@aiwg/cli 2026.10.0 → 2026.10.3

package/vscode-extension/schemas/aiwg.config.v1.json

@@ -0,0 +1,1953 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://aiwg.io/schemas/aiwg.config.v1.json",
+  "title": "AIWG Project Configuration",
+  "description": "Configuration file for the AIWG AI coding assistant framework",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "JSON Schema reference"
+    },
+    "version": {
+      "type": "string",
+      "description": "AIWG config format version",
+      "examples": ["1"]
+    },
+    "project": {
+      "description": "Project identity and data classification. A bare string is the project name; the object form adds classification and handling policy.",
+      "oneOf": [
+        { "type": "string", "description": "Project name" },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "name": { "type": "string" },
+            "description": { "type": "string" },
+            "classification": {
+              "type": "string",
+              "enum": ["private", "sanitized", "public"],
+              "description": "What the repository holds. 'private' defaults every handling flag to false."
+            },
+            "pii": { "type": "boolean", "description": "Repository holds personally identifiable information" },
+            "handling": {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "excerptable": { "type": "boolean", "description": "May content be quoted outside the repo?" },
+                "publishable": { "type": "boolean", "description": "May content be published?" },
+                "mirror": { "type": "boolean", "description": "May the repo be mirrored to a secondary remote?" }
+              }
+            }
+          }
+        }
+      ]
+    },
+    "installed": {
+      "type": "object",
+      "description": "Installed AIWG frameworks",
+      "additionalProperties": {
+        "$ref": "#/definitions/InstalledFramework"
+      }
+    },
+    "providers": {
+      "type": "array",
+      "description": "Active AI provider targets",
+      "items": {
+        "type": "string",
+        "enum": [
+          "claude",
+          "copilot",
+          "cursor",
+          "warp",
+          "windsurf",
+          "openclaw",
+          "codex",
+          "opencode",
+          "factory",
+          "hermes",
+          "grokbot",
+          "muse"
+        ]
+      }
+    },
+    "scripts": {
+      "type": "object",
+      "description": "Named scripts runnable via AIWG sidebar or CLI",
+      "additionalProperties": {
+        "type": "string"
+      }
+    },
+    "authorization": {
+      "$ref": "#/definitions/Authorization",
+      "description": "Versioned provider-neutral permission, role, assignment, scope, boundary, and provider mapping model. Deny by default."
+    },
+    "security": {
+      "type": "object",
+      "description": "Project-owned deterministic security policy.",
+      "additionalProperties": false,
+      "properties": {
+        "threatAssessment": {
+          "$ref": "#/definitions/ThreatAssessment"
+        }
+      }
+    },
+    "artifact_outputs": {
+      "type": "object",
+      "description": "Canonical AIWG artifact storage and optional provider-native presentation/export destinations. Provider-native output is explicit-only by default.",
+      "additionalProperties": false,
+      "properties": {
+        "canonical": {
+          "type": "string",
+          "enum": ["aiwg"],
+          "default": "aiwg",
+          "description": "Durable source of truth. Presentation destinations never replace this artifact."
+        },
+        "provider_native": {
+          "type": "string",
+          "enum": ["disabled", "explicit-only", "project-default"],
+          "default": "explicit-only",
+          "description": "Whether provider-native destinations are disabled, require an explicit task request, or may be selected by a declared project default."
+        },
+        "destinations": {
+          "type": "object",
+          "propertyNames": { "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "enabled": { "type": "boolean", "default": true },
+              "use_when": { "type": "string", "enum": ["disabled", "user-requested", "project-default"], "default": "user-requested" }
+            }
+          }
+        }
+      }
+    },
+    "uhp": {
+      "type": "object",
+      "description": "Experimental Unified Harness Protocol client configuration. Credentials are references only and are resolved at request time.",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": { "type": "boolean", "default": false },
+        "profiles": {
+          "type": "object",
+          "propertyNames": { "pattern": "^[a-z][a-z0-9_-]{0,63}$" },
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["endpoint", "version", "credential", "experimental"],
+            "properties": {
+              "endpoint": { "type": "string", "format": "uri", "pattern": "^https?://" },
+              "version": { "const": "2026-08-11" },
+              "credential": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["source", "name"],
+                "properties": {
+                  "source": { "const": "env" },
+                  "name": { "type": "string", "pattern": "^[A-Z_][A-Z0-9_]*$" }
+                }
+              },
+              "defaultHarness": { "type": "string", "pattern": "^chrn_[A-Za-z0-9_-]+$" },
+              "defaultModel": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$" },
+              "experimental": { "const": true },
+              "trust": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                  "allowedHosts": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+                  "allowPrivateNetwork": { "type": "boolean", "default": false },
+                  "allowInsecureLoopback": { "type": "boolean", "default": false },
+                  "allowRedirects": { "type": "boolean", "default": false }
+                }
+              },
+              "limits": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                  "requestTimeoutMs": { "type": "integer", "minimum": 1 },
+                  "inactivityTimeoutMs": { "type": "integer", "minimum": 1 },
+                  "maxTaskSeconds": { "type": "integer", "minimum": 1 },
+                  "maxUploadBytes": { "type": "integer", "minimum": 1 },
+                  "maxArtifactBytes": { "type": "integer", "minimum": 1 },
+                  "maxArtifactCount": { "type": "integer", "minimum": 1 },
+                  "maxRetries": { "type": "integer", "minimum": 1 }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "workspace": {
+      "$ref": "#/definitions/Workspace",
+      "description": "General multi-repository workspace metadata. Root manifests pair this with repos; external members may use member_of to discover their workspace."
+    },
+    "repos": {
+      "type": "array",
+      "minItems": 1,
+      "description": "Workspace member repositories. Each member's own .aiwg/aiwg.config remains authoritative for remotes, delivery, tracker actor, and signing.",
+      "items": {
+        "$ref": "#/definitions/WorkspaceRepo"
+      }
+    },
+    "externalLinks": {
+      "type": "object",
+      "description": "Named public external resources exposed as project metadata. AIWG renders these links but does not fetch them or submit data.",
+      "propertyNames": {
+        "pattern": "^[a-z][a-z0-9_-]*$"
+      },
+      "additionalProperties": {
+        "$ref": "#/definitions/ExternalLink"
+      }
+    },
+    "settings": {
+      "type": "object",
+      "description": "Framework-specific settings",
+      "additionalProperties": true
+    },
+    "remotes": {
+      "type": "object",
+      "description": "Repo origin topology — declares primary (CI/issues/PRs) and secondary remotes (#994)",
+      "additionalProperties": false,
+      "properties": {
+        "primary": {
+          "type": "string",
+          "description": "git remote name driving CI/PRs by default. Defaults to 'origin' when absent."
+        },
+        "issue_tracker": {
+          "type": "string",
+          "description": "Where issues live. Defaults to primary."
+        },
+        "issue_provider": {
+          "type": "string",
+          "enum": ["gitea", "github", "local"],
+          "description": "Explicit issue-tracker provider for self-hosted or local trackers when the remote URL is ambiguous."
+        },
+        "ci": {
+          "type": "string",
+          "description": "Where CI runs. Defaults to primary."
+        },
+        "tracker_actor": {
+          "$ref": "#/definitions/TrackerActor",
+          "description": "Forge account/tool that must author delivery writes such as issue comments, PRs, labels, and closures (#1601)."
+        },
+        "customer_issue_tracker": {
+          "type": "string",
+          "description": "Optional customer-facing issue intake remote. Internal engineering work remains on issue_tracker."
+        },
+        "customer_issue_provider": {
+          "type": "string",
+          "enum": ["gitea", "github", "local"],
+          "description": "Explicit provider hint for the customer-facing issue tracker."
+        },
+        "customer_tracker_actor": {
+          "$ref": "#/definitions/TrackerActor",
+          "description": "Forge account/tool for customer acknowledgements, comments, and closures."
+        },
+        "transport": {
+          "$ref": "#/definitions/RemoteTransport",
+          "description": "Git transport identity and project-local helper for the primary remote."
+        },
+        "secondary": {
+          "type": "array",
+          "description": "Mirrors, fork bases, and publishing targets",
+          "items": {
+            "$ref": "#/definitions/SecondaryRemote"
+          }
+        }
+      }
+    },
+    "issues": {
+      "type": "object",
+      "description": "Issue-tracker workflow semantics associated with remotes.issue_tracker (#1789). Ordinary issue processing validates but never implicitly provisions labels.",
+      "additionalProperties": false,
+      "properties": {
+        "labels": {
+          "type": "object",
+          "description": "Tracker labels keyed by stable semantic role.",
+          "additionalProperties": {
+            "$ref": "#/definitions/IssueLabelDefinition"
+          }
+        }
+      }
+    },
+    "repo_maintainer": {
+      "type": "object",
+      "description": "Role-aware repository maintenance overrides. Forge permission detection is attempted first; these tiers pin or narrow behavior when detection is denied or policy requires a fixed posture (#1755).",
+      "additionalProperties": false,
+      "properties": {
+        "tiers": {
+          "type": "object",
+          "description": "Map remote URLs, owner/repo slugs, remote names, or 'local' to collaborator, maintainer, or admin.",
+          "additionalProperties": {
+            "type": "string",
+            "enum": ["collaborator", "maintainer", "admin"]
+          },
+          "examples": [
+            {
+              "git@git.integrolabs.net:roctinam/aiwg.git": "maintainer",
+              "elder-plinius/T3MP3ST": "collaborator",
+              "local": "maintainer"
+            }
+          ]
+        }
+      }
+    },
+    "delivery": {
+      "type": "object",
+      "description": "Repo control / delivery policy — how AIWG agents are expected to ship code (#995)",
+      "additionalProperties": false,
+      "properties": {
+        "mode": {
+          "type": "string",
+          "enum": ["direct", "feature-branch", "pr-required"],
+          "description": "How agents deliver code. direct = commit/push to default_branch; feature-branch = push branch, no PR; pr-required = branch + PR (default)"
+        },
+        "default_branch": {
+          "type": "string",
+          "description": "Default branch name. Defaults to 'main'."
+        },
+        "branch_naming": {
+          "type": "object",
+          "description": "Branch-naming conventions. {issue} and {slug} are interpolated by skills.",
+          "additionalProperties": false,
+          "properties": {
+            "prefix_by_type": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Per commit-type branch prefix templates (feat, fix, docs, chore, refactor, test)"
+            }
+          }
+        },
+        "merge_style": {
+          "type": "string",
+          "enum": ["rebase-merge", "squash", "merge", "fast-forward-only"],
+          "description": "Merge style. Defaults to 'rebase-merge'."
+        },
+        "delete_branch_on_merge": {
+          "type": "boolean",
+          "description": "Delete the feature branch after merge. Default true."
+        },
+        "require_ci_green": {
+          "type": "boolean",
+          "description": "Agent must wait for CI green before declaring done. Default true."
+        },
+        "require_signed_commits": {
+          "type": "boolean",
+          "description": "Default false."
+        },
+        "committer": {
+          "$ref": "#/definitions/CommitterIdentity",
+          "description": "Committer identity agents should use for delivery commits. Defaults to git config when unset."
+        },
+        "signing": {
+          "$ref": "#/definitions/SigningConfig",
+          "description": "Signing metadata for delivery commits/tags (#1601)."
+        },
+        "release_signing": {
+          "$ref": "#/definitions/SigningConfig",
+          "description": "Distinct signing metadata for annotated release tags."
+        },
+        "force_push_policy": {
+          "type": "string",
+          "enum": ["never", "own-branch-only", "allowed"],
+          "description": "Force-push policy. Default 'never'."
+        },
+        "auto_close_issues": {
+          "type": "boolean",
+          "description": "Include 'Closes #N' in PR body. Default true."
+        },
+        "issue_comment_on_cycle": {
+          "type": "boolean",
+          "description": "Post AL CYCLE status comments to issue threads. Default true."
+        }
+      }
+    },
+    "parallelism": {
+      "type": "object",
+      "description": "Provider-scoped parallelism caps \u2014 limits concurrent subagents, Ralph loops, and MC missions to keep AIWG within the rate-limit envelope of the underlying model provider (#1359). Composes (effective limit = MIN) with context-budget caps and rlm-context-management Rule 8.",
+      "additionalProperties": false,
+      "properties": {
+        "max_parallel_subagents": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 50,
+          "description": "Max concurrent subagents (Task dispatches, rlm-batch fan-outs). Default: provider-specific (claude=4, codex/copilot/etc.=10)."
+        },
+        "max_parallel_ralph_loops": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 20,
+          "description": "Max concurrent Ralph external loops. Default: provider-specific (claude=2, others=3)."
+        },
+        "max_parallel_mc_missions": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 20,
+          "description": "Max concurrent Mission Control missions. Default: provider-specific (claude=4, others=6)."
+        },
+        "rationale": {
+          "type": "string",
+          "description": "Free-form note explaining why this cap was chosen (e.g., 'Claude Team plan API quota')."
+        },
+        "worker_dispatch": {
+          "type": "boolean",
+          "default": false
+        },
+        "clis": {
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/cli"
+          },
+          "propertyNames": {
+            "pattern": "^[a-z][a-z0-9-]{0,62}$"
+          }
+        },
+        "groups": {
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/group"
+          },
+          "propertyNames": {
+            "pattern": "^[a-z][a-z0-9-]{0,62}$"
+          }
+        },
+        "admission": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "groupCaps": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "integer",
+                "minimum": 1
+              }
+            },
+            "cliCaps": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "integer",
+                "minimum": 1
+              }
+            },
+            "modelCaps": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "integer",
+                "minimum": 1
+              }
+            },
+            "quotaCaps": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "integer",
+                "minimum": 1
+              }
+            },
+            "queueTimeoutSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "default": 300
+            },
+            "leaseSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "default": 60
+            },
+            "memberCaps": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "integer",
+                "minimum": 1
+              }
+            },
+            "maxQueued": {
+              "type": "integer",
+              "minimum": 0,
+              "default": 128
+            },
+            "authorityRef": {
+              "type": "string",
+              "pattern": "^(project|host:[a-z][a-z0-9-]{0,62})$",
+              "default": "project",
+              "description": "Project MC admission store by default; host reference requires S4 trusted executor binding."
+            },
+            "hostResources": {
+              "type": "object",
+              "additionalProperties": false,
+              "description": "Live host-resource admission thresholds for worker dispatch (FR-OG-107, #2954). Each present signal blocks dispatch over threshold; absent signals are reported but not enforced. Overrides build.resource_preflight.dispatch field-by-field.",
+              "properties": {
+                "min_avail_mem_gb": {
+                  "type": "number",
+                  "minimum": 0,
+                  "default": 8
+                },
+                "max_load_ratio": {
+                  "type": "number",
+                  "minimum": 0,
+                  "default": 1.0
+                },
+                "max_mem_psi_avg10": {
+                  "type": "number",
+                  "minimum": 0,
+                  "default": 30
+                },
+                "max_mem_psi_avg60": {
+                  "type": "number",
+                  "minimum": 0,
+                  "default": 10
+                },
+                "min_free_disk_gb": {
+                  "type": "number",
+                  "minimum": 0,
+                  "default": 2
+                },
+                "max_workers": {
+                  "type": "integer",
+                  "minimum": 1
+                }
+              }
+            }
+          }
+        },
+        "budgets": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "perRun": {
+              "$ref": "#/definitions/budget"
+            },
+            "perTask": {
+              "$ref": "#/definitions/budget"
+            },
+            "enforcement": {
+              "enum": [
+                "hard",
+                "observed"
+              ],
+              "default": "observed"
+            },
+            "unknownCost": {
+              "enum": [
+                "deny",
+                "reserve"
+              ],
+              "default": "deny"
+            },
+            "reservationUsd": {
+              "type": "number",
+              "exclusiveMinimum": 0
+            }
+          },
+          "allOf": [
+            {
+              "if": {
+                "required": [
+                  "unknownCost"
+                ],
+                "properties": {
+                  "unknownCost": {
+                    "const": "reserve"
+                  }
+                }
+              },
+              "then": {
+                "properties": {
+                  "reservationUsd": {}
+                },
+                "required": [
+                  "reservationUsd"
+                ]
+              }
+            }
+          ]
+        },
+        "retry": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "maxAttempts": {
+              "type": "integer",
+              "minimum": 1,
+              "default": 3
+            },
+            "on": {
+              "type": "array",
+              "items": {
+                "enum": [
+                  "rate-limit",
+                  "unavailable",
+                  "timeout"
+                ]
+              },
+              "minItems": 0,
+              "uniqueItems": true,
+              "default": [
+                "rate-limit",
+                "unavailable",
+                "timeout"
+              ]
+            },
+            "baseDelaySeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "default": 2
+            },
+            "maxDelaySeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "default": 60
+            }
+          }
+        },
+        "activation": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "revision": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "configDigest": {
+              "type": "string",
+              "pattern": "^sha256:[a-f0-9]{64}$"
+            },
+            "projectModelsDigest": {
+              "type": "string",
+              "pattern": "^sha256:[a-f0-9]{64}$"
+            },
+            "userModelsDigest": {
+              "type": "string",
+              "pattern": "^sha256:[a-f0-9]{64}$"
+            },
+            "builtinModelsDigest": {
+              "type": "string",
+              "pattern": "^sha256:[a-f0-9]{64}$"
+            },
+            "previousRef": {
+              "type": "string",
+              "maxLength": 2048
+            },
+            "snapshotRef": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 2048
+            }
+          },
+          "required": [
+            "revision",
+            "configDigest",
+            "projectModelsDigest",
+            "userModelsDigest",
+            "builtinModelsDigest",
+            "snapshotRef"
+          ]
+        },
+        "worker_mode": {
+          "enum": [
+            "direct",
+            "managed"
+          ],
+          "default": "direct"
+        },
+        "health": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "startupSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 600,
+              "default": 60
+            },
+            "checkSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 60,
+              "default": 15
+            },
+            "quietSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 3600,
+              "default": 90
+            },
+            "stallSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 7200,
+              "default": 300
+            },
+            "diagnosticGraceSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 600,
+              "default": 60
+            },
+            "terminateGraceSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 60,
+              "default": 5
+            },
+            "hardTimeoutSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 86400,
+              "default": 1800
+            },
+            "maxSteps": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 10000,
+              "default": 100
+            },
+            "requireStepCap": {
+              "type": "boolean",
+              "default": false
+            },
+            "roleScale": {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "efficiency": {
+                  "type": "number",
+                  "minimum": 1,
+                  "maximum": 6,
+                  "default": 1
+                },
+                "coding": {
+                  "type": "number",
+                  "minimum": 1,
+                  "maximum": 6,
+                  "default": 1
+                },
+                "reasoning": {
+                  "type": "number",
+                  "minimum": 1,
+                  "maximum": 6,
+                  "default": 2
+                }
+              }
+            },
+            "effortScale": {
+              "type": "object",
+              "maxProperties": 32,
+              "additionalProperties": {
+                "type": "number",
+                "minimum": 1,
+                "maximum": 6
+              },
+              "default": {
+                "xhigh": 2,
+                "max": 3
+              }
+            },
+            "modelScale": {
+              "type": "object",
+              "maxProperties": 500,
+              "additionalProperties": {
+                "type": "number",
+                "minimum": 1,
+                "maximum": 6
+              }
+            },
+            "modelStartupSeconds": {
+              "type": "object",
+              "maxProperties": 500,
+              "additionalProperties": {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 600
+              }
+            },
+            "correlationWindowSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 3600,
+              "default": 120
+            },
+            "failureCount": {
+              "type": "integer",
+              "minimum": 2,
+              "maximum": 100,
+              "default": 3
+            },
+            "allFailedMinimum": {
+              "type": "integer",
+              "minimum": 2,
+              "maximum": 100,
+              "default": 2
+            },
+            "cooldownSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 3600,
+              "default": 120
+            },
+            "maxCooldownSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 86400,
+              "default": 900
+            },
+            "probeSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 60,
+              "default": 10
+            },
+            "probeMaxBytes": {
+              "type": "integer",
+              "minimum": 1024,
+              "maximum": 1048576,
+              "default": 65536
+            },
+            "halfOpenMaxProbes": {
+              "const": 1,
+              "default": 1
+            }
+          }
+        }
+      }
+    },
+    "index": {
+      "type": "object",
+      "description": "Artifact-index configuration — graph definitions (#1491). Consolidated here from the legacy .aiwg/config.yaml per ADR adr-index-config-consolidation.",
+      "additionalProperties": false,
+      "properties": {
+        "graphs": {
+          "type": "object",
+          "description": "Index graph definitions. Each key (except 'indices') is a JSON node/edge graph (IndexGraphDef); 'indices' holds the markdown-view manifest (IndexMarkdownIndices) rendered by corpus-index-build.",
+          "properties": {
+            "indices": { "$ref": "#/definitions/IndexMarkdownIndices" }
+          },
+          "additionalProperties": { "$ref": "#/definitions/IndexGraphDef" }
+        },
+        "graphOverrides": {
+          "type": "object",
+          "description": "Safely adapts supported built-in graphs without redefining their identity or storage semantics.",
+          "additionalProperties": false,
+          "properties": {
+            "codebase": { "$ref": "#/definitions/IndexBuiltinGraphOverride" }
+          }
+        },
+        "userIndices": {
+          "type": "object",
+          "description": "Controls whether user/global index sidecars are included by default in merged capability discovery/show.",
+          "additionalProperties": false,
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "When false, default capability discovery/show omit user/global sidecars unless --graph user is selected explicitly."
+            }
+          }
+        }
+      }
+    },
+    "indices": {
+      "type": "object",
+      "description": "User/global index shorthand. Declares shared sidecar roots that can be used from any project.",
+      "additionalProperties": false,
+      "properties": {
+        "user": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "When false, default capability discovery/show omit user/global sidecars unless selected explicitly."
+            },
+            "roots": {
+              "type": "object",
+              "description": "Named user-level index roots. Each key becomes an addressable shared graph name.",
+              "additionalProperties": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["path"],
+                "properties": {
+                  "path": {
+                    "type": "string",
+                    "description": "Filesystem path for this user-level index root. Supports ~ expansion."
+                  },
+                  "backend": {
+                    "type": "string",
+                    "enum": ["local", "fortemi-core"],
+                    "description": "Preferred backend for this root. AIWG still builds the local graph before Fortemi sync."
+                  },
+                  "extensions": {
+                    "type": "array",
+                    "items": { "type": "string" },
+                    "description": "File extensions to index. Defaults to markdown, YAML, and JSON."
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "research": {
+      "type": "object",
+      "description": "Research-complete framework settings (#1497).",
+      "additionalProperties": false,
+      "properties": {
+        "corpusRoot": {
+          "type": "string",
+          "description": "Corpus root directory (relative to project root or absolute). Default: project root. The corpus lives under <corpusRoot>/documentation/{references,citations,radar,profiles}."
+        }
+      }
+    },
+    "command_log": {
+      "type": "object",
+      "description": "Optional local-first CLI command invocation log (#1614). Off by default.",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "description": "Enable command invocation logging for this project. Default false."
+        },
+        "scopes": {
+          "type": "array",
+          "description": "Stores to write. project = .aiwg/telemetry/cli-commands.jsonl; global = XDG state.",
+          "items": {
+            "type": "string",
+            "enum": ["project", "global"]
+          },
+          "uniqueItems": true
+        },
+        "max_bytes": {
+          "type": "integer",
+          "minimum": 1024,
+          "maximum": 104857600,
+          "description": "Maximum bytes per JSONL store before rotation to .1. Default 1048576."
+        }
+      }
+    },
+    "telemetry": {
+      "type": "object",
+      "description": "Local-first telemetry settings. All telemetry is off by default.",
+      "additionalProperties": false,
+      "properties": {
+        "skill_usage": {
+          "type": "object",
+          "description": "Optional local-first skill, agent, and command usage tracking (#1649). Off by default.",
+          "additionalProperties": false,
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Enable skill usage tracking for this project. Default false."
+            },
+            "scopes": {
+              "type": "array",
+              "description": "Stores to write. project = .aiwg/telemetry/skill-usage.jsonl; global = XDG state.",
+              "items": {
+                "type": "string",
+                "enum": ["project", "global"]
+              },
+              "uniqueItems": true
+            },
+            "max_bytes": {
+              "type": "integer",
+              "minimum": 1024,
+              "maximum": 104857600,
+              "description": "Maximum bytes per JSONL store before rotation to .1. Default 1048576."
+            }
+          }
+        }
+      }
+    },
+    "setup": {
+      "type": "object",
+      "description": "Setup/onboarding preferences (#3050) — answers to opt-in offers presented during `aiwg init` / `aiwg setup project`. Not worker policy; kept separate from the frozen `parallelism` contract fragment (B-OG-29).",
+      "additionalProperties": false,
+      "properties": {
+        "worker_dispatch_offer": {
+          "type": "string",
+          "enum": ["declined"],
+          "description": "Set to 'declined' when a person said no to the parallelism.worker_dispatch opt-in offer. Suppresses the offer and its hints until cleared."
+        }
+      }
+    },
+    "gates": {
+      "$ref": "#/definitions/GatesConfig"
+    }
+  },
+  "definitions": {
+    "cli": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "adapter": {
+          "type": "string",
+          "minLength": 1,
+          "pattern": "^(providers|workerAdapters):[a-z][a-z0-9-]{0,62}$"
+        },
+        "enabled": {
+          "type": "boolean",
+          "default": true
+        },
+        "executable": {
+          "type": "string",
+          "minLength": 1
+        },
+        "endpoint": {
+          "type": "string",
+          "minLength": 1,
+          "format": "uri"
+        },
+        "accountScope": {
+          "type": "string",
+          "minLength": 1
+        },
+        "quotaScope": {
+          "type": "string",
+          "minLength": 1
+        },
+        "credentialRef": {
+          "type": "string",
+          "minLength": 1
+        },
+        "approvalRef": {
+          "type": "string",
+          "minLength": 1
+        },
+        "invocationProfile": {
+          "type": "string",
+          "minLength": 1
+        },
+        "mcpServerRef": {
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "required": [
+        "adapter",
+        "accountScope",
+        "quotaScope"
+      ],
+      "not": {
+        "properties": {
+          "executable": {},
+          "endpoint": {}
+        },
+        "required": [
+          "executable",
+          "endpoint"
+        ]
+      }
+    },
+    "member": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "pattern": "^[a-z][a-z0-9-]{0,62}$"
+        },
+        "cli": {
+          "type": "string",
+          "minLength": 1
+        },
+        "model": {
+          "type": "string",
+          "minLength": 1
+        },
+        "roles": {
+          "type": "array",
+          "items": {
+            "enum": [
+              "efficiency",
+              "coding",
+              "reasoning"
+            ]
+          },
+          "minItems": 1,
+          "uniqueItems": true
+        },
+        "enabled": {
+          "type": "boolean",
+          "default": true
+        },
+        "priority": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 100,
+          "default": 50
+        }
+      },
+      "required": [
+        "id",
+        "cli",
+        "model",
+        "roles"
+      ]
+    },
+    "group": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "members": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/member"
+          },
+          "minItems": 1,
+          "uniqueItems": true
+        },
+        "fallback": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "minItems": 0,
+          "uniqueItems": true,
+          "default": []
+        },
+        "execution": {
+          "$ref": "#/definitions/execution"
+        },
+        "requiredRoles": {
+          "type": "array",
+          "items": {
+            "enum": [
+              "efficiency",
+              "coding",
+              "reasoning"
+            ]
+          },
+          "uniqueItems": true,
+          "default": []
+        },
+        "maxParallel": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 50
+        }
+      },
+      "required": [
+        "members"
+      ]
+    },
+    "execution": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "isolation": {
+          "enum": [
+            "worktree",
+            "snapshot",
+            "isolated-copy"
+          ],
+          "default": "worktree"
+        },
+        "sandbox": {
+          "enum": [
+            "read-only",
+            "workspace-write",
+            "external"
+          ],
+          "default": "workspace-write"
+        },
+        "approval": {
+          "enum": [
+            "never",
+            "on-request"
+          ],
+          "default": "never"
+        },
+        "network": {
+          "enum": [
+            "deny",
+            "allowlisted"
+          ],
+          "default": "deny"
+        },
+        "runnerRef": {
+          "type": "string",
+          "minLength": 1
+        },
+        "verifierRunnerRef": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "transport": {
+          "enum": [
+            "shell",
+            "mcp"
+          ],
+          "default": "shell"
+        },
+        "receipts": {
+          "enum": [
+            "off",
+            "optional",
+            "required"
+          ],
+          "default": "optional"
+        }
+      }
+    },
+    "budget": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "tokens": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "costUsd": {
+          "type": "number",
+          "minimum": 0
+        },
+        "wallSeconds": {
+          "type": "integer",
+          "minimum": 1
+        }
+      }
+    },
+    "GatesConfig": {
+      "type": "object",
+      "description": "Project gate floors for decision studies (#2832). Floors are project policy: every binding must include and tighten each floor gate. Absent means unconfigured; callers that load floors get the operator default integrity-ceiling floor.",
+      "additionalProperties": false,
+      "properties": {
+        "floors": {
+          "type": "array",
+          "description": "Floor sources. Each entry sets exactly one of 'pack' (an inline project: GatePack) or 'packRef' (a pin over a registered pack whose composed gates all become floors).",
+          "items": {
+            "type": "object",
+            "properties": {
+              "pack": {
+                "type": "object",
+                "description": "Inline floor pack (gates.aiwg.io/v1alpha1 GatePack with a project: id). Validated against the closed GatePack schema at load; every threshold parameter needs a default (the enforced minimum)."
+              },
+              "packRef": {
+                "$ref": "#/definitions/GateFloorPackRef"
+              }
+            },
+            "anyOf": [
+              { "required": ["pack"] },
+              { "required": ["packRef"] }
+            ]
+          }
+        },
+        "ceilings": {
+          "type": "object",
+          "description": "Outcome ceilings keyed by binding metadata.id, plus '*' as the project-wide default applied to every binding. A per-study key may only tighten the '*' default; a binding declaring a looser ceiling is refused at resolution.",
+          "additionalProperties": {
+            "type": "string",
+            "enum": ["PROMOTE", "HOLD", "ROLLBACK"]
+          }
+        }
+      }
+    },
+    "GateFloorPackRef": {
+      "type": "object",
+      "description": "Pin over a registered gate pack whose composed gates all become project floors. Version and authored digest are verified at resolution.",
+      "additionalProperties": false,
+      "required": ["id", "version", "digest"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "Full namespaced pack id, e.g. aiwg:decision-engine/integrity-ceiling or project:my-floors."
+        },
+        "version": {
+          "type": "string",
+          "pattern": "^\\d+\\.\\d+\\.\\d+$",
+          "description": "Pack version (X.Y.Z), must match the registered pack."
+        },
+        "digest": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$",
+          "description": "Authored-pack digest, must match the registered pack."
+        }
+      }
+    },
+    "Authorization": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["version", "default_effect", "resources", "permissions", "roles", "assignments"],
+      "properties": {
+        "version": { "const": "1" },
+        "default_effect": { "const": "deny" },
+        "resources": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["type", "value"],
+            "properties": {
+              "type": { "type": "string" },
+              "value": { "type": "string" },
+              "provider": { "type": "string" },
+              "locator_env": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" }
+            }
+          }
+        },
+        "permissions": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["actions", "resource_types"],
+            "properties": {
+              "actions": { "type": "array", "minItems": 1, "items": { "type": "string" } },
+              "resource_types": { "type": "array", "minItems": 1, "items": { "type": "string" } },
+              "effect": { "type": "string", "enum": ["allow", "deny"] },
+              "description": { "type": "string" }
+            }
+          }
+        },
+        "roles": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["permissions"],
+            "properties": {
+              "permissions": { "type": "array", "items": { "type": "string" } },
+              "inherits": { "type": "array", "items": { "type": "string" } },
+              "boundaries": { "type": "array", "items": { "type": "string" } },
+              "description": { "type": "string" }
+            }
+          }
+        },
+        "boundaries": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "permissions": { "type": "array", "items": { "type": "string" } },
+              "resources": { "type": "array", "items": { "type": "string" } }
+            }
+          }
+        },
+        "assignments": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["id", "subjects", "roles", "scope"],
+            "properties": {
+              "id": { "type": "string" },
+              "subjects": {
+                "type": "array", "minItems": 1,
+                "items": {
+                  "type": "object", "additionalProperties": false, "required": ["kind", "id"],
+                  "properties": {
+                    "kind": { "type": "string", "enum": ["user", "group", "service", "workload"] },
+                    "id": { "type": "string" }
+                  }
+                }
+              },
+              "roles": { "type": "array", "minItems": 1, "items": { "type": "string" } },
+              "scope": {
+                "type": "object", "additionalProperties": false, "required": ["resources"],
+                "properties": { "resources": { "type": "array", "minItems": 1, "items": { "type": "string" } } }
+              },
+              "conditions": { "type": "object" },
+              "expires_at": { "type": "string", "format": "date-time" },
+              "justification": { "type": "string" }
+            }
+          }
+        },
+        "provider_mappings": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "aws_iam": { "$ref": "#/definitions/ProviderPermissionMappings" },
+            "entra_id": { "$ref": "#/definitions/ProviderPermissionMappings" },
+            "openbao": { "$ref": "#/definitions/ProviderPermissionMappings" }
+          }
+        }
+      }
+    },
+    "ProviderPermissionMappings": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["stable_id"],
+        "properties": {
+          "stable_id": { "type": "string" },
+          "provider_id": { "type": "string" },
+          "principal": { "type": "string" },
+          "scope": { "type": "string" },
+          "actions": { "type": "array", "items": { "type": "string" } },
+          "resources": { "type": "array", "items": { "type": "string" } },
+          "conditions": { "type": "object" },
+          "token_ttl": { "type": "string" },
+          "token_max_ttl": { "type": "string" },
+          "secret_id_ttl": { "type": "string" },
+          "secret_id_num_uses": { "type": "integer", "minimum": 0 },
+          "locator_env": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" }
+        }
+      }
+    },
+    "Workspace": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Stable workspace name. Required by runtime validation when repos is present."
+        },
+        "root": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Base directory for relative member paths. Relative values resolve from the repo containing this config; defaults to that repo."
+        },
+        "member_of": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Optional member-to-workspace back-reference. External repos can use this to discover workspace authorization when invoked directly; must not coexist with repos."
+        }
+      }
+    },
+    "WorkspaceRepo": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "path", "allowed"],
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Unique member name."
+        },
+        "path": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Path relative to workspace.root, or an absolute system path."
+        },
+        "allowed": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "description": "Explicit member capabilities. Unlisted actions and unlisted paths are denied regardless of filesystem writability.",
+          "items": {
+            "type": "string",
+            "enum": ["read", "write", "commit", "push", "issue-comment", "service-action", "destructive"]
+          }
+        },
+        "provider": {
+          "type": "string",
+          "enum": ["gitea", "github", "gitlab"],
+          "description": "Optional hint for self-hosted domains that cannot be classified from their remote URL. Detectable remotes take precedence."
+        },
+        "notes": {
+          "type": "string",
+          "description": "Human-readable member authorization note."
+        }
+      }
+    },
+    "ExternalLink": {
+      "type": "object",
+      "description": "A named public HTTP(S) resource. Credentials embedded in URLs are rejected by runtime validation.",
+      "additionalProperties": false,
+      "required": ["label", "url"],
+      "properties": {
+        "label": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 200,
+          "description": "Human-readable link text."
+        },
+        "url": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^https?://",
+          "description": "Absolute public HTTP(S) URL without embedded credentials."
+        },
+        "description": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 500,
+          "description": "Optional explanation of when or why to use this resource."
+        },
+        "category": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 500,
+          "description": "Optional project-defined grouping, such as security, status, or docs."
+        },
+        "audience": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 500,
+          "description": "Optional intended audience, such as contributors or maintainers."
+        }
+      }
+    },
+    "IssueLabelDefinition": {
+      "type": "object",
+      "description": "Provider-neutral workflow semantics for one tracker-native label.",
+      "additionalProperties": false,
+      "required": ["name", "category", "description", "requires_human", "blocks_automation"],
+      "allOf": [
+        {
+          "if": {
+            "properties": { "blocks_automation": { "const": true } },
+            "required": ["blocks_automation"]
+          },
+          "then": { "required": ["resume_when"] }
+        }
+      ],
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Default tracker-native label name."
+        },
+        "provider_names": {
+          "type": "object",
+          "description": "Optional provider-specific strings that preserve this semantic role.",
+          "additionalProperties": false,
+          "properties": {
+            "gitea": { "type": "string", "minLength": 1 },
+            "github": { "type": "string", "minLength": 1 },
+            "local": { "type": "string", "minLength": 1 }
+          }
+        },
+        "category": {
+          "type": "string",
+          "enum": ["type", "area", "priority", "lifecycle", "blocked-reason", "review-approval", "ownership", "automation-eligibility", "human-interaction"],
+          "description": "Informative role family used for search, audit, batching, and work selection."
+        },
+        "description": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Purpose and application condition."
+        },
+        "requires_human": {
+          "type": "boolean",
+          "description": "Whether satisfying this state requires human action."
+        },
+        "blocks_automation": {
+          "type": "boolean",
+          "description": "Whether autonomous issue work must pause while this label applies."
+        },
+        "resume_when": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Condition that permits removal or transition of a transient label; required by runtime validation when blocks_automation is true."
+        },
+        "transition_to": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Optional semantic role to apply after resume_when is satisfied."
+        }
+      }
+    },
+    "TrackerActor": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "login": {
+          "type": "string",
+          "description": "Forge login that should author delivery writes."
+        },
+        "via": {
+          "type": "string",
+          "enum": ["tea", "gh", "mcp", "api"],
+          "description": "Tooling route to use for tracker writes."
+        },
+        "forbid_actors": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Forge logins that must not author delivery mutations."
+        }
+      }
+    },
+    "RemoteTransport": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "login": {
+          "type": "string",
+          "description": "Forge login expected to authenticate git pushes."
+        },
+        "protocol": {
+          "type": "string",
+          "enum": ["ssh", "https"],
+          "description": "Transport used by the primary remote."
+        },
+        "helper": {
+          "type": "string",
+          "description": "Project-relative command used for authenticated push/check operations."
+        },
+        "key_fingerprint": {
+          "type": "string",
+          "description": "Public SSH key fingerprint expected by the helper."
+        }
+      }
+    },
+    "CommitterIdentity": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Git committer name."
+        },
+        "email": {
+          "type": "string",
+          "description": "Git committer email."
+        }
+      }
+    },
+    "SigningConfig": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "format": {
+          "type": "string",
+          "enum": ["openpgp", "ssh", "x509"],
+          "description": "Signing key format."
+        },
+        "key": {
+          "type": "string",
+          "description": "Signing key id."
+        },
+        "key_file": {
+          "type": "string",
+          "description": "Path to signing key material when not in the default keyring."
+        },
+        "program": {
+          "type": "string",
+          "description": "Signing program, such as gpg, gpg2, ssh-keygen, or a custom path."
+        },
+        "enforce": {
+          "type": "string",
+          "enum": ["commits", "tags", "all"],
+          "description": "Which delivery artifacts require signing."
+        }
+      }
+    },
+    "IndexGraphDef": {
+      "type": "object",
+      "description": "A JSON node/edge index graph (mirrors GraphConfig in src/artifacts/types.ts).",
+      "additionalProperties": false,
+      "required": ["scanDirs"],
+      "properties": {
+        "type": { "type": "string", "description": "Graph type identifier (defaults to the graph's key name)." },
+        "scanDirs": { "type": "array", "items": { "type": "string" }, "minItems": 1, "description": "Directories to scan, relative to project root (required)." },
+        "extensions": { "type": "array", "items": { "type": "string" }, "description": "File extensions to index. Default: ['.md', '.yaml', '.json']." },
+        "shared": { "type": "boolean", "description": "Whether the graph is shared across projects. Default false." },
+        "defaultBuild": { "type": "boolean", "description": "Include in `aiwg index build` with no --graph. Default true." },
+        "nodeStrategy": { "type": "string", "enum": ["default", "filename-metadata"], "description": "Node creation strategy." },
+        "filenamePattern": { "type": "string", "description": "Named-capture regex for the filename-metadata strategy." },
+        "graphBackend": { "type": "string", "enum": ["json", "graphology", "sqlite"], "description": "Graph storage backend. Default 'json'." },
+        "description": { "type": "string", "description": "Human-facing note (metadata; not consumed by the builder)." },
+        "edgeExtraction": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["parser", "edges"],
+          "properties": {
+            "parser": { "type": "string", "enum": ["citation-sidecar"], "description": "Edge-extraction parser." },
+            "edges": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["type", "source", "target"],
+                "properties": {
+                  "type": { "type": "string" },
+                  "source": { "type": "string" },
+                  "target": { "type": "string" },
+                  "skipEmpty": { "type": "boolean" }
+                }
+              }
+            }
+          }
+        },
+        "metadataSupplements": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["scanDir", "matchOn", "nodeKey", "mergeFields"],
+            "properties": {
+              "scanDir": { "type": "string" },
+              "matchOn": { "type": "string" },
+              "nodeKey": { "type": "string" },
+              "mergeFields": { "type": "array", "items": { "type": "string" } }
+            }
+          }
+        },
+        "embedding": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["enabled"],
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "model": { "type": "string" },
+            "topK": { "type": "integer", "minimum": 1 },
+            "rebuildOn": { "type": "string", "enum": ["content-change", "always", "never"] }
+          }
+        }
+      }
+    },
+    "IndexBuiltinGraphOverride": {
+      "type": "object",
+      "description": "Operator-controlled scan fields for an immutable built-in graph. Present fields replace the detected/default values.",
+      "additionalProperties": false,
+      "properties": {
+        "scanDirs": { "type": "array", "items": { "type": "string" }, "minItems": 1 },
+        "extensions": { "type": "array", "items": { "type": "string" }, "minItems": 1 }
+      }
+    },
+    "IndexMarkdownIndices": {
+      "type": "object",
+      "description": "Markdown-view manifest rendered by the corpus-index-build skill (build.py). The builder consumes each manifest entry's `name` (renderer selector) and optional `output`.",
+      "additionalProperties": false,
+      "required": ["manifest"],
+      "properties": {
+        "scanDirs": { "type": "array", "items": { "type": "string" } },
+        "extensions": { "type": "array", "items": { "type": "string" } },
+        "defaultBuild": { "type": "boolean" },
+        "manifest": {
+          "type": "array",
+          "description": "Ordered list of markdown views to render.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["name"],
+            "properties": {
+              "name": { "type": "string", "description": "Renderer selector (by-topic, by-year, authors, by-venue, by-method, by-model-size, training-pipeline, citation-network, by-author, by-org, by-bridge, unprofiled-hubs)." },
+              "output": { "type": "string", "description": "Output path. Default indices/<name>.md." },
+              "description": { "type": "string", "description": "Human-facing note (metadata)." },
+              "source": { "type": "string", "description": "Human-facing note (metadata)." }
+            }
+          }
+        }
+      }
+    },
+    "SecondaryRemote": {
+      "type": "object",
+      "description": "A non-primary git remote (mirror, upstream, publishing target)",
+      "additionalProperties": false,
+      "required": ["name"],
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Must match a name from `git remote`"
+        },
+        "purpose": {
+          "type": "string",
+          "description": "Free-form tag (mirror | upstream | publish | replica)"
+        },
+        "push_on_release": {
+          "type": "boolean",
+          "description": "Hint to release workflows to push tags here on stable cuts"
+        }
+      }
+    },
+    "ThreatAssessment": {
+      "type": "object",
+      "description": "Versioned, surface-aware forge-content threat-assessment policy. Missing configuration resolves to aiwg:balanced compatibility behavior.",
+      "additionalProperties": false,
+      "properties": {
+        "schemaVersion": { "type": "string", "const": "1" },
+        "mode": { "$ref": "#/definitions/ThreatAssessmentMode" },
+        "defaultProfile": { "type": "string", "minLength": 1 },
+        "surfaces": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "issue-title": { "$ref": "#/definitions/ThreatSurfacePolicy" },
+            "issue-body": { "$ref": "#/definitions/ThreatSurfacePolicy" },
+            "issue-comment": { "$ref": "#/definitions/ThreatSurfacePolicy" },
+            "pull-request-title": { "$ref": "#/definitions/ThreatSurfacePolicy" },
+            "pull-request-body": { "$ref": "#/definitions/ThreatSurfacePolicy" },
+            "pull-request-diff-summary": { "$ref": "#/definitions/ThreatSurfacePolicy" },
+            "review-comment": { "$ref": "#/definitions/ThreatSurfacePolicy" },
+            "release-note": { "$ref": "#/definitions/ThreatSurfacePolicy" },
+            "handoff": { "$ref": "#/definitions/ThreatSurfacePolicy" },
+            "outbound-maintainer-comment": { "$ref": "#/definitions/ThreatSurfacePolicy" }
+          }
+        },
+        "profiles": {
+          "type": "object",
+          "propertyNames": { "pattern": "^(?!aiwg:)(?!trusted$)(?!audit$)(?!balanced$)(?!strict$)(?!high-assurance$)[a-z][a-z0-9-]*$" },
+          "additionalProperties": { "$ref": "#/definitions/ThreatProfile" }
+        },
+        "rulePacks": {
+          "type": "object",
+          "propertyNames": { "pattern": "^(?!aiwg:)[a-z][a-z0-9-]*$" },
+          "additionalProperties": { "$ref": "#/definitions/ThreatRulePack" }
+        },
+        "statements": {
+          "type": "array",
+          "items": { "$ref": "#/definitions/ThreatStatement" }
+        }
+      }
+    },
+    "ThreatAssessmentMode": {
+      "type": "string",
+      "enum": ["off", "audit", "enforce"]
+    },
+    "ThreatSeverity": {
+      "type": "string",
+      "enum": ["informational", "low", "moderate", "high", "critical"]
+    },
+    "ThreatSurfacePolicy": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "mode": { "$ref": "#/definitions/ThreatAssessmentMode" },
+        "profile": { "type": "string", "minLength": 1 }
+      }
+    },
+    "ThreatThresholds": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "flag": { "$ref": "#/definitions/ThreatSeverity" },
+        "requireAuthorization": { "$ref": "#/definitions/ThreatSeverity" },
+        "reject": { "$ref": "#/definitions/ThreatSeverity" }
+      }
+    },
+    "ThreatProfile": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "version": { "type": "string", "minLength": 1 },
+        "extends": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+        "mode": { "$ref": "#/definitions/ThreatAssessmentMode" },
+        "description": { "type": "string" },
+        "thresholds": { "$ref": "#/definitions/ThreatThresholds" },
+        "ruleSets": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+        "statements": { "type": "array", "items": { "$ref": "#/definitions/ThreatStatement" } }
+      }
+    },
+    "ThreatRulePack": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["version", "rules"],
+      "properties": {
+        "version": { "type": "string", "minLength": 1 },
+        "description": { "type": "string" },
+        "rules": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/definitions/ThreatRule" }
+        }
+      }
+    },
+    "ThreatRule": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "severity", "patterns"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$" },
+        "severity": { "$ref": "#/definitions/ThreatSeverity" },
+        "likelihood": { "type": "integer", "minimum": 1, "maximum": 5 },
+        "impact": { "type": "integer", "minimum": 1, "maximum": 5 },
+        "taxonomy": { "type": "array", "items": { "type": "string" } },
+        "patterns": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "string", "minLength": 1, "maxLength": 500 }
+        }
+      }
+    },
+    "ThreatStatement": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "effect", "reason"],
+      "allOf": [
+        {
+          "if": { "properties": { "effect": { "const": "suppress" } } },
+          "then": {
+            "required": ["signals", "when", "riskAcceptance"],
+            "properties": {
+              "signals": { "minItems": 1 },
+              "when": {
+                "anyOf": [
+                  { "required": ["surface"] },
+                  { "required": ["semanticContext"] },
+                  { "required": ["requestedAction"] }
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": { "properties": { "effect": { "const": "set-severity" } } },
+          "then": { "required": ["severity"] }
+        }
+      ],
+      "properties": {
+        "id": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$" },
+        "effect": { "type": "string", "enum": ["suppress", "set-severity"] },
+        "signals": { "type": "array", "items": { "type": "string" } },
+        "severity": { "$ref": "#/definitions/ThreatSeverity" },
+        "reason": { "type": "string", "minLength": 1 },
+        "when": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "surface": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "enum": ["issue-title", "issue-body", "issue-comment", "pull-request-title", "pull-request-body", "pull-request-diff-summary", "review-comment", "release-note", "handoff", "outbound-maintainer-comment"]
+              }
+            },
+            "semanticContext": {
+              "type": "array",
+              "items": { "type": "string", "enum": ["requested", "negative", "quoted", "documentation"] }
+            },
+            "requestedAction": { "type": "array", "items": { "type": "string" } }
+          }
+        },
+        "riskAcceptance": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["acceptedBy", "rationale"],
+          "properties": {
+            "acceptedBy": { "type": "string", "minLength": 1 },
+            "rationale": { "type": "string", "minLength": 1 },
+            "expiresAt": { "type": "string", "format": "date-time" }
+          }
+        }
+      }
+    },
+    "InstalledFramework": {
+      "type": "object",
+      "description": "Metadata for an installed AIWG framework",
+      "properties": {
+        "version": {
+          "type": "string",
+          "description": "Installed framework version (CalVer: YYYY.M.PATCH)"
+        },
+        "providers": {
+          "type": "array",
+          "description": "Providers this framework was deployed to",
+          "items": {
+            "type": "string"
+          }
+        },
+        "installedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp of installation"
+        },
+        "source": {
+          "type": "string",
+          "description": "Source registry or path"
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}