@aiwg/cli 2026.9.7 → 2026.9.10

package/dist/src/smiths/context-pipeline/workspace-context.js

@@ -33,6 +33,12 @@ const LEGACY_ROOT_FILES = [
     '.github/copilot-instructions.md',
     'AIWG.md',
 ];
+/**
+ * Operator-content volume above which a provider-named source is surfaced for a scope
+ * decision instead of being routed on filename alone (#2537). A genuine provider adapter
+ * is a few hundred bytes; a migrated project contract is tens of KB.
+ */
+const SCOPE_REVIEW_BYTES = 4096;
 const GENERATED_BLOCKS = [
     [PROVIDER_BOOTSTRAP_START, PROVIDER_BOOTSTRAP_END],
     ['<!-- AIWG:context-hook:start -->', '<!-- AIWG:context-hook:end -->'],
@@ -381,7 +387,8 @@ export function buildWorkspaceManagedBlock(projectPath, providerFiles = []) {
         '',
         '- Edit project-neutral notes only inside the protected Project Context section below.',
         '- Keep detailed policies, runbooks, hooks, and quickrefs in linked files.',
-        '- Keep provider-only directives in `.aiwg/context/providers/`.',
+        '- `.aiwg/context/providers/` is reference only: no provider bootstrap auto-loads it.',
+        '  Put directives you want read into Project Context above.',
         '- Never store secrets, tokens, credentials, or machine-local sensitive values here.',
         '',
         '### Artifact Routing',
@@ -419,11 +426,16 @@ export async function ensureWorkspaceContext(projectPath, options = {}) {
     const workspacePath = path.join(projectPath, 'WORKSPACE.md');
     const warnings = [];
     const existing = await readOptional(workspacePath);
+    // `aiwg use` and `aiwg regenerate` rebuild the managed block without
+    // knowing about earlier migrations. Rediscover the migrated provider files
+    // so their links survive every regeneration instead of only the one that
+    // wrote them (#2558).
+    const providerFiles = options.providerFiles ?? await migratedProviderFiles(projectPath);
     if (existing === null) {
-        await atomicWrite(workspacePath, buildWorkspaceDocument(projectPath, '', options.providerFiles));
+        await atomicWrite(workspacePath, buildWorkspaceDocument(projectPath, '', providerFiles));
         return { path: workspacePath, action: 'created', warnings };
     }
-    const block = buildWorkspaceManagedBlock(projectPath, options.providerFiles);
+    const block = buildWorkspaceManagedBlock(projectPath, providerFiles);
     if (existing.includes(WORKSPACE_MANAGED_START) || existing.includes(WORKSPACE_MANAGED_END)) {
         let updated = replaceBlock(existing, WORKSPACE_MANAGED_START, WORKSPACE_MANAGED_END, block);
         // A managed project-extraction block explicitly points operators back to
@@ -445,7 +457,7 @@ export async function ensureWorkspaceContext(projectPath, options = {}) {
     }
     const backupPath = `${workspacePath}.bak.${new Date().toISOString().replace(/[:.]/g, '-')}`;
     await fs.writeFile(backupPath, existing, 'utf8');
-    await atomicWrite(workspacePath, buildWorkspaceDocument(projectPath, existing, options.providerFiles));
+    await atomicWrite(workspacePath, buildWorkspaceDocument(projectPath, existing, providerFiles));
     return { path: workspacePath, action: 'updated', backupPath, warnings };
 }
 export function buildProviderBootstrapBlock(provider) {
@@ -689,14 +701,29 @@ export async function auditWorkspaceContext(projectPath) {
         .filter(([, values]) => new Set(values.map((value) => value.polarity)).size > 1)
         .map(([key, values]) => ({ key, sources: values.map(({ path: sourcePath, directive }) => ({ path: sourcePath, directive })).sort((a, b) => a.path.localeCompare(b.path)) }));
     const rootOperator = sources.filter((source) => source.scope === 'root' && source.operatorContent.trim());
-    // Provider startup roots remain attributed provider context even when one
-    // directive is duplicated elsewhere. Promoting an entire root file because
-    // of one matching line can copy large provider/framework bodies into the
-    // provider-neutral WORKSPACE.md operator region.
-    const neutralSources = rootOperator.filter((source) => source.path === 'WORKSPACE.md').map((source) => source.path);
-    const providerSources = rootOperator.filter((source) => source.path !== 'WORKSPACE.md' && !neutralSources.includes(source.path)).map((source) => source.path);
-    const providerOutputs = providerSources.map((source) => providerContextOutput(projectPath, source));
+    // Provider startup files (CLAUDE.md, AGENTS.md, WARP.md, …) are bootstrap
+    // surfaces: AIWG rewrites them to a managed bootstrap that `@`-imports
+    // WORKSPACE.md. The operator content they carried therefore ports into the
+    // WORKSPACE.md operator block, which every provider bootstrap loads and
+    // which `aiwg use` and `aiwg regenerate` preserve byte-for-byte. Routing
+    // it to `.aiwg/context/providers/` instead left it linked but never
+    // loaded, and a later `aiwg use` dropped even the link (#2558).
+    const neutralSources = rootOperator.map((source) => source.path);
+    const providerSources = [];
+    const providerOutputs = [];
     const workspaceExists = sources.some((source) => source.path === 'WORKSPACE.md');
+    // Report volume and destination per source. A substantial provider-named
+    // body is still surfaced for review (#2537): it now lands where every
+    // provider reads it, so anything genuinely provider-only should be moved to
+    // `.aiwg/context/providers/` by the operator after migration.
+    const routing = rootOperator.map((source) => ({
+        source: source.path,
+        operatorBytes: Buffer.byteLength(source.operatorContent, 'utf8'),
+        destination: 'WORKSPACE.md',
+        scope: 'project-neutral',
+        provider: source.path === 'WORKSPACE.md' ? null : source.provider,
+    })).sort((a, b) => b.operatorBytes - a.operatorBytes);
+    const scopeReview = routing.filter((entry) => entry.source !== 'WORKSPACE.md' && entry.operatorBytes >= SCOPE_REVIEW_BYTES);
     return {
         version: 1,
         projectPath,
@@ -708,6 +735,8 @@ export async function auditWorkspaceContext(projectPath) {
         conflicts,
         sensitiveFindings,
         plan: {
+            routing,
+            scopeReview,
             neutralSources,
             providerSources,
             nestedSources: sources.filter((source) => source.scope === 'nested').map((source) => source.path),
@@ -719,34 +748,48 @@ export async function auditWorkspaceContext(projectPath) {
 function projectOutputPath(projectPath, absPath) {
     return path.relative(projectPath, absPath).replace(/\\/g, '/');
 }
-function providerContextOutput(projectPath, sourcePath) {
-    return projectOutputPath(projectPath, projectAiwgPath(projectPath, 'context', 'providers', sourcePath.replace(/[^A-Za-z0-9.-]+/g, '-').replace(/^-+/, '')));
-}
+const LEGACY_PROJECT_CONTEXT_PLACEHOLDER = [
+    '## Project Context',
+    '',
+    'Add provider-neutral project conventions and links here.',
+].join('\n');
+/**
+ * Operator content for the WORKSPACE.md operator block after migration.
+ *
+ * Existing WORKSPACE.md operator content is kept verbatim; the operator body
+ * of each provider startup file is appended once, verbatim, under an
+ * attributed heading. Tables, procedures, and code blocks survive intact —
+ * the earlier line-flattened directive list lost exactly the runbook content
+ * operators keep in CLAUDE.md (#2558). Re-running the migration is a no-op:
+ * a body that already appears in the block is not appended again.
+ */
 function neutralMigrationContent(audit) {
-    const selected = audit.sources.filter((source) => audit.plan.neutralSources.includes(source.path));
-    const seen = new Set();
-    const lines = ['## Project Context', ''];
-    for (const source of selected) {
-        const unique = directives(source.operatorContent).filter((directive) => !seen.has(directive));
-        for (const directive of unique)
-            seen.add(directive);
-        if (unique.length === 0)
+    const workspace = audit.sources.find((source) => source.path === 'WORKSPACE.md');
+    let base = workspace?.operatorContent.trim() ?? '';
+    if (base === PROJECT_CONTEXT_PLACEHOLDER || base === LEGACY_PROJECT_CONTEXT_PLACEHOLDER)
+        base = '';
+    const sections = [];
+    let accumulated = base;
+    for (const source of audit.sources) {
+        if (source.path === 'WORKSPACE.md' || !audit.plan.neutralSources.includes(source.path))
             continue;
-        lines.push(`### From ${source.path}`, '', ...unique.map((directive) => `- ${directive}`), '');
+        const body = source.operatorContent.trim();
+        if (!body || accumulated.includes(body))
+            continue;
+        sections.push([
+            `### Migrated from ${source.path}`,
+            '',
+            `Source attribution: migrated from \`${source.path}\`; checksum \`${source.checksum}\`.`,
+            '',
+            body,
+        ].join('\n'));
+        accumulated = `${accumulated}\n${body}`;
     }
-    if (lines.length === 2)
-        lines.push('Add project conventions, local hook/context pointers, and links to deeper project documents here.');
-    return lines.join('\n').trim();
-}
-function providerMigrationContent(source) {
-    return [
-        `# Provider-specific context from ${source.path}`,
-        '',
-        `Source attribution: migrated from \`${source.path}\`; checksum \`${source.checksum}\`.`,
-        '',
-        source.operatorContent.trim() || '(No operator-authored content remained after managed blocks were removed.)',
-        '',
-    ].join('\n');
+    const parts = [base || '## Project Context', ...sections];
+    if (!base && sections.length === 0) {
+        parts.push('Add project conventions, local hook/context pointers, and links to deeper project documents here.');
+    }
+    return parts.join('\n\n').trim();
 }
 async function configuredProviders(projectPath) {
     try {
@@ -761,17 +804,8 @@ async function configuredProviders(projectPath) {
 }
 async function stageMigrationWrites(projectPath, audit, options = {}) {
     const writes = new Map();
-    for (const source of audit.sources.filter((item) => audit.plan.providerSources.includes(item.path))) {
-        writes.set(providerContextOutput(projectPath, source.path), providerMigrationContent(source));
-    }
-    const providerFiles = [...new Set([
-            ...audit.sources.filter((source) => source.path.replace(/\\/g, '/').includes('/context/providers/')).map((source) => source.path),
-            ...writes.keys(),
-        ])].sort();
-    const existingWorkspace = audit.sources.find((source) => source.path === 'WORKSPACE.md');
-    let workspaceOperatorContent = existingWorkspace?.managed
-        ? existingWorkspace.operatorContent
-        : neutralMigrationContent(audit);
+    const providerFiles = [...new Set(audit.sources.filter((source) => source.path.replace(/\\/g, '/').includes('/context/providers/')).map((source) => source.path))].sort();
+    let workspaceOperatorContent = neutralMigrationContent(audit);
     if (options.extractProject) {
         const extracted = await extractExistingProjectContext(projectPath);
         workspaceOperatorContent = mergeProjectExtraction(workspaceOperatorContent, extracted.content);
@@ -945,8 +979,35 @@ export async function rollbackWorkspaceContext(projectPath, requestedId) {
     await atomicWrite(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
     return { id, restored: manifest.files.map((file) => file.path) };
 }
+/**
+ * Blank out fenced code blocks and inline code spans, preserving offsets and line
+ * structure, so link extraction sees only prose. Illustrative paths inside an
+ * example block are documentation, not context links the graph should resolve (#2536).
+ */
+function maskCodeRegions(content) {
+    const lines = content.split('\n');
+    let fence = null;
+    const masked = lines.map((line) => {
+        const openOrClose = /^\s{0,3}(`{3,}|~{3,})(.*)$/.exec(line);
+        if (fence) {
+            // A closing fence uses the same character, is at least as long, and carries no info string.
+            if (openOrClose && openOrClose[1][0] === fence.marker && openOrClose[1].length >= fence.length && openOrClose[2].trim() === '') {
+                fence = null;
+            }
+            return ' '.repeat(line.length);
+        }
+        if (openOrClose) {
+            fence = { marker: openOrClose[1][0], length: openOrClose[1].length };
+            return ' '.repeat(line.length);
+        }
+        // Inline code spans: a run of N backticks closes on the next run of exactly N.
+        return line.replace(/(`+)(?:[^`]|(?!\1)`)*?\1/g, (span) => ' '.repeat(span.length));
+    });
+    return masked.join('\n');
+}
 function markdownLinks(content) {
-    return [...content.matchAll(/\[[^\]]+\]\((\.\/?[^)#]+)(?:#[^)]+)?\)/g)].map((match) => match[1]);
+    const prose = maskCodeRegions(content);
+    return [...prose.matchAll(/\[[^\]]+\]\((\.\/?[^)#]+)(?:#[^)]+)?\)/g)].map((match) => match[1]);
 }
 export async function workspaceLinkedFiles(projectPath) {
     const content = await readOptional(path.join(projectPath, 'WORKSPACE.md'));
@@ -1011,8 +1072,36 @@ export async function diagnoseWorkspaceContext(projectPath) {
     for (const conflict of audit.conflicts) {
         diagnostics.push({ severity: 'error', code: 'directive-conflict', message: `Conflicting duplicate directive group '${conflict.key}' appears in ${conflict.sources.map((source) => source.path).join(', ')}.` });
     }
+    // One diagnostic per source pair, not one per duplicated line: a shared
+    // pointer stub otherwise reports every line as a separate policy conflict
+    // and degrades the workspace over content that agrees with itself (#2558).
+    const duplicatesByPair = new Map();
     for (const overlap of audit.identical) {
-        diagnostics.push({ severity: 'warning', code: 'duplicate-directive', message: `Identical directive is duplicated across ${overlap.sources.join(', ')}.` });
+        const key = overlap.sources.join(', ');
+        duplicatesByPair.set(key, (duplicatesByPair.get(key) ?? 0) + overlap.directives.length);
+    }
+    const operatorBodies = new Map(audit.sources.map((source) => [source.path, source.operatorContent.trim()]));
+    for (const [pair, count] of duplicatesByPair) {
+        const paths = pair.split(', ');
+        const bodies = paths.map((item) => operatorBodies.get(item) ?? '');
+        const wholeFileDuplicate = bodies.every((body) => body.length > 0 && body === bodies[0]);
+        diagnostics.push({
+            severity: wholeFileDuplicate ? 'info' : 'warning',
+            code: 'duplicate-directive',
+            message: wholeFileDuplicate
+                ? `${pair} carry identical operator content (${count} directive(s)); keep one copy or accept the shared stub.`
+                : `${count} identical directive(s) duplicated across ${pair}.`,
+        });
+    }
+    for (const source of audit.sources) {
+        if (!source.path.replace(/\\/g, '/').includes('/context/providers/') || !source.operatorContent.trim())
+            continue;
+        diagnostics.push({
+            severity: 'info',
+            code: 'provider-context-not-loaded',
+            message: `${source.path} is linked from WORKSPACE.md but no provider bootstrap auto-loads it; move its operator content into the WORKSPACE.md Project Context section (\`aiwg regenerate --existing-project\` ports startup files there) or keep it as reference only.`,
+            path: source.path,
+        });
     }
     for (const finding of audit.sensitiveFindings) {
         diagnostics.push({ severity: 'error', code: 'possible-secret', message: 'Possible credential value found in context; remove it.', path: finding.path });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.9.7",
+  "version": "2026.9.10",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",

package/schemas/dataset/fortemi-capability-validation/1.0.1/authority.json

@@ -0,0 +1,61 @@
+{
+  "contract": "fortemi.dataset-capability-validation/v1",
+  "revision": "1.0.1",
+  "wireContract": "fortemi.dataset-execution-capabilities/v1",
+  "wireSchemaVersion": "1.0.0",
+  "consumerIssue": 2242,
+  "authority": {
+    "repository": "Fortemi/fortemi-react",
+    "issue": "https://git.integrolabs.net/Fortemi/fortemi-react/issues/422",
+    "commit": "5625215762a8fd06db8fef4ccedd87f3c370ec31",
+    "mergedCommit": "35edcd9f8429fcd91a417021cbe4c427f900ed73",
+    "path": "packages/core/schemas/dataset-execution-capabilities/validation/1.0.1",
+    "manifestSha256": "20b59bb871c3afc9bb972896b2a2da718970c6fe7ef54b49000418f62a5701c0"
+  },
+  "files": [
+    {
+      "path": "capability.schema.json",
+      "authorityPath": "schema.json",
+      "sha256": "a4e9b427da669a02e83db00d39f48c2e106770d6cd2ec1b717938c57793b754c"
+    },
+    {
+      "path": "../../../../test/fixtures/dataset/fortemi-capability/negotiation-vectors.json",
+      "authorityPath": "negotiation-vectors.json",
+      "sha256": "2793990a842d5969f1f64c90170ab97ca4ffc4b93d1302a2f358fae54631a6dc"
+    },
+    {
+      "path": "../../../../test/fixtures/dataset/fortemi-capability/wire-vectors.json",
+      "authorityPath": "wire-vectors.json",
+      "sha256": "c52d32d0b1d0d312cf8b242f11fc116c47d104a74112cbd5d0019e6d39df9744"
+    }
+  ],
+  "consumer": {
+    "repository": "roctinam/aiwg",
+    "implementation": "src/dataset/fortemi-capability.ts",
+    "binding": "src/dataset/fortemi-dataset-execution.ts",
+    "test": "test/unit/dataset/fortemi-capability.test.ts",
+    "boundary": "Independent AIWG implementation of the wire rules. AIWG never imports the producer's validator; agreement is established by the shared authority vectors."
+  },
+  "observedDescriptor": {
+    "source": "Fortemi/fortemi mcp-server/lib/dataset-execution.js buildDatasetExecutionDescriptor",
+    "commit": "a701847db779a0a3adfa36a09dfa1055a10a0a0a",
+    "fixture": "test/fixtures/dataset/fortemi-capability/server-descriptor.json",
+    "sha256": "66ee315912429645e97c77a96e3f5110fe9db5e6909ff3c39e8b6e22135d8b95",
+    "runtimeVersion": "2026.9.10",
+    "qualification": "Descriptor rendered from pinned producer source; not a released-artifact or live-session receipt."
+  },
+  "qualification": {
+    "status": "source-consumer-adoption",
+    "covers": [
+      "advertised capability descriptor validation before preview or execute",
+      "independent negotiation bound to the advertised descriptor",
+      "receipt capabilityDecision bound to that independent negotiation"
+    ],
+    "remaining": [
+      "clean installed and released consumer qualification",
+      "live Fortemi Server session evidence under roctinam/aiwg#2194 authorization"
+    ],
+    "maturity": "alpha",
+    "suiteAudit": "NO-GO"
+  }
+}