feat: add canonical workspace verification

[altaywtf]

Summary

Add one offline verification command and declarative project-registry ownership policies.

Changed

• add workspace-kit verify [--json] as the canonical config, doctor, registry, and wiki-catalog gate
• add allowedOwners, mustContain, and maxEntries registry policies with contradiction checks
• make new personal/runtime scaffolds verify-green and simplify their package scripts
• document the current verification and registry contracts

Review aids

flowchart LR
  C[workspace.json] --> V[workspace-kit verify]
  V --> D[configured doctor checks]
  V --> R[registry policy validation]
  V --> W[wiki catalog drift check]
  V --> O[text or one-line JSON result]

Loading

Risks

• existing standalone commands and parity-locked output remain unchanged
• verify adds configured registry and wiki-catalog checks without network access

Verification

• full pnpm run verify release gate
• 127 tests; 91.93% line coverage
• packed-package install and CLI smoke
• final autoreview clean

Complexity

The doctor evaluator is shared with verify; policy parsing stays at the config boundary and registry enforcement stays in the existing static validation phase.

---

Note

Medium Risk
Changes the canonical validation entry point and CI/pre-commit behavior; verify adds registry and wiki-catalog failures that were previously separate commands, though existing standalone commands are unchanged.

Overview
Introduces workspace-kit verify as the single offline local/CI gate: it parses workspace.json once, runs the same checks as doctor, optionally registry validate when registry.project is set, and a wiki backfill dry-run drift check when wiki is configured. verify --json mirrors doctor --json with extra config, registry, and wikiBackfill check keys; unknown config keys surface as warnings here (not only in config validate).

Registry gains declarative policies allowedOwners, mustContain, and maxEntries, parsed in config with cross-field validation and enforced in static registry validation before checkout inspection.

Init/scaffold shifts to verify-green defaults: package.json scripts call workspace-kit verify, pre-commit hooks run npm run verify, fresh personal/runtime scaffolds seed wiki catalogs via wikiBackfill with an explicit repoRoot, and docs describe adoption around verify instead of chaining doctor + separate registry steps.

^{Reviewed by Cursor Bugbot for commit 950822a. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Adds workspace-kit verify as the single offline gate for local and CI, and introduces declarative registry ownership policies to strengthen project registry validation. Simplifies scaffolds to be verify-green and updates docs and tests accordingly.

• New Features

  • workspace-kit verify [--json]: validates config, runs configured doctor, includes registry validate when registry.project is set, and checks wiki backfill drift. Emits one JSON object with --json.
  • Registry policies: allowedOwners, mustContain, and maxEntries (with contradiction checks). Enforced by registry validate and included in verify.
  • Wiki backfill: safer IO and repo-root support; personal/runtime scaffolds seed wiki catalogs and use a verify pre-commit hook.
  • Config/CLI: parse once, warn on unknown keys in verify and config validate. Scaffolds set test to run verify.

• Migration

  • Replace separate doctor + registry validate steps with workspace-kit verify (or npm run verify).
  • Add registry.project to enable registry checks in verify. Use the new allowedOwners, mustContain, and maxEntries as needed.
  • verify does not run wiki stale; keep calling it explicitly if you rely on history-based staleness.

^{Written for commit 950822a. Summary will update on new commits.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 950822a. Configure here.}

[Copilot]

Pull request overview

This PR introduces workspace-kit verify as the canonical offline verification gate that composes config validation, configured doctor checks, optional registry validation (when registry.project is configured), and a wiki catalog drift check. It also adds declarative registry ownership/shape policies and updates scaffolds/tests/docs to adopt the new verification contract.

Changes:

• Add workspace-kit verify [--json] and refactor doctor internals to share a report-building path.
• Add registry policies allowedOwners, mustContain, and maxEntries, including config-side contradiction checks and enforcement in static registry validation.
• Update init scaffolds, smoke checks, tests, and documentation to be “verify-green” by default and to describe the new contract.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/registry.test.ts	Adds coverage for new registry policy enforcement (allowedOwners, mustContain, maxEntries).
test/init.test.ts	Updates init expectations from “doctor-green” to “verify-green” and asserts new scripts/hooks.
test/config-version-handoff.test.ts	Extends config parsing/validation tests for the new registry policy fields and contradictions.
test/cli-commands.test.ts	Adds verify --json contract test and adjusts wiki backfill tests for seeded catalogs.
src/init.ts	Updates scaffold scripts to call verify and seeds initial wiki catalogs for personal/runtime profiles.
src/config.ts	Parses and validates new registry policy fields and performs cross-field contradiction checks.
src/cli.ts	Adds verify command and refactors doctor output into a reusable report for composition.
src/checks/wikiBackfill.ts	Adds repoRoot support and tweaks daily-log catalog generation behavior and links.
src/checks/registry.ts	Enforces maxEntries, allowedOwners, and mustContain during static registry validation.
scripts/smoke-package.mjs	Switches installed-tarball smoke from separate validate steps to verify.
README.md	Updates quick usage and command contract docs to emphasize verify as the canonical gate.
docs/convention.md	Documents the new verification and registry policy contracts and scaffold expectations.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.