From 1d9593a0867cd4a98167a0b38a2b1b457476171e Mon Sep 17 00:00:00 2001
From: tintinthong <justinthong93@gmail.com>
Date: Sun, 5 Jul 2026 15:59:12 +0800
Subject: [PATCH 1/3] Add listing conformance harness (scripts/conformance)

Standalone Node 20 stdlib harness with 14 static gates (structure, JSON:API
shapes, realm-bricking relationship classes, date-shape contract, formats,
CQ fitted, thunk links, theme tokens, icon CDN, reuse inventory, AI-slop
signals) and 5 dynamic gate wrappers (boxel parse/lint, module-load probe,
typed-search counts, prerender smoke). Waiver file support, machine-readable
report (report-schema.json), broken-listing fixture + selftest.

Full-catalog static sweep: 26 listings in ~1s, 0 harness errors.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .boxelignore                                  |   3 +
 .gitignore                                    |   5 +-
 scripts/conformance/README.md                 |  63 +++++++
 .../broken-listing/CardListing/broken.json    |  33 ++++
 .../fixtures/broken-listing/Event/gala.json   |  44 +++++
 .../fixtures/broken-listing/event.gts         |  48 ++++++
 .../fixtures/broken-listing/venue.gts         |  23 +++
 scripts/conformance/gates/d01-boxel-parse.mjs |  35 ++++
 scripts/conformance/gates/d02-boxel-lint.mjs  |  51 ++++++
 scripts/conformance/gates/d03-module-load.mjs |  43 +++++
 .../conformance/gates/d04-typed-search.mjs    |  46 +++++
 scripts/conformance/gates/d05-prerender.mjs   |  60 +++++++
 scripts/conformance/gates/s01-structure.mjs   | 142 +++++++++++++++
 .../conformance/gates/s02-json-validity.mjs   |  53 ++++++
 .../conformance/gates/s03-instance-shape.mjs  |  58 +++++++
 .../conformance/gates/s04-no-inline-media.mjs |  37 ++++
 .../conformance/gates/s05-relative-refs.mjs   | 105 ++++++++++++
 scripts/conformance/gates/s06-date-shape.mjs  |  58 +++++++
 .../conformance/gates/s07-formats-present.mjs |  42 +++++
 scripts/conformance/gates/s08-fitted-cq.mjs   |  45 +++++
 scripts/conformance/gates/s09-thunk-links.mjs |  31 ++++
 scripts/conformance/gates/s10-theme-vars.mjs  |  46 +++++
 scripts/conformance/gates/s11-cardinfo.mjs    |  26 +++
 scripts/conformance/gates/s12-icon-cdn.mjs    |  55 ++++++
 .../conformance/gates/s13-reuse-inventory.mjs | 161 ++++++++++++++++++
 .../conformance/gates/s14-slop-signals.mjs    | 100 +++++++++++
 scripts/conformance/lib/exec.mjs              |  21 +++
 scripts/conformance/lib/gts-scan.mjs          | 154 +++++++++++++++++
 scripts/conformance/lib/json-walk.mjs         |  89 ++++++++++
 scripts/conformance/lib/report.mjs            | 109 ++++++++++++
 scripts/conformance/report-schema.json        |  60 +++++++
 .../rules/base-field-manifest.json            |  22 +++
 .../conformance/rules/boxel-ui-manifest.json  |  17 ++
 scripts/conformance/rules/reuse-rules.mjs     |  80 +++++++++
 scripts/conformance/run.mjs                   | 147 ++++++++++++++++
 scripts/conformance/selftest.mjs              |  90 ++++++++++
 36 files changed, 2201 insertions(+), 1 deletion(-)
 create mode 100644 scripts/conformance/README.md
 create mode 100644 scripts/conformance/fixtures/broken-listing/CardListing/broken.json
 create mode 100644 scripts/conformance/fixtures/broken-listing/Event/gala.json
 create mode 100644 scripts/conformance/fixtures/broken-listing/event.gts
 create mode 100644 scripts/conformance/fixtures/broken-listing/venue.gts
 create mode 100644 scripts/conformance/gates/d01-boxel-parse.mjs
 create mode 100644 scripts/conformance/gates/d02-boxel-lint.mjs
 create mode 100644 scripts/conformance/gates/d03-module-load.mjs
 create mode 100644 scripts/conformance/gates/d04-typed-search.mjs
 create mode 100644 scripts/conformance/gates/d05-prerender.mjs
 create mode 100644 scripts/conformance/gates/s01-structure.mjs
 create mode 100644 scripts/conformance/gates/s02-json-validity.mjs
 create mode 100644 scripts/conformance/gates/s03-instance-shape.mjs
 create mode 100644 scripts/conformance/gates/s04-no-inline-media.mjs
 create mode 100644 scripts/conformance/gates/s05-relative-refs.mjs
 create mode 100644 scripts/conformance/gates/s06-date-shape.mjs
 create mode 100644 scripts/conformance/gates/s07-formats-present.mjs
 create mode 100644 scripts/conformance/gates/s08-fitted-cq.mjs
 create mode 100644 scripts/conformance/gates/s09-thunk-links.mjs
 create mode 100644 scripts/conformance/gates/s10-theme-vars.mjs
 create mode 100644 scripts/conformance/gates/s11-cardinfo.mjs
 create mode 100644 scripts/conformance/gates/s12-icon-cdn.mjs
 create mode 100644 scripts/conformance/gates/s13-reuse-inventory.mjs
 create mode 100644 scripts/conformance/gates/s14-slop-signals.mjs
 create mode 100644 scripts/conformance/lib/exec.mjs
 create mode 100644 scripts/conformance/lib/gts-scan.mjs
 create mode 100644 scripts/conformance/lib/json-walk.mjs
 create mode 100644 scripts/conformance/lib/report.mjs
 create mode 100644 scripts/conformance/report-schema.json
 create mode 100644 scripts/conformance/rules/base-field-manifest.json
 create mode 100644 scripts/conformance/rules/boxel-ui-manifest.json
 create mode 100644 scripts/conformance/rules/reuse-rules.mjs
 create mode 100644 scripts/conformance/run.mjs
 create mode 100644 scripts/conformance/selftest.mjs

diff --git a/.boxelignore b/.boxelignore
index 9ac9e6f3..72089b38 100644
--- a/.boxelignore
+++ b/.boxelignore
@@ -6,3 +6,6 @@ LICENSE
 tests
 .github
 scripts
+.conformance-waivers.yaml
+.conformance-report.json
+.boxel-history
diff --git a/.gitignore b/.gitignore
index b13ebc35..92366983 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,4 @@
-.claude/
\ No newline at end of file
+.claude/
+.conformance-report.json
+**/.conformance-report.json
+.boxel-history/
diff --git a/scripts/conformance/README.md b/scripts/conformance/README.md
new file mode 100644
index 00000000..4ba9041e
--- /dev/null
+++ b/scripts/conformance/README.md
@@ -0,0 +1,63 @@
+# Listing conformance harness
+
+Machine-checkable quality gates for catalog listing packages. Run it on any
+top-level listing directory (one containing a `<Type>Listing/*.json`):
+
+```
+node scripts/conformance/run.mjs <listing-dir> \
+  [--phase static|full]     # default static; full adds boxel-cli / realm gates
+  [--realm <url>]           # dev realm for the dynamic gates (D02-D05)
+  [--json <out.json>]       # report path (default <dir>/.conformance-report.json, gitignored)
+  [--waivers <file.yaml>]   # default <dir>/.conformance-waivers.yaml
+  [--offline]               # skip the icon-CDN network gate (S12)
+```
+
+Exit codes: `0` pass (warnings allowed) · `1` errors found · `2` harness fault.
+
+## Phases
+
+- **Static (S01–S14)** — pure Node 20 stdlib, no install, <15s. Runs in CI
+  (`.github/workflows/conformance.yaml`) on changed listing dirs in PRs and in
+  a nightly sweep over the whole catalog. The only network call is S12 (icon
+  CDN HEAD), skippable with `--offline`.
+- **Dynamic (D01–D05)** — local/pre-PR only: `npx boxel parse`, realm `/_lint`,
+  module-load probe (Gate A), typed-search counts (Gate B), prerender smoke.
+  Needs `@cardstack/boxel-cli` ≥0.4 and (for D02–D05) `--realm`.
+
+## Severities
+
+- **error** — realm-bricking / render-crashing / structurally broken. Blocks.
+- **warn** — quality rules (theme tokens, reuse, slop signals). Warnings never
+  fail the run, but the card factory's conform step requires each one to be
+  **fixed or waived with a reason** — adjudicated, never silently ignored.
+- **info** — advisory (e.g. a similar listing already exists).
+
+## Waivers
+
+`<listing-dir>/.conformance-waivers.yaml` travels with the PR (it is excluded
+from realm sync via `.boxelignore`):
+
+```yaml
+waivers:
+  - rule: reuse/hand-rolled-button
+    file: piano.gts
+    reason: "Piano-key buttons need custom pressed-state animation; Button's chrome fights it"
+```
+
+`file` is optional (omit to waive the rule package-wide). Reviewers see the
+justification in the diff; CI applies the same waivers the local run used.
+
+## Report
+
+`--json` emits a machine-readable report (schema: `report-schema.json`). Each
+finding carries `rule`, `severity`, `file`, `loc`, `message`, `suggestion`, and
+`fixRef` (a pointer into the card-factory skill tree), so an agent can consume
+the report as a fix-list.
+
+## Extending
+
+One module per gate in `gates/`, uniform interface `{ id, title, phase, run(ctx) }`
+returning findings. Shared scanning helpers live in `lib/` (`gts-scan.mjs` is a
+regex/brace scanner, deliberately not a parser — anything subtler belongs in
+glint/eslint via `ci-lint.yaml`). Reuse/slop rule tables live in `rules/`.
+Self-test: `node scripts/conformance/selftest.mjs`.
diff --git a/scripts/conformance/fixtures/broken-listing/CardListing/broken.json b/scripts/conformance/fixtures/broken-listing/CardListing/broken.json
new file mode 100644
index 00000000..20507214
--- /dev/null
+++ b/scripts/conformance/fixtures/broken-listing/CardListing/broken.json
@@ -0,0 +1,33 @@
+{
+  "data": {
+    "type": "card",
+    "meta": {
+      "adoptsFrom": {
+        "name": "CardListing",
+        "module": "https://app.boxel.ai/catalog/catalog-app/listing/listing"
+      }
+    },
+    "attributes": {
+      "name": "Broken Fixture",
+      "summary": "Intentionally broken listing package used by the conformance selftest.",
+      "cardInfo": {
+        "name": null,
+        "notes": null,
+        "summary": null,
+        "cardThumbnailURL": null
+      }
+    },
+    "relationships": {
+      "examples.0": {
+        "links": {
+          "self": "../Event/gala"
+        }
+      },
+      "cardInfo.cardThumbnail": {
+        "links": {
+          "self": null
+        }
+      }
+    }
+  }
+}
diff --git a/scripts/conformance/fixtures/broken-listing/Event/gala.json b/scripts/conformance/fixtures/broken-listing/Event/gala.json
new file mode 100644
index 00000000..3eb3805d
--- /dev/null
+++ b/scripts/conformance/fixtures/broken-listing/Event/gala.json
@@ -0,0 +1,44 @@
+{
+  "data": {
+    "type": "card",
+    "meta": {
+      "adoptsFrom": {
+        "module": "../event",
+        "name": "Event"
+      }
+    },
+    "attributes": {
+      "title": "Item 1",
+      "startDate": "2026-07-04T19:00:00.000Z",
+      "posterData": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==",
+      "cardInfo": {
+        "name": null,
+        "notes": null,
+        "summary": null,
+        "cardThumbnailURL": null
+      }
+    },
+    "relationships": {
+      "speakers": {
+        "links": {
+          "self": ["../Speaker/ada", "../Speaker/grace"]
+        }
+      },
+      "heroImage": {
+        "links": {
+          "self": "https://images.unsplash.com/photo-1519681393784-d120267933ba.jpg"
+        }
+      },
+      "venue": {
+        "links": {
+          "self": "https://app.boxel.ai/justin-thong/cf-broken/Venue/main"
+        }
+      },
+      "cardInfo.theme": {
+        "links": {
+          "self": null
+        }
+      }
+    }
+  }
+}
diff --git a/scripts/conformance/fixtures/broken-listing/event.gts b/scripts/conformance/fixtures/broken-listing/event.gts
new file mode 100644
index 00000000..81d9f1d2
--- /dev/null
+++ b/scripts/conformance/fixtures/broken-listing/event.gts
@@ -0,0 +1,48 @@
+// FIXTURE — intentionally violates conformance gates for selftest.mjs.
+// Seeded bugs: bare kit-internal linksTo (S09), slop gradient (S14),
+// no @container in fitted (S08 warn).
+import {
+  CardDef,
+  field,
+  contains,
+  linksTo,
+  Component,
+} from 'https://cardstack.com/base/card-api';
+import StringField from 'https://cardstack.com/base/string';
+import DateField from 'https://cardstack.com/base/date';
+import { Venue } from './venue';
+
+export class Event extends CardDef {
+  static displayName = 'Event';
+  @field title = contains(StringField);
+  @field startDate = contains(DateField);
+  @field venue = linksTo(Venue);
+
+  static isolated = class extends Component<typeof Event> {
+    <template>
+      <div class='hero'><h1>{{@model.title}}</h1></div>
+      <style scoped>
+        .hero {
+          background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+        }
+      </style>
+    </template>
+  };
+
+  static embedded = class extends Component<typeof Event> {
+    <template>
+      <span>{{@model.title}}</span>
+    </template>
+  };
+
+  static fitted = class extends Component<typeof Event> {
+    <template>
+      <div class='tile'>{{@model.title}}</div>
+      <style scoped>
+        .tile {
+          padding: 4px;
+        }
+      </style>
+    </template>
+  };
+}
diff --git a/scripts/conformance/fixtures/broken-listing/venue.gts b/scripts/conformance/fixtures/broken-listing/venue.gts
new file mode 100644
index 00000000..0f22b39d
--- /dev/null
+++ b/scripts/conformance/fixtures/broken-listing/venue.gts
@@ -0,0 +1,23 @@
+// FIXTURE — minimal linked def for the bare-linksTo seed in event.gts.
+import { CardDef, field, contains, Component } from 'https://cardstack.com/base/card-api';
+import StringField from 'https://cardstack.com/base/string';
+
+export class Venue extends CardDef {
+  static displayName = 'Venue';
+  @field name = contains(StringField);
+
+  static isolated = class extends Component<typeof Venue> {
+    <template><h1>{{@model.name}}</h1></template>
+  };
+  static embedded = class extends Component<typeof Venue> {
+    <template><span>{{@model.name}}</span></template>
+  };
+  static fitted = class extends Component<typeof Venue> {
+    <template>
+      <div class='v'>{{@model.name}}</div>
+      <style scoped>
+        @container card (height <= 80px) { .v { font-size: 11px; } }
+      </style>
+    </template>
+  };
+}
diff --git a/scripts/conformance/gates/d01-boxel-parse.mjs b/scripts/conformance/gates/d01-boxel-parse.mjs
new file mode 100644
index 00000000..6295c1be
--- /dev/null
+++ b/scripts/conformance/gates/d01-boxel-parse.mjs
@@ -0,0 +1,35 @@
+// D01 — glint typecheck + card-document validation via `npx boxel parse`.
+// Dynamic phase only (needs the boxel-cli npm package; CI's fast job skips it).
+import { runCli } from '../lib/exec.mjs';
+
+export default {
+  id: 'd01-boxel-parse',
+  title: 'boxel parse (glint + document validation)',
+  phase: 'dynamic',
+  async run(ctx) {
+    const { code, stdout, stderr } = await runCli(
+      ['boxel', '-q', 'parse', '--workspace', ctx.rootDir, '--json'],
+      { timeoutMs: 180_000 }
+    );
+    if (code === 0) return [];
+    let diagnostics = [];
+    try {
+      const parsed = JSON.parse(stdout);
+      diagnostics = parsed.diagnostics ?? parsed.messages ?? parsed.errors ?? [];
+    } catch {
+      return [{
+        rule: 'parse/failed',
+        severity: 'error',
+        file: '.',
+        message: `boxel parse exited ${code}: ${(stderr || stdout).slice(0, 400)}`,
+      }];
+    }
+    return diagnostics.map((d) => ({
+      rule: 'parse/diagnostic',
+      severity: 'error',
+      file: d.file ?? d.path ?? '.',
+      loc: d.line ? `line ${d.line}` : undefined,
+      message: d.message ?? JSON.stringify(d).slice(0, 300),
+    }));
+  },
+};
diff --git a/scripts/conformance/gates/d02-boxel-lint.mjs b/scripts/conformance/gates/d02-boxel-lint.mjs
new file mode 100644
index 00000000..baafe6f1
--- /dev/null
+++ b/scripts/conformance/gates/d02-boxel-lint.mjs
@@ -0,0 +1,51 @@
+// D02 — realm-server lint (eslint + prettier with @cardstack/boxel rules) via
+// `npx boxel lint`. Requires --realm: the card modules must already be pushed.
+import { runCli } from '../lib/exec.mjs';
+
+export default {
+  id: 'd02-boxel-lint',
+  title: 'Realm lint (/_lint endpoint)',
+  phase: 'dynamic',
+  async run(ctx) {
+    if (!ctx.options.realm) {
+      return [{
+        rule: 'lint/no-realm',
+        severity: 'warn',
+        file: '.',
+        message: 'D02 skipped: no --realm provided (realm lint runs against pushed modules)',
+      }];
+    }
+    const { code, stdout, stderr } = await runCli(
+      ['boxel', '-q', 'lint', '--realm', ctx.options.realm, '--json'],
+      { timeoutMs: 180_000 }
+    );
+    let files = [];
+    try {
+      const parsed = JSON.parse(stdout);
+      files = Array.isArray(parsed) ? parsed : parsed.files ?? parsed.results ?? [];
+    } catch {
+      if (code !== 0) {
+        return [{
+          rule: 'lint/failed',
+          severity: 'error',
+          file: '.',
+          message: `boxel lint exited ${code}: ${(stderr || stdout).slice(0, 400)}`,
+        }];
+      }
+      return [];
+    }
+    const findings = [];
+    for (const f of files) {
+      for (const m of f.messages ?? []) {
+        findings.push({
+          rule: `lint/${m.ruleId ?? 'message'}`,
+          severity: m.severity === 2 || m.severity === 'error' ? 'error' : 'warn',
+          file: f.filePath ?? f.path ?? '.',
+          loc: m.line ? `line ${m.line}` : undefined,
+          message: m.message,
+        });
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/d03-module-load.mjs b/scripts/conformance/gates/d03-module-load.mjs
new file mode 100644
index 00000000..69236695
--- /dev/null
+++ b/scripts/conformance/gates/d03-module-load.mjs
@@ -0,0 +1,43 @@
+// D03 — Gate A: the realm server actually evaluates each definition module.
+// `cardOrThunk was undefined` here means a bad import or unresolved cycle that
+// lint and typecheck cannot see.
+import { runCli } from '../lib/exec.mjs';
+
+export default {
+  id: 'd03-module-load',
+  title: 'Module-load probe (Gate A)',
+  phase: 'dynamic',
+  async run(ctx) {
+    if (!ctx.options.realm) {
+      return [{ rule: 'gate-a/no-realm', severity: 'warn', file: '.', message: 'D03 skipped: no --realm provided' }];
+    }
+    const realm = ctx.options.realm.endsWith('/') ? ctx.options.realm : `${ctx.options.realm}/`;
+    const findings = [];
+    for (const def of ctx.kit.defs) {
+      if (!def.exported || def.kind !== 'card') continue;
+      const moduleUrl = `${realm}${def.file.replace(/\.(gts|gjs)$/, '')}`;
+      const input = JSON.stringify({ codeRef: { module: moduleUrl, name: def.name } });
+      const { code, stdout, stderr } = await runCli(
+        [
+          'boxel', '-q', 'run-command',
+          '@cardstack/boxel-host/commands/get-card-type-schema/default',
+          '--realm', realm, '--input', input, '--json',
+        ],
+        { timeoutMs: 60_000 }
+      );
+      const out = stdout + stderr;
+      if (code !== 0 || !/"status"\s*:\s*"ready"|schema/i.test(out)) {
+        findings.push({
+          rule: 'gate-a/module-load-failed',
+          severity: 'error',
+          file: def.file,
+          loc: `class ${def.name}`,
+          message: `Module-load probe failed for ${def.name}: ${out.slice(0, 300)}`,
+          suggestion: '"cardOrThunk was undefined" → bad import (named vs default) or missing thunk on a cyclic relationship',
+          fixRef: 'boxel/references/common-imports.md',
+        });
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/d04-typed-search.mjs b/scripts/conformance/gates/d04-typed-search.mjs
new file mode 100644
index 00000000..f7769c4a
--- /dev/null
+++ b/scripts/conformance/gates/d04-typed-search.mjs
@@ -0,0 +1,46 @@
+// D04 — Gate B: typed-search count in the realm equals the on-disk instance
+// count per CardDef. `boxel search` is the truth source — lint passing while
+// the index is empty has happened repeatedly.
+import { runCli } from '../lib/exec.mjs';
+
+export default {
+  id: 'd04-typed-search',
+  title: 'Typed-search counts (Gate B)',
+  phase: 'dynamic',
+  async run(ctx) {
+    if (!ctx.options.realm) {
+      return [{ rule: 'gate-b/no-realm', severity: 'warn', file: '.', message: 'D04 skipped: no --realm provided' }];
+    }
+    const realm = ctx.options.realm.endsWith('/') ? ctx.options.realm : `${ctx.options.realm}/`;
+    const findings = [];
+    for (const def of ctx.kit.defs) {
+      if (!def.exported || def.kind !== 'card') continue;
+      // instances adopting this def: <DefName>/*.json convention
+      const expected = ctx.files.filter((f) => new RegExp(`(^|/)${def.name}/[^/]+\\.json$`).test(f)).length;
+      if (expected === 0) continue;
+      const moduleUrl = `${realm}${def.file.replace(/\.(gts|gjs)$/, '')}`;
+      const query = JSON.stringify({ filter: { type: { module: moduleUrl, name: def.name } } });
+      const { stdout } = await runCli(
+        ['boxel', '-q', 'search', '--realm', realm, '--query', query, '--json'],
+        { timeoutMs: 60_000 }
+      );
+      let count = null;
+      try {
+        const parsed = JSON.parse(stdout);
+        count = Array.isArray(parsed) ? parsed.length : (parsed.results?.length ?? parsed.data?.length ?? null);
+      } catch { /* fall through */ }
+      if (count === null || count < expected) {
+        findings.push({
+          rule: 'gate-b/count-mismatch',
+          severity: 'error',
+          file: def.file,
+          loc: `class ${def.name}`,
+          message: `Typed search found ${count ?? 'unparseable'} indexed ${def.name} instance(s), expected ${expected} — instances exist on disk but are not indexed`,
+          suggestion: 'Check for a bricking instance (S03 classes) or an indexing job that was silently dropped; re-push per-file',
+          fixRef: 'boxel-environment/references/indexing-operations.md',
+        });
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/d05-prerender.mjs b/scripts/conformance/gates/d05-prerender.mjs
new file mode 100644
index 00000000..06cdee3d
--- /dev/null
+++ b/scripts/conformance/gates/d05-prerender.mjs
@@ -0,0 +1,60 @@
+// D05 — prerender smoke: the realm's search-prerendered endpoint returns
+// rendered HTML (not error payloads) for embedded/fitted/atom of each example.
+export default {
+  id: 'd05-prerender',
+  title: 'Prerender formats render clean',
+  phase: 'dynamic',
+  async run(ctx) {
+    if (!ctx.options.realm) {
+      return [{ rule: 'prerender/no-realm', severity: 'warn', file: '.', message: 'D05 skipped: no --realm provided' }];
+    }
+    const realm = ctx.options.realm.endsWith('/') ? ctx.options.realm : `${ctx.options.realm}/`;
+    const findings = [];
+    for (const def of ctx.kit.defs) {
+      if (!def.exported || def.kind !== 'card') continue;
+      const moduleUrl = `${realm}${def.file.replace(/\.(gts|gjs)$/, '')}`;
+      for (const format of ['embedded', 'fitted', 'atom']) {
+        const url = new URL(`${realm}_search-prerendered`);
+        url.searchParams.set('prerenderedHtmlFormat', format);
+        url.searchParams.set('filter', JSON.stringify({ type: { module: moduleUrl, name: def.name } }));
+        try {
+          const res = await fetch(url, {
+            headers: { Accept: 'application/vnd.card+json' },
+            signal: AbortSignal.timeout(30_000),
+          });
+          const body = await res.text();
+          if (!res.ok) {
+            findings.push({
+              rule: 'prerender/http-error',
+              severity: 'error',
+              file: def.file,
+              loc: `${def.name} @${format}`,
+              message: `Prerender query returned HTTP ${res.status} for ${format}`,
+            });
+            continue;
+          }
+          if (/"error"|render error|Encountered error rendering/i.test(body)) {
+            findings.push({
+              rule: 'prerender/render-error',
+              severity: 'error',
+              file: def.file,
+              loc: `${def.name} @${format}`,
+              message: `Prerendered ${format} contains an error payload — the template throws at render time`,
+              suggestion: 'Check defensive guards on linksTo/linksToMany traversals and date values',
+              fixRef: 'boxel/references/defensive-programming.md',
+            });
+          }
+        } catch (e) {
+          findings.push({
+            rule: 'prerender/unreachable',
+            severity: 'warn',
+            file: def.file,
+            loc: `${def.name} @${format}`,
+            message: `Prerender endpoint unreachable: ${e.message}`,
+          });
+        }
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/s01-structure.mjs b/scripts/conformance/gates/s01-structure.mjs
new file mode 100644
index 00000000..32e2c735
--- /dev/null
+++ b/scripts/conformance/gates/s01-structure.mjs
@@ -0,0 +1,142 @@
+// S01 — listing dir anatomy: one listing JSON, spec coverage, examples, imagery.
+import { relationshipsOf, resolveRelative } from '../lib/json-walk.mjs';
+
+const FIX = 'catalog-card-factory/references/packaging.md';
+
+export default {
+  id: 's01-structure',
+  title: 'Listing directory anatomy',
+  phase: 'static',
+  run(ctx) {
+    const findings = [];
+    const listingPaths = ctx.files.filter((f) => /(^|\/)[A-Za-z]+Listing\/[^/]+\.json$/.test(f));
+
+    if (listingPaths.length === 0) {
+      findings.push({
+        rule: 'structure/no-listing',
+        severity: 'error',
+        file: '.',
+        message: 'No <Type>Listing/*.json found — a listing package must contain exactly one listing instance',
+        fixRef: FIX,
+      });
+      return findings;
+    }
+    if (listingPaths.length > 1) {
+      findings.push({
+        rule: 'structure/multiple-listings',
+        severity: 'error',
+        file: listingPaths[1],
+        message: `Found ${listingPaths.length} listing instances (${listingPaths.join(', ')}) — a listing package must contain exactly one`,
+        fixRef: FIX,
+      });
+    }
+
+    const listingPath = listingPaths[0];
+    const listing = ctx.jsonDocs.get(listingPath)?.doc;
+    if (!listing) return findings; // unparseable — S02 reports it
+    const listingType = listing?.data?.meta?.adoptsFrom?.name ?? 'CardListing';
+    const rels = relationshipsOf(listing);
+    const isVisual = listingType === 'CardListing' || listingType === 'AppListing';
+
+    // linked-file existence for relative listing relationships
+    const relEntries = Object.entries(rels)
+      .map(([k, v]) => [k, v?.links?.self])
+      .filter(([, link]) => typeof link === 'string' && link.startsWith('.'));
+    for (const [key, link] of relEntries) {
+      const resolved = resolveRelative(listingPath, link);
+      const exists = ctx.files.some((f) => f === resolved || f === `${resolved}.json` || f.startsWith(`${resolved}.`));
+      if (!exists && !resolved.startsWith('..')) {
+        findings.push({
+          rule: 'structure/broken-relationship',
+          severity: 'error',
+          file: listingPath,
+          loc: `data.relationships["${key}"]`,
+          message: `Relationship points at ${link} but no such file exists in the package`,
+          fixRef: FIX,
+        });
+      }
+    }
+
+    // examples (visual listings must ship at least one)
+    const hasExample = Object.keys(rels).some((k) => /^examples\.\d+$/.test(k) && rels[k]?.links?.self);
+    if (isVisual && !hasExample) {
+      findings.push({
+        rule: 'structure/no-example',
+        severity: 'error',
+        file: listingPath,
+        message: `${listingType} has no examples.N relationships — ship at least one live example instance`,
+        suggestion: 'Link example instances so the catalog can preview the card with real data',
+        fixRef: FIX,
+      });
+    }
+
+    // thumbnail
+    const thumb = rels['cardInfo.cardThumbnail']?.links?.self;
+    if (!thumb) {
+      findings.push({
+        rule: 'structure/no-thumbnail',
+        severity: 'error',
+        file: listingPath,
+        loc: 'data.relationships["cardInfo.cardThumbnail"]',
+        message: 'Listing has no thumbnail (cardInfo.cardThumbnail is null)',
+        fixRef: FIX,
+      });
+    }
+
+    // screenshots (visual listings)
+    const hasScreenshot = Object.keys(rels).some((k) => /^images\.\d+$/.test(k) && rels[k]?.links?.self);
+    if (isVisual && !hasScreenshot) {
+      findings.push({
+        rule: 'structure/no-screenshot',
+        severity: 'error',
+        file: listingPath,
+        message: `${listingType} has no images.N screenshot relationships`,
+        fixRef: FIX,
+      });
+    }
+
+    // name + summary present
+    const attrs = listing?.data?.attributes ?? {};
+    if (!attrs.name) {
+      findings.push({
+        rule: 'structure/no-name',
+        severity: 'error',
+        file: listingPath,
+        message: 'Listing has no name attribute',
+      });
+    }
+    if (!attrs.summary) {
+      findings.push({
+        rule: 'structure/no-summary',
+        severity: 'warn',
+        file: listingPath,
+        message: 'Listing has no summary — the catalog page will be blank',
+      });
+    }
+
+    // Spec coverage: every module with an exported card/field def should have a local Spec
+    const specRefs = new Set();
+    for (const [rel, entry] of ctx.jsonDocs) {
+      if (!/(^|\/)Spec\/[^/]+\.json$/.test(rel) || !entry.doc) continue;
+      const mod = entry.doc?.data?.attributes?.ref?.module;
+      if (typeof mod === 'string') specRefs.add(resolveRelative(rel, mod));
+    }
+    const defModules = new Set(
+      ctx.kit.defs.filter((d) => d.exported).map((d) => d.file.replace(/\.(gts|gjs)$/, ''))
+    );
+    for (const mod of defModules) {
+      if (!specRefs.has(mod)) {
+        findings.push({
+          rule: 'structure/missing-spec',
+          severity: 'error',
+          file: `${mod}.gts`,
+          message: `Module exports a CardDef/FieldDef but has no Spec/*.json with ref.module pointing at it`,
+          suggestion: 'Every definition module ships a Spec so the catalog can install and document it',
+          fixRef: FIX,
+        });
+      }
+    }
+
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/s02-json-validity.mjs b/scripts/conformance/gates/s02-json-validity.mjs
new file mode 100644
index 00000000..73d61289
--- /dev/null
+++ b/scripts/conformance/gates/s02-json-validity.mjs
@@ -0,0 +1,53 @@
+// S02 — every .json parses and has JSON:API card document shape.
+import { isInstancePath } from '../lib/json-walk.mjs';
+
+export default {
+  id: 's02-json-validity',
+  title: 'JSON parse + card document shape',
+  phase: 'static',
+  run(ctx) {
+    const findings = [];
+    for (const [rel, entry] of ctx.jsonDocs) {
+      if (!isInstancePath(rel)) continue;
+      if (entry.error) {
+        findings.push({
+          rule: 'json/unparseable',
+          severity: 'error',
+          file: rel,
+          message: `Invalid JSON: ${entry.error}`,
+        });
+        continue;
+      }
+      const d = entry.doc?.data;
+      if (!d || typeof d !== 'object') {
+        findings.push({
+          rule: 'json/no-data',
+          severity: 'error',
+          file: rel,
+          message: 'Document has no data member — not a JSON:API card document',
+        });
+        continue;
+      }
+      if (d.type !== 'card') {
+        findings.push({
+          rule: 'json/wrong-type',
+          severity: 'error',
+          file: rel,
+          loc: 'data.type',
+          message: `data.type is ${JSON.stringify(d.type)} — must be "card"`,
+        });
+      }
+      const adopts = d.meta?.adoptsFrom;
+      if (!adopts || typeof adopts.module !== 'string' || typeof adopts.name !== 'string') {
+        findings.push({
+          rule: 'json/no-adopts-from',
+          severity: 'error',
+          file: rel,
+          loc: 'data.meta.adoptsFrom',
+          message: 'meta.adoptsFrom must have string module and name — the host cannot load this instance',
+        });
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/s03-instance-shape.mjs b/scripts/conformance/gates/s03-instance-shape.mjs
new file mode 100644
index 00000000..387c82a7
--- /dev/null
+++ b/scripts/conformance/gates/s03-instance-shape.mjs
@@ -0,0 +1,58 @@
+// S03 — realm-bricking relationship shapes. Ported from
+// boxel-workspaces .claude/skills/boxel/scripts/instance-correctness-scan.py (rules 1-2).
+import { instances, relationshipsOf } from '../lib/json-walk.mjs';
+
+const NONCARD_EXTS = ['.jpg', '.jpeg', '.webp', '.gif', '.pdf', '.mp3', '.mp4', '.wav', '.zip'];
+const NONCARD_HOSTS = ['images.unsplash.com', 'images.', 'cdn.', 'img.', 's3.amazonaws.com'];
+const FIX = 'boxel/references/base-field-catalog.md';
+
+export default {
+  id: 's03-instance-shape',
+  title: 'Relationship shapes (realm-bricking classes)',
+  phase: 'static',
+  run(ctx) {
+    const findings = [];
+    for (const [rel, doc] of instances(ctx)) {
+      const rels = relationshipsOf(doc);
+      for (const [key, val] of Object.entries(rels)) {
+        if (!val || typeof val !== 'object') continue;
+        const self = val.links?.self;
+
+        // Rule 1: linksToMany serialized as an array under one key
+        if (Array.isArray(self)) {
+          findings.push({
+            rule: 'instance/linksToMany-array',
+            severity: 'error',
+            file: rel,
+            loc: `data.relationships["${key}"].links.self`,
+            message: 'linksToMany serialized as an array under links.self; the host rejects this as "not a card resource document"',
+            suggestion: `Use indexed top-level keys instead: "${key}.0", "${key}.1", …`,
+            fixRef: FIX,
+          });
+          continue;
+        }
+        if (typeof self !== 'string' || !self.startsWith('http')) continue;
+
+        // Rule 2: external non-card URL in a relationship link — bricks indexing
+        const low = self.toLowerCase().split('?')[0];
+        const extHit = NONCARD_EXTS.some((e) => low.endsWith(e));
+        const hostHit = NONCARD_HOSTS.some((h) => low.includes(h));
+        // .png/.svg are allowed only as RELATIVE realm-file links (ImageDef files);
+        // over http they are still non-card fetches.
+        const imgHit = /\.(png|svg)$/.test(low);
+        if (extHit || hostHit || imgHit) {
+          findings.push({
+            rule: 'instance/external-url-in-link',
+            severity: 'error',
+            file: rel,
+            loc: `data.relationships["${key}"].links.self`,
+            message: `External non-card URL in relationship link (${self.slice(0, 60)}…) — the indexer fetches it expecting a card, JSON.parse fails on binary, and the whole indexing batch rolls back`,
+            suggestion: 'Store external URLs in an attributes UrlField (heroImageURL pattern) and keep links.self for card identifiers only',
+            fixRef: FIX,
+          });
+        }
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/s04-no-inline-media.mjs b/scripts/conformance/gates/s04-no-inline-media.mjs
new file mode 100644
index 00000000..3b0bfad4
--- /dev/null
+++ b/scripts/conformance/gates/s04-no-inline-media.mjs
@@ -0,0 +1,37 @@
+// S04 — no inline media/binary payloads in card JSON attributes.
+import { instances, attributesOf, walkStrings } from '../lib/json-walk.mjs';
+
+const BASE64_BLOB = /^[A-Za-z0-9+/]{512,}={0,2}$/;
+
+export default {
+  id: 's04-no-inline-media',
+  title: 'No inline media / base64 in JSON attributes',
+  phase: 'static',
+  run(ctx) {
+    const findings = [];
+    for (const [rel, doc] of instances(ctx)) {
+      walkStrings(attributesOf(doc), (path, str) => {
+        if (str.startsWith('data:') && str.includes(';base64,')) {
+          findings.push({
+            rule: 'media/data-uri',
+            severity: 'error',
+            file: rel,
+            loc: path,
+            message: `data: URI embedded in attributes (${str.slice(0, 40)}…) — media must be a realm file linked via FileDef/ImageDef`,
+            suggestion: 'Write the bytes with WriteBinaryFileCommand and linksTo the file instead',
+          });
+        } else if (str.length >= 512 && BASE64_BLOB.test(str.replace(/\s/g, ''))) {
+          findings.push({
+            rule: 'media/base64-blob',
+            severity: 'error',
+            file: rel,
+            loc: path,
+            message: `Attribute contains a ${str.length}-char base64-looking blob — inline binary is forbidden in card JSON`,
+            suggestion: 'Store as a realm file and link it (FileDef/ImageDef/PngDef)',
+          });
+        }
+      });
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/s05-relative-refs.mjs b/scripts/conformance/gates/s05-relative-refs.mjs
new file mode 100644
index 00000000..78e6feb2
--- /dev/null
+++ b/scripts/conformance/gates/s05-relative-refs.mjs
@@ -0,0 +1,105 @@
+// S05 — reference hygiene: no localhost, no leftover dev/user-realm URLs from
+// packaging, intra-package references relative. Absolute URLs are legal ONLY
+// for the base realm, the catalog realm itself, boxel-icons, and bare npm-style
+// specifiers (@cardstack/*, ember, @glimmer, @ember, tracked-built-ins, lodash, etc.).
+import { instances, relationshipsOf } from '../lib/json-walk.mjs';
+import { importDecls } from '../lib/gts-scan.mjs';
+
+const ALLOWED_URL_PREFIXES = [
+  'https://cardstack.com/base/',
+  'https://app.boxel.ai/catalog/',
+  'https://realms-staging.stack.cards/catalog/',
+  'https://stack.cards/catalog/',
+  'https://boxel-icons.boxel.ai/',
+];
+
+function classifyUrl(url) {
+  if (/localhost|127\.0\.0\.1/.test(url)) return 'localhost';
+  if (!/^https?:\/\//.test(url)) return 'not-absolute';
+  if (ALLOWED_URL_PREFIXES.some((p) => url.startsWith(p))) return 'allowed';
+  if (/^https:\/\/(app\.boxel\.ai|realms-staging\.stack\.cards|stack\.cards)\//.test(url)) {
+    return 'foreign-realm'; // a realm host but NOT the catalog realm — dev/user realm leftover
+  }
+  return 'external';
+}
+
+export default {
+  id: 's05-relative-refs',
+  title: 'Reference hygiene (relative refs, no dev-realm leftovers)',
+  phase: 'static',
+  run(ctx) {
+    const findings = [];
+
+    // JSON: adoptsFrom modules + relationship links
+    for (const [rel, doc] of instances(ctx)) {
+      const spots = [];
+      const mod = doc?.data?.meta?.adoptsFrom?.module;
+      if (typeof mod === 'string') spots.push(['data.meta.adoptsFrom.module', mod]);
+      for (const [key, val] of Object.entries(relationshipsOf(doc))) {
+        const self = val?.links?.self;
+        if (typeof self === 'string') spots.push([`data.relationships["${key}"].links.self`, self]);
+      }
+      for (const [loc, url] of spots) {
+        const kind = classifyUrl(url);
+        if (kind === 'localhost') {
+          findings.push({
+            rule: 'refs/localhost',
+            severity: 'error',
+            file: rel,
+            loc,
+            message: `localhost URL (${url.slice(0, 60)}) — will not resolve in the catalog realm`,
+          });
+        } else if (kind === 'foreign-realm') {
+          findings.push({
+            rule: 'refs/dev-realm-leftover',
+            severity: 'error',
+            file: rel,
+            loc,
+            message: `URL points at a non-catalog realm (${url.slice(0, 70)}…) — packaging did not rewrite this reference`,
+            suggestion: 'Re-run packaging (collect-submission-files rewrites realm URLs to relative paths)',
+            fixRef: 'catalog-card-factory/references/packaging.md',
+          });
+        }
+      }
+    }
+
+    // GTS imports
+    for (const [rel, src] of ctx.gtsSources) {
+      for (const imp of importDecls(src)) {
+        if (!/^https?:\/\//.test(imp.source)) {
+          if (/localhost|127\.0\.0\.1/.test(imp.source)) {
+            findings.push({
+              rule: 'refs/localhost',
+              severity: 'error',
+              file: rel,
+              loc: `line ${imp.line}`,
+              message: `localhost import (${imp.source})`,
+            });
+          }
+          continue; // relative or bare specifier — fine
+        }
+        const kind = classifyUrl(imp.source);
+        if (kind === 'foreign-realm') {
+          findings.push({
+            rule: 'refs/dev-realm-leftover',
+            severity: 'error',
+            file: rel,
+            loc: `line ${imp.line}`,
+            message: `Import from a non-catalog realm (${imp.source.slice(0, 70)}…) — packaging did not rewrite this module reference`,
+            fixRef: 'catalog-card-factory/references/packaging.md',
+          });
+        } else if (kind === 'external') {
+          findings.push({
+            rule: 'refs/external-module',
+            severity: 'warn',
+            file: rel,
+            loc: `line ${imp.line}`,
+            message: `Import from external host (${imp.source.slice(0, 70)}) — CDN imports are allowed but must be deliberate`,
+            suggestion: 'If this is a library, consider the integrate-*-via-cdn patterns; otherwise vendor it into the package',
+          });
+        }
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/s06-date-shape.mjs b/scripts/conformance/gates/s06-date-shape.mjs
new file mode 100644
index 00000000..416095bc
--- /dev/null
+++ b/scripts/conformance/gates/s06-date-shape.mjs
@@ -0,0 +1,58 @@
+// S06 — DateField vs DateTimeField schema↔instance contract. Ported from
+// instance-correctness-scan.py rule 3. A mismatch passes lint, writes, indexes —
+// then crashes at render with RangeError: Invalid time value.
+import { instances, attributesOf, resolveRelative } from '../lib/json-walk.mjs';
+import { dateFieldMap } from '../lib/gts-scan.mjs';
+
+const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+const DATETIME_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2})?(\.\d{1,3})?(Z|[+-]\d{2}:?\d{2})?$/;
+const FIX = 'boxel/references/base-field-catalog.md';
+
+export default {
+  id: 's06-date-shape',
+  title: 'DateField / DateTimeField value shapes',
+  phase: 'static',
+  run(ctx) {
+    // field-type maps per module rel path (without extension)
+    const maps = new Map();
+    for (const [rel, src] of ctx.gtsSources) {
+      maps.set(rel.replace(/\.(gts|gjs)$/, ''), dateFieldMap(src));
+    }
+
+    const findings = [];
+    for (const [rel, doc] of instances(ctx)) {
+      const mod = doc?.data?.meta?.adoptsFrom?.module;
+      if (typeof mod !== 'string' || !mod.startsWith('.')) continue;
+      const resolved = resolveRelative(rel, mod);
+      const fieldMap = maps.get(resolved);
+      if (!fieldMap) continue;
+      const attrs = attributesOf(doc);
+      for (const [fname, ftype] of Object.entries(fieldMap)) {
+        const v = attrs[fname];
+        if (typeof v !== 'string' || v === '') continue;
+        if (ftype === 'DateField' && !DATE_RE.test(v)) {
+          findings.push({
+            rule: 'date/datefield-shape',
+            severity: 'error',
+            file: rel,
+            loc: `data.attributes.${fname}`,
+            message: `${fname}=${JSON.stringify(v)} but the schema declares contains(DateField) — value must be YYYY-MM-DD with no T`,
+            suggestion: 'Either reformat the value or switch the field to DateTimeField if time-of-day matters',
+            fixRef: FIX,
+          });
+        } else if (ftype === 'DateTimeField' && !DATETIME_RE.test(v)) {
+          findings.push({
+            rule: 'date/datetimefield-shape',
+            severity: 'error',
+            file: rel,
+            loc: `data.attributes.${fname}`,
+            message: `${fname}=${JSON.stringify(v)} but the schema declares contains(DateTimeField) — value must be an ISO datetime containing T`,
+            suggestion: 'Either reformat the value or switch the field to DateField if time-of-day is meaningless',
+            fixRef: FIX,
+          });
+        }
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/s07-formats-present.mjs b/scripts/conformance/gates/s07-formats-present.mjs
new file mode 100644
index 00000000..40d4c87d
--- /dev/null
+++ b/scripts/conformance/gates/s07-formats-present.mjs
@@ -0,0 +1,42 @@
+// S07 — every exported CardDef ships isolated + embedded + fitted; FieldDefs
+// should override embedded or edit (base defaults are rarely adequate for a listing).
+import { staticFormats } from '../lib/gts-scan.mjs';
+
+const FIX = 'boxel/references/design-playbook.md';
+
+export default {
+  id: 's07-formats-present',
+  title: 'Required formats per definition',
+  phase: 'static',
+  run(ctx) {
+    const findings = [];
+    for (const def of ctx.kit.defs) {
+      if (!def.exported) continue;
+      const formats = staticFormats(def.body);
+      if (def.kind === 'card') {
+        for (const required of ['isolated', 'embedded', 'fitted']) {
+          if (!formats[required]) {
+            findings.push({
+              rule: 'formats/missing-card-format',
+              severity: 'error',
+              file: def.file,
+              loc: `class ${def.name} (line ${def.line})`,
+              message: `CardDef ${def.name} has no static ${required} template — every catalog card needs isolated, embedded AND fitted`,
+              suggestion: 'Utility/config cards may waive this with a reason',
+              fixRef: FIX,
+            });
+          }
+        }
+      } else if (!formats.embedded && !formats.edit) {
+        findings.push({
+          rule: 'formats/fielddef-no-override',
+          severity: 'warn',
+          file: def.file,
+          loc: `class ${def.name} (line ${def.line})`,
+          message: `FieldDef ${def.name} overrides neither embedded nor edit — it will render with bare base defaults`,
+        });
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/s08-fitted-cq.mjs b/scripts/conformance/gates/s08-fitted-cq.mjs
new file mode 100644
index 00000000..28264287
--- /dev/null
+++ b/scripts/conformance/gates/s08-fitted-cq.mjs
@@ -0,0 +1,45 @@
+// S08 — fitted templates must use container queries (the CQ .cq→.fit discipline);
+// the parent owns the cell size, so fixed root heights are suspect.
+import { staticFormats, styleBlocks } from '../lib/gts-scan.mjs';
+
+const FIX = 'boxel/references/container-query-fitted-layout.md';
+
+export default {
+  id: 's08-fitted-cq',
+  title: 'Container-query fitted layouts',
+  phase: 'static',
+  run(ctx) {
+    const findings = [];
+    for (const def of ctx.kit.defs) {
+      if (def.kind !== 'card' || !def.exported) continue;
+      const fitted = staticFormats(def.body).fitted;
+      if (!fitted) continue; // S07's problem
+      const styles = styleBlocks(fitted).join('\n');
+      if (!styles.includes('@container')) {
+        // warn, not error: trivially-scaling fitted layouts (e.g. a full-bleed
+        // image tile) are legitimately CQ-free; the factory adjudicates.
+        findings.push({
+          rule: 'fitted/no-container-query',
+          severity: 'warn',
+          file: def.file,
+          loc: `class ${def.name} static fitted`,
+          message: `${def.name}'s fitted template has no @container queries — fitted cells range from 100px badges to 800px tiles and one fixed layout cannot serve them`,
+          suggestion: 'Use the two-element .cq → .fit structure with container-query sub-formats',
+          fixRef: FIX,
+        });
+      }
+      const fixedRoot = styles.match(/^\s*(height|width)\s*:\s*\d{2,}px/m);
+      if (fixedRoot) {
+        findings.push({
+          rule: 'fitted/fixed-dimension',
+          severity: 'warn',
+          file: def.file,
+          loc: `class ${def.name} static fitted`,
+          message: `Fitted styles set a fixed ${fixedRoot[1]} in px — the parent owns the cell size; fixed dimensions overflow or underfill`,
+          fixRef: FIX,
+        });
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/s09-thunk-links.mjs b/scripts/conformance/gates/s09-thunk-links.mjs
new file mode 100644
index 00000000..9ebebbd5
--- /dev/null
+++ b/scripts/conformance/gates/s09-thunk-links.mjs
@@ -0,0 +1,31 @@
+// S09 — kit-internal linksTo/linksToMany targets must be thunk-wrapped:
+// `linksTo(() => Task)`. The bare form fails at runtime with
+// "cardOrThunk was undefined" on module cycles — invisible to lint and TS.
+import { fieldDecls } from '../lib/gts-scan.mjs';
+
+export default {
+  id: 's09-thunk-links',
+  title: 'Thunk-wrapped kit-internal relationships',
+  phase: 'static',
+  run(ctx) {
+    const findings = [];
+    const localClasses = new Set(ctx.kit.classIndex.keys());
+    for (const [rel, src] of ctx.gtsSources) {
+      for (const decl of fieldDecls(src)) {
+        if (decl.kind !== 'linksTo' && decl.kind !== 'linksToMany') continue;
+        if (decl.thunk || !decl.target) continue;
+        if (localClasses.has(decl.target)) {
+          findings.push({
+            rule: 'links/bare-kit-internal',
+            severity: 'error',
+            file: rel,
+            loc: `line ${decl.line}`,
+            message: `@field ${decl.name} = ${decl.kind}(${decl.target}) references a kit-internal class without a thunk — module cycles make this fail at runtime with "cardOrThunk was undefined"`,
+            suggestion: `Write ${decl.kind}(() => ${decl.target})`,
+          });
+        }
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/s10-theme-vars.mjs b/scripts/conformance/gates/s10-theme-vars.mjs
new file mode 100644
index 00000000..1a49e2a1
--- /dev/null
+++ b/scripts/conformance/gates/s10-theme-vars.mjs
@@ -0,0 +1,46 @@
+// S10 — theme-token discipline: scoped styles should use var(--*) tokens, not
+// color literals. Warning severity (adjudicate: fix or waive) — data-driven
+// colors in attributes are NOT flagged; only CSS inside <style scoped> blocks.
+import { styleBlocks } from '../lib/gts-scan.mjs';
+
+const COLOR_LITERAL = /#[0-9a-fA-F]{3,8}\b|(?<![-\w])(rgb|rgba|hsl|hsla|oklch)\(/g;
+const FIX = 'boxel/references/theme-design-system.md';
+
+export default {
+  id: 's10-theme-vars',
+  title: 'Theme tokens over color literals',
+  phase: 'static',
+  run(ctx) {
+    const findings = [];
+    for (const [rel, src] of ctx.gtsSources) {
+      // Theme cards define palettes — they are the one legitimate home for literals.
+      if (/theme/i.test(rel)) continue;
+      const styles = styleBlocks(src).join('\n');
+      const lines = styles.split('\n');
+      const hits = [];
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (!COLOR_LITERAL.test(line)) {
+          COLOR_LITERAL.lastIndex = 0;
+          continue;
+        }
+        COLOR_LITERAL.lastIndex = 0;
+        // allow literals inside var() fallbacks: var(--accent, #f00)
+        const stripped = line.replace(/var\([^)]*\)/g, '');
+        if (COLOR_LITERAL.test(stripped)) hits.push(stripped.trim().slice(0, 60));
+        COLOR_LITERAL.lastIndex = 0;
+      }
+      if (hits.length) {
+        findings.push({
+          rule: 'theme/color-literal',
+          severity: 'warn',
+          file: rel,
+          message: `${hits.length} color literal(s) in scoped styles (e.g. \`${hits[0]}\`) — templates should reference var(--*) theme tokens so instance themes can restyle the card`,
+          suggestion: 'Move colors into the Theme card cssVariables and reference tokens; waive deliberate fixed-brand colors with a reason',
+          fixRef: FIX,
+        });
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/s11-cardinfo.mjs b/scripts/conformance/gates/s11-cardinfo.mjs
new file mode 100644
index 00000000..bab24b49
--- /dev/null
+++ b/scripts/conformance/gates/s11-cardinfo.mjs
@@ -0,0 +1,26 @@
+// S11 — instances should carry attributes.cardInfo (even all-null) so users can
+// rename/summarize/theme them through the UI later.
+import { instances, attributesOf } from '../lib/json-walk.mjs';
+
+export default {
+  id: 's11-cardinfo',
+  title: 'cardInfo present on instances',
+  phase: 'static',
+  run(ctx) {
+    const findings = [];
+    for (const [rel, doc] of instances(ctx)) {
+      const attrs = attributesOf(doc);
+      if (!('cardInfo' in attrs) || typeof attrs.cardInfo !== 'object' || attrs.cardInfo === null) {
+        findings.push({
+          rule: 'instance/no-cardinfo',
+          severity: 'warn',
+          file: rel,
+          loc: 'data.attributes',
+          message: 'Instance has no attributes.cardInfo object — users cannot edit name/summary/theme through the UI',
+          suggestion: 'Add "cardInfo": { "name": null, "notes": null, "summary": null, "cardThumbnailURL": null }',
+        });
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/s12-icon-cdn.mjs b/scripts/conformance/gates/s12-icon-cdn.mjs
new file mode 100644
index 00000000..522d5289
--- /dev/null
+++ b/scripts/conformance/gates/s12-icon-cdn.mjs
@@ -0,0 +1,55 @@
+// S12 — every boxel-icons import must exist on the CDN. Phantom icons compile
+// clean and 403 at render; a HEAD probe is the only proof. Skipped with --offline.
+import { importDecls } from '../lib/gts-scan.mjs';
+
+const CDN = 'https://boxel-icons.boxel.ai/@cardstack/boxel-icons/v1/icons';
+
+export default {
+  id: 's12-icon-cdn',
+  title: 'boxel-icons resolve on the CDN',
+  phase: 'static',
+  async run(ctx) {
+    const findings = [];
+    if (ctx.options.offline) return findings;
+
+    // gather icon name -> [{file, line}]
+    const uses = new Map();
+    for (const [rel, src] of ctx.gtsSources) {
+      for (const imp of importDecls(src)) {
+        const m = imp.source.match(/@cardstack\/boxel-icons\/([A-Za-z0-9-]+)$/);
+        if (m && m[1] !== 'v1') {
+          if (!uses.has(m[1])) uses.set(m[1], []);
+          uses.get(m[1]).push({ file: rel, line: imp.line });
+        }
+      }
+    }
+    if (uses.size === 0) return findings;
+
+    const checks = [...uses.keys()].map(async (name) => {
+      try {
+        const res = await fetch(`${CDN}/${name}.js`, {
+          method: 'HEAD',
+          signal: AbortSignal.timeout(10_000),
+        });
+        return [name, res.status];
+      } catch (e) {
+        return [name, `network: ${e.message}`];
+      }
+    });
+    for (const [name, status] of await Promise.all(checks)) {
+      if (status === 200) continue;
+      for (const use of uses.get(name)) {
+        findings.push({
+          rule: 'icons/unresolvable',
+          severity: typeof status === 'number' ? 'error' : 'warn',
+          file: use.file,
+          loc: `line ${use.line}`,
+          message: `Icon "${name}" returned ${status} from the boxel-icons CDN — it will 403/404 at render time`,
+          suggestion: `Pick a verified icon: curl -s -o /dev/null -w "%{http_code}" ${CDN}/<name>.js must print 200`,
+          fixRef: 'boxel/references/icons.md',
+        });
+      }
+    }
+    return findings;
+  },
+};
diff --git a/scripts/conformance/gates/s13-reuse-inventory.mjs b/scripts/conformance/gates/s13-reuse-inventory.mjs
new file mode 100644
index 00000000..5aa4b697
--- /dev/null
+++ b/scripts/conformance/gates/s13-reuse-inventory.mjs
@@ -0,0 +1,161 @@
+// S13 — reuse inventory: hand-rolled UI that duplicates boxel-ui components,
+// FieldDefs that duplicate base fields, and near-duplicate catalog fields/listings.
+// ALL findings are warnings — the factory's conform step requires each to be
+// fixed or waived with a reason. The report also carries an inventory block so
+// reuse trends are measurable across cards.
+import { readdirSync, readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { reuseRules } from '../rules/reuse-rules.mjs';
+import { staticFormats, templateBlocks, styleBlocks, importDecls } from '../lib/gts-scan.mjs';
+
+function loadJson(url) {
+  return JSON.parse(readFileSync(new URL(url, import.meta.url), 'utf8'));
+}
+
+export default {
+  id: 's13-reuse-inventory',
+  title: 'Component / field / listing reuse',
+  phase: 'static',
+  run(ctx) {
+    const findings = [];
+    const baseFields = loadJson('../rules/base-field-manifest.json').fields;
+    const uiManifest = loadJson('../rules/boxel-ui-manifest.json');
+
+    // ---- hand-rolled UI detectors, per definition per format
+    for (const def of ctx.kit.defs) {
+      const formats = staticFormats(def.body);
+      for (const [format, span] of Object.entries(formats)) {
+        const template = templateBlocks(span).join('\n');
+        const styles = styleBlocks(span).join('\n');
+        if (!template && !styles) continue;
+        for (const rule of reuseRules) {
+          if (rule.formats && !rule.formats.includes(format)) continue;
+          if (rule.detect({ template, styles })) {
+            findings.push({
+              rule: rule.id,
+              severity: 'warn',
+              file: def.file,
+              loc: `class ${def.name} static ${format}`,
+              message: rule.message,
+              suggestion: rule.suggestion,
+              fixRef: 'boxel-ui-guidelines',
+            });
+          }
+        }
+      }
+    }
+
+    // ---- duplicate-base-field: local FieldDef re-implementing a base field
+    for (const def of ctx.kit.defs) {
+      if (def.kind !== 'field') continue;
+      const hit = baseFields.find((f) => new RegExp(f.namePattern, 'i').test(def.name));
+      if (hit && def.name !== hit.name) {
+        findings.push({
+          rule: 'reuse/duplicate-base-field',
+          severity: 'warn',
+          file: def.file,
+          loc: `class ${def.name} (line ${def.line})`,
+          message: `FieldDef ${def.name} looks like a re-implementation of the base ${hit.name}`,
+          suggestion: `Import the default export of ${hit.module} instead (or waive if genuinely different semantics)`,
+          fixRef: 'boxel/references/base-field-catalog.md',
+        });
+      }
+    }
+
+    // ---- duplicate-catalog-field: matched against the repo's shared fields/ inventory
+    const repoRoot = ctx.repoRoot;
+    const fieldsDir = join(repoRoot, 'fields');
+    if (existsSync(fieldsDir)) {
+      const catalogFields = readdirSync(fieldsDir, { withFileTypes: true })
+        .filter((d) => d.isDirectory())
+        .map((d) => d.name); // e.g. "rating"
+      for (const def of ctx.kit.defs) {
+        if (def.kind !== 'field') continue;
+        const stem = def.name.replace(/Field$/, '').toLowerCase();
+        const hit = catalogFields.find((f) => f.replace(/-/g, '') === stem);
+        // skip when the def under scan IS that catalog field package
+        if (hit && !ctx.listingDirName.includes(hit)) {
+          findings.push({
+            rule: 'reuse/duplicate-catalog-field',
+            severity: 'warn',
+            file: def.file,
+            loc: `class ${def.name} (line ${def.line})`,
+            message: `FieldDef ${def.name} duplicates the existing catalog field package fields/${hit}`,
+            suggestion: `Depend on fields/${hit} instead of re-implementing it`,
+          });
+        }
+      }
+    }
+
+    // ---- duplicate-catalog-card: fuzzy listing-title match (info only)
+    const myName = ctx.listing?.doc?.data?.attributes?.name;
+    if (myName && existsSync(repoRoot)) {
+      const mine = norm(myName);
+      for (const dirent of readdirSync(repoRoot, { withFileTypes: true })) {
+        if (!dirent.isDirectory() || dirent.name === ctx.listingDirName) continue;
+        for (const sub of ['CardListing', 'AppListing', 'FieldListing', 'SkillListing', 'ThemeListing', 'ComponentListing']) {
+          const dir = join(repoRoot, dirent.name, sub);
+          if (!existsSync(dir)) continue;
+          for (const f of readdirSync(dir)) {
+            try {
+              const name = JSON.parse(readFileSync(join(dir, f), 'utf8'))?.data?.attributes?.name;
+              if (name && similar(mine, norm(name))) {
+                findings.push({
+                  rule: 'reuse/duplicate-catalog-card',
+                  severity: 'info',
+                  file: ctx.listing.path,
+                  message: `A similar listing already exists: ${dirent.name} ("${name}")`,
+                  suggestion: 'Confirm this listing is differentiated, or extend the existing one',
+                });
+              }
+            } catch { /* unparseable sibling — not this gate's problem */ }
+          }
+        }
+      }
+    }
+
+    // ---- inventory block (attached to the gate result by run.mjs via findings meta)
+    const uiImports = new Set();
+    for (const src of ctx.gtsSources.values()) {
+      for (const imp of importDecls(src)) {
+        if (imp.source.startsWith(uiManifest.importPath)) {
+          for (const name of imp.clause.replace(/[{}]/g, '').split(',')) {
+            const n = name.trim().split(/\s+as\s+/)[0];
+            if (n) uiImports.add(n);
+          }
+        }
+      }
+    }
+    ctx.inventory = {
+      boxelUiComponentsUsed: [...uiImports].sort(),
+      handRolledFindings: findings.filter((f) => f.rule.startsWith('reuse/hand-rolled')).length,
+    };
+
+    return findings;
+  },
+};
+
+function norm(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+// crude similarity: containment or Levenshtein <= 2 on normalized names
+function similar(a, b) {
+  if (a === b) return true;
+  if (a.length > 5 && b.length > 5 && (a.includes(b) || b.includes(a))) return true;
+  if (Math.abs(a.length - b.length) > 2) return false;
+  return levenshtein(a, b) <= 2;
+}
+function levenshtein(a, b) {
+  const dp = Array.from({ length: a.length + 1 }, (_, i) => [i, ...Array(b.length).fill(0)]);
+  for (let j = 0; j <= b.length; j++) dp[0][j] = j;
+  for (let i = 1; i <= a.length; i++) {
+    for (let j = 1; j <= b.length; j++) {
+      dp[i][j] = Math.min(
+        dp[i - 1][j] + 1,
+        dp[i][j - 1] + 1,
+        dp[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1)
+      );
+    }
+  }
+  return dp[a.length][b.length];
+}
diff --git a/scripts/conformance/gates/s14-slop-signals.mjs b/scripts/conformance/gates/s14-slop-signals.mjs
new file mode 100644
index 00000000..8779772f
--- /dev/null
+++ b/scripts/conformance/gates/s14-slop-signals.mjs
@@ -0,0 +1,100 @@
+// S14 — deterministic AI-slop tells. Warnings only; the design jury (D06, run
+// by the factory's conform command) is the judgment layer — this gate catches
+// what regex can catch. Every finding must be fixed or waived with a reason.
+import { instances, attributesOf, walkStrings } from '../lib/json-walk.mjs';
+import { styleBlocks, templateBlocks } from '../lib/gts-scan.mjs';
+
+const FIX = 'catalog-card-factory/references/taste-rubric.md';
+
+// the canonical "AI gradient" purple/indigo family
+const SLOP_HEXES = /#(667eea|764ba2|8b5cf6|a855f7|7c3aed|6366f1|4f46e5|9333ea|7e22ce)\b/i;
+// NOTE: bare "placeholder" is NOT matched — placeholder= is a legitimate HTML
+// attribute; only placeholder-as-content counts (see TEMPLATED_SAMPLE).
+const PLACEHOLDER_COPY = /\b(lorem ipsum|john doe|jane doe|my awesome|acme corp|description (goes )?here|insert \w+ here|your \w+ here)\b/i;
+const TEMPLATED_SAMPLE = /^(placeholder|(item|card|entry|thing|test|sample|example)\s*#?\d+)$/i;
+const EMOJI = /\p{Extended_Pictographic}/gu;
+const GENERIC_FONT_STACK = /font-family\s*:\s*['"]?(inter|roboto|arial|helvetica)\b(?![^;]*var\()/i;
+
+export default {
+  id: 's14-slop-signals',
+  title: 'AI-slop tells',
+  phase: 'static',
+  run(ctx) {
+    const findings = [];
+
+    for (const [rel, src] of ctx.gtsSources) {
+      const styles = styleBlocks(src).join('\n');
+      const templates = templateBlocks(src).join('\n');
+
+      if (/linear-gradient/i.test(styles) && SLOP_HEXES.test(styles)) {
+        findings.push({
+          rule: 'slop/default-gradient',
+          severity: 'warn',
+          file: rel,
+          message: 'The default purple/indigo AI gradient — the single most recognizable slop tell',
+          suggestion: 'Derive colors from the brief\'s aesthetic anchor instead',
+          fixRef: FIX,
+        });
+      }
+      const emoji = templates.match(EMOJI) ?? [];
+      if (new Set(emoji).size >= 5) {
+        findings.push({
+          rule: 'slop/emoji-as-icons',
+          severity: 'warn',
+          file: rel,
+          message: `${new Set(emoji).size} distinct emoji in templates — emoji-as-iconography reads as unfinished`,
+          suggestion: 'Use @cardstack/boxel-icons (CDN-verified) or in-world typographic marks',
+          fixRef: FIX,
+        });
+      }
+      if (PLACEHOLDER_COPY.test(templates)) {
+        findings.push({
+          rule: 'slop/placeholder-copy',
+          severity: 'warn',
+          file: rel,
+          message: `Placeholder copy in template (${templates.match(PLACEHOLDER_COPY)[0]})`,
+          suggestion: 'Every string a user sees should be in-world for the brief',
+          fixRef: FIX,
+        });
+      }
+      if (GENERIC_FONT_STACK.test(styles)) {
+        findings.push({
+          rule: 'slop/generic-font-stack',
+          severity: 'warn',
+          file: rel,
+          message: `Hard-coded generic font stack (${styles.match(GENERIC_FONT_STACK)[0].slice(0, 40)}) — typography should come from the theme`,
+          suggestion: 'Use var(--font-family, …) tokens; pick display faces from the brief vocabulary',
+          fixRef: FIX,
+        });
+      }
+    }
+
+    // sample-data blandness in instances
+    for (const [rel, doc] of instances(ctx)) {
+      if (/(^|\/)(Spec|[A-Za-z]+Listing)\//.test(rel)) continue;
+      walkStrings(attributesOf(doc), (path, str) => {
+        if (TEMPLATED_SAMPLE.test(str.trim())) {
+          findings.push({
+            rule: 'slop/templated-sample-data',
+            severity: 'warn',
+            file: rel,
+            loc: path,
+            message: `Templated sample value ${JSON.stringify(str)} — example instances must be in-world for the brief (real names, real register)`,
+            fixRef: FIX,
+          });
+        } else if (PLACEHOLDER_COPY.test(str)) {
+          findings.push({
+            rule: 'slop/placeholder-copy',
+            severity: 'warn',
+            file: rel,
+            loc: path,
+            message: `Placeholder copy in sample data (${str.match(PLACEHOLDER_COPY)[0]})`,
+            fixRef: FIX,
+          });
+        }
+      });
+    }
+
+    return findings;
+  },
+};
diff --git a/scripts/conformance/lib/exec.mjs b/scripts/conformance/lib/exec.mjs
new file mode 100644
index 00000000..3f30e95f
--- /dev/null
+++ b/scripts/conformance/lib/exec.mjs
@@ -0,0 +1,21 @@
+// Shell-out helper for dynamic gates (npx boxel …). Static gates never use this.
+import { spawn } from 'node:child_process';
+
+export function runCli(args, { timeoutMs = 120_000, cwd } = {}) {
+  return new Promise((resolve) => {
+    const child = spawn('npx', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    const timer = setTimeout(() => child.kill('SIGKILL'), timeoutMs);
+    child.stdout.on('data', (d) => (stdout += d));
+    child.stderr.on('data', (d) => (stderr += d));
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      resolve({ code, stdout, stderr });
+    });
+    child.on('error', (err) => {
+      clearTimeout(timer);
+      resolve({ code: -1, stdout, stderr: String(err) });
+    });
+  });
+}
diff --git a/scripts/conformance/lib/gts-scan.mjs b/scripts/conformance/lib/gts-scan.mjs
new file mode 100644
index 00000000..49327806
--- /dev/null
+++ b/scripts/conformance/lib/gts-scan.mjs
@@ -0,0 +1,154 @@
+// Lightweight structural scanning of .gts card modules — regex + brace matching,
+// deliberately NOT a real parser (stdlib-only constraint). Good enough for the
+// conformance gates; anything subtler belongs in glint/eslint (ci-lint.yaml).
+
+/**
+ * Extract class declarations with their body spans.
+ * Returns [{ name, base, exported, start, end, body }] where body is the source
+ * text between the class's braces (best-effort brace matching that ignores
+ * braces inside strings/template literals only crudely — fine for gate use).
+ */
+export function extractClasses(src) {
+  const out = [];
+  const re = /(export\s+)?class\s+([A-Za-z0-9_$]+)\s+extends\s+([A-Za-z0-9_$.]+)/g;
+  let m;
+  while ((m = re.exec(src))) {
+    const braceStart = src.indexOf('{', re.lastIndex);
+    if (braceStart === -1) continue;
+    let depth = 0;
+    let i = braceStart;
+    for (; i < src.length; i++) {
+      const ch = src[i];
+      if (ch === '{') depth++;
+      else if (ch === '}') {
+        depth--;
+        if (depth === 0) break;
+      }
+    }
+    out.push({
+      exported: Boolean(m[1]),
+      name: m[2],
+      base: m[3],
+      start: m.index,
+      end: i,
+      body: src.slice(braceStart + 1, i),
+      line: src.slice(0, m.index).split('\n').length,
+    });
+  }
+  return out;
+}
+
+/** Names a class ultimately extends, resolved through classes defined in the same kit. */
+export function resolveBase(className, classIndex, seen = new Set()) {
+  if (seen.has(className)) return className;
+  seen.add(className);
+  const cls = classIndex.get(className);
+  if (!cls) return className;
+  return resolveBase(cls.base, classIndex, seen);
+}
+
+const DEF_ROOTS = new Set(['CardDef', 'FieldDef']);
+
+/**
+ * Build a kit-wide view over all .gts sources:
+ * classIndex: name -> { file, name, base, exported, body, line }
+ * defs: [{ file, name, kind: 'card'|'field', exported, body, line }]
+ * (Transitively resolves local inheritance: class Task extends TrackedCard extends CardDef.)
+ */
+export function indexKit(gtsSources) {
+  const classIndex = new Map();
+  for (const [file, src] of gtsSources) {
+    for (const cls of extractClasses(src)) {
+      classIndex.set(cls.name, { file, ...cls });
+    }
+  }
+  const defs = [];
+  for (const cls of classIndex.values()) {
+    const root = resolveBase(cls.name, classIndex);
+    if (DEF_ROOTS.has(root)) {
+      defs.push({ ...cls, kind: root === 'CardDef' ? 'card' : 'field' });
+    }
+  }
+  return { classIndex, defs };
+}
+
+/** static format blocks declared directly in a class body: { isolated, embedded, fitted, edit, atom } -> body text */
+export function staticFormats(classBody) {
+  const out = {};
+  const re = /static\s+(isolated|embedded|fitted|edit|atom)\s*[:=]/g;
+  let m;
+  while ((m = re.exec(classBody))) {
+    // capture from the match to the next `static <format>` or end of body — a
+    // coarse span, only used for looking inside one format's template/styles.
+    const rest = classBody.slice(m.index + m[0].length);
+    const next = rest.search(/\n\s*static\s+(isolated|embedded|fitted|edit|atom|displayName|prefersWideFormat|headerColor|icon)\s*[:=]/);
+    out[m[1]] = next === -1 ? rest : rest.slice(0, next);
+  }
+  return out;
+}
+
+/** All <style scoped> block contents in a source span. */
+export function styleBlocks(span) {
+  const out = [];
+  const re = /<style(?:\s+scoped)?\s*>([\s\S]*?)<\/style>/g;
+  let m;
+  while ((m = re.exec(span))) out.push(m[1]);
+  return out;
+}
+
+/** All <template> block contents (with nested style blocks stripped). */
+export function templateBlocks(span) {
+  const out = [];
+  const re = /<template>([\s\S]*?)<\/template>/g;
+  let m;
+  while ((m = re.exec(span))) out.push(m[1].replace(/<style(?:\s+scoped)?\s*>[\s\S]*?<\/style>/g, ''));
+  return out;
+}
+
+/** @field declarations: [{ name, kind: contains|containsMany|linksTo|linksToMany, target, thunk, line }] */
+export function fieldDecls(src) {
+  const out = [];
+  const re = /@field\s+([A-Za-z0-9_$]+)\s*=\s*(contains|containsMany|linksTo|linksToMany)\(\s*(\(\s*\)\s*=>)?\s*([A-Za-z0-9_$.]+)?/g;
+  let m;
+  while ((m = re.exec(src))) {
+    out.push({
+      name: m[1],
+      kind: m[2],
+      thunk: Boolean(m[3]),
+      target: m[4] ?? null,
+      line: src.slice(0, m.index).split('\n').length,
+    });
+  }
+  return out;
+}
+
+/** import specifiers: [{ names: [...], source, line }] */
+export function importDecls(src) {
+  const out = [];
+  const re = /import\s+(?:([\s\S]*?)\s+from\s+)?['"]([^'"]+)['"]/g;
+  let m;
+  while ((m = re.exec(src))) {
+    out.push({
+      clause: (m[1] ?? '').trim(),
+      source: m[2],
+      line: src.slice(0, m.index).split('\n').length,
+    });
+  }
+  return out;
+}
+
+/** Map of DateField/DateTimeField contains-fields per source: { fieldName -> 'DateField'|'DateTimeField' } */
+export function dateFieldMap(src) {
+  const out = {};
+  const re = /@field\s+([A-Za-z0-9_$]+)\s*=\s*contains\(\s*(?:\(\s*\)\s*=>\s*)?(DateField|DateTimeField)/g;
+  let m;
+  while ((m = re.exec(src))) out[m[1]] = m[2];
+  return out;
+}
+
+/** line number of the first occurrence of a pattern in src (1-based), or null. */
+export function lineOf(src, pattern) {
+  const idx = typeof pattern === 'string' ? src.indexOf(pattern) : src.search(pattern);
+  if (idx === -1) return null;
+  return src.slice(0, idx).split('\n').length;
+}
diff --git a/scripts/conformance/lib/json-walk.mjs b/scripts/conformance/lib/json-walk.mjs
new file mode 100644
index 00000000..ebde2ebb
--- /dev/null
+++ b/scripts/conformance/lib/json-walk.mjs
@@ -0,0 +1,89 @@
+// Filesystem walking + JSON instance loading for a listing directory.
+// Stdlib only — must run in CI with no npm install.
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative, extname, posix, dirname } from 'node:path';
+
+const SKIP_DIRS = new Set(['.git', 'node_modules', '.boxel-history']);
+const SKIP_FILES = new Set(['.conformance-report.json']);
+
+/** Recursively list files under dir, returning repo-style relative paths (posix separators). */
+export function walkFiles(rootDir) {
+  const out = [];
+  const walk = (dir) => {
+    for (const name of readdirSync(dir)) {
+      if (SKIP_DIRS.has(name)) continue;
+      const full = join(dir, name);
+      const st = statSync(full);
+      if (st.isDirectory()) walk(full);
+      else if (!SKIP_FILES.has(name)) out.push(relative(rootDir, full).split('\\').join('/'));
+    }
+  };
+  walk(rootDir);
+  return out.sort();
+}
+
+/**
+ * Load the listing dir into a context object shared by all gates.
+ * jsonDocs: rel path -> { doc, error } (error set when unparseable — S02 reports it).
+ * gtsSources: rel path (with .gts ext) -> source text.
+ */
+export function loadListingDir(rootDir) {
+  const files = walkFiles(rootDir);
+  const jsonDocs = new Map();
+  const gtsSources = new Map();
+  for (const rel of files) {
+    const ext = extname(rel);
+    if (ext === '.json') {
+      const raw = readFileSync(join(rootDir, rel), 'utf8');
+      try {
+        jsonDocs.set(rel, { doc: JSON.parse(raw) });
+      } catch (e) {
+        jsonDocs.set(rel, { doc: null, error: String(e.message).slice(0, 120) });
+      }
+    } else if (ext === '.gts' || ext === '.gjs') {
+      gtsSources.set(rel, readFileSync(join(rootDir, rel), 'utf8'));
+    }
+  }
+  return { rootDir, files, jsonDocs, gtsSources };
+}
+
+/** True for card instance docs (skips realm.json / index.json if ever present). */
+export function isInstancePath(rel) {
+  return rel.endsWith('.json') && !rel.endsWith('realm.json') && !rel.endsWith('index.json');
+}
+
+/** Iterate [relPath, doc] for parseable card instance documents. */
+export function* instances(ctx) {
+  for (const [rel, entry] of ctx.jsonDocs) {
+    if (!isInstancePath(rel) || !entry.doc) continue;
+    const d = entry.doc?.data;
+    if (d && typeof d === 'object') yield [rel, entry.doc];
+  }
+}
+
+/** relationships map of an instance doc (always an object). */
+export function relationshipsOf(doc) {
+  const r = doc?.data?.relationships;
+  return r && typeof r === 'object' ? r : {};
+}
+
+/** attributes map of an instance doc (always an object). */
+export function attributesOf(doc) {
+  const a = doc?.data?.attributes;
+  return a && typeof a === 'object' ? a : {};
+}
+
+/** Resolve a relative link (e.g. "../Spec/foo") against the instance's location inside the listing dir. */
+export function resolveRelative(instanceRelPath, link) {
+  const base = dirname(instanceRelPath);
+  return posix.normalize(posix.join(base, link));
+}
+
+/** Depth-first walk of every string value in a JSON value; cb(path, str). */
+export function walkStrings(value, cb, path = '$') {
+  if (typeof value === 'string') cb(path, value);
+  else if (Array.isArray(value)) value.forEach((v, i) => walkStrings(v, cb, `${path}[${i}]`));
+  else if (value && typeof value === 'object') {
+    for (const [k, v] of Object.entries(value)) walkStrings(v, cb, `${path}.${k}`);
+  }
+}
diff --git a/scripts/conformance/lib/report.mjs b/scripts/conformance/lib/report.mjs
new file mode 100644
index 00000000..61faae9f
--- /dev/null
+++ b/scripts/conformance/lib/report.mjs
@@ -0,0 +1,109 @@
+// Findings aggregation, waiver application, human + JSON output.
+
+/** finding: { rule, severity: 'error'|'warn'|'info', file, loc?, message, suggestion?, fixRef? } */
+export function makeFinding(f) {
+  return { severity: 'warn', ...f };
+}
+
+/**
+ * Minimal YAML subset parser for waiver files — a list of flat maps:
+ *   waivers:
+ *     - rule: reuse/hand-rolled-button
+ *       file: recipe-box.gts
+ *       reason: "custom pressed-state animation"
+ * Also accepts a bare top-level list (no `waivers:` key). Nothing else.
+ */
+export function parseWaivers(text) {
+  const waivers = [];
+  let current = null;
+  for (const raw of text.split('\n')) {
+    const line = raw.replace(/#.*$/, '').trimEnd();
+    if (!line.trim() || /^waivers\s*:\s*$/.test(line.trim())) continue;
+    const item = line.match(/^\s*-\s+(\w+)\s*:\s*(.+)$/);
+    const cont = line.match(/^\s+(\w+)\s*:\s*(.+)$/);
+    if (item) {
+      current = {};
+      waivers.push(current);
+      current[item[1]] = unquote(item[2]);
+    } else if (cont && current) {
+      current[cont[1]] = unquote(cont[2]);
+    }
+  }
+  return waivers.filter((w) => w.rule);
+}
+
+function unquote(s) {
+  const t = s.trim();
+  if ((t.startsWith('"') && t.endsWith('"')) || (t.startsWith("'") && t.endsWith("'"))) {
+    return t.slice(1, -1);
+  }
+  return t;
+}
+
+/** Mark findings matched by a waiver (rule required; file optional = waives all files). */
+export function applyWaivers(findings, waivers) {
+  for (const f of findings) {
+    const w = waivers.find(
+      (w) => w.rule === f.rule && (!w.file || w.file === f.file)
+    );
+    if (w) {
+      f.waived = true;
+      f.waivedReason = w.reason ?? '';
+    }
+  }
+  return findings;
+}
+
+export function buildReport({ listingDir, phase, gateResults, harnessVersion }) {
+  const all = gateResults.flatMap((g) => g.findings);
+  const active = all.filter((f) => !f.waived);
+  const errors = active.filter((f) => f.severity === 'error').length;
+  const warnings = active.filter((f) => f.severity === 'warn').length;
+  const waived = all.filter((f) => f.waived).length;
+  return {
+    harnessVersion,
+    listingDir,
+    phase,
+    summary: {
+      result: errors > 0 ? 'fail' : 'pass',
+      errors,
+      warnings,
+      waived,
+    },
+    gates: gateResults.map((g) => ({
+      id: g.id,
+      title: g.title,
+      status: g.error
+        ? 'harness-error'
+        : g.findings.some((f) => !f.waived && f.severity === 'error')
+          ? 'fail'
+          : g.findings.some((f) => !f.waived)
+            ? 'warn'
+            : 'pass',
+      durationMs: g.durationMs,
+      ...(g.error ? { error: g.error } : {}),
+      findings: g.findings,
+    })),
+  };
+}
+
+const ICONS = { pass: '✓', warn: '△', fail: '✗', 'harness-error': '!' };
+
+export function printHuman(report, out = console) {
+  out.log(`\nConformance — ${report.listingDir} (phase: ${report.phase})\n`);
+  for (const gate of report.gates) {
+    out.log(`  ${ICONS[gate.status] ?? '?'} ${gate.id}  ${gate.title}  (${gate.durationMs}ms)`);
+    for (const f of gate.findings) {
+      const tag = f.waived ? 'waived' : f.severity;
+      out.log(`      [${tag}] ${f.file}${f.loc ? ` :: ${f.loc}` : ''}`);
+      out.log(`        ${f.message}`);
+      if (f.suggestion && !f.waived) out.log(`        → ${f.suggestion}`);
+      if (f.waived) out.log(`        (waived: ${f.waivedReason})`);
+    }
+    if (gate.error) out.log(`      harness error: ${gate.error}`);
+  }
+  const s = report.summary;
+  out.log(
+    `\n  ${s.result === 'pass' ? '✓ PASS' : '✗ FAIL'} — ${s.errors} error(s), ${s.warnings} warning(s), ${s.waived} waived\n`
+  );
+}
diff --git a/scripts/conformance/report-schema.json b/scripts/conformance/report-schema.json
new file mode 100644
index 00000000..4ed9ec64
--- /dev/null
+++ b/scripts/conformance/report-schema.json
@@ -0,0 +1,60 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Catalog listing conformance report",
+  "type": "object",
+  "required": ["harnessVersion", "listingDir", "phase", "summary", "gates"],
+  "properties": {
+    "harnessVersion": { "type": "string" },
+    "listingDir": { "type": "string" },
+    "phase": { "enum": ["static", "full"] },
+    "summary": {
+      "type": "object",
+      "required": ["result", "errors", "warnings", "waived"],
+      "properties": {
+        "result": { "enum": ["pass", "fail"] },
+        "errors": { "type": "integer", "minimum": 0 },
+        "warnings": { "type": "integer", "minimum": 0 },
+        "waived": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "inventory": {
+      "type": "object",
+      "properties": {
+        "boxelUiComponentsUsed": { "type": "array", "items": { "type": "string" } },
+        "handRolledFindings": { "type": "integer" }
+      }
+    },
+    "gates": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "title", "status", "durationMs", "findings"],
+        "properties": {
+          "id": { "type": "string" },
+          "title": { "type": "string" },
+          "status": { "enum": ["pass", "warn", "fail", "harness-error"] },
+          "durationMs": { "type": "integer" },
+          "error": { "type": "string" },
+          "findings": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": ["rule", "severity", "file", "message"],
+              "properties": {
+                "rule": { "type": "string" },
+                "severity": { "enum": ["error", "warn", "info"] },
+                "file": { "type": "string" },
+                "loc": { "type": "string" },
+                "message": { "type": "string" },
+                "suggestion": { "type": "string" },
+                "fixRef": { "type": "string" },
+                "waived": { "type": "boolean" },
+                "waivedReason": { "type": "string" }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/scripts/conformance/rules/base-field-manifest.json b/scripts/conformance/rules/base-field-manifest.json
new file mode 100644
index 00000000..1d9390ad
--- /dev/null
+++ b/scripts/conformance/rules/base-field-manifest.json
@@ -0,0 +1,22 @@
+{
+  "comment": "Base-realm fields a listing must not re-implement. namePattern is matched (case-insensitive) against locally-defined FieldDef class names.",
+  "fields": [
+    { "name": "EmailField", "module": "https://cardstack.com/base/email", "namePattern": "email" },
+    { "name": "PhoneNumberField", "module": "https://cardstack.com/base/phone-number", "namePattern": "phone" },
+    { "name": "UrlField", "module": "https://cardstack.com/base/url", "namePattern": "^(url|link|website)" },
+    { "name": "AddressField", "module": "https://cardstack.com/base/address", "namePattern": "address" },
+    { "name": "CountryField", "module": "https://cardstack.com/base/country", "namePattern": "country" },
+    { "name": "CurrencyField", "module": "https://cardstack.com/base/currency", "namePattern": "currency" },
+    { "name": "AmountWithCurrencyField", "module": "https://cardstack.com/base/amount-with-currency", "namePattern": "(money|price|amount)" },
+    { "name": "PercentageField", "module": "https://cardstack.com/base/percentage", "namePattern": "percent" },
+    { "name": "ColorField", "module": "https://cardstack.com/base/color", "namePattern": "^colou?r" },
+    { "name": "CoordinateField", "module": "https://cardstack.com/base/coordinate", "namePattern": "(coordinate|latlng|geopoint)" },
+    { "name": "EnumField", "module": "https://cardstack.com/base/enum", "namePattern": "^enum" },
+    { "name": "MarkdownField", "module": "https://cardstack.com/base/markdown", "namePattern": "markdown" },
+    { "name": "TextAreaField", "module": "https://cardstack.com/base/text-area", "namePattern": "^(textarea|longtext)" },
+    { "name": "DateRangeField", "module": "https://cardstack.com/base/date-range-field", "namePattern": "daterange" },
+    { "name": "BigIntegerField", "module": "https://cardstack.com/base/big-integer", "namePattern": "bigint" },
+    { "name": "EthereumAddressField", "module": "https://cardstack.com/base/ethereum-address", "namePattern": "(ethereum|wallet)" },
+    { "name": "TagField", "module": "https://cardstack.com/base/tag", "namePattern": "^tagfield" }
+  ]
+}
diff --git a/scripts/conformance/rules/boxel-ui-manifest.json b/scripts/conformance/rules/boxel-ui-manifest.json
new file mode 100644
index 00000000..bd98c311
--- /dev/null
+++ b/scripts/conformance/rules/boxel-ui-manifest.json
@@ -0,0 +1,17 @@
+{
+  "comment": "Components exported from @cardstack/boxel-ui/components — the suggestion targets for reuse findings.",
+  "importPath": "@cardstack/boxel-ui/components",
+  "components": [
+    "Accordion", "AddButton", "Alert", "Avatar", "BasicFitted", "BoxelButton",
+    "BoxelInput", "BoxelInputGroup", "BoxelSelect", "Button", "CardContainer",
+    "CardHeader", "CircleSpinner", "ColorPalette", "ColorPicker", "Container",
+    "ContextButton", "CopyButton", "DateRangePicker", "DndKanbanBoard", "Dropdown",
+    "EmailInput", "EntityDisplayWithIcon", "EntityDisplayWithThumbnail", "FieldContainer",
+    "FilterList", "FittedCard", "GridContainer", "Header", "IconButton", "InputGroup",
+    "Label", "LoadingIndicator", "Menu", "Message", "Modal", "MultiSelect",
+    "PhoneInput", "Pill", "ProgressBar", "ProgressRadial", "RadioInput", "RealmIcon",
+    "ResizablePanelGroup", "SelectionCheckmark", "SelectionMenu", "SkeletonPlaceholder",
+    "SortDropdown", "Swatch", "Switch", "TabbedHeader", "Tag", "TagList", "Tooltip",
+    "ViewSelector"
+  ]
+}
diff --git a/scripts/conformance/rules/reuse-rules.mjs b/scripts/conformance/rules/reuse-rules.mjs
new file mode 100644
index 00000000..b16216ac
--- /dev/null
+++ b/scripts/conformance/rules/reuse-rules.mjs
@@ -0,0 +1,80 @@
+// S13 reuse-inventory rule table. Every rule emits WARNINGS — the factory's
+// conform step requires each finding to be fixed or waived with a reason.
+// Detectors receive { template, styles } (one format's template text + its
+// style blocks joined) and return true when the hand-rolled pattern is present.
+
+const UI = '@cardstack/boxel-ui/components';
+
+function styleDeclCount(styles, selectorHint, props) {
+  // crude: if any rule block mentions the hint (or hint is null), count how many
+  // of the given properties appear anywhere in the styles.
+  if (selectorHint && !new RegExp(selectorHint, 'i').test(styles)) return 0;
+  return props.filter((p) => new RegExp(`(^|[^-a-z])${p}\\s*:`, 'i').test(styles)).length;
+}
+
+export const reuseRules = [
+  {
+    id: 'reuse/hand-rolled-button',
+    detect: ({ template, styles }) =>
+      /<button\b/i.test(template) &&
+      styleDeclCount(styles, 'button|btn', ['background', 'border', 'border-radius', 'padding']) >= 3,
+    message: 'Hand-rolled <button> with heavy custom chrome',
+    suggestion: `Use Button (or IconButton) from ${UI}`,
+  },
+  {
+    id: 'reuse/hand-rolled-select',
+    detect: ({ template }) => /<select\b/i.test(template),
+    message: 'Raw <select> element',
+    suggestion: `Use BoxelSelect from ${UI}`,
+  },
+  {
+    id: 'reuse/hand-rolled-input',
+    formats: ['isolated', 'embedded', 'fitted', 'atom'],
+    detect: ({ template }) => /<(input|textarea)\b/i.test(template),
+    message: 'Raw <input>/<textarea> outside an edit template',
+    suggestion: `Use BoxelInput from ${UI} (and prefer @fields.x in edit format)`,
+  },
+  {
+    id: 'reuse/hand-rolled-pill',
+    detect: ({ template, styles }) =>
+      /class=['"][^'"]*\b(pill|badge|chip)\b/i.test(template) &&
+      /border-radius\s*:\s*(999px|100px|9999px|2em|50px|calc\(infinity)/i.test(styles),
+    message: 'Hand-rolled pill/badge/chip',
+    suggestion: `Use Pill from ${UI}`,
+  },
+  {
+    id: 'reuse/hand-rolled-modal',
+    detect: ({ template, styles }) =>
+      /<dialog\b/i.test(template) ||
+      (/\b(modal|overlay)\b/i.test(template) && /position\s*:\s*fixed/i.test(styles)),
+    message: 'Hand-rolled modal/overlay (position:fixed also breaks the card bounding box)',
+    suggestion: `Use Modal from ${UI}; never position:fixed inside a card`,
+  },
+  {
+    id: 'reuse/hand-rolled-progress',
+    detect: ({ template, styles }) =>
+      /\bprogress\b/i.test(template) && /width\s*:\s*(\{\{|calc|[0-9.]+%)/i.test(styles),
+    message: 'Hand-rolled progress bar',
+    suggestion: `Use ProgressBar or ProgressRadial from ${UI}`,
+  },
+  {
+    id: 'reuse/hand-rolled-tabs',
+    detect: ({ template }) => /role=['"]tab['"]/i.test(template),
+    message: 'Hand-rolled tab strip',
+    suggestion: `Use TabbedHeader (or ViewSelector) from ${UI}`,
+  },
+  {
+    id: 'reuse/hand-rolled-avatar',
+    detect: ({ template, styles }) =>
+      /\bavatar\b/i.test(template) && /border-radius\s*:\s*50%/i.test(styles),
+    message: 'Hand-rolled avatar',
+    suggestion: `Use Avatar from ${UI}`,
+  },
+  {
+    id: 'reuse/hand-rolled-card-frame',
+    detect: ({ styles }) =>
+      styleDeclCount(styles, 'card|container|frame|wrapper', ['border-radius', 'box-shadow', 'border']) >= 3,
+    message: 'Outermost wrapper re-implements card container chrome',
+    suggestion: `Use CardContainer from ${UI} (or rely on the host-injected container)`,
+  },
+];
diff --git a/scripts/conformance/run.mjs b/scripts/conformance/run.mjs
new file mode 100644
index 00000000..fa3f1e0e
--- /dev/null
+++ b/scripts/conformance/run.mjs
@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+// Catalog listing conformance harness.
+//
+//   node scripts/conformance/run.mjs <listing-dir> [--phase static|full]
+//     [--realm <url>] [--json <out.json>] [--waivers <file.yaml>] [--offline]
+//
+// Exit codes: 0 = pass (warnings allowed), 1 = errors found, 2 = harness fault.
+//
+// Static phase is stdlib-only and runs identically in CI (conformance.yaml)
+// and locally. Full phase adds the dynamic gates (boxel-cli + realm endpoints)
+// and is the factory's pre-PR gate.
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { resolve, basename, dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { loadListingDir } from './lib/json-walk.mjs';
+import { indexKit } from './lib/gts-scan.mjs';
+import { parseWaivers, applyWaivers, buildReport, printHuman } from './lib/report.mjs';
+
+const HARNESS_VERSION = '1.0.0';
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+const STATIC_GATES = [
+  's01-structure', 's02-json-validity', 's03-instance-shape', 's04-no-inline-media',
+  's05-relative-refs', 's06-date-shape', 's07-formats-present', 's08-fitted-cq',
+  's09-thunk-links', 's10-theme-vars', 's11-cardinfo', 's12-icon-cdn',
+  's13-reuse-inventory', 's14-slop-signals',
+];
+const DYNAMIC_GATES = [
+  'd01-boxel-parse', 'd02-boxel-lint', 'd03-module-load', 'd04-typed-search', 'd05-prerender',
+];
+
+function parseArgs(argv) {
+  const args = { phase: 'static', offline: false, positional: [] };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--phase') args.phase = argv[++i];
+    else if (a === '--realm') args.realm = argv[++i];
+    else if (a === '--json') args.json = argv[++i];
+    else if (a === '--waivers') args.waivers = argv[++i];
+    else if (a === '--offline') args.offline = true;
+    else if (a === '--help' || a === '-h') args.help = true;
+    else args.positional.push(a);
+  }
+  return args;
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help || args.positional.length !== 1) {
+    console.log('Usage: node scripts/conformance/run.mjs <listing-dir> [--phase static|full] [--realm <url>] [--json <out.json>] [--waivers <file.yaml>] [--offline]');
+    process.exit(args.help ? 0 : 2);
+  }
+  if (!['static', 'full'].includes(args.phase)) {
+    console.error(`Unknown phase: ${args.phase}`);
+    process.exit(2);
+  }
+  const rootDir = resolve(args.positional[0]);
+  if (!existsSync(rootDir)) {
+    console.error(`No such directory: ${rootDir}`);
+    process.exit(2);
+  }
+
+  // ---- build shared context
+  const ctx = loadListingDir(rootDir);
+  ctx.kit = indexKit(ctx.gtsSources);
+  ctx.options = { realm: args.realm, offline: args.offline };
+  ctx.listingDirName = basename(rootDir);
+  ctx.repoRoot = resolve(HERE, '..', '..');
+  const listingPath = ctx.files.find((f) => /(^|\/)[A-Za-z]+Listing\/[^/]+\.json$/.test(f));
+  ctx.listing = listingPath ? { path: listingPath, doc: ctx.jsonDocs.get(listingPath)?.doc } : null;
+
+  // ---- waivers (explicit path, or the dir's own .conformance-waivers.yaml)
+  let waivers = [];
+  const waiverPath = args.waivers ?? join(rootDir, '.conformance-waivers.yaml');
+  if (existsSync(waiverPath)) {
+    waivers = parseWaivers(readFileSync(waiverPath, 'utf8'));
+  }
+
+  // ---- run gates
+  const gateIds = args.phase === 'full' ? [...STATIC_GATES, ...DYNAMIC_GATES] : STATIC_GATES;
+  const gateResults = [];
+  for (const id of gateIds) {
+    const started = Date.now();
+    let findings = [];
+    let error;
+    try {
+      const mod = (await import(`./gates/${id}.mjs`)).default;
+      findings = (await mod.run(ctx)) ?? [];
+    } catch (e) {
+      error = `${e.message}\n${(e.stack ?? '').split('\n')[1] ?? ''}`.trim();
+    }
+    applyWaivers(findings, waivers);
+    gateResults.push({
+      id,
+      title: titleOf(id),
+      findings,
+      error,
+      durationMs: Date.now() - started,
+    });
+  }
+
+  const report = buildReport({
+    listingDir: ctx.listingDirName,
+    phase: args.phase,
+    gateResults,
+    harnessVersion: HARNESS_VERSION,
+  });
+  if (ctx.inventory) report.inventory = ctx.inventory;
+
+  printHuman(report);
+  const jsonPath = args.json ?? join(rootDir, '.conformance-report.json');
+  writeFileSync(jsonPath, JSON.stringify(report, null, 2));
+  console.log(`  report: ${jsonPath}`);
+
+  if (gateResults.some((g) => g.error)) process.exit(2);
+  process.exit(report.summary.result === 'pass' ? 0 : 1);
+}
+
+const TITLES = {
+  's01-structure': 'Listing directory anatomy',
+  's02-json-validity': 'JSON parse + card document shape',
+  's03-instance-shape': 'Relationship shapes (realm-bricking classes)',
+  's04-no-inline-media': 'No inline media / base64 in JSON attributes',
+  's05-relative-refs': 'Reference hygiene',
+  's06-date-shape': 'DateField / DateTimeField value shapes',
+  's07-formats-present': 'Required formats per definition',
+  's08-fitted-cq': 'Container-query fitted layouts',
+  's09-thunk-links': 'Thunk-wrapped kit-internal relationships',
+  's10-theme-vars': 'Theme tokens over color literals',
+  's11-cardinfo': 'cardInfo present on instances',
+  's12-icon-cdn': 'boxel-icons resolve on the CDN',
+  's13-reuse-inventory': 'Component / field / listing reuse',
+  's14-slop-signals': 'AI-slop tells',
+  'd01-boxel-parse': 'boxel parse (glint + document validation)',
+  'd02-boxel-lint': 'Realm lint (/_lint endpoint)',
+  'd03-module-load': 'Module-load probe (Gate A)',
+  'd04-typed-search': 'Typed-search counts (Gate B)',
+  'd05-prerender': 'Prerender formats render clean',
+};
+function titleOf(id) {
+  return TITLES[id] ?? id;
+}
+
+main().catch((e) => {
+  console.error(`harness fault: ${e.stack ?? e}`);
+  process.exit(2);
+});
diff --git a/scripts/conformance/selftest.mjs b/scripts/conformance/selftest.mjs
new file mode 100644
index 00000000..5a62116e
--- /dev/null
+++ b/scripts/conformance/selftest.mjs
@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+// Harness self-test:
+//   1. the broken fixture FAILS with every seeded finding present
+//   2. the known-good exemplar (d29736-tier-list) PASSES
+//   3. reports are structurally valid per report-schema.json's required keys
+// Run: node scripts/conformance/selftest.mjs   (exit 0 = harness healthy)
+import { spawnSync } from 'node:child_process';
+import { readFileSync, rmSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const REPO = resolve(HERE, '..', '..');
+const RUN = join(HERE, 'run.mjs');
+
+let failures = 0;
+const check = (label, ok, detail = '') => {
+  console.log(`  ${ok ? '✓' : '✗'} ${label}${ok || !detail ? '' : ` — ${detail}`}`);
+  if (!ok) failures++;
+};
+
+function runHarness(dir, out) {
+  const res = spawnSync('node', [RUN, dir, '--phase', 'static', '--offline', '--json', out], {
+    cwd: REPO,
+    encoding: 'utf8',
+  });
+  let report = null;
+  try {
+    report = JSON.parse(readFileSync(out, 'utf8'));
+  } catch { /* asserted below */ }
+  return { code: res.status, report, stderr: res.stderr };
+}
+
+function rulesIn(report) {
+  return new Set(report.gates.flatMap((g) => g.findings.map((f) => f.rule)));
+}
+
+function structurallyValid(report) {
+  return (
+    report &&
+    typeof report.harnessVersion === 'string' &&
+    ['static', 'full'].includes(report.phase) &&
+    ['pass', 'fail'].includes(report.summary?.result) &&
+    Array.isArray(report.gates) &&
+    report.gates.every(
+      (g) =>
+        typeof g.id === 'string' &&
+        ['pass', 'warn', 'fail', 'harness-error'].includes(g.status) &&
+        Array.isArray(g.findings) &&
+        g.findings.every((f) => f.rule && f.severity && f.file && f.message)
+    )
+  );
+}
+
+console.log('\nbroken fixture (must fail with all seeded findings):');
+const brokenOut = join(HERE, 'fixtures', '.selftest-broken-report.json');
+const broken = runHarness(join(HERE, 'fixtures', 'broken-listing'), brokenOut);
+check('exit code 1', broken.code === 1, `got ${broken.code} ${broken.stderr?.slice(0, 200) ?? ''}`);
+check('report structurally valid', structurallyValid(broken.report));
+if (broken.report) {
+  const rules = rulesIn(broken.report);
+  for (const expected of [
+    'instance/linksToMany-array',      // S03 seed: speakers array shape
+    'instance/external-url-in-link',   // S03 seed: unsplash jpg in links.self
+    'refs/dev-realm-leftover',         // S05 seed: user-realm URL in venue link
+    'date/datefield-shape',            // S06 seed: ISO datetime in a DateField
+    'media/data-uri',                  // S04 seed: base64 poster
+    'links/bare-kit-internal',         // S09 seed: linksTo(Venue) without thunk
+    'slop/default-gradient',           // S14 seed: 667eea/764ba2 gradient
+    'slop/templated-sample-data',      // S14 seed: title "Item 1"
+    'structure/no-thumbnail',          // S01 seed: null cardThumbnail
+    'structure/no-screenshot',         // S01 seed: no images.N
+    'structure/missing-spec',          // S01 seed: no Spec/ at all
+    'fitted/no-container-query',       // S08 seed: Event fitted without @container
+  ]) {
+    check(`finds ${expected}`, rules.has(expected));
+  }
+}
+
+console.log('\nknown-good exemplar d29736-tier-list (must pass):');
+const goodOut = join(HERE, 'fixtures', '.selftest-good-report.json');
+const good = runHarness(join(REPO, 'd29736-tier-list'), goodOut);
+check('exit code 0', good.code === 0, `got ${good.code} ${good.stderr?.slice(0, 200) ?? ''}`);
+check('report structurally valid', structurallyValid(good.report));
+check('zero errors', good.report?.summary.errors === 0, `got ${good.report?.summary.errors}`);
+
+for (const f of [brokenOut, goodOut]) rmSync(f, { force: true });
+
+console.log(failures === 0 ? '\n✓ selftest passed\n' : `\n✗ selftest: ${failures} failure(s)\n`);
+process.exit(failures === 0 ? 0 : 1);

From fb1eee87664021464198072ecf399a6b301fc183 Mon Sep 17 00:00:00 2001
From: tintinthong <justinthong93@gmail.com>
Date: Mon, 6 Jul 2026 10:13:07 +0800
Subject: [PATCH 2/3] Format fixture venue.gts prettier-compliantly

The monorepo Lint job (ci-lint.yaml) runs eslint+prettier over the whole
checkout including conformance fixtures; the fixture's seeded bugs are
conformance-level, not formatting-level, so formatting can comply.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .../fixtures/broken-listing/venue.gts         | 21 +++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/scripts/conformance/fixtures/broken-listing/venue.gts b/scripts/conformance/fixtures/broken-listing/venue.gts
index 0f22b39d..e5430fc0 100644
--- a/scripts/conformance/fixtures/broken-listing/venue.gts
+++ b/scripts/conformance/fixtures/broken-listing/venue.gts
@@ -1,5 +1,10 @@
 // FIXTURE — minimal linked def for the bare-linksTo seed in event.gts.
-import { CardDef, field, contains, Component } from 'https://cardstack.com/base/card-api';
+import {
+  CardDef,
+  field,
+  contains,
+  Component,
+} from 'https://cardstack.com/base/card-api';
 import StringField from 'https://cardstack.com/base/string';
 
 export class Venue extends CardDef {
@@ -7,16 +12,24 @@ export class Venue extends CardDef {
   @field name = contains(StringField);
 
   static isolated = class extends Component<typeof Venue> {
-    <template><h1>{{@model.name}}</h1></template>
+    <template>
+      <h1>{{@model.name}}</h1>
+    </template>
   };
   static embedded = class extends Component<typeof Venue> {
-    <template><span>{{@model.name}}</span></template>
+    <template>
+      <span>{{@model.name}}</span>
+    </template>
   };
   static fitted = class extends Component<typeof Venue> {
     <template>
       <div class='v'>{{@model.name}}</div>
       <style scoped>
-        @container card (height <= 80px) { .v { font-size: 11px; } }
+        @container card (height <= 80px) {
+          .v {
+            font-size: 11px;
+          }
+        }
       </style>
     </template>
   };

From e2a75704754dde1a50e44d40dad24bc59e38496d Mon Sep 17 00:00:00 2001
From: tintinthong <justinthong93@gmail.com>
Date: Mon, 6 Jul 2026 16:36:00 +0800
Subject: [PATCH 3/3] Document boundary with monorepo software-factory package

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 scripts/conformance/README.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/scripts/conformance/README.md b/scripts/conformance/README.md
index 4ba9041e..1a3927ae 100644
--- a/scripts/conformance/README.md
+++ b/scripts/conformance/README.md
@@ -54,6 +54,18 @@ finding carries `rule`, `severity`, `file`, `loc`, `message`, `suggestion`, and
 `fixRef` (a pointer into the card-factory skill tree), so an agent can consume
 the report as a fix-list.
 
+## Relationship to `software-factory` (boxel monorepo)
+
+`packages/software-factory` validates cards *functionally* against a **live realm**
+(parse, realm lint, module eval, instantiate-from-Spec, QUnit) as part of its
+autonomous in-realm build loop. This harness is deliberately different: static,
+repo-local, zero-infra checks of **catalog-semantic** rules (realm-bricking JSON
+shapes, date contracts, thunk links, theme tokens, CQ fitted layouts, icon CDN,
+reuse inventory, slop tells) that have no counterpart there. The only echo is
+our dynamic D01–D03 wrappers hitting the same realm endpoints their validators
+use. Keep the boundary: in-realm functional validation belongs in
+software-factory; listing-dir catalog conformance belongs here.
+
 ## Extending
 
 One module per gate in `gates/`, uniform interface `{ id, title, phase, run(ctx) }`