specpro-cli 0.1.0__py3-none-any.whl

specpro_cli/assets/scripts/powershell/verify-cumulative-records.ps1

@@ -0,0 +1,133 @@
+# Cumulative-record verifier — PowerShell twin of verify-cumulative-records.sh.
+#
+# FR-008 requires the two implementations to be stdout/stderr/exit-code byte-identical;
+# tools/install/tests/test_script_parity.py asserts it on every fixture.
+#
+# The rationale, the measured failure it comes from, the two-sided DERIVATION design (no
+# registries — that is what makes it fixtureable without editing the subject), and the
+# stated coverage limits are argued in the `.sh` twin. This file is the same program, and
+# the two are changed together.
+
+$ErrorActionPreference = 'Continue'
+
+# Base resolution mirrors the shell twin: an explicit override for fixtures, else the
+# repository root two levels up from this script.
+$Base = if ($env:RECORDS_HOOK_BASE) { $env:RECORDS_HOOK_BASE }
+        else { (Resolve-Path (Join-Path $PSScriptRoot '..' '..')).Path }
+
+$script:Hits = 0
+function Write-Ok   { param([string]$m) Write-Output "  ✓ $m" }
+function Write-Hit  { param([string]$m) $script:Hits++; Write-Output "  ✗ $m" }
+function Write-Skip { param([string]$m) Write-Output "  ⊘ $m" }
+
+Write-Output "Cumulative-record check: $Base"
+
+# Resolve a destination variable to a path SUFFIX by reading its binding in the same
+# document: drop up to and including the last `$`, then cut at the first `/`. Only the
+# suffix is compared, so the binding's own base variable never has to be resolved.
+function Get-DestSuffix {
+    param([string]$Doc, [string]$Var)
+    $path = Join-Path $Base $Doc
+    if (-not (Test-Path -LiteralPath $path -PathType Leaf)) { return '' }
+    $m = [regex]::Match((Get-Content -LiteralPath $path -Raw), "^\s*$([regex]::Escape($Var))=""([^""]*)""", 'Multiline')
+    if (-not $m.Success) { return '' }
+    $binding = $m.Groups[1].Value
+    $idx = $binding.LastIndexOf('$')
+    if ($idx -lt 0) { return '' }
+    $binding = $binding.Substring($idx + 1)
+    $slash = $binding.IndexOf('/')
+    if ($slash -lt 0) { return '' }
+    return $binding.Substring($slash + 1)
+}
+
+# -----------------------------------------------------------------------------------------
+# 1. Records — every file under specs/ that declares itself cumulative
+# -----------------------------------------------------------------------------------------
+Write-Output "  [1] cross-round records (self-declared: ``**Cumulative**: …``)"
+$records = @()
+$specsDir = Join-Path $Base 'specs'
+if (Test-Path -LiteralPath $specsDir -PathType Container) {
+    $records = Get-ChildItem -LiteralPath $specsDir -Recurse -Filter *.md -File |
+        Where-Object { (Get-Content -LiteralPath $_.FullName -Raw) -cmatch '(?m)^\*\*Cumulative\*\*: ' } |
+        ForEach-Object { $_.FullName.Substring($Base.Length + 1) -replace '\\', '/' } |
+        Sort-Object
+}
+if ($records.Count -eq 0) {
+    # A SKIP, not a hit: this script ships with the tool, and a user project may legitimately
+    # have no cross-round record at all. The cost is real and stated — un-declaring a record
+    # turns this check off for it — which is why the declaration lives in the record's header.
+    Write-Skip "no file under specs/ declares itself cumulative — nothing is proven"
+} else {
+    foreach ($r in $records) { Write-Ok "record: $r" }
+}
+
+# -----------------------------------------------------------------------------------------
+# 2. Rebuild sites — a `cp` in commands/ whose destination is a shell variable
+# -----------------------------------------------------------------------------------------
+# The optional closing quote is load-bearing — see the shell twin.
+Write-Output "  [2] wholesale-rebuild sites (``cp`` to a shell variable in commands/)"
+$rebuildRe = '^\s*cp\s+.*\$[A-Za-z_][A-Za-z0-9_]*["'']?\s*$'
+$varRe = '\$[A-Za-z_][A-Za-z0-9_]*'
+$sites = @()
+$cmdDir = Join-Path $Base 'commands'
+if (Test-Path -LiteralPath $cmdDir -PathType Container) {
+    $files = Get-ChildItem -LiteralPath $cmdDir -Filter *.md -File | Sort-Object Name
+    foreach ($f in $files) {
+        $rel = $f.FullName.Substring($Base.Length + 1) -replace '\\', '/'
+        $n = 0
+        foreach ($line in (Get-Content -LiteralPath $f.FullName)) {
+            $n++
+            if ($line -notmatch $rebuildRe) { continue }
+            $sites += ,@($rel, $n, ($line -replace '^\s+', ''))
+        }
+    }
+}
+foreach ($s in $sites) {
+    $rel = $s[0]; $num = $s[1]; $text = $s[2]
+    $vars = [regex]::Matches($text, $varRe)
+    $var = if ($vars.Count -gt 0) { $vars[$vars.Count - 1].Value.TrimStart('$') } else { '' }
+    $suffix = Get-DestSuffix -Doc $rel -Var $var
+    if ([string]::IsNullOrEmpty($suffix)) {
+        Write-Hit "rebuild site: cannot resolve `$$var in $rel`:$num — nothing is proven about it"
+        continue
+    }
+    Write-Ok "rebuild site: $rel`:$num → $suffix"
+}
+if ($sites.Count -eq 0) {
+    Write-Skip 'no `cp … $VAR` line found in commands/ — nothing is proven about rebuild sites'
+}
+
+# -----------------------------------------------------------------------------------------
+# 3. The proposition: no record sits where a rebuild lands
+# -----------------------------------------------------------------------------------------
+Write-Output "  [3] no cross-round record sits on a rebuild path"
+$checked = 0
+foreach ($s in $sites) {
+    $rel = $s[0]; $text = $s[2]
+    $vars = [regex]::Matches($text, $varRe)
+    $var = if ($vars.Count -gt 0) { $vars[$vars.Count - 1].Value.TrimStart('$') } else { '' }
+    $suffix = Get-DestSuffix -Doc $rel -Var $var
+    if ([string]::IsNullOrEmpty($suffix)) { continue }
+    foreach ($r in $records) {
+        $checked++
+        if ($r.EndsWith("/$suffix") -or $r -ceq $suffix) {
+            Write-Hit "a cross-round record lives in an artifact rebuilt wholesale — $r (rebuilt by $rel)"
+        } else {
+            Write-Ok "not on a rebuild path: $r"
+        }
+    }
+}
+if ($checked -eq 0) {
+    Write-Skip 'no (record × rebuild site) pair to compare — nothing is proven'
+}
+
+# -----------------------------------------------------------------------------------------
+# Coverage, stated rather than implied — see the shell twin for the full note.
+# -----------------------------------------------------------------------------------------
+Write-Output ""
+if ($script:Hits -gt 0) {
+    Write-Output "✗ cumulative records: $($script:Hits) violation(s)"
+    exit 1
+}
+Write-Output "✓ cumulative records: no record sits on a rebuild path"
+exit 0

specpro_cli/assets/scripts/powershell/verify-deliverables-tracked.ps1

@@ -0,0 +1,112 @@
+#!/usr/bin/env pwsh
+#
+# Deliverables-tracked verifier — PowerShell twin of scripts/bash/verify-deliverables-tracked.sh.
+#
+# Same stdout, same exit code, per FR-008. The rationale (the three deliverable
+# classes and the ISS-75 scope rule) lives in the bash side's header; keep the two in step.
+#
+# `.Contains`-style checks and explicit loops stand in for the bash `case`/parameter
+# expansions; brace expansion is re-implemented here as prefix/suffix splitting —
+# one level, exactly like the bash side.
+
+$Repo = git rev-parse --show-toplevel 2>$null
+if (-not $Repo -or -not (Test-Path $Repo)) {
+    Write-Output "deliverables-tracked: not inside a git repository"
+    exit 1
+}
+$Repo = (Resolve-Path $Repo).Path
+Write-Output "deliverables-tracked: $Repo"
+$Fail = $false
+
+# --- class ② — deliverable source dirs in THIS repo --------------------------
+$SrcDirs = @('commands', 'templates', 'scripts', 'tools')
+$untracked = git -C $Repo ls-files --others --exclude-standard -- @SrcDirs
+if ($untracked) {
+    $Fail = $true
+    Write-Output ("✗ class ② — untracked files under deliverable source dirs ({0}):" -f ($SrcDirs -join ' '))
+    $untracked | ForEach-Object { Write-Output "      $_" }
+} else {
+    Write-Output ("✓ class ② — source dirs ({0}): every file tracked" -f ($SrcDirs -join ' '))
+}
+
+# --- class ③ — artifact repos (specs/ · docs/) --------------------------------
+foreach ($sub in @('specs', 'docs')) {
+    if (Test-Path (Join-Path $Repo "$sub/.git")) {
+        $u = git -C (Join-Path $Repo $sub) ls-files --others --exclude-standard
+        if ($u) {
+            $Fail = $true
+            Write-Output "✗ class ③ — untracked files in the $sub/ artifact repo:"
+            $u | ForEach-Object { Write-Output "      $_" }
+        } else {
+            Write-Output "✓ class ③ — artifact repo $sub/: every file tracked"
+        }
+    }
+}
+
+# --- class ① — Location paths named by CHECKED tasks --------------------------
+# Three-conditioned verdict (see the bash side): tracked -> verified; on disk but
+# untracked -> real violation; ignored BY DESIGN (derived deploy mirror) -> skipped;
+# absent from disk -> skipped. Backtick segments include descriptions' code words,
+# so "untracked" alone accuses non-paths.
+$tasks = Join-Path $Repo 'specs/tasks.md'
+$checkedN = 0
+$skippedN = 0
+if (Test-Path $tasks) {
+    $lines = Select-String -Path $tasks -Pattern '^- \[x\] T[0-9]' | ForEach-Object { $_.Line }
+    foreach ($line in $lines) {
+        $segs = [regex]::Matches($line, '`([^`]+)`') | ForEach-Object { $_.Groups[1].Value }
+        foreach ($seg in $segs) {
+            if (-not $seg) { continue }
+            if ($seg -match ' ') { $skippedN++; continue }   # prose/note
+            if ($seg.StartsWith('/')) { $skippedN++; continue }  # absolute
+
+            $repoPath = $Repo
+            $rel = $seg
+            if ($seg.StartsWith('specs/')) { $repoPath = Join-Path $Repo 'specs'; $rel = $seg.Substring(6) }
+            elseif ($seg.StartsWith('docs/')) { $repoPath = Join-Path $Repo 'docs'; $rel = $seg.Substring(5) }
+
+            # A segment that reduces to an empty path (`specs/` bare) is not a path —
+            # feeding it to git only produces a pathspec error (T254).
+            if ([string]::IsNullOrEmpty($rel)) { $skippedN++; continue }
+
+            $rels = @($rel)
+            if ($rel -match '\{([^{}]*)\}') {
+                $openIdx = $rel.IndexOf('{')
+                $closeIdx = $rel.IndexOf('}')
+                $pre = $rel.Substring(0, $openIdx)
+                $mid = $rel.Substring($openIdx + 1, $closeIdx - $openIdx - 1)
+                $suf = $rel.Substring($closeIdx + 1)
+                # Empty branches (e.g. `{}` / trailing comma) yield zero words on the
+                # bash side (word-splitting drops them) — filter here to stay in step.
+                $rels = @($mid.Split(',') | Where-Object { $_ } | ForEach-Object { "$pre$_$suf" })
+            }
+
+            foreach ($one in $rels) {
+                if ([string]::IsNullOrEmpty($one)) { $skippedN++; continue }
+                # Ignored BY DESIGN ⇒ skipped (T254 / ISS-235): a derived deploy mirror
+                # (`.claude/`, `.specpro/`) is gitignored on purpose; the deliverable is
+                # its source side, covered by the same Location's other path.
+                git -C $repoPath check-ignore -q -- $one *> $null
+                if ($LASTEXITCODE -eq 0) { $skippedN++ }
+                else {
+                    git -C $repoPath ls-files --error-unmatch -- $one *> $null
+                    if ($LASTEXITCODE -eq 0) { $checkedN++ }
+                    elseif (Test-Path -LiteralPath (Join-Path $repoPath $one) -PathType Leaf) {
+                        $Fail = $true
+                        if ($rels.Count -gt 1) { Write-Output "✗ class ① — task Location file exists but is NOT tracked: $seg (expanded: $one)" }
+                        else { Write-Output "✗ class ① — task Location file exists but is NOT tracked: $seg" }
+                    }
+                    else { $skippedN++ }
+                }
+            }
+        }
+    }
+    Write-Output "✓ class ① — task Locations: $checkedN path(s) verified tracked · $skippedN skipped (not on disk / not a path / ignored-by-design)"
+}
+
+if (-not $Fail) {
+    Write-Output "✓ deliverables-tracked: every deliverable path is tracked"
+    exit 0
+}
+Write-Output "✗ deliverables-tracked: untracked deliverables found — commit them or fix the criterion"
+exit 1

specpro_cli/assets/scripts/powershell/verify-deployment.ps1

@@ -0,0 +1,278 @@
+#!/usr/bin/env pwsh
+#
+# Deployment-drift verifier — PowerShell twin of scripts/bash/verify-deployment.sh.
+#
+# Same stdout, same stderr, same exit code, by the contract in
+# `specs/contracts/dev-shellcheck-tool.md` and FR-008. The doc-comment below is the
+# shared rationale; keep it in step with the bash side.
+#
+# Why this exists: 宪法 Q1 requires that mirrors not diverge unnoticed, and 宪法 1.1
+# requires deployment to be the closing step of a landing. The enforcement point is
+# `scripts/git-hooks/pre-commit` §3.
+#
+# 核验强度按目标形态确定 (plan.md → Constraint 1); the form is judged FIRST:
+#   same    — byte-for-byte copy  ⇒ Compare-Object style diff, zero output expected
+#   derived — produced by a rule  ⇒ reproducible-check criterion, NOT implemented here
+#
+# ⚠️ A `derived` group FAILS loudly, and so does a MISSING mirror. Neither is skipped:
+# an unchecked group that reports success is indistinguishable from a clean one.
+
+# No `$ErrorActionPreference = 'Stop'` for the diff calls: this script reads their exit
+# codes, and Stop would end it before the reading happens (the same carve-out the bash
+# side documents).
+
+# ⚠️ **Position-independent, and the result is TESTED** (T180 / `ISS-124`): the previous
+# `$PSScriptRoot/../..` is correct only from the SOURCE layout — from the deployed mirror
+# it lands one level short. ⚠️ A mirror table read against the wrong tree still prints
+# "in sync", which is indistinguishable from a real pass; and this script is what the
+# pre-commit hook calls, so the wrong tree is the likely one.
+#
+# The sentinel tests the RESULT, not the method — including for an override.
+function Test-RepoRoot([string]$p) {
+    (Test-Path (Join-Path $p 'commands')) -and
+    (Test-Path (Join-Path $p 'templates')) -and
+    (Test-Path (Join-Path $p 'scripts'))
+}
+function Resolve-Base {
+    $t = git rev-parse --show-toplevel 2>$null
+    if ($t -and (Test-RepoRoot $t)) { return $t }
+    foreach ($cand in @((Join-Path $PSScriptRoot '..' '..'), (Join-Path $PSScriptRoot '..' '..' '..'))) {
+        if (Test-Path $cand) {
+            $p = (Resolve-Path $cand).Path
+            if (Test-RepoRoot $p) { return $p }
+        }
+    }
+    return $null
+}
+
+$Base = if ($env:DEPLOY_HOOK_BASE) { $env:DEPLOY_HOOK_BASE } else { Resolve-Base }
+
+if (-not (Test-RepoRoot $Base)) {
+    $shown = if ($Base) { $Base } else { '<unresolved>' }
+    [Console]::Error.WriteLine("✗ BASE is not a repository root: '$shown'")
+    [Console]::Error.WriteLine("  Expected it to contain commands/ , templates/ and scripts/ .")
+    if ($env:DEPLOY_HOOK_BASE) {
+        [Console]::Error.WriteLine("  Source: the DEPLOY_HOOK_BASE override.")
+    } else {
+        [Console]::Error.WriteLine("  Source: auto-resolution (git toplevel, then the script's two possible depths).")
+    }
+    [Console]::Error.WriteLine("  ⚠️ Every group below would be compared against a tree this script never read —")
+    [Console]::Error.WriteLine("     an absent mirror and an in-sync mirror are the same output otherwise.")
+    exit 1
+}
+
+# 源 | 镜像 | 形态
+$Pairs = @(
+    @{ Src = 'commands';     Dst = '.claude/skills';         Form = 'derived' }
+    @{ Src = 'templates';    Dst = '.specpro/templates';     Form = 'same' }
+    @{ Src = 'scripts/bash'; Dst = '.specpro/scripts/bash';  Form = 'same' }
+)
+
+# ⚠️ `powershell` is excluded by DECISION, not neglect: the mirror exists so THIS
+# repository can run its own toolchain, and this repository is not Windows. The
+# PowerShell implementations reach user projects through the CLI's asset snapshot, which
+# has its own verifier (Constraint 4).
+$ExcludedInScripts = @('powershell', 'git-hooks', 'install-git-hooks.sh')
+
+$Fail = 0
+Write-Output "Deployment drift: $Base"
+Write-Output ""
+
+foreach ($pair in $Pairs) {
+    $src = Join-Path $Base $pair.Src
+    $dst = Join-Path $Base $pair.Dst
+    Write-Output ("  [{0}] {1} → {2}" -f $pair.Form, $pair.Src, $pair.Dst)
+
+    if (-not (Test-Path -LiteralPath $src)) {
+        Write-Output "    ✗ source does not exist: $src"
+        Write-Output "      → the table names a group that is not there; fix the table or restore the source."
+        $Fail = 1
+        continue
+    }
+
+    if (-not (Test-Path -LiteralPath $dst -PathType Container)) {
+        Write-Output "    ✗ mirror missing: $dst"
+        Write-Output "      → deploy the source, or add the group to EXCLUDED_* by name with a reason."
+        Write-Output "        A missing target MUST NOT be skipped: an absent group and a clean one look identical."
+        $Fail = 1
+        continue
+    }
+
+    if ($pair.Form -eq 'derived') {
+        # Reproducible check (FR-007 / 宪法 1.1 T3): same source + same base class ⇒
+        # same output. Two installs of the CURRENT source into two temp dirs must agree
+        # byte-for-byte (determinism), and the mirror must equal the first (sync) — a
+        # stale mirror fails exactly like a drifted copy. No installer ⇒ UNVERIFIED ⇒
+        # FAIL, never skip.
+        $Py = $null
+        foreach ($pycand in @(
+            (Join-Path $Base 'tools/install/.venv/bin/python'),
+            (Join-Path $Base 'tools/install/.venv/Scripts/python.exe')
+        )) {
+            if (Test-Path -LiteralPath $pycand -PathType Leaf) { $Py = $pycand; break }
+        }
+        if ($null -eq $Py) {
+            Write-Output "    ✗ derived check cannot run: no install CLI venv under tools/install/."
+            Write-Output "      → the derived mirror is produced by this repo's own CLI; without it this"
+            Write-Output "        group is UNVERIFIED, and reporting success would be a false pass."
+            $Fail = 1
+            continue
+        }
+        $tmp1 = Join-Path ([System.IO.Path]::GetTempPath()) ([System.Guid]::NewGuid().ToString('N'))
+        $tmp2 = Join-Path ([System.IO.Path]::GetTempPath()) ([System.Guid]::NewGuid().ToString('N'))
+        $instOk = $true
+        Push-Location (Join-Path $Base 'tools/install')
+        try {
+            & $Py -c "from specpro_cli.cli.entry import app; app()" init $tmp1 --agent claude --source $Base *> $null
+            if ($LASTEXITCODE -ne 0) { $instOk = $false }
+            & $Py -c "from specpro_cli.cli.entry import app; app()" init $tmp2 --agent claude --source $Base *> $null
+            if ($LASTEXITCODE -ne 0) { $instOk = $false }
+        } finally {
+            Pop-Location
+        }
+        $fresh1 = Join-Path $tmp1 '.claude/skills'
+        $fresh2 = Join-Path $tmp2 '.claude/skills'
+        if (-not $instOk -or -not (Test-Path -LiteralPath $fresh1 -PathType Container) -or -not (Test-Path -LiteralPath $fresh2 -PathType Container)) {
+            Write-Output "    ✗ derived check cannot run: the install CLI failed to produce .claude/skills."
+            Write-Output "      → fix the CLI or its venv; until then this group is UNVERIFIED (never a silent pass)."
+            $Fail = 1
+            if (Test-Path -LiteralPath $tmp1) { Remove-Item -Recurse -Force -LiteralPath $tmp1 }
+            if (Test-Path -LiteralPath $tmp2) { Remove-Item -Recurse -Force -LiteralPath $tmp2 }
+            continue
+        }
+        $drift = @()
+        # ⚠️ The comma operator is LOAD-BEARING: `@(@($a,$b))` flattens in PowerShell
+        # (the inner array unrolls into the outer), and then `$side[0]` is the FIRST
+        # CHARACTER of a path — `Get-ChildItem -Recurse /` — a whole-filesystem scan.
+        $sides = ,@($fresh1, $fresh2)
+        foreach ($side in $sides) {
+            $a = $side[0]
+            $b = $side[1]
+            $aFiles = Get-ChildItem -LiteralPath $a -Recurse -File -Force | Where-Object { $_.Name -ne '.DS_Store' }
+            $bFiles = Get-ChildItem -LiteralPath $b -Recurse -File -Force | Where-Object { $_.Name -ne '.DS_Store' }
+            foreach ($f in $aFiles) {
+                $rel = $f.FullName.Substring($a.Length).TrimStart('\', '/')
+                if (-not (Test-Path -LiteralPath (Join-Path $b $rel) -PathType Leaf)) { $drift += "x"; break }
+                $ha = (Get-FileHash -LiteralPath $f.FullName -Algorithm SHA256).Hash
+                $hb = (Get-FileHash -LiteralPath (Join-Path $b $rel) -Algorithm SHA256).Hash
+                if ($ha -ne $hb) { $drift += "x"; break }
+            }
+            if ($drift.Count -eq 0) {
+                foreach ($f in $bFiles) {
+                    $rel = $f.FullName.Substring($b.Length).TrimStart('\', '/')
+                    if (-not (Test-Path -LiteralPath (Join-Path $a $rel) -PathType Leaf)) { $drift += "x"; break }
+                }
+            }
+            if ($drift.Count -gt 0) { break }
+        }
+        if ($drift.Count -gt 0) {
+            Write-Output "    ✗ derived: two installs of the same source DISAGREE — output is not reproducible."
+            if (Test-Path -LiteralPath $tmp1) { Remove-Item -Recurse -Force -LiteralPath $tmp1 }
+            if (Test-Path -LiteralPath $tmp2) { Remove-Item -Recurse -Force -LiteralPath $tmp2 }
+            $Fail = 1
+            continue
+        }
+        # Mirror vs fresh install — same message shapes as `diff -rq` (the parity contract).
+        $drift = @()
+        $fFiles = Get-ChildItem -LiteralPath $fresh1 -Recurse -File -Force | Where-Object { $_.Name -ne '.DS_Store' }
+        $mFiles = Get-ChildItem -LiteralPath $dst -Recurse -File -Force | Where-Object { $_.Name -ne '.DS_Store' }
+        foreach ($f in $fFiles) {
+            $rel = $f.FullName.Substring($fresh1.Length).TrimStart('\', '/')
+            $t = Join-Path $dst $rel
+            if (-not (Test-Path -LiteralPath $t -PathType Leaf)) {
+                $drift += "Only in $fresh1`: $rel"
+            } else {
+                $ha = (Get-FileHash -LiteralPath $f.FullName -Algorithm SHA256).Hash
+                $hb = (Get-FileHash -LiteralPath $t -Algorithm SHA256).Hash
+                if ($ha -ne $hb) { $drift += "Files $($f.FullName) and $t differ" }
+            }
+        }
+        foreach ($f in $mFiles) {
+            $rel = $f.FullName.Substring($dst.Length).TrimStart('\', '/')
+            if (-not (Test-Path -LiteralPath (Join-Path $fresh1 $rel) -PathType Leaf)) {
+                $drift += "Only in $dst`: $rel"
+            }
+        }
+        if (Test-Path -LiteralPath $tmp1) { Remove-Item -Recurse -Force -LiteralPath $tmp1 }
+        if (Test-Path -LiteralPath $tmp2) { Remove-Item -Recurse -Force -LiteralPath $tmp2 }
+        if ($drift.Count -gt 0) {
+            Write-Output "    ✗ derived drift (mirror ≠ fresh install of the current source):"
+            # Temp prefix normalized away — same reason as the bash side: the drift
+            # lines must not depend on where the fresh install landed.
+            foreach ($d in $drift) { Write-Output "      $($d.Replace($tmp1, '<fresh-install>'))" }
+            $Fail = 1
+        } else {
+            Write-Output "    ✓ derived: reproducible (2 installs agree) and in sync with the current source"
+        }
+        continue
+    }
+
+    $srcFiles = Get-ChildItem -LiteralPath $src -Recurse -File -Force |
+        Where-Object { $_.Name -ne '.DS_Store' }
+    $dstFiles = Get-ChildItem -LiteralPath $dst -Recurse -File -Force |
+        Where-Object { $_.Name -ne '.DS_Store' }
+
+    $drift = @()
+    foreach ($f in $srcFiles) {
+        $rel = $f.FullName.Substring($src.Length).TrimStart('\', '/')
+        $t = Join-Path $dst $rel
+        if (-not (Test-Path -LiteralPath $t -PathType Leaf)) {
+            # ⚠️ Message shapes mirror `diff -rq`'s own output, absolute paths included.
+            # The parity contract is "same stdout", and a hand-built message that reads
+            # better still breaks it — the parity test found exactly that on the first run.
+            $drift += "Only in $src`: $rel"
+        } else {
+            $a = (Get-FileHash -LiteralPath $f.FullName -Algorithm SHA256).Hash
+            $b = (Get-FileHash -LiteralPath $t -Algorithm SHA256).Hash
+            if ($a -ne $b) { $drift += "Files $($f.FullName) and $t differ" }
+        }
+    }
+    foreach ($f in $dstFiles) {
+        $rel = $f.FullName.Substring($dst.Length).TrimStart('\', '/')
+        if (-not (Test-Path -LiteralPath (Join-Path $src $rel) -PathType Leaf)) {
+            $drift += "Only in $dst`: $rel"
+        }
+    }
+
+    if ($drift.Count -gt 0) {
+        Write-Output "    ✗ drift:"
+        foreach ($d in $drift) { Write-Output "      $d" }
+        $Fail = 1
+    } else {
+        Write-Output "    ✓ byte-identical"
+    }
+}
+
+Write-Output ""
+$scriptsDir = Join-Path $Base 'scripts'
+if (Test-Path -LiteralPath $scriptsDir -PathType Container) {
+    $uncovered = @()
+    foreach ($entry in Get-ChildItem -LiteralPath $scriptsDir -Force) {
+        $name = $entry.Name
+        if ($ExcludedInScripts -contains $name) { continue }
+        $covered = $false
+        foreach ($pair in $Pairs) {
+            if ($pair.Src -eq "scripts/$name") { $covered = $true }
+        }
+        if (-not $covered) { $uncovered += $name }
+    }
+    if ($uncovered.Count -gt 0) {
+        Write-Output "  ✗ scripts/ entries that are neither mirrored nor listed as excluded:"
+        foreach ($u in $uncovered) { Write-Output "      $u" }
+        Write-Output "      → add a mirror row, or add the name to EXCLUDED_IN_SCRIPTS with a reason."
+        Write-Output "        Otherwise the next un-mirrored directory joins without anyone noticing."
+        $Fail = 1
+    } else {
+        Write-Output "  ✓ every scripts/ entry is either mirrored or listed as excluded"
+    }
+}
+
+Write-Output ""
+if ($Fail -eq 0) {
+    Write-Output "✓ deployment: every group is in sync"
+    exit 0
+} else {
+    Write-Output "✗ deployment: VIOLATIONS FOUND (see above)"
+    Write-Output "  → 宪法 1.1: 部署是该次落地的收尾动作 —— 源与镜像的差异不得跨提交存在。"
+    exit 1
+}

specpro_cli/assets/scripts/powershell/verify-frontmatter-yaml.ps1

@@ -0,0 +1,56 @@
+#!/usr/bin/env pwsh
+#
+# Frontmatter-YAML verifier — PowerShell twin of scripts/bash/verify-frontmatter-yaml.sh.
+#
+# Same stdout, same exit code, per FR-008. The rationale lives in the bash side's
+# header; keep the two in step.
+#
+# ⚠️ ONE DECLARED NON-PARITY MECHANISM, stated here rather than discovered later:
+# PowerShell has no YAML parser in the box, and re-implementing one here would be a
+# second, drift-prone implementation of the criterion (形态 3). The Python runtime IS
+# a dependency of this toolchain (the install CLI is a Python package), so — exactly
+# like verify-shapes.ps1 running its bash-carried criteria through `bash -c` — this
+# side runs the SAME python snippet through `python -`. On a host without python this
+# reports the scan as not executable instead of guessing a verdict.
+
+$Repo = git rev-parse --show-toplevel 2>$null
+if (-not $Repo -or -not (Test-Path $Repo)) {
+    Write-Output "frontmatter-yaml: not inside a git repository"
+    exit 1
+}
+$CommandsDir = Join-Path (Resolve-Path $Repo).Path 'commands'
+if (-not (Test-Path $CommandsDir)) {
+    Write-Output "frontmatter-yaml: no commands/ directory at $Repo — nothing to scan"
+    exit 1
+}
+
+$python = Get-Command python3 -ErrorAction SilentlyContinue
+if (-not $python) { $python = Get-Command python -ErrorAction SilentlyContinue }
+if (-not $python) {
+    Write-Output "frontmatter-yaml: ⊘ not executable — no python runtime found (PyYAML is the criterion's carrier)"
+    exit 1
+}
+
+$py = @'
+import glob, os, sys, yaml
+d = sys.argv[1]
+parsed = 0
+bad = []
+for f in sorted(glob.glob(os.path.join(d, "*.md"))):
+    with open(f, encoding="utf-8") as fh:
+        t = fh.read()
+    if not t.startswith("---"):
+        continue  # absent frontmatter is out of scope (ISS-81 ruling)
+    parsed += 1
+    end = t.find("\n---", 3)
+    try:
+        yaml.safe_load(t[3:end])
+    except Exception as ex:
+        print("✗ %s: %s" % (os.path.relpath(f, d), str(ex).splitlines()[0]))
+        bad.append(f)
+print("frontmatter-yaml: %d frontmatter block(s) parsed · %d failed" % (parsed, len(bad)))
+sys.exit(1 if bad else 0)
+'@
+
+& $python.Source -c $py $CommandsDir
+exit $LASTEXITCODE