refactor(information-architecture): migrate mechanics to Python

.github/workflows/python-quality.yml

@@ -286,6 +286,47 @@ jobs:
           /bin/bash --version
           /bin/bash plugins/foundation/darrow-decisions/backend/tests/decision.test.sh
 
+  information-architecture-windows:
+    name: Information architecture Python ${{ matrix.python-version }} on windows-latest
+    needs: changes
+    if: contains(needs.changes.outputs.packages, 'plugins/foundation/darrow-information-architecture/backend')
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: bash
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+      - run: scripts/check-python --package plugins/foundation/darrow-information-architecture/backend
+
+  information-architecture-fresh-install:
+    name: Fresh install information architecture on ${{ matrix.os }}
+    needs: changes
+    if: contains(needs.changes.outputs.packages, 'plugins/foundation/darrow-information-architecture/backend')
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - uses: astral-sh/setup-uv@v6
+      - run: uv run --quiet --frozen --no-dev --project plugins/foundation/darrow-information-architecture/backend python plugins/foundation/darrow-information-architecture/backend/tests/fresh_install.py
+
   inventory:
     name: Python inventory guard
     runs-on: ubuntu-latest
@@ -425,6 +466,8 @@ jobs:
       - tickets-fresh-install
       - decisions-windows
       - decisions-fresh-install
+      - information-architecture-windows
+      - information-architecture-fresh-install
       - inventory
       - skill-authoring-fresh-install
       - observability-fresh-install
@@ -461,6 +504,9 @@ jobs:
           DECISIONS_SELECTED: ${{ contains(needs.changes.outputs.packages, 'plugins/foundation/darrow-decisions/backend') }}
           DECISIONS_WINDOWS_RESULT: ${{ needs.decisions-windows.result }}
           DECISIONS_INSTALL_RESULT: ${{ needs.decisions-fresh-install.result }}
+          IA_SELECTED: ${{ contains(needs.changes.outputs.packages, 'plugins/foundation/darrow-information-architecture/backend') }}
+          IA_WINDOWS_RESULT: ${{ needs.information-architecture-windows.result }}
+          IA_INSTALL_RESULT: ${{ needs.information-architecture-fresh-install.result }}
         run: |
           scripts/verify-python-quality-results \
             "$CHANGES_RESULT" "$INVENTORY_RESULT" \
@@ -484,3 +530,7 @@ jobs:
           if [ "$DECISIONS_SELECTED" = true ]; then expected=success; fi
           test "$DECISIONS_WINDOWS_RESULT" = "$expected"
           test "$DECISIONS_INSTALL_RESULT" = "$expected"
+          expected=skipped
+          if [ "$IA_SELECTED" = true ]; then expected=success; fi
+          test "$IA_WINDOWS_RESULT" = "$expected"
+          test "$IA_INSTALL_RESULT" = "$expected"

docs/specs/information-architecture.md

@@ -7,6 +7,42 @@ reachable at the moment it matters.
 Plugin: `darrow-information-architecture`. Skills: `setup-information-architecture`,
 `doctor-information-architecture`.
 
+## Portable mechanics
+
+- **IA-P1 — Contained locked execution.** Setup inspection and doctor
+  inspection/verification run through the plugin's frozen UV package on Python
+  3.10–3.13, Linux, macOS, and native Windows. Preserve inventory groups,
+  diagnostics, summary records, and statuses: 64 for invalid arguments, 2 for
+  inaccessible repository/input, 1 for critical verification findings, and 0
+  for completed inspection or successful verification. No Bash runtime shim is
+  required. Setup and doctor retain separate intent and judgment in their skills.
+- **IA-P2 — Filesystem semantics.** Resolve the primary worktree from Git's
+  first porcelain record, otherwise the supplied directory. Accept native
+  repository paths, including Windows drives and UNC paths. Interpret portable
+  guidance routes with forward slashes; accept Windows separators on Windows.
+  Match instruction names with their documented case even on case-insensitive
+  filesystems. Recognize CRLF, LF, and UTF-8 BOM guidance without changing bytes.
+  Emit UTF-8 records even when a native pipe defaults to a legacy code page,
+  so non-Latin repository paths remain reportable.
+  Follow file adapters only within the repository; report broken, looping,
+  external, unreadable, or non-file dependencies rather than silently dropping
+  selected evidence. Existing native imports outside the repository retain
+  their host-owned semantics and are outside the repository audit scope.
+  Do not recurse into directory symlinks. An unavailable
+  native symlink facility never authorizes replacing an existing adapter.
+- **IA-P3 — Safe guidance updates.** Inventory and verification are read-only.
+  Approved edits preserve the source of truth, newline convention, and file
+  permissions. Publish complete replacement content atomically from a temporary
+  file in the destination directory, preserving symlink adapters by updating
+  their canonical source. A failed replacement leaves original bytes intact;
+  concurrent source changes must be detected before replacement. Multi-file
+  edits are not a transaction and must be verified as a complete graph.
+- **IA-P4 — Release evidence.** Retain regression evidence for routing,
+  reachability, native scope, adapters, duplicate content, stale references,
+  refusals, and output. Enforce the repository Python quality gates, property
+  tests, both skill eval suites, and fresh copied-plugin execution using only
+  locked runtime dependencies on all three native platforms.
+
 ## Why
 
 Large root instruction files spend context on every task. Bare repositories

plugins/foundation/darrow-information-architecture/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "darrow-information-architecture",
   "description": "Set up and doctor lean, routed repository information architecture",
-  "version": "0.1.5",
+  "version": "0.2.1",
   "license": "BUSL-1.1"
 }

plugins/foundation/darrow-information-architecture/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "darrow-information-architecture",
-  "version": "0.1.5",
+  "version": "0.2.1",
   "description": "Set up and doctor lean, routed repository information architecture",
   "author": {
     "name": "Björn Rochel",

plugins/foundation/darrow-information-architecture/README.md

@@ -32,10 +32,10 @@ Example: _“Doctor this repository's agent instructions.”_
 
 ### Bundled inspectors
 
-`skills/setup-information-architecture/scripts/ia-setup.sh` inventories the
-repository surfaces needed to design an instruction graph. `bin/ia-doctor`
-inspects routes, runtime reachability, adapter drift, duplicates, cycles, and
-root context size; the doctor skill reaches it through its colocated script.
+The contained `backend/` package supplies `ia-setup inspect`, `ia-doctor
+inspect|verify`, and `ia-write` for approved atomic guidance replacements. Run
+all commands through `uv run --quiet --frozen --no-dev --project <plugin>/backend`.
+The inspectors are read-only; policy and edit decisions remain in the skills.
 These are compact structural checks, not complete validators for every Codex
 or Claude Code configuration format.
 
@@ -70,7 +70,31 @@ Organize or audit repository agent guidance. Use another capability for product
 
 ## Hosts and prerequisites
 
-Codex and Claude Code; repository file access, Bash, and baseline Unix tools.
+Codex and Claude Code; UV, Python 3.10–3.13, and repository file access on
+Linux, macOS, or native Windows. Git resolves the primary worktree when available;
+plain directories work without it. The runtime package has no third-party dependencies.
+
+Paths use native filesystem identity while guidance names require exact documented
+case. LF, CRLF, and UTF-8 BOM guidance are supported. Directory symlinks are not
+traversed; selected broken, looping, external file adapters and unreadable evidence
+fail closed. Native imports outside the repository remain host-owned and outside
+this compact repository audit. Windows symlink privileges are not assumed.
+Output records use UTF-8 on every host, including redirected Windows output.
+
+Approved updates preserve adapter sources, permissions, and newline conventions.
+See [atomic guidance updates](references/file-updates.md) for the digest-checked
+writer and its concurrency boundary. Inventory and verification never write guidance.
+
+## Validation
+
+The package follows the contained Python + UV migration pattern: committed lock,
+separate development tools, Ruff complexity ≤5, strict mypy, property tests, and
+separate 95% line/branch coverage gates. Run `scripts/check-python --package
+plugins/foundation/darrow-information-architecture/backend` from the Darrow checkout.
+The setup and doctor regressions run in pytest across all supported hosts;
+no Bash test harness or runtime launcher remains.
+The fresh-artifact test copies only this plugin and exercises all public entrypoints
+with locked runtime dependencies on Linux, macOS, and native Windows in CI.
 
 ## Installation
 

plugins/foundation/darrow-information-architecture/backend/pyproject.toml

@@ -0,0 +1,59 @@
+[project]
+name = "darrow-information-architecture"
+version = "0.2.1"
+description = "Portable repository guidance inventory and verification"
+requires-python = ">=3.10,<3.14"
+dependencies = []
+
+[project.scripts]
+ia-doctor = "darrow_ia.cli:doctor_entrypoint"
+ia-setup = "darrow_ia.cli:setup_entrypoint"
+ia-write = "darrow_ia.updates:entrypoint"
+
+[dependency-groups]
+dev = [
+  "coverage[toml]>=7.10,<8",
+  "hypothesis>=6.138,<7",
+  "mypy>=1.18,<2",
+  "pytest>=8.4,<9",
+  "ruff>=0.12,<1",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.uv]
+default-groups = []
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/darrow_ia"]
+
+[tool.ruff]
+target-version = "py310"
+line-length = 88
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = ["B", "C4", "C90", "E4", "E7", "E9", "F", "I", "N", "RUF", "SIM", "UP"]
+mccabe.max-complexity = 5
+
+[tool.ruff.format]
+docstring-code-format = true
+
+[tool.mypy]
+python_version = "3.10"
+strict = true
+files = ["src", "tests"]
+
+[tool.pytest.ini_options]
+addopts = ["--strict-config", "--strict-markers"]
+testpaths = ["tests"]
+
+[tool.coverage.run]
+branch = true
+source = ["darrow_ia"]
+
+[tool.coverage.report]
+show_missing = true
+skip_covered = false

plugins/foundation/darrow-information-architecture/backend/src/darrow_ia/__init__.py

@@ -0,0 +1 @@
+"""Portable repository guidance mechanics."""