@aiwg/cli 2026.9.2 → 2026.9.3

package/dist/src/storage/backends/fortemi.js

@@ -36,6 +36,45 @@
  * @issue #961
  * @issue #972
  */
+import { createHash } from 'node:crypto';
+const FORTEMI_QUERY_LIMIT = 50;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function schemaProperties(tool) {
+    const properties = tool?.inputSchema?.properties;
+    return properties && typeof properties === 'object'
+        ? properties
+        : {};
+}
+/** Select an argument contract from discovered capabilities, never a version string. */
+export function resolveFortemiToolProfile(tools) {
+    const byName = new Map(tools.map((tool) => [tool.name, tool]));
+    const legacy = schemaProperties(byName.get('get_note'));
+    if ('note_id' in legacy)
+        return 'legacy-note-id';
+    const currentGet = schemaProperties(byName.get('get_note'));
+    const currentUpsert = schemaProperties(byName.get('upsert_external_notes'));
+    const currentItems = currentUpsert.items;
+    if ('id' in currentGet &&
+        'source_namespace' in currentUpsert &&
+        'items' in currentUpsert &&
+        currentItems?.items?.properties &&
+        'external_id' in currentItems.items.properties &&
+        'content' in currentItems.items.properties &&
+        'caller_stable_id' in currentItems.items.properties)
+        return 'source-addressed-v1';
+    throw new Error('storage(fortemi): unsupported live MCP tool contract');
+}
+/** Stable UUID used as the opaque Fortemi handle for a subsystem/path identity. */
+export function fortemiStableNoteId(subsystem, path) {
+    const bytes = createHash('sha256')
+        .update(`aiwg-storage\0${subsystem}\0${path}`)
+        .digest()
+        .subarray(0, 16);
+    bytes[6] = (bytes[6] & 0x0f) | 0x50;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    const hex = bytes.toString('hex');
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
 const DEFAULT_MCP_SERVER = 'fortemi';
 const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 export function resolveMcpRequestHeaders(server, environment = process.env) {
@@ -48,7 +87,8 @@ export function resolveMcpRequestHeaders(server, environment = process.env) {
         if (!value) {
             throw new Error(`storage(fortemi): required credential environment variable "${envName}" is not set`);
         }
-        headers[header] = header.toLowerCase() === 'authorization' ? `Bearer ${value}` : value;
+        headers[header] =
+            header.toLowerCase() === 'authorization' ? `Bearer ${value}` : value;
     }
     return headers;
 }
@@ -75,6 +115,11 @@ export function unwrapMcpToolResult(result) {
             ?.filter((item) => item.type === 'text' && typeof item.text === 'string')
             .map((item) => item.text)
             .join('; ');
+        if (detail &&
+            /(?:API error 404|status(?: code)? 404)/i.test(detail) &&
+            /(?:Note not found|problems\/not-found)/i.test(detail)) {
+            return { not_found: true };
+        }
         throw new Error(`storage(fortemi): MCP tool failed${detail ? `: ${detail}` : ''}`);
     }
     if (envelope.structuredContent !== undefined)
@@ -95,6 +140,7 @@ export class FortemiAdapter {
     scheme;
     clientFactory;
     client = null;
+    profile = null;
     constructor(opts) {
         this.subsystem = opts.subsystem;
         this.mcpServer = opts.config.mcpServer ?? DEFAULT_MCP_SERVER;
@@ -105,12 +151,21 @@ export class FortemiAdapter {
         if (this.client)
             return;
         this.client = await this.clientFactory(this.mcpServer);
+        if (this.client.listTools) {
+            const discovered = await this.client.listTools();
+            this.profile = resolveFortemiToolProfile(discovered.tools ?? []);
+        }
+        else {
+            // Preserve injected/older clients which predate tool discovery.
+            this.profile = 'legacy-note-id';
+        }
     }
     async close() {
         if (this.client?.close) {
             await this.client.close();
         }
         this.client = null;
+        this.profile = null;
     }
     async getClient() {
         if (!this.client)
@@ -132,17 +187,44 @@ export class FortemiAdapter {
     async read(path) {
         const id = this.noteId(path);
         const client = await this.getClient();
-        const result = (await client.callTool('get_note', { note_id: id }));
+        const result = (await client.callTool('get_note', this.profile === 'source-addressed-v1'
+            ? { id: fortemiStableNoteId(this.subsystem, path) }
+            : { note_id: id }));
         if (!result || result.not_found)
             return null;
-        const note = result.note;
+        const note = result.note ?? result;
         if (!note)
             return null;
-        return note.revised_content ?? note.content ?? null;
+        return (result.revised?.content ??
+            result.original?.content ??
+            note.revised_content ??
+            note.content ??
+            null);
     }
     async write(path, content, meta) {
         const id = this.noteId(path);
         const client = await this.getClient();
+        if (this.profile === 'source-addressed-v1') {
+            const digest = createHash('sha256').update(content).digest('hex');
+            await client.callTool('upsert_external_notes', {
+                source_namespace: `aiwg.storage.${this.subsystem}`,
+                source_schema_version: 'aiwg.storage-entry/v1',
+                import_run_id: `sha256:${digest}`,
+                batch_id: `sha256:${digest}`,
+                policy: 'replace',
+                items: [
+                    {
+                        external_id: path,
+                        content,
+                        content_digest: `sha256:${digest}`,
+                        caller_stable_id: fortemiStableNoteId(this.subsystem, path),
+                        metadata: { ...this.buildMetadata(meta), aiwg_storage_path: path },
+                        policy: 'replace',
+                    },
+                ],
+            });
+            return;
+        }
         // Try update first; if not found, capture as new. Two calls in the
         // worst case but idempotent — Fortemi's update_note increments the
         // version rather than overwriting, which matches the Phase-4 design.
@@ -171,16 +253,29 @@ export class FortemiAdapter {
         const subsystemPrefix = `${this.subsystem}:`;
         const fullPrefix = prefix.length === 0 ? subsystemPrefix : `${subsystemPrefix}${prefix}`;
         const result = (await client.callTool('list_notes', {
-            id_prefix: fullPrefix,
-            scheme: this.scheme,
+            ...(this.profile === 'source-addressed-v1'
+                ? { limit: 500, offset: 0 }
+                : { id_prefix: fullPrefix, scheme: this.scheme }),
         }));
         const notes = result?.notes ?? [];
         return notes
-            .filter((n) => typeof n.note_id === 'string' && n.note_id.startsWith(subsystemPrefix))
+            .map((n) => {
+            const current = n;
+            const path = current.metadata?.aiwg_storage_path;
+            return typeof path === 'string' &&
+                current.metadata?.subsystem === this.subsystem
+                ? {
+                    ...n,
+                    note_id: `${subsystemPrefix}${path}`,
+                    external_id: current.id,
+                }
+                : n;
+        })
+            .filter((n) => typeof n.note_id === 'string' && n.note_id.startsWith(fullPrefix))
             .map((n) => {
             const entry = {
                 path: n.note_id.slice(subsystemPrefix.length),
-                externalId: n.note_id,
+                externalId: n.external_id ?? n.note_id,
             };
             if (typeof n.size === 'number')
                 entry.size = n.size;
@@ -200,11 +295,16 @@ export class FortemiAdapter {
         // the note from list/read by archiving it).
         const id = this.noteId(path);
         const client = await this.getClient();
-        const existing = (await client.callTool('get_note', { note_id: id }));
-        if (!existing || existing.not_found || !existing.note)
+        const identityArgs = this.profile === 'source-addressed-v1'
+            ? { id: fortemiStableNoteId(this.subsystem, path) }
+            : { note_id: id };
+        const existing = (await client.callTool('get_note', identityArgs));
+        if (!existing ||
+            existing.not_found ||
+            (this.profile !== 'source-addressed-v1' && !existing.note))
             return;
         await client.callTool('update_note', {
-            note_id: id,
+            ...identityArgs,
             archived: true,
         });
     }
@@ -212,16 +312,41 @@ export class FortemiAdapter {
         const client = await this.getClient();
         const subsystemPrefix = `${this.subsystem}:`;
         const result = (await client.callTool('search', {
-            query: q,
-            id_prefix: subsystemPrefix,
-            scheme: this.scheme,
+            ...(this.profile === 'source-addressed-v1'
+                ? { action: 'text', query: q, limit: FORTEMI_QUERY_LIMIT }
+                : { query: q, id_prefix: subsystemPrefix, scheme: this.scheme }),
         }));
         const results = result?.results ?? [];
-        return results
-            .filter((r) => typeof r.note_id === 'string' && r.note_id.startsWith(subsystemPrefix))
+        const hydrated = [];
+        for (const resultItem of results.slice(0, FORTEMI_QUERY_LIMIT)) {
+            let item = resultItem;
+            if (this.profile === 'source-addressed-v1' &&
+                typeof item.id === 'string' &&
+                UUID.test(item.id) &&
+                (!item.metadata || typeof item.metadata.aiwg_storage_path !== 'string')) {
+                const detail = (await client.callTool('get_note', { id: item.id }));
+                if (!detail || detail.not_found)
+                    continue;
+                const note = detail.note;
+                if (!note || note.id !== item.id)
+                    continue;
+                item = { ...item, metadata: note.metadata };
+            }
+            hydrated.push(item);
+        }
+        return hydrated
+            .map((r) => {
+            const path = r.metadata?.aiwg_storage_path;
+            return typeof path === 'string' &&
+                r.metadata?.subsystem === this.subsystem
+                ? { ...r, note_id: `${subsystemPrefix}${path}` }
+                : r;
+        })
+            .filter((r) => typeof r.note_id === 'string' &&
+            r.note_id.startsWith(subsystemPrefix))
             .map((r) => ({
             path: r.note_id.slice(subsystemPrefix.length),
-            externalId: r.note_id,
+            externalId: r.id ?? r.note_id,
         }));
     }
     buildMetadata(meta) {

package/dist/src/storage/fortemi-qualification-receipt.js

@@ -0,0 +1,206 @@
+import { createHash } from "node:crypto";
+import { link, mkdir, unlink, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { execFileSync } from "node:child_process";
+export const FORTEMI_QUALIFICATION_RECEIPT = "aiwg.fortemi-live-qualification-receipt/v1";
+const DIGEST = /^sha256:[0-9a-f]{64}$/;
+const COMMIT = /^[0-9a-f]{40}$/;
+const REF = /^(?:refs\/(?:heads|tags)\/[A-Za-z0-9._/-]+|[0-9a-f]{40})$/;
+const SHORT_REF = /^[A-Za-z0-9._/-]+$/;
+const SAFE = /^[A-Za-z0-9._:/-]+$/;
+const NAMESPACE = /^aiwg-qualification-[0-9a-f-]{36}$/;
+const REQUIRED_OPERATIONS = new Set([
+    "read",
+    "write",
+    "update",
+    "list",
+    "query",
+]);
+function hasCompleteOperationInventory(operations) {
+    const names = operations.map((operation) => operation.operation);
+    return (names.length === REQUIRED_OPERATIONS.size &&
+        new Set(names).size === REQUIRED_OPERATIONS.size &&
+        names.every((name) => REQUIRED_OPERATIONS.has(name)));
+}
+export function resolveFortemiQualificationSource(env = process.env, cwd = process.cwd()) {
+    const git = (...args) => execFileSync("git", args, {
+        cwd,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+    const aiwgCommit = env.AIWG_STORAGE_QUALIFICATION_COMMIT || git("rev-parse", "HEAD");
+    const configuredRef = env.AIWG_STORAGE_QUALIFICATION_BRANCH;
+    const aiwgRef = configuredRef
+        ? REF.test(configuredRef)
+            ? configuredRef
+            : SHORT_REF.test(configuredRef) && !configuredRef.includes("..")
+                ? `refs/heads/${configuredRef}`
+                : configuredRef
+        : (() => {
+            try {
+                return git("symbolic-ref", "-q", "HEAD");
+            }
+            catch {
+                return aiwgCommit;
+            }
+        })();
+    if (!COMMIT.test(aiwgCommit))
+        throw new Error("FORTEMI_RECEIPT_INVALID_COMMIT");
+    if (!REF.test(aiwgRef) || aiwgRef.includes(".."))
+        throw new Error("FORTEMI_RECEIPT_INVALID_REF");
+    return { aiwgCommit, aiwgRef };
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value && typeof value === "object")
+        return `{${Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`)
+            .join(",")}}`;
+    return JSON.stringify(value);
+}
+export function fortemiReceiptDigest(value) {
+    return `sha256:${createHash("sha256").update(canonical(value)).digest("hex")}`;
+}
+export function endpointFingerprint(rawUrl) {
+    const url = new URL(rawUrl);
+    url.username = "";
+    url.password = "";
+    url.hash = "";
+    return fortemiReceiptDigest(url.toString());
+}
+function receiptMaterial(receipt) {
+    const { receiptDigest: _digest, ...material } = receipt;
+    return material;
+}
+export function createFortemiQualificationReceipt(input) {
+    if (!COMMIT.test(input.aiwgCommit))
+        throw new Error("FORTEMI_RECEIPT_INVALID_COMMIT");
+    if (!REF.test(input.aiwgRef) || input.aiwgRef.includes(".."))
+        throw new Error("FORTEMI_RECEIPT_INVALID_REF");
+    if (!input.report.server.name || !SAFE.test(input.report.server.name))
+        throw new Error("FORTEMI_RECEIPT_INVALID_SERVER_NAME");
+    if (!input.report.server.version || !SAFE.test(input.report.server.version))
+        throw new Error("FORTEMI_RECEIPT_INVALID_SERVER_VERSION");
+    if (!SAFE.test(input.contractRevision))
+        throw new Error("FORTEMI_RECEIPT_INVALID_CONTRACT_REVISION");
+    if (!NAMESPACE.test(input.report.namespace))
+        throw new Error("FORTEMI_RECEIPT_INVALID_NAMESPACE");
+    if (input.report.mutationAttempted !== Boolean(input.mutationObjectId))
+        throw new Error("FORTEMI_RECEIPT_MUTATION_BINDING_MISMATCH");
+    if (input.mutationObjectId && !SAFE.test(input.mutationObjectId))
+        throw new Error("FORTEMI_RECEIPT_INVALID_OBJECT_ID");
+    const start = Date.parse(input.startedAt);
+    const end = Date.parse(input.endedAt);
+    if (!Number.isFinite(start) || !Number.isFinite(end) || end < start)
+        throw new Error("FORTEMI_RECEIPT_INVALID_TIMESTAMPS");
+    if (!Number.isInteger(input.timeoutMs) ||
+        input.timeoutMs < 250 ||
+        input.timeoutMs > 30_000 ||
+        !Number.isInteger(input.networkAttempts) ||
+        input.networkAttempts < 0)
+        throw new Error("FORTEMI_RECEIPT_INVALID_RESOURCES");
+    const operations = input.report.operations.map(({ operation, tool, compatible, code }) => {
+        if (![operation, tool, code].every((value) => SAFE.test(value)))
+            throw new Error("FORTEMI_RECEIPT_UNSAFE_OPERATION");
+        return { operation, tool, compatible, code };
+    });
+    if (!hasCompleteOperationInventory(operations))
+        throw new Error("FORTEMI_RECEIPT_OPERATION_INVENTORY_INVALID");
+    const material = {
+        contract: FORTEMI_QUALIFICATION_RECEIPT,
+        outcome: input.report.compatible ? "passed" : "failed",
+        bindings: {
+            aiwgCommit: input.aiwgCommit,
+            aiwgRef: input.aiwgRef,
+            endpointFingerprint: endpointFingerprint(input.endpointUrl),
+            toolSchemaDigest: fortemiReceiptDigest(input.toolSchemas),
+        },
+        observed: {
+            serverName: input.report.server.name,
+            serverVersion: input.report.server.version,
+            contractRevision: input.contractRevision,
+        },
+        namespace: input.report.namespace,
+        operations,
+        mutation: {
+            attempted: input.report.mutationAttempted,
+            ...(input.mutationObjectId ? { objectId: input.mutationObjectId } : {}),
+        },
+        startedAt: new Date(start).toISOString(),
+        endedAt: new Date(end).toISOString(),
+        resources: {
+            timeoutMs: input.timeoutMs,
+            durationMs: end - start,
+            networkAttempts: input.networkAttempts,
+            toolCount: operations.length,
+        },
+    };
+    return { ...material, receiptDigest: fortemiReceiptDigest(material) };
+}
+export function verifyFortemiQualificationReceipt(receipt) {
+    const errors = [];
+    if (receipt.contract !== FORTEMI_QUALIFICATION_RECEIPT)
+        errors.push("FORTEMI_RECEIPT_CONTRACT_MISMATCH");
+    if (!["passed", "failed"].includes(receipt.outcome) ||
+        receipt.outcome !==
+            (receipt.operations.every((operation) => operation.compatible)
+                ? "passed"
+                : "failed"))
+        errors.push("FORTEMI_RECEIPT_OUTCOME_INVALID");
+    if (!DIGEST.test(receipt.receiptDigest) ||
+        receipt.receiptDigest !== fortemiReceiptDigest(receiptMaterial(receipt)))
+        errors.push("FORTEMI_RECEIPT_DIGEST_MISMATCH");
+    if (!DIGEST.test(receipt.bindings.endpointFingerprint) ||
+        !DIGEST.test(receipt.bindings.toolSchemaDigest))
+        errors.push("FORTEMI_RECEIPT_BINDING_INVALID");
+    if (!COMMIT.test(receipt.bindings.aiwgCommit) ||
+        !REF.test(receipt.bindings.aiwgRef))
+        errors.push("FORTEMI_RECEIPT_SOURCE_INVALID");
+    if (!SAFE.test(receipt.observed.serverName) ||
+        !SAFE.test(receipt.observed.serverVersion) ||
+        !SAFE.test(receipt.observed.contractRevision) ||
+        !NAMESPACE.test(receipt.namespace))
+        errors.push("FORTEMI_RECEIPT_OBSERVATION_INVALID");
+    if (receipt.operations.some((item) => !SAFE.test(item.operation) ||
+        !SAFE.test(item.tool) ||
+        !SAFE.test(item.code)))
+        errors.push("FORTEMI_RECEIPT_OPERATION_INVALID");
+    if (!hasCompleteOperationInventory(receipt.operations))
+        errors.push("FORTEMI_RECEIPT_OPERATION_INVENTORY_INVALID");
+    if (receipt.mutation.attempted !== Boolean(receipt.mutation.objectId) ||
+        (receipt.mutation.objectId && !SAFE.test(receipt.mutation.objectId)))
+        errors.push("FORTEMI_RECEIPT_MUTATION_INVALID");
+    if (Date.parse(receipt.endedAt) < Date.parse(receipt.startedAt) ||
+        receipt.resources.durationMs !==
+            Date.parse(receipt.endedAt) - Date.parse(receipt.startedAt))
+        errors.push("FORTEMI_RECEIPT_TIME_INVALID");
+    if (!Number.isInteger(receipt.resources.timeoutMs) ||
+        receipt.resources.timeoutMs < 250 ||
+        receipt.resources.timeoutMs > 30_000 ||
+        !Number.isInteger(receipt.resources.networkAttempts) ||
+        receipt.resources.networkAttempts < 0 ||
+        receipt.resources.toolCount !== receipt.operations.length)
+        errors.push("FORTEMI_RECEIPT_RESOURCES_INVALID");
+    return errors;
+}
+export async function writeFortemiQualificationReceipt(path, receipt) {
+    const errors = verifyFortemiQualificationReceipt(receipt);
+    if (errors.length)
+        throw new Error(errors.join(","));
+    await mkdir(dirname(path), { recursive: true });
+    const temporary = `${path}.tmp-${process.pid}`;
+    await writeFile(temporary, `${JSON.stringify(receipt, null, 2)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+        flag: "wx",
+    });
+    try {
+        await link(temporary, path);
+    }
+    finally {
+        await unlink(temporary).catch(() => undefined);
+    }
+}
+//# sourceMappingURL=fortemi-qualification-receipt.js.map

package/dist/src/storage/fortemi-qualification.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
-import { FortemiAdapter } from "./backends/fortemi.js";
+import { FortemiAdapter, fortemiStableNoteId, } from "./backends/fortemi.js";
 export const FORTEMI_QUALIFICATION_VERSION = "aiwg.fortemi-live-qualification/v1";
-const EXPECTED = {
+const LEGACY_EXPECTED = {
     read: { tool: "get_note", required: ["note_id"], properties: ["note_id"] },
     write: {
         tool: "capture_knowledge",
@@ -20,6 +20,37 @@ const EXPECTED = {
         properties: ["query", "id_prefix"],
     },
 };
+const SOURCE_ADDRESSED_EXPECTED = {
+    read: { tool: "get_note", required: ["id"], properties: ["id"] },
+    write: {
+        tool: "upsert_external_notes",
+        required: [
+            "source_namespace",
+            "source_schema_version",
+            "import_run_id",
+            "items",
+        ],
+        properties: [
+            "source_namespace",
+            "source_schema_version",
+            "import_run_id",
+            "batch_id",
+            "policy",
+            "items",
+        ],
+    },
+    update: {
+        tool: "update_note",
+        required: ["id"],
+        properties: ["id", "content", "archived"],
+    },
+    list: { tool: "list_notes", required: [], properties: ["limit", "offset"] },
+    query: {
+        tool: "search",
+        required: ["action"],
+        properties: ["action", "query", "limit"],
+    },
+};
 function bounded(work, timeoutMs, label) {
     let timer;
     return Promise.race([
@@ -50,8 +81,19 @@ export async function qualifyLiveFortemi(client, options = {}) {
         if (!client.listTools)
             throw new Error("FORTEMI_TOOL_DISCOVERY_UNAVAILABLE");
         const discovered = await bounded(client.listTools(), timeoutMs, "tools/list");
+        options.onToolSchemas?.(discovered.tools ?? []);
         const tools = new Map((discovered.tools ?? []).map((tool) => [tool.name, tool]));
-        for (const [operation, expected] of Object.entries(EXPECTED)) {
+        const getProperties = tools.get("get_note")?.inputSchema?.properties;
+        const profile = tools.has("upsert_external_notes") &&
+            getProperties &&
+            typeof getProperties === "object" &&
+            "id" in getProperties
+            ? "source-addressed-v1"
+            : "legacy-note-id";
+        const expectedOperations = profile === "source-addressed-v1"
+            ? SOURCE_ADDRESSED_EXPECTED
+            : LEGACY_EXPECTED;
+        for (const [operation, expected] of Object.entries(expectedOperations)) {
             const tool = tools.get(expected.tool);
             const schema = tool?.inputSchema;
             const properties = schema?.properties && typeof schema.properties === "object"
@@ -62,9 +104,23 @@ export async function qualifyLiveFortemi(client, options = {}) {
                 : [];
             const missing = expected.properties.filter((name) => !(name in properties));
             const missingRequired = expected.required.filter((name) => !required.includes(name));
+            const itemProperties = operation === "write" && profile === "source-addressed-v1"
+                ? (properties.items?.items?.properties ?? {})
+                : {};
+            const missingItemProperties = operation === "write" && profile === "source-addressed-v1"
+                ? [
+                    "external_id",
+                    "content",
+                    "content_digest",
+                    "caller_stable_id",
+                    "metadata",
+                    "policy",
+                ].filter((name) => !(name in itemProperties))
+                : [];
             const compatible = Boolean(tool && schema) &&
                 missing.length === 0 &&
-                missingRequired.length === 0;
+                missingRequired.length === 0 &&
+                missingItemProperties.length === 0;
             report.operations.push({
                 operation,
                 tool: expected.tool,
@@ -76,7 +132,7 @@ export async function qualifyLiveFortemi(client, options = {}) {
                         : "FORTEMI_TOOL_MISSING",
                 detail: compatible
                     ? "expected adapter arguments are accepted"
-                    : `missing properties: ${missing.join(", ") || "none"}; not required: ${missingRequired.join(", ") || "none"}`,
+                    : `missing properties: ${missing.join(", ") || "none"}; not required: ${missingRequired.join(", ") || "none"}; missing item properties: ${missingItemProperties.join(", ") || "none"}`,
             });
         }
         report.compatible = report.operations.every((item) => item.compatible);
@@ -93,7 +149,12 @@ export async function qualifyLiveFortemi(client, options = {}) {
         await bounded(adapter.query(`aiwg qualification ${namespace}`), timeoutMs, "adapter query");
         if (options.allowMutation) {
             report.mutationAttempted = true;
-            await bounded(adapter.write(randomUUID(), `AIWG live qualification ${namespace}`, {
+            const mutationPath = randomUUID();
+            report.mutationObjectId =
+                profile === "source-addressed-v1"
+                    ? fortemiStableNoteId(namespace, mutationPath)
+                    : `${namespace}:${mutationPath}`;
+            await bounded(adapter.write(mutationPath, `AIWG live qualification ${namespace}`, {
                 contentType: "text/plain",
             }), timeoutMs, "adapter write");
         }

package/dist/src/storage/index.js

@@ -22,6 +22,7 @@ export { ObsidianAdapter } from './backends/obsidian.js';
 export { LogseqAdapter } from './backends/logseq.js';
 export { FortemiAdapter } from './backends/fortemi.js';
 export { qualifyLiveFortemi, FORTEMI_QUALIFICATION_VERSION, } from './fortemi-qualification.js';
+export { createFortemiQualificationReceipt, endpointFingerprint, fortemiReceiptDigest, verifyFortemiQualificationReceipt, writeFortemiQualificationReceipt, FORTEMI_QUALIFICATION_RECEIPT, } from './fortemi-qualification-receipt.js';
 export { STORAGE_BACKEND_CONTRACT, STORAGE_BACKEND_MATRIX, StorageCapabilityError, negotiateStorageCapabilities, } from './backend-contract.js';
 export { STORAGE_MIGRATION_PROTOCOL, MigrationProtocolError, StorageMigrationCoordinator, approvalDigest, digestRecordChunks, digestRecords, validateManifest, } from './migration-protocol.js';
 export { PostgresStorageBackend, PostgresBackendError, } from './backends/postgres.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.9.2",
+  "version": "2026.9.3",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",
@@ -39,6 +39,7 @@
     "tools/_resolve-impl.mjs",
     "tools/agents/deploy-agents.mjs",
     "tools/agents/providers/",
+    "tools/providers/antigravity-transport.mjs",
     "tools/commands/deploy-prompts-codex.mjs",
     "tools/plugin/package-plugins.mjs",
     "tools/skills/deploy-skills-codex.mjs",