diff --git a/Makefile b/Makefile
index c8f59774d..2549c6fa2 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 SHELL := /usr/bin/env bash
 
-.PHONY: local-ci local-ci-fast ci build test docs-check clean help
+.PHONY: local-ci local-ci-fast ci build test docs-check regen-all regen-check clean help
 
 # Default: run the release-grade local CI gate.
 # Note: scripts/ci-local-release.sh already includes build + test + release-binary validation.
@@ -25,6 +25,12 @@ docs-check: ## Run docs and hook safety drift checks
 	./scripts/validate-hook-preflight.sh
 	./tests/docs/validate-doc-release.sh
 
+regen-all: ## Regenerate every derived artifact after adding a skill/command (one-command finalizer)
+	./scripts/regen-all.sh
+
+regen-check: ## Run the derived-artifact drift/gate sweep (no writes; pre-push gate)
+	./scripts/regen-all.sh --check
+
 clean: ## Clean CLI build artifacts
 	$(MAKE) -C cli clean
 
diff --git a/scripts/regen-all.sh b/scripts/regen-all.sh
new file mode 100755
index 000000000..3019822e0
--- /dev/null
+++ b/scripts/regen-all.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# regen-all.sh — one-command finalizer for the derived-artifact gate surface.
+#
+# Adding a skill or `ao` command makes ~8 generated registries/goldens stale, each
+# guarded by an independent CI gate that stops at the first error. Discovering them
+# one CI round at a time is slow (see PR #598 / ag-nk67: 9 rounds, 0 feature-code
+# failures). This composes every generator into one local pass, with a --check mode
+# that runs the matching drift validators as a pre-push gate.
+#
+# Usage:
+#   scripts/regen-all.sh            # regenerate all derived artifacts (writes)
+#   scripts/regen-all.sh --check    # run all drift validators (no writes); exit 1 on drift
+#
+# NOTE: Codex twins (skills-codex/<name>/{SKILL.md,prompt.md}) are MANUAL — this
+# refreshes their hashes but cannot author a missing twin. Create twins by hand
+# (runtime-native: no `.claude/...` tokens), then re-run.
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+MODE="regen"
+[[ "${1:-}" == "--check" ]] && MODE="check"
+[[ -n "${1:-}" && "$MODE" == "regen" ]] && { echo "usage: $0 [--check]" >&2; exit 2; }
+
+fail=0
+step() { # label cmd...
+  local label="$1"; shift
+  if "$@" >/tmp/regen-all.$$.log 2>&1; then
+    printf '  \033[0;32m✓\033[0m %s\n' "$label"
+  else
+    printf '  \033[0;31m✗\033[0m %s\n' "$label"; sed 's/^/      /' /tmp/regen-all.$$.log | tail -6
+    fail=1
+  fi
+}
+
+if [[ "$MODE" == "regen" ]]; then
+  echo "== regenerating derived artifacts (dependency order) =="
+  step "skill counts"          bash scripts/sync-skill-counts.sh
+  step "skill-domain-map"      bash scripts/generate-skill-domain-map.sh
+  step "SKU catalog (registry.json)" bash scripts/generate-registry.sh
+  step "context-map"           bash scripts/generate-context-map.sh
+  step "embedded skills"       make -C cli sync-hooks
+  step "cli reference (COMMANDS.md)" bash scripts/generate-cli-reference.sh
+  step "cli-surface inventory" bash scripts/check-cmdao-surface-parity.sh --write-surface
+  step "codex hashes"          bash scripts/regen-codex-hashes.sh
+  echo
+  echo "Regenerated. Review 'git status', then run: scripts/regen-all.sh --check"
+  echo "Reminder: new skills also need MANUAL skills-codex/<name>/ twins +"
+  echo "  the cobra expectedCmds list + cli-help-matrix golden when adding ao commands."
+else
+  echo "== drift / gate sweep (no writes) =="
+  step "registry drift"        bash scripts/check-registry-drift.sh
+  step "skill-domain-map golden" bash scripts/generate-skill-domain-map.sh --check
+  step "write-surfaces"        bash scripts/check-agents-write-surfaces.sh
+  step "codex parity"          bash scripts/audit-codex-parity.sh
+  step "codex runtime sections" bash scripts/validate-codex-runtime-sections.sh
+  step "codex hashes (no drift)" bash scripts/regen-codex-hashes.sh --check
+  step "SKU catalog drift"     bash scripts/validate-sku-catalog-drift.sh
+  step "context-map drift"     bash scripts/validate-context-map-drift.sh
+  step "doc-release gate"      bash tests/docs/validate-doc-release.sh
+  echo
+  [[ $fail -eq 0 ]] && echo "ALL GATES GREEN — safe to push" || echo "DRIFT DETECTED — run scripts/regen-all.sh (no flag) to fix, then commit"
+fi
+
+rm -f /tmp/regen-all.$$.log
+exit $fail