@aiwg/cli 2026.9.9 → 2026.9.10

package/dist/src/dataset/fortemi-capability.js

@@ -0,0 +1,211 @@
+import { readFileSync } from "node:fs";
+import Ajv2020 from "ajv/dist/2020.js";
+import { fortemiPinnedSchemaPath } from "./fortemi-schema-path.js";
+/**
+ * Independent AIWG implementation of the Fortemi dataset capability wire rules
+ * (Fortemi/fortemi-react#422 validation revision 1.0.1). AIWG pins the authority
+ * schema and vectors but never imports the producer's validator, so agreement is
+ * established by shared vectors rather than by shared code.
+ */
+export const FORTEMI_CAPABILITY_CONTRACT = "fortemi.dataset-execution-capabilities/v1";
+export const FORTEMI_CAPABILITY_SCHEMA_MAJOR = 1;
+const schema = JSON.parse(readFileSync(fortemiPinnedSchemaPath("schemas/dataset/fortemi-capability-validation/1.0.1/capability.schema.json"), "utf8"));
+const ajv = new Ajv2020({ strict: true, allErrors: false });
+ajv.addSchema(schema);
+const descriptorStructure = ajv.compile({ $ref: `${schema.$id}#/$defs/descriptor` });
+const requestStructure = ajv.compile({ $ref: `${schema.$id}#/$defs/request` });
+const versionPattern = new RegExp(schema.$defs.semver.pattern);
+const CAPABILITY_IDS = new Set(schema.$defs.capabilityId.enum);
+const LIMIT_KEYS = ["maxInputBytes", "maxRecordBytes", "maxBatchRecords", "maxConcurrency", "maxPageSize", "maxTraversalDepth"];
+const REQUIRED_TOGETHER = [
+    ["ingest.incremental", ["identity.stable-revision", "checkpoint.read", "checkpoint.write"]],
+    ["lineage.field", ["lineage.relationship-evidence"]],
+    ["mutation.reconcile", ["mutation.upsert", "mutation.tombstone"]],
+    ["index.hybrid", ["index.lexical", "index.vector"]],
+];
+function parseVersion(value) {
+    if (typeof value !== "string" || value.length > schema.$defs.semver.maxLength)
+        return null;
+    const match = versionPattern.exec(value);
+    if (!match || match[0] !== value)
+        return null;
+    const core = match.slice(1, 4).map(Number);
+    if (!core.every(Number.isSafeInteger))
+        return null;
+    return { core, prerelease: match[4]?.split(".") ?? [] };
+}
+/** SemVer 2.0.0 precedence; build metadata is ignored. `null` means unparseable. */
+export function compareFortemiCapabilityVersions(left, right) {
+    const a = parseVersion(left);
+    const b = parseVersion(right);
+    if (!a || !b)
+        return null;
+    for (let index = 0; index < 3; index++) {
+        if (a.core[index] !== b.core[index])
+            return a.core[index] > b.core[index] ? 1 : -1;
+    }
+    if (!a.prerelease.length || !b.prerelease.length) {
+        return a.prerelease.length ? -1 : b.prerelease.length ? 1 : 0;
+    }
+    for (let index = 0; index < Math.max(a.prerelease.length, b.prerelease.length); index++) {
+        const leftPart = a.prerelease[index];
+        const rightPart = b.prerelease[index];
+        if (leftPart === rightPart)
+            continue;
+        if (leftPart === undefined)
+            return -1;
+        if (rightPart === undefined)
+            return 1;
+        const leftNumeric = /^[0-9]+$/.test(leftPart);
+        const rightNumeric = /^[0-9]+$/.test(rightPart);
+        if (leftNumeric !== rightNumeric)
+            return leftNumeric ? -1 : 1;
+        // Numeric prerelease identifiers can exceed Number's exact integer range.
+        if (leftNumeric && leftPart.length !== rightPart.length)
+            return leftPart.length > rightPart.length ? 1 : -1;
+        return leftPart > rightPart ? 1 : -1;
+    }
+    return 0;
+}
+function majorVersion(value) {
+    const parsed = parseVersion(value);
+    return parsed && parsed.prerelease.length === 0 ? parsed.core[0] : null;
+}
+function supported(capability) {
+    return capability !== undefined && (capability.status === "supported" || capability.status === "experimental");
+}
+/** Structural and semantic validation of an advertised capability descriptor. */
+export function validateFortemiCapabilityDescriptor(descriptor) {
+    if (!descriptorStructure(descriptor)) {
+        const contract = descriptor?.contract;
+        return contract !== undefined && contract !== FORTEMI_CAPABILITY_CONTRACT
+            ? ["CONTRACT_MAJOR_UNSUPPORTED:/contract"]
+            : ["DESCRIPTOR_INVALID:/structure"];
+    }
+    const diagnostics = [];
+    if (descriptor.contract !== FORTEMI_CAPABILITY_CONTRACT)
+        diagnostics.push("CONTRACT_MAJOR_UNSUPPORTED:/contract");
+    if (majorVersion(descriptor.schemaVersion) !== FORTEMI_CAPABILITY_SCHEMA_MAJOR)
+        diagnostics.push("SCHEMA_VERSION_UNSUPPORTED:/schemaVersion");
+    if (!parseVersion(descriptor.runtime.version))
+        diagnostics.push("DESCRIPTOR_INVALID:/runtime/version");
+    const declared = new Map();
+    descriptor.capabilities.forEach((capability, index) => {
+        if (!CAPABILITY_IDS.has(capability.id) || !parseVersion(capability.version)) {
+            diagnostics.push(`DESCRIPTOR_INVALID:/capabilities/${index}`);
+            return;
+        }
+        if (declared.has(capability.id))
+            diagnostics.push(`CAPABILITY_DUPLICATE:/capabilities/${index}/id`);
+        declared.set(capability.id, capability);
+        for (const key of LIMIT_KEYS) {
+            const value = capability.limits?.[key];
+            if (value !== undefined && (!Number.isSafeInteger(value) || value < 0)) {
+                diagnostics.push(`DESCRIPTOR_INVALID:/capabilities/${index}/limits/${key}`);
+            }
+        }
+        if (capability.status !== "unsupported" && capability.evidence.length === 0) {
+            diagnostics.push(`DESCRIPTOR_INVALID:/capabilities/${index}/evidence`);
+        }
+        for (const evidenceId of capability.evidence) {
+            if (!descriptor.evidence.some(entry => entry.id === evidenceId)) {
+                diagnostics.push(`DESCRIPTOR_INVALID:/capabilities/${index}/evidence`);
+            }
+        }
+    });
+    for (const [source, requirements] of REQUIRED_TOGETHER) {
+        if (!supported(declared.get(source)))
+            continue;
+        for (const requirement of requirements) {
+            if (!supported(declared.get(requirement)))
+                diagnostics.push(`CAPABILITY_INCONSISTENT:${source}`);
+        }
+    }
+    if (descriptor.guarantees.transaction === "atomic-batch" && !supported(declared.get("transaction.atomic-batch"))) {
+        diagnostics.push("CAPABILITY_INCONSISTENT:transaction.atomic-batch");
+    }
+    if (descriptor.runtime.plane === "static-cache" && descriptor.runtime.dataClass !== "static-cache") {
+        diagnostics.push("CAPABILITY_INCONSISTENT:/runtime/dataClass");
+    }
+    if (descriptor.runtime.plane === "live-remote-persistence" && descriptor.runtime.maturity === "stable"
+        && !descriptor.evidence.some(entry => entry.kind === "live-qualification")) {
+        diagnostics.push("CAPABILITY_INCONSISTENT:/runtime/maturity");
+    }
+    return diagnostics;
+}
+/** Structural and semantic validation of a negotiation request AIWG is about to send. */
+export function validateFortemiCapabilityRequest(request) {
+    if (!requestStructure(request)) {
+        const contract = request?.contract;
+        return contract !== undefined && contract !== FORTEMI_CAPABILITY_CONTRACT
+            ? ["CONTRACT_MAJOR_UNSUPPORTED:/request/contract"]
+            : ["REQUEST_SCHEMA_INVALID:/request"];
+    }
+    const diagnostics = [];
+    for (const [group, requirements] of [["required", request.required], ["optional", request.optional ?? []]]) {
+        requirements.forEach((requirement, index) => {
+            if (requirement.minimumVersion !== undefined && !parseVersion(requirement.minimumVersion)) {
+                diagnostics.push(`DESCRIPTOR_INVALID:/request/${group}/${index}/minimumVersion`);
+            }
+        });
+    }
+    return diagnostics;
+}
+function assess(requirement, declared) {
+    const capability = declared.get(requirement.id);
+    if (!supported(capability))
+        return { ok: false, reason: "unsupported", diagnostic: `REQUIRED_CAPABILITY_MISSING:${requirement.id}` };
+    if (requirement.minimumVersion !== undefined) {
+        const comparison = compareFortemiCapabilityVersions(capability.version, requirement.minimumVersion);
+        if (comparison === null || comparison < 0) {
+            return { ok: false, reason: "version-insufficient", diagnostic: `CAPABILITY_VERSION_INSUFFICIENT:${requirement.id}` };
+        }
+    }
+    for (const key of LIMIT_KEYS) {
+        const required = requirement.minimumLimits?.[key];
+        if (required !== undefined && (capability.limits?.[key] ?? -1) < required) {
+            return { ok: false, reason: "limit-insufficient", diagnostic: `CAPABILITY_LIMIT_INSUFFICIENT:${requirement.id}/${key}` };
+        }
+    }
+    return { ok: true };
+}
+/**
+ * Pure negotiation of a request against an advertised descriptor. Performs no
+ * I/O and mutates neither input, so a caller can compare the result with the
+ * decision a server reports for the same pair.
+ */
+export function negotiateFortemiCapabilities(descriptor, request) {
+    const diagnostics = [...validateFortemiCapabilityDescriptor(descriptor), ...validateFortemiCapabilityRequest(request)];
+    const selected = [];
+    const degradations = [];
+    if (diagnostics.length)
+        return { accepted: false, selected, degradations, diagnostics };
+    const typed = descriptor;
+    const negotiation = request;
+    const declared = new Map(typed.capabilities.map(capability => [capability.id, capability]));
+    for (const requirement of negotiation.required) {
+        const assessment = assess(requirement, declared);
+        if (assessment.ok)
+            selected.push(requirement.id);
+        else
+            diagnostics.push(assessment.diagnostic);
+    }
+    for (const requirement of negotiation.optional ?? []) {
+        const assessment = assess(requirement, declared);
+        if (assessment.ok) {
+            selected.push(requirement.id);
+            continue;
+        }
+        const fallback = requirement.fallback?.find(id => supported(declared.get(id)));
+        if (fallback)
+            selected.push(fallback);
+        degradations.push({
+            requested: requirement.id,
+            ...(fallback ? { selected: fallback } : {}),
+            reason: assessment.reason,
+            changedGuarantees: [fallback ? `${requirement.id} replaced by ${fallback}` : `${requirement.id} omitted`],
+        });
+    }
+    return { accepted: diagnostics.length === 0, selected: [...new Set(selected)], degradations, diagnostics };
+}
+//# sourceMappingURL=fortemi-capability.js.map

package/dist/src/dataset/fortemi-dataset-execution.d.ts

@@ -1,4 +1,5 @@
 import type { McpClientLike } from "../storage/backends/fortemi.js";
+import { type FortemiCapabilityDecision } from "./fortemi-capability.js";
 import { type FortemiDatasetRunReceipt } from "./fortemi-run-receipt.js";
 export declare const FORTEMI_DATASET_EXECUTION_TOOL = "manage_dataset_execution";
 export declare function fortemiDatasetRequestDigest(request: Record<string, unknown>): string;
@@ -9,10 +10,18 @@ export declare class FortemiDatasetExecutionClient {
     constructor(client: McpClientLike);
     private call;
     capabilities(): Promise<Record<string, unknown>>;
+    /**
+     * Negotiate the request against the advertised descriptor without trusting the
+     * server's own decision, then require the two to agree.
+     */
+    private negotiate;
     preview(request: Record<string, unknown>): Promise<Record<string, unknown>>;
+    private previewWithDecision;
     /** The caller must approve the exact digest returned by read-only preview. */
     execute(request: Record<string, unknown>, approvedRequestDigest: string): Promise<FortemiDatasetRunReceipt>;
     private verifyResult;
+    /** The decision AIWG negotiated for a run, not the one the server reported. */
+    capabilityDecision(runId: string): FortemiCapabilityDecision;
     private knownRun;
     retry(runId: string, action?: "retry" | "resume"): Promise<FortemiDatasetRunReceipt>;
     status(runId: string): Promise<Record<string, unknown>>;

package/dist/src/dataset/fortemi-dataset-execution.js

@@ -1,3 +1,4 @@
+import { FORTEMI_CAPABILITY_CONTRACT, negotiateFortemiCapabilities, validateFortemiCapabilityDescriptor, } from "./fortemi-capability.js";
 import { canonicalFortemiDatasetJson, fortemiDatasetDigest, verifyFortemiDatasetRunReceipt } from "./fortemi-run-receipt.js";
 export const FORTEMI_DATASET_EXECUTION_TOOL = "manage_dataset_execution";
 export function fortemiDatasetRequestDigest(request) {
@@ -13,6 +14,10 @@ export function fortemiDatasetRequestDigest(request) {
         outputSchemaDigest: request.outputSchemaDigest,
     });
 }
+/** Only omission receives the producer's legacy empty-requirement default. */
+function negotiationOf(request) {
+    return request.negotiation === undefined ? { contract: FORTEMI_CAPABILITY_CONTRACT, required: [] } : request.negotiation;
+}
 function object(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         throw new Error("CONFORMANCE_FORTEMI_RESPONSE_INVALID");
@@ -40,20 +45,47 @@ export class FortemiDatasetExecutionClient {
     async capabilities() {
         const result = await this.call("capabilities");
         if (object(result.contracts).receipt !== "fortemi.dataset-run-receipt/v1"
+            || object(result.contracts).capability !== FORTEMI_CAPABILITY_CONTRACT
             || object(result.schemaVersions).receipt !== "1.0.0"
+            || object(result.schemaVersions).capability !== "1.0.0"
             || object(result.receiptValidation).revision !== "1.0.1"
             || object(result.receiptValidation).requestBindingRevision !== "1.0.1")
             throw new Error("CONFORMANCE_FORTEMI_RECEIPT_REVISION_UNSUPPORTED");
+        const diagnostics = validateFortemiCapabilityDescriptor(result.descriptor);
+        if (diagnostics.length)
+            throw new Error(`CONFORMANCE_FORTEMI_DESCRIPTOR_INVALID:${diagnostics.join(",")}`);
         return result;
     }
+    /**
+     * Negotiate the request against the advertised descriptor without trusting the
+     * server's own decision, then require the two to agree.
+     */
+    async negotiate(request) {
+        const advertised = await this.capabilities();
+        const decision = negotiateFortemiCapabilities(advertised.descriptor, negotiationOf(request));
+        if (!decision.accepted)
+            throw new Error(`CONFORMANCE_FORTEMI_CAPABILITY_UNSATISFIED:${decision.diagnostics.join(",")}`);
+        return { descriptor: advertised.descriptor, decision };
+    }
     async preview(request) {
-        await this.capabilities();
+        return (await this.previewWithDecision(request)).result;
+    }
+    async previewWithDecision(request) {
+        const { descriptor, decision } = await this.negotiate(request);
         const result = await this.call("preview", { request });
         if (result.noSideEffects !== true)
             throw new Error("CONFORMANCE_FORTEMI_PREVIEW_INVALID");
+        const reported = object(result.negotiation);
+        if (reported.accepted !== true
+            || reported.runtime === undefined
+            || canonicalFortemiDatasetJson(reported.runtime) !== canonicalFortemiDatasetJson(object(descriptor).runtime)
+            || canonicalFortemiDatasetJson(reported.selected) !== canonicalFortemiDatasetJson(decision.selected)
+            || canonicalFortemiDatasetJson(reported.degradations) !== canonicalFortemiDatasetJson(decision.degradations)) {
+            throw new Error("CONFORMANCE_FORTEMI_CAPABILITY_DECISION_MISMATCH");
+        }
         if (result.accepted === true && result.requestDigest !== fortemiDatasetRequestDigest(request))
             throw new Error("CONFORMANCE_FORTEMI_PREVIEW_BINDING_MISMATCH");
-        return result;
+        return { result, decision };
     }
     /** The caller must approve the exact digest returned by read-only preview. */
     async execute(request, approvedRequestDigest) {
@@ -62,7 +94,7 @@ export class FortemiDatasetExecutionClient {
             throw new Error("CONFORMANCE_LIVE_AUTHORIZATION_REQUIRED");
         if (fortemiDatasetRequestDigest(request) !== approvedRequestDigest)
             throw new Error("CONFORMANCE_FORTEMI_PLAN_NOT_APPROVED");
-        const preview = await this.preview(request);
+        const { result: preview, decision } = await this.previewWithDecision(request);
         if (preview.accepted !== true || preview.requestDigest !== approvedRequestDigest)
             throw new Error("CONFORMANCE_FORTEMI_PLAN_NOT_APPROVED");
         if (typeof request.runId !== "string")
@@ -70,11 +102,11 @@ export class FortemiDatasetExecutionClient {
         const previous = this.runs.get(request.runId);
         if (previous && previous.digest !== approvedRequestDigest)
             throw new Error("CONFORMANCE_FORTEMI_PLAN_NOT_APPROVED");
-        this.runs.set(request.runId, { request: structuredClone(request), digest: approvedRequestDigest });
+        this.runs.set(request.runId, { request: structuredClone(request), digest: approvedRequestDigest, decision });
         const result = await this.call("execute", { request });
-        return this.verifyResult(result, request, approvedRequestDigest);
+        return this.verifyResult(result, request, approvedRequestDigest, decision);
     }
-    verifyResult(result, request, approvedRequestDigest) {
+    verifyResult(result, request, approvedRequestDigest, decision) {
         const errors = verifyFortemiDatasetRunReceipt(result.receipt);
         if (errors.length)
             throw new Error(`CONFORMANCE_FORTEMI_RECEIPT_INVALID:${errors.join(",")}`);
@@ -83,6 +115,11 @@ export class FortemiDatasetExecutionClient {
             || receipt.namespaceId !== object(object(request.plan).destination).dataset
             || receipt.state !== result.state || receipt.verification !== result.verification)
             throw new Error("CONFORMANCE_FORTEMI_RECEIPT_BINDING_MISMATCH");
+        if (receipt.capabilityDecision.accepted !== true
+            || canonicalFortemiDatasetJson(receipt.capabilityDecision.selected) !== canonicalFortemiDatasetJson(decision.selected)
+            || canonicalFortemiDatasetJson(receipt.capabilityDecision.degradations) !== canonicalFortemiDatasetJson(decision.degradations)) {
+            throw new Error("CONFORMANCE_FORTEMI_CAPABILITY_DECISION_MISMATCH");
+        }
         const plan = object(request.plan);
         const batch = object(request.batch);
         if (["planId", "sourceRevision", "mode", "planDigest", "configurationDigest", "transformationDigest"].some(key => receipt.bindings[key] !== plan[key])
@@ -96,6 +133,10 @@ export class FortemiDatasetExecutionClient {
             throw new Error("CONFORMANCE_FORTEMI_RECEIPT_BINDING_MISMATCH");
         return receipt;
     }
+    /** The decision AIWG negotiated for a run, not the one the server reported. */
+    capabilityDecision(runId) {
+        return structuredClone(this.knownRun(runId).decision);
+    }
     knownRun(runId) {
         const run = this.runs.get(runId);
         if (!run)
@@ -104,7 +145,7 @@ export class FortemiDatasetExecutionClient {
     }
     async retry(runId, action = "retry") {
         const run = this.knownRun(runId);
-        return this.verifyResult(await this.call(action, { runId }), run.request, run.digest);
+        return this.verifyResult(await this.call(action, { runId }), run.request, run.digest, run.decision);
     }
     async status(runId) {
         const run = this.knownRun(runId);
@@ -112,7 +153,7 @@ export class FortemiDatasetExecutionClient {
         if (result.runId !== runId)
             throw new Error("CONFORMANCE_FORTEMI_RECEIPT_BINDING_MISMATCH");
         if (result.receipt)
-            this.verifyResult(result, run.request, run.digest);
+            this.verifyResult(result, run.request, run.digest, run.decision);
         else if (result.state !== "running" || result.verification !== "pending")
             throw new Error("CONFORMANCE_FORTEMI_RESPONSE_INVALID");
         return result;

package/dist/src/dataset/fortemi-run-receipt.d.ts

@@ -29,6 +29,7 @@ export interface FortemiDatasetRunReceipt {
         after: Checkpoint;
     };
     capabilityDecision: {
+        accepted: boolean;
         selected: string[];
         degradations: unknown[];
     };

package/dist/src/dataset/fortemi-run-receipt.js

@@ -1,9 +1,8 @@
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
 import Ajv2020 from "ajv/dist/2020.js";
 import addFormats from "ajv-formats";
+import { fortemiPinnedSchemaPath } from "./fortemi-schema-path.js";
 /** Independent implementation of the Fortemi wire canonicalization contract. */
 export function canonicalFortemiDatasetJson(value) {
     if (value === null)
@@ -23,25 +22,9 @@ export function canonicalFortemiDatasetJson(value) {
 export function fortemiDatasetDigest(value) {
     return `sha256:${createHash("sha256").update(canonicalFortemiDatasetJson(value), "utf8").digest("hex")}`;
 }
-function schemaPath() {
-    let directory = dirname(fileURLToPath(import.meta.url));
-    for (;;) {
-        try {
-            const metadata = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
-            if (metadata.name === "aiwg" || metadata.name === "@aiwg/cli") {
-                return join(directory, "schemas/dataset/fortemi-run-receipt/validation-1.0.1/run-receipt.schema.json");
-            }
-        }
-        catch { /* Source and built installations have different depths. */ }
-        const parent = dirname(directory);
-        if (parent === directory)
-            throw new Error("FORTEMI_RECEIPT_SCHEMA_UNAVAILABLE");
-        directory = parent;
-    }
-}
 const ajv = new Ajv2020({ strict: true, allErrors: true });
 addFormats(ajv);
-const validate = ajv.compile(JSON.parse(readFileSync(schemaPath(), "utf8")));
+const validate = ajv.compile(JSON.parse(readFileSync(fortemiPinnedSchemaPath("schemas/dataset/fortemi-run-receipt/validation-1.0.1/run-receipt.schema.json"), "utf8")));
 /** Schema validity, semantic consistency, and checksum integrity; not issuer authentication. */
 export function verifyFortemiDatasetRunReceipt(value) {
     if (!validate(value))

package/dist/src/dataset/fortemi-schema-path.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Resolve a pinned external contract file shipped under `schemas/`.
+ * Source and built installations sit at different depths, so walk up to the
+ * package root instead of assuming a relative offset.
+ */
+export declare function fortemiPinnedSchemaPath(relativePath: string): string;
+//# sourceMappingURL=fortemi-schema-path.d.ts.map

package/dist/src/dataset/fortemi-schema-path.js

@@ -0,0 +1,24 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * Resolve a pinned external contract file shipped under `schemas/`.
+ * Source and built installations sit at different depths, so walk up to the
+ * package root instead of assuming a relative offset.
+ */
+export function fortemiPinnedSchemaPath(relativePath) {
+    let directory = dirname(fileURLToPath(import.meta.url));
+    for (;;) {
+        try {
+            const metadata = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
+            if (metadata.name === "aiwg" || metadata.name === "@aiwg/cli")
+                return join(directory, relativePath);
+        }
+        catch { /* Not the package root; keep walking. */ }
+        const parent = dirname(directory);
+        if (parent === directory)
+            throw new Error("FORTEMI_PINNED_SCHEMA_UNAVAILABLE");
+        directory = parent;
+    }
+}
+//# sourceMappingURL=fortemi-schema-path.js.map

package/dist/src/dataset/index.d.ts

@@ -13,6 +13,7 @@ export * from './orchestration-types.js';
 export * from './orchestration-repository.js';
 export * from './file-orchestration-repository.js';
 export * from './local-execution-backend.js';
+export * from './fortemi-capability.js';
 export * from './fortemi-execution-bridge.js';
 export * from './fortemi-live-qualification.js';
 export * from './fortemi-run-receipt.js';

package/dist/src/dataset/index.js

@@ -13,6 +13,7 @@ export * from './orchestration-types.js';
 export * from './orchestration-repository.js';
 export * from './file-orchestration-repository.js';
 export * from './local-execution-backend.js';
+export * from './fortemi-capability.js';
 export * from './fortemi-execution-bridge.js';
 export * from './fortemi-live-qualification.js';
 export * from './fortemi-run-receipt.js';

package/dist/src/extensions/project-local-doctor.js

@@ -173,7 +173,21 @@ export async function buildProjectLocalDoctorSection(opts) {
                         // Missing — not drift, deploy is just absent
                         continue;
                     }
-                    if (actualHash.normalized !== expectedHash && actualHash.raw !== expectedHash) {
+                    // "Differs from source" must be judged against the source, not only
+                    // against whichever rendering the registry recorded. A bundle can be
+                    // (re)deployed through a path that writes the source verbatim plus
+                    // the managed marker after the registry captured a transformed copy;
+                    // the deployed file then matches its source line-for-line while the
+                    // recorded hash never will (#2560). Accept the recorded deployed
+                    // hash, the recorded source hash, or the current source file.
+                    const accepted = new Set([expectedHash]);
+                    const recordedSourceHash = entry.artifactHashes?.[sourceRel];
+                    if (recordedSourceHash)
+                        accepted.add(recordedSourceHash);
+                    const currentSourceHash = await hashDeployed(join(bundle.artifactPath, sourceRel));
+                    if (currentSourceHash)
+                        accepted.add(currentSourceHash.normalized);
+                    if (!accepted.has(actualHash.normalized) && !accepted.has(actualHash.raw)) {
                         driftCount++;
                         driftLines.push(`    ✗ ${bundle.id} :: ${sourceRel} @ ${provider}  (deployed file differs from source)`);
                     }

package/dist/src/lint/cli.js

@@ -86,6 +86,9 @@ function parseArgs(args) {
         else if (arg === '--no-recursive') {
             options.recursive = false;
         }
+        else if (arg === '--no-gitignore') {
+            options.respectGitignore = false;
+        }
         else if (!arg.startsWith('-') && !options.target) {
             options.target = arg;
         }
@@ -123,7 +126,7 @@ export async function main(args) {
     }
     // Require a target for actual linting
     if (!options.target) {
-        console.error('Usage: aiwg lint <target> [--ruleset <name>] [--format full|summary|json] [--ci] [--fail-on error|warn|info]');
+        console.error('Usage: aiwg lint <target> [--ruleset <name>] [--format full|summary|json] [--ci] [--fail-on error|warn|info] [--no-gitignore]');
         console.error('       aiwg lint --list-rulesets');
         console.error('       aiwg lint --list-rules <ruleset>');
         process.exitCode = 1;
@@ -160,6 +163,7 @@ export async function main(args) {
     const result = await runLint(targetDir, selectedRulesets, {
         recursive: options.recursive,
         failOn: options.failOn,
+        respectGitignore: options.respectGitignore ?? true,
     });
     // Output results
     console.log(formatResult(result, options.format || 'full'));

package/dist/src/lint/reporters.js

@@ -37,7 +37,20 @@ function formatFull(result) {
     lines.push(`Target: ${result.target}`);
     lines.push(`Rulesets: ${result.rulesets.join(', ')}`);
     lines.push(`Files checked: ${result.summary.filesChecked}`);
+    lines.push(`Rules applied: ${result.summary.rulesApplied} of ${result.summary.rulesSelected}`);
     lines.push('');
+    // A target that excludes every rule produces the same clean output as a
+    // target that passes them, which is how 34 findings stayed invisible across a
+    // long session (#2555). Say so before the verdict.
+    if (result.summary.rulesSelected > 0 && result.summary.rulesApplied === 0) {
+        lines.push(`\x1b[33m! No rule applies to this target — 0 of ${result.summary.rulesSelected} selected rules matched any file here.\x1b[0m`);
+        lines.push(`  This is not a clean result. Lint a parent directory (the rules' globs are written from the project root), or check --ruleset.`);
+        lines.push('');
+    }
+    else if (result.summary.inapplicableRules.length > 0) {
+        lines.push(`\x1b[33m! ${result.summary.inapplicableRules.length} rule(s) matched no file here: ${result.summary.inapplicableRules.join(', ')}\x1b[0m`);
+        lines.push('');
+    }
     if (result.diagnostics.length === 0) {
         lines.push('\x1b[32m\u2714 No issues found\x1b[0m');
     }
@@ -81,6 +94,10 @@ function formatFull(result) {
 function formatSummary(result) {
     const lines = [];
     lines.push(`Lint: ${result.summary.filesChecked} files, ${result.summary.errors} errors, ${result.summary.warnings} warnings, ${result.summary.infos} info`);
+    lines.push(`Rules applied: ${result.summary.rulesApplied} of ${result.summary.rulesSelected}`);
+    if (result.summary.rulesSelected > 0 && result.summary.rulesApplied === 0) {
+        lines.push(`! No rule applies to this target — this is not a clean result (#2555).`);
+    }
     const statusIcon = result.summary.passed ? '\u2714 PASS' : '\u2718 FAIL';
     lines.push(`Result: ${statusIcon}`);
     return lines.join('\n');