chore: bump Node to 24.16.0, add bin build guard, update CI workflows

- .nvmrc: 22.22.0 → 24.16.0
- All workflows: node-version hardcodes → node-version-file .nvmrc
- test-shared-context: matrix [20.x, 22.x] → [24.x]
- bin/*: add existsSync guard with actionable error before import()
- docs/AGENTS.md: add Safety Rules section (rm -rf ban, safe cleanup pattern)
- .gitignore: add .venv/ and scripts/gepa/.before-optimize.md

Author: StackMemory Bot (CLI)

.github/workflows/company-os-compliance.yml

@@ -0,0 +1,52 @@
+name: Company OS SOP Compliance
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: company-os-compliance-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  compliance:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build provenant
+        working-directory: packages/provenant
+        run: npx tsc
+
+      - name: Restore Provenant graph database
+        uses: actions/cache@v4
+        with:
+          path: .provenant/company-os.db
+          key: provenant-company-os-db-${{ github.run_number }}
+          restore-keys: provenant-company-os-db-
+
+      - name: Run Company OS integration tests and log to Provenant
+        run: npx tsx scripts/log-company-os-results.ts .provenant/company-os.db
+
+      - name: Print Company OS SOP compliance report
+        run: npx tsx packages/provenant/src/cli/index.ts compliance --db .provenant/company-os.db --system company-os-test-run
+
+      - name: Upload graph database
+        uses: actions/upload-artifact@v4
+        with:
+          name: provenant-graph-company-os-${{ github.run_number }}
+          path: .provenant/company-os.db
+          retention-days: 30

.github/workflows/coverage-only.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: 'npm'
 
       - name: Install dependencies

.github/workflows/npm-publish.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           registry-url: 'https://registry.npmjs.org'
           cache: 'npm'
 

.github/workflows/prose-compliance.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version-file: '.nvmrc'
           cache: 'npm'
 
       - name: Install dependencies

.github/workflows/provenant-ingest.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version-file: '.nvmrc'
           cache: 'npm'
 
       - name: Install dependencies

.github/workflows/test-shared-context.yml

@@ -34,7 +34,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [20.x, 22.x]
+        node-version: [24.x]
 
     steps:
     - uses: actions/checkout@v4
@@ -62,14 +62,14 @@ jobs:
       env:
         CI: true
 
-    - name: Generate coverage (Node 20 only)
-      if: matrix.node-version == '20.x'
+    - name: Generate coverage (Node 24 only)
+      if: matrix.node-version == '24.x'
       run: npm run test:run -- --coverage
       env:
         CI: true
 
     - name: Upload coverage reports to Codecov
-      if: matrix.node-version == '20.x'
+      if: matrix.node-version == '24.x'
       uses: codecov/codecov-action@v5
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
@@ -97,7 +97,7 @@ jobs:
     - name: Setup Node.js
       uses: actions/setup-node@v4
       with:
-        node-version: 20.x
+        node-version: 24.x
         cache: 'npm'
 
     - name: Install dependencies

.gitignore

@@ -73,6 +73,7 @@ __pycache__/
 *$py.class
 *.egg-info/
 .Python
+.venv/
 venv/
 env/
 ENV/
@@ -140,6 +141,7 @@ packages/diffmem/
 
 # GEPA runtime state (modified by hooks)
 scripts/gepa/.hook-state.json
+scripts/gepa/.before-optimize.md
 scripts/gepa/results/scores.jsonl
 scripts/gepa/state.json
 scripts/gepa/results/

.nvmrc

@@ -1 +1 @@
-22.22.0
+24.16.0

bin/claude-sm

@@ -3,4 +3,19 @@
  * Claude-SM CLI Launcher (ESM)
  * Delegates to built CLI in dist without requiring tsx.
  */
-import('../dist/src/cli/claude-sm.js');
+import { existsSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const target = join(__dirname, '../dist/src/cli/claude-sm.js');
+
+if (!existsSync(target)) {
+  console.error('Error: StackMemory has not been built.');
+  console.error(`Missing: ${target}`);
+  console.error('Run: npm install && npm run build');
+  process.exit(1);
+}
+
+import(target);

bin/claude-smd

@@ -3,4 +3,19 @@
  * Claude-SM-Danger CLI Launcher (ESM)
  * Delegates to built CLI in dist without requiring tsx.
  */
-import('../dist/src/cli/claude-sm-danger.js');
+import { existsSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const target = join(__dirname, '../dist/src/cli/claude-sm-danger.js');
+
+if (!existsSync(target)) {
+  console.error('Error: StackMemory has not been built.');
+  console.error(`Missing: ${target}`);
+  console.error('Run: npm install && npm run build');
+  process.exit(1);
+}
+
+import(target);