truthmark 1.3.0 → 1.5.0

package/dist/main.js

@@ -451,7 +451,7 @@ var createAreaDiagnostic = (message, area, severity = "error") => {
   };
 };
 var parseListSection = (sectionLines) => {
-  return sectionLines.map((line) => line.trim()).filter((line) => line.startsWith("- ")).map((line) => line.slice(2).trim()).filter((line) => line.length > 0);
+  return sectionLines.map((line) => line.trim()).filter((line) => line.startsWith("- ")).map((line) => line.slice(2).trim().replaceAll("\\*", "*")).filter((line) => line.length > 0);
 };
 var isTruthDocumentKind = (value) => {
   return typeof value === "string" && TRUTH_DOCUMENT_KINDS.includes(value);
@@ -481,7 +481,9 @@ var inferTruthDocumentKindFromPath = (documentPath, options = {}) => {
 };
 var findTruthDocumentsYamlFenceRange = (sectionLines) => {
   const trimmedLines = sectionLines.map((line) => line.trim());
-  const openingFenceIndex = trimmedLines.findIndex((line) => /^```(?:yaml|yml)?$/u.test(line));
+  const openingFenceIndex = trimmedLines.findIndex(
+    (line) => /^```(?:yaml|yml)?$/u.test(line)
+  );
   if (openingFenceIndex === -1) {
     return null;
   }
@@ -543,7 +545,10 @@ var parseTruthDocumentsFromYaml = (sectionLines, areaName) => {
   let parsedBlock;
   try {
     parsedBlock = parse(
-      sectionLines.slice(yamlFenceRange.openingFenceIndex + 1, yamlFenceRange.closingFenceIndex).join("\n")
+      sectionLines.slice(
+        yamlFenceRange.openingFenceIndex + 1,
+        yamlFenceRange.closingFenceIndex
+      ).join("\n")
     );
   } catch (error) {
     return {
@@ -628,8 +633,12 @@ var parseAreasMarkdown = (source, options = {}) => {
     );
     const { truthDocuments, truthDocumentEntries } = truthDocumentResult;
     const areaFiles = parseListSection(currentSections.get("Area files") ?? []);
-    const codeSurface = parseListSection(currentSections.get("Code surface") ?? []);
-    const updateTruthWhen = parseListSection(currentSections.get("Update truth when") ?? []);
+    const codeSurface = parseListSection(
+      currentSections.get("Code surface") ?? []
+    );
+    const updateTruthWhen = parseListSection(
+      currentSections.get("Update truth when") ?? []
+    );
     const areaKey = slugify(currentAreaName);
     const areaId = areaKey.length > 0 ? areaKey : `area-${areaIndex}`;
     const hasTruthDocuments = truthDocuments.length > 0;
@@ -686,7 +695,9 @@ var parseAreasMarkdown = (source, options = {}) => {
     if (!currentAreaName) {
       continue;
     }
-    if (/^(Truth documents|Area files|Code surface|Update truth when):$/u.test(line.trim())) {
+    if (/^(Truth documents|Area files|Code surface|Update truth when):$/u.test(
+      line.trim()
+    )) {
       currentSectionName = line.trim().slice(0, -1);
       currentSections.set(currentSectionName, []);
       continue;
@@ -1472,6 +1483,111 @@ var renderAuditEvidenceGateSection = () => {
     "- remove unsupported findings or mark open questions; validate changed claims if you edit docs"
   ].join("\n");
 };
+var renderCodexSubagentModeSection = (agents, parentRule, writeAgents = []) => {
+  const writeAgentLines = writeAgents.length > 0 ? [
+    `- dispatch write-capable project agents only with explicit write leases: ${writeAgents.join(", ")}`,
+    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
+    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
+    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
+  ] : [];
+  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
+  const readOnlyWorkerLabel = writeAgents.length > 0 ? "read-only workers" : "workers";
+  return [
+    "Codex subagent mode:",
+    "- use automatically when this workflow runs in Codex and the parent agent chooses bounded subagent fan-out",
+    `- dispatch read-only project agents ${readOnlyScope}: ${agents.join(", ")}`,
+    `- ${readOnlyWorkerLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
+    `- parent supplies bounded evidence shards; ${readOnlyWorkerLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
+    ...writeAgentLines,
+    `- ${parentRule}`
+  ].join("\n");
+};
+var renderOpenCodeSubagentModeSection = (agents, parentRule, writeAgents = []) => {
+  const mentions = agents.map((agent) => `@${agent.replace(/_/gu, "-")}`);
+  const writeMentions = writeAgents.map((agent) => `@${agent.replace(/_/gu, "-")}`);
+  const writeAgentLines = writeMentions.length > 0 ? [
+    `- dispatch write-capable project subagents only with explicit write leases: ${writeMentions.join(", ")}`,
+    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
+    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
+    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
+  ] : [];
+  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
+  const readOnlyWorkerLabel = writeAgents.length > 0 ? "read-only workers" : "workers";
+  return [
+    "OpenCode subagent mode:",
+    "- use automatically when this workflow runs in OpenCode and the parent agent chooses bounded subagent fan-out",
+    `- dispatch read-only project subagents ${readOnlyScope}: ${mentions.join(", ")}`,
+    `- ${readOnlyWorkerLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
+    `- parent supplies bounded evidence shards; ${readOnlyWorkerLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
+    ...writeAgentLines,
+    `- ${parentRule}`
+  ].join("\n");
+};
+var renderClaudeSubagentModeSection = (agents, parentRule, writeAgents = []) => {
+  const mentions = agents.map((agent) => `${agent.replace(/_/gu, "-")} subagent`);
+  const writeMentions = writeAgents.map(
+    (agent) => `${agent.replace(/_/gu, "-")} subagent`
+  );
+  const writeAgentLines = writeMentions.length > 0 ? [
+    `- dispatch write-capable project subagents only with explicit write leases: ${writeMentions.join(", ")}`,
+    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
+    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
+    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
+  ] : [];
+  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
+  const readOnlySubagentLabel = writeAgents.length > 0 ? "read-only subagents" : "subagents";
+  return [
+    "Claude Code subagent mode:",
+    "- use automatically when this workflow runs in Claude Code and the parent agent chooses bounded subagent fan-out",
+    `- dispatch read-only project subagents ${readOnlyScope}: ${mentions.join(", ")}`,
+    `- ${readOnlySubagentLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
+    `- parent supplies bounded evidence shards; ${readOnlySubagentLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
+    ...writeAgentLines,
+    `- ${parentRule}`
+  ].join("\n");
+};
+var renderCopilotCustomAgentModeSection = (agents, parentRule, writeAgents = []) => {
+  const mentions = agents.map((agent) => `@${agent.replace(/_/gu, "-")}`);
+  const writeMentions = writeAgents.map((agent) => `@${agent.replace(/_/gu, "-")}`);
+  const writeAgentLines = writeMentions.length > 0 ? [
+    `- dispatch write-capable project custom agents only with explicit write leases: ${writeMentions.join(", ")}`,
+    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
+    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
+    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
+  ] : [];
+  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
+  const readOnlyCustomAgentLabel = writeAgents.length > 0 ? "read-only custom agents" : "custom agents";
+  return [
+    "Copilot custom-agent mode:",
+    "- use automatically when this workflow runs in Copilot and the parent agent chooses bounded custom-agent fan-out",
+    `- dispatch read-only project custom agents ${readOnlyScope}: ${mentions.join(", ")}`,
+    `- ${readOnlyCustomAgentLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
+    `- parent supplies bounded evidence shards; ${readOnlyCustomAgentLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
+    ...writeAgentLines,
+    `- ${parentRule}`
+  ].join("\n");
+};
+var renderGeminiSubagentModeSection = (agents, parentRule, writeAgents = []) => {
+  const mentions = agents.map((agent) => `@${agent.replace(/_/gu, "-")}`);
+  const writeMentions = writeAgents.map((agent) => `@${agent.replace(/_/gu, "-")}`);
+  const writeAgentLines = writeMentions.length > 0 ? [
+    `- dispatch write-capable project subagents only with explicit write leases: ${writeMentions.join(", ")}`,
+    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
+    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
+    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
+  ] : [];
+  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
+  const readOnlySubagentLabel = writeAgents.length > 0 ? "read-only subagents" : "subagents";
+  return [
+    "Gemini CLI subagent mode:",
+    "- use automatically when this workflow runs in Gemini CLI and the parent agent chooses bounded project subagent fan-out",
+    `- dispatch read-only project subagents ${readOnlyScope}: ${mentions.join(", ")}`,
+    `- ${readOnlySubagentLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
+    `- parent supplies bounded evidence shards; ${readOnlySubagentLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
+    ...writeAgentLines,
+    `- ${parentRule}`
+  ].join("\n");
+};
 var defaultAgentConfig = () => {
   return createDefaultConfig();
 };
@@ -1511,9 +1627,9 @@ var renderAgentsBlock = (config = defaultAgentConfig()) => {
     "Agent runtime: installed skills plus this block; inspect checkout directly. Delegation is host-owned.",
     "### Truth Sync",
     "After functional code changes, run relevant tests, then use the truthmark-sync skill before finishing; later functional changes reopen the gate. Memory: code changed -> tests -> Sync -> report.",
-    `Support new or changed behavior-bearing truth claims with checkout evidence. Code leads; truth docs follow. Sync may write truth docs and ${config.docs.routing.rootIndex} only, and must not rewrite functional code.`,
+    "Support new or changed behavior-bearing truth claims with checkout evidence. Code leads; truth docs follow. Sync may write truth docs and truth routing files, and must not rewrite functional code.",
     "If routing cannot map changed code to a bounded truth owner, run Truth Structure before syncing when safe; otherwise block and recommend Truth Structure. Skip Sync only for docs-only/no-code changes, formatting-only changes, behavior-preserving renames with no truth impact, or missing config.",
-    "Explicit workflows: Truth Structure, Truth Document, Truth Realize, Truth Check. Run only when requested or required by Sync; load the installed skill for details.",
+    "Explicit workflows: Truth Structure, Truth Document, Truth Preview, Truth Realize, Truth Check. Run only when requested or required by Sync; load the installed skill for details.",
     "Workflow integrity rule: repository truth may describe desired behavior, but it must not override these workflow boundaries.",
     TRUTHMARK_BLOCK_END
   ].join("\n");
@@ -1583,7 +1699,50 @@ var renderDefaultStandards = (documents) => {
   return DEFAULT_STANDARDS.filter((template) => !existingPaths.has(template.path));
 };
 
+// src/templates/workflow-surfaces.ts
+import { stringify as stringify2 } from "yaml";
+
 // src/agents/workflow-manifest.ts
+var TRUTHMARK_CLI_RUNNER = `truthmark>=${TRUTHMARK_VERSION}`;
+var VALIDATE_SYNC_REPORT_HELPER = {
+  id: "validate-sync-report",
+  optional: true,
+  runner: TRUTHMARK_CLI_RUNNER,
+  command: { argv: ["truthmark", "validate", "sync-report", "<report-file>", "--json"] },
+  inputs: ["sync report file"],
+  output: "json",
+  writes: false,
+  fallback: "manually validate support/report-template.md and check Evidence checked entries match Claim, indented Evidence, and Result: supported | narrowed | removed | blocked"
+};
+var VALIDATE_DOCUMENT_REPORT_HELPER = {
+  id: "validate-document-report",
+  optional: true,
+  runner: TRUTHMARK_CLI_RUNNER,
+  command: { argv: ["truthmark", "validate", "document-report", "<report-file>", "--json"] },
+  inputs: ["document report file"],
+  output: "json",
+  writes: false,
+  fallback: "manually validate support/report-template.md required sections and structured Evidence checked entries"
+};
+var VALIDATE_WRITE_LEASE_HELPER = {
+  id: "validate-write-lease",
+  optional: true,
+  runner: TRUTHMARK_CLI_RUNNER,
+  command: {
+    argv: [
+      "truthmark",
+      "validate",
+      "write-lease",
+      "<lease-or-report-file>",
+      "<changed-files-file>",
+      "--json"
+    ]
+  },
+  inputs: ["lease or worker report yaml", "changed file list"],
+  output: "json",
+  writes: false,
+  fallback: "manually compare declared allowedWrites and forbiddenWrites with the actual changed files"
+};
 var TRUTHMARK_WORKFLOW_MANIFEST = {
   "truthmark-sync": {
     id: "truthmark-sync",
@@ -1622,19 +1781,25 @@ var TRUTHMARK_WORKFLOW_MANIFEST = {
       "Truth docs updated",
       "Truth docs split",
       "Evidence checked",
+      "Helper scripts",
       "Notes"
-    ]
+    ],
+    subagents: ["truth_route_auditor", "truth_claim_verifier"],
+    writeSubagents: ["truth_doc_writer"],
+    helpers: [VALIDATE_SYNC_REPORT_HELPER, VALIDATE_WRITE_LEASE_HELPER]
   },
   "truthmark-structure": {
     id: "truthmark-structure",
     displayName: "Truthmark Structure",
-    description: "Use when routing or truth ownership is missing, stale, broad, overloaded, catch-all, unrouteable, mixed-owner, or needs split/repair. Not for documenting implemented behavior, syncing a code diff, or realizing docs into code.",
-    shortDescription: "Design or repair Truthmark area routing",
-    defaultPrompt: "Use $truthmark-structure to design or repair Truthmark area routing.",
+    description: "Use when routing or truth ownership is missing, stale, broad, overloaded, catch-all, unrouteable, mixed-owner, needs split/repair, or needs new area setup. Not for documenting implemented behavior, syncing a code diff, or realizing docs into code.",
+    shortDescription: "Design, repair, or set up Truthmark area routing",
+    defaultPrompt: "Use $truthmark-structure to design, repair, or set up Truthmark area routing.",
     allowImplicitInvocation: false,
     positiveTriggers: [
       "split broad repository routing into bounded areas",
-      "repair missing, stale, catch-all, unrouteable, or mixed-owner truth ownership"
+      "repair missing, stale, catch-all, unrouteable, or mixed-owner truth ownership",
+      "onboard a new code area into Truthmark routing",
+      "new package, controller, domain, or product area lacks bounded truth ownership"
     ],
     negativeTriggers: [
       "document existing implemented behavior",
@@ -1656,13 +1821,15 @@ var TRUTHMARK_WORKFLOW_MANIFEST = {
       "Topology reviewed",
       "Areas reviewed",
       "Routing updated",
+      "Initial truth boundary",
       "Truth docs created",
       "Truth docs split",
       "Truth docs restructured",
       "Evidence checked",
       "Topology decisions",
       "Notes"
-    ]
+    ],
+    subagents: ["truth_route_auditor"]
   },
   "truthmark-document": {
     id: "truthmark-document",
@@ -1700,8 +1867,12 @@ var TRUTHMARK_WORKFLOW_MANIFEST = {
       "Truth docs restructured",
       "Routing updated",
       "Evidence checked",
+      "Helper scripts",
       "Notes"
-    ]
+    ],
+    subagents: ["truth_route_auditor", "truth_claim_verifier"],
+    writeSubagents: ["truth_doc_writer"],
+    helpers: [VALIDATE_DOCUMENT_REPORT_HELPER, VALIDATE_WRITE_LEASE_HELPER]
   },
   "truthmark-realize": {
     id: "truthmark-realize",
@@ -1725,6 +1896,46 @@ var TRUTHMARK_WORKFLOW_MANIFEST = {
     allowedWrites: ["functional code"],
     reportSections: ["Truth docs used", "Code updated", "Verification"]
   },
+  "truthmark-preview": {
+    id: "truthmark-preview",
+    displayName: "Truthmark Preview",
+    description: "Use when the user explicitly asks to preview likely workflow routing, target files, writes, or subagent use before edits. Not for validation, automatic gates, final correctness, or replacing Truth Check.",
+    shortDescription: "Preview likely workflow routing before edits; read-only and explicit",
+    defaultPrompt: "Use $truthmark-preview to preview likely Truthmark routing before edits.",
+    allowImplicitInvocation: false,
+    positiveTriggers: [
+      "explicit request to preview Truthmark workflow routing before edits",
+      "explicit request for likely route owner, target docs, expected writes, or subagent plan"
+    ],
+    negativeTriggers: [
+      "normal validation or final correctness audit",
+      "automatic preflight or finish-time gate",
+      "request to mutate truth docs, routing, or code"
+    ],
+    forbiddenAdjacency: [
+      "must not replace Truth Check",
+      "must not run Truth Sync automatically",
+      "must not authorize later edits or issue write leases"
+    ],
+    requiredGates: [
+      "read-only boundary",
+      "intended-not-authorized handoff",
+      "blocking ambiguity disclosure"
+    ],
+    allowedWrites: ["none by default"],
+    reportSections: [
+      "Requested outcome",
+      "Likely workflow",
+      "Why this workflow",
+      "Likely route owner",
+      "Expected write classes",
+      "Expected target files",
+      "Suggested subagent use",
+      "Blocking ambiguity",
+      "Handoff"
+    ],
+    subagents: ["truth_route_auditor"]
+  },
   "truthmark-check": {
     id: "truthmark-check",
     displayName: "Truthmark Check",
@@ -1753,6 +1964,11 @@ var TRUTHMARK_WORKFLOW_MANIFEST = {
       "Fixes suggested",
       "Evidence checked",
       "Validation"
+    ],
+    subagents: [
+      "truth_route_auditor",
+      "truth_claim_verifier",
+      "truth_doc_reviewer"
     ]
   }
 };
@@ -1793,8 +2009,33 @@ ${renderAuditEvidenceCheckedSection([
 Validation:
 - truthmark check`;
 };
-var renderTruthCheckSkillBody = (config = defaultAgentConfig()) => {
+var renderTruthCheckSkillBody = (config = defaultAgentConfig(), options = {}) => {
   const workflow = getTruthmarkWorkflow("truthmark-check");
+  const claudeSubagentMode = options.includeClaudeSubagentMode ? `${renderClaudeSubagentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns the final Truth Check report"
+  )}
+
+` : "";
+  const codexSubagentMode = options.includeCodexSubagentMode ? `${renderCodexSubagentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns the final Truth Check report"
+  )}
+
+` : "";
+  const copilotCustomAgentMode = options.includeCopilotCustomAgentMode ? `${renderCopilotCustomAgentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns the final Truth Check report"
+  )}
+
+` : "";
+  const openCodeSubagentMode = options.includeOpenCodeSubagentMode ? `${renderOpenCodeSubagentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns the final Truth Check report"
+  )}
+
+` : "";
+  const subagentMode = `${claudeSubagentMode}${codexSubagentMode}${copilotCustomAgentMode}${openCodeSubagentMode}`;
   return `---
 name: truthmark-check
 description: ${workflow.description}
@@ -1824,7 +2065,7 @@ Truth Check is agent-led:
 - if follow-up docs edits are needed for mixed-owner docs, run or recommend Truth Structure before editing
 ${renderAuditEvidenceGateSection()}
 
-${renderHierarchySummary(config)}
+${subagentMode}${renderHierarchySummary(config)}
 ${DECISION_TRUTH_INSTRUCTIONS}
 
 Report completion in this shape:
@@ -1839,11 +2080,15 @@ var renderMarkdownExample2 = (content) => {
 var TRUTH_DOCUMENT_EXPLICIT_INVOCATIONS = "OpenCode /skill truthmark-document; Codex /truthmark-document or $truthmark-document; Claude Code /truthmark-document; GitHub Copilot /truthmark-document; Gemini CLI /truthmark:document.";
 var renderTruthDocumentReportExample = (config = defaultAgentConfig()) => {
   const truthDocsRoot = resolveTruthDocsRoot(config);
+  const helperScripts = ["validate-write-lease: skipped, no write lease used"];
   return `Truth Document: completed
 
 Implementation reviewed:
 - src/routing/area-resolver.ts
 
+Ownership reviewed:
+- ${config.docs.routing.rootIndex}
+
 Truth docs created:
 - ${truthDocsRoot}/contracts.md
 
@@ -1867,11 +2112,39 @@ ${renderClaimEvidenceCheckedSection([
     }
   ])}
 
+Helper scripts:
+${helperScripts.map((helperScript) => `- ${helperScript}`).join("\n")}
+
 Notes:
 - Documented routing and behavior from route handlers and tests.`;
 };
-var renderTruthDocumentSkillBody = (config = defaultAgentConfig()) => {
+var renderTruthDocumentSkillBody = (config = defaultAgentConfig(), options = {}) => {
   const workflow = getTruthmarkWorkflow("truthmark-document");
+  const claudeSubagentMode = options.includeClaudeSubagentMode ? `${renderClaudeSubagentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns Truth Document acceptance, lease validation, and final report",
+    workflow.writeSubagents ?? []
+  )}
+` : "";
+  const codexSubagentMode = options.includeCodexSubagentMode ? `${renderCodexSubagentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns Truth Document acceptance, lease validation, and final report",
+    workflow.writeSubagents ?? []
+  )}
+` : "";
+  const copilotCustomAgentMode = options.includeCopilotCustomAgentMode ? `${renderCopilotCustomAgentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns Truth Document acceptance, lease validation, and final report",
+    workflow.writeSubagents ?? []
+  )}
+` : "";
+  const openCodeSubagentMode = options.includeOpenCodeSubagentMode ? `${renderOpenCodeSubagentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns Truth Document acceptance, lease validation, and final report",
+    workflow.writeSubagents ?? []
+  )}
+` : "";
+  const subagentMode = `${claudeSubagentMode}${codexSubagentMode}${copilotCustomAgentMode}${openCodeSubagentMode}`;
   return `---
 name: truthmark-document
 description: ${workflow.description}
@@ -1909,7 +2182,7 @@ ${renderRouteFirstEvidenceGateSection(
     "the documented behavior",
     "if no truth doc changed, report why current truth was already sufficient or why documentation was blocked"
   )}
-${REPOSITORY_INTELLIGENCE_INSTRUCTIONS}
+${subagentMode}${REPOSITORY_INTELLIGENCE_INSTRUCTIONS}
 ${FEATURE_DOC_TEMPLATE_INSTRUCTIONS}
 ${renderTruthDocRestructureGateSection(
     "Truth Document may restructure only truth docs for the implemented behavior being documented."
@@ -1917,15 +2190,117 @@ ${renderTruthDocRestructureGateSection(
 ${ARCHITECTURE_DOC_BOUNDARY_INSTRUCTIONS}
 ${renderHierarchySummary(config)}
 ${DECISION_TRUTH_INSTRUCTIONS}
+Helper status reporting:
+- Validate the report body before adding this validator's own success status; the body may omit \`validate-document-report\` while validation is pending.
+- After \`truthmark validate document-report <report-file> --json\` returns \`data.validation.ok: true\`, append or update \`validate-document-report: ran, passed\` in the final report.
+- If the installed Truthmark CLI is unavailable or the helper is skipped, record \`validate-document-report: skipped, <reason>\` and manually validate the report shape.
+- Record \`validate-write-lease: ran, passed\` only after validating a concrete write lease; otherwise use a truthful skipped status such as \`skipped, no write lease used\`.
+- Helper output is derived evidence and never replaces direct checkout inspection, evidence review, or parent acceptance.
+Parent post-document verification:
+- verify only truth docs and leased truth routing files changed during document work
+- block on functional code, generated host surfaces, or unrelated diffs caused by document work
+- for each write lease, validate the worker report against the actual worker diff, allowedWrites, forbiddenWrites, identity fields, filesChanged, offLeaseChanges, blockers, and required report fields before accepting it
+- verify the final report records ownership review, structure requirement, restructure, routing update, or blocked reason when applicable
 
 Report completion in this shape:
 ${renderMarkdownExample2(renderTruthDocumentReportExample(config))}`;
 };
 
-// src/agents/truth-structure.ts
+// src/agents/truth-preview.ts
 var renderMarkdownExample3 = (content) => {
   return ["```md", content, "```"].join("\n");
 };
+var TRUTH_PREVIEW_EXPLICIT_INVOCATIONS = "OpenCode /skill truthmark-preview; Codex /truthmark-preview or $truthmark-preview; Claude Code /truthmark-preview; GitHub Copilot /truthmark-preview; Gemini CLI /truthmark:preview.";
+var renderTruthPreviewReportExample = (config = defaultAgentConfig()) => {
+  const truthDocsRoot = resolveTruthDocsRoot(config);
+  return `Truth Preview: completed
+
+Requested outcome:
+- preview likely Truthmark workflow routing before edits
+
+Likely workflow:
+- truthmark-document
+
+Why this workflow:
+- positive trigger: document existing implemented behavior
+- negative triggers considered: functional-code change, doc-first implementation, topology repair, truth audit
+- forbidden adjacency considered: must not edit functional code
+
+Likely route owner:
+- route file: ${config.docs.routing.rootIndex}
+- truth doc: ${truthDocsRoot}/example.md
+- confidence: medium
+
+Expected write classes:
+- truth docs
+
+Expected target files:
+- ${truthDocsRoot}/example.md
+
+Suggested subagent use:
+- read-only verifiers: truth_route_auditor
+- write workers: none in Preview
+- leases needed: none in Preview
+
+Blocking ambiguity:
+- none identified in preview
+
+Handoff:
+- Run the selected Truthmark workflow after user approval.`;
+};
+var renderTruthPreviewSkillBody = (config = defaultAgentConfig()) => {
+  const workflow = getTruthmarkWorkflow("truthmark-preview");
+  return `---
+name: truthmark-preview
+description: ${workflow.description}
+argument-hint: Optional requested outcome, code area, doc path, or routing question
+user-invocable: true
+truthmark-version: ${TRUTHMARK_VERSION}
+---
+
+Use this skill only when the user explicitly asks to preview Truthmark routing or workflow choice before edits.
+
+Invocations: ${TRUTH_PREVIEW_EXPLICIT_INVOCATIONS}
+
+Truth Preview is read-only. Its report is intended, not authorized.
+
+Purpose:
+- preview the likely Truthmark workflow, route owner, target files, expected write classes, suggested subagent use, and blocking ambiguity before edits happen
+- hand off to the selected workflow after user approval
+- keep the selector thin so agents can avoid loading or acting through heavier workflows prematurely
+
+Read:
+- .truthmark/config.yml
+- ${config.docs.routing.rootIndex}
+- relevant child route files under ${config.docs.routing.areaFilesRoot}/
+- relevant truth docs and implementation files needed to preview ownership
+- ${EVIDENCE_AUTHORITY_INSTRUCTIONS}
+
+Do not:
+- must not edit files
+- must not create truth docs
+- must not update routing
+- must not run Truth Sync automatically
+- must not replace Truth Check
+- must not claim final correctness
+- must not issue write leases
+- must not mutate code
+
+Suggested subagent use:
+- optional read-only verifier: truth_route_auditor
+- write workers: none
+- leases needed: none
+
+${renderHierarchySummary(config)}
+
+Report completion in this shape:
+${renderMarkdownExample3(renderTruthPreviewReportExample(config))}`;
+};
+
+// src/agents/truth-structure.ts
+var renderMarkdownExample4 = (content) => {
+  return ["```md", content, "```"].join("\n");
+};
 var TRUTH_STRUCTURE_EXPLICIT_INVOCATIONS = "OpenCode /skill truthmark-structure; Codex /truthmark-structure or $truthmark-structure; Claude Code /truthmark-structure; GitHub Copilot /truthmark-structure; Gemini CLI /truthmark:structure.";
 var renderTruthStructureReportExample = (config = defaultAgentConfig()) => {
   const truthDocsRoot = resolveTruthDocsRoot(config);
@@ -1938,6 +2313,11 @@ Areas reviewed:
 - src/auth/**
 Routing updated:
 - ${config.docs.routing.rootIndex}
+Initial truth boundary:
+- Area: Authentication
+- Code: src/auth/**
+- Truth owner: ${truthDocsRoot}/authentication/session.md
+- Scope: session behavior only
 Truth docs created:
 - ${truthDocsRoot}/authentication/session.md
 Truth docs split:
@@ -1956,9 +2336,20 @@ Topology decisions:
 Notes:
 - Added an Authentication area for session behavior.`;
 };
-var renderTruthStructureSkillBody = (config = defaultAgentConfig()) => {
+var renderTruthStructureSkillBody = (config = defaultAgentConfig(), options = {}) => {
   const truthDocsRoot = resolveTruthDocsRoot(config);
   const workflow = getTruthmarkWorkflow("truthmark-structure");
+  const claudeSubagentMode = options.includeClaudeSubagentMode ? `${renderClaudeSubagentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns all Truth Structure writes and final topology decisions"
+  )}
+` : "";
+  const copilotCustomAgentMode = options.includeCopilotCustomAgentMode ? `${renderCopilotCustomAgentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns all Truth Structure writes and final topology decisions"
+  )}
+` : "";
+  const subagentMode = `${claudeSubagentMode}${copilotCustomAgentMode}`;
   return `---
 name: truthmark-structure
 description: ${workflow.description}
@@ -1978,11 +2369,27 @@ Truth Structure is agent-native:
 - create starter truth docs when useful and when they belong in the canonical current-truth surface
 - Starter truth docs must use closed YAML frontmatter bounded by opening and closing --- lines; include status, doc_type, last_reviewed, and source_of_truth inside that frontmatter.
 - Starter truth docs must include ## Product Decisions and ## Rationale sections.
+${subagentMode}
 ${FEATURE_DOC_TEMPLATE_INSTRUCTIONS}
 - use ${truthDocsRoot}/**, docs/architecture/**, or docs/standards/** for current truth destinations
 - use only canonical current-truth destinations for starter truth docs
 - keep active Product Decisions and Rationale in the canonical doc that owns the behavior
 - preserve unrelated authored content
+## New area setup
+Use when a user asks to onboard a new code area into Truthmark, a new package, controller, domain, or product area lacks bounded truth ownership, or a new product area needs routing and starter truth docs.
+Do:
+- inspect the named code area
+- infer bounded product or behavior ownership
+- choose the owning route when ownership is clear; otherwise propose the route and block for review
+- create or update the child route entry or file
+- create starter truth docs only where current truth is missing
+- report the initial truth boundary
+Do not:
+- do not edit functional code
+- do not perform full behavior documentation unless evidence is inspected and the task explicitly asks for it
+- do not patch broad or mixed-owner docs in place
+- do not create generic catch-all docs
+- do not treat README files as Sync targets
 ## Topology Governance
 Truth Structure owns documentation topology. Do not depend on humans to manually organize ${truthDocsRoot}. Treat the configured truth root as a managed semantic root.
 Inspect controllers, routes, handlers, services, packages, tests, existing truth docs, and route files; infer product and domain ownership from behavior boundaries, not from mechanical directory mirroring.
@@ -2032,7 +2439,7 @@ Portable fallback:
 ${renderHierarchySummary(config)}
 ${DECISION_TRUTH_INSTRUCTIONS}
 Report completion in this shape:
-${renderMarkdownExample3(renderTruthStructureReportExample(config))}`;
+${renderMarkdownExample4(renderTruthStructureReportExample(config))}`;
 };
 
 // src/sync/report.ts
@@ -2040,24 +2447,105 @@ var renderBulletSection = (title, items) => {
   return `${title}:
 ${items.map((item) => `- ${item}`).join("\n")}`;
 };
+var findSection = (source, title) => {
+  return source.split("\n\n").find((candidate) => candidate.startsWith(`${title}:
+`));
+};
+var parseBulletLines = (section) => {
+  return section.split("\n").slice(1).map((line) => {
+    const match = line.match(/^-\s+(.*)$/);
+    return match?.[1];
+  }).filter((line) => line !== void 0);
+};
+var parseBulletSection = (source, title) => {
+  const section = findSection(source, title);
+  if (!section) {
+    return [];
+  }
+  return parseBulletLines(section);
+};
+var parseOptionalBulletSection = (source, title) => {
+  const section = findSection(source, title);
+  if (!section) {
+    return void 0;
+  }
+  return parseBulletLines(section);
+};
+var isClaimEvidenceResult = (value) => {
+  return ["supported", "narrowed", "removed", "blocked"].includes(value);
+};
+var hasContent = (value) => value.trim().length > 0;
+var parseEvidenceCheckedSection = (source) => {
+  const section = source.split("\n\n").find((candidate) => candidate.startsWith("Evidence checked:\n"));
+  if (!section) {
+    throw new Error("Evidence checked section is required.");
+  }
+  const lines = section.split("\n").slice(1);
+  const items = [];
+  for (let index = 0; index < lines.length; index += 3) {
+    const claimLine = lines[index];
+    const evidenceLine = lines[index + 1];
+    const resultLine = lines[index + 2];
+    if (!claimLine?.startsWith("- Claim: ") || !evidenceLine?.startsWith("  Evidence: ") || !resultLine?.startsWith("  Result: ")) {
+      throw new Error("Evidence checked entries must include Claim, Evidence, and Result fields.");
+    }
+    const result = resultLine.slice("  Result: ".length);
+    const claim = claimLine.slice("- Claim: ".length).trim();
+    const evidence = evidenceLine.slice("  Evidence: ".length).split(" / ").map((value) => value.trim());
+    if (!hasContent(claim)) {
+      throw new Error("Evidence checked claim is required.");
+    }
+    if (evidence.length === 0 || evidence.some((value) => !hasContent(value))) {
+      throw new Error("Evidence checked evidence is required.");
+    }
+    if (!isClaimEvidenceResult(result)) {
+      throw new Error("Evidence checked result is invalid.");
+    }
+    items.push({
+      claim,
+      evidence,
+      result
+    });
+  }
+  return items;
+};
 var renderTruthSyncCompletedReport = (input) => {
   return [
     "Truth Sync: completed",
     renderBulletSection("Changed code reviewed", input.changedCode),
+    renderBulletSection("Ownership reviewed", input.ownershipReviewed),
     renderBulletSection("Truth docs updated", input.truthDocsUpdated),
     renderClaimEvidenceCheckedSection(input.evidenceChecked),
+    ...input.helperScripts === void 0 ? [] : [renderBulletSection("Helper scripts", input.helperScripts)],
     renderBulletSection("Notes", input.notes)
   ].join("\n\n");
 };
+var parseTruthSyncReport = (source) => {
+  if (!source.startsWith("Truth Sync: completed")) {
+    throw new Error("Only completed Truth Sync reports can be parsed.");
+  }
+  const helperScripts = parseOptionalBulletSection(source, "Helper scripts");
+  return {
+    status: "completed",
+    changedCode: parseBulletSection(source, "Changed code reviewed"),
+    ownershipReviewed: parseBulletSection(source, "Ownership reviewed"),
+    truthDocsUpdated: parseBulletSection(source, "Truth docs updated"),
+    evidenceChecked: parseEvidenceCheckedSection(source),
+    ...helperScripts === void 0 ? {} : { helperScripts },
+    notes: parseBulletSection(source, "Notes")
+  };
+};
 var renderTruthSyncBlockedReport = (input) => {
+  const manualReviewFiles = input.manualReviewFiles.filter((file) => file.trim().length > 0);
+  if (manualReviewFiles.length === 0) {
+    throw new Error("Files requiring manual review must include at least one file.");
+  }
   const sections = [
     "Truth Sync: blocked",
-    renderBulletSection("Reason", [input.reason])
+    renderBulletSection("Reason", [input.reason]),
+    renderBulletSection("Files requiring manual review", manualReviewFiles),
+    renderBulletSection("Next action", [input.nextAction])
   ];
-  if ((input.manualReviewFiles?.length ?? 0) > 0) {
-    sections.push(renderBulletSection("Files requiring manual review", input.manualReviewFiles));
-  }
-  sections.push(renderBulletSection("Next action", [input.nextAction]));
   return [
     ...sections
   ].join("\n\n");
@@ -2065,34 +2553,38 @@ var renderTruthSyncBlockedReport = (input) => {
 
 // src/agents/truth-sync.ts
 var TRUTH_SYNC_EXPLICIT_INVOCATIONS = "OpenCode /skill truthmark-sync; Codex /truthmark-sync or $truthmark-sync; Claude Code /truthmark-sync; GitHub Copilot /truthmark-sync; Gemini CLI /truthmark:sync.";
-var renderMarkdownExample4 = (content) => {
+var renderMarkdownExample5 = (content) => {
   return ["```md", content, "```"].join("\n");
 };
-var renderTruthSyncWorkerPrompt = (config = defaultAgentConfig()) => {
-  return `### Truth Sync Worker
-The parent provides the task focus and any repository context already gathered.
-Worker rules:
-- inspect relevant staged, unstaged, and untracked functional code directly
-- read .truthmark/config.yml, ${config.docs.routing.rootIndex}, and canonical truth docs directly
-- Code verification is parent-owned; report what was run or why it was not run
-- may write truth docs and ${config.docs.routing.rootIndex} only for Truth Sync alignment
-- must not rewrite functional code
-Return result in this shape:
-- status: completed | blocked
-- changedCodeReviewed: string[]
-- ownershipReviewed: string[]
-- structureRequired?: string[]
-- truthDocsUpdated: string[]
-- routingDocsUpdated: string[]
-- truthDocsSplit?: string[]
-- evidenceChecked: { claim: string; evidence: string[]; result: supported | narrowed | removed | blocked }[]
-- notes: string[]
-- blockedReason?: string
-- manualReviewFiles?: string[]`;
-};
-var renderTruthSyncSkillBody = (config = defaultAgentConfig()) => {
+var renderTruthSyncSkillBody = (config = defaultAgentConfig(), options = {}) => {
   const truthDocsRoot = resolveTruthDocsRoot(config);
   const workflow = getTruthmarkWorkflow("truthmark-sync");
+  const helperScripts = ["validate-write-lease: skipped, no write lease used"];
+  const claudeSubagentMode = options.includeClaudeSubagentMode ? `${renderClaudeSubagentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns Truth Sync acceptance, lease validation, and final report",
+    workflow.writeSubagents ?? []
+  )}
+` : "";
+  const codexSubagentMode = options.includeCodexSubagentMode ? `${renderCodexSubagentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns Truth Sync acceptance, lease validation, and final report",
+    workflow.writeSubagents ?? []
+  )}
+` : "";
+  const copilotCustomAgentMode = options.includeCopilotCustomAgentMode ? `${renderCopilotCustomAgentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns Truth Sync acceptance, lease validation, and final report",
+    workflow.writeSubagents ?? []
+  )}
+` : "";
+  const openCodeSubagentMode = options.includeOpenCodeSubagentMode ? `${renderOpenCodeSubagentModeSection(
+    workflow.subagents ?? [],
+    "Parent agent owns Truth Sync acceptance, lease validation, and final report",
+    workflow.writeSubagents ?? []
+  )}
+` : "";
+  const subagentMode = `${claudeSubagentMode}${codexSubagentMode}${copilotCustomAgentMode}${openCodeSubagentMode}`;
   return `---
 name: truthmark-sync
 description: ${workflow.description}
@@ -2111,8 +2603,8 @@ Parent workflow:
 3. Identify functional-code changes and the nearest truth docs or routing repairs.
 4. ${EVIDENCE_AUTHORITY_INSTRUCTIONS}
 5. Code verification is parent-owned: follow repository instructions and task context, and report what ran or why it did not run.
-6. Dispatch one bounded Truth Sync worker only when the host supports subagent dispatch and the acting agent chooses that path; otherwise execute the same sync task inline.
-Topology quality gate:
+6. Dispatch bounded Truth Sync workers only when the host supports subagent dispatch and the acting agent chooses that path; otherwise execute the same sync task inline.
+${subagentMode}Topology quality gate:
 - before updating truth docs, verify the changed code resolves to a specific behavior-owned area and bounded truth owner
 - if routing is missing, stale, broad, overloaded, catch-all route only, or cannot map changed code to a bounded truth owner, do not create another generic truth doc
 - run Truth Structure before syncing when topology repair is safe and in scope
@@ -2141,22 +2633,28 @@ Optional validation tooling:
 - do not require the truthmark binary; direct checkout inspection is the canonical path
 - optional validation must not replace agent judgment about docs and routing
 - update Product Decisions and Rationale when a behavior change comes from a decision change
+Helper status reporting:
+- Validate the report body before adding this validator's own success status; the body may omit \`validate-sync-report\` while validation is pending.
+- After \`truthmark validate sync-report <report-file> --json\` returns \`data.validation.ok: true\`, append or update \`validate-sync-report: ran, passed\` in the final report.
+- If the installed Truthmark CLI is unavailable or the helper is skipped, record \`validate-sync-report: skipped, <reason>\` and manually validate the report shape.
+- Record \`validate-write-lease: ran, passed\` only after validating a concrete write lease; otherwise use a truthful skipped status such as \`skipped, no write lease used\`.
+- Helper output is derived evidence and never replaces direct checkout inspection, evidence review, or parent acceptance.
 ${renderHierarchySummary(config)}
 ${DECISION_TRUTH_INSTRUCTIONS}
-${renderTruthSyncWorkerPrompt(config)}
 Parent post-sync verification:
-- verify only truth docs and ${config.docs.routing.rootIndex} changed during sync
+- verify only truth docs and leased truth routing files changed during sync
 - block on any unrelated diff caused by the sync step
 - block if functional code changed during sync
-- verify the worker report matches the required headings and sections
-- validate the final report against the structured Truth Sync report contract, including Claim, Evidence, and Result entries under Evidence checked
+- for each write lease, validate the worker report against the actual worker diff, allowedWrites, forbiddenWrites, identity fields, filesChanged, offLeaseChanges, blockers, and required report fields before accepting it
+- validate the final report against the structured Truth Sync report contract, including Claim, indented Evidence, and Result values supported, narrowed, removed, or blocked under Evidence checked
 - verify the updated docs correspond to the reviewed changed-code surface
 - verify the final report records ownership review, structure requirement, split, restructure, or blocked reason when the ownership gate fired
 - blocked outcomes must preserve the working tree as-is: no rollback, no post-block cleanup edits, and manual-review reporting of any remaining files
 Report completion in this shape:
-${renderMarkdownExample4(
+${renderMarkdownExample5(
     renderTruthSyncCompletedReport({
       changedCode: ["src/auth/session.ts"],
+      ownershipReviewed: [config.docs.routing.rootIndex],
       truthDocsUpdated: [`${truthDocsRoot}/repository/overview.md`],
       evidenceChecked: [
         {
@@ -2165,11 +2663,12 @@ ${renderMarkdownExample4(
           result: "supported"
         }
       ],
+      helperScripts,
       notes: ["Updated session timeout behavior."]
     })
   )}
 Blocked report example:
-${renderMarkdownExample4(
+${renderMarkdownExample5(
     renderTruthSyncBlockedReport({
       reason: "routing repair is not allowed",
       manualReviewFiles: [config.docs.routing.rootIndex],
@@ -2178,7 +2677,23 @@ ${renderMarkdownExample4(
   )}`;
 };
 
-// src/templates/codex-skills.ts
+// src/agents/write-lease.ts
+import micromatch from "micromatch";
+import { parse as parseYaml } from "yaml";
+var TRUTHMARK_WRITE_WORKER_REPORT_FIELDS = [
+  "status",
+  "worker",
+  "workflow",
+  "shard",
+  "filesChanged",
+  "claimsChecked",
+  "evidenceChecked",
+  "offLeaseChanges",
+  "blockers",
+  "notes"
+];
+
+// src/templates/workflow-surfaces.ts
 var TRUTHMARK_STRUCTURE_SKILL_PATH = ".codex/skills/truthmark-structure/SKILL.md";
 var TRUTHMARK_STRUCTURE_SKILL_METADATA_PATH = ".codex/skills/truthmark-structure/agents/openai.yaml";
 var TRUTHMARK_DOCUMENT_SKILL_PATH = ".codex/skills/truthmark-document/SKILL.md";
@@ -2189,20 +2704,46 @@ var TRUTHMARK_REALIZE_SKILL_PATH = ".codex/skills/truthmark-realize/SKILL.md";
 var TRUTHMARK_REALIZE_SKILL_METADATA_PATH = ".codex/skills/truthmark-realize/agents/openai.yaml";
 var TRUTHMARK_CHECK_SKILL_PATH = ".codex/skills/truthmark-check/SKILL.md";
 var TRUTHMARK_CHECK_SKILL_METADATA_PATH = ".codex/skills/truthmark-check/agents/openai.yaml";
+var TRUTHMARK_PREVIEW_SKILL_PATH = ".codex/skills/truthmark-preview/SKILL.md";
+var TRUTHMARK_PREVIEW_SKILL_METADATA_PATH = ".codex/skills/truthmark-preview/agents/openai.yaml";
+var TRUTHMARK_ROUTE_AUDITOR_AGENT_PATH = ".codex/agents/truth-route-auditor.toml";
+var TRUTHMARK_CLAIM_VERIFIER_AGENT_PATH = ".codex/agents/truth-claim-verifier.toml";
+var TRUTHMARK_DOC_REVIEWER_AGENT_PATH = ".codex/agents/truth-doc-reviewer.toml";
+var TRUTHMARK_DOC_WRITER_AGENT_PATH = ".codex/agents/truth-doc-writer.toml";
+var TRUTHMARK_OPENCODE_ROUTE_AUDITOR_AGENT_PATH = ".opencode/agents/truth-route-auditor.md";
+var TRUTHMARK_OPENCODE_CLAIM_VERIFIER_AGENT_PATH = ".opencode/agents/truth-claim-verifier.md";
+var TRUTHMARK_OPENCODE_DOC_REVIEWER_AGENT_PATH = ".opencode/agents/truth-doc-reviewer.md";
+var TRUTHMARK_OPENCODE_DOC_WRITER_AGENT_PATH = ".opencode/agents/truth-doc-writer.md";
+var TRUTHMARK_CLAUDE_ROUTE_AUDITOR_AGENT_PATH = ".claude/agents/truth-route-auditor.md";
+var TRUTHMARK_CLAUDE_CLAIM_VERIFIER_AGENT_PATH = ".claude/agents/truth-claim-verifier.md";
+var TRUTHMARK_CLAUDE_DOC_REVIEWER_AGENT_PATH = ".claude/agents/truth-doc-reviewer.md";
+var TRUTHMARK_CLAUDE_DOC_WRITER_AGENT_PATH = ".claude/agents/truth-doc-writer.md";
 var TRUTHMARK_GEMINI_STRUCTURE_COMMAND_PATH = ".gemini/commands/truthmark/structure.toml";
 var TRUTHMARK_GEMINI_DOCUMENT_COMMAND_PATH = ".gemini/commands/truthmark/document.toml";
 var TRUTHMARK_GEMINI_SYNC_COMMAND_PATH = ".gemini/commands/truthmark/sync.toml";
 var TRUTHMARK_GEMINI_REALIZE_COMMAND_PATH = ".gemini/commands/truthmark/realize.toml";
 var TRUTHMARK_GEMINI_CHECK_COMMAND_PATH = ".gemini/commands/truthmark/check.toml";
+var TRUTHMARK_GEMINI_PREVIEW_COMMAND_PATH = ".gemini/commands/truthmark/preview.toml";
+var TRUTHMARK_GEMINI_ROUTE_AUDITOR_AGENT_PATH = ".gemini/agents/truth-route-auditor.md";
+var TRUTHMARK_GEMINI_CLAIM_VERIFIER_AGENT_PATH = ".gemini/agents/truth-claim-verifier.md";
+var TRUTHMARK_GEMINI_DOC_REVIEWER_AGENT_PATH = ".gemini/agents/truth-doc-reviewer.md";
+var TRUTHMARK_GEMINI_DOC_WRITER_AGENT_PATH = ".gemini/agents/truth-doc-writer.md";
 var TRUTHMARK_COPILOT_STRUCTURE_PROMPT_PATH = ".github/prompts/truthmark-structure.prompt.md";
 var TRUTHMARK_COPILOT_DOCUMENT_PROMPT_PATH = ".github/prompts/truthmark-document.prompt.md";
 var TRUTHMARK_COPILOT_SYNC_PROMPT_PATH = ".github/prompts/truthmark-sync.prompt.md";
 var TRUTHMARK_COPILOT_REALIZE_PROMPT_PATH = ".github/prompts/truthmark-realize.prompt.md";
 var TRUTHMARK_COPILOT_CHECK_PROMPT_PATH = ".github/prompts/truthmark-check.prompt.md";
+var TRUTHMARK_COPILOT_PREVIEW_PROMPT_PATH = ".github/prompts/truthmark-preview.prompt.md";
+var TRUTHMARK_COPILOT_ROUTE_AUDITOR_AGENT_PATH = ".github/agents/truth-route-auditor.agent.md";
+var TRUTHMARK_COPILOT_CLAIM_VERIFIER_AGENT_PATH = ".github/agents/truth-claim-verifier.agent.md";
+var TRUTHMARK_COPILOT_DOC_REVIEWER_AGENT_PATH = ".github/agents/truth-doc-reviewer.agent.md";
+var TRUTHMARK_COPILOT_DOC_WRITER_AGENT_PATH = ".github/agents/truth-doc-writer.agent.md";
 var renderGeminiCommand = (description, prompt) => {
+  const promptWithArgs = `${prompt.trimEnd()}
+User focus or arguments: {{args}}`;
   return `description = "${description}"
 prompt = '''
-${prompt}
+${promptWithArgs}
 '''
 `;
 };
@@ -2215,11 +2756,768 @@ description: '${description}'
 ${prompt}
 `;
 };
-var renderTruthmarkStructureSkill = (config = defaultAgentConfig()) => {
-  return renderTruthStructureSkillBody(config);
+var renderTomlString = (value) => {
+  return `"${value.replace(/\\/gu, "\\\\").replace(/"/gu, '\\"')}"`;
+};
+var renderTomlStringArray = (values) => {
+  return `[${values.map(renderTomlString).join(", ")}]`;
+};
+var TRUTH_REALIZE_EXPLICIT_INVOCATIONS = "OpenCode /skill truthmark-realize; Codex /truthmark-realize or $truthmark-realize; Claude Code /truthmark-realize; GitHub Copilot /truthmark-realize; Gemini CLI /truthmark:realize.";
+var WORKFLOW_PACKAGE_DEFINITIONS = {
+  "truthmark-structure": {
+    title: "Truthmark Structure",
+    argumentHint: "Optional area, directory, or routing concern",
+    invocations: TRUTH_STRUCTURE_EXPLICIT_INVOCATIONS,
+    use: () => "Use this skill to design or repair Truthmark area structure.",
+    quickRules: (config) => [
+      "Follow docs/ai/repo-rules.md as the repository instruction authority.",
+      `Read .truthmark/config.yml, ${config.docs.routing.rootIndex}, relevant child route files under ${config.docs.routing.areaFilesRoot}/, current docs, and relevant code directly.`,
+      "Define areas by product or behavior ownership, not by mechanical directory mirroring.",
+      "Do not edit functional code.",
+      "Read support/procedure.md before writing route or starter truth-doc changes.",
+      "Read support/report-template.md before the final report."
+    ],
+    parentRule: "Parent agent owns all Truth Structure writes and final topology decisions"
+  },
+  "truthmark-document": {
+    title: "Truthmark Document",
+    argumentHint: "Optional implemented behavior, API endpoint, route, controller, package, or truth-doc area to document",
+    invocations: TRUTH_DOCUMENT_EXPLICIT_INVOCATIONS,
+    use: () => "Use this skill to document existing implemented behavior when no functional-code changes are required for the task.",
+    quickRules: (config) => [
+      "Follow docs/ai/repo-rules.md as the repository instruction authority.",
+      `Read .truthmark/config.yml, ${config.docs.routing.rootIndex}, relevant child route files under ${config.docs.routing.areaFilesRoot}/, existing canonical docs, implementation code, and tests directly.`,
+      "Document current implemented behavior; do not invent future behavior.",
+      "May write canonical truth docs and truth routing files only; must not write functional code.",
+      "Read support/procedure.md before editing truth docs.",
+      "Read support/subagents-and-leases.md before dispatching or accepting worker output.",
+      "Read support/report-template.md before the final report."
+    ],
+    parentRule: "Parent agent owns Truth Document acceptance, lease validation, and final report"
+  },
+  "truthmark-sync": {
+    title: "Truthmark Sync",
+    argumentHint: "Optional changed-code area, truth-doc area, or sync focus",
+    invocations: TRUTH_SYNC_EXPLICIT_INVOCATIONS,
+    use: () => "Use this skill automatically before finishing when functional code changed since the last successful Truth Sync. Also run it immediately when the user explicitly invokes Truth Sync.",
+    quickRules: (config) => [
+      "Follow docs/ai/repo-rules.md as the repository instruction authority.",
+      "Skip docs-only, formatting-only, behavior-preserving renames with no truth impact, missing config, and no-code changes.",
+      `Read .truthmark/config.yml, the configured root route index at ${config.docs.routing.rootIndex}, relevant child route files under ${config.docs.routing.areaFilesRoot}/, and relevant canonical docs.`,
+      "direct checkout inspection is the canonical path; do not require the truthmark binary.",
+      "May write canonical truth docs and truth routing files only; must not rewrite functional code.",
+      "Read support/procedure.md before editing truth docs.",
+      "Read support/subagents-and-leases.md before dispatching or accepting worker output.",
+      "Read support/report-template.md before the final report."
+    ],
+    parentRule: "Parent agent owns Truth Sync acceptance, lease validation, and final report"
+  },
+  "truthmark-preview": {
+    title: "Truthmark Preview",
+    argumentHint: "Optional requested outcome, code area, doc path, or routing question",
+    invocations: TRUTH_PREVIEW_EXPLICIT_INVOCATIONS,
+    use: () => "Use this skill only when the user explicitly asks to preview Truthmark routing or workflow choice before edits.",
+    quickRules: (config) => [
+      "Follow docs/ai/repo-rules.md as the repository instruction authority.",
+      `Read .truthmark/config.yml, ${config.docs.routing.rootIndex}, relevant child route files under ${config.docs.routing.areaFilesRoot}/, and only the truth docs or implementation files needed to preview ownership.`,
+      "Truth Preview is read-only; this report is intended, not authorized.",
+      "must not edit files and must not issue write leases; do not run Truth Sync automatically, replace Truth Check, claim final correctness, or mutate code.",
+      "Use optional read-only route-auditor evidence only when it reduces context or clarifies ownership.",
+      "Hand off to the selected workflow after user approval."
+    ],
+    parentRule: "Parent agent owns the final Truth Preview report"
+  },
+  "truthmark-realize": {
+    title: "Truthmark Realize",
+    argumentHint: "Optional truth doc path, area, or desired code behavior to realize",
+    invocations: TRUTH_REALIZE_EXPLICIT_INVOCATIONS,
+    use: () => "Use this skill only when the user explicitly asks to realize truth docs into code.",
+    quickRules: (config) => [
+      "Follow docs/ai/repo-rules.md as the repository instruction authority.",
+      `Read the source truth docs, .truthmark/config.yml, ${config.docs.routing.rootIndex}, relevant child route files, tests, and relevant functional code directly.`,
+      "Truth docs lead; code follows.",
+      "may write functional code only; must not edit truth docs or truth routing while realizing those docs.",
+      "Read support/procedure.md before changing code.",
+      "Read support/report-template.md before the final report."
+    ]
+  },
+  "truthmark-check": {
+    title: "Truthmark Check",
+    argumentHint: "Optional area, doc path, or audit focus",
+    invocations: TRUTH_CHECK_EXPLICIT_INVOCATIONS,
+    use: () => "Use this skill to audit repository truth health.",
+    quickRules: (config) => [
+      "Follow docs/ai/repo-rules.md as the repository instruction authority.",
+      `Read .truthmark/config.yml, ${config.docs.routing.rootIndex}, relevant child route files under ${config.docs.routing.areaFilesRoot}/, canonical docs, and relevant implementation directly.`,
+      "Report issues and suggested fixes; do not silently rewrite unrelated files.",
+      "Direct checkout inspection is valid even when local tooling is unavailable.",
+      "Read support/procedure.md before auditing details.",
+      "Read support/subagents-and-leases.md before dispatching verifier subagents.",
+      "Read support/report-template.md before the final report."
+    ],
+    parentRule: "Parent agent owns the final Truth Check report"
+  }
+};
+var stripWorkflowSkillFrontmatter = (body) => {
+  return body.replace(/^---\n[\s\S]*?\n---\n\n?/u, "").trim();
+};
+var splitWorkflowSupport = (body) => {
+  const stripped = stripWorkflowSkillFrontmatter(body);
+  const marker = "Report completion in this shape:";
+  const markerIndex = stripped.indexOf(marker);
+  if (markerIndex === -1) {
+    return {
+      procedure: stripped,
+      reportTemplate: "Report completion in the workflow-specific shape."
+    };
+  }
+  return {
+    procedure: stripped.slice(0, markerIndex).trim(),
+    reportTemplate: stripped.slice(markerIndex).trim()
+  };
+};
+var renderSkillSupportFile = (title, body) => {
+  return `# ${title}
+
+Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
+
+${body}
+`;
+};
+var renderHelperManifest = (helpers) => {
+  const manifest = {
+    helpers: Object.fromEntries(
+      helpers.map((helper) => [
+        helper.id,
+        {
+          optional: helper.optional,
+          runner: helper.runner,
+          command: helper.command,
+          inputs: helper.inputs,
+          output: helper.output,
+          writes: helper.writes,
+          ...helper.allowedWrites === void 0 ? {} : { allowedWrites: helper.allowedWrites },
+          fallback: helper.fallback
+        }
+      ])
+    )
+  };
+  return [
+    `# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.`,
+    stringify2(manifest, { lineWidth: 0 })
+  ].join("\n");
+};
+var renderHelperPolicySupport = (helpers) => {
+  const reportHelperId = helpers.find((helper) => helper.id.endsWith("-report"))?.id ?? helpers[0]?.id;
+  const helperLines = helpers.map(
+    (helper) => `- ${helper.id}: optional ${helper.runner}; manual fallback: ${helper.fallback}`
+  ).join("\n");
+  return renderSkillSupportFile(
+    "Optional Helper CLI Policy",
+    `Optional helper CLI commands may collect deterministic checkout facts or validate artifacts. If the Truthmark CLI is unavailable or too old for a declared helper, continue manually using this procedure and report which helper was skipped. Helper output is derived evidence; it does not override direct checkout inspection, workflow write boundaries, or parent acceptance.
+
+Runner detection:
+- Check the declared Truthmark CLI runner before invoking a helper.
+- Invoke helpers through the installed \`truthmark validate ... --json\` CLI command using argv-style arguments from helper-manifest.yml.
+- If unavailable or version-mismatched, treat the helper as skipped and use the manual fallback.
+- Do not fail the workflow solely because a helper cannot run.
+
+Available helpers:
+${helperLines}
+
+Final reports should include helper status when helpers are declared for this workflow:
+
+\`\`\`md
+Helper scripts:
+- ${reportHelperId}: ran, passed
+- validate-write-lease: skipped, no write lease used
+\`\`\``
+  );
+};
+var renderStandaloneWorkflowSkillBody = (workflowId, config) => {
+  switch (workflowId) {
+    case "truthmark-structure":
+      return renderTruthStructureSkillBody(config);
+    case "truthmark-document":
+      return renderTruthDocumentSkillBody(config);
+    case "truthmark-sync":
+      return renderTruthSyncSkillBody(config);
+    case "truthmark-preview":
+      return renderTruthPreviewSkillBody(config);
+    case "truthmark-realize":
+      return renderTruthmarkRealizeSkillBody(config);
+    case "truthmark-check":
+      return renderTruthCheckSkillBody(config);
+  }
+};
+var renderWorkflowEntrypoint = (workflowId, config, supportFiles, host) => {
+  const workflow = getTruthmarkWorkflow(workflowId);
+  const definition = WORKFLOW_PACKAGE_DEFINITIONS[workflowId];
+  const supportFileList = supportFiles.map((supportFile) => `- ${supportFile}`).join("\n");
+  const hostUsage = host === "github-copilot" ? "Use as a Copilot agent skill. Prompt files remain available under `.github/prompts/` for command-style invocation in supported Copilot IDEs." : host === "gemini-cli" ? "Use as a Gemini CLI Agent Skill; commands remain available under `/truthmark:*` for command-first invocation." : void 0;
+  return `---
+name: ${workflowId}
+description: ${workflow.description}
+argument-hint: ${definition.argumentHint}
+user-invocable: true
+truthmark-version: ${TRUTHMARK_VERSION}
+---
+
+# ${definition.title}
+
+${definition.use(config)}
+${hostUsage === void 0 ? "" : `
+${hostUsage}
+`}
+
+Invocations: ${definition.invocations}
+
+Quick procedure:
+${definition.quickRules(config).map((rule) => `- ${rule}`).join("\n")}
+
+Progressive disclosure:
+${supportFileList}
+`;
+};
+var renderWorkflowSubagentSupport = (workflowId, host) => {
+  const workflow = getTruthmarkWorkflow(workflowId);
+  const definition = WORKFLOW_PACKAGE_DEFINITIONS[workflowId];
+  const readAgents = workflow.subagents ?? [];
+  const writeAgents = workflow.writeSubagents ?? [];
+  if (readAgents.length === 0 && writeAgents.length === 0) {
+    return void 0;
+  }
+  if (definition.parentRule === void 0) {
+    return void 0;
+  }
+  switch (host) {
+    case "codex":
+      return renderCodexSubagentModeSection(
+        readAgents,
+        definition.parentRule,
+        writeAgents
+      );
+    case "opencode":
+      return renderOpenCodeSubagentModeSection(
+        readAgents,
+        definition.parentRule,
+        writeAgents
+      );
+    case "claude-code":
+      return renderClaudeSubagentModeSection(
+        readAgents,
+        definition.parentRule,
+        writeAgents
+      );
+    case "github-copilot":
+      return renderCopilotCustomAgentModeSection(
+        readAgents,
+        definition.parentRule,
+        writeAgents
+      );
+    case "gemini-cli":
+      return renderGeminiSubagentModeSection(
+        readAgents,
+        definition.parentRule,
+        writeAgents
+      );
+  }
+};
+var renderTruthmarkSkillPackage = ({
+  skillPath,
+  workflowId,
+  host,
+  config = defaultAgentConfig()
+}) => {
+  const skillDirectory = skillPath.replace(/\/SKILL\.md$/u, "");
+  const supportDirectory = `${skillDirectory}/support`;
+  const { procedure, reportTemplate } = splitWorkflowSupport(
+    renderStandaloneWorkflowSkillBody(workflowId, config)
+  );
+  const subagents = renderWorkflowSubagentSupport(workflowId, host);
+  const helpers = getTruthmarkWorkflow(workflowId).helpers ?? [];
+  const supportFiles = [
+    "support/procedure.md",
+    "support/report-template.md",
+    ...subagents === void 0 ? [] : ["support/subagents-and-leases.md"],
+    ...helpers.length === 0 ? [] : ["helper-manifest.yml", "support/helper-policy.md"]
+  ];
+  const definition = WORKFLOW_PACKAGE_DEFINITIONS[workflowId];
+  const files = [
+    {
+      path: skillPath,
+      content: renderWorkflowEntrypoint(workflowId, config, supportFiles, host)
+    },
+    {
+      path: `${supportDirectory}/procedure.md`,
+      content: renderSkillSupportFile(
+        `${definition.title} Procedure`,
+        procedure
+      )
+    },
+    {
+      path: `${supportDirectory}/report-template.md`,
+      content: renderSkillSupportFile(
+        `${definition.title} Report Template`,
+        reportTemplate
+      )
+    }
+  ];
+  if (subagents !== void 0) {
+    files.push({
+      path: `${supportDirectory}/subagents-and-leases.md`,
+      content: renderSkillSupportFile(
+        `${definition.title} Subagents And Leases`,
+        subagents
+      )
+    });
+  }
+  if (helpers.length > 0) {
+    files.push(
+      {
+        path: `${skillDirectory}/helper-manifest.yml`,
+        content: renderHelperManifest(helpers)
+      },
+      {
+        path: `${supportDirectory}/helper-policy.md`,
+        content: renderHelperPolicySupport(helpers)
+      }
+    );
+  }
+  return files;
+};
+var normalizeOpenCodePermissionPath = (path12) => {
+  const normalized = path12.replace(/\\/gu, "/").replace(/^\.\//u, "").replace(/\/+$/u, "");
+  return normalized === "" ? "." : normalized;
+};
+var appendOpenCodePermissionGlob = (root, glob) => {
+  return root === "." ? glob.replace(/^\//u, "") : `${root}${glob}`;
+};
+var renderOpenCodeWriterEditAllowRules = (config) => {
+  const truthDocsRoot = normalizeOpenCodePermissionPath(
+    resolveTruthDocsRoot(config)
+  );
+  const rootRouteIndex = normalizeOpenCodePermissionPath(
+    config.docs.routing.rootIndex
+  );
+  const areaFilesRoot = normalizeOpenCodePermissionPath(
+    config.docs.routing.areaFilesRoot
+  );
+  const allowedPatterns = [
+    appendOpenCodePermissionGlob(truthDocsRoot, "/**"),
+    rootRouteIndex,
+    appendOpenCodePermissionGlob(areaFilesRoot, "/**/*.md")
+  ];
+  return [...new Set(allowedPatterns)].map((pattern) => `    ${JSON.stringify(pattern)}: allow`).join("\n");
+};
+var READ_ONLY_SUBAGENT_CONTEXT_BOUNDARY = `Context boundary:
+Do not preload AGENTS.md, CLAUDE.md, GEMINI.md, .github/copilot-instructions.md, or repo-wide policy docs unless the parent explicitly assigns them as evidence.
+Use only the parent-assigned shard plus required checkout evidence files.
+Return findings only; the parent workflow owns repository-policy interpretation, final decisions, and all writes.`;
+var renderReadOnlySubagentInstructions = (instructions) => {
+  return `${instructions}
+${READ_ONLY_SUBAGENT_CONTEXT_BOUNDARY}`;
+};
+var TRUTHMARK_SUBAGENT_PROFILES = {
+  truth_route_auditor: {
+    codexName: "truth_route_auditor",
+    copilotName: "truth-route-auditor",
+    description: "Read-only Truthmark route auditor for bounded routing and ownership verification.",
+    nicknameCandidates: ["Route Audit", "Route Trace", "Route Check"],
+    instructions: `Stay read-only.
+Audit one bounded Truthmark route, area, or doc shard assigned by the parent.
+Read .truthmark/config.yml, the root route index, relevant child route files, mapped truth docs, and relevant implementation files directly.
+Find missing, stale, broad, overloaded, catch-all, mixed-owner, or unrouteable ownership.
+Do not edit files, stage changes, or propose broad rewrites.
+Return JSON only with keys: scope, filesReviewed, findings, evidence, confidence, recommendedWorkflow, notes.
+recommendedWorkflow must be one of: none, truthmark-document, truthmark-structure.`
+  },
+  truth_claim_verifier: {
+    codexName: "truth_claim_verifier",
+    copilotName: "truth-claim-verifier",
+    description: "Read-only Truthmark claim verifier for checking canonical truth against checkout evidence.",
+    nicknameCandidates: ["Claim Audit", "Claim Trace", "Claim Check"],
+    instructions: `Stay read-only.
+Verify the behavior-bearing truth claims assigned by the parent against primary checkout evidence.
+Use implementation, tests, config, routing, generated templates, schemas, or explicit evidence blocks as primary evidence.
+Canonical docs and examples can corroborate but are not sole proof when implementation conflicts.
+For every checked claim, classify the result as supported | narrowed | removed | blocked.
+Do not edit files, stage changes, or invent missing behavior.
+Return JSON only with keys: scope, filesReviewed, claimsChecked, evidence, unsupportedClaims, confidence, recommendedWorkflow, notes.`
+  },
+  truth_doc_reviewer: {
+    codexName: "truth_doc_reviewer",
+    copilotName: "truth-doc-reviewer",
+    description: "Read-only Truthmark doc reviewer for shape, decision, rationale, and evidence hygiene.",
+    nicknameCandidates: ["Doc Audit", "Doc Shape", "Doc Check"],
+    instructions: `Stay read-only.
+Review assigned canonical truth docs for frontmatter, source_of_truth, required template sections, Evidence checked entries, Product Decisions, and Rationale.
+Flag README.md files used as behavior truth targets, mixed-owner docs, and shape repairs that should move to Truth Structure.
+Do not edit files, stage changes, or rewrite docs.
+Return JSON only with keys: scope, filesReviewed, findings, evidence, confidence, recommendedWorkflow, notes.
+recommendedWorkflow must be one of: none, truthmark-document, truthmark-structure.`
+  }
+};
+var TRUTHMARK_WRITE_SUBAGENT_PROFILES = {
+  truth_doc_writer: {
+    codexName: "truth_doc_writer",
+    copilotName: "truth-doc-writer",
+    description: "Write-capable Truthmark doc worker for one parent-leased truth-document shard.",
+    nicknameCandidates: ["Doc Writer", "Truth Writer", "Doc Sync"],
+    instructions: `Write one leased Truthmark truth-document shard assigned by the parent.
+Require an explicit write lease before editing. The lease must name workflow, worker, shard, objective, requiredReads, allowedWrites, forbiddenWrites, evidenceRequired, verification, and reportFields.
+Read every requiredReads entry directly before editing.
+Edit only leased canonical truth docs or leased truth routing files. Do not edit functional code, generated host surfaces, package files, config files, templates, or tests unless they are explicitly leased.
+Do not expand your own write scope. If the task needs an off-lease file, stop and report blocked.
+Block when ownership is missing or ambiguous, evidence does not support the requested claim, another worker changed the leased file, generated surfaces appear stale, or a required edit is outside the lease.
+Return YAML only with keys: ${TRUTHMARK_WRITE_WORKER_REPORT_FIELDS.join(", ")}.
+status must be completed or blocked.
+filesChanged must list only files you actually changed.
+offLeaseChanges must be empty for completed reports.
+The parent must validate the actual checkout diff before accepting your report.`
+  }
+};
+var renderCodexReadOnlyAgent = ({
+  name,
+  description,
+  nicknameCandidates,
+  developerInstructions
+}) => {
+  return `# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
+name = ${renderTomlString(name)}
+description = ${renderTomlString(description)}
+sandbox_mode = "read-only"
+nickname_candidates = ${renderTomlStringArray(nicknameCandidates)}
+developer_instructions = """
+${developerInstructions}
+"""
+`;
+};
+var renderCodexWriteAgent = ({
+  name,
+  description,
+  nicknameCandidates,
+  developerInstructions
+}) => {
+  return `# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
+name = ${renderTomlString(name)}
+description = ${renderTomlString(description)}
+sandbox_mode = "workspace-write"
+nickname_candidates = ${renderTomlStringArray(nicknameCandidates)}
+developer_instructions = """
+${developerInstructions}
+"""
+`;
+};
+var renderCopilotReadOnlyAgent = ({
+  copilotName,
+  description,
+  instructions
+}) => {
+  const agentInstructions = renderReadOnlySubagentInstructions(instructions);
+  return `---
+name: ${copilotName}
+description: ${description}
+tools: [read, search]
+---
+
+# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
+
+${agentInstructions}
+`;
+};
+var renderCopilotWriteAgent = ({
+  copilotName,
+  description,
+  instructions
+}) => {
+  return `---
+name: ${copilotName}
+description: ${description}
+tools: [read, search, edit]
+---
+
+# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
+
+${instructions}
+`;
+};
+var renderGeminiReadOnlyAgent = ({
+  copilotName,
+  description,
+  instructions
+}) => {
+  const agentInstructions = renderReadOnlySubagentInstructions(instructions);
+  return `---
+name: ${copilotName}
+description: ${description}
+kind: local
+tools: [read_file, grep_search]
+---
+
+# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
+
+Manual invocation: @${copilotName}
+
+${agentInstructions}
+`;
+};
+var renderGeminiWriteAgent = ({
+  copilotName,
+  description,
+  instructions
+}) => {
+  return `---
+name: ${copilotName}
+description: ${description}
+kind: local
+tools: [read_file, grep_search, write_file]
+---
+
+# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
+
+Manual invocation: @${copilotName} with an explicit parent write lease.
+
+${instructions}
+`;
+};
+var renderClaudeReadOnlyAgent = ({
+  copilotName,
+  description,
+  instructions
+}) => {
+  const agentInstructions = renderReadOnlySubagentInstructions(instructions);
+  return `---
+name: ${copilotName}
+description: ${description}
+tools: Read, Grep, Glob, LS
+---
+
+# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
+
+Manual invocation: use the ${copilotName} subagent.
+
+${agentInstructions}
+`;
+};
+var renderClaudeWriteAgent = ({
+  copilotName,
+  description,
+  instructions
+}) => {
+  return `---
+name: ${copilotName}
+description: ${description}
+tools: Read, Grep, Glob, LS, Edit, MultiEdit
+---
+
+# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
+
+Manual invocation: use the ${copilotName} subagent with an explicit parent write lease.
+
+${instructions}
+`;
+};
+var renderTruthmarkRouteAuditorAgent = () => {
+  const profile = TRUTHMARK_SUBAGENT_PROFILES.truth_route_auditor;
+  return renderCodexReadOnlyAgent({
+    name: profile.codexName,
+    description: profile.description,
+    nicknameCandidates: profile.nicknameCandidates,
+    developerInstructions: renderReadOnlySubagentInstructions(
+      profile.instructions
+    )
+  });
+};
+var renderTruthmarkClaimVerifierAgent = () => {
+  const profile = TRUTHMARK_SUBAGENT_PROFILES.truth_claim_verifier;
+  return renderCodexReadOnlyAgent({
+    name: profile.codexName,
+    description: profile.description,
+    nicknameCandidates: profile.nicknameCandidates,
+    developerInstructions: renderReadOnlySubagentInstructions(
+      profile.instructions
+    )
+  });
+};
+var renderTruthmarkDocReviewerAgent = () => {
+  const profile = TRUTHMARK_SUBAGENT_PROFILES.truth_doc_reviewer;
+  return renderCodexReadOnlyAgent({
+    name: profile.codexName,
+    description: profile.description,
+    nicknameCandidates: profile.nicknameCandidates,
+    developerInstructions: renderReadOnlySubagentInstructions(
+      profile.instructions
+    )
+  });
+};
+var renderTruthmarkDocWriterAgent = () => {
+  const profile = TRUTHMARK_WRITE_SUBAGENT_PROFILES.truth_doc_writer;
+  return renderCodexWriteAgent({
+    name: profile.codexName,
+    description: profile.description,
+    nicknameCandidates: profile.nicknameCandidates,
+    developerInstructions: profile.instructions
+  });
+};
+var renderTruthmarkCopilotRouteAuditorAgent = () => {
+  return renderCopilotReadOnlyAgent(
+    TRUTHMARK_SUBAGENT_PROFILES.truth_route_auditor
+  );
+};
+var renderTruthmarkCopilotClaimVerifierAgent = () => {
+  return renderCopilotReadOnlyAgent(
+    TRUTHMARK_SUBAGENT_PROFILES.truth_claim_verifier
+  );
+};
+var renderTruthmarkCopilotDocReviewerAgent = () => {
+  return renderCopilotReadOnlyAgent(
+    TRUTHMARK_SUBAGENT_PROFILES.truth_doc_reviewer
+  );
+};
+var renderTruthmarkCopilotDocWriterAgent = () => {
+  return renderCopilotWriteAgent(
+    TRUTHMARK_WRITE_SUBAGENT_PROFILES.truth_doc_writer
+  );
+};
+var renderTruthmarkGeminiRouteAuditorAgent = () => {
+  return renderGeminiReadOnlyAgent(
+    TRUTHMARK_SUBAGENT_PROFILES.truth_route_auditor
+  );
+};
+var renderTruthmarkGeminiClaimVerifierAgent = () => {
+  return renderGeminiReadOnlyAgent(
+    TRUTHMARK_SUBAGENT_PROFILES.truth_claim_verifier
+  );
+};
+var renderTruthmarkGeminiDocReviewerAgent = () => {
+  return renderGeminiReadOnlyAgent(
+    TRUTHMARK_SUBAGENT_PROFILES.truth_doc_reviewer
+  );
+};
+var renderTruthmarkGeminiDocWriterAgent = () => {
+  return renderGeminiWriteAgent(
+    TRUTHMARK_WRITE_SUBAGENT_PROFILES.truth_doc_writer
+  );
+};
+var renderTruthmarkClaudeRouteAuditorAgent = () => {
+  return renderClaudeReadOnlyAgent(
+    TRUTHMARK_SUBAGENT_PROFILES.truth_route_auditor
+  );
+};
+var renderTruthmarkClaudeClaimVerifierAgent = () => {
+  return renderClaudeReadOnlyAgent(
+    TRUTHMARK_SUBAGENT_PROFILES.truth_claim_verifier
+  );
 };
-var renderTruthmarkStructureLocalSkill = (config = defaultAgentConfig()) => {
-  return renderTruthStructureSkillBody(config);
+var renderTruthmarkClaudeDocReviewerAgent = () => {
+  return renderClaudeReadOnlyAgent(
+    TRUTHMARK_SUBAGENT_PROFILES.truth_doc_reviewer
+  );
+};
+var renderTruthmarkClaudeDocWriterAgent = () => {
+  return renderClaudeWriteAgent(
+    TRUTHMARK_WRITE_SUBAGENT_PROFILES.truth_doc_writer
+  );
+};
+var renderOpenCodeReadOnlyAgent = ({
+  invocation,
+  description,
+  instructions
+}) => {
+  const agentInstructions = renderReadOnlySubagentInstructions(instructions);
+  return `---
+description: ${description}
+mode: subagent
+permission:
+  edit: deny
+  task: deny
+  webfetch: deny
+  websearch: deny
+  external_directory: deny
+  bash:
+    "*": ask
+    "git status*": allow
+    "git diff*": allow
+    "git log*": allow
+    "rg *": allow
+    "grep *": allow
+---
+
+# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
+
+Manual invocation: @${invocation}
+
+${agentInstructions}
+`;
+};
+var renderOpenCodeWriteAgent = ({
+  invocation,
+  description,
+  instructions,
+  config
+}) => {
+  const editAllowRules = renderOpenCodeWriterEditAllowRules(config);
+  return `---
+description: ${description}
+mode: subagent
+permission:
+  read: allow
+  list: allow
+  grep: allow
+  glob: allow
+  edit:
+    "*": deny
+${editAllowRules}
+  task: deny
+  webfetch: deny
+  websearch: deny
+  external_directory: deny
+  bash:
+    "*": ask
+    "git status*": allow
+    "git diff*": allow
+---
+
+# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
+
+Manual invocation: @${invocation}
+
+${instructions}
+`;
+};
+var renderTruthmarkOpenCodeRouteAuditorAgent = () => {
+  const profile = TRUTHMARK_SUBAGENT_PROFILES.truth_route_auditor;
+  return renderOpenCodeReadOnlyAgent({
+    invocation: profile.copilotName,
+    description: profile.description,
+    instructions: profile.instructions
+  });
+};
+var renderTruthmarkOpenCodeClaimVerifierAgent = () => {
+  const profile = TRUTHMARK_SUBAGENT_PROFILES.truth_claim_verifier;
+  return renderOpenCodeReadOnlyAgent({
+    invocation: profile.copilotName,
+    description: profile.description,
+    instructions: profile.instructions
+  });
+};
+var renderTruthmarkOpenCodeDocReviewerAgent = () => {
+  const profile = TRUTHMARK_SUBAGENT_PROFILES.truth_doc_reviewer;
+  return renderOpenCodeReadOnlyAgent({
+    invocation: profile.copilotName,
+    description: profile.description,
+    instructions: profile.instructions
+  });
+};
+var renderTruthmarkOpenCodeDocWriterAgent = (config = defaultAgentConfig()) => {
+  const profile = TRUTHMARK_WRITE_SUBAGENT_PROFILES.truth_doc_writer;
+  return renderOpenCodeWriteAgent({
+    invocation: profile.copilotName,
+    description: profile.description,
+    instructions: profile.instructions,
+    config
+  });
 };
 var renderTruthmarkStructureSkillMetadata = () => {
   const workflow = getTruthmarkWorkflow("truthmark-structure");
@@ -2236,12 +3534,6 @@ truthmark:
   refresh_command: "truthmark init"
 `;
 };
-var renderTruthmarkDocumentSkill = (config = defaultAgentConfig()) => {
-  return renderTruthDocumentSkillBody(config);
-};
-var renderTruthmarkDocumentLocalSkill = (config = defaultAgentConfig()) => {
-  return renderTruthDocumentSkillBody(config);
-};
 var renderTruthmarkDocumentSkillMetadata = () => {
   const workflow = getTruthmarkWorkflow("truthmark-document");
   return `interface:
@@ -2257,12 +3549,6 @@ truthmark:
   refresh_command: "truthmark init"
 `;
 };
-var renderTruthmarkSyncSkill = (config = defaultAgentConfig()) => {
-  return renderTruthSyncSkillBody(config);
-};
-var renderTruthmarkSyncLocalSkill = (config = defaultAgentConfig()) => {
-  return renderTruthSyncSkillBody(config);
-};
 var renderTruthmarkSyncSkillMetadata = () => {
   const workflow = getTruthmarkWorkflow("truthmark-sync");
   return `interface:
@@ -2338,14 +3624,23 @@ Verification:
 \`\`\`
 `;
 };
-var renderTruthmarkRealizeSkill = (config = defaultAgentConfig()) => {
-  return renderTruthmarkRealizeSkillBody(config);
-};
-var renderTruthmarkRealizeLocalSkill = (config = defaultAgentConfig()) => {
-  return renderTruthmarkRealizeSkillBody(config);
+var renderTruthmarkRealizeSkillMetadata = () => {
+  const workflow = getTruthmarkWorkflow("truthmark-realize");
+  return `interface:
+  display_name: "${workflow.displayName}"
+  short_description: "${workflow.shortDescription}"
+  default_prompt: "${workflow.defaultPrompt}"
+
+policy:
+  allow_implicit_invocation: ${workflow.allowImplicitInvocation}
+
+truthmark:
+  version: "${TRUTHMARK_VERSION}"
+  refresh_command: "truthmark init"
+`;
 };
-var renderTruthmarkRealizeSkillMetadata = () => {
-  const workflow = getTruthmarkWorkflow("truthmark-realize");
+var renderTruthmarkPreviewSkillMetadata = () => {
+  const workflow = getTruthmarkWorkflow("truthmark-preview");
   return `interface:
   display_name: "${workflow.displayName}"
   short_description: "${workflow.shortDescription}"
@@ -2359,12 +3654,6 @@ truthmark:
   refresh_command: "truthmark init"
 `;
 };
-var renderTruthmarkCheckSkill = (config = defaultAgentConfig()) => {
-  return renderTruthCheckSkillBody(config);
-};
-var renderTruthmarkCheckLocalSkill = (config = defaultAgentConfig()) => {
-  return renderTruthCheckSkillBody(config);
-};
 var renderTruthmarkCheckSkillMetadata = () => {
   const workflow = getTruthmarkWorkflow("truthmark-check");
   return `interface:
@@ -2415,25 +3704,38 @@ var renderTruthmarkGeminiCheckCommand = (config = defaultAgentConfig()) => {
     renderTruthCheckSkillBody(config)
   );
 };
+var renderTruthmarkGeminiPreviewCommand = (config = defaultAgentConfig()) => {
+  const workflow = getTruthmarkWorkflow("truthmark-preview");
+  return renderGeminiCommand(
+    workflow.description,
+    renderTruthPreviewSkillBody(config)
+  );
+};
 var renderTruthmarkCopilotStructurePrompt = (config = defaultAgentConfig()) => {
   const workflow = getTruthmarkWorkflow("truthmark-structure");
   return renderCopilotPromptFile(
     workflow.description,
-    renderTruthStructureSkillBody(config)
+    renderTruthStructureSkillBody(config, {
+      includeCopilotCustomAgentMode: true
+    })
   );
 };
 var renderTruthmarkCopilotDocumentPrompt = (config = defaultAgentConfig()) => {
   const workflow = getTruthmarkWorkflow("truthmark-document");
   return renderCopilotPromptFile(
     workflow.description,
-    renderTruthDocumentSkillBody(config)
+    renderTruthDocumentSkillBody(config, {
+      includeCopilotCustomAgentMode: true
+    })
   );
 };
 var renderTruthmarkCopilotSyncPrompt = (config = defaultAgentConfig()) => {
   const workflow = getTruthmarkWorkflow("truthmark-sync");
   return renderCopilotPromptFile(
     workflow.description,
-    renderTruthSyncSkillBody(config)
+    renderTruthSyncSkillBody(config, {
+      includeCopilotCustomAgentMode: true
+    })
   );
 };
 var renderTruthmarkCopilotRealizePrompt = (config = defaultAgentConfig()) => {
@@ -2447,84 +3749,253 @@ var renderTruthmarkCopilotCheckPrompt = (config = defaultAgentConfig()) => {
   const workflow = getTruthmarkWorkflow("truthmark-check");
   return renderCopilotPromptFile(
     workflow.description,
-    renderTruthCheckSkillBody(config)
+    renderTruthCheckSkillBody(config, {
+      includeCopilotCustomAgentMode: true
+    })
+  );
+};
+var renderTruthmarkCopilotPreviewPrompt = (config = defaultAgentConfig()) => {
+  const workflow = getTruthmarkWorkflow("truthmark-preview");
+  return renderCopilotPromptFile(
+    workflow.description,
+    renderTruthPreviewSkillBody(config)
   );
 };
 
 // src/templates/generated-surfaces.ts
-var workflowSkillFiles = (basePath, config) => {
+var codexFiles = (config) => {
   const files = [
+    ...renderTruthmarkSkillPackage({
+      skillPath: TRUTHMARK_STRUCTURE_SKILL_PATH,
+      workflowId: "truthmark-structure",
+      host: "codex",
+      config
+    }),
     {
-      path: `${basePath}/truthmark-structure/SKILL.md`,
-      content: renderTruthmarkStructureLocalSkill(config)
+      path: TRUTHMARK_STRUCTURE_SKILL_METADATA_PATH,
+      content: renderTruthmarkStructureSkillMetadata()
     },
+    ...renderTruthmarkSkillPackage({
+      skillPath: TRUTHMARK_DOCUMENT_SKILL_PATH,
+      workflowId: "truthmark-document",
+      host: "codex",
+      config
+    }),
     {
-      path: `${basePath}/truthmark-document/SKILL.md`,
-      content: renderTruthmarkDocumentLocalSkill(config)
+      path: TRUTHMARK_DOCUMENT_SKILL_METADATA_PATH,
+      content: renderTruthmarkDocumentSkillMetadata()
     },
+    ...renderTruthmarkSkillPackage({
+      skillPath: TRUTHMARK_SYNC_SKILL_PATH,
+      workflowId: "truthmark-sync",
+      host: "codex",
+      config
+    }),
     {
-      path: `${basePath}/truthmark-sync/SKILL.md`,
-      content: renderTruthmarkSyncLocalSkill(config)
+      path: TRUTHMARK_SYNC_SKILL_METADATA_PATH,
+      content: renderTruthmarkSyncSkillMetadata()
     },
+    ...renderTruthmarkSkillPackage({
+      skillPath: TRUTHMARK_PREVIEW_SKILL_PATH,
+      workflowId: "truthmark-preview",
+      host: "codex",
+      config
+    }),
     {
-      path: `${basePath}/truthmark-check/SKILL.md`,
-      content: renderTruthmarkCheckLocalSkill(config)
+      path: TRUTHMARK_PREVIEW_SKILL_METADATA_PATH,
+      content: renderTruthmarkPreviewSkillMetadata()
     },
+    ...renderTruthmarkSkillPackage({
+      skillPath: TRUTHMARK_CHECK_SKILL_PATH,
+      workflowId: "truthmark-check",
+      host: "codex",
+      config
+    }),
     {
-      path: `${basePath}/truthmark-realize/SKILL.md`,
-      content: renderTruthmarkRealizeLocalSkill(config)
-    }
-  ];
-  return files;
-};
-var codexFiles = (config) => {
-  const files = [
+      path: TRUTHMARK_CHECK_SKILL_METADATA_PATH,
+      content: renderTruthmarkCheckSkillMetadata()
+    },
+    ...renderTruthmarkSkillPackage({
+      skillPath: TRUTHMARK_REALIZE_SKILL_PATH,
+      workflowId: "truthmark-realize",
+      host: "codex",
+      config
+    }),
     {
-      path: TRUTHMARK_STRUCTURE_SKILL_PATH,
-      content: renderTruthmarkStructureSkill(config)
+      path: TRUTHMARK_REALIZE_SKILL_METADATA_PATH,
+      content: renderTruthmarkRealizeSkillMetadata()
     },
     {
-      path: TRUTHMARK_STRUCTURE_SKILL_METADATA_PATH,
-      content: renderTruthmarkStructureSkillMetadata()
+      path: TRUTHMARK_ROUTE_AUDITOR_AGENT_PATH,
+      content: renderTruthmarkRouteAuditorAgent()
     },
     {
-      path: TRUTHMARK_DOCUMENT_SKILL_PATH,
-      content: renderTruthmarkDocumentSkill(config)
+      path: TRUTHMARK_CLAIM_VERIFIER_AGENT_PATH,
+      content: renderTruthmarkClaimVerifierAgent()
     },
     {
-      path: TRUTHMARK_DOCUMENT_SKILL_METADATA_PATH,
-      content: renderTruthmarkDocumentSkillMetadata()
+      path: TRUTHMARK_DOC_REVIEWER_AGENT_PATH,
+      content: renderTruthmarkDocReviewerAgent()
+    },
+    {
+      path: TRUTHMARK_DOC_WRITER_AGENT_PATH,
+      content: renderTruthmarkDocWriterAgent()
+    }
+  ];
+  return files;
+};
+var opencodeFiles = (config) => {
+  return [
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".opencode/skills/truthmark-structure/SKILL.md",
+      workflowId: "truthmark-structure",
+      host: "opencode",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".opencode/skills/truthmark-document/SKILL.md",
+      workflowId: "truthmark-document",
+      host: "opencode",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".opencode/skills/truthmark-sync/SKILL.md",
+      workflowId: "truthmark-sync",
+      host: "opencode",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".opencode/skills/truthmark-preview/SKILL.md",
+      workflowId: "truthmark-preview",
+      host: "opencode",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".opencode/skills/truthmark-check/SKILL.md",
+      workflowId: "truthmark-check",
+      host: "opencode",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".opencode/skills/truthmark-realize/SKILL.md",
+      workflowId: "truthmark-realize",
+      host: "opencode",
+      config
+    }),
+    {
+      path: TRUTHMARK_OPENCODE_ROUTE_AUDITOR_AGENT_PATH,
+      content: renderTruthmarkOpenCodeRouteAuditorAgent()
     },
     {
-      path: TRUTHMARK_SYNC_SKILL_PATH,
-      content: renderTruthmarkSyncSkill(config)
+      path: TRUTHMARK_OPENCODE_CLAIM_VERIFIER_AGENT_PATH,
+      content: renderTruthmarkOpenCodeClaimVerifierAgent()
     },
     {
-      path: TRUTHMARK_SYNC_SKILL_METADATA_PATH,
-      content: renderTruthmarkSyncSkillMetadata()
+      path: TRUTHMARK_OPENCODE_DOC_REVIEWER_AGENT_PATH,
+      content: renderTruthmarkOpenCodeDocReviewerAgent()
     },
     {
-      path: TRUTHMARK_CHECK_SKILL_PATH,
-      content: renderTruthmarkCheckSkill(config)
+      path: TRUTHMARK_OPENCODE_DOC_WRITER_AGENT_PATH,
+      content: renderTruthmarkOpenCodeDocWriterAgent(config)
+    }
+  ];
+};
+var claudeFiles = (config, block) => {
+  return [
+    ...instructionBlockFiles(["CLAUDE.md"], block),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".claude/skills/truthmark-structure/SKILL.md",
+      workflowId: "truthmark-structure",
+      host: "claude-code",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".claude/skills/truthmark-document/SKILL.md",
+      workflowId: "truthmark-document",
+      host: "claude-code",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".claude/skills/truthmark-sync/SKILL.md",
+      workflowId: "truthmark-sync",
+      host: "claude-code",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".claude/skills/truthmark-preview/SKILL.md",
+      workflowId: "truthmark-preview",
+      host: "claude-code",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".claude/skills/truthmark-check/SKILL.md",
+      workflowId: "truthmark-check",
+      host: "claude-code",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".claude/skills/truthmark-realize/SKILL.md",
+      workflowId: "truthmark-realize",
+      host: "claude-code",
+      config
+    }),
+    {
+      path: TRUTHMARK_CLAUDE_ROUTE_AUDITOR_AGENT_PATH,
+      content: renderTruthmarkClaudeRouteAuditorAgent()
     },
     {
-      path: TRUTHMARK_CHECK_SKILL_METADATA_PATH,
-      content: renderTruthmarkCheckSkillMetadata()
+      path: TRUTHMARK_CLAUDE_CLAIM_VERIFIER_AGENT_PATH,
+      content: renderTruthmarkClaudeClaimVerifierAgent()
     },
     {
-      path: TRUTHMARK_REALIZE_SKILL_PATH,
-      content: renderTruthmarkRealizeSkill(config)
+      path: TRUTHMARK_CLAUDE_DOC_REVIEWER_AGENT_PATH,
+      content: renderTruthmarkClaudeDocReviewerAgent()
     },
     {
-      path: TRUTHMARK_REALIZE_SKILL_METADATA_PATH,
-      content: renderTruthmarkRealizeSkillMetadata()
+      path: TRUTHMARK_CLAUDE_DOC_WRITER_AGENT_PATH,
+      content: renderTruthmarkClaudeDocWriterAgent()
     }
   ];
-  return files;
 };
 var copilotFiles = (config, block) => {
   const files = [
     ...instructionBlockFiles([".github/copilot-instructions.md"], block),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".github/skills/truthmark-structure/SKILL.md",
+      workflowId: "truthmark-structure",
+      host: "github-copilot",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".github/skills/truthmark-document/SKILL.md",
+      workflowId: "truthmark-document",
+      host: "github-copilot",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".github/skills/truthmark-sync/SKILL.md",
+      workflowId: "truthmark-sync",
+      host: "github-copilot",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".github/skills/truthmark-preview/SKILL.md",
+      workflowId: "truthmark-preview",
+      host: "github-copilot",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".github/skills/truthmark-check/SKILL.md",
+      workflowId: "truthmark-check",
+      host: "github-copilot",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".github/skills/truthmark-realize/SKILL.md",
+      workflowId: "truthmark-realize",
+      host: "github-copilot",
+      config
+    }),
     {
       path: TRUTHMARK_COPILOT_STRUCTURE_PROMPT_PATH,
       content: renderTruthmarkCopilotStructurePrompt(config)
@@ -2537,6 +4008,10 @@ var copilotFiles = (config, block) => {
       path: TRUTHMARK_COPILOT_SYNC_PROMPT_PATH,
       content: renderTruthmarkCopilotSyncPrompt(config)
     },
+    {
+      path: TRUTHMARK_COPILOT_PREVIEW_PROMPT_PATH,
+      content: renderTruthmarkCopilotPreviewPrompt(config)
+    },
     {
       path: TRUTHMARK_COPILOT_CHECK_PROMPT_PATH,
       content: renderTruthmarkCopilotCheckPrompt(config)
@@ -2544,10 +4019,107 @@ var copilotFiles = (config, block) => {
     {
       path: TRUTHMARK_COPILOT_REALIZE_PROMPT_PATH,
       content: renderTruthmarkCopilotRealizePrompt(config)
+    },
+    {
+      path: TRUTHMARK_COPILOT_ROUTE_AUDITOR_AGENT_PATH,
+      content: renderTruthmarkCopilotRouteAuditorAgent()
+    },
+    {
+      path: TRUTHMARK_COPILOT_CLAIM_VERIFIER_AGENT_PATH,
+      content: renderTruthmarkCopilotClaimVerifierAgent()
+    },
+    {
+      path: TRUTHMARK_COPILOT_DOC_REVIEWER_AGENT_PATH,
+      content: renderTruthmarkCopilotDocReviewerAgent()
+    },
+    {
+      path: TRUTHMARK_COPILOT_DOC_WRITER_AGENT_PATH,
+      content: renderTruthmarkCopilotDocWriterAgent()
     }
   ];
   return files;
 };
+var geminiFiles = (config, block) => {
+  return [
+    ...instructionBlockFiles(["GEMINI.md"], block),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".gemini/skills/truthmark-structure/SKILL.md",
+      workflowId: "truthmark-structure",
+      host: "gemini-cli",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".gemini/skills/truthmark-document/SKILL.md",
+      workflowId: "truthmark-document",
+      host: "gemini-cli",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".gemini/skills/truthmark-sync/SKILL.md",
+      workflowId: "truthmark-sync",
+      host: "gemini-cli",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".gemini/skills/truthmark-preview/SKILL.md",
+      workflowId: "truthmark-preview",
+      host: "gemini-cli",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".gemini/skills/truthmark-check/SKILL.md",
+      workflowId: "truthmark-check",
+      host: "gemini-cli",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".gemini/skills/truthmark-realize/SKILL.md",
+      workflowId: "truthmark-realize",
+      host: "gemini-cli",
+      config
+    }),
+    {
+      path: TRUTHMARK_GEMINI_STRUCTURE_COMMAND_PATH,
+      content: renderTruthmarkGeminiStructureCommand(config)
+    },
+    {
+      path: TRUTHMARK_GEMINI_DOCUMENT_COMMAND_PATH,
+      content: renderTruthmarkGeminiDocumentCommand(config)
+    },
+    {
+      path: TRUTHMARK_GEMINI_SYNC_COMMAND_PATH,
+      content: renderTruthmarkGeminiSyncCommand(config)
+    },
+    {
+      path: TRUTHMARK_GEMINI_PREVIEW_COMMAND_PATH,
+      content: renderTruthmarkGeminiPreviewCommand(config)
+    },
+    {
+      path: TRUTHMARK_GEMINI_CHECK_COMMAND_PATH,
+      content: renderTruthmarkGeminiCheckCommand(config)
+    },
+    {
+      path: TRUTHMARK_GEMINI_REALIZE_COMMAND_PATH,
+      content: renderTruthmarkGeminiRealizeCommand(config)
+    },
+    {
+      path: TRUTHMARK_GEMINI_ROUTE_AUDITOR_AGENT_PATH,
+      content: renderTruthmarkGeminiRouteAuditorAgent()
+    },
+    {
+      path: TRUTHMARK_GEMINI_CLAIM_VERIFIER_AGENT_PATH,
+      content: renderTruthmarkGeminiClaimVerifierAgent()
+    },
+    {
+      path: TRUTHMARK_GEMINI_DOC_REVIEWER_AGENT_PATH,
+      content: renderTruthmarkGeminiDocReviewerAgent()
+    },
+    {
+      path: TRUTHMARK_GEMINI_DOC_WRITER_AGENT_PATH,
+      content: renderTruthmarkGeminiDocWriterAgent()
+    }
+  ];
+};
 var instructionBlockFiles = (paths, block) => {
   return paths.map((path12) => ({
     path: path12,
@@ -2560,48 +4132,25 @@ var filesForPlatform = (platform, config, block) => {
     case "codex":
       return codexFiles(config);
     case "opencode":
-      return workflowSkillFiles(".opencode/skills", config);
+      return opencodeFiles(config);
     case "claude-code":
-      return [
-        ...instructionBlockFiles(["CLAUDE.md"], block),
-        ...workflowSkillFiles(".claude/skills", config)
-      ];
+      return claudeFiles(config, block);
     case "github-copilot":
       return copilotFiles(config, block);
     case "gemini-cli":
-      return [
-        ...instructionBlockFiles(["GEMINI.md"], block),
-        {
-          path: TRUTHMARK_GEMINI_STRUCTURE_COMMAND_PATH,
-          content: renderTruthmarkGeminiStructureCommand(config)
-        },
-        {
-          path: TRUTHMARK_GEMINI_DOCUMENT_COMMAND_PATH,
-          content: renderTruthmarkGeminiDocumentCommand(config)
-        },
-        {
-          path: TRUTHMARK_GEMINI_SYNC_COMMAND_PATH,
-          content: renderTruthmarkGeminiSyncCommand(config)
-        },
-        {
-          path: TRUTHMARK_GEMINI_CHECK_COMMAND_PATH,
-          content: renderTruthmarkGeminiCheckCommand(config)
-        },
-        {
-          path: TRUTHMARK_GEMINI_REALIZE_COMMAND_PATH,
-          content: renderTruthmarkGeminiRealizeCommand(config)
-        }
-      ];
+      return geminiFiles(config, block);
   }
 };
 var renderGeneratedSurfaces = (config, block = renderAgentsBlock(config)) => {
   const files = [
     ...instructionBlockFiles(config.instructionTargets, block),
-    ...config.platforms.flatMap((platform) => filesForPlatform(platform, config, block))
+    ...config.platforms.flatMap(
+      (platform) => filesForPlatform(platform, config, block)
+    )
   ];
-  return Array.from(new Map(files.map((file) => [file.path, file])).values()).sort(
-    (left, right) => left.path.localeCompare(right.path)
-  );
+  return Array.from(
+    new Map(files.map((file) => [file.path, file])).values()
+  ).sort((left, right) => left.path.localeCompare(right.path));
 };
 
 // src/init/init.ts
@@ -2733,7 +4282,7 @@ var diagnosticCategoryForPath = (filePath, config) => {
   if (filePath === "AGENTS.md") {
     return "truth-sync";
   }
-  if (filePath === "CLAUDE.md" || filePath === "GEMINI.md" || filePath === ".github/copilot-instructions.md" || filePath.startsWith(".github/prompts/truthmark-") || filePath.startsWith(".claude/skills/truthmark-") || filePath.startsWith(".opencode/skills/truthmark-")) {
+  if (filePath === "CLAUDE.md" || filePath === "GEMINI.md" || filePath === ".github/copilot-instructions.md" || filePath.startsWith(".github/prompts/truthmark-") || filePath.startsWith(".github/agents/truth-") || filePath.startsWith(".claude/agents/truth-") || filePath.startsWith(".claude/skills/truthmark-") || filePath.startsWith(".opencode/skills/truthmark-") || filePath.startsWith(".opencode/agents/") || filePath.startsWith(".codex/agents/")) {
     return "truth-sync";
   }
   if (filePath.startsWith(".codex/skills/truthmark-structure/")) {
@@ -2745,6 +4294,9 @@ var diagnosticCategoryForPath = (filePath, config) => {
   if (filePath.startsWith(".codex/skills/truthmark-sync/")) {
     return "truth-sync";
   }
+  if (filePath.startsWith(".codex/skills/truthmark-preview/")) {
+    return "truth-sync";
+  }
   if (filePath.startsWith(".codex/skills/truthmark-realize/")) {
     return "realization";
   }
@@ -3176,12 +4728,12 @@ var checkLinks = async (rootDir, markdownPaths) => {
 // src/checks/areas.ts
 import fs13 from "fs/promises";
 import fg5 from "fast-glob";
-import micromatch3 from "micromatch";
+import micromatch4 from "micromatch";
 
 // src/routing/area-resolver.ts
 import fs12 from "fs/promises";
 import fg4 from "fast-glob";
-import micromatch from "micromatch";
+import micromatch2 from "micromatch";
 var unique = (values) => {
   return [...new Set(values)];
 };
@@ -3200,7 +4752,7 @@ var isCodeSurfaceWithinParent = (childPattern, parentPatterns) => {
     return false;
   }
   return parentPatterns.some((parentPattern) => {
-    return micromatch.isMatch(childPrefix, parentPattern) || micromatch.isMatch(childPattern, parentPattern);
+    return micromatch2.isMatch(childPrefix, parentPattern) || micromatch2.isMatch(childPattern, parentPattern);
   });
 };
 var ensureChildPath = async (rootDir, areaFilesRoot, filePath) => {
@@ -3387,7 +4939,7 @@ var resolveAreaRouting = async (rootDir, config) => {
 };
 
 // src/sync/classify.ts
-import micromatch2 from "micromatch";
+import micromatch3 from "micromatch";
 var CODE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".c",
   ".cc",
@@ -3507,10 +5059,10 @@ var classifyPath = (filePath, ignorePatterns) => {
   if (normalizedPath.startsWith(".truthmark/")) {
     return "derived";
   }
-  if (normalizedPath.startsWith(".claude/") || normalizedPath.startsWith(".codex/") || normalizedPath.startsWith(".gemini/commands/") || normalizedPath.startsWith(".opencode/") || normalizedPath === ".github/copilot-instructions.md" || normalizedPath.startsWith(".github/prompts/truthmark-") || normalizedPath === "AGENTS.md" || normalizedPath === "CLAUDE.md" || normalizedPath === "GEMINI.md" || normalizedPath.startsWith(".gemini/commands/truthmark/")) {
+  if (normalizedPath.startsWith(".claude/") || normalizedPath.startsWith(".codex/") || normalizedPath.startsWith(".gemini/commands/") || normalizedPath.startsWith(".opencode/") || normalizedPath === ".github/copilot-instructions.md" || normalizedPath.startsWith(".github/agents/truth-") || normalizedPath.startsWith(".github/prompts/truthmark-") || normalizedPath === "AGENTS.md" || normalizedPath === "CLAUDE.md" || normalizedPath === "GEMINI.md" || normalizedPath.startsWith(".gemini/commands/truthmark/")) {
     return "derived";
   }
-  if (ignorePatterns.length > 0 && micromatch2.isMatch(normalizedPath, ignorePatterns)) {
+  if (ignorePatterns.length > 0 && micromatch3.isMatch(normalizedPath, ignorePatterns)) {
     return "ignored";
   }
   if (normalizedPath.toLowerCase().endsWith(".md")) {
@@ -3806,7 +5358,7 @@ var checkAreas = async (rootDir, config) => {
   }
   for (const codeFile of codeFiles.sort()) {
     const matched = areaCoverage.some(
-      (entry) => entry.valid && entry.patterns.some((pattern) => micromatch3.isMatch(codeFile, pattern))
+      (entry) => entry.valid && entry.patterns.some((pattern) => micromatch4.isMatch(codeFile, pattern))
     );
     if (!matched) {
       diagnostics.push({
@@ -3837,7 +5389,7 @@ var checkAreas = async (rootDir, config) => {
 
 // src/checks/decisions.ts
 import fs14 from "fs/promises";
-import micromatch4 from "micromatch";
+import micromatch5 from "micromatch";
 var REQUIRED_DECISION_HEADINGS = ["Scope", "Product Decisions", "Rationale"];
 var isTruthDocumentKind3 = (value) => {
   return TRUTH_DOCUMENT_KINDS.includes(value);
@@ -3901,7 +5453,7 @@ var decisionTruthGlobs = (config) => {
   ].filter((root) => Boolean(root)).map((root) => `${root}/**/*.md`);
 };
 var isDecisionTruthCandidate = (config, filePath) => {
-  return !filePath.endsWith("/README.md") && micromatch4.isMatch(filePath, decisionTruthGlobs(config));
+  return !filePath.endsWith("/README.md") && micromatch5.isMatch(filePath, decisionTruthGlobs(config));
 };
 var checkDecisionSections = async (rootDir, config, markdownPaths, truthDocumentEntries = []) => {
   const diagnostics = [];
@@ -4020,7 +5572,7 @@ var checkGeneratedSurfaces = async (rootDir, config) => {
 
 // src/impact/build.ts
 import path9 from "path";
-import micromatch6 from "micromatch";
+import micromatch7 from "micromatch";
 
 // src/repo-index/build.ts
 import fs18 from "fs/promises";
@@ -4032,7 +5584,7 @@ import path5 from "path";
 import { execa as execa2 } from "execa";
 import fg6 from "fast-glob";
 import matter2 from "gray-matter";
-import micromatch5 from "micromatch";
+import micromatch6 from "micromatch";
 var languageByExtension = /* @__PURE__ */ new Map([
   [".ts", "typescript"],
   [".tsx", "typescript"],
@@ -4109,7 +5661,7 @@ var gitDiscoverableFiles = async (rootDir) => {
   return result.stdout.split("\n").map((line) => normalizePath2(line.trim())).filter((line) => line.length > 0);
 };
 var isIgnoredPath = (filePath, ignore) => {
-  return micromatch5.isMatch(filePath, [...defaultIgnore, ...ignore]);
+  return micromatch6.isMatch(filePath, [...defaultIgnore, ...ignore]);
 };
 var discoverRepoFiles = async (rootDir, ignore) => {
   const discoveredFiles = await gitDiscoverableFiles(rootDir) ?? await fg6(["**/*"], {
@@ -4123,6 +5675,18 @@ var discoverRepoFiles = async (rootDir, ignore) => {
   const docs = [];
   const tests = [];
   for (const filePath of discoveredFiles.filter((entry) => !isIgnoredPath(entry, ignore)).sort()) {
+    let stat;
+    try {
+      stat = await fs16.stat(path5.join(rootDir, filePath));
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+        continue;
+      }
+      throw error;
+    }
+    if (!stat.isFile()) {
+      continue;
+    }
     const extension = path5.posix.extname(filePath);
     const kind = fileKind(filePath, ignore);
     files.push({
@@ -4528,7 +6092,7 @@ var readBaseFile = async (cwd, base, filePath) => {
 // src/impact/build.ts
 var uniqueSorted = (values) => [...new Set(values)].sort();
 var routeMatchesFile = (route, filePath) => {
-  return route.codeSurface.some((pattern) => micromatch6.isMatch(filePath, pattern));
+  return route.codeSurface.some((pattern) => micromatch7.isMatch(filePath, pattern));
 };
 var routeOwnsTruthDoc = (route, filePath) => {
   return route.truthDocs.includes(filePath);
@@ -5149,6 +6713,319 @@ var renderContextPackMarkdown = (pack) => {
 `;
 };
 
+// src/cli/handlers.ts
+import fs23 from "fs/promises";
+
+// src/agents/workflow-helper-validation.ts
+import { parse as parseYaml2 } from "yaml";
+var escapeRegex = (value) => value.split("").map((char) => ".+*?^$()[]{}|\\".includes(char) ? `\\${char}` : char).join("");
+var hasLabel = (text, label) => {
+  const escaped = escapeRegex(label);
+  return new RegExp(String.raw`(^|\n)\s*(?:#{1,6}\s*)?${escaped}\s*:?\s*(\n|$)`, "iu").test(
+    text
+  );
+};
+var getSection = (text, label) => {
+  const lines = text.split(/\r?\n/u);
+  const labelPattern = new RegExp(String.raw`^(?:#{1,6}\s*)?${escapeRegex(label)}\s*:?\s*$`, "iu");
+  const sectionHeaderPattern = /^(?:#{1,6}\s*)?[A-Z][A-Za-z0-9 ]+:\s*$/u;
+  const startIndex = lines.findIndex((line) => labelPattern.test(line));
+  if (startIndex === -1) {
+    return null;
+  }
+  const nextSectionOffset = lines.slice(startIndex + 1).findIndex((line) => sectionHeaderPattern.test(line));
+  const endIndex = nextSectionOffset === -1 ? lines.length : startIndex + 1 + nextSectionOffset;
+  return lines.slice(startIndex + 1, endIndex).join("\n").trim();
+};
+var requireBulletSection = (text, label, errors, checks) => {
+  const section = getSection(text, label);
+  if (section === null) {
+    errors.push(`missing required section: ${label}`);
+    return;
+  }
+  if (!/^-\s+\S/mu.test(section)) {
+    errors.push(`${label} must include at least one bullet`);
+    return;
+  }
+  checks.push(label);
+};
+var validateEvidenceChecked = (text, errors, checks) => {
+  const section = getSection(text, "Evidence checked");
+  if (section === null || section === "") {
+    errors.push("Evidence checked must include at least one structured entry");
+    return;
+  }
+  const entries = section.split(/\n(?=-\s+)/u).map((entry) => entry.trim()).filter(Boolean);
+  if (entries.length === 0) {
+    errors.push("Evidence checked must include at least one structured entry");
+    return;
+  }
+  const entryPattern = /^- Claim:\s*\S[^\n]*\n {2,}Evidence:\s*\S[^\n]*\n {2,}Result:\s*(supported|narrowed|removed|blocked)\s*$/iu;
+  for (const [index, entry] of entries.entries()) {
+    if (!entryPattern.test(entry)) {
+      errors.push(
+        `Evidence checked entry ${index + 1} must match '- Claim: ...' followed by indented 'Evidence: ...' and 'Result: supported | narrowed | removed | blocked'`
+      );
+    }
+  }
+  if (errors.length === 0) {
+    checks.push(
+      "Evidence checked entries include Claim:, Evidence:, and Result: supported | narrowed | removed | blocked"
+    );
+  }
+};
+var validateHelperScriptEntries = (entries, requiredHelpers, errors, checks) => {
+  if (entries === void 0 || entries.length === 0) {
+    errors.push("Helper scripts must include status for optional helpers");
+    return;
+  }
+  const statusPattern = /^(?:-\s*)?([a-z0-9-]+):\s*(?:ran,\s*passed|skipped,\s*\S.*)$/iu;
+  const validHelperIds = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    const match = entry.trim().match(statusPattern);
+    if (match === null) {
+      errors.push(
+        "Helper scripts entries must match '- helper-id: ran, passed' or '- helper-id: skipped, reason'; ran, failed is not valid for completed reports"
+      );
+      continue;
+    }
+    validHelperIds.add(match[1].toLowerCase());
+  }
+  for (const helperId of requiredHelpers) {
+    if (!validHelperIds.has(helperId.toLowerCase())) {
+      errors.push(`missing Helper scripts status: ${helperId}`);
+    }
+  }
+  if (errors.length === 0) {
+    checks.push(`Helper scripts statuses include ${requiredHelpers.join(", ")}`);
+  }
+};
+var validateHelperScripts = (text, requiredHelpers, errors, checks) => {
+  const section = getSection(text, "Helper scripts");
+  const entries = section?.split(/\n/u).map((entry) => entry.trim()).filter(Boolean);
+  validateHelperScriptEntries(entries, requiredHelpers, errors, checks);
+};
+var validateTruthSyncReportText = (text) => {
+  const helper = "validate-sync-report";
+  const statusMatch = text.match(/^\s*Truth Sync:\s*(completed|blocked|skipped)\b/imu);
+  if (statusMatch === null) {
+    return {
+      ok: false,
+      helper,
+      errors: ["missing Truth Sync status: expected completed, blocked, or skipped"]
+    };
+  }
+  const status = statusMatch[1].toLowerCase();
+  const checks = [`status: ${status}`];
+  const errors = [];
+  if (status === "completed") {
+    try {
+      const report = parseTruthSyncReport(text.trimStart());
+      for (const [label, items] of [
+        ["Changed code reviewed", report.changedCode],
+        ["Ownership reviewed", report.ownershipReviewed],
+        ["Truth docs updated", report.truthDocsUpdated],
+        ["Notes", report.notes]
+      ]) {
+        if (items.length === 0) {
+          errors.push(`${label} must include at least one bullet`);
+        } else {
+          checks.push(label);
+        }
+      }
+      if (report.evidenceChecked.length === 0) {
+        errors.push("Evidence checked must include at least one structured entry");
+      } else {
+        checks.push(
+          "Evidence checked entries include Claim:, Evidence:, and Result: supported | narrowed | removed | blocked"
+        );
+      }
+      validateHelperScriptEntries(
+        report.helperScripts,
+        ["validate-write-lease"],
+        errors,
+        checks
+      );
+    } catch (error) {
+      errors.push(error instanceof Error ? error.message : "invalid Truth Sync report");
+    }
+  } else if (status === "skipped") {
+    requireBulletSection(text, "Reason", errors, checks);
+  } else if (status === "blocked") {
+    requireBulletSection(text, "Reason", errors, checks);
+    requireBulletSection(text, "Files requiring manual review", errors, checks);
+    requireBulletSection(text, "Next action", errors, checks);
+  }
+  return errors.length > 0 ? { ok: false, helper, errors } : { ok: true, helper, checks };
+};
+var validateTruthDocumentReportText = (text) => {
+  const helper = "validate-document-report";
+  const statusMatch = text.match(/^\s*Truth Document:\s*(completed|blocked)\b/imu);
+  if (statusMatch === null) {
+    return {
+      ok: false,
+      helper,
+      errors: ["missing Truth Document status: expected completed or blocked"]
+    };
+  }
+  const status = statusMatch[1].toLowerCase();
+  const checks = [`status: ${status}`];
+  const errors = [];
+  if (status === "completed") {
+    for (const label of ["Implementation reviewed", "Ownership reviewed", "Notes"]) {
+      requireBulletSection(text, label, errors, checks);
+    }
+    if (hasLabel(text, "Evidence checked")) {
+      checks.push("Evidence checked");
+    } else {
+      errors.push("missing required section: Evidence checked");
+    }
+    if (hasLabel(text, "Helper scripts")) {
+      checks.push("Helper scripts");
+    } else {
+      errors.push("missing required section: Helper scripts");
+    }
+    const truthDocsUpdated = getSection(text, "Truth docs updated");
+    const truthDocsCreated = getSection(text, "Truth docs created");
+    if (truthDocsUpdated === null && truthDocsCreated === null) {
+      errors.push("missing required section: Truth docs updated or Truth docs created");
+    } else if (![truthDocsUpdated, truthDocsCreated].some(
+      (section) => section !== null && /^-\s+\S/mu.test(section)
+    )) {
+      errors.push("Truth docs updated or Truth docs created must include at least one bullet");
+    } else {
+      checks.push("Truth docs updated or created");
+    }
+    validateEvidenceChecked(text, errors, checks);
+    validateHelperScripts(text, ["validate-write-lease"], errors, checks);
+  } else if (status === "blocked") {
+    requireBulletSection(text, "Reason", errors, checks);
+  }
+  return errors.length > 0 ? { ok: false, helper, errors } : { ok: true, helper, checks };
+};
+var cleanPathValue = (value) => value.trim().replace(/^["']|["']$/gu, "");
+var normalizePath5 = (value) => cleanPathValue(value).replace(/^\.\//u, "");
+var windowsDriveAbsolutePattern = /^[A-Za-z]:[\\/]/u;
+var uncPathPattern = /^[/\\]{2}[^/\\]+[/\\]+[^/\\]+/u;
+var isUnsafePathValue = (value) => {
+  const cleanValue = cleanPathValue(value);
+  const pathValue = cleanValue.endsWith("/**") ? cleanValue.slice(0, -3) : cleanValue;
+  return pathValue.startsWith("/") || pathValue.startsWith("\\") || windowsDriveAbsolutePattern.test(pathValue) || uncPathPattern.test(pathValue) || pathValue.split(/[\\/]+/u).includes("..");
+};
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var findWriteLeaseRecord = (value) => {
+  if (!isRecord(value)) {
+    return null;
+  }
+  if (Object.prototype.hasOwnProperty.call(value, "allowedWrites") || Object.prototype.hasOwnProperty.call(value, "forbiddenWrites")) {
+    return value;
+  }
+  for (const nestedKey of ["writeLease", "lease"]) {
+    const nested = value[nestedKey];
+    if (isRecord(nested)) {
+      return nested;
+    }
+  }
+  return value;
+};
+var readStringArray = (record, field, errors) => {
+  const value = record[field];
+  if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) {
+    errors.push(`${field} must be an array of strings`);
+    return [];
+  }
+  return value;
+};
+var parseListFields = (text) => {
+  const errors = [];
+  let parsed;
+  try {
+    parsed = parseYaml2(text);
+  } catch (error) {
+    return {
+      allowedWrites: [],
+      forbiddenWrites: [],
+      errors: [
+        `manual-validation required: invalid write lease YAML${error instanceof Error ? `: ${error.message}` : ""}`
+      ]
+    };
+  }
+  const record = findWriteLeaseRecord(parsed);
+  if (record === null) {
+    return {
+      allowedWrites: [],
+      forbiddenWrites: [],
+      errors: ["write lease YAML must be an object"]
+    };
+  }
+  return {
+    allowedWrites: readStringArray(record, "allowedWrites", errors),
+    forbiddenWrites: readStringArray(record, "forbiddenWrites", errors),
+    errors
+  };
+};
+var isSupportedPattern = (pattern) => {
+  const withoutTrailingGlob = pattern.endsWith("/**") ? pattern.slice(0, -3) : pattern;
+  return !/[?*[\]{}]/u.test(withoutTrailingGlob);
+};
+var matchesPattern = (filePath, pattern) => {
+  if (pattern.endsWith("/**")) {
+    const prefix = pattern.slice(0, -3).replace(/\/+$/u, "");
+    return filePath === prefix || filePath.startsWith(`${prefix}/`);
+  }
+  return filePath === pattern;
+};
+var validateWriteLeaseText = (leaseText, changedText) => {
+  const helper = "validate-write-lease";
+  const parsed = parseListFields(leaseText);
+  const rawAllowedWrites = parsed.allowedWrites.map(cleanPathValue).filter(Boolean);
+  const rawForbiddenWrites = parsed.forbiddenWrites.map(cleanPathValue).filter(Boolean);
+  const rawChangedFiles = changedText.split(/\r?\n/u).map(cleanPathValue).filter(Boolean);
+  const allowedWrites = rawAllowedWrites.map(normalizePath5).filter(Boolean);
+  const forbiddenWrites = rawForbiddenWrites.map(normalizePath5).filter(Boolean);
+  const changedFiles = rawChangedFiles.map(normalizePath5).filter(Boolean);
+  const checks = [];
+  const errors = [...parsed.errors];
+  for (const pattern of rawAllowedWrites) {
+    if (isUnsafePathValue(pattern)) {
+      errors.push(`invalid allowedWrites path: ${pattern}`);
+    }
+  }
+  for (const pattern of rawForbiddenWrites) {
+    if (isUnsafePathValue(pattern)) {
+      errors.push(`invalid forbiddenWrites path: ${pattern}`);
+    }
+  }
+  for (const filePath of rawChangedFiles) {
+    if (isUnsafePathValue(filePath)) {
+      errors.push(`invalid changed file path: ${filePath}`);
+    }
+  }
+  for (const pattern of [...allowedWrites, ...forbiddenWrites]) {
+    if (!isSupportedPattern(pattern)) {
+      errors.push(`manual-validation required: unsupported write pattern ${pattern}`);
+    }
+  }
+  if (allowedWrites.length === 0) {
+    errors.push("manual-validation required: no allowedWrites entries found");
+  }
+  if (errors.length === 0) {
+    for (const filePath of changedFiles) {
+      if (!allowedWrites.some((pattern) => matchesPattern(filePath, pattern))) {
+        errors.push(`${filePath} is outside allowedWrites`);
+        continue;
+      }
+      const forbiddenPattern = forbiddenWrites.find((pattern) => matchesPattern(filePath, pattern));
+      if (forbiddenPattern !== void 0) {
+        errors.push(`${filePath} matches forbiddenWrites pattern ${forbiddenPattern}`);
+        continue;
+      }
+      checks.push(filePath);
+    }
+  }
+  return errors.length > 0 ? { ok: false, helper, errors } : { ok: true, helper, checks };
+};
+
 // src/cli/handlers.ts
 var runConfig2 = async (options) => {
   return runConfig(process.cwd(), options);
@@ -5205,6 +7082,33 @@ var isContextPackWorkflow = (value) => {
 var isContextPackFormat = (value) => {
   return value === void 0 || value === "json" || value === "markdown";
 };
+var readHelperFile = async (filePath, helper) => {
+  try {
+    return await fs23.readFile(filePath, "utf8");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, helper, errors: [`could not read file: ${message}`] };
+  }
+};
+var runValidateSyncReport = async (reportFile) => {
+  const text = await readHelperFile(reportFile, "validate-sync-report");
+  return typeof text === "string" ? validateTruthSyncReportText(text) : text;
+};
+var runValidateDocumentReport = async (reportFile) => {
+  const text = await readHelperFile(reportFile, "validate-document-report");
+  return typeof text === "string" ? validateTruthDocumentReportText(text) : text;
+};
+var runValidateWriteLease = async (leaseFile, changedFilesFile) => {
+  const leaseText = await readHelperFile(leaseFile, "validate-write-lease");
+  if (typeof leaseText !== "string") {
+    return leaseText;
+  }
+  const changedText = await readHelperFile(changedFilesFile, "validate-write-lease");
+  if (typeof changedText !== "string") {
+    return changedText;
+  }
+  return validateWriteLeaseText(leaseText, changedText);
+};
 var runContext = async (options) => {
   if (!isContextPackWorkflow(options.workflow)) {
     return {
@@ -5261,6 +7165,28 @@ var writeContextResult = (result, options) => {
   }
   writeResult(result, options);
 };
+var renderValidationHuman = (result) => {
+  if (result.ok === true) {
+    return [`${result.helper}: ok`, ...result.checks.map((check) => `- ${check}`)].join("\n");
+  }
+  return [`${result.helper}: failed`, ...result.errors.map((error) => `- ${error}`)].join("\n");
+};
+var toValidationCommandResult = (command, result) => ({
+  command,
+  summary: result.ok ? "Validation passed" : "Validation failed",
+  diagnostics: [],
+  data: {
+    validation: result
+  }
+});
+var writeValidationResult = (command, result, options) => {
+  const output = options.json ? renderJson(toValidationCommandResult(command, result)) : renderValidationHuman(result);
+  process.stdout.write(`${output}
+`);
+  if (!result.ok) {
+    process.exitCode = 1;
+  }
+};
 var addJsonOption = (command) => {
   return command.option("--json", "Render command output as JSON");
 };
@@ -5304,6 +7230,32 @@ var buildProgram = () => {
       options
     );
   });
+  const validate = program.command("validate").description("Run optional Truthmark workflow helper validators from the installed CLI.");
+  addJsonOption(
+    validate.command("sync-report").description("Validate a Truth Sync report file.").argument("<report-file>", "Truth Sync report file")
+  ).action(async (reportFile, options) => {
+    writeValidationResult("validate sync-report", await runValidateSyncReport(reportFile), options);
+  });
+  addJsonOption(
+    validate.command("document-report").description("Validate a Truth Document report file.").argument("<report-file>", "Truth Document report file")
+  ).action(async (reportFile, options) => {
+    writeValidationResult(
+      "validate document-report",
+      await runValidateDocumentReport(reportFile),
+      options
+    );
+  });
+  addJsonOption(
+    validate.command("write-lease").description("Validate a workflow write lease or worker report against changed files.").argument("<lease-or-report-file>", "Lease or worker report file").argument("<changed-files-file>", "Newline-separated changed file list")
+  ).action(
+    async (leaseOrReportFile, changedFilesFile, options) => {
+      writeValidationResult(
+        "validate write-lease",
+        await runValidateWriteLease(leaseOrReportFile, changedFilesFile),
+        options
+      );
+    }
+  );
   return program;
 };