@aiwg/cli 2026.9.16 → 2026.9.18

package/agentic/code/providers/capability-matrix.yaml

@@ -401,6 +401,44 @@ providers:
     deploy_target: mixed
     aggregated_output: false
 
+  grok-build:
+    display_name: Grok Build
+    status: experimental
+    # xAI Grok Build CLI/TUI. Distinct from Grok Bot (`grokbot`).
+    # Wave 1 (#2575): native kernel skills + AGENTS.md. Agents/rules writers deferred #2577.
+    daemon_tier: unsupported
+    daemon_pty_adapter: false
+    artifact_paths:
+      agents: "Indexed: aiwg discover / aiwg show agent (native .grok/agents writer deferred #2577)"
+      commands: null
+      skills: .grok/skills/
+      skills_cross_agent: .grok/.aiwg/skills/  # --copy-all opt-in mirror
+      rules: "Indexed: aiwg show rule + AGENTS.md / host .grok/rules (AIWG writer deferred #2577)"
+      behaviors: null
+    native_features:
+      cron: false
+      agent_teams: false
+      tasks: false
+      mcp: true
+      behaviors: false
+      mission_control: false
+      daemon: false
+    emulation:
+      cron: null
+      agent_teams: null
+      tasks: aiwg-mc
+      mcp: null
+      behaviors: aiwg-mc
+      mission_control: aiwg-mc
+      daemon: null
+    hook_wiring:
+      at_link_support: false
+      hook_file: null
+      fallback: full-inject
+      context_file: AGENTS.md
+    deploy_target: mixed
+    aggregated_output: false
+
   hermes:
     display_name: Hermes
     status: stable

package/dist/src/cli/scope-resolver.js

@@ -14,6 +14,7 @@ import { homedir } from 'node:os';
 import * as path from 'node:path';
 import { resolveHermesHome, resolveHermesHomePath } from '../providers/hermes-home.js';
 import { resolveGrokbotSkillsDir } from '../providers/grokbot-paths.js';
+import { resolveGrokHome } from '../providers/grok-build-paths.js';
 export const hermesHome = resolveHermesHome;
 function piAgentDir() {
     const configured = process.env.PI_CODING_AGENT_DIR;
@@ -229,6 +230,18 @@ export const USER_SCOPE_PATHS = {
             behaviors: '',
         };
     },
+    get 'grok-build'() {
+        // Skills mirror to $GROK_HOME/skills. Agents/rules writers deferred #2577 —
+        // leave those user paths empty so mirroring does not invent empty trees.
+        const home = resolveGrokHome();
+        return {
+            agents: '',
+            skills: home ? path.join(home, 'skills') : '',
+            commands: '',
+            rules: '',
+            behaviors: '',
+        };
+    },
     factory: {
         // #1164 — Verified against Factory docs (docs.factory.ai/cli/configuration/skills).
         // Skills primary user-scope path is ~/.factory/skills/, NOT the

package/dist/src/cli/services/deployment-verification.js

@@ -7,6 +7,8 @@ import { inspectInstallation } from '../../installation/manager.mjs';
 import { getPackageRoot } from '../../channel/manager.mjs';
 import { getProviderDefinition, normalizeProviderDefinitionId, resolveProviderPathValue, } from '../../providers/provider-definitions.js';
 import { resolveGrokbotSkillsDir } from '../../providers/grokbot-paths.js';
+import { resolveGrokHome } from '../../providers/grok-build-paths.js';
+import { runGrokInspect } from '../../providers/grok-build-inspect.js';
 import { diagnoseIntegratedProviderTransformationReceipt } from '../../providers/transformation-receipt-integration.js';
 import { diagnoseWorkspaceContext, providerContextContract, } from '../../smiths/context-pipeline/workspace-context.js';
 import { USER_SCOPE_PATHS } from '../scope-resolver.js';
@@ -37,6 +39,11 @@ const RESTART_NOTICES = {
         action: 'Start a new Grok Bot agent chat (or re-read skills) so deployed AIWG context and skills are visible.',
         reason: 'Grok Bot skill/context reload behavior is not yet verified; AIWG does not claim live refresh.',
     },
+    'grok-build': {
+        policy: 'restart-required',
+        action: 'Restart the Grok Build session so it reloads .grok skills and AGENTS.md.',
+        reason: 'Grok Build reload semantics are not yet verified for live refresh; treat deploys as restart-required.',
+    },
     factory: {
         policy: 'restart-required',
         action: 'Restart the Factory droid runtime so it reloads deployed droids.',
@@ -435,6 +442,56 @@ export async function verifyProviderDeployment(options) {
                 findings.push(finding(normalized, 'provider-artifacts-missing', 'blocking', `No deployed provider or kernel artifacts were found for ${normalized}.`, `Re-run aiwg use ${options.requestedBundles[0] ?? 'all'} --provider ${normalized}.`, { kernelPath, kernelCount, counts }));
             }
         }
+        if (normalized === 'grok-build') {
+            const expectedSkillNames = [];
+            // Prefer validating against kernel skills actually present under .grok/skills.
+            try {
+                const { readdirSync, existsSync: existsSyncFs } = await import('node:fs');
+                const skillsDir = path.resolve(options.projectRoot, '.grok', 'skills');
+                if (existsSyncFs(skillsDir)) {
+                    for (const entry of readdirSync(skillsDir, { withFileTypes: true })) {
+                        if (entry.isDirectory() && existsSyncFs(path.resolve(skillsDir, entry.name, 'SKILL.md'))) {
+                            expectedSkillNames.push(entry.name);
+                        }
+                    }
+                }
+            }
+            catch {
+                // best-effort expected set
+            }
+            const inspect = runGrokInspect({
+                cwd: options.projectRoot,
+                expected: {
+                    instructionPaths: ['AGENTS.md'],
+                    skillNames: expectedSkillNames.slice(0, 32),
+                },
+            });
+            if (inspect.status === 'absent') {
+                findings.push(finding(normalized, 'grok-inspect-absent', 'advisory', 'Grok Build CLI (`grok`) is not on PATH; skipped `grok inspect`.', inspect.remediation, { grokHome: resolveGrokHome(), cwd: options.projectRoot }));
+            }
+            else if (inspect.status === 'failed') {
+                const mismatchSummary = (inspect.mismatches ?? [])
+                    .slice(0, 8)
+                    .map((item) => `${item.kind}:${item.expected}`)
+                    .join('; ');
+                findings.push(finding(normalized, 'grok-inspect-failed', 'advisory', mismatchSummary
+                    ? `\`grok inspect\` did not confirm expected AIWG artifacts (${mismatchSummary}).`
+                    : `\`grok inspect\` exited ${inspect.exitCode ?? 'unknown'}.`, 'Fix the Grok Build installation or redeploy, then re-run aiwg status --probe or aiwg use for grok-build.', {
+                    exitCode: inspect.exitCode,
+                    stderr: inspect.stderr.slice(0, 500),
+                    cwd: inspect.cwd,
+                    mismatches: inspect.mismatches?.slice(0, 12),
+                }));
+            }
+            else {
+                findings.push(finding(normalized, 'grok-inspect-ok', 'info', '`grok inspect` confirmed expected AIWG artifacts in the deployment target.', 'No action required; restart the Grok Build session if newly deployed skills are not visible.', {
+                    binary: inspect.binary,
+                    cwd: inspect.cwd,
+                    parsedKeys: Object.keys(inspect.parsed).slice(0, 20),
+                    checkedSkills: expectedSkillNames.slice(0, 32),
+                }));
+            }
+        }
     }
     findings.push(...await collectRegistryFindings(options, normalized, counts));
     findings.push(...await collectProviderReceiptFindings(options, normalized));

package/dist/src/config/aiwg-config.js

@@ -173,6 +173,7 @@ export function resolveDelivery(delivery) {
  *   - hermes: MCP sidecar; rate-limit depends on upstream provider, operator
  *     should tune. Conservative 10 default.
  *   - grokbot: desktop multi-agent; conservative 4 until native evidence.
+*   - grok-build: experimental; conservative 4 until Wave 2/3 evidence.
  *   - unknown: conservative 4 default.
  */
 export const PROVIDER_PARALLELISM_DEFAULTS = {
@@ -189,6 +190,7 @@ export const PROVIDER_PARALLELISM_DEFAULTS = {
     hermes: { max_parallel_subagents: 10, max_parallel_ralph_loops: 3, max_parallel_mc_missions: 6 },
     // Desktop multi-agent; conservative until native concurrency evidence exists.
     grokbot: { max_parallel_subagents: 4, max_parallel_ralph_loops: 2, max_parallel_mc_missions: 4 },
+    'grok-build': { max_parallel_subagents: 4, max_parallel_ralph_loops: 2, max_parallel_mc_missions: 4 },
     // Conservative defaults for remaining stable/experimental harnesses (#249).
     openhuman: { max_parallel_subagents: 4, max_parallel_ralph_loops: 2, max_parallel_mc_missions: 4 },
     omp: { max_parallel_subagents: 4, max_parallel_ralph_loops: 2, max_parallel_mc_missions: 4 },

package/dist/src/dataset/adapters.d.ts

@@ -45,7 +45,7 @@ declare abstract class LineAdapter<T extends FileConfig> extends LocalAdapter<T>
     protected lineDiscovery(kind: string, config: T, request: AdapterRequest<T>, schema: Record<string, unknown>): Promise<AdapterDiscovery>;
     protected lines(config: T, request: AdapterRequest<T> & {
         checkpoint?: AdapterCheckpoint;
-    }, parse: (line: string, ordinal: number) => unknown): AsyncIterable<AdapterRecord>;
+    }, parse: (line: string, ordinal: number, maxDepth: number) => unknown): AsyncIterable<AdapterRecord>;
 }
 export declare class JsonlAdapter extends LineAdapter<FileConfig> {
     #private;

package/dist/src/dataset/adapters.js

@@ -108,6 +108,21 @@ function record(value, ordinal, sourceLocator) {
     const serialized = typeof value === 'string' ? value : JSON.stringify(value);
     return { logicalId: `sha256:${sha256Digest(`${sourceLocator}\0${ordinal}\0${serialized}`).value}`, ordinal, value, sourceLocator, contentDigest: sha256Digest(serialized) };
 }
+function valueDepth(value) {
+    let maximum = 0;
+    const pending = [{ value, depth: 0 }];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (current.value === null || typeof current.value !== 'object')
+            continue;
+        const depth = current.depth + 1;
+        maximum = Math.max(maximum, depth);
+        const children = Array.isArray(current.value) ? current.value : Object.values(current.value);
+        for (const child of children)
+            pending.push({ value: child, depth });
+    }
+    return maximum;
+}
 function checkpoint(manifestValue, sourceIdentity, cursor) {
     return {
         contractVersion: DATASET_ADAPTER_CONTRACT_VERSION, kind: 'AdapterCheckpoint', adapter: { id: manifestValue.id, version: manifestValue.version },
@@ -227,7 +242,7 @@ class LineAdapter extends LocalAdapter {
                 if (Buffer.byteLength(line) > limits.maxRecordBytes || ordinal >= limits.maxRecords)
                     throw new AdapterFailure(diagnostic(operation, 'ADAPTER_RESOURCE_LIMIT', 'The record or record count exceeds configured limits.'));
                 if (line.trim() !== '')
-                    yield record(parse(line, ordinal), ordinal, config.path);
+                    yield record(parse(line, ordinal, limits.maxDepth), ordinal, config.path);
                 ordinal += 1;
             }
         }
@@ -243,12 +258,19 @@ export class JsonlAdapter extends LineAdapter {
     valid(value) { return isFileConfig(value); }
     discoverPath(config, request) { return this.lineDiscovery('jsonl', config, request, {}); }
     records(config, request) {
-        return this.lines(config, request, (line, ordinal) => { try {
-            return JSON.parse(line);
-        }
-        catch {
-            throw new AdapterFailure(diagnostic(request.checkpoint ? 'read' : 'preview', 'ADAPTER_SCHEMA_DRIFT', `Malformed JSONL record at ordinal ${ordinal}.`));
-        } });
+        return this.lines(config, request, (line, ordinal, maxDepth) => {
+            try {
+                const value = JSON.parse(line);
+                if (valueDepth(value) > maxDepth)
+                    throw new AdapterFailure(diagnostic(request.checkpoint ? 'read' : 'preview', 'ADAPTER_RESOURCE_LIMIT', `JSONL record at ordinal ${ordinal} exceeds the configured nesting limit.`));
+                return value;
+            }
+            catch (error) {
+                if (error instanceof AdapterFailure)
+                    throw error;
+                throw new AdapterFailure(diagnostic(request.checkpoint ? 'read' : 'preview', 'ADAPTER_SCHEMA_DRIFT', `Malformed JSONL record at ordinal ${ordinal}.`));
+            }
+        });
     }
 }
 function parseCsvLine(line) {

package/dist/src/dataset/conformance-types.d.ts

@@ -36,6 +36,7 @@ export interface DatasetConformanceManifest {
 export interface DatasetConformanceBinding {
     aiwgCommit: string;
     fortemiCommit?: string;
+    fortemiServerCommit?: string;
     packageDigests: Record<string, string>;
     schemaDigests: Record<string, string>;
     fixtureDigest: string;
@@ -75,7 +76,7 @@ export interface DatasetConformanceReceipt {
         stableEligible: boolean;
     };
 }
-export type DatasetConformanceDiagnosticCode = 'CONFORMANCE_MANIFEST_INVALID' | 'CONFORMANCE_CELL_DUPLICATE' | 'CONFORMANCE_REQUIRED_CELL_MISSING' | 'CONFORMANCE_FIXTURE_DIGEST_MISMATCH' | 'CONFORMANCE_RECEIPT_STALE' | 'CONFORMANCE_RECEIPT_UNVERIFIABLE' | 'CONFORMANCE_EVIDENCE_WEAKENED' | 'CONFORMANCE_MOCK_ONLY_STABLE' | 'CONFORMANCE_RESOURCE_ENVELOPE_MISSING' | 'CONFORMANCE_PENDING_STABLE_CELL' | 'CONFORMANCE_RESULT_FAILED' | 'CONFORMANCE_RESULT_DIGEST_MISMATCH' | 'CONFORMANCE_SENSITIVE_VALUE';
+export type DatasetConformanceDiagnosticCode = 'CONFORMANCE_MANIFEST_INVALID' | 'CONFORMANCE_CELL_DUPLICATE' | 'CONFORMANCE_REQUIRED_CELL_MISSING' | 'CONFORMANCE_RESULT_DUPLICATE' | 'CONFORMANCE_RESULT_UNEXPECTED' | 'CONFORMANCE_FIXTURE_DIGEST_MISMATCH' | 'CONFORMANCE_RECEIPT_STALE' | 'CONFORMANCE_RECEIPT_UNVERIFIABLE' | 'CONFORMANCE_EVIDENCE_WEAKENED' | 'CONFORMANCE_MOCK_ONLY_STABLE' | 'CONFORMANCE_RESOURCE_ENVELOPE_MISSING' | 'CONFORMANCE_PENDING_STABLE_CELL' | 'CONFORMANCE_RESULT_FAILED' | 'CONFORMANCE_RESULT_DIGEST_MISMATCH' | 'CONFORMANCE_SENSITIVE_VALUE';
 export interface DatasetConformanceDiagnostic {
     code: DatasetConformanceDiagnosticCode;
     path: string;

package/dist/src/dataset/conformance.js

@@ -68,7 +68,16 @@ export function verifyConformanceReceipt(manifest, receipt) {
         diagnostics.push({ code: 'CONFORMANCE_RECEIPT_UNVERIFIABLE', path: '/bindings/aiwgCommit', message: 'AIWG commit binding is invalid.' });
     if (Object.keys(receipt.bindings.packageDigests).length === 0 || Object.keys(receipt.bindings.schemaDigests).length === 0)
         diagnostics.push({ code: 'CONFORMANCE_RECEIPT_UNVERIFIABLE', path: '/bindings', message: 'Package and schema digest bindings are required.' });
-    const resultById = new Map(receipt.results.map(result => [result.cellId, result]));
+    const expectedIds = new Set(manifest.cells.map(cell => cell.id));
+    const resultById = new Map();
+    receipt.results.forEach((result, index) => {
+        if (resultById.has(result.cellId))
+            diagnostics.push({ code: 'CONFORMANCE_RESULT_DUPLICATE', path: `/results/${index}/cellId`, message: `Cell ${result.cellId} occurs more than once.` });
+        else
+            resultById.set(result.cellId, result);
+        if (!expectedIds.has(result.cellId))
+            diagnostics.push({ code: 'CONFORMANCE_RESULT_UNEXPECTED', path: `/results/${index}/cellId`, message: `Cell ${result.cellId} is not declared by the manifest.` });
+    });
     manifest.cells.forEach(cell => {
         const result = resultById.get(cell.id);
         if (!result)

package/dist/src/dataset/fortemi-live-qualification.d.ts

@@ -40,6 +40,16 @@ export interface FortemiDatasetLiveReceipt {
     startedAt: string;
     endedAt: string;
 }
+/**
+ * Verify the independently captured, mutating Fortemi dataset qualification.
+ * The caller supplies the separately persisted run receipt so a wrapper cannot
+ * claim a successful execution without the receipt's canonical digest checks.
+ */
+export declare function verifyFortemiDatasetExecutionQualification(input: {
+    qualification: unknown;
+    runReceipt: unknown;
+    expectedFortemiCommit: string;
+}): string[];
 /** Read-only discovery. It never invokes a Fortemi tool, even when the proposed contract is present. */
 export declare function qualifyFortemiDatasetLivePreflight(input: {
     client: McpClientLike;

package/dist/src/dataset/fortemi-live-qualification.js

@@ -3,6 +3,7 @@ import { link, mkdir, unlink, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { FORTEMI_DATASET_EXECUTION_TOOL } from "./fortemi-dataset-execution.js";
 import { endpointFingerprint, fortemiReceiptDigest, } from "../storage/fortemi-qualification-receipt.js";
+import { verifyFortemiDatasetRunReceipt } from "./fortemi-run-receipt.js";
 export const FORTEMI_DATASET_LIVE_CONTRACT = "aiwg.fortemi-dataset-live-qualification/v2";
 const LEGACY_LIVE_CONTRACT = "aiwg.fortemi-dataset-live-qualification/v1";
 export const FORTEMI_DATASET_CAPABILITIES_TOOL = "dataset_capabilities";
@@ -19,6 +20,18 @@ const REQUIRED_TOOLS = [FORTEMI_DATASET_EXECUTION_TOOL];
 const REQUIRED_ACTIONS = ["capabilities", "preview", "execute", "status", "checkpoint", "cancel", "resume", "retry", "verify", "archive"];
 const MAX_TOOL_COUNT = 256;
 const MAX_SCHEMA_BYTES = 1_048_576;
+const SENSITIVE = /(?:(?:password|passwd|api[-_]?key|authorization)\s*[:=]\s*[^\s"}]+|bearer\s+[a-z0-9._~+/-]+|-----BEGIN [A-Z ]+PRIVATE KEY-----)/iu;
+const EXECUTION_QUALIFICATION_CONTRACT = "fortemi.lane-b.dataset-live-qualification.v1";
+const EXECUTION_CHECKS = [
+    "published API identity and clean migrated destination",
+    "MCP initialize and capability discovery agree",
+    "schema-bound preview has no side effects",
+    "execute commits one synthetic record with valid redacted receipt",
+    "status, checkpoint, resume, and exact in-process replay are stable",
+    "fresh MCP process reconstructs byte-equivalent durable replay receipt",
+    "namespace-scoped archive cleanup is complete and idempotent",
+];
+const EXECUTION_BOUNDARY = "Synthetic single-record Community dataset execution against a private ephemeral PostgreSQL destination. No shared Fortemi, vLLM, Ollama, GPU, personal container, or persistent data is used.";
 function record(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value)
         ? value
@@ -28,6 +41,127 @@ function exactKeys(value, allowed) {
     const keys = Object.keys(value);
     return (keys.length === allowed.length && keys.every((key) => allowed.includes(key)));
 }
+/**
+ * Verify the independently captured, mutating Fortemi dataset qualification.
+ * The caller supplies the separately persisted run receipt so a wrapper cannot
+ * claim a successful execution without the receipt's canonical digest checks.
+ */
+export function verifyFortemiDatasetExecutionQualification(input) {
+    const errors = [];
+    const qualification = record(input.qualification);
+    const runReceipt = record(input.runReceipt);
+    if (!COMMIT.test(input.expectedFortemiCommit))
+        return ["CONFORMANCE_INVALID_FORTEMI_COMMIT"];
+    if (!qualification || !runReceipt)
+        return ["CONFORMANCE_FORTEMI_EXECUTION_EVIDENCE_INVALID"];
+    if (!exactKeys(qualification, [
+        "schemaVersion", "status", "boundedUnit", "source", "release",
+        "executableSha256", "checks", "mcpSessions", "boundary", "apiPid",
+        "health", "migrations", "descriptorSha256", "run", "finalDatabase",
+        "apiExit", "apiPidAbsent", "apiOutputBytes", "apiOutputSha256",
+        "scratchRemoved",
+    ]))
+        errors.push("CONFORMANCE_FORTEMI_EXECUTION_EVIDENCE_SHAPE_INVALID");
+    const source = qualification.source;
+    const release = qualification.release;
+    const checks = qualification.checks;
+    const sessions = qualification.mcpSessions;
+    const health = record(qualification.health);
+    const run = record(qualification.run);
+    const archive = record(run?.archive);
+    const finalDatabase = record(qualification.finalDatabase);
+    const apiExit = record(qualification.apiExit);
+    const receiptBindings = record(runReceipt.bindings);
+    const receiptCounts = record(runReceipt.counts);
+    const receiptEnvelope = record(runReceipt.resourceEnvelope);
+    const receiptRedaction = record(runReceipt.redaction);
+    if (SENSITIVE.test(JSON.stringify(qualification)) || SENSITIVE.test(JSON.stringify(runReceipt)))
+        errors.push("CONFORMANCE_FORTEMI_EXECUTION_SENSITIVE_VALUE");
+    if (qualification.schemaVersion !== EXECUTION_QUALIFICATION_CONTRACT ||
+        qualification.status !== "PASS" ||
+        source !== input.expectedFortemiCommit ||
+        typeof release !== "string" ||
+        !/^v\d{4}\.\d+\.\d+$/u.test(release) ||
+        typeof qualification.boundedUnit !== "string" ||
+        !/^fortemi-local-test-1000-[0-9a-f-]+\.service$/u.test(qualification.boundedUnit) ||
+        typeof qualification.apiPid !== "number" ||
+        !Number.isInteger(qualification.apiPid) || qualification.apiPid < 1 ||
+        qualification.boundary !== EXECUTION_BOUNDARY ||
+        typeof qualification.executableSha256 !== "string" ||
+        !/^[0-9a-f]{64}$/u.test(qualification.executableSha256) ||
+        typeof qualification.descriptorSha256 !== "string" ||
+        !/^[0-9a-f]{64}$/u.test(qualification.descriptorSha256) ||
+        typeof qualification.apiOutputSha256 !== "string" ||
+        !/^[0-9a-f]{64}$/u.test(qualification.apiOutputSha256))
+        errors.push("CONFORMANCE_FORTEMI_EXECUTION_BINDING_INVALID");
+    if (!Array.isArray(checks) ||
+        checks.length !== EXECUTION_CHECKS.length ||
+        !EXECUTION_CHECKS.every((check, index) => checks[index] === check))
+        errors.push("CONFORMANCE_FORTEMI_EXECUTION_CHECKS_INCOMPLETE");
+    if (!Array.isArray(sessions) ||
+        sessions.length !== 2 ||
+        !sessions.every((value, index) => {
+            const session = record(value);
+            return session &&
+                exactKeys(session, ["label", "pid", "stderrBytes", "closed"]) &&
+                session.label === (index === 0 ? "initial" : "restart") &&
+                typeof session.pid === "number" && Number.isInteger(session.pid) && session.pid > 0 &&
+                typeof session.stderrBytes === "number" && Number.isInteger(session.stderrBytes) && session.stderrBytes >= 0 &&
+                session.stderrBytes <= 65_536 && session.closed === true;
+        }))
+        errors.push("CONFORMANCE_FORTEMI_EXECUTION_SESSION_INVALID");
+    if (!health || health.status !== "healthy" || health.git_sha !== source ||
+        health.version !== String(release).slice(1) ||
+        record(health.lifecycle)?.ready !== true ||
+        typeof qualification.migrations !== "number" ||
+        !Number.isInteger(qualification.migrations) || qualification.migrations < 1)
+        errors.push("CONFORMANCE_FORTEMI_EXECUTION_RUNTIME_INVALID");
+    const receiptErrors = verifyFortemiDatasetRunReceipt(runReceipt);
+    if (receiptErrors.length)
+        errors.push("CONFORMANCE_FORTEMI_RUN_RECEIPT_INVALID", ...receiptErrors);
+    if (!run || !archive ||
+        !exactKeys(run, [
+            "runId", "namespaceId", "requestDigest", "receiptDigest", "state",
+            "verification", "checkpointSequence", "archive", "contentSha256",
+            "sourceContentRetained",
+        ]) ||
+        !exactKeys(archive, [
+            "namespaceId", "archived", "alreadyArchived", "unresolved", "complete",
+            "reasonCodes",
+        ]) ||
+        run.runId !== runReceipt.runId ||
+        run.namespaceId !== runReceipt.namespaceId ||
+        run.requestDigest !== runReceipt.requestDigest ||
+        run.receiptDigest !== runReceipt.receiptDigest ||
+        run.state !== runReceipt.state ||
+        run.verification !== "verified" ||
+        runReceipt.verification !== "verified" ||
+        run.checkpointSequence !== 1 ||
+        run.sourceContentRetained !== false ||
+        archive.namespaceId !== run.namespaceId || archive.complete !== true ||
+        archive.archived !== 1 || archive.alreadyArchived !== 0 ||
+        !Array.isArray(archive.unresolved) || archive.unresolved.length !== 0 ||
+        !Array.isArray(archive.reasonCodes) || archive.reasonCodes.length !== 0 ||
+        receiptBindings?.sourceRevision !== source ||
+        receiptCounts?.attempted !== 1 || receiptCounts?.committed !== 1 ||
+        receiptCounts?.rejected !== 0 || receiptEnvelope?.maxRecords !== 1 ||
+        receiptEnvelope?.allowOutboundNetwork !== false ||
+        receiptRedaction?.sourceContentIncluded !== false ||
+        receiptRedaction?.logicalIdentifiersIncluded !== false ||
+        receiptRedaction?.connectionDetailsIncluded !== false)
+        errors.push("CONFORMANCE_FORTEMI_EXECUTION_RECEIPT_MISMATCH");
+    if (!finalDatabase || finalDatabase.visibleNotes !== 0 ||
+        !exactKeys(finalDatabase, ["visibleNotes", "archivedNotes"]) ||
+        finalDatabase.archivedNotes !== 1 || !apiExit || apiExit.code !== 0 ||
+        !exactKeys(apiExit, ["code", "signal"]) ||
+        apiExit.signal !== null || qualification.apiPidAbsent !== true ||
+        qualification.scratchRemoved !== true ||
+        typeof qualification.apiOutputBytes !== "number" ||
+        !Number.isInteger(qualification.apiOutputBytes) ||
+        qualification.apiOutputBytes < 0 || qualification.apiOutputBytes > 262_144)
+        errors.push("CONFORMANCE_FORTEMI_EXECUTION_CLEANUP_INVALID");
+    return [...new Set(errors)];
+}
 function material(receipt) {
     const { receiptDigest: _digest, ...rest } = receipt;
     return rest;

package/dist/src/providers/capability-matrix.yaml

@@ -401,6 +401,44 @@ providers:
     deploy_target: mixed
     aggregated_output: false
 
+  grok-build:
+    display_name: Grok Build
+    status: experimental
+    # xAI Grok Build CLI/TUI. Distinct from Grok Bot (`grokbot`).
+    # Wave 1 (#2575): native kernel skills + AGENTS.md. Agents/rules writers deferred #2577.
+    daemon_tier: unsupported
+    daemon_pty_adapter: false
+    artifact_paths:
+      agents: "Indexed: aiwg discover / aiwg show agent (native .grok/agents writer deferred #2577)"
+      commands: null
+      skills: .grok/skills/
+      skills_cross_agent: .grok/.aiwg/skills/  # --copy-all opt-in mirror
+      rules: "Indexed: aiwg show rule + AGENTS.md / host .grok/rules (AIWG writer deferred #2577)"
+      behaviors: null
+    native_features:
+      cron: false
+      agent_teams: false
+      tasks: false
+      mcp: true
+      behaviors: false
+      mission_control: false
+      daemon: false
+    emulation:
+      cron: null
+      agent_teams: null
+      tasks: aiwg-mc
+      mcp: null
+      behaviors: aiwg-mc
+      mission_control: aiwg-mc
+      daemon: null
+    hook_wiring:
+      at_link_support: false
+      hook_file: null
+      fallback: full-inject
+      context_file: AGENTS.md
+    deploy_target: mixed
+    aggregated_output: false
+
   hermes:
     display_name: Hermes
     status: stable

package/dist/src/providers/grok-build-inspect.js

@@ -0,0 +1,245 @@
+/**
+ * Grok Build verification via `grok inspect` when the binary is available.
+ * Presence-only remediation when absent — never invents inspect output.
+ *
+ * @issue #2575
+ */
+import { accessSync, constants as fsConstants } from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+export function grokExecutableCandidates(env, cwd, platform = process.platform) {
+    const pathApi = platform === 'win32' ? path.win32 : path.posix;
+    const pathDelimiter = platform === 'win32' ? ';' : ':';
+    const pathDirs = (env.PATH ?? env.Path ?? process.env.PATH ?? '')
+        .split(pathDelimiter)
+        // An empty PATH segment means the child cwd on POSIX and Windows.
+        .map((entry) => entry || '.');
+    const suffixes = platform === 'win32'
+        ? [...(env.PATHEXT || env.Pathext || '.COM;.EXE;.BAT;.CMD')
+                .split(';')
+                .map((entry) => entry.trim())
+                .filter(Boolean), '']
+        : [''];
+    const candidates = new Set();
+    for (const dir of pathDirs) {
+        const absoluteDir = pathApi.isAbsolute(dir) ? dir : pathApi.resolve(cwd, dir);
+        for (const suffix of suffixes)
+            candidates.add(pathApi.join(absoluteDir, `grok${suffix}`));
+    }
+    return [...candidates];
+}
+function whichGrok(env, cwd) {
+    // Resolve from the supplied environment and deployment cwd without a shell.
+    for (const candidate of grokExecutableCandidates(env, cwd)) {
+        try {
+            accessSync(candidate, process.platform === 'win32' ? fsConstants.F_OK : fsConstants.X_OK);
+            return candidate;
+        }
+        catch {
+            // try next
+        }
+    }
+    return null;
+}
+function tryParseJson(text) {
+    const trimmed = text.trim();
+    if (!trimmed)
+        return null;
+    try {
+        const value = JSON.parse(trimmed);
+        return value && typeof value === 'object' && !Array.isArray(value)
+            ? value
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function asRecordArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((entry) => Boolean(entry) && typeof entry === 'object' && !Array.isArray(entry));
+}
+function pathMentions(haystack, needle) {
+    const normalizedHay = haystack.replace(/\\/g, '/');
+    const normalizedNeedle = needle.replace(/\\/g, '/');
+    return normalizedHay.includes(normalizedNeedle);
+}
+/**
+ * Validate a `grok inspect --json` report against artifacts AIWG intended to deploy.
+ * Shape follows xAI InspectReport (camelCase): projectInstructions, skills, agents, configSources.
+ */
+export function validateGrokInspectReport(parsed, expected = {}) {
+    const mismatches = [];
+    const instructions = asRecordArray(parsed.projectInstructions);
+    const skills = asRecordArray(parsed.skills);
+    const agents = asRecordArray(parsed.agents);
+    const configSources = parsed.configSources;
+    const layers = configSources && typeof configSources === 'object' && !Array.isArray(configSources)
+        ? asRecordArray(configSources.layers)
+        : [];
+    const hasReportShape = Array.isArray(parsed.projectInstructions)
+        || Array.isArray(parsed.skills)
+        || Array.isArray(parsed.agents)
+        || Boolean(configSources);
+    if (!hasReportShape) {
+        mismatches.push({
+            kind: 'shape',
+            expected: 'InspectReport fields (projectInstructions/skills/agents/configSources)',
+            detail: `parsed keys: ${Object.keys(parsed).slice(0, 20).join(',') || '(none)'}`,
+        });
+        return mismatches;
+    }
+    for (const instructionPath of expected.instructionPaths ?? []) {
+        const found = instructions.some((entry) => typeof entry.path === 'string' && pathMentions(entry.path, instructionPath));
+        if (!found) {
+            mismatches.push({
+                kind: 'instructions',
+                expected: instructionPath,
+                detail: `not listed in projectInstructions (${instructions.length} entries)`,
+            });
+        }
+    }
+    for (const skillName of expected.skillNames ?? []) {
+        const found = skills.some((entry) => (typeof entry.name === 'string' && entry.name === skillName)
+            || (typeof entry.source === 'object' && entry.source !== null
+                && typeof entry.source.path === 'string'
+                && pathMentions(String(entry.source.path), skillName)));
+        if (!found) {
+            mismatches.push({
+                kind: 'skills',
+                expected: skillName,
+                detail: `not listed in skills (${skills.length} entries)`,
+            });
+        }
+    }
+    for (const agentName of expected.agentNames ?? []) {
+        const found = agents.some((entry) => typeof entry.name === 'string' && entry.name === agentName);
+        if (!found) {
+            mismatches.push({
+                kind: 'agents',
+                expected: agentName,
+                detail: `not listed in agents (${agents.length} entries)`,
+            });
+        }
+    }
+    for (const substring of expected.configPathSubstrings ?? []) {
+        const found = layers.some((entry) => typeof entry.path === 'string' && pathMentions(entry.path, substring));
+        if (!found) {
+            mismatches.push({
+                kind: 'config',
+                expected: substring,
+                detail: `not listed in configSources.layers (${layers.length} entries)`,
+            });
+        }
+    }
+    return mismatches;
+}
+const ABSENT_REMEDIATION = 'Install the Grok Build CLI so `grok` is on PATH, then re-run verification. '
+    + 'Until then AIWG only confirms provider registration and on-disk .grok paths — it does not invent inspect output.';
+function isRunOptions(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const keys = Object.keys(value);
+    if (keys.length === 0)
+        return false;
+    return keys.every((key) => key === 'env' || key === 'cwd' || key === 'expected');
+}
+/**
+ * Run `grok inspect` (prefer `--json` when the CLI accepts it).
+ * Accepts either a ProcessEnv (legacy) or an options bag with env/cwd/expected.
+ */
+export function runGrokInspect(envOrOptions = process.env) {
+    const options = isRunOptions(envOrOptions)
+        ? envOrOptions
+        : { env: envOrOptions };
+    const env = options.env ?? process.env;
+    const cwd = options.cwd ?? process.cwd();
+    const binary = whichGrok(env, cwd);
+    if (!binary) {
+        return { status: 'absent', remediation: ABSENT_REMEDIATION };
+    }
+    // Prefer machine-readable inspect; fall back to plain inspect if --json is rejected.
+    // Use length/index checks — tuple `includes()` narrows incorrectly under TS (TS2345).
+    const argSets = [
+        ['inspect', '--json'],
+        ['inspect'],
+    ];
+    for (let i = 0; i < argSets.length; i++) {
+        const args = argSets[i];
+        const wantsJson = args.length > 1 && args[1] === '--json';
+        const result = spawnSync(binary, [...args], {
+            encoding: 'utf8',
+            env,
+            cwd,
+            timeout: 15_000,
+            maxBuffer: 2_000_000,
+            // npm exposes Grok through a .cmd shim on Windows; Node requires a shell
+            // for .cmd/.bat launchers. Native .exe installs stay shell-free.
+            shell: process.platform === 'win32' && /\.(?:cmd|bat)$/i.test(binary),
+        });
+        if (result.error && result.error.code === 'ENOENT') {
+            return { status: 'absent', remediation: ABSENT_REMEDIATION };
+        }
+        const stdout = result.stdout || '';
+        const stderr = result.stderr || '';
+        if (result.status === 0) {
+            const parsed = tryParseJson(stdout);
+            if (!parsed) {
+                return {
+                    status: 'failed',
+                    binary,
+                    exitCode: 0,
+                    stderr,
+                    stdout,
+                    cwd,
+                    mismatches: [{
+                            kind: 'shape',
+                            expected: 'JSON InspectReport',
+                            detail: 'exit 0 but stdout was not a JSON object',
+                        }],
+                };
+            }
+            const mismatches = validateGrokInspectReport(parsed, options.expected);
+            if (mismatches.length > 0) {
+                return {
+                    status: 'failed',
+                    binary,
+                    exitCode: 0,
+                    stderr,
+                    stdout,
+                    cwd,
+                    mismatches,
+                };
+            }
+            return {
+                status: 'ok',
+                binary,
+                stdout,
+                parsed,
+                cwd,
+                mismatches: [],
+            };
+        }
+        if (wantsJson && /unknown|unrecognized|invalid/i.test(`${stderr}\n${stdout}`)) {
+            continue;
+        }
+        return {
+            status: 'failed',
+            binary,
+            exitCode: result.status,
+            stderr,
+            stdout,
+            cwd,
+        };
+    }
+    return {
+        status: 'failed',
+        binary,
+        exitCode: null,
+        stderr: 'grok inspect did not succeed',
+        stdout: '',
+        cwd,
+    };
+}
+//# sourceMappingURL=grok-build-inspect.js.map

package/dist/src/providers/grok-build-paths.js

@@ -0,0 +1,92 @@
+/**
+ * Grok Build home/path resolution — documented defaults with fail-closed overrides.
+ *
+ * Default `$GROK_HOME` is `~/.grok` (absolute after expand). Relative overrides,
+ * bare `~`, root-only paths, and null bytes are rejected.
+ *
+ * Distinct from Grok Bot (`grokbot` / `AIWG_GROKBOT_SKILLS_DIR`): never share
+ * roots or invent `~/.grokbot` / `.cursor` paths.
+ *
+ * @see https://docs.x.ai/build/settings
+ * @issue #2575
+ */
+import { homedir } from 'node:os';
+import * as path from 'node:path';
+export const GROK_HOME_ENV = 'GROK_HOME';
+export function isGrokFilesystemRoot(resolved, pathFlavor = path) {
+    return pathFlavor.parse(resolved).root === resolved;
+}
+function expandHomePrefix(raw, userHome = homedir()) {
+    if (raw === '~')
+        return raw;
+    if (raw.startsWith('~/'))
+        return path.join(userHome, raw.slice(2));
+    return raw;
+}
+/**
+ * Resolve Grok Build home directory.
+ * When unset, defaults to `~/.grok` (expanded). Explicit env must be absolute or `~/…`.
+ */
+export function resolveGrokHomeResult(env = process.env, userHome = homedir()) {
+    const raw = (env[GROK_HOME_ENV] || '').trim();
+    const fromEnv = Boolean(raw);
+    const candidate = fromEnv ? raw : path.join(userHome, '.grok');
+    const expanded = expandHomePrefix(candidate, userHome);
+    if (expanded === '~' || expanded.startsWith('~')) {
+        return {
+            ok: false,
+            reason: 'not-absolute',
+            message: `${GROK_HOME_ENV} must be an absolute path or ~/… (got '${raw || '(default)'}'). Bare '~' is rejected.`,
+        };
+    }
+    if (!path.isAbsolute(expanded)) {
+        return {
+            ok: false,
+            reason: 'not-absolute',
+            message: `${GROK_HOME_ENV} must be an absolute path (got '${raw}'). Relative overrides are rejected.`,
+        };
+    }
+    if (raw.includes('\0') || expanded.includes('\0')) {
+        return {
+            ok: false,
+            reason: 'traversal',
+            message: `${GROK_HOME_ENV} contains an invalid path character.`,
+        };
+    }
+    const resolved = path.resolve(expanded);
+    if (!resolved || isGrokFilesystemRoot(resolved)) {
+        return {
+            ok: false,
+            reason: 'root',
+            message: `${GROK_HOME_ENV} resolves to filesystem root; refuse to deploy there.`,
+        };
+    }
+    return { ok: true, path: resolved, source: fromEnv ? 'env' : 'default' };
+}
+export function resolveGrokHome(env = process.env, userHome = homedir()) {
+    const result = resolveGrokHomeResult(env, userHome);
+    return result.ok ? result.path : null;
+}
+export function grokBuildProjectPaths() {
+    return {
+        skills: '.grok/skills',
+        agents: '.grok/agents',
+        rules: '.grok/rules',
+        hooks: '.grok/hooks',
+        config: '.grok/config.toml',
+        agentsMd: 'AGENTS.md',
+    };
+}
+export function grokBuildUserPaths(grokHome) {
+    return {
+        skills: path.join(grokHome, 'skills'),
+        agents: path.join(grokHome, 'agents'),
+    };
+}
+export function grokHomeRemediation(env = process.env) {
+    const result = resolveGrokHomeResult(env);
+    if (result.ok)
+        return `${GROK_HOME_ENV}=${result.path} (${result.source})`;
+    return result.message;
+}
+//# sourceMappingURL=grok-build-paths.js.map

package/dist/src/providers/provider-definitions.js

@@ -21,6 +21,7 @@ const ProviderDefinitionSchema = z.object({
         'deepseek-harness',
         'factory',
         'grokbot',
+        'grok-build',
         'hermes',
         'opencode',
         'openclaw',
@@ -38,7 +39,7 @@ const ProviderDefinitionSchema = z.object({
     upstream: z.object({
         source: z.string().url(),
         version: z.string().min(1),
-        revision: z.string().regex(/^[0-9a-f]{40}$/),
+        revision: z.string().regex(/^[0-9a-f]{40}$/).refine((value) => value !== '0'.repeat(40), { message: 'upstream.revision must be a real reviewed SHA, not all-zero' }),
         runtime: z.string().min(1),
         lastVerified: z.string().regex(/^\d{4}-\d{2}-\d{2}$/),
     }).optional(),
@@ -143,6 +144,7 @@ export const PROVIDER_IDS = [
     'deepseek-harness',
     'factory',
     'grokbot',
+    'grok-build',
     'hermes',
     'opencode',
     'openclaw',
@@ -218,6 +220,24 @@ const CONTEXT_CONTRACTS = {
             lastVerified: '2026-09-15',
         },
     },
+    'grok-build': {
+        // config.toml is configuration (MCP/plugins/permissions), not a startup/context file.
+        // Hierarchical instructions: AGENTS.md + .grok/rules/*.md, root-to-cwd, deeper wins.
+        startupFiles: ['AGENTS.md', '.grok/rules/*.md'],
+        precedence: [
+            'provider/system',
+            'global ~/.grok instruction sources',
+            'root-to-cwd AGENTS.md and .grok/rules/*.md (deeper files win on conflicts)',
+            '$GROK_HOME for user skills and user config',
+        ],
+        loadMode: 'prose-directive', includeSyntax: null, configRegistration: null,
+        bootstrapTargets: ['AGENTS.md'], maxContextBytes: null, recommendedMaxLines: null, nestedContext: true, support: 'supported',
+        verification: {
+            method: 'xAI project-rules docs (AGENTS.md + .grok/rules hierarchical discovery); grok inspect when installed',
+            source: 'https://docs.x.ai/build/features/project-rules',
+            lastVerified: '2026-09-20',
+        },
+    },
     hermes: {
         startupFiles: ['.hermes.md', 'AGENTS.md'], precedence: ['provider/system', '.hermes.md', 'AGENTS.md'],
         loadMode: 'prose-directive', includeSyntax: null, configRegistration: null,
@@ -632,6 +652,72 @@ const BUILT_IN_SEEDS = [
         },
         matrixRef: 'grokbot',
     },
+    {
+        id: 'grok-build',
+        displayName: 'Grok Build',
+        aliases: [],
+        status: 'experimental',
+        builtIn: true,
+        upstream: {
+            source: 'https://github.com/xai-org/grok-build',
+            version: '1.0.38',
+            // Reviewed public tree (docs + inspect schema), not an all-zero placeholder.
+            revision: '4247f661689354b831191f11eeeac8424993fe3d',
+            runtime: 'Grok Build CLI',
+            lastVerified: '2026-09-20',
+        },
+        surfaces: {
+            primary: 'grok-build',
+            compatibility: [],
+            // Agents/rules native writers deferred #2577; host still discovers those dirs.
+            precedence: ['AGENTS.md', '.grok/skills/', '.grok/rules/ (host; AIWG writer deferred #2577)', '.grok/config.toml (config only)', '$GROK_HOME'],
+            related: [],
+        },
+        detection: { env: ['GROK_HOME'], process: ['grok'], capabilityId: 'grok-build' },
+        paths: {
+            deployTarget: 'mixed',
+            artifacts: {
+                // Wave 1 writes skills + AGENTS.md only; agents/rules indexed until #2577.
+                agents: null,
+                commands: null,
+                skills: '.grok/skills',
+                rules: null,
+                behaviors: null,
+            },
+            kernelSkills: '.grok/skills',
+            contextDiscovery: {
+                agents: '.grok/agents',
+                skills: '.grok/skills',
+                rules: '.grok/rules',
+                behaviors: null,
+            },
+            configFile: '.grok/config.toml',
+            contextFiles: { aiwgMd: true, agentsMd: true, claudeMdHook: false, hookFile: null, contextFile: 'AGENTS.md' },
+        },
+        smithPaths: {
+            agents: null,
+            commands: null,
+            skills: '.grok/skills',
+            rules: null,
+            fileExtension: '.md',
+            configFile: '.grok/config.toml',
+            aggregated: false,
+        },
+        skillNamespace: {
+            deploymentGroup: 'deep-recursion',
+            pathType: 'project',
+            skillsBaseDir: '.grok/skills',
+            subdirLayout: true,
+        },
+        adapters: {
+            agentFormat: 'agents-md',
+            hookBridge: null,
+            mcpInjection: null,
+            contextAggregation: 'agents-md',
+            ruleFormat: 'agents-md-section',
+        },
+        matrixRef: 'grok-build',
+    },
     {
         id: 'hermes',
         aliases: [],

package/dist/src/providers/provider-inventory.js

@@ -13,6 +13,7 @@ const PROVIDER_EXECUTABLES = {
     'deepseek-harness': ['dsh'],
     factory: ['droid'],
     // Grok Bot has no verified CLI executable name; omit rather than invent.
+    'grok-build': ['grok'],
     hermes: ['hermes'],
     opencode: ['opencode'],
     openclaw: ['openclaw'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.9.16",
+  "version": "2026.9.18",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",

package/schemas/dataset/conformance-receipt.v1.schema.json

@@ -15,7 +15,7 @@
   "$defs": {
     "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$" }, "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "time": { "type": "string", "format": "date-time", "pattern": "Z$" },
     "digestMap": { "type": "object", "minProperties": 1, "additionalProperties": { "$ref": "#/$defs/digest" } },
-    "bindings": { "type": "object", "additionalProperties": false, "required": ["aiwgCommit", "packageDigests", "schemaDigests", "fixtureDigest", "configurationDigest"], "properties": { "aiwgCommit": { "type": "string", "pattern": "^(?:[0-9a-f]{40}|sha256:[0-9a-f]{64})$" }, "fortemiCommit": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "packageDigests": { "$ref": "#/$defs/digestMap" }, "schemaDigests": { "$ref": "#/$defs/digestMap" }, "fixtureDigest": { "$ref": "#/$defs/digest" }, "descriptorDigest": { "$ref": "#/$defs/digest" }, "configurationDigest": { "$ref": "#/$defs/digest" } } },
+    "bindings": { "type": "object", "additionalProperties": false, "required": ["aiwgCommit", "packageDigests", "schemaDigests", "fixtureDigest", "configurationDigest"], "properties": { "aiwgCommit": { "type": "string", "pattern": "^(?:[0-9a-f]{40}|sha256:[0-9a-f]{64})$" }, "fortemiCommit": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "fortemiServerCommit": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "packageDigests": { "$ref": "#/$defs/digestMap" }, "schemaDigests": { "$ref": "#/$defs/digestMap" }, "fixtureDigest": { "$ref": "#/$defs/digest" }, "descriptorDigest": { "$ref": "#/$defs/digest" }, "configurationDigest": { "$ref": "#/$defs/digest" } } },
     "evidence": { "type": "object", "additionalProperties": false, "required": ["kind", "reference", "digest"], "properties": { "kind": { "enum": ["fixture", "real-source", "cross-repo", "live-qualification"] }, "reference": { "type": "string", "minLength": 1 }, "digest": { "$ref": "#/$defs/digest" } } },
     "result": { "type": "object", "additionalProperties": false, "required": ["cellId", "status", "evidence", "observed"], "properties": { "cellId": { "type": "string", "minLength": 1 }, "status": { "enum": ["passed", "failed", "pending"] }, "diagnostic": { "type": "string", "minLength": 1 }, "evidence": { "type": "array", "items": { "$ref": "#/$defs/evidence" } }, "observed": { "type": "object", "additionalProperties": false, "required": ["networkAttempts"], "properties": { "records": { "type": "integer", "minimum": 0 }, "bytes": { "type": "integer", "minimum": 0 }, "durationMs": { "type": "integer", "minimum": 0 }, "networkAttempts": { "type": "integer", "minimum": 0 } } } } }
   }

package/tools/agents/deploy-agents.mjs

@@ -20,7 +20,7 @@
  *   --rules-only             Deploy only rules (skip agents)
  *   --dry-run                Show what would be deployed without writing
  *   --force                  Overwrite existing files
- *   --provider <name>        Target provider: antigravity (agy), claude (default), openai, codex, cursor, opencode, copilot, factory, grokbot, pi, omp, deepseek-harness (dsh), warp, devin, hermes, openhuman, or openclaw
+ *   --provider <name>        Target provider: antigravity (agy), claude (default), openai, codex, cursor, opencode, copilot, factory, grokbot, grok-build, pi, omp, deepseek-harness (dsh), warp, devin, hermes, openhuman, or openclaw
  *   --model <name>            Override model for all tiers (blanket)
  *   --reasoning-model <name> Override model for reasoning tasks
  *   --coding-model <name>    Override model for coding tasks
@@ -123,7 +123,7 @@ const PROVIDER_ALIASES = {
   'dsh': 'deepseek-harness',
 };
 
-const AVAILABLE_PROVIDERS = ['antigravity', 'claude', 'factory', 'codex', 'opencode', 'copilot', 'cursor', 'pi', 'omp', 'deepseek-harness', 'warp', 'windsurf', 'hermes', 'openclaw', 'openhuman', 'grokbot'];
+const AVAILABLE_PROVIDERS = ['antigravity', 'claude', 'factory', 'codex', 'opencode', 'copilot', 'cursor', 'pi', 'omp', 'deepseek-harness', 'warp', 'windsurf', 'hermes', 'openclaw', 'openhuman', 'grokbot', 'grok-build'];
 
 const UNSUPPORTED_PROVIDER_HINTS = {
   'devin-cli': [
@@ -651,7 +651,8 @@ Providers (all deploy agents, commands, skills, and rules):
               Paths: AGENTS.md, .agents/skills/, .dsh/aiwg.cordis.patch.yml
   devin     - Devin Desktop (preferred; aliases: devin-desktop, windsurf)
               Paths: .windsurf/agents/, .windsurf/workflows/, .windsurf/skills/, .windsurf/rules/
-  grokbot   - Grok Bot (experimental; AGENTS.md bridge; skills only with AIWG_GROKBOT_SKILLS_DIR)
+  grokbot   - Grok Bot (AGENTS.md bridge; skills only with AIWG_GROKBOT_SKILLS_DIR)
+  grok-build - Grok Build (experimental; .grok paths + $GROK_HOME; no bare grok alias)
   hermes    - Hermes Agent (MCP-based integration)
               Skills: $HERMES_HOME/skills/ (user-global; defaults to ~/.hermes/skills/) | Agents: AGENTS.md
               Commands/Rules: served via MCP, not file-deployed

package/tools/agents/providers/grok-build.mjs

@@ -0,0 +1,153 @@
+/**
+ * Grok Build provider (experimental).
+ * Project skills under `.grok/skills`; user home via $GROK_HOME (default ~/.grok).
+ * Distinct from grokbot. No bare `grok` alias.
+ *
+ * Wave 1: native kernel skills + AGENTS.md bridge. Agents and rules are
+ * indexed/deferred until #2577 (Grok discovers `.grok/agents` and
+ * `.grok/rules`, but AIWG does not yet emit qualified writers for them).
+ *
+ * @issue #2575
+ */
+
+import path from 'node:path';
+import os from 'node:os';
+import {
+  createAgentsMdFromTemplate,
+  deploySkillsWithKernelRouting,
+  collectFrameworkArtifacts,
+  getAddonSkillDirs,
+  normalizeDeploymentMode,
+  resolveAiwgRoot,
+} from './base.mjs';
+
+export const name = 'grok-build';
+export const aliases = [];
+export const paths = {
+  // Agents/rules dirs exist in Grok Build, but Wave 1 does not write them.
+  agents: '',
+  skills: '.grok/skills',
+  rules: '',
+  hooks: '.grok/hooks',
+  config: '.grok/config.toml',
+};
+export const kernelSkillsPath = '.grok/skills';
+/** Standard-tier opt-in mirror (`--copy-all`) lives under the project .aiwg tree. */
+export const standardSkillsPath = '.grok/.aiwg/skills';
+
+export const support = {
+  agents: 'indexed', // deferred native writer until #2577
+  commands: 'indexed', // discoverable through the AIWG index; no native command writer
+  skills: 'native',
+  rules: 'indexed', // deferred native writer until #2577; host still loads AGENTS.md + .grok/rules hierarchically
+};
+
+export const capabilities = {
+  skills: true,
+  rules: false, // indexed/deferred — do not claim native rule transforms yet
+  yamlFormat: false,
+  aggregatedOutput: false,
+  homeDirectoryDeploy: true,
+  parallelCommandAndSkillSurfaces: false,
+};
+
+const GROK_HOME_ENV = 'GROK_HOME';
+
+export function resolveGrokHome(env = process.env, userHome = os.homedir()) {
+  const raw = (env[GROK_HOME_ENV] || '').trim();
+  const candidate = raw || path.join(userHome, '.grok');
+  if (candidate === '~') return null;
+  let expanded = candidate;
+  if (candidate.startsWith('~/')) expanded = path.join(userHome, candidate.slice(2));
+  if (!path.isAbsolute(expanded)) return null;
+  const resolved = path.resolve(expanded);
+  if (!resolved || path.parse(resolved).root === resolved) return null;
+  return resolved;
+}
+
+export function createAgentsMd(target, srcRoot, dryRun) {
+  createAgentsMdFromTemplate(
+    target,
+    resolveAiwgRoot(srcRoot) || srcRoot,
+    'grok-build/AGENTS.md.aiwg-template',
+    dryRun,
+  );
+}
+
+/**
+ * Kernel skills → `.grok/skills` (always).
+ * Standard skills → index-driven by default; `.grok/.aiwg/skills` with `--copy-all`.
+ */
+export function deploySkills(skillDirs, targetDir, opts = {}) {
+  const kernelDest = path.join(targetDir, kernelSkillsPath);
+  const standardDest = path.join(targetDir, standardSkillsPath);
+  return deploySkillsWithKernelRouting(skillDirs, standardDest, kernelDest, {
+    ...opts,
+    copyStandardSkills: opts.copyStandardSkills === true,
+  });
+}
+
+export function deployAgents() {
+  return 0;
+}
+
+export function deployRules() {
+  return 0;
+}
+
+export async function postDeploy(target, opts = {}) {
+  if (opts.createAgentsMd || (!opts.commandsOnly && !opts.skillsOnly && !opts.rulesOnly)) {
+    createAgentsMd(target, opts.srcRoot, opts.dryRun);
+  }
+  if (!opts.quiet) {
+    const home = resolveGrokHome(opts.env || process.env);
+    console.log(
+      `Grok Build (experimental): kernel skills → ${kernelSkillsPath}; ` +
+        `standard skills index-driven (opt-in mirror → ${standardSkillsPath} with --copy-all); ` +
+        `agents/rules indexed until #2577; user home → ${home || '(unresolved GROK_HOME)'}. ` +
+        'Distinct from grokbot.',
+    );
+  }
+}
+
+export function getFileExtension() {
+  return '.md';
+}
+
+export async function deploy(opts) {
+  const mode = normalizeDeploymentMode(opts.mode);
+  const skillDirs = [...getAddonSkillDirs(opts.srcRoot)];
+  skillDirs.push(
+    ...collectFrameworkArtifacts(opts.srcRoot, mode, {
+      includeAgents: false,
+      includeCommands: false,
+      includeSkills: true,
+      includeRules: false,
+    }).skills,
+  );
+  let count = 0;
+  if (!opts.commandsOnly && !opts.rulesOnly) {
+    const result = deploySkills(skillDirs, opts.target, opts);
+    count += (result?.kernel ?? 0) + (result?.standardCopied ?? 0);
+  }
+  await postDeploy(opts.target, opts);
+  return count;
+}
+
+export default {
+  name,
+  aliases,
+  paths,
+  kernelSkillsPath,
+  standardSkillsPath,
+  support,
+  capabilities,
+  resolveGrokHome,
+  createAgentsMd,
+  deploySkills,
+  deployAgents,
+  deployRules,
+  postDeploy,
+  getFileExtension,
+  deploy,
+};