Install-Runbook Linter

A macOS onboarding runbook is false-green when it reads fine to a human but assigns admin-only steps to a Standard (non-admin) user — the gen16 audit failed exactly here (a Standard user couldn't brew install). This skill turns that audit into a mechanical, replayable gate: runbook_lint.py parses a runbook and reports privilege-correctness violations, with RED→GREEN fixtures (fixtures/, tests/).

Scope

The lint runs before the runbook ships.

Run it

python3 lint_cli.py path/to/onboarding-RUNBOOK.md   # exit 1 if any violation
python3 -m pytest tests/                            # the RED→GREEN gate

Rules

Phase classification

Phases are split on ## … headers and tagged admin / standard / neutral from role cues (admin, machine-wide vs Standard, happy-camper, user space, without admin). A header naming the Standard user wins (it's the privilege-sensitive one).

Validated against the real artifact

The linter was replayed against the gen17 happy-camper onboarding runbook. The Happy Campr company/launcher name is intentionally distinct from the happy-camper account, while genuine account typos still trip fixtures/red-runbook.md. That delta is the gate: RED on the bad fixture, no noisy findings on the known good patterns, and concrete line numbers for real drift.

Why a linter, not prose

Per the gen-18 doctrine (build the gate, not the prose): a runbook reviewed by eye drifts; a runbook gated by lint_cli.py in CI cannot ship a Standard-user brew install or a receipt-only "verification" again.