Summary
.aiox-core/install-manifest.yaml declares 1164 files, but the published payload ships 1208 files under .aiox-core/. The 44-file gap is not cosmetic:
- files the manifest doesn't declare can be dropped at install time, and
aiox validate cannot detect the loss, because it only walks declared files.
The result is an installed tree that is measurably broken while every integrity tool reports it healthy. #820 and #808 are two symptoms of this; this issue is about the mechanism that lets them happen silently.
Evidence
Measured on Windows 11 / Node v24.19.0 against a vendored @aiox-squads/core-internal@5.3.0 tree, comparing with npm pack @aiox-squads/core@5.3.0. Line endings normalized CRLF→LF before comparing — without that, Windows checkouts show 100% divergence on line endings alone and the real signal is lost.
.aiox-core files in the published tarball : 1208
declared in install-manifest.yaml : 1164 (file_count: 1164)
in the package but NOT declared : 44
files actually missing from the install : 28
of those, declared in the manifest : 0
of those, NOT declared in the manifest : 28
Every missing file was an undeclared one. The 28:
| Group |
Count |
Files |
quality/ |
4 |
metrics-collector.js, metrics-hook.js, seed-metrics.js, schemas/quality-metrics.schema.json |
hooks/ |
13 |
ids-post-commit.js, ids-pre-push.js, gemini/* (6), unified/* (5) |
utils/ |
7 |
aiox-validator.js, format-duration.js, filters/* (5) |
| root config |
4 |
framework-config.yaml, project-config.yaml, local-config.yaml.template, governance/global-heuristic-hints.yaml |
The remaining 16 undeclared files did land — constitution.md, core/docs/*, docs/standards/*, schemas/*, presets/README.md. That asymmetry suggests those are copied by explicit installer rules, while everything else depends on being in the manifest.
Why this is worse than the individual symptoms
$ aiox validate
Integrity Score: 100%
Total files: 1164 | Valid: 1162 | Corrupted: 2
$ node .aiox-core/cli/index.js --help
Error: Cannot find module '../../../quality/metrics-collector'
aiox validate --repair cannot repair what the manifest never listed, and aiox doctor has no check for payload completeness. So the failure mode is: install succeeds, all checks pass, and the CLI is dead — with no tool in the box able to say why.
The dropped hooks/ files make this broader than the CLI: ids-pre-push.js, ids-post-commit.js and the whole hooks/unified/ runner set silently don't exist, so any governance that depends on them is absent rather than failing loudly.
Expected
One of:
scripts/generate-install-manifest.js covers the entire .aiox-core/ payload, so file_count equals what actually ships; or- the manifest stops being the copy list and is used only for change detection, with the installer copying the payload wholesale.
Right now it appears to serve both roles and the two disagree. Either way, aiox doctor would benefit from a payload-completeness check that compares the installed tree against the packaged file list rather than against the manifest — the manifest is the thing that can be wrong.
Repro
npm pack @aiox-squads/core@5.3.0
tar -xzf aiox-squads-core-5.3.0.tgz
# what ships vs what the manifest declares
tar -tzf aiox-squads-core-5.3.0.tgz | grep '^package/\.aiox-core/' | grep -v '/$' | wc -l # 1208
grep -c '^\s*- path:' package/.aiox-core/install-manifest.yaml # 1164
Environment
Related
🤖 Investigated with Claude Code on behalf of a project using AIOX.
Summary
.aiox-core/install-manifest.yamldeclares 1164 files, but the published payload ships 1208 files under.aiox-core/. The 44-file gap is not cosmetic:aiox validatecannot detect the loss, because it only walks declared files.The result is an installed tree that is measurably broken while every integrity tool reports it healthy. #820 and #808 are two symptoms of this; this issue is about the mechanism that lets them happen silently.
Evidence
Measured on Windows 11 / Node v24.19.0 against a vendored
@aiox-squads/core-internal@5.3.0tree, comparing withnpm pack @aiox-squads/core@5.3.0. Line endings normalized CRLF→LF before comparing — without that, Windows checkouts show 100% divergence on line endings alone and the real signal is lost.Every missing file was an undeclared one. The 28:
quality/metrics-collector.js,metrics-hook.js,seed-metrics.js,schemas/quality-metrics.schema.jsonhooks/ids-post-commit.js,ids-pre-push.js,gemini/*(6),unified/*(5)utils/aiox-validator.js,format-duration.js,filters/*(5)framework-config.yaml,project-config.yaml,local-config.yaml.template,governance/global-heuristic-hints.yamlThe remaining 16 undeclared files did land —
constitution.md,core/docs/*,docs/standards/*,schemas/*,presets/README.md. That asymmetry suggests those are copied by explicit installer rules, while everything else depends on being in the manifest.Why this is worse than the individual symptoms
aiox validate --repaircannot repair what the manifest never listed, andaiox doctorhas no check for payload completeness. So the failure mode is: install succeeds, all checks pass, and the CLI is dead — with no tool in the box able to say why.The dropped
hooks/files make this broader than the CLI:ids-pre-push.js,ids-post-commit.jsand the wholehooks/unified/runner set silently don't exist, so any governance that depends on them is absent rather than failing loudly.Expected
One of:
scripts/generate-install-manifest.jscovers the entire.aiox-core/payload, sofile_countequals what actually ships; orRight now it appears to serve both roles and the two disagree. Either way,
aiox doctorwould benefit from a payload-completeness check that compares the installed tree against the packaged file list rather than against the manifest — the manifest is the thing that can be wrong.Repro
Environment
@aiox-squads/core@5.3.0(global) + vendored.aiox-core/at the same version--help): Cannot find module 'quality/metrics-collector' (5.2.9 and 5.3.0) #820Related
--help): Cannot find module 'quality/metrics-collector' (5.2.9 and 5.3.0) #820 — CLI crashes on any invocation (quality/metrics-collectormissing) — symptomcore-internaldoesn't declareajv-formats— adjacent packaging gapquality/directory (metrics-collector + seed-metrics) #782 — 5.2.9 published withoutquality/— different bug, same blast radius🤖 Investigated with Claude Code on behalf of a project using AIOX.