@aiwg/cli 2026.10.5 → 2026.10.6

package/dist/src/models/worker-installation.mjs

@@ -1,7 +1,7 @@
 /** Shared installed-worker qualification owner, also used by the Ralph compatibility facade. */
 import { spawn } from 'node:child_process';
 import { constants } from 'node:fs';
-import { open, realpath, lstat, mkdir, rename, writeFile } from 'node:fs/promises';
+import { open, realpath, lstat, mkdir, rename, writeFile, unlink } from 'node:fs/promises';
 import path from 'node:path';
 import { homedir } from 'node:os';
 import { pathToFileURL } from 'node:url';
@@ -163,7 +163,7 @@ export async function qualifyWorkerInstallation(instance, options) {
 }
 
 export async function prepareInstalledWorkerInvocation(instance, invocation, qualification) {
-  const { prepareWorkerInvocation, WorkerPathScopeError } = await import('../serve/worker-invocation.js');
+  const { prepareWorkerInvocation, WorkerPathScopeError, WorkerInvocationCheckError } = await import('../serve/worker-invocation.js');
   const { requiredWorkerControls, WorkerPolicyError, isOperatorQualifiedWorkerAdapter } = await import('./provider-policy.js');
   if (!isOperatorQualifiedWorkerAdapter(qualification.adapter)) qualification = { ...qualification, requiredControls: requiredWorkerControls({
     ...qualification, effort: invocation.selected.effort.value }) };
@@ -187,7 +187,7 @@ export async function prepareInstalledWorkerInvocation(instance, invocation, qua
       throw new WorkerPolicyError('OG_PIN_MISMATCH', 'Worker installation qualification changed');
     }
     if (await realpath(result.cwd) !== scope.cwd) {
-      throw new WorkerPolicyError('OG_CONFIG_REFERENCE', 'Worker cwd differs from the qualified workspace');
+      throw new WorkerInvocationCheckError('OG_CONFIG_REFERENCE', 'qualified_workspace_mismatch');
     }
     for (const key of ['briefPath', 'stdoutPath', 'stderrPath', 'finalPath']) {
       const target = await canonicalFuturePath(result[key]);
@@ -443,6 +443,19 @@ export function boundedVersionProbe(executable, argv, environment, cwd, timeoutM
     || !Array.isArray(argv) || argv.some(arg => typeof arg !== 'string' || arg.includes('\0'))) {
     throw new Error('Invalid probe bounds');
   }
+  // ETXTBSY: the executable still has a writer somewhere, typically a sibling
+  // process forked while the file was being written or a CLI mid-update. It
+  // clears in milliseconds, so retry the spawn within the same overall bound.
+  const deadline = Date.now() + timeoutMs;
+  const attempt = delayMs => runBoundedVersionProbe(executable, argv, environment, cwd, timeoutMs, maxBytes, versionPattern)
+    .catch(error => {
+      if (error?.code !== 'ETXTBSY' || Date.now() + delayMs >= deadline) throw error;
+      return new Promise(resolveDelay => setTimeout(resolveDelay, delayMs)).then(() => attempt(Math.min(delayMs * 2, 200)));
+    });
+  return attempt(10);
+}
+
+function runBoundedVersionProbe(executable, argv, environment, cwd, timeoutMs, maxBytes, versionPattern) {
   return new Promise((resolve, reject) => {
     const child = spawn(executable, argv, { cwd, env: environment, stdio: 'pipe', detached: true, shell: false });
     let output = Buffer.alloc(0);
@@ -663,7 +676,9 @@ async function loadQualifiedModules({ registry, modules, workerWritableRoots, pl
     for (const id of entry.adapterIds) {
       const builtinConflict = canonicalIds.has(id) ? false : providerRegistry.has(id);
       if (ids.has(id) || ((builtinConflict || installedModules.has(inspectedModule.key))
-        && installedModules.get(id) !== inspectedModule.key)) throw new Error(`Duplicate worker adapter ID: ${id}`);
+        && installedModules.get(id) !== inspectedModule.key)) {
+        throw Object.assign(new Error(`Duplicate worker adapter ID: ${id}`), { code: 'WORKER_ADAPTER_CONFLICT' });
+      }
       ids.add(id);
     }
     inspected.push(inspectedModule);
@@ -825,6 +840,37 @@ async function readInstallationStore(filename, expectedDigest) {
   }
 }
 
+/** Offline projection of recorded approvals only. Never imports drivers, reads auth, or probes CLIs.
+ * This is historical evidence, not current launch authority; loadRecordedWorkerInstallations
+ * performs binary/version/scope checks when dispatch actually requests a binding.
+ */
+export async function inspectRecordedWorkerQualifications({ cwd, policy, parallelism }) {
+  const filename = installationStorePath();
+  await assertTrustedStore(filename, [cwd]);
+  const { stored } = await readInstallationStore(filename);
+  const workspace = await realpath(cwd);
+  const results = [];
+  const { qualificationDigest } = await import('./qualification-digest.mjs');
+  for (const record of stored.registrations) {
+    try {
+      const { cli, installation, adapter, binding } = record;
+      const configured = parallelism?.clis?.[cli];
+      if (!configured || configured.enabled === false || !/^[a-z][a-z0-9-]{0,62}$/.test(cli)
+        || await realpath(installation.cwd) !== workspace
+        || qualificationDigest(policy) !== installation.effectiveConfigDigest
+        || configured.adapter !== `providers:${adapter.provider}` && configured.adapter !== adapter.id
+        || configured.accountScope !== binding.accountScope
+        || binding.profile !== installation.profile || binding.cliVersion !== installation.cliVersion
+        || (configured.executable && await realpath(configured.executable) !== await realpath(installation.executable))) continue;
+      const proof = adapter.invocationProfiles?.[binding.profile]?.installationQualification;
+      if (!proof || ['scopeDigest', 'fixtureDigest', 'verifiedAt', 'evidenceRef'].some(key => proof[key] !== installation.evidence?.[key])) continue;
+      await assertWorkerInstallationEvidence({ ...installation, adapter, now: Date.now(), policy }, proof.scopeDigest);
+      results.push({ cli, provider: adapter.provider });
+    } catch { /* Malformed, expired or unbound evidence is not qualification. */ }
+  }
+  return results.filter(row => results.filter(other => row.cli === other.cli).length === 1);
+}
+
 /** Explicit host operation: successful bounded qualification is required before
  * recording; credentials are reduced to names and are never written to disk. */
 export async function recordWorkerInstallation(instance, options) {
@@ -842,79 +888,154 @@ export async function recordWorkerInstallation(instance, options) {
     || binding.accountScope !== installation.accountScope) throw new Error('Installation binding differs from qualification');
   const filename = installationStorePath();
   await assertTrustedStore(filename, installation.workerWritableRoots);
-  const { stored } = await readInstallationStore(filename);
-  const environmentNames = Object.keys(installation.environment ?? {});
-  delete installation.environment;
-  delete installation.adapter;
-  delete installation.now;
-  const record = { cli, ...(options.modelObservations ? { modelObservations: structuredClone(options.modelObservations) } : {}), binding: { ...structuredClone(binding), boundary: installation.boundary }, adapter,
-    installation: { ...installation, environmentNames, versionProbe: { rawBanner: result.rawVersionBanner, version: result.cliVersion } },
-    ...(options.mcpSchemas ? { mcpSchemas: structuredClone(options.mcpSchemas) } : {}),
-    ...(options.mcpProfile ? { mcpProfile: structuredClone(options.mcpProfile) } : {}) };
-  stored.registrations = stored.registrations.filter(entry => entry.cli !== cli);
-  stored.registrations.push(record);
+  // Canonical workspace identity is an exact approval key, never a prefix.
+  installation.cwd = await realpath(installation.cwd);
   await mkdir(path.dirname(filename), { recursive: true, mode: 0o700 });
-  await assertTrustedStore(filename, installation.workerWritableRoots);
-  const temporary = `${filename}.${process.pid}.${createHash('sha256').update(String(Math.random())).digest('hex')}.tmp`;
-  await writeFile(temporary, `${JSON.stringify(stored, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
-  await rename(temporary, filename);
-  return result;
+  // Serialize read/modify/rename across qualifying CLI processes. A stale lock
+  // fails closed; qualification never steals another process's lock.
+  const lockPath = `${filename}.lock`;
+  let lock;
+  for (let attempt = 0; attempt < 100; attempt++) {
+    try { lock = await open(lockPath, 'wx', 0o600); break; }
+    catch (error) {
+      if (error.code !== 'EEXIST' || attempt === 99) throw error;
+      await new Promise(resolve => setTimeout(resolve, 20));
+    }
+  }
+  try {
+    await assertTrustedStore(filename, installation.workerWritableRoots);
+    const { stored } = await readInstallationStore(filename);
+    const environmentNames = Object.keys(installation.environment ?? {});
+    delete installation.environment;
+    delete installation.adapter;
+    delete installation.now;
+    const record = { cli, ...(options.modelObservations ? { modelObservations: structuredClone(options.modelObservations) } : {}), binding: { ...structuredClone(binding), boundary: installation.boundary }, adapter,
+      installation: { ...installation, environmentNames, versionProbe: { rawBanner: result.rawVersionBanner, version: result.cliVersion } },
+      ...(options.mcpSchemas ? { mcpSchemas: structuredClone(options.mcpSchemas) } : {}),
+      ...(options.mcpProfile ? { mcpProfile: structuredClone(options.mcpProfile) } : {}) };
+    const retained = [];
+    for (const entry of stored.registrations) {
+      const workspace = typeof entry.installation?.cwd === 'string'
+        ? await realpath(entry.installation.cwd).catch(() => entry.installation.cwd) : null;
+      if (entry.cli !== cli || workspace !== installation.cwd) retained.push(entry);
+    }
+    // Bound host authority without silently evicting another workspace approval.
+    if (retained.length >= 128) throw new Error('Worker installation store is full (128 workspace approvals); remove an obsolete approval before qualifying another workspace');
+    stored.registrations = retained;
+    stored.registrations.push(record);
+    await mkdir(path.dirname(filename), { recursive: true, mode: 0o700 });
+    await assertTrustedStore(filename, installation.workerWritableRoots);
+    const temporary = `${filename}.${process.pid}.${createHash('sha256').update(String(Math.random())).digest('hex')}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(stored, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
+    await rename(temporary, filename);
+    return result;
+  } finally {
+    await lock.close();
+    await unlink(lockPath);
+  }
 }
 
 /** Read recorded host authority, validate installation bytes and the current CLI
  * version, then load the same approved factory used by Ralph. */
-export async function loadRecordedWorkerInstallations({ registry, cwd, policy, parallelism, storePath, storeDigest }) {
+export async function loadRecordedWorkerInstallations({ registry, cwd, policy, parallelism, storePath, storeDigest, precheckPolicy }) {
   const { WorkerPolicyError, parseProviderModelCapabilities } = await import('./provider-policy.js');
   const { qualificationDigest } = await import('./qualification-digest.mjs');
-  const fail = () => new WorkerPolicyError('OG_ADAPTER_UNQUALIFIED', 'Trusted installation qualification is required');
-  const filename = storePath ?? installationStorePath();
+  // Only fixed stage codes and bounded record indexes may leave this boundary.
+  // Underlying errors can contain probe output, environment values or paths.
+  const rejections = [];
+  const fail = () => new WorkerPolicyError('OG_ADAPTER_UNQUALIFIED',
+    `Trusted installation qualification is required (${[...new Set(rejections.map(row => row.reason))].join(', ')})`,
+    { rejections });
+  let reason = 'store-binding';
+  let filename;
   let stored, digest;
   try {
+    filename = storePath ?? installationStorePath();
     if (!path.isAbsolute(filename) || (storePath !== undefined && !/^sha256:[a-f0-9]{64}$/.test(storeDigest ?? ''))) throw fail();
+    reason = 'store-untrusted';
     await assertTrustedStore(filename, [cwd]);
+    reason = 'store-record';
     ({ stored, digest } = await readInstallationStore(filename, storeDigest));
   }
-  catch { throw fail(); }
+  catch { rejections.push({ registration: null, reason }); throw fail(); }
+  if (!stored.registrations.length) {
+    rejections.push({ registration: null, reason: 'no-records' });
+    throw fail();
+  }
+  // Request policy errors remain actionable before digest/adapter checks,
+  // while an absent approval retains the qualification contract (#3070).
+  precheckPolicy?.();
   const installations = {};
   const drivers = {};
   const observations = {};
   const resolvedRegistry = structuredClone(registry);
+  const requestedWorkspace = await realpath(cwd);
+  const workspaces = await Promise.all(stored.registrations.map(async record => {
+    try { return await realpath(record?.installation?.cwd); } catch { return null; }
+  }));
   const counts = new Map();
-  for (const record of stored.registrations) counts.set(record?.cli, (counts.get(record?.cli) ?? 0) + 1);
-  for (const record of stored.registrations) {
+  const selected = new Map();
+  for (const [index, record] of stored.registrations.entries()) {
+    const key = JSON.stringify([record?.cli, workspaces[index]]);
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+    // Prefer an exact approval. Retain the latest other-workspace record only
+    // to preserve the typed workspace-mismatch diagnostic for unapproved dirs.
+    const prior = selected.get(record?.cli);
+    if (prior === undefined || workspaces[prior] !== requestedWorkspace) selected.set(record?.cli, index);
+  }
+  for (const [registration, record] of stored.registrations.entries()) {
+    reason = 'record-identity';
     try {
       const { cli, binding, adapter } = record;
-      if (!/^[a-z][a-z0-9-]{0,62}$/.test(cli) || counts.get(cli) !== 1) throw fail();
+      if (!/^[a-z][a-z0-9-]{0,62}$/.test(cli)) throw fail();
+      if (counts.get(JSON.stringify([cli, workspaces[registration]])) !== 1) throw fail();
+      if (selected.get(cli) !== registration) continue;
       const installation = { ...record.installation, adapter, now: Date.now(), environment: {} };
+      reason = 'environment-name';
       if (record.installation.environment && Object.keys(record.installation.environment).length) throw fail();
       for (const name of installation.environmentNames ?? []) {
         if (typeof name !== 'string' || process.env[name] === undefined) throw fail();
         installation.environment[name] = process.env[name];
       }
+      reason = 'binding-mismatch';
       if (binding.profile !== installation.profile || binding.cliVersion !== installation.cliVersion
         || binding.accountScope !== installation.accountScope
-        || qualificationDigest(binding.boundary) !== qualificationDigest(installation.boundary)
-        || qualificationDigest(policy) !== installation.effectiveConfigDigest) throw fail();
+        || qualificationDigest(binding.boundary) !== qualificationDigest(installation.boundary)) throw fail();
+      reason = 'effective-config-digest';
+      if (qualificationDigest(policy) !== installation.effectiveConfigDigest) throw fail();
+      reason = 'evidence';
       const proof = adapter.invocationProfiles?.[binding.profile]?.installationQualification;
       if (!proof || ['scopeDigest', 'fixtureDigest', 'verifiedAt', 'evidenceRef'].some(key => proof[key] !== installation.evidence?.[key])) throw fail();
       // Reject expired/unbound negative observations before any factory import.
       const { requiredWorkerControls, isOperatorQualifiedWorkerAdapter } = await import('./provider-policy.js');
       if (!isOperatorQualifiedWorkerAdapter(adapter)) installation.requiredControls = requiredWorkerControls(installation);
       await assertWorkerInstallationEvidence(installation, proof.scopeDigest);
+      reason = 'store-untrusted';
       await assertTrustedStore(filename, installation.workerWritableRoots);
+      reason = 'adapter-metadata';
       const candidateRegistry = structuredClone(resolvedRegistry);
       if (candidateRegistry.providers[adapter.id]) candidateRegistry.providers[adapter.id].workerAdapter = adapter;
       else { candidateRegistry.workerAdapters ??= {}; candidateRegistry.workerAdapters[adapter.id] = adapter; }
       parseProviderModelCapabilities(candidateRegistry);
       // The loader validates package identity, bytes and static exports BEFORE import.
       // Only this installation's metadata is needed; unrelated absent modules do not block it.
-      const loadingRegistry = structuredClone(registry);
-      for (const provider of Object.values(loadingRegistry.providers)) delete provider.workerAdapter;
-      loadingRegistry.workerAdapters = { [adapter.id]: adapter };
+      // Preserve the canonical provider slot used to distinguish upgrades from ID conflicts.
+      const loadingRegistry = structuredClone(candidateRegistry);
+      const canonical = loadingRegistry.providers[adapter.id]?.workerAdapter?.id === adapter.id;
+      for (const [name, provider] of Object.entries(loadingRegistry.providers)) {
+        if (canonical && name === adapter.id) provider.workerAdapter = adapter;
+        else delete provider.workerAdapter;
+      }
+      loadingRegistry.workerAdapters = canonical ? {} : { [adapter.id]: adapter };
+      reason = 'module-registration';
       await loadInstalledWorkerAdapters({ registry: loadingRegistry, modules: installation.modules,
         workerWritableRoots: installation.workerWritableRoots, platform: process.platform });
+      reason = 'binary-identity';
       const instance = createProvider(adapter.id);
-      const { scope } = await recheckWorkerInstallation(instance, installation);
+      const scope = await inspectWorkerInstallation(instance, installation);
+      reason = 'scope-digest';
+      await assertWorkerInstallationEvidence(installation, scope.scopeDigest);
+      reason = 'binary-identity';
       if (parallelism && isOperatorQualifiedWorkerAdapter(adapter)) {
         const { resolveWorkerGroupInstallation } = await import('../config/aiwg-config.js');
         const configured = resolveWorkerGroupInstallation(parallelism, cli, candidateRegistry);
@@ -931,15 +1052,19 @@ export async function loadRecordedWorkerInstallations({ registry, cwd, policy, p
         }
         if (!executable || await realpath(executable) !== scope.binary.realpath) throw fail();
       }
+      reason = 'scope-digest';
       if (scope.scopeDigest !== proof.scopeDigest) throw fail();
       // A launcher can keep the same bytes while its CLI payload is updated.
       // Reuse the bounded, credential-free doctor probe before granting authority.
+      reason = 'version';
       const { version } = await boundedVersionProbe(scope.binary.realpath,
         adapter.invocation.versionArgv, workerVersionProbeEnvironment(), cwd,
         workerVersionProbeDefaults.timeoutMs, workerVersionProbeDefaults.maxBytes,
         adapter.invocation.versionPattern);
-      if (version !== binding.cliVersion
-        || (await inspectWorkerInstallation(instance, installation)).scopeDigest !== scope.scopeDigest) throw fail();
+      if (version !== binding.cliVersion) throw fail();
+      reason = 'scope-digest';
+      if ((await inspectWorkerInstallation(instance, installation)).scopeDigest !== scope.scopeDigest) throw fail();
+      reason = 'driver';
       const profile = adapter.invocationProfiles[binding.profile];
       let mcpRegistry;
       if (profile.transport === 'mcp') {
@@ -979,8 +1104,15 @@ export async function loadRecordedWorkerInstallations({ registry, cwd, policy, p
       installations[cli] = structuredClone(binding);
       if (record.modelObservations) observations[cli] = structuredClone(record.modelObservations);
       Object.assign(resolvedRegistry, candidateRegistry);
-    } catch { /* One missing/changed installation cannot grant authority or hide qualified peers. */ }
+    } catch (error) {
+      // One rejected installation cannot grant authority or hide qualified peers.
+      rejections.push({ registration, reason: reason === 'module-registration' && error?.code === 'WORKER_ADAPTER_CONFLICT'
+        ? 'adapter-conflict' : reason });
+    }
+  }
+  if (!Object.keys(installations).length) {
+    if (!rejections.length) rejections.push({ registration: null, reason: 'no-records' });
+    throw fail();
   }
-  if (!Object.keys(installations).length) throw fail();
   return { registry: resolvedRegistry, installations, drivers, observations };
 }

package/dist/src/models/wrapper-route.js

@@ -47,7 +47,7 @@ export function buildWrapperRouteEnvelope(request) {
         ? [
             `Run this assignment through ${wrapper}.`,
             `Selected capability: ${request.capability.type} ${request.capability.name} (${request.capability.id}).`,
-            `Load it with aiwg show ${request.capability.type === 'workflow' ? 'metadata' : request.capability.type} ${request.capability.id} after discover-first validation.`,
+            `Load it with aiwg show ${request.capability.type === 'workflow' ? 'metadata' : request.capability.type} ${request.capability.id}${request.capability.type === 'workflow' ? '' : ' --body'} after discover-first validation.`,
             `Assignment: ${request.assignment.trim()}`,
             'Return capability evidence, changed artifacts, validation results, and remaining risks.',
         ].join('\n')

package/dist/src/output-modes/registry.js

@@ -5,6 +5,7 @@ import { createHash } from 'node:crypto';
 import { dirname, extname, join, resolve } from 'node:path';
 import { parse, stringify } from 'yaml';
 import { z } from 'zod';
+import { integer } from '../schema/zod-validation.mjs';
 import { getWritingChannelPack } from '../writing/channel-packs.js';
 import { WriterProfileStore } from '../writing/writer-profile-store.js';
 import { compileWriterProfile } from '../writing/writer-profile.js';
@@ -14,28 +15,28 @@ const PROTECTED = ['code', 'commands', 'citations', 'quoted-text', 'identifiers'
 const STAGE_ORDER = ['semantic', 'voice', 'controlled-language', 'structure', 'presentation'];
 const modeIdSchema = z.string().regex(MODE_ID_PATTERN, 'must start with a lowercase letter or number and contain only lowercase letters, numbers, dots, or hyphens');
 const uniqueModeIds = z.array(modeIdSchema).refine(values => new Set(values).size === values.length, 'must not contain duplicates');
-const outputModeProfileSchema = z.object({
+const outputModeProfileSchema = z.strictObject({
     id: modeIdSchema,
     version: z.string().min(1),
     description: z.string().min(1),
     kind: z.enum(['voice', 'controlled-language', 'structure', 'presentation']),
     stage: z.enum(STAGE_ORDER),
-    order: z.number().int().optional(),
+    order: integer().optional(),
     instructions: z.string(),
-    provenance: z.object({ source: z.string().min(1), license: z.string().min(1) }).strict(),
-    validation: z.object({
+    provenance: z.strictObject({ source: z.string().min(1), license: z.string().min(1) }),
+    validation: z.strictObject({
         level: z.enum(['advisory', 'validated', 'conformance']),
         hook: z.string().min(1).optional(),
         standardVersion: z.string().min(1).optional(),
-    }).strict(),
+    }),
     compatible: uniqueModeIds.optional(),
     conflicts: uniqueModeIds.optional(),
     requires: uniqueModeIds.optional(),
     supersedes: uniqueModeIds.optional(),
     protectedContent: z.array(z.enum(PROTECTED)).refine(values => new Set(values).size === values.length, 'must not contain duplicates').optional(),
-    contextCost: z.number().int().nonnegative().optional(),
+    contextCost: integer().nonnegative().optional(),
     mergeStrategy: z.literal('weighted-voice').optional(),
-}).strict().superRefine((profile, ctx) => {
+}).superRefine((profile, ctx) => {
     if (profile.validation.level !== 'advisory' && !profile.validation.hook) {
         ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['validation', 'hook'], message: `${profile.validation.level} modes require a validator hook` });
     }

package/dist/src/plugin/metadata-validator.js

@@ -177,7 +177,7 @@ export class MetadataValidator {
             result.manifest = manifest;
         }
         else {
-            for (const issue of skillResult.errors.errors) {
+            for (const issue of skillResult.errors.issues) {
                 result.errors.push({
                     path: filename,
                     field: issue.path.join('.'),

package/dist/src/providers/deploy-version.d.mts

@@ -0,0 +1 @@
+export function resolveDeployVersion(root: string, explicitVersion?: string | null, warn?: (message: string) => void): string;

package/dist/src/providers/deploy-version.mjs

@@ -0,0 +1,17 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+/** Resolve the selected corpus version before provider inputs are staged. */
+export function resolveDeployVersion(root, explicitVersion, warn = console.warn) {
+  const valid = value => typeof value === 'string' && value.trim() &&
+    !/unknown|\s/i.test(value);
+  if (valid(explicitVersion)) return explicitVersion;
+  if (!explicitVersion) {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+      if (valid(pkg.version)) return pkg.version;
+    } catch { /* Report missing, unreadable and invalid versions consistently. */ }
+  }
+  warn(`Unable to resolve AIWG deploy version from ${path.join(root, 'package.json')}; managed markers will use vunknown. Restore the package version or pass --deploy-version to the deployer.`);
+  return 'unknown';
+}

package/dist/src/providers/provider-definitions.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
+import { integer, url } from '../schema/zod-validation.mjs';
 import { homedir } from 'os';
-import { join } from 'path';
+import { isAbsolute, join } from 'path';
 import { resolveHermesHomePath } from './hermes-home.js';
 import { resolveGrokbotSkillsDir } from './grokbot-paths.js';
 import { getProviderCapabilities, } from './capability-matrix.js';
@@ -38,9 +39,9 @@ const ProviderDefinitionSchema = z.object({
     status: z.enum(['stable', 'experimental', 'deprecated']),
     builtIn: z.boolean(),
     upstream: z.object({
-        source: z.string().url(),
+        source: url(),
         version: z.string().min(1),
-        revision: z.string().regex(/^[0-9a-f]{40}$/).refine((value) => value !== '0'.repeat(40), { message: 'upstream.revision must be a real reviewed SHA, not all-zero' }),
+        revision: z.string().regex(/^[0-9a-f]{40}$/).refine((value) => value !== '0'.repeat(40), { error: 'upstream.revision must be a real reviewed SHA, not all-zero' }),
         runtime: z.string().min(1),
         lastVerified: z.string().regex(/^\d{4}-\d{2}-\d{2}$/),
     }).optional(),
@@ -67,7 +68,7 @@ const ProviderDefinitionSchema = z.object({
         env: z.array(z.string().min(1)),
         process: z.array(z.string().min(1)),
         capabilityId: z.string().min(1),
-        runtimeEnvPriority: z.number().int().positive().optional(),
+        runtimeEnvPriority: integer().positive().optional(),
     }),
     paths: z.object({
         deployTarget: z.enum(['project', 'home', 'mixed']),
@@ -95,8 +96,8 @@ const ProviderDefinitionSchema = z.object({
         includeSyntax: z.string().nullable(),
         configRegistration: z.object({ file: z.string().min(1), key: z.string().min(1) }).nullable(),
         bootstrapTargets: z.array(z.string().min(1)),
-        maxContextBytes: z.number().int().positive().nullable(),
-        recommendedMaxLines: z.number().int().positive().nullable(),
+        maxContextBytes: integer().positive().nullable(),
+        recommendedMaxLines: integer().positive().nullable(),
         nestedContext: z.boolean(),
         support: z.enum(['supported', 'degraded', 'unsupported']),
         verification: z.object({
@@ -119,8 +120,8 @@ const ProviderDefinitionSchema = z.object({
         pathType: z.enum(['project', 'home-dir']),
         skillsBaseDir: z.string().min(1),
         subdirLayout: z.boolean(),
-        maxNameLength: z.number().int().positive().optional(),
-        maxDescriptionLength: z.number().int().positive().optional(),
+        maxNameLength: integer().positive().optional(),
+        maxDescriptionLength: integer().positive().optional(),
         appendToDescription: z.string().min(1).optional(),
     }),
     adapters: z.object({
@@ -132,8 +133,8 @@ const ProviderDefinitionSchema = z.object({
     }),
     capabilities: z.object({
         matrixRef: z.string().nullable(),
-        nativeFeatures: z.record(z.boolean()),
-        emulation: z.record(z.string().nullable()),
+        nativeFeatures: z.record(z.string(), z.boolean()),
+        emulation: z.record(z.string(), z.string().nullable()),
     }),
 });
 export const PROVIDER_IDS = [
@@ -755,10 +756,11 @@ const BUILT_IN_SEEDS = [
                 agents: null,
                 commands: null,
                 skills: resolveHermesHomePath('skills', '.aiwg'),
-                rules: null,
+                rules: '.hermes/rules',
                 behaviors: null,
             },
             kernelSkills: resolveHermesHomePath('skills'),
+            contextDiscovery: { agents: null, skills: resolveHermesHomePath('skills', '.aiwg'), rules: null, behaviors: null },
             configFile: 'AGENTS.md',
             contextFiles: { aiwgMd: true, agentsMd: true, claudeMdHook: false, hookFile: '.hermes.md', contextFile: 'AGENTS.md' },
         },
@@ -1080,7 +1082,7 @@ const BUILT_IN_SEEDS = [
                 agents: '.agents/skills',
                 commands: '.pi/prompts',
                 skills: '.pi/.aiwg/skills',
-                rules: null,
+                rules: '.pi/rules',
                 behaviors: '.pi/extensions',
             },
             kernelSkills: '.agents/skills',
@@ -1425,13 +1427,14 @@ export function getProviderKernelSkillPath(provider) {
     const definition = getProviderDefinition(provider);
     return expandProviderHomePath(definition?.paths.kernelSkills ?? null);
 }
-export function resolveProviderPathValue(providerPath, projectPath) {
-    const expandedPath = expandProviderHomePath(providerPath);
+export function resolveProviderPathValue(providerPath, projectPath, paths = { join, isAbsolute }, homeDirectory = homedir()) {
+    const expandedPath = !providerPath ? '' : providerPath === '~' ? homeDirectory
+        : providerPath.startsWith('~/') ? paths.join(homeDirectory, providerPath.slice(2)) : providerPath;
     if (!expandedPath)
         return '';
-    if (expandedPath.startsWith('/'))
+    if (paths.isAbsolute(expandedPath))
         return expandedPath;
-    return join(projectPath, expandedPath);
+    return paths.join(projectPath, expandedPath);
 }
 export function normalizeProviderDefinitionId(provider) {
     const normalized = provider?.trim().toLowerCase();

package/dist/src/providers/skill-ownership.d.mts

@@ -2,8 +2,17 @@ export interface SkillReceipt {
   skillSource?: string;
   managed?: Record<string, { hash: string; frameworkSlug?: string; source?: string; version?: string }>;
 }
+export interface SkillRemovalPlanEntry {
+  path: string;
+  action: 'remove' | 'preserve';
+  reason: string;
+}
+export interface SkillRemovalOptions {
+  dryRun?: boolean;
+  plan?: SkillRemovalPlanEntry[];
+}
 export function extractFrameworkSlug(source: string): string | null;
 export function sameSkillOwner(receipt: SkillReceipt | null, skillSource: string, frameworkSlug?: string | null): boolean;
 export function canDeploySkill(receipt: SkillReceipt | null, skillSource: string, opts?: { force?: boolean }): boolean;
-export function pruneRecordedSkillFiles(skillDir: string, managed: SkillReceipt['managed'], desired: Set<string>, opts?: { dryRun?: boolean }): void;
-export function releaseSkillOwnership(skillDir: string, owner: { frameworkSlug?: string; skillSource?: string; sourceRoot?: string }, opts?: { dryRun?: boolean }): boolean | null;
+export function pruneRecordedSkillFiles(skillDir: string, managed: SkillReceipt['managed'], desired: Set<string>, opts?: SkillRemovalOptions): void;
+export function releaseSkillOwnership(skillDir: string, owner: { frameworkSlug?: string; skillSource?: string; sourceRoot?: string }, opts?: SkillRemovalOptions): boolean | null;

package/dist/src/providers/skill-ownership.mjs

@@ -40,28 +40,40 @@ export function canDeploySkill(receipt, skillSource, { force = false } = {}) {
 
 /** Remove unchanged recorded files, allowing symlinks above (but never inside) the skill root. */
 export function pruneRecordedSkillFiles(skillDir, managed, desired, opts = {}) {
-  if (opts.dryRun) return;
+  const root = path.resolve(skillDir);
   for (const [relative, record] of Object.entries(managed || {})) {
-    if (desired.has(relative)) continue;
     const target = path.resolve(skillDir, relative);
-    if (!target.startsWith(`${path.resolve(skillDir)}${path.sep}`)) continue;
+    let action = 'preserve';
+    let reason = 'modified or unverifiable managed file';
+    if (desired.has(relative)) reason = 'retained managed file';
+    else if (!target.startsWith(`${root}${path.sep}`)) reason = 'path outside skill directory';
+    else {
+      try {
+        const expected = path.resolve(fs.realpathSync(skillDir), relative);
+        let current = target;
+        let symlink = false;
+        while (current !== root) {
+          if (fs.lstatSync(current).isSymbolicLink()) { symlink = true; break; }
+          current = path.dirname(current);
+        }
+        if (symlink) reason = 'symlink preserved';
+        else if (fs.realpathSync(target) === expected && fs.lstatSync(target).isFile()
+          && `sha256:${createHash('sha256').update(fs.readFileSync(target)).digest('hex')}` === record?.hash) {
+          action = 'remove';
+          reason = 'unchanged managed file';
+        }
+      } catch { reason = 'missing or unreadable path; cannot verify'; }
+    }
+    opts.plan?.push({ path: target, action, reason });
+    if (opts.dryRun || action !== 'remove') continue;
     try {
-      const expected = path.resolve(fs.realpathSync(skillDir), relative);
-      let current = target;
-      let symlink = false;
-      while (current !== path.resolve(skillDir)) {
-        if (fs.lstatSync(current).isSymbolicLink()) { symlink = true; break; }
-        current = path.dirname(current);
-      }
-      if (symlink || fs.realpathSync(target) !== expected || !fs.lstatSync(target).isFile()) continue;
-      if (`sha256:${createHash('sha256').update(fs.readFileSync(target)).digest('hex')}` !== record.hash) continue;
       fs.unlinkSync(target);
       let parent = path.dirname(target);
-      while (parent !== path.resolve(skillDir)) {
+      while (parent !== root) {
         try { fs.rmdirSync(parent); } catch { break; }
         parent = path.dirname(parent);
       }
-    } catch { /* missing, modified, or unreadable files are left alone */ }
+    } catch { /* Files that cannot be removed are left alone. */ }
   }
 }
 
@@ -80,9 +92,15 @@ export function releaseSkillOwnership(skillDir, owner, opts = {}) {
     && !path.isAbsolute(path.relative(path.resolve(owner.sourceRoot), path.resolve(receipt.skillSource)));
   if (!insideRoot && (slug ? slug !== owner.frameworkSlug
     : !owner.skillSource || !sameSkillOwner(receipt, owner.skillSource, null))) return null;
-  if (opts.dryRun) return false;
   pruneRecordedSkillFiles(skillDir, receipt.managed, new Set(), opts);
-  fs.rmSync(manifestPath, { force: true });
-  fs.rmSync(path.join(skillDir, '.aiwg-managed'), { force: true });
+  for (const target of [manifestPath, path.join(skillDir, '.aiwg-managed')]) {
+    // Metadata is released even when operator files keep the directory alive.
+    try {
+      fs.lstatSync(target);
+      opts.plan?.push({ path: path.resolve(target), action: 'remove', reason: 'ownership metadata released' });
+    } catch { /* Missing metadata has nothing to remove. */ }
+    if (!opts.dryRun) fs.rmSync(target, { force: true });
+  }
+  if (opts.dryRun) return false;
   try { fs.rmdirSync(skillDir); return true; } catch { return false; }
 }

package/dist/src/rules/activation.d.mts

@@ -1,4 +1,4 @@
-export type RuleActivation = 'kernel' | 'summary' | 'bound' | 'paths' | 'on-demand';
+export type RuleActivation = 'core' | 'kernel' | 'summary' | 'bound' | 'paths' | 'on-demand';
 export type RuleBindingKey = 'skills' | 'agents' | 'flows';
 export interface RuleBindings { skills: string[]; agents: string[]; flows: string[] }
 export interface RuleFrontmatter extends Record<string, unknown> {
@@ -16,6 +16,15 @@ export type RuleValidationResult =
 export const RULE_ACTIVATIONS: readonly RuleActivation[];
 export const RULE_BINDING_TYPES: Readonly<{ skills: 'skill'; agents: 'agent'; flows: 'flow' }>;
 export const ruleFrontmatterSchema: Record<string, unknown>;
-export function inferRuleActivation(enforcement: unknown): 'kernel' | 'on-demand';
+export function inferRuleActivation(enforcement?: unknown): 'on-demand';
 export function validateRuleFrontmatter(data: unknown): RuleValidationResult;
 export function parseRuleFrontmatter(content: string): RuleValidationResult & { data: unknown; body: string };
+export const CORE_BODY_MAX_BYTES: number;
+export const CORE_TOTAL_MAX_BYTES: number;
+export const CORE_RULES_START: string;
+export const CORE_RULES_END: string;
+export function coreBodyPath(ruleFile: string): string;
+export function validateCoreBody(text: string, label?: string): string[];
+export function validateCoreSet(bodies: Array<{ name: string; text: string }>): string[];
+export function readCoreBody(ruleFile: string): string;
+export function measureDeployedCoreRules(target: string, provider: string, rulesDir?: string): { bodies: Array<{ name: string; bytes: number }>; bytes: number; limit: number };