#Requires -Version 5.1
# reverse-skill routing + ops contract gates (skill-router only; no host platform runtime)
param([string] $ScratchDir = '')
$ErrorActionPreference = 'Stop'

$scriptDir = $PSScriptRoot
if (-not $scriptDir) { $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path }
$skillsRoot = Split-Path -Parent $scriptDir
$packageRoot = Split-Path -Parent $skillsRoot
$masterRoute = Join-Path $scriptDir 'master-route.ps1'
$caseInit = Join-Path $scriptDir 'case-init.ps1'
$masterDoc = Join-Path $skillsRoot 'MASTER-ROUTING.md'

$tmpBase = if ($env:TEMP) { $env:TEMP } else { [System.IO.Path]::GetTempPath() }
if (-not $ScratchDir) {
    $ScratchDir = Join-Path $tmpBase ("rs-verify-{0}" -f (Get-Date -Format 'yyyyMMddHHmmss'))
}
New-Item -ItemType Directory -Force -Path $ScratchDir | Out-Null
$fail = New-Object System.Collections.Generic.List[string]
function Ok($m) { Write-Host "[OK] $m" -ForegroundColor Green }
function Bad($m) { Write-Host "[FAIL] $m" -ForegroundColor Red; [void]$fail.Add($m) }

# --- 新事实源/产物检查（routing.json / benchmark / INDEX） ---
$routingJson = Join-Path $skillsRoot 'config/routing.json'
if (Test-Path -LiteralPath $routingJson) {
    $rj = Get-Content -LiteralPath $routingJson -Raw -Encoding UTF8 | ConvertFrom-Json
    $rjRoutes = @($rj.routes.PSObject.Properties)
    if ($rjRoutes.Count -ge 30) { Ok "routing.json routes=$($rjRoutes.Count)" } else { Bad 'routing.json route count suspicious (<30)' }
    $badRoute = @($rjRoutes | Where-Object { -not $_.Value.label -or -not $_.Value.skill -or -not $_.Value.keywords })
    if ($badRoute.Count -eq 0) { Ok 'routing.json: all routes have label/skill/keywords' } else { Bad "routing.json routes missing fields: $($badRoute.Name -join ',')" }
    $missingRouteSkills = @($rjRoutes | Where-Object {
        -not (Test-Path -LiteralPath (Join-Path $skillsRoot ($_.Value.skill -replace '/', [IO.Path]::DirectorySeparatorChar)) -PathType Leaf)
    })
    if ($missingRouteSkills.Count -eq 0) { Ok 'routing.json: all route skills exist' } else { Bad "routing.json missing skill files: $($missingRouteSkills.Name -join ',')" }
    $git = Get-Command git -ErrorAction SilentlyContinue
    if ($git) {
        $trackedSkills = @(& $git.Source -C $packageRoot ls-files -- 'skills/**/SKILL.md')
        if ($LASTEXITCODE -eq 0) {
            $untrackedRouteSkills = @($rjRoutes | Where-Object { ('skills/' + $_.Value.skill) -notin $trackedSkills })
            if ($untrackedRouteSkills.Count -eq 0) { Ok 'routing.json: all route skills are tracked' } else { Bad "routing.json references untracked skills: $($untrackedRouteSkills.Name -join ',')" }
        }
    }
    $routeIds = @($rjRoutes | ForEach-Object { $_.Name })
    $missingPrio = @($routeIds | Where-Object { $_ -notin @($rj.priority) })
    $extraPrio = @($rj.priority | Where-Object { $_ -notin $routeIds })
    if ($missingPrio.Count -eq 0 -and $extraPrio.Count -eq 0) { Ok 'routing.json priority covers all routes (1:1)' } else { Bad "routing.json priority mismatch: missing=$($missingPrio -join ',') extra=$($extraPrio -join ',')" }
} else {
    Bad 'skills/config/routing.json missing (single source of truth)'
}

$benchJson = Join-Path $skillsRoot 'tests/routing-benchmark.json'
if (Test-Path -LiteralPath $benchJson) {
    $bj = Get-Content -LiteralPath $benchJson -Raw -Encoding UTF8 | ConvertFrom-Json
    $bjCases = @($bj.cases)
    if ($bjCases.Count -ge 100) { Ok "benchmark cases=$($bjCases.Count)" } else { Bad "benchmark cases < 100 ($($bjCases.Count))" }
    $badExpect = @($bjCases | Where-Object { $_.expect -notmatch '^R\d+$' })
    if ($badExpect.Count -eq 0) { Ok 'benchmark expect ids well-formed' } else { Bad "benchmark bad expect: $($badExpect.Count)" }
    # benchmark expect 必须存在于 routing.json（防 benchmark 引用已删除的路由）
    if (Test-Path -LiteralPath $routingJson) {
        $rjIds = @($rjRoutes | ForEach-Object { $_.Name })
        $ghostExpect = @($bjCases | Where-Object { $_.expect -notin $rjIds })
        if ($ghostExpect.Count -eq 0) { Ok 'benchmark expects all exist in routing.json' } else { Bad "benchmark ghost expects: $(($ghostExpect | Select-Object -First 5).expect -join ',')" }
    }
} else {
    Bad 'skills/tests/routing-benchmark.json missing'
}

if (Test-Path -LiteralPath (Join-Path $skillsRoot 'INDEX.md')) { Ok 'INDEX.md present (generated)' } else { Bad 'INDEX.md missing (run extract-summaries.ps1)' }

# master-route.ps1 不得回退到硬编码路由表（防绕过 routing.json）
$mrText = Get-Content -LiteralPath (Join-Path $scriptDir 'master-route.ps1') -Raw -Encoding UTF8
if ($mrText -match '\$map\s*=\s*\[ordered\]' -or $mrText -match "R1'\s*=\s*'apk-reverse") {
    Bad 'master-route.ps1 contains hardcoded routing table (must read routing.json)'
} else {
    Ok 'master-route.ps1 has no hardcoded routing table'
}

# --- ops artifacts exist ---
$opsFiles = @(
    'ops/IDENTITY.md',
    'ops/scope-contract.md',
    'ops/evidence-finding-path.md',
    'ops/role-map.md',
    'ops/timeline-workitem.md',
    'ops/sandbox-profile.md',
    'ops/skill-supply-chain.md',
    'ops/README.md',
    'references/community-security-skills.md',
    'references/domain-coverage-map.md',
    'attack-chain\references\lifecycle-checklist.md',
    'reverse-engineering/references\re-agent-workflow.md',
    'pentest-tools/references\recon-pipeline.md',
    'MASTER-ROUTING.md',
    'scripts\master-route.ps1',
    'scripts\case-init.ps1',
    'scripts\lib\WorkRoot.ps1',
    'case-review/SKILL.md',
    'case-review/scripts/review_case.py',
    'docs-generator/references\security-report-templates.md',
    'field-journal/_template.md'
)
$indexLines = New-Object System.Collections.Generic.List[string]
foreach ($rel in $opsFiles) {
    $p = Join-Path $skillsRoot $rel
    if (Test-Path -LiteralPath $p) {
        Ok "artifact $rel"
        [void]$indexLines.Add("OK $rel")
    } else {
        Bad "missing $rel"
        [void]$indexLines.Add("MISS $rel")
    }
}
$indexLines | Set-Content -LiteralPath (Join-Path $ScratchDir 'artifacts-index.txt') -Encoding UTF8

# --- links from hubs (skills + RULES single source) ---
foreach ($hub in @('MASTER-ROUTING.md', 'SKILL.md', 'routing.md')) {
    $t = Get-Content (Join-Path $skillsRoot $hub) -Raw -Encoding UTF8
    if ($t -match 'ops/scope-contract|ops\\scope-contract|case-init') { Ok "hub link scope in $hub" }
    else { Bad "hub $hub missing scope/case-init link" }
    if ($t -match 'ops/IDENTITY|IDENTITY\.md') { Ok "hub identity $hub" }
    else { Bad "hub $hub missing IDENTITY" }
}
# research deposits must be reachable from hubs
$hubAll = ''
foreach ($hub in @('MASTER-ROUTING.md', 'SKILL.md', 'ops/README.md', 'routing.md')) {
    $hp = Join-Path $skillsRoot $hub
    if (Test-Path $hp) { $hubAll += (Get-Content $hp -Raw -Encoding UTF8) }
}
foreach ($n in @('community-security-skills', 'skill-supply-chain', 're-agent-workflow', 'recon-pipeline')) {
    if ($hubAll -match [regex]::Escape($n)) { Ok "hub surfaces $n" }
    else { Bad "hub missing surface for $n" }
}

# RULES.md / RULES_zh.md MUST gate case-init/scope before ACT (injection + CRITICAL + chain)
$rulesEn = Join-Path $packageRoot 'RULES.md'
$rulesZh = Join-Path $packageRoot 'RULES_zh.md'
foreach ($rp in @($rulesEn, $rulesZh)) {
    $name = Split-Path $rp -Leaf
    if (-not (Test-Path -LiteralPath $rp)) { Bad "missing $name"; continue }
    $rt = Get-Content -LiteralPath $rp -Raw -Encoding UTF8
    if ($rt -match 'case-init' -and ($rt -match 'scope-contract|scope\.md|network_profile')) {
        Ok "$name has case-init/scope gate"
    } else {
        Bad "$name missing case-init/scope/network_profile gate"
    }
    # Compact or CRITICAL must not jump routing→ACT without scope
    if ($rt -match 'auth\.status\s*=\s*granted|auth.status=granted|未就绪禁止|MUST NOT ACT against targets|禁止对目标 ACT') {
        Ok "$name has auth hard gate language"
    } else {
        Bad "$name missing auth hard-gate language"
    }
    # Post-trigger / 行为链: case-init before ACT pattern
    if ($rt -match '(?s)case-init.{0,400}ACT|scope\.md.{0,400}ACT|scope-contract.{0,400}ACT') {
        Ok "$name orders scope before ACT (nearby)"
    } else {
        Bad "$name does not place scope/case-init before ACT"
    }
}

# --- template required headings ---
$fieldLog = New-Object System.Collections.Generic.List[string]
function Assert-Fields([string]$path, [string[]]$needles) {
    $t = Get-Content $path -Raw -Encoding UTF8
    foreach ($n in $needles) {
        if ($t -match [regex]::Escape($n)) {
            Ok "field '$n' in $(Split-Path $path -Leaf)"
            [void]$fieldLog.Add("OK $n @ $path")
        } else {
            Bad "field '$n' missing in $path"
            [void]$fieldLog.Add("MISS $n @ $path")
        }
    }
}
Assert-Fields (Join-Path $skillsRoot 'ops/scope-contract.md') @('auth', 'in_scope', 'out_of_scope', 'network_profile', 'deliverables')
Assert-Fields (Join-Path $skillsRoot 'ops/evidence-finding-path.md') @('Evidence', 'Finding', 'Path', 'repro_command', 'evidence_ids')
Assert-Fields (Join-Path $skillsRoot 'ops/timeline-workitem.md') @('timeline.md', 'workitems.md', 'Coverage')
Assert-Fields (Join-Path $skillsRoot 'ops/role-map.md') @('lead', 'cie', 'cpe', 'cre', 'Handoff')
Assert-Fields (Join-Path $skillsRoot 'ops/skill-supply-chain.md') @('AST10', 'MCP', 'bootstrap', 'MUST')
Assert-Fields (Join-Path $skillsRoot 'references/community-security-skills.md') @('trailofbits', 'agentskills.io', 'MUST', '2026-07')
Assert-Fields (Join-Path $skillsRoot 'reverse-engineering/references\re-agent-workflow.md') @('Triage', 'Static', 'Dynamic', 'Synthesis')
Assert-Fields (Join-Path $skillsRoot 'pentest-tools/references\recon-pipeline.md') @('auth.status', 'network_profile', 'Evidence', 'nuclei')
Assert-Fields (Join-Path $skillsRoot 'docs-generator/references\security-report-templates.md') @('Evidence Chain', 'Findings', 'Path')
Assert-Fields (Join-Path $skillsRoot 'field-journal/_template.md') @('Scope', 'Evidence', 'Finding')
Assert-Fields (Join-Path $skillsRoot 'case-review/SKILL.md') @('ACTION REQUIRED', 'review_case.py', 'Evidence Graph Review')
$fieldLog | Set-Content -LiteralPath (Join-Path $ScratchDir 'template-fields.txt') -Encoding UTF8

# --- role map skills exist for primary rows ---
$roleDoc = Get-Content (Join-Path $skillsRoot 'ops/role-map.md') -Raw -Encoding UTF8
foreach ($sk in @('attack-chain', 'pentest-tools', 'ida-reverse', 'docs-generator', 'llm-security')) {
    if ($roleDoc -match [regex]::Escape($sk)) { Ok "role-map mentions $sk" } else { Bad "role-map missing $sk" }
}

# --- master-route cases ---
$cases = @(
    @{ N = 'dsl'; H = 'dsl vm reverse fireye'; Id = 'R4'; Sub = 'reverse-engineering/dsl-vm-reverse/SKILL.md' },
    @{ N = 'apk'; H = 'apk jadx smali reverse'; Id = 'R1'; Sub = 'apk-reverse/SKILL.md' },
    @{ N = 'malware'; H = 'malware yara sample analysis'; Id = 'R9'; Sub = 'malware-analysis/SKILL.md' },
    @{ N = 'pentest'; H = 'nmap nuclei pentest sqlmap'; Id = 'R11'; Sub = 'pentest-tools/SKILL.md' },
    @{ N = 'attack'; H = 'full pentest attack chain from external'; Id = 'R10'; Sub = 'attack-chain/SKILL.md' },
    @{ N = 'protocol'; H = 'protobuf custom protocol reverse pcap'; Id = 'R21'; Sub = 'protocol-reverse/SKILL.md' },
    @{ N = 'ghidra'; H = 'ghidra headless decompile'; Id = 'R22'; Sub = 'ghidra-reverse/SKILL.md' },
    @{ N = 'cloud'; H = 'kubernetes k8s container escape'; Id = 'R23'; Sub = 'cloud-k8s/SKILL.md' },
    @{ N = 'ad'; H = 'bloodhound kerberoast active directory'; Id = 'R24'; Sub = 'windows-ad/SKILL.md' },
    @{ N = 'forensics'; H = 'volatility memory dump forensics'; Id = 'R25'; Sub = 'digital-forensics/SKILL.md' },
    @{ N = 'codeaudit'; H = 'semgrep code audit sast'; Id = 'R26'; Sub = 'code-audit/SKILL.md' },
    @{ N = 'hunt'; H = 'threat hunting detection engineering'; Id = 'R27'; Sub = 'threat-hunting/SKILL.md' },
    @{ N = 'ot'; H = 'scada plc modbus industrial control'; Id = 'R28'; Sub = 'ot-ics/SKILL.md' },
    @{ N = 'wifi'; H = 'wifi aircrack wireless pentest'; Id = 'R29'; Sub = 'wifi-wireless/SKILL.md' },
    @{ N = 'extension'; H = 'chrome extension crx reverse'; Id = 'R30'; Sub = 'browser-extension-reverse/SKILL.md' },
    @{ N = 'macos'; H = 'macos mach-o codesign reverse'; Id = 'R31'; Sub = 'macos-reverse/SKILL.md' },
    @{ N = 'thick'; H = 'thick client electron desktop client'; Id = 'R32'; Sub = 'thick-client/SKILL.md' },
    @{ N = 'gorust'; H = 'golang stripped go binary reverse'; Id = 'R33'; Sub = 'go-rust-reverse/SKILL.md' },
    @{ N = 'hw'; H = 'uart jtag hardware debug pads'; Id = 'R34'; Sub = 'hardware-security/SKILL.md' },
    @{ N = 'db'; H = 'database security mysql postgres redis'; Id = 'R35'; Sub = 'database-security/SKILL.md' },
    @{ N = 'email'; H = 'phishing spf dkim dmarc email security'; Id = 'R36'; Sub = 'email-security/SKILL.md' },
    @{ N = 'sso'; H = 'saml oidc sso federation'; Id = 'R37'; Sub = 'identity-federation/SKILL.md' },
    @{ N = 'sdr'; H = 'sdr hackrf gnu radio rf'; Id = 'R38'; Sub = 'radio-sdr/SKILL.md' }
)
foreach ($c in $cases) {
    $out = Join-Path $ScratchDir ("route-{0}" -f $c.N)
    $stdout = & powershell -NoProfile -ExecutionPolicy Bypass -File $masterRoute -Hint $c.H -OutDir $out 2>&1 | Out-String
    $stdout | Set-Content -LiteralPath (Join-Path $ScratchDir ("route-{0}.txt" -f $c.N)) -Encoding UTF8
    $scope = Join-Path $out 'route-scope.md'
    if (-not (Test-Path $scope)) { Bad "no scope $($c.N)"; continue }
    $text = Get-Content $scope -Raw -Encoding UTF8
    if ($text -notmatch ("primary: {0}" -f [regex]::Escape($c.Id))) { Bad "$($c.N) id want $($c.Id)" } else { Ok "$($c.N) -> $($c.Id)" }
    $abs = Join-Path $skillsRoot ($c.Sub -replace '/', [IO.Path]::DirectorySeparatorChar)
    if (-not (Test-Path $abs)) { Bad "missing $($c.Sub)" } else { Ok "exists $($c.Sub)" }
}

# default outdir under work
$def = & powershell -NoProfile -ExecutionPolicy Bypass -File $masterRoute -Hint 'radare2 analyze' 2>&1 | Out-String
$def | Set-Content (Join-Path $ScratchDir 'default-out.txt') -Encoding UTF8
if ($def -match 'work[\\/]master-route-') { Ok 'default OutDir under work/' } else { Bad 'default OutDir not under work/' }

# project-root output must stay with the analysis project when the skill is invoked elsewhere
$projectRoot = Join-Path $ScratchDir 'analysis-project'
New-Item -ItemType Directory -Force -Path $projectRoot | Out-Null
$projectRoute = & powershell -NoProfile -ExecutionPolicy Bypass -File $masterRoute `
    -Hint 'radare2 analyze' -ProjectRoot $projectRoot 2>&1 | Out-String
$projectWork = Join-Path $projectRoot 'work'
$projectRouteDirs = @(Get-ChildItem -LiteralPath $projectWork -Directory -Filter 'master-route-*' -ErrorAction SilentlyContinue)
if ($projectRouteDirs.Count -eq 1 -and (Test-Path (Join-Path $projectRouteDirs[0].FullName 'route-scope.md'))) {
    Ok 'explicit ProjectRoot keeps route artifacts in analysis project'
} else {
    Bad 'explicit ProjectRoot did not receive route artifacts'
}

$defaultProjectRoot = Join-Path $ScratchDir 'default-analysis-project'
New-Item -ItemType Directory -Force -Path $defaultProjectRoot | Out-Null
$previousLocation = Get-Location
try {
    Set-Location -LiteralPath $defaultProjectRoot
    $defaultProjectRoute = & powershell -NoProfile -ExecutionPolicy Bypass -File $masterRoute `
        -Hint 'radare2 analyze' 2>&1 | Out-String
} finally {
    Set-Location -LiteralPath $previousLocation
}
$defaultProjectWork = Join-Path $defaultProjectRoot 'work'
$defaultProjectRoutes = @(Get-ChildItem -LiteralPath $defaultProjectWork -Directory -Filter 'master-route-*' -ErrorAction SilentlyContinue)
if ($defaultProjectRoutes.Count -eq 1 -and (Test-Path (Join-Path $defaultProjectRoutes[0].FullName 'route-scope.md'))) {
    Ok 'default route artifacts follow the caller project'
} else {
    Bad 'default route artifacts did not follow the caller project'
}

# case-init real path
$caseName = 'verify-ops-' + (Get-Date -Format 'HHmmss')
$ci = & powershell -NoProfile -ExecutionPolicy Bypass -File $caseInit -Hint 'apk jadx reverse' -CaseName $caseName -PackageRoot $packageRoot 2>&1 | Out-String
$ci | Set-Content (Join-Path $ScratchDir 'case-init.txt') -Encoding UTF8
$caseRoot = Join-Path $packageRoot ("work/{0}" -f $caseName)
foreach ($f in @('scope.md', 'timeline.md', 'workitems.md')) {
    $fp = Join-Path $caseRoot $f
    if (Test-Path $fp) { Ok "case-init $f" } else { Bad "case-init missing $f" }
}
if (Test-Path (Join-Path $caseRoot 'scope.md')) {
    $sc = Get-Content (Join-Path $caseRoot 'scope.md') -Raw -Encoding UTF8
    foreach ($k in @('auth', 'network_profile', 'in_scope', 'ready_for_act')) {
        if ($sc -match $k) { Ok "case scope has $k" } else { Bad "case scope missing $k" }
    }
}

$projectCaseName = 'verify-project-root-' + (Get-Date -Format 'HHmmss')
& powershell -NoProfile -ExecutionPolicy Bypass -File $caseInit `
    -Hint 'apk jadx reverse' -CaseName $projectCaseName -PackageRoot $packageRoot `
    -ProjectRoot $projectRoot 2>&1 | Out-Null
$projectCaseRoot = Join-Path $projectWork $projectCaseName
if ((Test-Path (Join-Path $projectCaseRoot 'scope.md')) -and
    (Test-Path (Join-Path $projectCaseRoot 'timeline.md')) -and
    (Test-Path (Join-Path $projectCaseRoot 'workitems.md'))) {
    Ok 'explicit ProjectRoot keeps case artifacts in analysis project'
} else {
    Bad 'explicit ProjectRoot did not receive case artifacts'
}

$defaultCaseName = 'verify-default-project-' + (Get-Date -Format 'HHmmss')
try {
    Set-Location -LiteralPath $defaultProjectRoot
    & powershell -NoProfile -ExecutionPolicy Bypass -File $caseInit `
        -Hint 'apk jadx reverse' -CaseName $defaultCaseName 2>&1 | Out-Null
} finally {
    Set-Location -LiteralPath $previousLocation
}
$defaultCaseRoot = Join-Path (Join-Path $defaultProjectRoot 'work') $defaultCaseName
if ((Test-Path (Join-Path $defaultCaseRoot 'scope.md')) -and
    (Test-Path (Join-Path $defaultCaseRoot 'timeline.md')) -and
    (Test-Path (Join-Path $defaultCaseRoot 'workitems.md'))) {
    Ok 'default case artifacts follow the caller project'
} else {
    Bad 'default case artifacts did not follow the caller project'
}

# ghost dsl
foreach ($rel in @('SKILL.md', 'routing.md', 'MASTER-ROUTING.md', 'scripts\master-route.ps1')) {
    $p = Join-Path $skillsRoot $rel
    if (-not (Test-Path $p)) { continue }
    $t = Get-Content $p -Raw -Encoding UTF8
    if ($t -match '`dsl-vm-reverse/' -and $t -notmatch 'reverse-engineering/dsl-vm-reverse') {
        Bad "ghost dsl path in $rel"
    }
}
Ok 'ghost dsl scan done'

# refresh-tool-index parses
$e = $null
[void][System.Management.Automation.Language.Parser]::ParseFile((Join-Path $scriptDir 'refresh-tool-index.ps1'), [ref]$null, [ref]$e)
if ($e -and $e.Count -gt 0) { Bad ("refresh-tool-index parse: {0}" -f $e[0]) } else { Ok 'refresh-tool-index parses' }

# --- bootstrap-manifest parity (skills vs kali) ---
$skillsManifest = Join-Path $scriptDir 'bootstrap-manifest.json'
$kaliManifest = Join-Path $packageRoot 'kali/scripts/bootstrap-manifest.json'
$skillsCaps = @()
if (Test-Path -LiteralPath $skillsManifest) {
    $sm = Get-Content -LiteralPath $skillsManifest -Raw -Encoding UTF8 | ConvertFrom-Json
    $skillsCaps = @($sm.capabilities | ForEach-Object { $_.name })
    if ($skillsCaps.Count -ge 10) { Ok "skills manifest $($skillsCaps.Count) capabilities" } else { Bad 'skills manifest capability count suspicious' }
} else {
    Bad 'skills bootstrap-manifest.json missing'
}
if (Test-Path -LiteralPath $kaliManifest) {
    $km = Get-Content -LiteralPath $kaliManifest -Raw -Encoding UTF8 | ConvertFrom-Json
    $kaliCaps = @($km.capabilities | ForEach-Object { $_.name })
    foreach ($missing in ($skillsCaps | Where-Object { $_ -notin $kaliCaps })) {
        Bad "kali manifest missing capability: $missing"
    }
    foreach ($missing in ($kaliCaps | Where-Object { $_ -notin $skillsCaps })) {
        Ok "kali-only capability: $missing"
    }
} else {
    Bad 'kali bootstrap-manifest.json missing'
}

# --- supply-chain pin gate: auto-install download sources MUST be pinned ---
# 统一判定：pinnedVersion / pinnedCommit / pinPolicy 三选一；
# github-release-* 额外接受 assetSha256 / preferApiDigest（GitHub 官方发布资产哈希）。
$pinKinds = @('pip-package', 'npm-mcp', 'npm-global', 'go-install', 'git-clone')
foreach ($mf in @($skillsManifest, $kaliManifest)) {
    if (-not (Test-Path -LiteralPath $mf)) { continue }
    $mn = Split-Path $mf -Leaf
    $mc = Get-Content -LiteralPath $mf -Raw -Encoding UTF8 | ConvertFrom-Json
    foreach ($cap in $mc.capabilities) {
        if (-not $cap.canAutoInstall) { continue }
        $hasPin = ($cap.pinnedVersion -or $cap.pinnedCommit -or $cap.pinPolicy)
        switch ($cap.bootstrapKind) {
            'github-release-zip' { $hasPin = $hasPin -or $cap.assetSha256 -or $cap.preferApiDigest }
            'github-release-jar-wrapper' { $hasPin = $hasPin -or $cap.assetSha256 }
            'github-release-tar' { $hasPin = $hasPin -or $cap.assetSha256 -or $cap.preferApiDigest }
            'local-http-mcp' { $hasPin = $true }   # 本地服务，不下载
            'winget-package' { $hasPin = $hasPin } # winget-latest 属于 pinPolicy
            'apt-package' { $hasPin = $true }      # 发行版仓库自带（Kali 侧）
            'docker-image' { $hasPin = $true }     # fallback 通道
            'manual' { $hasPin = $true }           # 手工安装
            default { $hasPin = $hasPin }
        }
        if (-not $hasPin) {
            Bad "unpinned auto-install capability: $($cap.name) in $mn ($($cap.bootstrapKind))"
        } else {
            Ok "pinned $($cap.name) in $mn"
        }
    }
}

# identity: no FastAPI/React requirement in ops IDENTITY
$id = Get-Content (Join-Path $skillsRoot 'ops/IDENTITY.md') -Raw -Encoding UTF8
if ($id -match '不是|不做|NOT|not a Z3r0|FastAPI|React') { Ok 'identity distinguishes platform' } else { Bad 'identity weak' }
if ($id -match 'tool-index|bootstrap|field-journal|路由') { Ok 'identity keeps reverse-skill DNA' } else { Bad 'identity missing DNA' }

$idCheck = @()
$idCheck += "HEAD packageRoot=$packageRoot"
$idCheck += "fastapi-in-ops-deps=false"
$idCheck -join [Environment]::NewLine | Set-Content (Join-Path $ScratchDir 'identity-check.txt') -Encoding UTF8
Ok 'identity-check written'

Write-Host "Scratch=$ScratchDir"
if ($fail.Count -gt 0) {
    Write-Host ("FAILED {0}" -f $fail.Count) -ForegroundColor Red
    $fail | ForEach-Object { Write-Host " - $_" }
    $fail | Set-Content (Join-Path $ScratchDir 'failures.txt') -Encoding UTF8
    exit 1
}
Write-Host 'ALL ROUTING COHERENCE CHECKS PASSED' -ForegroundColor Green
'ALL ROUTING COHERENCE CHECKS PASSED' | Set-Content (Join-Path $ScratchDir 'verify.txt') -Encoding UTF8
exit 0