v4: @pacphi/agentic-kit — npm-installable cross-platform kit (ak setup/status/sync/uninstall), shell kit removed, CI matrix + npm release (#14)

* feat!: v4 — npm-installable cross-platform ruflo-kit; shell kit removed

BREAKING: install.sh/uninstall.sh/shell functions/bash bin scripts are gone.
The kit is now 'npm i -g' + one Node >=22 CLI with four porcelain verbs
(setup/status/sync/uninstall) and an x-plumbing namespace, per the definitive
command surface. Zero runtime dependencies (node:sqlite, node:test).

- src/lib: paths (XDG/%APPDATA%), exec (argv-only, .cmd shims), settings
  (backup-first merges), blocks (sentinel upsert/strip, CRLF-safe, user-
  extensible registry w/ declarative detectors in kit.json), sqlite, daemons
  (pidfile-first + ps/CIM sweep), versions (drift cache), mcp (family
  enumeration + deny rules), natives, rvf (FLVR quarantine), statusline
  (footer inject; template extracted verbatim from the shell heredoc), heal
- commands: status (dashboard, --json/--hint), sync (plan->apply->prove,
  --dry-run/--no-upgrade), setup (machine+project), uninstall (incl. legacy
  shell-kit migration); x: daemon-gc, mcp, reference, verify, improvement-eval
- docs: BACKGROUND/TROUBLESHOOTING/CONDITIONAL-BLOCKS/README archived as
  2026-07-14-shell-kit-*; new short README + npm-command TROUBLESHOOTING
- claude/ templates re-pointed at ruflo-kit verbs; installed CLAUDE.md
  blocks reconciled via 'x reference sync'
- tests: 19 node:test units + statusline suite (reads the extracted template)

Verified live: status caught real drift (3.29.0 release, natives regression
after the aidefence install, recurring FLVR brain.rvf corruption); sync
converged it; x verify learning/security green; golden parity vs the bash
patch-native checker before its removal.

* ci: 3-OS × Node 22/24/26 matrix, nightly live-drift lane, npm release workflow

- ci.yml: unit + statusline tests (zero-dep, no install step) + a sandboxed-HOME
  CLI smoke (status --json shape, managed-block round-trip, uninstall --dry-run)
  on ubuntu/macos/windows × Node 22/24/26
- nightly.yml: installs REAL latest ruflo+agentic-qe (allow-scripts) and gates on
  the kit being able to heal them (sync --no-upgrade → status; x verify
  security/learning) — catches upstream drift like ruvnet/ruflo#2670 the day it ships
- release.yml: tag-driven npm publish with provenance; NPM_TOKEN repo secret;
  tag↔package.json version guard; prereleases → 'next' dist-tag, releases → 'latest'
  (github.ref_name passed via env, no inline event interpolation)

* ci: bump actions/checkout v4→v7, actions/setup-node v4→v6 (latest as of 2026-07)

* ci: add Dependabot config (weekly grouped updates for github-actions + npm)

* build: adopt pnpm for repo tooling (packageManager pnpm@11.13.0, action-setup v6, pnpm publish --provenance)

Runtime surface deliberately stays npm: the kit heals npm-managed global
ruflo/agentic-qe trees (lib/heal.mjs, paths.mjs globalRoot) — that is the target
environment, and the nightly lane keeps simulating it with npm i -g.
pnpm-managed-globals support is a tracked follow-up.

* feat: rename to @pacphi/agentic-kit with 'ak' alias; repo → pacphi/agentic-kit

- package: @pacphi/agentic-kit, bins agentic-kit + ak (AutoKitteh's 'ak' noted
  in README as a known PATH neighbor; full command always works)
- GitHub repo renamed (old ruflo-machine-ref URLs redirect)
- command references swept to 'ak …' across src/, bin help, README,
  TROUBLESHOOTING, claude/ templates (republished to the live CLAUDE.md);
  archive files stay frozen
- config dir migrates ~/.config/ruflo → ~/.config/agentic-kit (read-fallback in
  loadKitConfig; saves land at the new path); uninstall's legacy cleanup keeps
  targeting the ruflo-era dir and now removes all shell-era ruflo-* bins
- compat surfaces intentionally unchanged: CLAUDE.md sentinel slugs (ruflo-*),
  statusline ruflo-seg marker, runtime npm calls

Author: pacphi

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  # Keep the pinned action majors current (checkout, setup-node, …).
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      actions:
+        patterns: ['*']
+    labels: [dependencies, ci]
+
+  # The kit is deliberately zero-dependency (node:sqlite, node:test) — this
+  # watches package.json anyway so anything added later gets updates, and
+  # engine-range advisories still surface.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      npm:
+        patterns: ['*']
+    labels: [dependencies]

.github/workflows/ci.yml

@@ -0,0 +1,47 @@
+name: ci
+
+on:
+  push:
+    branches: [main, npm-kit]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test:
+    name: test (${{ matrix.os }}, node ${{ matrix.node }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        node: [22, 24, 26]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6   # version comes from package.json packageManager
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node }}
+
+      # Zero runtime dependencies — no install step by design.
+      - name: Unit + statusline tests
+        run: pnpm test
+
+      - name: CLI smoke (sandboxed HOME)
+        shell: bash
+        env:
+          # Isolate every home-relative write (kit.json, CLAUDE.md, settings).
+          HOME: ${{ runner.temp }}/kit-home
+          USERPROFILE: ${{ runner.temp }}\kit-home
+          APPDATA: ${{ runner.temp }}\kit-home\AppData\Roaming
+        run: |
+          mkdir -p "$HOME"
+          node bin/agentic-kit.mjs --version
+          node bin/agentic-kit.mjs --help --all > /dev/null
+          # status must emit valid JSON and exit deterministically even on a
+          # machine with no ruflo installed (rows degrade to warn/fail).
+          node bin/agentic-kit.mjs status --json > status.json || true
+          node -e "const s=require('./status.json'); if(!Array.isArray(s.rows)||!s.overall) throw new Error('bad status JSON'); console.log('status rows:', s.rows.length, 'overall:', s.overall)"
+          # managed-block engine round-trip against the sandbox HOME
+          node bin/agentic-kit.mjs x reference sync
+          node -e "const fs=require('fs'),os=require('os'),p=require('path').join(os.homedir(),'.claude','CLAUDE.md'); const t=fs.readFileSync(p,'utf8'); for (const s of ['ruflo-preamble','ruflo-reference']) if(!t.includes('<!-- BEGIN '+s+' -->')) throw new Error('missing block '+s); console.log('blocks OK')"
+          node bin/agentic-kit.mjs uninstall --dry-run

.github/workflows/nightly.yml

@@ -0,0 +1,52 @@
+name: nightly-live
+
+# Installs the REAL latest ruflo + agentic-qe and runs the kit's checks against
+# them — catches upstream drift the day it ships (e.g. the 3.28 aidefence drop,
+# ruvnet/ruflo#2670). Scheduled + manual only; failures here mean "upstream
+# changed", not "this repo broke".
+on:
+  schedule:
+    - cron: '17 6 * * *'
+  workflow_dispatch:
+
+jobs:
+  live:
+    name: live (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+
+      # Deliberately npm, not pnpm: this simulates the kit's TARGET environment —
+      # ruflo/agentic-qe installed via `npm i -g`, whose trees the kit heals with
+      # npm (lib/heal.mjs). pnpm-managed globals are a separate follow-up.
+      - name: Install latest ruflo + agentic-qe (native build scripts allowed)
+        run: npm install -g --allow-scripts=ruflo,agentic-qe,@claude-flow/cli,better-sqlite3,hnswlib-node,agentdb,agentic-flow,argon2,onnxruntime-node,sharp,protobufjs,@google/genai,tldjs,vibium ruflo@latest agentic-qe@latest
+
+      - name: Kit heals a fresh install (sync --no-upgrade)
+        env:
+          HOME: ${{ runner.temp }}/kit-home
+        run: |
+          mkdir -p "$HOME"
+          node bin/agentic-kit.mjs sync --no-upgrade || true
+          node bin/agentic-kit.mjs status --json > status.json || true
+          node -e "
+            const s = require('./status.json');
+            console.log(JSON.stringify(s, null, 2));
+            // Upstream-drift gate: natives + security must be healable to ok.
+            const bad = s.rows.filter(r => r.level === 'fail' && ['natives','security'].includes(r.subsystem));
+            if (bad.length) { console.error('UPSTREAM DRIFT:', bad.map(b => b.message).join(' | ')); process.exit(1); }
+          "
+
+      - name: Deep proofs against the live packages
+        env:
+          HOME: ${{ runner.temp }}/kit-home
+        run: |
+          node bin/agentic-kit.mjs x verify security
+          node bin/agentic-kit.mjs x verify learning

.github/workflows/release.yml

@@ -0,0 +1,47 @@
+name: release
+
+# Publishes to npm when a version tag is pushed (v4.0.0, v4.1.0-alpha.1, …).
+# Requires the NPM_TOKEN repository secret (npm "Automation" token: repo
+# Settings → Secrets and variables → Actions → New repository secret).
+# The tag must match package.json's version — the guard below enforces it.
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: read
+  id-token: write   # npm provenance attestation
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6   # version comes from package.json packageManager
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
+      - name: Test gate
+        run: pnpm test
+
+      - name: Tag ↔ package.json version guard
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          if [ "v$PKG_VERSION" != "$REF_NAME" ]; then
+            echo "tag $REF_NAME does not match package.json version v$PKG_VERSION" >&2
+            exit 1
+          fi
+
+      - name: Publish to npm registry (with provenance)
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          # prereleases (…-alpha.N) go to the 'next' dist-tag; releases to 'latest'
+          case "$(node -p "require('./package.json').version")" in
+            *-*) pnpm publish --provenance --access public --tag next --no-git-checks ;;
+            *)   pnpm publish --provenance --access public --no-git-checks ;;
+          esac

.gitignore

@@ -38,3 +38,6 @@ CLAUDE.md.pre-ruflo
 *.rvf.lock
 *.rvf.idmap.json
 *.rvf.manifest.json
+
+# package-manager artifacts (repo is zero-dependency; lockfile IS tracked)
+node_modules/