raytsystem-lint

name	raytsystem-lint
description	Run deterministic integrity, provenance, projection, link, alias, operation, and secret checks over raytsystem. Use for LINT, health checks, pre-commit verification, stale projection diagnosis, broken evidence, or semantic review; never auto-fix canonical knowledge.

raytsystem LINT

Inputs and outputs

• Accept deterministic mode by default or explicit semantic-review mode.
• Return a sorted machine-readable LintReport with stable codes and a report hash.

Write scope

• Keep LINT read-only.
• Permit a separate explicit rebuild-index only for derived artifacts.
• Never edit canonical records, generated pages, events, run history, or manual notes.

Preflight

1. Run uv run raytsystem agent preflight --skill raytsystem-lint --write --json.
2. Record the active generation and Git dirty state.
3. Read all inspected files through no-follow, hardlink-safe paths.

Workflow

1. Run uv run raytsystem lint --json.
2. Use uv run raytsystem lint --semantic --json only to create review findings, never fixes.
3. Group findings by stable code and point to workspace-relative subjects only.

Validation

• Check raw hashes, citation closure, schema/canonical bytes, projection marker/files/index, local links, IDs/aliases/slugs, secrets, and operation uniqueness.
• Require nonzero exit for any critical/high/error finding.
• Exercise evals m3-lint-golden and m3-lint-adversarial.

Recovery

• Repair code or rebuild derived projections through their owning command, then re-run LINT.
• Preserve corrupted inputs and failed staging for diagnosis; never hide a finding by deletion.

Stop and approval conditions

• Stop before canonical repair, destructive migration, secret disclosure, or external action.
• Escalate a semantic conflict as a proposal/human review, not an automatic write.