F-III mechanized, pre-commit firewall hook, skills consume the engine (v0.17.1)

[chinmaygit]

What changed

Overhaul session 2, building on the merged v0.17.0 engine (PR #1) and your accepted lock — now at v0.17.2:

• F-III mechanized — the engine parses experiments/ (per templates/experiment.md) and audits pre-registration deterministically: EXP-* error findings for a RUNNING+ experiment with empty/placeholder Hypothesis/Metric/Decision-rule, a missing/invalid/future pre-registered date, or an illegal status. F-III's enforcement accordingly flips UNGUARDED → AUDITED — the one audit-derived field edit in the law plane, and constitution firewall stayed clean across it (proof the lock hashes ratified substance only). The self-audit now reports 0 findings.
• constitution hooks install — worktree-safe pre-commit hook running audit + firewall at commit time. It capability-checks the PATH CLI first: your global is still 0.16.12, and without that check the hook would have blocked every commit with "Unknown command: audit" (caught live, verified by executing the hook both ways). It skips with a loud message until your global is ≥ 0.17.0.
• Skills consume the engine — audit-structure 1.4.0 starts from constitution audit --json as ground truth for the deterministic checks; compile-prompt 1.2.0 starts from constitution compile packs. Manual discovery protocols kept as the no-CLI fallback.
• Publish-on-merge (your directive) — .github/workflows/publish.yml: every push to main builds, tests, gates on version sync (cli/package.json == CONSTITUTION.md header), publishes to GitHub Packages via the built-in GITHUB_TOKEN only if the version is new, then smoke-tests the published tarball by scaffolding + auditing a fresh consumer. Two cli/AGENTS.md statutes upgraded prompt-only → CI. Gate and already-published-guard logic validated locally against the real registry; the workflow's first live run is this PR's merge — watch that Actions run.
• Tests 19/19 (new experiments + hooks suites, incl. a \Z-anchor regex regression caught in review). cli/package.json → 0.17.2 synced by constitution doctor.

For the reviewer

• Ledger entries [0.17.1]/[0.17.2] are agent-authored, pending your review; the only ratified-adjacent edit is F-III's enforcement field, which the constitution defines as set-by-audit (below the firewall). Firewall + audit both run clean on this branch.
• Merging this PR publishes 0.17.2 automatically. The one command left for you (arms the pre-commit hook for real):

  npm install -g @chinmaygit/constitution-cli@0.17.2

• Session record: BUILDLOG.md § Session 2 (+ publish-on-merge addendum).

🤖 Generated with Claude Code