truthmark 1.4.0 → 1.5.0

package/dist/main.js

@@ -1567,6 +1567,27 @@ var renderCopilotCustomAgentModeSection = (agents, parentRule, writeAgents = [])
     `- ${parentRule}`
   ].join("\n");
 };
+var renderGeminiSubagentModeSection = (agents, parentRule, writeAgents = []) => {
+  const mentions = agents.map((agent) => `@${agent.replace(/_/gu, "-")}`);
+  const writeMentions = writeAgents.map((agent) => `@${agent.replace(/_/gu, "-")}`);
+  const writeAgentLines = writeMentions.length > 0 ? [
+    `- dispatch write-capable project subagents only with explicit write leases: ${writeMentions.join(", ")}`,
+    "- each write lease must name objective, required reads, allowed writes, forbidden writes, evidence, verification, and report fields",
+    "- write workers must stop when a required edit is off-lease and report status, filesChanged, evidence, offLeaseChanges, blockers, and notes",
+    "- parent must inspect the actual checkout diff against each lease before accepting a worker report"
+  ] : [];
+  const readOnlyScope = writeAgents.length > 0 ? "for verification" : "only";
+  const readOnlySubagentLabel = writeAgents.length > 0 ? "read-only subagents" : "subagents";
+  return [
+    "Gemini CLI subagent mode:",
+    "- use automatically when this workflow runs in Gemini CLI and the parent agent chooses bounded project subagent fan-out",
+    `- dispatch read-only project subagents ${readOnlyScope}: ${mentions.join(", ")}`,
+    `- ${readOnlySubagentLabel} inspect checkout evidence directly, return structured findings, and must not edit files`,
+    `- parent supplies bounded evidence shards; ${readOnlySubagentLabel} must not preload host instruction files or repo-wide policy docs unless assigned as evidence`,
+    ...writeAgentLines,
+    `- ${parentRule}`
+  ].join("\n");
+};
 var defaultAgentConfig = () => {
   return createDefaultConfig();
 };
@@ -1678,7 +1699,50 @@ var renderDefaultStandards = (documents) => {
   return DEFAULT_STANDARDS.filter((template) => !existingPaths.has(template.path));
 };
 
+// src/templates/workflow-surfaces.ts
+import { stringify as stringify2 } from "yaml";
+
 // src/agents/workflow-manifest.ts
+var TRUTHMARK_CLI_RUNNER = `truthmark>=${TRUTHMARK_VERSION}`;
+var VALIDATE_SYNC_REPORT_HELPER = {
+  id: "validate-sync-report",
+  optional: true,
+  runner: TRUTHMARK_CLI_RUNNER,
+  command: { argv: ["truthmark", "validate", "sync-report", "<report-file>", "--json"] },
+  inputs: ["sync report file"],
+  output: "json",
+  writes: false,
+  fallback: "manually validate support/report-template.md and check Evidence checked entries match Claim, indented Evidence, and Result: supported | narrowed | removed | blocked"
+};
+var VALIDATE_DOCUMENT_REPORT_HELPER = {
+  id: "validate-document-report",
+  optional: true,
+  runner: TRUTHMARK_CLI_RUNNER,
+  command: { argv: ["truthmark", "validate", "document-report", "<report-file>", "--json"] },
+  inputs: ["document report file"],
+  output: "json",
+  writes: false,
+  fallback: "manually validate support/report-template.md required sections and structured Evidence checked entries"
+};
+var VALIDATE_WRITE_LEASE_HELPER = {
+  id: "validate-write-lease",
+  optional: true,
+  runner: TRUTHMARK_CLI_RUNNER,
+  command: {
+    argv: [
+      "truthmark",
+      "validate",
+      "write-lease",
+      "<lease-or-report-file>",
+      "<changed-files-file>",
+      "--json"
+    ]
+  },
+  inputs: ["lease or worker report yaml", "changed file list"],
+  output: "json",
+  writes: false,
+  fallback: "manually compare declared allowedWrites and forbiddenWrites with the actual changed files"
+};
 var TRUTHMARK_WORKFLOW_MANIFEST = {
   "truthmark-sync": {
     id: "truthmark-sync",
@@ -1717,10 +1781,12 @@ var TRUTHMARK_WORKFLOW_MANIFEST = {
       "Truth docs updated",
       "Truth docs split",
       "Evidence checked",
+      "Helper scripts",
       "Notes"
     ],
     subagents: ["truth_route_auditor", "truth_claim_verifier"],
-    writeSubagents: ["truth_doc_writer"]
+    writeSubagents: ["truth_doc_writer"],
+    helpers: [VALIDATE_SYNC_REPORT_HELPER, VALIDATE_WRITE_LEASE_HELPER]
   },
   "truthmark-structure": {
     id: "truthmark-structure",
@@ -1801,10 +1867,12 @@ var TRUTHMARK_WORKFLOW_MANIFEST = {
       "Truth docs restructured",
       "Routing updated",
       "Evidence checked",
+      "Helper scripts",
       "Notes"
     ],
     subagents: ["truth_route_auditor", "truth_claim_verifier"],
-    writeSubagents: ["truth_doc_writer"]
+    writeSubagents: ["truth_doc_writer"],
+    helpers: [VALIDATE_DOCUMENT_REPORT_HELPER, VALIDATE_WRITE_LEASE_HELPER]
   },
   "truthmark-realize": {
     id: "truthmark-realize",
@@ -2012,11 +2080,15 @@ var renderMarkdownExample2 = (content) => {
 var TRUTH_DOCUMENT_EXPLICIT_INVOCATIONS = "OpenCode /skill truthmark-document; Codex /truthmark-document or $truthmark-document; Claude Code /truthmark-document; GitHub Copilot /truthmark-document; Gemini CLI /truthmark:document.";
 var renderTruthDocumentReportExample = (config = defaultAgentConfig()) => {
   const truthDocsRoot = resolveTruthDocsRoot(config);
+  const helperScripts = ["validate-write-lease: skipped, no write lease used"];
   return `Truth Document: completed
 
 Implementation reviewed:
 - src/routing/area-resolver.ts
 
+Ownership reviewed:
+- ${config.docs.routing.rootIndex}
+
 Truth docs created:
 - ${truthDocsRoot}/contracts.md
 
@@ -2040,6 +2112,9 @@ ${renderClaimEvidenceCheckedSection([
     }
   ])}
 
+Helper scripts:
+${helperScripts.map((helperScript) => `- ${helperScript}`).join("\n")}
+
 Notes:
 - Documented routing and behavior from route handlers and tests.`;
 };
@@ -2115,6 +2190,12 @@ ${renderTruthDocRestructureGateSection(
 ${ARCHITECTURE_DOC_BOUNDARY_INSTRUCTIONS}
 ${renderHierarchySummary(config)}
 ${DECISION_TRUTH_INSTRUCTIONS}
+Helper status reporting:
+- Validate the report body before adding this validator's own success status; the body may omit \`validate-document-report\` while validation is pending.
+- After \`truthmark validate document-report <report-file> --json\` returns \`data.validation.ok: true\`, append or update \`validate-document-report: ran, passed\` in the final report.
+- If the installed Truthmark CLI is unavailable or the helper is skipped, record \`validate-document-report: skipped, <reason>\` and manually validate the report shape.
+- Record \`validate-write-lease: ran, passed\` only after validating a concrete write lease; otherwise use a truthful skipped status such as \`skipped, no write lease used\`.
+- Helper output is derived evidence and never replaces direct checkout inspection, evidence review, or parent acceptance.
 Parent post-document verification:
 - verify only truth docs and leased truth routing files changed during document work
 - block on functional code, generated host surfaces, or unrelated diffs caused by document work
@@ -2366,24 +2447,105 @@ var renderBulletSection = (title, items) => {
   return `${title}:
 ${items.map((item) => `- ${item}`).join("\n")}`;
 };
+var findSection = (source, title) => {
+  return source.split("\n\n").find((candidate) => candidate.startsWith(`${title}:
+`));
+};
+var parseBulletLines = (section) => {
+  return section.split("\n").slice(1).map((line) => {
+    const match = line.match(/^-\s+(.*)$/);
+    return match?.[1];
+  }).filter((line) => line !== void 0);
+};
+var parseBulletSection = (source, title) => {
+  const section = findSection(source, title);
+  if (!section) {
+    return [];
+  }
+  return parseBulletLines(section);
+};
+var parseOptionalBulletSection = (source, title) => {
+  const section = findSection(source, title);
+  if (!section) {
+    return void 0;
+  }
+  return parseBulletLines(section);
+};
+var isClaimEvidenceResult = (value) => {
+  return ["supported", "narrowed", "removed", "blocked"].includes(value);
+};
+var hasContent = (value) => value.trim().length > 0;
+var parseEvidenceCheckedSection = (source) => {
+  const section = source.split("\n\n").find((candidate) => candidate.startsWith("Evidence checked:\n"));
+  if (!section) {
+    throw new Error("Evidence checked section is required.");
+  }
+  const lines = section.split("\n").slice(1);
+  const items = [];
+  for (let index = 0; index < lines.length; index += 3) {
+    const claimLine = lines[index];
+    const evidenceLine = lines[index + 1];
+    const resultLine = lines[index + 2];
+    if (!claimLine?.startsWith("- Claim: ") || !evidenceLine?.startsWith("  Evidence: ") || !resultLine?.startsWith("  Result: ")) {
+      throw new Error("Evidence checked entries must include Claim, Evidence, and Result fields.");
+    }
+    const result = resultLine.slice("  Result: ".length);
+    const claim = claimLine.slice("- Claim: ".length).trim();
+    const evidence = evidenceLine.slice("  Evidence: ".length).split(" / ").map((value) => value.trim());
+    if (!hasContent(claim)) {
+      throw new Error("Evidence checked claim is required.");
+    }
+    if (evidence.length === 0 || evidence.some((value) => !hasContent(value))) {
+      throw new Error("Evidence checked evidence is required.");
+    }
+    if (!isClaimEvidenceResult(result)) {
+      throw new Error("Evidence checked result is invalid.");
+    }
+    items.push({
+      claim,
+      evidence,
+      result
+    });
+  }
+  return items;
+};
 var renderTruthSyncCompletedReport = (input) => {
   return [
     "Truth Sync: completed",
     renderBulletSection("Changed code reviewed", input.changedCode),
+    renderBulletSection("Ownership reviewed", input.ownershipReviewed),
     renderBulletSection("Truth docs updated", input.truthDocsUpdated),
     renderClaimEvidenceCheckedSection(input.evidenceChecked),
+    ...input.helperScripts === void 0 ? [] : [renderBulletSection("Helper scripts", input.helperScripts)],
     renderBulletSection("Notes", input.notes)
   ].join("\n\n");
 };
+var parseTruthSyncReport = (source) => {
+  if (!source.startsWith("Truth Sync: completed")) {
+    throw new Error("Only completed Truth Sync reports can be parsed.");
+  }
+  const helperScripts = parseOptionalBulletSection(source, "Helper scripts");
+  return {
+    status: "completed",
+    changedCode: parseBulletSection(source, "Changed code reviewed"),
+    ownershipReviewed: parseBulletSection(source, "Ownership reviewed"),
+    truthDocsUpdated: parseBulletSection(source, "Truth docs updated"),
+    evidenceChecked: parseEvidenceCheckedSection(source),
+    ...helperScripts === void 0 ? {} : { helperScripts },
+    notes: parseBulletSection(source, "Notes")
+  };
+};
 var renderTruthSyncBlockedReport = (input) => {
+  const manualReviewFiles = input.manualReviewFiles.filter((file) => file.trim().length > 0);
+  if (manualReviewFiles.length === 0) {
+    throw new Error("Files requiring manual review must include at least one file.");
+  }
   const sections = [
     "Truth Sync: blocked",
-    renderBulletSection("Reason", [input.reason])
+    renderBulletSection("Reason", [input.reason]),
+    renderBulletSection("Files requiring manual review", manualReviewFiles),
+    renderBulletSection("Next action", [input.nextAction])
   ];
-  if ((input.manualReviewFiles?.length ?? 0) > 0) {
-    sections.push(renderBulletSection("Files requiring manual review", input.manualReviewFiles));
-  }
-  sections.push(renderBulletSection("Next action", [input.nextAction]));
   return [
     ...sections
   ].join("\n\n");
@@ -2397,6 +2559,7 @@ var renderMarkdownExample5 = (content) => {
 var renderTruthSyncSkillBody = (config = defaultAgentConfig(), options = {}) => {
   const truthDocsRoot = resolveTruthDocsRoot(config);
   const workflow = getTruthmarkWorkflow("truthmark-sync");
+  const helperScripts = ["validate-write-lease: skipped, no write lease used"];
   const claudeSubagentMode = options.includeClaudeSubagentMode ? `${renderClaudeSubagentModeSection(
     workflow.subagents ?? [],
     "Parent agent owns Truth Sync acceptance, lease validation, and final report",
@@ -2470,6 +2633,12 @@ Optional validation tooling:
 - do not require the truthmark binary; direct checkout inspection is the canonical path
 - optional validation must not replace agent judgment about docs and routing
 - update Product Decisions and Rationale when a behavior change comes from a decision change
+Helper status reporting:
+- Validate the report body before adding this validator's own success status; the body may omit \`validate-sync-report\` while validation is pending.
+- After \`truthmark validate sync-report <report-file> --json\` returns \`data.validation.ok: true\`, append or update \`validate-sync-report: ran, passed\` in the final report.
+- If the installed Truthmark CLI is unavailable or the helper is skipped, record \`validate-sync-report: skipped, <reason>\` and manually validate the report shape.
+- Record \`validate-write-lease: ran, passed\` only after validating a concrete write lease; otherwise use a truthful skipped status such as \`skipped, no write lease used\`.
+- Helper output is derived evidence and never replaces direct checkout inspection, evidence review, or parent acceptance.
 ${renderHierarchySummary(config)}
 ${DECISION_TRUTH_INSTRUCTIONS}
 Parent post-sync verification:
@@ -2477,7 +2646,7 @@ Parent post-sync verification:
 - block on any unrelated diff caused by the sync step
 - block if functional code changed during sync
 - for each write lease, validate the worker report against the actual worker diff, allowedWrites, forbiddenWrites, identity fields, filesChanged, offLeaseChanges, blockers, and required report fields before accepting it
-- validate the final report against the structured Truth Sync report contract, including Claim, Evidence, and Result entries under Evidence checked
+- validate the final report against the structured Truth Sync report contract, including Claim, indented Evidence, and Result values supported, narrowed, removed, or blocked under Evidence checked
 - verify the updated docs correspond to the reviewed changed-code surface
 - verify the final report records ownership review, structure requirement, split, restructure, or blocked reason when the ownership gate fired
 - blocked outcomes must preserve the working tree as-is: no rollback, no post-block cleanup edits, and manual-review reporting of any remaining files
@@ -2485,6 +2654,7 @@ Report completion in this shape:
 ${renderMarkdownExample5(
     renderTruthSyncCompletedReport({
       changedCode: ["src/auth/session.ts"],
+      ownershipReviewed: [config.docs.routing.rootIndex],
       truthDocsUpdated: [`${truthDocsRoot}/repository/overview.md`],
       evidenceChecked: [
         {
@@ -2493,6 +2663,7 @@ ${renderMarkdownExample5(
           result: "supported"
         }
       ],
+      helperScripts,
       notes: ["Updated session timeout behavior."]
     })
   )}
@@ -2553,6 +2724,10 @@ var TRUTHMARK_GEMINI_SYNC_COMMAND_PATH = ".gemini/commands/truthmark/sync.toml";
 var TRUTHMARK_GEMINI_REALIZE_COMMAND_PATH = ".gemini/commands/truthmark/realize.toml";
 var TRUTHMARK_GEMINI_CHECK_COMMAND_PATH = ".gemini/commands/truthmark/check.toml";
 var TRUTHMARK_GEMINI_PREVIEW_COMMAND_PATH = ".gemini/commands/truthmark/preview.toml";
+var TRUTHMARK_GEMINI_ROUTE_AUDITOR_AGENT_PATH = ".gemini/agents/truth-route-auditor.md";
+var TRUTHMARK_GEMINI_CLAIM_VERIFIER_AGENT_PATH = ".gemini/agents/truth-claim-verifier.md";
+var TRUTHMARK_GEMINI_DOC_REVIEWER_AGENT_PATH = ".gemini/agents/truth-doc-reviewer.md";
+var TRUTHMARK_GEMINI_DOC_WRITER_AGENT_PATH = ".gemini/agents/truth-doc-writer.md";
 var TRUTHMARK_COPILOT_STRUCTURE_PROMPT_PATH = ".github/prompts/truthmark-structure.prompt.md";
 var TRUTHMARK_COPILOT_DOCUMENT_PROMPT_PATH = ".github/prompts/truthmark-document.prompt.md";
 var TRUTHMARK_COPILOT_SYNC_PROMPT_PATH = ".github/prompts/truthmark-sync.prompt.md";
@@ -2564,9 +2739,11 @@ var TRUTHMARK_COPILOT_CLAIM_VERIFIER_AGENT_PATH = ".github/agents/truth-claim-ve
 var TRUTHMARK_COPILOT_DOC_REVIEWER_AGENT_PATH = ".github/agents/truth-doc-reviewer.agent.md";
 var TRUTHMARK_COPILOT_DOC_WRITER_AGENT_PATH = ".github/agents/truth-doc-writer.agent.md";
 var renderGeminiCommand = (description, prompt) => {
+  const promptWithArgs = `${prompt.trimEnd()}
+User focus or arguments: {{args}}`;
   return `description = "${description}"
 prompt = '''
-${prompt}
+${promptWithArgs}
 '''
 `;
 };
@@ -2707,6 +2884,56 @@ Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades
 ${body}
 `;
 };
+var renderHelperManifest = (helpers) => {
+  const manifest = {
+    helpers: Object.fromEntries(
+      helpers.map((helper) => [
+        helper.id,
+        {
+          optional: helper.optional,
+          runner: helper.runner,
+          command: helper.command,
+          inputs: helper.inputs,
+          output: helper.output,
+          writes: helper.writes,
+          ...helper.allowedWrites === void 0 ? {} : { allowedWrites: helper.allowedWrites },
+          fallback: helper.fallback
+        }
+      ])
+    )
+  };
+  return [
+    `# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.`,
+    stringify2(manifest, { lineWidth: 0 })
+  ].join("\n");
+};
+var renderHelperPolicySupport = (helpers) => {
+  const reportHelperId = helpers.find((helper) => helper.id.endsWith("-report"))?.id ?? helpers[0]?.id;
+  const helperLines = helpers.map(
+    (helper) => `- ${helper.id}: optional ${helper.runner}; manual fallback: ${helper.fallback}`
+  ).join("\n");
+  return renderSkillSupportFile(
+    "Optional Helper CLI Policy",
+    `Optional helper CLI commands may collect deterministic checkout facts or validate artifacts. If the Truthmark CLI is unavailable or too old for a declared helper, continue manually using this procedure and report which helper was skipped. Helper output is derived evidence; it does not override direct checkout inspection, workflow write boundaries, or parent acceptance.
+
+Runner detection:
+- Check the declared Truthmark CLI runner before invoking a helper.
+- Invoke helpers through the installed \`truthmark validate ... --json\` CLI command using argv-style arguments from helper-manifest.yml.
+- If unavailable or version-mismatched, treat the helper as skipped and use the manual fallback.
+- Do not fail the workflow solely because a helper cannot run.
+
+Available helpers:
+${helperLines}
+
+Final reports should include helper status when helpers are declared for this workflow:
+
+\`\`\`md
+Helper scripts:
+- ${reportHelperId}: ran, passed
+- validate-write-lease: skipped, no write lease used
+\`\`\``
+  );
+};
 var renderStandaloneWorkflowSkillBody = (workflowId, config) => {
   switch (workflowId) {
     case "truthmark-structure":
@@ -2723,10 +2950,11 @@ var renderStandaloneWorkflowSkillBody = (workflowId, config) => {
       return renderTruthCheckSkillBody(config);
   }
 };
-var renderWorkflowEntrypoint = (workflowId, config, supportFiles) => {
+var renderWorkflowEntrypoint = (workflowId, config, supportFiles, host) => {
   const workflow = getTruthmarkWorkflow(workflowId);
   const definition = WORKFLOW_PACKAGE_DEFINITIONS[workflowId];
   const supportFileList = supportFiles.map((supportFile) => `- ${supportFile}`).join("\n");
+  const hostUsage = host === "github-copilot" ? "Use as a Copilot agent skill. Prompt files remain available under `.github/prompts/` for command-style invocation in supported Copilot IDEs." : host === "gemini-cli" ? "Use as a Gemini CLI Agent Skill; commands remain available under `/truthmark:*` for command-first invocation." : void 0;
   return `---
 name: ${workflowId}
 description: ${workflow.description}
@@ -2738,6 +2966,9 @@ truthmark-version: ${TRUTHMARK_VERSION}
 # ${definition.title}
 
 ${definition.use(config)}
+${hostUsage === void 0 ? "" : `
+${hostUsage}
+`}
 
 Invocations: ${definition.invocations}
 
@@ -2778,6 +3009,18 @@ var renderWorkflowSubagentSupport = (workflowId, host) => {
         definition.parentRule,
         writeAgents
       );
+    case "github-copilot":
+      return renderCopilotCustomAgentModeSection(
+        readAgents,
+        definition.parentRule,
+        writeAgents
+      );
+    case "gemini-cli":
+      return renderGeminiSubagentModeSection(
+        readAgents,
+        definition.parentRule,
+        writeAgents
+      );
   }
 };
 var renderTruthmarkSkillPackage = ({
@@ -2792,16 +3035,18 @@ var renderTruthmarkSkillPackage = ({
     renderStandaloneWorkflowSkillBody(workflowId, config)
   );
   const subagents = renderWorkflowSubagentSupport(workflowId, host);
+  const helpers = getTruthmarkWorkflow(workflowId).helpers ?? [];
   const supportFiles = [
     "support/procedure.md",
     "support/report-template.md",
-    ...subagents === void 0 ? [] : ["support/subagents-and-leases.md"]
+    ...subagents === void 0 ? [] : ["support/subagents-and-leases.md"],
+    ...helpers.length === 0 ? [] : ["helper-manifest.yml", "support/helper-policy.md"]
   ];
   const definition = WORKFLOW_PACKAGE_DEFINITIONS[workflowId];
   const files = [
     {
       path: skillPath,
-      content: renderWorkflowEntrypoint(workflowId, config, supportFiles)
+      content: renderWorkflowEntrypoint(workflowId, config, supportFiles, host)
     },
     {
       path: `${supportDirectory}/procedure.md`,
@@ -2827,6 +3072,18 @@ var renderTruthmarkSkillPackage = ({
       )
     });
   }
+  if (helpers.length > 0) {
+    files.push(
+      {
+        path: `${skillDirectory}/helper-manifest.yml`,
+        content: renderHelperManifest(helpers)
+      },
+      {
+        path: `${supportDirectory}/helper-policy.md`,
+        content: renderHelperPolicySupport(helpers)
+      }
+    );
+  }
   return files;
 };
 var normalizeOpenCodePermissionPath = (path12) => {
@@ -2982,6 +3239,45 @@ tools: [read, search, edit]
 
 # Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
 
+${instructions}
+`;
+};
+var renderGeminiReadOnlyAgent = ({
+  copilotName,
+  description,
+  instructions
+}) => {
+  const agentInstructions = renderReadOnlySubagentInstructions(instructions);
+  return `---
+name: ${copilotName}
+description: ${description}
+kind: local
+tools: [read_file, grep_search]
+---
+
+# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
+
+Manual invocation: @${copilotName}
+
+${agentInstructions}
+`;
+};
+var renderGeminiWriteAgent = ({
+  copilotName,
+  description,
+  instructions
+}) => {
+  return `---
+name: ${copilotName}
+description: ${description}
+kind: local
+tools: [read_file, grep_search, write_file]
+---
+
+# Generated by Truthmark ${TRUTHMARK_VERSION}. Rerun truthmark init after upgrades.
+
+Manual invocation: @${copilotName} with an explicit parent write lease.
+
 ${instructions}
 `;
 };
@@ -3084,6 +3380,26 @@ var renderTruthmarkCopilotDocWriterAgent = () => {
     TRUTHMARK_WRITE_SUBAGENT_PROFILES.truth_doc_writer
   );
 };
+var renderTruthmarkGeminiRouteAuditorAgent = () => {
+  return renderGeminiReadOnlyAgent(
+    TRUTHMARK_SUBAGENT_PROFILES.truth_route_auditor
+  );
+};
+var renderTruthmarkGeminiClaimVerifierAgent = () => {
+  return renderGeminiReadOnlyAgent(
+    TRUTHMARK_SUBAGENT_PROFILES.truth_claim_verifier
+  );
+};
+var renderTruthmarkGeminiDocReviewerAgent = () => {
+  return renderGeminiReadOnlyAgent(
+    TRUTHMARK_SUBAGENT_PROFILES.truth_doc_reviewer
+  );
+};
+var renderTruthmarkGeminiDocWriterAgent = () => {
+  return renderGeminiWriteAgent(
+    TRUTHMARK_WRITE_SUBAGENT_PROFILES.truth_doc_writer
+  );
+};
 var renderTruthmarkClaudeRouteAuditorAgent = () => {
   return renderClaudeReadOnlyAgent(
     TRUTHMARK_SUBAGENT_PROFILES.truth_route_auditor
@@ -3644,6 +3960,42 @@ var claudeFiles = (config, block) => {
 var copilotFiles = (config, block) => {
   const files = [
     ...instructionBlockFiles([".github/copilot-instructions.md"], block),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".github/skills/truthmark-structure/SKILL.md",
+      workflowId: "truthmark-structure",
+      host: "github-copilot",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".github/skills/truthmark-document/SKILL.md",
+      workflowId: "truthmark-document",
+      host: "github-copilot",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".github/skills/truthmark-sync/SKILL.md",
+      workflowId: "truthmark-sync",
+      host: "github-copilot",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".github/skills/truthmark-preview/SKILL.md",
+      workflowId: "truthmark-preview",
+      host: "github-copilot",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".github/skills/truthmark-check/SKILL.md",
+      workflowId: "truthmark-check",
+      host: "github-copilot",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".github/skills/truthmark-realize/SKILL.md",
+      workflowId: "truthmark-realize",
+      host: "github-copilot",
+      config
+    }),
     {
       path: TRUTHMARK_COPILOT_STRUCTURE_PROMPT_PATH,
       content: renderTruthmarkCopilotStructurePrompt(config)
@@ -3687,6 +4039,87 @@ var copilotFiles = (config, block) => {
   ];
   return files;
 };
+var geminiFiles = (config, block) => {
+  return [
+    ...instructionBlockFiles(["GEMINI.md"], block),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".gemini/skills/truthmark-structure/SKILL.md",
+      workflowId: "truthmark-structure",
+      host: "gemini-cli",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".gemini/skills/truthmark-document/SKILL.md",
+      workflowId: "truthmark-document",
+      host: "gemini-cli",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".gemini/skills/truthmark-sync/SKILL.md",
+      workflowId: "truthmark-sync",
+      host: "gemini-cli",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".gemini/skills/truthmark-preview/SKILL.md",
+      workflowId: "truthmark-preview",
+      host: "gemini-cli",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".gemini/skills/truthmark-check/SKILL.md",
+      workflowId: "truthmark-check",
+      host: "gemini-cli",
+      config
+    }),
+    ...renderTruthmarkSkillPackage({
+      skillPath: ".gemini/skills/truthmark-realize/SKILL.md",
+      workflowId: "truthmark-realize",
+      host: "gemini-cli",
+      config
+    }),
+    {
+      path: TRUTHMARK_GEMINI_STRUCTURE_COMMAND_PATH,
+      content: renderTruthmarkGeminiStructureCommand(config)
+    },
+    {
+      path: TRUTHMARK_GEMINI_DOCUMENT_COMMAND_PATH,
+      content: renderTruthmarkGeminiDocumentCommand(config)
+    },
+    {
+      path: TRUTHMARK_GEMINI_SYNC_COMMAND_PATH,
+      content: renderTruthmarkGeminiSyncCommand(config)
+    },
+    {
+      path: TRUTHMARK_GEMINI_PREVIEW_COMMAND_PATH,
+      content: renderTruthmarkGeminiPreviewCommand(config)
+    },
+    {
+      path: TRUTHMARK_GEMINI_CHECK_COMMAND_PATH,
+      content: renderTruthmarkGeminiCheckCommand(config)
+    },
+    {
+      path: TRUTHMARK_GEMINI_REALIZE_COMMAND_PATH,
+      content: renderTruthmarkGeminiRealizeCommand(config)
+    },
+    {
+      path: TRUTHMARK_GEMINI_ROUTE_AUDITOR_AGENT_PATH,
+      content: renderTruthmarkGeminiRouteAuditorAgent()
+    },
+    {
+      path: TRUTHMARK_GEMINI_CLAIM_VERIFIER_AGENT_PATH,
+      content: renderTruthmarkGeminiClaimVerifierAgent()
+    },
+    {
+      path: TRUTHMARK_GEMINI_DOC_REVIEWER_AGENT_PATH,
+      content: renderTruthmarkGeminiDocReviewerAgent()
+    },
+    {
+      path: TRUTHMARK_GEMINI_DOC_WRITER_AGENT_PATH,
+      content: renderTruthmarkGeminiDocWriterAgent()
+    }
+  ];
+};
 var instructionBlockFiles = (paths, block) => {
   return paths.map((path12) => ({
     path: path12,
@@ -3705,33 +4138,7 @@ var filesForPlatform = (platform, config, block) => {
     case "github-copilot":
       return copilotFiles(config, block);
     case "gemini-cli":
-      return [
-        ...instructionBlockFiles(["GEMINI.md"], block),
-        {
-          path: TRUTHMARK_GEMINI_STRUCTURE_COMMAND_PATH,
-          content: renderTruthmarkGeminiStructureCommand(config)
-        },
-        {
-          path: TRUTHMARK_GEMINI_DOCUMENT_COMMAND_PATH,
-          content: renderTruthmarkGeminiDocumentCommand(config)
-        },
-        {
-          path: TRUTHMARK_GEMINI_SYNC_COMMAND_PATH,
-          content: renderTruthmarkGeminiSyncCommand(config)
-        },
-        {
-          path: TRUTHMARK_GEMINI_PREVIEW_COMMAND_PATH,
-          content: renderTruthmarkGeminiPreviewCommand(config)
-        },
-        {
-          path: TRUTHMARK_GEMINI_CHECK_COMMAND_PATH,
-          content: renderTruthmarkGeminiCheckCommand(config)
-        },
-        {
-          path: TRUTHMARK_GEMINI_REALIZE_COMMAND_PATH,
-          content: renderTruthmarkGeminiRealizeCommand(config)
-        }
-      ];
+      return geminiFiles(config, block);
   }
 };
 var renderGeneratedSurfaces = (config, block = renderAgentsBlock(config)) => {
@@ -5268,6 +5675,18 @@ var discoverRepoFiles = async (rootDir, ignore) => {
   const docs = [];
   const tests = [];
   for (const filePath of discoveredFiles.filter((entry) => !isIgnoredPath(entry, ignore)).sort()) {
+    let stat;
+    try {
+      stat = await fs16.stat(path5.join(rootDir, filePath));
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+        continue;
+      }
+      throw error;
+    }
+    if (!stat.isFile()) {
+      continue;
+    }
     const extension = path5.posix.extname(filePath);
     const kind = fileKind(filePath, ignore);
     files.push({
@@ -6294,6 +6713,319 @@ var renderContextPackMarkdown = (pack) => {
 `;
 };
 
+// src/cli/handlers.ts
+import fs23 from "fs/promises";
+
+// src/agents/workflow-helper-validation.ts
+import { parse as parseYaml2 } from "yaml";
+var escapeRegex = (value) => value.split("").map((char) => ".+*?^$()[]{}|\\".includes(char) ? `\\${char}` : char).join("");
+var hasLabel = (text, label) => {
+  const escaped = escapeRegex(label);
+  return new RegExp(String.raw`(^|\n)\s*(?:#{1,6}\s*)?${escaped}\s*:?\s*(\n|$)`, "iu").test(
+    text
+  );
+};
+var getSection = (text, label) => {
+  const lines = text.split(/\r?\n/u);
+  const labelPattern = new RegExp(String.raw`^(?:#{1,6}\s*)?${escapeRegex(label)}\s*:?\s*$`, "iu");
+  const sectionHeaderPattern = /^(?:#{1,6}\s*)?[A-Z][A-Za-z0-9 ]+:\s*$/u;
+  const startIndex = lines.findIndex((line) => labelPattern.test(line));
+  if (startIndex === -1) {
+    return null;
+  }
+  const nextSectionOffset = lines.slice(startIndex + 1).findIndex((line) => sectionHeaderPattern.test(line));
+  const endIndex = nextSectionOffset === -1 ? lines.length : startIndex + 1 + nextSectionOffset;
+  return lines.slice(startIndex + 1, endIndex).join("\n").trim();
+};
+var requireBulletSection = (text, label, errors, checks) => {
+  const section = getSection(text, label);
+  if (section === null) {
+    errors.push(`missing required section: ${label}`);
+    return;
+  }
+  if (!/^-\s+\S/mu.test(section)) {
+    errors.push(`${label} must include at least one bullet`);
+    return;
+  }
+  checks.push(label);
+};
+var validateEvidenceChecked = (text, errors, checks) => {
+  const section = getSection(text, "Evidence checked");
+  if (section === null || section === "") {
+    errors.push("Evidence checked must include at least one structured entry");
+    return;
+  }
+  const entries = section.split(/\n(?=-\s+)/u).map((entry) => entry.trim()).filter(Boolean);
+  if (entries.length === 0) {
+    errors.push("Evidence checked must include at least one structured entry");
+    return;
+  }
+  const entryPattern = /^- Claim:\s*\S[^\n]*\n {2,}Evidence:\s*\S[^\n]*\n {2,}Result:\s*(supported|narrowed|removed|blocked)\s*$/iu;
+  for (const [index, entry] of entries.entries()) {
+    if (!entryPattern.test(entry)) {
+      errors.push(
+        `Evidence checked entry ${index + 1} must match '- Claim: ...' followed by indented 'Evidence: ...' and 'Result: supported | narrowed | removed | blocked'`
+      );
+    }
+  }
+  if (errors.length === 0) {
+    checks.push(
+      "Evidence checked entries include Claim:, Evidence:, and Result: supported | narrowed | removed | blocked"
+    );
+  }
+};
+var validateHelperScriptEntries = (entries, requiredHelpers, errors, checks) => {
+  if (entries === void 0 || entries.length === 0) {
+    errors.push("Helper scripts must include status for optional helpers");
+    return;
+  }
+  const statusPattern = /^(?:-\s*)?([a-z0-9-]+):\s*(?:ran,\s*passed|skipped,\s*\S.*)$/iu;
+  const validHelperIds = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    const match = entry.trim().match(statusPattern);
+    if (match === null) {
+      errors.push(
+        "Helper scripts entries must match '- helper-id: ran, passed' or '- helper-id: skipped, reason'; ran, failed is not valid for completed reports"
+      );
+      continue;
+    }
+    validHelperIds.add(match[1].toLowerCase());
+  }
+  for (const helperId of requiredHelpers) {
+    if (!validHelperIds.has(helperId.toLowerCase())) {
+      errors.push(`missing Helper scripts status: ${helperId}`);
+    }
+  }
+  if (errors.length === 0) {
+    checks.push(`Helper scripts statuses include ${requiredHelpers.join(", ")}`);
+  }
+};
+var validateHelperScripts = (text, requiredHelpers, errors, checks) => {
+  const section = getSection(text, "Helper scripts");
+  const entries = section?.split(/\n/u).map((entry) => entry.trim()).filter(Boolean);
+  validateHelperScriptEntries(entries, requiredHelpers, errors, checks);
+};
+var validateTruthSyncReportText = (text) => {
+  const helper = "validate-sync-report";
+  const statusMatch = text.match(/^\s*Truth Sync:\s*(completed|blocked|skipped)\b/imu);
+  if (statusMatch === null) {
+    return {
+      ok: false,
+      helper,
+      errors: ["missing Truth Sync status: expected completed, blocked, or skipped"]
+    };
+  }
+  const status = statusMatch[1].toLowerCase();
+  const checks = [`status: ${status}`];
+  const errors = [];
+  if (status === "completed") {
+    try {
+      const report = parseTruthSyncReport(text.trimStart());
+      for (const [label, items] of [
+        ["Changed code reviewed", report.changedCode],
+        ["Ownership reviewed", report.ownershipReviewed],
+        ["Truth docs updated", report.truthDocsUpdated],
+        ["Notes", report.notes]
+      ]) {
+        if (items.length === 0) {
+          errors.push(`${label} must include at least one bullet`);
+        } else {
+          checks.push(label);
+        }
+      }
+      if (report.evidenceChecked.length === 0) {
+        errors.push("Evidence checked must include at least one structured entry");
+      } else {
+        checks.push(
+          "Evidence checked entries include Claim:, Evidence:, and Result: supported | narrowed | removed | blocked"
+        );
+      }
+      validateHelperScriptEntries(
+        report.helperScripts,
+        ["validate-write-lease"],
+        errors,
+        checks
+      );
+    } catch (error) {
+      errors.push(error instanceof Error ? error.message : "invalid Truth Sync report");
+    }
+  } else if (status === "skipped") {
+    requireBulletSection(text, "Reason", errors, checks);
+  } else if (status === "blocked") {
+    requireBulletSection(text, "Reason", errors, checks);
+    requireBulletSection(text, "Files requiring manual review", errors, checks);
+    requireBulletSection(text, "Next action", errors, checks);
+  }
+  return errors.length > 0 ? { ok: false, helper, errors } : { ok: true, helper, checks };
+};
+var validateTruthDocumentReportText = (text) => {
+  const helper = "validate-document-report";
+  const statusMatch = text.match(/^\s*Truth Document:\s*(completed|blocked)\b/imu);
+  if (statusMatch === null) {
+    return {
+      ok: false,
+      helper,
+      errors: ["missing Truth Document status: expected completed or blocked"]
+    };
+  }
+  const status = statusMatch[1].toLowerCase();
+  const checks = [`status: ${status}`];
+  const errors = [];
+  if (status === "completed") {
+    for (const label of ["Implementation reviewed", "Ownership reviewed", "Notes"]) {
+      requireBulletSection(text, label, errors, checks);
+    }
+    if (hasLabel(text, "Evidence checked")) {
+      checks.push("Evidence checked");
+    } else {
+      errors.push("missing required section: Evidence checked");
+    }
+    if (hasLabel(text, "Helper scripts")) {
+      checks.push("Helper scripts");
+    } else {
+      errors.push("missing required section: Helper scripts");
+    }
+    const truthDocsUpdated = getSection(text, "Truth docs updated");
+    const truthDocsCreated = getSection(text, "Truth docs created");
+    if (truthDocsUpdated === null && truthDocsCreated === null) {
+      errors.push("missing required section: Truth docs updated or Truth docs created");
+    } else if (![truthDocsUpdated, truthDocsCreated].some(
+      (section) => section !== null && /^-\s+\S/mu.test(section)
+    )) {
+      errors.push("Truth docs updated or Truth docs created must include at least one bullet");
+    } else {
+      checks.push("Truth docs updated or created");
+    }
+    validateEvidenceChecked(text, errors, checks);
+    validateHelperScripts(text, ["validate-write-lease"], errors, checks);
+  } else if (status === "blocked") {
+    requireBulletSection(text, "Reason", errors, checks);
+  }
+  return errors.length > 0 ? { ok: false, helper, errors } : { ok: true, helper, checks };
+};
+var cleanPathValue = (value) => value.trim().replace(/^["']|["']$/gu, "");
+var normalizePath5 = (value) => cleanPathValue(value).replace(/^\.\//u, "");
+var windowsDriveAbsolutePattern = /^[A-Za-z]:[\\/]/u;
+var uncPathPattern = /^[/\\]{2}[^/\\]+[/\\]+[^/\\]+/u;
+var isUnsafePathValue = (value) => {
+  const cleanValue = cleanPathValue(value);
+  const pathValue = cleanValue.endsWith("/**") ? cleanValue.slice(0, -3) : cleanValue;
+  return pathValue.startsWith("/") || pathValue.startsWith("\\") || windowsDriveAbsolutePattern.test(pathValue) || uncPathPattern.test(pathValue) || pathValue.split(/[\\/]+/u).includes("..");
+};
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var findWriteLeaseRecord = (value) => {
+  if (!isRecord(value)) {
+    return null;
+  }
+  if (Object.prototype.hasOwnProperty.call(value, "allowedWrites") || Object.prototype.hasOwnProperty.call(value, "forbiddenWrites")) {
+    return value;
+  }
+  for (const nestedKey of ["writeLease", "lease"]) {
+    const nested = value[nestedKey];
+    if (isRecord(nested)) {
+      return nested;
+    }
+  }
+  return value;
+};
+var readStringArray = (record, field, errors) => {
+  const value = record[field];
+  if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) {
+    errors.push(`${field} must be an array of strings`);
+    return [];
+  }
+  return value;
+};
+var parseListFields = (text) => {
+  const errors = [];
+  let parsed;
+  try {
+    parsed = parseYaml2(text);
+  } catch (error) {
+    return {
+      allowedWrites: [],
+      forbiddenWrites: [],
+      errors: [
+        `manual-validation required: invalid write lease YAML${error instanceof Error ? `: ${error.message}` : ""}`
+      ]
+    };
+  }
+  const record = findWriteLeaseRecord(parsed);
+  if (record === null) {
+    return {
+      allowedWrites: [],
+      forbiddenWrites: [],
+      errors: ["write lease YAML must be an object"]
+    };
+  }
+  return {
+    allowedWrites: readStringArray(record, "allowedWrites", errors),
+    forbiddenWrites: readStringArray(record, "forbiddenWrites", errors),
+    errors
+  };
+};
+var isSupportedPattern = (pattern) => {
+  const withoutTrailingGlob = pattern.endsWith("/**") ? pattern.slice(0, -3) : pattern;
+  return !/[?*[\]{}]/u.test(withoutTrailingGlob);
+};
+var matchesPattern = (filePath, pattern) => {
+  if (pattern.endsWith("/**")) {
+    const prefix = pattern.slice(0, -3).replace(/\/+$/u, "");
+    return filePath === prefix || filePath.startsWith(`${prefix}/`);
+  }
+  return filePath === pattern;
+};
+var validateWriteLeaseText = (leaseText, changedText) => {
+  const helper = "validate-write-lease";
+  const parsed = parseListFields(leaseText);
+  const rawAllowedWrites = parsed.allowedWrites.map(cleanPathValue).filter(Boolean);
+  const rawForbiddenWrites = parsed.forbiddenWrites.map(cleanPathValue).filter(Boolean);
+  const rawChangedFiles = changedText.split(/\r?\n/u).map(cleanPathValue).filter(Boolean);
+  const allowedWrites = rawAllowedWrites.map(normalizePath5).filter(Boolean);
+  const forbiddenWrites = rawForbiddenWrites.map(normalizePath5).filter(Boolean);
+  const changedFiles = rawChangedFiles.map(normalizePath5).filter(Boolean);
+  const checks = [];
+  const errors = [...parsed.errors];
+  for (const pattern of rawAllowedWrites) {
+    if (isUnsafePathValue(pattern)) {
+      errors.push(`invalid allowedWrites path: ${pattern}`);
+    }
+  }
+  for (const pattern of rawForbiddenWrites) {
+    if (isUnsafePathValue(pattern)) {
+      errors.push(`invalid forbiddenWrites path: ${pattern}`);
+    }
+  }
+  for (const filePath of rawChangedFiles) {
+    if (isUnsafePathValue(filePath)) {
+      errors.push(`invalid changed file path: ${filePath}`);
+    }
+  }
+  for (const pattern of [...allowedWrites, ...forbiddenWrites]) {
+    if (!isSupportedPattern(pattern)) {
+      errors.push(`manual-validation required: unsupported write pattern ${pattern}`);
+    }
+  }
+  if (allowedWrites.length === 0) {
+    errors.push("manual-validation required: no allowedWrites entries found");
+  }
+  if (errors.length === 0) {
+    for (const filePath of changedFiles) {
+      if (!allowedWrites.some((pattern) => matchesPattern(filePath, pattern))) {
+        errors.push(`${filePath} is outside allowedWrites`);
+        continue;
+      }
+      const forbiddenPattern = forbiddenWrites.find((pattern) => matchesPattern(filePath, pattern));
+      if (forbiddenPattern !== void 0) {
+        errors.push(`${filePath} matches forbiddenWrites pattern ${forbiddenPattern}`);
+        continue;
+      }
+      checks.push(filePath);
+    }
+  }
+  return errors.length > 0 ? { ok: false, helper, errors } : { ok: true, helper, checks };
+};
+
 // src/cli/handlers.ts
 var runConfig2 = async (options) => {
   return runConfig(process.cwd(), options);
@@ -6350,6 +7082,33 @@ var isContextPackWorkflow = (value) => {
 var isContextPackFormat = (value) => {
   return value === void 0 || value === "json" || value === "markdown";
 };
+var readHelperFile = async (filePath, helper) => {
+  try {
+    return await fs23.readFile(filePath, "utf8");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, helper, errors: [`could not read file: ${message}`] };
+  }
+};
+var runValidateSyncReport = async (reportFile) => {
+  const text = await readHelperFile(reportFile, "validate-sync-report");
+  return typeof text === "string" ? validateTruthSyncReportText(text) : text;
+};
+var runValidateDocumentReport = async (reportFile) => {
+  const text = await readHelperFile(reportFile, "validate-document-report");
+  return typeof text === "string" ? validateTruthDocumentReportText(text) : text;
+};
+var runValidateWriteLease = async (leaseFile, changedFilesFile) => {
+  const leaseText = await readHelperFile(leaseFile, "validate-write-lease");
+  if (typeof leaseText !== "string") {
+    return leaseText;
+  }
+  const changedText = await readHelperFile(changedFilesFile, "validate-write-lease");
+  if (typeof changedText !== "string") {
+    return changedText;
+  }
+  return validateWriteLeaseText(leaseText, changedText);
+};
 var runContext = async (options) => {
   if (!isContextPackWorkflow(options.workflow)) {
     return {
@@ -6406,6 +7165,28 @@ var writeContextResult = (result, options) => {
   }
   writeResult(result, options);
 };
+var renderValidationHuman = (result) => {
+  if (result.ok === true) {
+    return [`${result.helper}: ok`, ...result.checks.map((check) => `- ${check}`)].join("\n");
+  }
+  return [`${result.helper}: failed`, ...result.errors.map((error) => `- ${error}`)].join("\n");
+};
+var toValidationCommandResult = (command, result) => ({
+  command,
+  summary: result.ok ? "Validation passed" : "Validation failed",
+  diagnostics: [],
+  data: {
+    validation: result
+  }
+});
+var writeValidationResult = (command, result, options) => {
+  const output = options.json ? renderJson(toValidationCommandResult(command, result)) : renderValidationHuman(result);
+  process.stdout.write(`${output}
+`);
+  if (!result.ok) {
+    process.exitCode = 1;
+  }
+};
 var addJsonOption = (command) => {
   return command.option("--json", "Render command output as JSON");
 };
@@ -6449,6 +7230,32 @@ var buildProgram = () => {
       options
     );
   });
+  const validate = program.command("validate").description("Run optional Truthmark workflow helper validators from the installed CLI.");
+  addJsonOption(
+    validate.command("sync-report").description("Validate a Truth Sync report file.").argument("<report-file>", "Truth Sync report file")
+  ).action(async (reportFile, options) => {
+    writeValidationResult("validate sync-report", await runValidateSyncReport(reportFile), options);
+  });
+  addJsonOption(
+    validate.command("document-report").description("Validate a Truth Document report file.").argument("<report-file>", "Truth Document report file")
+  ).action(async (reportFile, options) => {
+    writeValidationResult(
+      "validate document-report",
+      await runValidateDocumentReport(reportFile),
+      options
+    );
+  });
+  addJsonOption(
+    validate.command("write-lease").description("Validate a workflow write lease or worker report against changed files.").argument("<lease-or-report-file>", "Lease or worker report file").argument("<changed-files-file>", "Newline-separated changed file list")
+  ).action(
+    async (leaseOrReportFile, changedFilesFile, options) => {
+      writeValidationResult(
+        "validate write-lease",
+        await runValidateWriteLease(leaseOrReportFile, changedFilesFile),
+        options
+      );
+    }
+  );
   return program;
 };