note lifecycle |
+| \`type/\` | \`architecture\`, \`api-contract\`, \`decision\`, \`runbook\`, \`schema\`, \`index\`, \`glossary\`, \`template\` | Document type |
+
+## Traversal Instructions
+
+1. **Start here** \u2014 read this index to orient yourself in the knowledge graph
+2. **Understand the system** \u2014 read [[architecture/overview]] and [[glossary]]
+3. **Find the relevant subsystem** \u2014 follow links to specific architecture notes
+4. **Check for decisions** \u2014 before proposing alternatives, read relevant ADRs
+5. **Follow runbooks** \u2014 for operational tasks, use the runbook for that workflow
+6. **Use templates** \u2014 when creating new docs, copy from the \`_templates/\` directory
+
+## Document Registry
+
+### Architecture
+- [[architecture/overview]] \u2014 System architecture overview
+
+### Decisions
+- [[decisions/adr-001-metalayer]] \u2014 Why the control metalayer pattern
+
+### Runbooks
+- [[runbooks/local-dev-setup]] \u2014 Getting started from scratch
+
+### Glossary
+- [[glossary]] \u2014 Key terms and definitions
+`,gt=e=>`---
+title: "Glossary"
+type: glossary
+domain: all
+status: active
+tags:
+  - domain/all
+  - status/active
+  - type/glossary
+---
+
+# Glossary
+
+## Control Metalayer
+The governance layer (\`.control/\`) that defines policies, commands, and topology for the project. Acts as a declarative control system for development practices.
+
+## Entropy Audit
+A check that measures "drift" in the repository: uncovered topology, stale docs, broken wikilinks. Run via \`make -f Makefile.control audit\`.
+
+## Harness
+The collection of bash scripts in \`scripts/harness/\` that automate common development tasks (check, test, build, audit).
+
+## Knowledge Graph
+The interconnected documentation in \`docs/\` using Obsidian-flavored Markdown with wikilinks (\`[[target]]\`) and frontmatter tags.
+
+## Policy Gate
+A rule in \`.control/policy.yaml\` that identifies high-risk changes and their required checks before proceeding.
+
+## Topology
+The map of all apps and packages in \`.control/topology.yaml\`, including their paths, dependencies, risk levels, and domains.
+
+## Wikilink
+An Obsidian-style internal link: \`[[path/to/doc]]\` resolves to \`docs/path/to/doc.md\`.
+`,ut=e=>`---
+title: "Architecture Overview"
+type: architecture
+domain: all
+status: active
+tags:
+  - domain/all
+  - status/active
+  - type/architecture
+---
+
+# Architecture Overview
+
+> [!context]
+> High-level architecture of ${e.name}. This document describes the system topology, key components, and how they interact.
+
+## System Diagram
+
+\`\`\`mermaid
+graph TD
+    subgraph Apps
+        APP["app (dashboard)"]
+        API["api (server)"]
+        WEB["web (marketing)"]
+    end
+
+    subgraph Packages
+        AUTH["auth"]
+        DB["database"]
+        UI["design-system"]
+        OBS["observability"]
+    end
+
+    APP --> AUTH
+    APP --> DB
+    APP --> UI
+    APP --> OBS
+    API --> AUTH
+    API --> DB
+    API --> OBS
+    WEB --> UI
+\`\`\`
+
+## Apps
+
+| App | Port | Description |
+|-----|------|-------------|
+| \`apps/app\` | 3000 | Main dashboard application |
+| \`apps/api\` | 3002 | API server |
+| \`apps/web\` | 3001 | Marketing website |
+| \`apps/docs\` | 3004 | Public documentation |
+| \`apps/email\` | 3003 | Email templates |
+| \`apps/storybook\` | 6006 | Component explorer |
+
+## Packages
+
+See \`.control/topology.yaml\` for the full package map with dependencies.
+
+## Related
+
+- [[glossary]]
+`,ft=e=>`---
+title: "ADR-001: Control Metalayer Pattern"
+type: decision
+domain: all
+status: active
+tags:
+  - domain/all
+  - status/active
+  - type/decision
+---
+
+# ADR-001: Control Metalayer Pattern
+
+## Status
+
+**Accepted** \u2014 scaffolded by symphony-forge
+
+## Context
+
+${e.name} needs a governance layer that:
+- Defines risk policies for high-impact changes (database migrations, env vars, deploys)
+- Provides a canonical command registry for build automation
+- Maps the full repository topology for discoverability
+- Enables AI agents to operate autonomously with safety guardrails
+
+## Decision
+
+> [!decision]
+> We adopt the **control metalayer** pattern: \`.control/\` YAML for governance, \`scripts/harness/\` for automation, \`docs/\` for knowledge, and metalayer-aware agent instructions.
+
+## Rationale
+
+The metalayer is a **control system** applied to development:
+- **Policy gates** are sensors that detect high-risk changes
+- **Harness scripts** are actuators that enforce standards
+- **Knowledge graph** is the system's model of itself
+- **Agent instructions** close the loop between measurement and action
+
+## Consequences
+
+### Positive
+- Agents can operate autonomously with clear guardrails
+- New contributors discover conventions via docs, not tribal knowledge
+- Entropy is measurable and auditable
+
+### Negative
+- Additional files to maintain (mitigated by audit scripts)
+- Learning curve for the metalayer conventions
+
+## Related
+
+- [[architecture/overview]]
+- [[glossary]]
+`,kt=e=>{let t=e.packageManager;return`---
+title: "Runbook: Local Development Setup"
+type: runbook
+domain: all
+status: active
+tags:
+  - domain/all
+  - status/active
+  - type/runbook
+---
+
+# Runbook: Local Development Setup
+
+> [!context]
+> How to set up ${e.name} for local development from scratch.
+
+## Pre-Flight Checklist
+
+- [ ] Node.js >= 18 installed
+- [ ] ${mt(t)} installed
+- [ ] Git installed
+
+## Steps
+
+### 1. Clone the repository
+
+\`\`\`bash
+git clone <repository-url>
+cd ${e.name}
+\`\`\`
+
+### 2. Install dependencies
+
+\`\`\`bash
+${y(e)}
+\`\`\`
+
+### 3. Set up environment variables
+
+\`\`\`bash
+# Copy example env files
+cp apps/app/.env.example apps/app/.env.local
+cp apps/api/.env.example apps/api/.env.local
+cp apps/web/.env.example apps/web/.env.local
+\`\`\`
+
+### 4. Start development server
+
+\`\`\`bash
+${l(e,"dev")}
+\`\`\`
+
+### 5. Verify setup
+
+\`\`\`bash
+make -f Makefile.control smoke
+\`\`\`
+
+## Verification
+
+| Check | Expected Result |
+|-------|-----------------|
+| \`make -f Makefile.control check\` | Lint + typecheck pass |
+| \`localhost:3000\` | Dashboard loads |
+| \`localhost:3001\` | Marketing site loads |
+
+## Related
+
+- [[architecture/overview]]
+- [[glossary]]
+`},yt=()=>`---
+title: "ADR-NNN: [Decision Title]"
+type: decision
+domain: # specify domain
+status: draft
+tags:
+  - domain/{area}
+  - status/draft
+  - type/decision
+---
+
+# ADR-NNN: [Decision Title]
+
+## Status
+
+**Proposed** \u2014 YYYY-MM
+
+## Context
+
+<!-- What is the issue that motivates this decision? -->
+
+## Options Considered
+
+### Option A: [Name]
+
+<!-- Description, pros, cons -->
+
+### Option B: [Name]
+
+<!-- Description, pros, cons -->
+
+## Decision
+
+> [!decision]
+> We will use **[chosen option]** because [one-line rationale].
+
+## Rationale
+
+<!-- Detailed reasoning -->
+
+## Consequences
+
+### Positive
+<!-- What becomes easier? -->
+
+### Negative
+<!-- What becomes harder? -->
+
+## Related
+
+- [[architecture/overview]]
+`,bt=()=>`---
+title: "[Component/System Name]"
+type: architecture
+domain: # specify domain
+status: draft
+tags:
+  - domain/{area}
+  - status/draft
+  - type/architecture
+---
+
+# [Component/System Name]
+
+> [!context]
+> Brief description of what this component/system does and why it exists.
+
+## Overview
+
+<!-- High-level description -->
+
+## Architecture Diagram
+
+\`\`\`mermaid
+graph TD
+    A["Component A"] --> B["Component B"]
+\`\`\`
+
+## Key Components
+
+| Component | File/Path | Purpose |
+|-----------|-----------|---------|
+| | | |
+
+## Dependencies
+
+| Dependency | Usage |
+|------------|-------|
+| | |
+
+## Related
+
+- [[architecture/overview]]
+`,vt=()=>`---
+title: "Runbook: [Task Name]"
+type: runbook
+domain: # specify domain
+status: draft
+tags:
+  - domain/{area}
+  - status/draft
+  - type/runbook
+---
+
+# Runbook: [Task Name]
+
+> [!context]
+> Brief description of what this runbook covers and when to use it.
+
+## Pre-Flight Checklist
+
+- [ ] Prerequisite 1
+- [ ] Prerequisite 2
+
+## Steps
+
+### 1. [First Step]
+
+\`\`\`bash
+# Command
+\`\`\`
+
+### 2. [Second Step]
+
+\`\`\`bash
+# Command
+\`\`\`
+
+## Verification
+
+| Check | Expected Result |
+|-------|-----------------|
+| | |
+
+## Rollback
+
+> [!warning]
+> Describe any destructive steps and their rollback procedures.
+
+## Related
+
+- [[runbooks/local-dev-setup]]
+`,wt=()=>`---
+title: "[API Name]"
+type: api-contract
+domain: # specify domain
+status: draft
+tags:
+  - domain/{area}
+  - status/draft
+  - type/api-contract
+---
+
+# [API Name]
+
+> [!context]
+> Brief description of this API.
+
+## Base URL
+
+<!-- Protocol, host, port, base path -->
+
+## Authentication
+
+<!-- How are requests authenticated? -->
+
+## Endpoints
+
+### [METHOD] /path
+
+**Description**: What this endpoint does.
+
+**Request Body**:
+
+\`\`\`typescript
+interface RequestBody {
+  field: string;
+}
+\`\`\`
+
+**Response**: \`200 OK\`
+
+\`\`\`typescript
+interface Response {
+  field: string;
+}
+\`\`\`
+
+## Related
+
+- [[architecture/overview]]
+`,$t=()=>`---
+title: "[Schema Name]"
+type: schema
+domain: # specify domain
+status: draft
+tags:
+  - domain/{area}
+  - status/draft
+  - type/schema
+---
+
+# [Schema Name]
+
+> [!context]
+> Brief description of what this schema defines.
+
+## Schema Definition
+
+\`\`\`
+# Schema definition here
+\`\`\`
+
+## Field Reference
+
+| Field | Type | Constraints | Description |
+|-------|------|-------------|-------------|
+| | | | |
+
+## Related
+
+- [[architecture/overview]]
+`,se={name:"knowledge",description:"Obsidian knowledge graph skeleton (docs/, templates, glossary, ADR)",dependsOn:["control"],generate:e=>[{path:"docs/_index.md",content:ht(e)},{path:"docs/glossary.md",content:gt(e)},{path:"docs/architecture/overview.md",content:ut(e)},{path:"docs/decisions/adr-001-metalayer.md",content:ft(e)},{path:"docs/runbooks/local-dev-setup.md",content:kt(e)},{path:"docs/_templates/adr.md",content:yt()},{path:"docs/_templates/architecture-note.md",content:bt()},{path:"docs/_templates/runbook.md",content:vt()},{path:"docs/_templates/api-contract.md",content:wt()},{path:"docs/_templates/schema-note.md",content:$t()}]};var A={control:te,harness:ae,knowledge:se,consciousness:ee,autoany:Z},I=e=>["control","harness","knowledge","consciousness","autoany"].filter(a=>e.includes(a)).map(a=>A[a]),f=Object.keys(A);import{mkdir as St,readFile as Rt,writeFile as oe}from"fs/promises";import{dirname as Ct,join as ne}from"path";import{log as Pt,spinner as At}from"@clack/prompts";var xt=async(e,t)=>{let a=[];for(let s of t){let o=ne(e,s.path);await St(Ct(o),{recursive:!0}),await oe(o,s.content,{mode:s.executable?493:420}),a.push(s.path)}return a},Et=async(e,t)=>{let a=ne(e,".symphony-forge.json"),s;try{let o=await Rt(a,"utf-8"),n=JSON.parse(o);s={...n,installedLayers:[...new Set([...n.installedLayers,...t.layers])],updatedAt:new Date().toISOString()}}catch{s={version:"1.0.0",installedLayers:t.layers,packageManager:t.packageManager,createdAt:new Date().toISOString(),updatedAt:new Date().toISOString()}}await oe(a,`${JSON.stringify(s,null,2)}
+`)},G=async(e,t)=>{let a=I(t.layers),s=[];for(let n of a){let r=n.generate(t);s.push(...r)}let o=await xt(e,s);for(let n of a)n.postInstall&&await n.postInstall(t,e);return await Et(e,t),o},re=async(e,t,a)=>{if(a){Pt.info("Skipping metalayer (--no-layers). Pure next-forge project.");return}let s=At();s.start("Scaffolding metalayer...");let o=t.layers.length>0?t.layers:f,n={...t,layers:o},r=await G(e,n);s.stop(`Metalayer scaffolded (${r.length} files across ${o.length} layers)`)};var jt=async e=>{let t=U(e,".symphony-forge.json");try{let o=await ie(t,"utf-8"),n=JSON.parse(o);return{packageManager:n.packageManager,installedLayers:n.installedLayers}}catch{}return{packageManager:(await _t(e))?.name??"npm",installedLayers:[]}},Lt=(e,t,a)=>{let s=I(t),o=[];for(let n of s){let r=n.generate(a);for(let c of r)Mt(U(e,c.path))&&o.push(c.path)}return o},Ft=async e=>{if(e==="all")return[...f];if(e&&e in A)return[e];e&&($.error(`Unknown layer: ${e}
+Available layers: ${f.join(", ")}, all`),process.exit(1));let t=await Nt({message:"Which layer would you like to add?",options:[{value:"all",label:"all \u2014 Install all layers"},...f.map(a=>({value:a,label:`${a} \u2014 ${A[a].description}`}))]});return le(t)&&(ce("Operation cancelled."),process.exit(0)),t==="all"?[...f]:[t]},pe=async e=>{try{Ot("Symphony Forge \u2014 Layer Manager");let t=process.cwd(),a=await Ft(e.name),s=await jt(t),o=U(t,"package.json"),n="my-project";try{let p=await ie(o,"utf-8");n=JSON.parse(p).name||n}catch{}let r={name:n,description:"",packageManager:s.packageManager,layers:[...new Set([...s.installedLayers,...a])]};if(!e.force){let p=Lt(t,a,r);if(p.length>0){$.warn(`The following files already exist:
+${p.map(R=>`  - ${R}`).join(`
+`)}`);let d=await It({message:"Overwrite existing files?",initialValue:!1});(le(d)||!d)&&(ce("Operation cancelled. Use --force to overwrite."),process.exit(0))}}let c=Tt();c.start(`Installing layer(s): ${a.join(", ")}...`);let m=await G(t,r);c.stop(`Installed ${m.length} files.`),$.info(`Layers installed: ${a.join(", ")}`),$.info("Files written:");for(let p of m)$.message(`  ${p}`);Dt("Layer installation complete.")}catch(t){let a=t instanceof Error?t.message:`Layer command failed: ${t}`;$.error(a),process.exit(1)}};import{copyFile as Gt,mkdir as ge,readFile as Ut,rm as ue}from"fs/promises";import{dirname as Wt,join as x}from"path";import{cancel as Bt,intro as Ht,isCancel as qt,log as Kt,outro as de,select as Vt,spinner as Jt}from"@clack/prompts";var Yt=(e,t)=>{let[a,s,o]=e.split(".").map(Number),[n,r,c]=t.split(".").map(Number);return a!==n?a-n:s!==r?s-r:o-c},zt=async e=>{let t=process.cwd(),a=x(t,e);await ue(a,{recursive:!0,force:!0}),await ge(a,{recursive:!0})},Xt=e=>{g("git",["clone",P,e])},me=e=>(g("git",["checkout",e]),g("git",["ls-files"],{stdio:"pipe"}).stdout.toString().trim().split(`
+`)),Qt=async e=>{let t=process.cwd(),a=x(t,v);for(let s of e){let o=x(a,s),n=x(t,s);await ge(Wt(n),{recursive:!0}),await Gt(o,n)}},Zt=async()=>await ue(v,{recursive:!0,force:!0}),ea=async()=>{let e=x(process.cwd(),"package.json"),t=await Ut(e,"utf-8");return JSON.parse(t).version},he=async(e,t,a)=>{let s=await Vt({message:`Select a version to update ${e}:`,options:t.map(o=>({value:o,label:`v${o}`})),initialValue:a,maxItems:10});return qt(s)&&(Bt("Operation cancelled."),process.exit(0)),s.toString()},ta=(e,t)=>{let a=[];for(let s of t.files){if(K.some(r=>s.startsWith(r)))continue;if(!e.files.includes(s)){a.push(s);continue}g("git",["diff",e.version,t.version,"--",q(s)],{stdio:"pipe",maxBuffer:1024*1024*1024}).stdout.toString().trim()!==""&&a.push(s)}return a},fe=async e=>{try{Ht("Let's update your next-forge project!");let t=process.cwd(),a=await V(),s=await ea();s&&!a.includes(s)&&(s=void 0);let o=e.from||await he("from",a,s);if(o===a[0]){de("You are already on the latest version!");return}let n=a.filter(ke=>Yt(ke,o)>0),[r]=n,c=e.to||await he("to",n,r),m=`v${o}`,p=`v${c}`,d=Jt();d.start(`Preparing to update from ${m} to ${p}...`),d.message("Creating temporary directory..."),await zt(v),d.message("Cloning next-forge..."),Xt(v),d.message("Moving into repository..."),process.chdir(v),d.message(`Getting files from version ${m}...`);let R=me(m);d.message(`Getting files from version ${p}...`);let O=me(p);d.message(`Computing diff between versions ${m} and ${p}...`);let W=ta({version:m,files:R},{version:p,files:O});d.message("Moving back to original directory..."),process.chdir(t),d.message(`Updating ${W.length} files...`),await Qt(W),d.message("Cleaning up..."),await Zt(),d.stop(`Successfully updated project from ${m} to ${p}!`),de("Please review and test the changes carefully.")}catch(t){let a=t instanceof Error?t.message:`${t}`;Kt.error(`Failed to update project: ${a}`),process.exit(1)}};S.name("symphony-forge").description("Scaffold next-forge projects with a composable control metalayer").version("0.1.0");S.command("init").description("Initialize a new next-forge project with metalayer").option("--name <name>","Name of the project").option("--package-manager <manager>","Package manager to use (bun, npm, yarn, pnpm)").option("--disable-git","Disable git initialization").option("--branch <branch>","Git branch to clone from").option("--no-layers","Skip metalayer scaffolding (pure next-forge)").option("--layers <layers>","Comma-separated list of layers to install (default: all)").action(async e=>{await Q(e);let t=process.cwd(),a=e.layers?e.layers.split(",").map(o=>o.trim()):f,s={name:e.name||t.split("/").pop()||"my-project",description:"",packageManager:e.packageManager||"bun",layers:a};await re(t,s,e.layers===!1)});S.command("layer [name]").description(`Add a layer to an existing project. Available: ${f.join(", ")}, all`).option("--force","Overwrite existing files without prompting").action(async(e,t)=>{await pe({name:e,force:t.force})});S.command("audit").description("Run entropy audit on the current project").action(async()=>{await H()});S.command("update").description("Update the project from one version to another").option("--from <version>","Version to update from e.g. 1.0.0").option("--to <version>","Version to update to e.g. 2.0.0").action(fe);S.parse(process.argv);