ci: run static conformance checks on every PR

.github/workflows/conformance.yml

@@ -0,0 +1,25 @@
+name: conformance
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  static:
+    # Static checks only: manifests, every stage in its eight places, Claude Code 2.1
+    # facts, and the gate hook against fixtures. The --live checks need an
+    # authenticated Claude Code session and stay a manual pre-release step.
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install ripgrep and PyYAML
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq ripgrep python3-yaml
+      - name: Run conformance (static)
+        run: bash scripts/conformance.sh

scripts/conformance.sh

@@ -28,7 +28,12 @@ check() { # check "<label>" <command...>  (passes when the command succeeds)
 STAGES=(tech-stack brd prd validate-specs scaffold implement audit-completeness audit-security audit-a11y optimize docs refactor seed-data harden prelaunch verify remediate polish redesign smoke user-guide feedback maintain)
 
 echo "== Structure =="
-check "plugin manifest validates" claude plugin validate .
+if command -v claude >/dev/null 2>&1; then
+  check "plugin manifest validates" claude plugin validate .
+else
+  # CI runners have no Claude Code CLI; fall back to a JSON parse of both manifests.
+  check "plugin manifests parse as JSON (claude CLI not installed)" python3 -c "import json;[json.load(open(f)) for f in ('.claude-plugin/plugin.json','.claude-plugin/marketplace.json','hooks/hooks.json')]"
+fi
 for s in "${STAGES[@]}"; do
   [[ -f "skills/$s/SKILL.md" ]] || fail "skills/$s/SKILL.md missing"
 done