refactor(lockstep): rename xport → lockstep

Cascades the rename from socket-repo-template (xport namespace becomes
lockstep) to disambiguate from the TypeScript export keyword and align
with the fleet's three-axis convention: update / sync / lockstep.

Renamed:
- xport.json → lockstep.json
- xport.schema.json → lockstep.schema.json
- scripts/xport*.mts → scripts/lockstep*.mts
- .claude/skills/updating-xport/ → .claude/skills/updating-lockstep/

Updated:
- package.json scripts (xport, xport:emit-schema)
- CLAUDE.md fleet references
- .claude/skills/updating/SKILL.md (synced to fleet canonical)
- scripts/socket-repo-template-emit-schema.mts header
- repo-specific xport mentions in workflows / per-repo skills / docs

Author: jdalton

.claude/skills/updating-xport/SKILL.md .claude/skills/updating-lockstep/SKILL.md.claude/skills/updating-xport/SKILL.md renamed to .claude/skills/updating-lockstep/SKILL.md

@@ -1,19 +1,19 @@
 ---
-name: updating-xport
-description: Acts on `xport.json` drift for repos that carry the xport lock-step manifest. Reads `pnpm run xport --json`, then for each row acts per-kind — auto-bump `version-pin` rows (low-risk mechanical updates), advisory-only for `file-fork` / `feature-parity` / `spec-conformance` / `lang-parity` (upstream semantics need human judgment). Invoked by the `updating` umbrella skill; can also be invoked standalone.
+name: updating-lockstep
+description: Acts on `lockstep.json` drift for repos that carry the lockstep manifest. Reads `pnpm run lockstep --json`, then for each row acts per-kind — auto-bump `version-pin` rows (low-risk mechanical updates), advisory-only for `file-fork` / `feature-parity` / `spec-conformance` / `lang-parity` (upstream semantics need human judgment). Invoked by the `updating` umbrella skill; can also be invoked standalone.
 user-invocable: true
 allowed-tools: Bash(pnpm:*), Bash(npm:*), Bash(git:*), Bash(node:*), Bash(rg:*), Bash(grep:*), Bash(find:*), Bash(ls:*), Bash(cat:*), Bash(head:*), Bash(tail:*), Bash(wc:*), Bash(diff:*), Read, Edit, Grep, Glob---
 
-# updating-xport
+# updating-lockstep
 
 <task>
-Act on drift findings in `xport.json`. Auto-apply mechanical version-pin bumps; surface everything else as advisory notes for human review. Commit each actioned row as its own atomic commit so the PR reviewer can accept/reject per-row.
+Act on drift findings in `lockstep.json`. Auto-apply mechanical version-pin bumps; surface everything else as advisory notes for human review. Commit each actioned row as its own atomic commit so the PR reviewer can accept/reject per-row.
 </task>
 
 <context>
-**xport** is a cross-project lock-step manifest. Not every repo has one; this skill exits cleanly when `xport.json` is absent. See `xport.schema.json` (deployed via `socket-repo-template/sync-scaffolding.mjs`) for the five row kinds.
+**lockstep** is a cross-project lock-step manifest. Not every repo has one; this skill exits cleanly when `lockstep.json` is absent. See `lockstep.schema.json` (deployed via `socket-repo-template/sync-scaffolding.mjs`) for the five row kinds.
 
-The harness at `scripts/xport.mts` emits JSON reports with `severity ∈ {ok, drift, error}` per row. This skill consumes that JSON.
+The harness at `scripts/lockstep.mts` emits JSON reports with `severity ∈ {ok, drift, error}` per row. This skill consumes that JSON.
 
 **Per-kind action policy:**
 
@@ -32,7 +32,7 @@ The common rule: **version-pin is mechanical** (safe to auto-apply with `track-l
 **Requirements:**
 - Start with clean working directory (check via `git status --porcelain`)
 - Run from repo root
-- Exit 0 cleanly if `xport.json` is absent (the repo doesn't use xport)
+- Exit 0 cleanly if `lockstep.json` is absent (the repo doesn't use lockstep)
 - Conventional commit format: `chore(deps): bump <upstream> to <tag>`
 - Update `.gitmodules` version comments when submodule tags change (pattern: `# <name>-<version>` on the line above the submodule block)
 - Target stable releases only (filter `-rc`, `-alpha`, `-beta`, `-dev`, `-snapshot`, `-nightly`, `-preview`)
@@ -53,9 +53,9 @@ The common rule: **version-pin is mechanical** (safe to auto-apply with `track-l
 ## Phase 1 — Pre-flight
 
 ```bash
-test -f xport.json || { echo "no xport.json; skill n/a"; exit 0; }
-test -f xport.schema.json || { echo "xport.schema.json missing — malformed scaffolding"; exit 1; }
-test -f scripts/xport.mts || { echo "scripts/xport.mts missing — malformed scaffolding"; exit 1; }
+test -f lockstep.json || { echo "no lockstep.json; skill n/a"; exit 0; }
+test -f lockstep.schema.json || { echo "lockstep.schema.json missing — malformed scaffolding"; exit 1; }
+test -f scripts/lockstep.mts || { echo "scripts/lockstep.mts missing — malformed scaffolding"; exit 1; }
 
 git status --porcelain | grep -v '^??' && { echo "dirty tree; aborting"; exit 1; } || true
 
@@ -65,15 +65,15 @@ git status --porcelain | grep -v '^??' && { echo "dirty tree; aborting"; exit 1;
 ## Phase 2 — Collect drift
 
 ```bash
-pnpm run xport --json > /tmp/xport-report.json
+pnpm run lockstep --json > /tmp/lockstep-report.json
 ```
 
 Parse `reports[]` from the JSON. Split into:
 
 - **auto** — rows where `severity == "drift"` AND `kind == "version-pin"` AND `upgrade_policy` ∈ `{ "track-latest", "major-gate" }`
 - **advisory** — everything else with `severity != "ok"`
 
-If both lists empty: exit 0 with "no xport drift".
+If both lists empty: exit 0 with "no lockstep drift".
 
 ## Phase 3 — Auto-bump version-pin rows
 
@@ -82,7 +82,7 @@ For each row in **auto** list, in manifest declaration order:
 **3a. Resolve the upstream submodule + fetch tags**
 
 ```bash
-SUBMODULE=$(jq -r --arg a "$UPSTREAM_ALIAS" '.upstreams[$a].submodule' xport.json)
+SUBMODULE=$(jq -r --arg a "$UPSTREAM_ALIAS" '.upstreams[$a].submodule' lockstep.json)
 cd "$SUBMODULE"
 git fetch origin --tags --quiet
 OLD_SHA=$(git rev-parse HEAD)
@@ -109,36 +109,36 @@ NEW_SHA=$(git rev-parse HEAD)
 cd -
 ```
 
-**3d. Update `xport.json` + `.gitmodules`**
+**3d. Update `lockstep.json` + `.gitmodules`**
 
 Use `jq` for structured edit:
 
 ```bash
 jq --arg id "$ROW_ID" --arg sha "$NEW_SHA" --arg tag "$LATEST" \
   '(.rows[] | select(.id == $id) | .pinned_sha) = $sha
    | (.rows[] | select(.id == $id) | .pinned_tag) = $tag' \
-  xport.json > xport.json.tmp && mv xport.json.tmp xport.json
+  lockstep.json > lockstep.json.tmp && mv lockstep.json.tmp lockstep.json
 ```
 
 Update `.gitmodules` version comment via Edit tool (NOT sed per CLAUDE.md) — replace `# <prefix>-<old>` with `# <prefix>-<new>` on the comment line above the submodule block.
 
 **3e. Validate + commit**
 
 ```bash
-# Confirm xport harness accepts the new state
-pnpm run xport --json > /tmp/xport-post.json
-jq --arg id "$ROW_ID" '.reports[] | select(.id == $id) | .severity' /tmp/xport-post.json
+# Confirm lockstep harness accepts the new state
+pnpm run lockstep --json > /tmp/lockstep-post.json
+jq --arg id "$ROW_ID" '.reports[] | select(.id == $id) | .severity' /tmp/lockstep-post.json
 # expect "ok"
 
 if [ "$CI_MODE" = "false" ]; then
   pnpm test || {
     echo "tests failed; rolling back $ROW_ID"
-    git checkout xport.json .gitmodules "$SUBMODULE"
+    git checkout lockstep.json .gitmodules "$SUBMODULE"
     continue
   }
 fi
 
-git add xport.json .gitmodules "$SUBMODULE"
+git add lockstep.json .gitmodules "$SUBMODULE"
 git commit -m "chore(deps): bump $UPSTREAM_ALIAS to $LATEST"
 ```
 
@@ -162,7 +162,7 @@ For each row in **advisory**, accumulate a markdown line:
 Final human-readable report to stdout:
 
 ```
-## updating-xport report
+## updating-lockstep report
 
 **Auto-bumped:** <N> row(s)
 <list>
@@ -171,18 +171,18 @@ Final human-readable report to stdout:
 <list>
 ```
 
-In CI mode, emit the advisory block to `$GITHUB_OUTPUT` (base64-encoded) under key `xport-advisory` so the weekly-update workflow can include it in the PR body:
+In CI mode, emit the advisory block to `$GITHUB_OUTPUT` (base64-encoded) under key `lockstep-advisory` so the weekly-update workflow can include it in the PR body:
 
 ```bash
 if [ -n "$GITHUB_OUTPUT" ]; then
-  echo "xport-advisory=$(printf '%s' "$ADVISORY" | base64 | tr -d '\n')" >> "$GITHUB_OUTPUT"
+  echo "lockstep-advisory=$(printf '%s' "$ADVISORY" | base64 | tr -d '\n')" >> "$GITHUB_OUTPUT"
 fi
 ```
 
 Emit a HANDOFF block per `_shared/report-format.md`:
 
 ```
-=== HANDOFF: updating-xport ===
+=== HANDOFF: updating-lockstep ===
 Status: {pass|fail}
 Findings: {auto_bumped: N, advisory: M}
 Summary: {one-line description}
@@ -196,17 +196,17 @@ Summary: {one-line description}
 - All actionable `version-pin` rows bumped atomically (one commit per row)
 - Advisory rows collected for PR body / workflow output
 - No edits to non-version-pin row state
-- `pnpm run xport` exits 0 or 2 at end (never 1 — no schema errors introduced)
+- `pnpm run lockstep` exits 0 or 2 at end (never 1 — no schema errors introduced)
 - `.gitmodules` version comments synchronized with `pinned_tag`
 
 ## Commands
 
-- `pnpm run xport --json` — drift report (consumed by this skill)
-- `jq` — parse + edit `xport.json` (structured JSON edits)
+- `pnpm run lockstep --json` — drift report (consumed by this skill)
+- `jq` — parse + edit `lockstep.json` (structured JSON edits)
 - `git submodule status` — verify submodule state after bumps
 
 ## When to use
 
 - Invoked by the `updating` umbrella skill (weekly-update workflow)
-- Standalone: `/updating-xport` when syncing just the xport manifest
-- After manual submodule bumps, to refresh `xport.json` metadata
+- Standalone: `/updating-lockstep` when syncing just the lockstep manifest
+- After manual submodule bumps, to refresh `lockstep.json` metadata

.claude/skills/updating/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: updating
-description: Umbrella update skill for a Socket fleet repo. Runs `pnpm run update` (npm), validates `xport.json` via `pnpm run xport` (if present), optionally bumps submodules, and checks workflow SHA pins. Use when asked to update dependencies, sync upstreams, or prepare for a release.
+description: Umbrella update skill for a Socket fleet repo. Runs `pnpm run update` (npm), validates `lockstep.json` via `pnpm run lockstep` (if present), optionally bumps submodules, and checks workflow SHA pins. Use when asked to update dependencies, sync upstreams, or prepare for a release.
 user-invocable: true
 allowed-tools: Task, Skill, Read, Edit, Grep, Glob, Bash(pnpm run:*), Bash(pnpm test:*), Bash(pnpm install:*), Bash(git:*), Bash(claude --version)
 ---
@@ -9,7 +9,7 @@ allowed-tools: Task, Skill, Read, Edit, Grep, Glob, Bash(pnpm run:*), Bash(pnpm
 
 <task>
 Update all dependencies for this repo: npm packages first, then the
-xport-managed version pins (if `xport.json` exists), then any other
+lockstep-managed version pins (if `lockstep.json` exists), then any other
 submodules tracked via `.gitmodules`, and finally verify workflow
 SHA pins are current. Validate with the full check/test suite before
 committing. The sub-skill delegation mirrors the canonical
@@ -24,17 +24,17 @@ adapts to what the repo has:
 
 **Update Targets:**
 - **npm packages** — via `pnpm run update` (every Socket repo has this script)
-- **xport-managed upstreams** — via `pnpm run xport` when `xport.json` exists
+- **lockstep-managed upstreams** — via `pnpm run lockstep` when `lockstep.json` exists
   (manifest-managed submodule pins + advisory drift on file-fork /
   feature-parity / spec-conformance / lang-parity rows)
 - **Other submodules** — via repo-specific `updating-*` sub-skills
-  when `.gitmodules` has entries not claimed by xport version-pin rows
+  when `.gitmodules` has entries not claimed by lockstep version-pin rows
 - **Workflow SHA pins** — check `_local-not-for-reuse-*.yml` against
   `origin/main`; run the `updating-workflows` skill when stale
 
 **Key files this skill consults:**
-- `xport.json` — if present, drives version-pin bumps and surfaces drift
-- `.gitmodules` — listed submodules; xport's `version-pin` rows take precedence
+- `lockstep.json` — if present, drives version-pin bumps and surfaces drift
+- `.gitmodules` — listed submodules; lockstep's `version-pin` rows take precedence
 - `.github/workflows/_local-not-for-reuse-*.yml` — SHA pin sources
 - `package.json` — `pnpm run update` script
 
@@ -56,7 +56,7 @@ state first to discover what to run.
 
 **Actions:**
 - Update npm packages
-- Apply xport-driven bumps (if `xport.json` present)
+- Apply lockstep-driven bumps (if `lockstep.json` present)
 - Bump remaining submodules (if any)
 - Create atomic commits per category
 - Report summary of changes
@@ -91,30 +91,30 @@ fi
 
 ---
 
-### Phase 3: Validate xport manifest (if applicable)
+### Phase 3: Validate lockstep manifest (if applicable)
 
-If `xport.json` exists at repo root, run the harness in read-only mode
+If `lockstep.json` exists at repo root, run the harness in read-only mode
 to classify drift before acting on it:
 
 ```bash
-if [ -f xport.json ]; then
-  pnpm run xport
-  XPORT_EXIT=$?
-
-  case $XPORT_EXIT in
-    0) echo "✓ xport clean — manifest valid, no drift; skip Phase 4 xport step" ;;
-    1) echo "✗ xport schema/structural error — stopping"; exit 1 ;;
-    2) echo "⚠ xport drift — Phase 4 will invoke updating-xport to act" ;;
+if [ -f lockstep.json ]; then
+  pnpm run lockstep
+  LOCKSTEP_EXIT=$?
+
+  case $LOCKSTEP_EXIT in
+    0) echo "✓ lockstep clean — manifest valid, no drift; skip Phase 4 lockstep step" ;;
+    1) echo "✗ lockstep schema/structural error — stopping"; exit 1 ;;
+    2) echo "⚠ lockstep drift — Phase 4 will invoke updating-lockstep to act" ;;
   esac
 fi
 ```
 
 Exit code semantics:
-- **0** — manifest valid, no drift; nothing for `updating-xport` to do.
+- **0** — manifest valid, no drift; nothing for `updating-lockstep` to do.
 - **1** — schema violation, missing file, or unreachable baseline. Stop
-  and investigate via `scripts/xport-schema.mts` and the failing row's
+  and investigate via `scripts/lockstep-schema.mts` and the failing row's
   `local_*`/`upstream` fields. Do not auto-retry.
-- **2** — drift detected. Phase 4 invokes the `updating-xport` skill,
+- **2** — drift detected. Phase 4 invokes the `updating-lockstep` skill,
   which auto-bumps mechanical `version-pin` rows (per `upgrade_policy`)
   and surfaces everything else (`file-fork` / `feature-parity` /
   `spec-conformance` / `lang-parity` / `locked` version-pins) as
@@ -123,30 +123,30 @@ Exit code semantics:
   `temporal-rs` is `locked` because Node vendors it and bumping is
   gated on a Node bump landing first).
 
-If `xport.json` does NOT exist, skip this phase.
+If `lockstep.json` does NOT exist, skip this phase.
 
 ---
 
-### Phase 4: Apply xport drift + update other submodules (if applicable)
+### Phase 4: Apply lockstep drift + update other submodules (if applicable)
 
-**4a. xport drift** — if Phase 3 reported exit 2 (drift), invoke the
-`updating-xport` skill. It auto-bumps `version-pin` rows whose
+**4a. lockstep drift** — if Phase 3 reported exit 2 (drift), invoke the
+`updating-lockstep` skill. It auto-bumps `version-pin` rows whose
 `upgrade_policy` is `track-latest` or `major-gate` (patch/minor only,
 majors → advisory), and emits an advisory block for everything else.
 Each auto-bumped row becomes its own atomic commit.
 
 ```bash
-if [ "$XPORT_EXIT" = "2" ]; then
+if [ "$LOCKSTEP_EXIT" = "2" ]; then
   # Invoke via the Skill tool / programmatic-claude flow used by the
-  # weekly-update workflow. Standalone runs can do `/updating-xport`.
-  echo "Invoking updating-xport for drift handling"
+  # weekly-update workflow. Standalone runs can do `/updating-lockstep`.
+  echo "Invoking updating-lockstep for drift handling"
 fi
 ```
 
-**4b. Non-xport submodules** — invoke each `updating-*` sub-skill this
+**4b. Non-lockstep submodules** — invoke each `updating-*` sub-skill this
 repo defines (e.g., `updating-node`, `updating-curl`) for submodules
-NOT claimed by an xport `version-pin` row. These sub-skills know about
-build inputs that aren't tracked in xport (cache-versions bumps,
+NOT claimed by a lockstep `version-pin` row. These sub-skills know about
+build inputs that aren't tracked in lockstep (cache-versions bumps,
 patch regeneration, etc.).
 
 If no `.gitmodules` exists, skip 4b.
@@ -196,7 +196,7 @@ fi
 | Category           | Status                               |
 |--------------------|--------------------------------------|
 | npm packages       | Updated / Up to date                 |
-| xport manifest     | <ok>/<total> ok, <drift> drift, <error> error (exit <code>) — or n/a |
+| lockstep manifest  | <ok>/<total> ok, <drift> drift, <error> error (exit <code>) — or n/a |
 | Other submodules   | K bumped — or n/a                    |
 | Workflow SHA pins  | Up to date / Stale                   |
 
@@ -223,7 +223,7 @@ fi
 ## Success Criteria
 
 - All npm packages checked for updates
-- xport manifest validated (when present); schema/structural errors block
+- lockstep manifest validated (when present); schema/structural errors block
 - Full build and tests pass (interactive mode)
 - Summary report generated
 
@@ -236,5 +236,5 @@ This skill is useful for:
 - Pre-release preparation
 
 **Safety:** Updates are validated before committing. Schema errors
-(xport exit 1) stop the process; drift (xport exit 2) is advisory
+(lockstep exit 1) stop the process; drift (lockstep exit 2) is advisory
 and does not block.

CLAUDE.md

@@ -87,7 +87,7 @@ Where drift commonly hides:
 - `socket-registry/.github/actions/*` — composite-action SHAs pinned in consumer workflows
 - `template/CLAUDE.md` `<!-- BEGIN FLEET-CANONICAL -->` block — must be byte-identical across the fleet
 - `template/.claude/hooks/*` — same hook, same code
-- xport.json `pinned_sha` rows — upstream submodules tracked by socket-btm
+- lockstep.json `pinned_sha` rows — upstream submodules tracked by socket-btm
 - `.gitmodules` `# name-version` annotations
 - pnpm/Node `packageManager`/`engines` fields
 
@@ -178,14 +178,14 @@ Full hook spec in [`.claude/hooks/token-guard/README.md`](.claude/hooks/token-gu
 Every skill under `.claude/skills/` falls into one of three tiers — surface this distinction when adding a new skill so it lands in the right place:
 
 - **Fleet skill** — present in every fleet repo, identical contract everywhere. Examples: `guarding-paths`, `scanning-quality`, `scanning-security`, `updating`, `locking-down-programmatic-claude`, `plug-leaking-promise-race`. New fleet skills land in `socket-repo-template/template/.claude/skills/<name>/` and cascade via `node socket-repo-template/scripts/sync-scaffolding.mts --all --fix`. Track them in `SHARED_SKILL_FILES` in the sync manifest.
-- **Partial skill** — present in the subset of repos that need it, identical contract within that subset. Examples: `driving-cursor-bugbot` (every repo with PR review), `updating-xport` (every repo with `xport.json`), `squashing-history` (repos with the squash workflow). Live in each adopting repo's `.claude/skills/<name>/`. When you change one, propagate to the others.
+- **Partial skill** — present in the subset of repos that need it, identical contract within that subset. Examples: `driving-cursor-bugbot` (every repo with PR review), `updating-lockstep` (every repo with `lockstep.json`), `squashing-history` (repos with the squash workflow). Live in each adopting repo's `.claude/skills/<name>/`. When you change one, propagate to the others.
 - **Unique skill** — one repo only, bespoke to that repo's domain. Examples: `updating-cdxgen` (sdxgen), `updating-yoga` (socket-btm), `release` (socket-registry). Never canonical-tracked; the host repo owns it end-to-end.
 
 Audit the current classification with `node socket-repo-template/scripts/run-skill-fleet.mts --list-skills`.
 
 #### `updating` umbrella + `updating-*` siblings
 
-`updating` is the canonical fleet umbrella that runs `pnpm run update` then discovers and runs every `updating-*` sibling skill the host repo registers. The umbrella is fleet-shared; the siblings are per-repo (or partial — e.g. `updating-xport` lives in every repo with `xport.json`). To add a new repo-specific update step, drop a new `.claude/skills/updating-<domain>/SKILL.md` and the umbrella picks it up automatically — no edits to `updating` itself.
+`updating` is the canonical fleet umbrella that runs `pnpm run update` then discovers and runs every `updating-*` sibling skill the host repo registers. The umbrella is fleet-shared; the siblings are per-repo (or partial — e.g. `updating-lockstep` lives in every repo with `lockstep.json`). To add a new repo-specific update step, drop a new `.claude/skills/updating-<domain>/SKILL.md` and the umbrella picks it up automatically — no edits to `updating` itself.
 
 #### Running skills across the fleet