Check that every rev reference agrees with the policy block

.github/workflows/validate.yml

@@ -47,7 +47,7 @@ jobs:
           grep -qE '^[[:space:]]*author:' "$S" || { echo "::error::frontmatter author missing"; exit 1; }
           [ "$(grep -cx -- '<!-- stackwich:v1 -->' "$S")" -eq 1 ] || { echo "::error::SKILL.md must contain exactly one whole-line opening marker"; exit 1; }
           [ "$(grep -cx -- '<!-- /stackwich:v1 -->' "$S")" -eq 1 ] || { echo "::error::SKILL.md must contain exactly one whole-line closing marker"; exit 1; }
-          [ "$(grep -cx -- '<!-- policy-rev: 5 -->' "$S")" -eq 1 ] || { echo "::error::SKILL.md must contain exactly one whole-line policy-rev: 5 comment"; exit 1; }
+          [ "$(grep -cxE -- '<!-- policy-rev: [0-9]+ -->' "$S")" -eq 1 ] || { echo "::error::SKILL.md must contain exactly one whole-line policy-rev comment"; exit 1; }
           for h in Prompt Context Harness Loop Graph; do
             awk '/^<!-- stackwich:v1 -->$/,/^<!-- \/stackwich:v1 -->$/' "$S" | grep -q "^### $h" || { echo "::error::policy block missing the $h layer"; exit 1; }
           done
@@ -86,6 +86,61 @@ jobs:
           PY
           echo "frontmatter OK"
 
+      - name: Revision references agree
+        run: |
+          python3 - <<'PY'
+          import json, re, sys, pathlib
+          bad = []
+          def lines(p): return pathlib.Path(p).read_text().splitlines()
+          def region(ls, start, end, path):
+            if ls.count(start) != 1 or ls.count(end) != 1:
+              bad.append(f"{path} needs exactly one whole-line {start} and {end}"); return []
+            return ls[ls.index(start) + 1:ls.index(end)]
+          def one(ls, pattern, what):
+            hits = [m.group(1) for m in map(re.compile(pattern).fullmatch, ls) if m]
+            if len(hits) != 1:
+              bad.append(f"{what}: expected exactly one, found {len(hits)}"); return None
+            return hits[0]
+          S = "plugins/stackwich/skills/stackwich/SKILL.md"
+          s = lines(S)
+          rev = one(region(s, "<!-- stackwich:v1 -->", "<!-- /stackwich:v1 -->", S), r"<!-- policy-rev: (\d+) -->", f"{S} policy-rev comment inside the block")
+          fm = s[1:s.index("---", 1)] if s[:1] == ["---"] and "---" in s[1:] else []
+          md = [k for k, x in enumerate(fm) if x == "metadata:"]
+          if len(md) != 1:
+            bad.append(f"{S} frontmatter needs exactly one whole-line metadata: key, found {len(md)}"); meta = None
+          else:
+            e = next((k for k in range(md[0] + 1, len(fm)) if fm[k].strip() and not fm[k][0].isspace()), len(fm))
+            meta = one(fm[md[0] + 1:e], r"  policy-rev: (\d+)", f"{S} frontmatter policy-rev directly under metadata")
+          h = "## 4. Verify the install"
+          i = s.index(h) if h in s else len(s)
+          j = next((k for k in range(i + 1, len(s)) if s[k].startswith("## ")), len(s))
+          step4 = one(s[i + 1:j], r"2\. `policy-rev: (\d+)` is present inside the block.*", f"{S} step 4 check 2")
+          for label, val in (("frontmatter metadata.policy-rev", meta), ("step 4 check 2", step4)):
+            if None not in (rev, val) and val != rev:
+              bad.append(f"{S} {label} is {val}, but the block's policy-rev comment is {rev}")
+          evals = {e["id"]: e for e in json.loads(pathlib.Path("evals/evals.json").read_text())["evals"]}
+          for cid in (1, 2):
+            case = evals.get(cid, {})
+            found = {n for t in [case.get("expected_output", ""), *case.get("assertions", [])] for n in re.findall(r"policy-rev:? (\d+)", t)}
+            if not found:
+              bad.append(f"evals/evals.json case {cid} names no policy-rev number")
+            for n in sorted(found - {rev}):
+              bad.append(f"evals/evals.json case {cid} says policy-rev {n}, but the block says {rev}")
+          for port, path, readme, a, b in (
+              ("grok", "grok/SKILL.md", "grok/README.md", "<!-- stackwich:v1 -->", "<!-- /stackwich:v1 -->"),
+              ("codex", "codex/references/templates.md", "codex/README.md", "<!-- stackwich-codex:v1 -->", "<!-- /stackwich-codex:v1 -->")):
+            prev = one(region(lines(path), a, b, path), rf"<!-- stackwich-{port}-rev: (\d+) -->", f"{path} stackwich-{port}-rev comment inside the block")
+            said = re.findall(rf"`stackwich-{port}-rev (\d+)`", pathlib.Path(readme).read_text())
+            if len(said) != 1:
+              bad.append(f"{readme}: expected exactly one `stackwich-{port}-rev N` mention, found {len(said)}")
+            elif prev is not None and said[0] != prev:
+              bad.append(f"{readme} says stackwich-{port}-rev {said[0]}, but {path} says {prev}")
+          for msg in bad:
+            print(f"::error::{msg}")
+          sys.exit(1 if bad else 0)
+          PY
+          echo "revisions OK"
+
       - name: Agent assets present and well-formed
         run: |
           A=plugins/stackwich/skills/stackwich/assets