@aiwg/cli 2026.9.9 → 2026.9.10

package/dist/src/lint/runner.js

@@ -7,6 +7,7 @@
  * @issue #810
  */
 import fs from 'fs';
+import { spawnSync } from 'child_process';
 import fsp from 'fs/promises';
 import path from 'path';
 import { glob } from 'glob';
@@ -29,6 +30,25 @@ function parseFrontmatter(content) {
     return result;
 }
 const DEFAULT_REFERENCE_PATTERN = '\\bREF-\\d{3,}\\b';
+/**
+ * Phrases that mark an identifier as deliberately absent (#2555). A mention
+ * next to one of these documents a gap rather than pointing at a document, so
+ * it is not an unresolved reference.
+ */
+export const DEFAULT_ABSENCE_MARKERS = [
+    '\\bunallocated\\b',
+    '\\bnot in corpus\\b',
+    '\\bskipped\\b',
+    '\\bretired\\b',
+    '\\bwithdrawn\\b',
+    '\\bdeliberately (?:absent|unallocated|skipped)\\b',
+    '\\bnever (?:allocated|assigned)\\b',
+    '\\bdeduplicat',
+];
+// Deliberately NOT markers: "does not exist", "missing", "no longer exists".
+// Those are how a broken reference is described, not how a corpus records an
+// intentional gap, and treating them as markers would suppress the finding this
+// check exists for.
 /**
  * Verification targets — things the inducting agent could have checked.
  *
@@ -92,6 +112,49 @@ export const DEFAULT_UNCERTAINTY_PATTERNS = [
     '\\bunconfirmed\\b',
     'rests on .{0,60} rather than an independent',
 ];
+/**
+ * A dated outcome closes an uncertainty (#2523's "records an outcome with a
+ * date"). The vocabulary is deliberately wider than a verb+date pair: the
+ * retraction convention recommended alongside this rule writes
+ * `~~<limitation>~~ **Done YYYY-MM-DD (<what closed it>).**`, which no
+ * verb+date pattern matches, so a correctly dated retraction was rejected for
+ * its shape (#2556).
+ */
+export const DATED_OUTCOME_PATTERN = '(?:\\b(?:done|resolved|completed|closed|addressed|fixed|verified|retrieved|archived|queried|fetched|checked|probed|confirmed)\\b[^\\n]{0,60}?\\d{4}-\\d{2}-\\d{2}|\\d{4}-\\d{2}-\\d{2}[^\\n]{0,30}?\\b(?:done|resolved|completed|closed|addressed|fixed)\\b)';
+/**
+ * The closure half of {@link DATED_OUTCOME_PATTERN}. Only explicit closure
+ * verbs count outside a struck span: a date sitting anywhere near an action
+ * verb ("...was not retrieved at induction. Induction ran 2026-09-01.") is not
+ * an outcome, and treating it as one would discharge the very statements this
+ * rule exists to catch.
+ */
+export const CLOSURE_OUTCOME_PATTERN = '(?:\\b(?:done|resolved|completed|closed|addressed|fixed)\\b[^\\n]{0,60}?\\d{4}-\\d{2}-\\d{2}|\\d{4}-\\d{2}-\\d{2}[^\\n]{0,30}?\\b(?:done|resolved|completed|closed|addressed|fixed)\\b)';
+/**
+ * Spans struck through with `~~…~~` are, by the markup's own meaning, no longer
+ * asserted. When a dated outcome follows the span on the same line, the pair is
+ * a completed retraction however long the struck text is — the length of the
+ * struck span was the hidden variable behind #2556.
+ */
+function retractedWithDatedOutcome(line) {
+    const dated = new RegExp(DATED_OUTCOME_PATTERN, 'i');
+    const strikethrough = /~~([\s\S]*?)~~/g;
+    let match;
+    while ((match = strikethrough.exec(line)) !== null) {
+        if (dated.test(line.slice(match.index + match[0].length)))
+            return true;
+    }
+    return false;
+}
+/** Character offsets of every `~~…~~` span on a line. */
+function strikethroughSpans(line) {
+    const spans = [];
+    const strikethrough = /~~([\s\S]*?)~~/g;
+    let match;
+    while ((match = strikethrough.exec(line)) !== null) {
+        spans.push({ start: match.index, end: match.index + match[0].length });
+    }
+    return spans;
+}
 export const DEFAULT_OBSTACLE_PATTERNS = [
     '\\bHTTP\\s?[45]\\d{2}\\b',
     '\\b(?:401|403|404|429|451|503)\\b',
@@ -122,6 +185,9 @@ export const DEFAULT_OBSTACLE_PATTERNS = [
     'status:\\s*(?:incomplete|blocked)',
     '\\b(?:queried|fetched|checked|probed|confirmed|resolved)\\s+(?:on\\s+)?\\d{4}-\\d{2}-\\d{2}',
     '\\bdeferred\\b.{0,40}\\b(?:because|since|due to)\\b',
+    // An explicit dated closure ("**Done 2026-09-12 (post-induction audit).**"),
+    // which the verb+date pattern above does not match (#2556).
+    CLOSURE_OUTCOME_PATTERN,
 ];
 /**
  * Build a target-wide artifact ID index once per lint run.
@@ -211,11 +277,19 @@ function runCheck(check, content, frontmatter, filePath, targetDir, allFiles, re
             const refPattern = check.referencePattern || DEFAULT_REFERENCE_PATTERN;
             const regex = new RegExp(refPattern, 'g');
             const lines = content.split('\n');
+            const absence = (check.absenceMarkers ?? DEFAULT_ABSENCE_MARKERS).map((p) => new RegExp(p, 'i'));
             for (let i = 0; i < lines.length; i++) {
                 let match;
                 while ((match = regex.exec(lines[i])) !== null) {
                     const refId = match[0];
                     const basePath = check.basePath || '.aiwg/research/findings';
+                    // A corpus documents its deliberate gaps ("REF-2464 remains
+                    // unallocated after deduplication"). Reading that sentence as a
+                    // dangling reference left only two ways to silence an error: delete
+                    // accurate documentation, or allocate a REF that is deliberately
+                    // absent (#2555).
+                    if (absence.some((re) => re.test(lines[i])))
+                        continue;
                     if (!referenceIndex.has(refId) && !resolvesFromBasePath(refId, targetDir, basePath)) {
                         diagnostics.push({
                             ruleId: '',
@@ -254,6 +328,15 @@ function runCheck(check, content, frontmatter, filePath, targetDir, allFiles, re
                 const clause = splitClauses(lines[i]).find((c) => uncertainty.some((re) => re.test(c)) && targets.some((re) => re.test(c)));
                 if (!clause)
                     continue;
+                // A struck span followed by a dated outcome is a completed retraction,
+                // whatever its length. Clause scoping otherwise ends the window before
+                // the `**Done <date>**` that closes it, so the recommended convention
+                // failed for two-sentence struck text and passed for one (#2556).
+                const clauseAt = lines[i].indexOf(clause);
+                const struck = clauseAt >= 0 && strikethroughSpans(lines[i])
+                    .some((span) => clauseAt >= span.start && clauseAt < span.end);
+                if (struck && retractedWithDatedOutcome(lines[i]))
+                    continue;
                 // Look in the matching line and the following `within` lines: the
                 // obstacle normally sits in the same sentence or the next one.
                 const window = lines.slice(i, i + within + 1).join(' ');
@@ -269,7 +352,7 @@ function runCheck(check, content, frontmatter, filePath, targetDir, allFiles, re
                     file: filePath,
                     line: i + 1,
                     message: `Uncertainty stated without a named obstacle or recorded outcome: ${clause.trim().slice(0, 160)}`,
-                    fix: 'Resolve it if it costs about one request against a known endpoint, or name the specific obstacle (HTTP status, credential required, rate limited, paywalled) so it lands as incomplete/blocked rather than narrative.',
+                    fix: 'Resolve it if it costs about one request against a known endpoint, or name the specific obstacle (HTTP status, credential required, rate limited, paywalled) so it lands as incomplete/blocked rather than narrative. If the check has since been done, retract the statement with the dated form — `~~<original limitation>~~ **Done YYYY-MM-DD (<what closed it>).** <evidence>` — which closes it whatever the length of the struck text.',
                 });
             }
             break;
@@ -361,16 +444,44 @@ function runCheck(check, content, frontmatter, filePath, targetDir, allFiles, re
     }
     return diagnostics;
 }
+/**
+ * Candidate paths a rule glob may be written against (#2555).
+ *
+ * `collectFiles` walks with `cwd: targetDir`, so files arrive target-relative
+ * (`REF-001.md`) while rule globs are written repo-relative
+ * (`documentation/references/**\/*.md`). Narrowing the target to the very
+ * directory a rule names therefore matched nothing, and the run reported PASS
+ * with every finding unreported. Matching against the target-relative path and
+ * each ancestor-prefixed form makes a glob resolve the same way wherever the
+ * walk is rooted.
+ */
+export function ruleMatchCandidates(file, targetDir) {
+    const normalizedFile = file.replace(/\\/g, '/');
+    const candidates = [normalizedFile];
+    const segments = path.resolve(targetDir).replace(/\\/g, '/').split('/').filter(Boolean);
+    let prefix = '';
+    for (let i = segments.length - 1; i >= 0 && segments.length - i <= 12; i -= 1) {
+        prefix = prefix ? `${segments[i]}/${prefix}` : `${segments[i]}/`;
+        candidates.push(`${prefix}${normalizedFile}`);
+    }
+    return candidates;
+}
+/** True when a rule's glob selects this file, wherever the walk was rooted. */
+export function ruleAppliesToFile(ruleGlob, file, targetDir) {
+    return ruleMatchCandidates(file, targetDir).some((candidate) => minimatch(candidate, ruleGlob));
+}
 /**
  * Run a single rule against all matching files in the target
  */
 async function runRule(rule, targetDir, allFiles, referenceIndex) {
     const diagnostics = [];
+    RULE_APPLIED.delete(rule.id);
     // Filter files matching the rule's glob
     const ruleGlob = rule.appliesTo.glob;
-    const matchingFiles = allFiles.filter(f => minimatch(f, ruleGlob));
+    const matchingFiles = allFiles.filter(f => ruleAppliesToFile(ruleGlob, f, targetDir));
     if (matchingFiles.length === 0)
         return diagnostics;
+    RULE_APPLIED.add(rule.id);
     // Handle id-unique check at the ruleset level
     const uniqueCheck = rule.checks.find(c => c.type === 'id-unique');
     if (uniqueCheck) {
@@ -416,10 +527,12 @@ async function runRule(rule, targetDir, allFiles, referenceIndex) {
     }
     return diagnostics;
 }
+/** Rule ids that selected at least one file in the current run (#2555). */
+const RULE_APPLIED = new Set();
 /**
  * Collect all files under a target directory
  */
-async function collectFiles(targetDir, recursive) {
+async function collectFiles(targetDir, recursive, respectGitignore = true) {
     const pattern = recursive ? '**/*' : '*';
     try {
         const files = await glob(pattern, {
@@ -427,12 +540,44 @@ async function collectFiles(targetDir, recursive) {
             nodir: true,
             dot: false,
         });
-        return files.filter(f => f.endsWith('.md') || f.endsWith('.yaml') || f.endsWith('.yml') || f.endsWith('.json'));
+        const linted = files.filter(f => f.endsWith('.md') || f.endsWith('.yaml') || f.endsWith('.yml') || f.endsWith('.json'));
+        return respectGitignore ? dropGitignored(targetDir, linted) : linted;
     }
     catch {
         return [];
     }
 }
+/**
+ * Drop files git ignores (#2555).
+ *
+ * Generated trees are regenerated, not authored: linting `indices/` reported an
+ * error in text that documents a deliberate gap. `git check-ignore` is asked
+ * once for the whole set so the semantics are git's own (negations, nested
+ * `.gitignore`, `core.excludesFile`) rather than a re-implementation. Outside a
+ * repository, or without git, every file is kept.
+ */
+function dropGitignored(targetDir, files) {
+    if (files.length === 0)
+        return files;
+    try {
+        const result = spawnSync('git', ['check-ignore', '--stdin'], {
+            cwd: targetDir,
+            input: `${files.join('\n')}\n`,
+            encoding: 'utf8',
+        });
+        // 0 = some paths ignored, 1 = none ignored, anything else = not a repo or
+        // git unavailable, in which case nothing is filtered.
+        if (result.error || (result.status !== 0 && result.status !== 1))
+            return files;
+        const ignored = new Set((result.stdout ?? '').split('\n').map((line) => line.trim()).filter(Boolean));
+        if (ignored.size === 0)
+            return files;
+        return files.filter((file) => !ignored.has(file));
+    }
+    catch {
+        return files;
+    }
+}
 /**
  * Auto-detect which rulesets apply to a target path
  *
@@ -464,12 +609,17 @@ function autoDetectRulesets(target, available) {
  */
 export async function runLint(targetDir, rulesets, options = {}) {
     const recursive = options.recursive ?? true;
-    const allFiles = await collectFiles(targetDir, recursive);
+    const allFiles = await collectFiles(targetDir, recursive, options.respectGitignore ?? true);
     const referenceIndex = buildReferenceIndex(allFiles);
     const allDiagnostics = [];
+    const inapplicableRules = [];
+    let rulesSelected = 0;
     for (const ruleset of rulesets) {
         for (const rule of ruleset.rules) {
+            rulesSelected += 1;
             const diagnostics = await runRule(rule, targetDir, allFiles, referenceIndex);
+            if (!RULE_APPLIED.has(rule.id))
+                inapplicableRules.push(rule.id);
             allDiagnostics.push(...diagnostics);
         }
     }
@@ -494,6 +644,11 @@ export async function runLint(targetDir, rulesets, options = {}) {
             warnings,
             infos,
             passed,
+            // A run where no rule selected a file must never read the same as a clean
+            // run (#2555). Reporters surface this; callers can gate on it.
+            rulesSelected,
+            rulesApplied: rulesSelected - inapplicableRules.length,
+            inapplicableRules,
         },
         timestamp: new Date().toISOString(),
     };

package/dist/src/policy/authorization.js

@@ -113,7 +113,7 @@ export function evaluateAuthorization(model, request) {
 }
 export function validateAuthorization(model) {
     if (!model)
-        return [{ severity: 'warning', code: 'authorization-missing', message: 'No normalized authorization block; run steward permissions audit.' }];
+        return [{ severity: 'warning', code: 'authorization-missing', message: 'No normalized authorization block; default deny applies. Write one with `aiwg steward permissions migrate --apply`.' }];
     const out = [];
     if (model.version !== '1')
         out.push({ severity: 'error', code: 'version', message: `Unsupported authorization version: ${model.version}` });

package/dist/src/smiths/context-pipeline/workspace-context.js

@@ -387,7 +387,8 @@ export function buildWorkspaceManagedBlock(projectPath, providerFiles = []) {
         '',
         '- Edit project-neutral notes only inside the protected Project Context section below.',
         '- Keep detailed policies, runbooks, hooks, and quickrefs in linked files.',
-        '- Keep provider-only directives in `.aiwg/context/providers/`.',
+        '- `.aiwg/context/providers/` is reference only: no provider bootstrap auto-loads it.',
+        '  Put directives you want read into Project Context above.',
         '- Never store secrets, tokens, credentials, or machine-local sensitive values here.',
         '',
         '### Artifact Routing',
@@ -425,11 +426,16 @@ export async function ensureWorkspaceContext(projectPath, options = {}) {
     const workspacePath = path.join(projectPath, 'WORKSPACE.md');
     const warnings = [];
     const existing = await readOptional(workspacePath);
+    // `aiwg use` and `aiwg regenerate` rebuild the managed block without
+    // knowing about earlier migrations. Rediscover the migrated provider files
+    // so their links survive every regeneration instead of only the one that
+    // wrote them (#2558).
+    const providerFiles = options.providerFiles ?? await migratedProviderFiles(projectPath);
     if (existing === null) {
-        await atomicWrite(workspacePath, buildWorkspaceDocument(projectPath, '', options.providerFiles));
+        await atomicWrite(workspacePath, buildWorkspaceDocument(projectPath, '', providerFiles));
         return { path: workspacePath, action: 'created', warnings };
     }
-    const block = buildWorkspaceManagedBlock(projectPath, options.providerFiles);
+    const block = buildWorkspaceManagedBlock(projectPath, providerFiles);
     if (existing.includes(WORKSPACE_MANAGED_START) || existing.includes(WORKSPACE_MANAGED_END)) {
         let updated = replaceBlock(existing, WORKSPACE_MANAGED_START, WORKSPACE_MANAGED_END, block);
         // A managed project-extraction block explicitly points operators back to
@@ -451,7 +457,7 @@ export async function ensureWorkspaceContext(projectPath, options = {}) {
     }
     const backupPath = `${workspacePath}.bak.${new Date().toISOString().replace(/[:.]/g, '-')}`;
     await fs.writeFile(backupPath, existing, 'utf8');
-    await atomicWrite(workspacePath, buildWorkspaceDocument(projectPath, existing, options.providerFiles));
+    await atomicWrite(workspacePath, buildWorkspaceDocument(projectPath, existing, providerFiles));
     return { path: workspacePath, action: 'updated', backupPath, warnings };
 }
 export function buildProviderBootstrapBlock(provider) {
@@ -695,29 +701,29 @@ export async function auditWorkspaceContext(projectPath) {
         .filter(([, values]) => new Set(values.map((value) => value.polarity)).size > 1)
         .map(([key, values]) => ({ key, sources: values.map(({ path: sourcePath, directive }) => ({ path: sourcePath, directive })).sort((a, b) => a.path.localeCompare(b.path)) }));
     const rootOperator = sources.filter((source) => source.scope === 'root' && source.operatorContent.trim());
-    // Provider startup roots remain attributed provider context even when one
-    // directive is duplicated elsewhere. Promoting an entire root file because
-    // of one matching line can copy large provider/framework bodies into the
-    // provider-neutral WORKSPACE.md operator region.
-    const neutralSources = rootOperator.filter((source) => source.path === 'WORKSPACE.md').map((source) => source.path);
-    const providerSources = rootOperator.filter((source) => source.path !== 'WORKSPACE.md' && !neutralSources.includes(source.path)).map((source) => source.path);
-    const providerOutputs = providerSources.map((source) => providerContextOutput(projectPath, source));
+    // Provider startup files (CLAUDE.md, AGENTS.md, WARP.md, …) are bootstrap
+    // surfaces: AIWG rewrites them to a managed bootstrap that `@`-imports
+    // WORKSPACE.md. The operator content they carried therefore ports into the
+    // WORKSPACE.md operator block, which every provider bootstrap loads and
+    // which `aiwg use` and `aiwg regenerate` preserve byte-for-byte. Routing
+    // it to `.aiwg/context/providers/` instead left it linked but never
+    // loaded, and a later `aiwg use` dropped even the link (#2558).
+    const neutralSources = rootOperator.map((source) => source.path);
+    const providerSources = [];
+    const providerOutputs = [];
     const workspaceExists = sources.some((source) => source.path === 'WORKSPACE.md');
-    // Filename is the default scope signal, but a project that used CLAUDE.md as its
-    // main context file before WORKSPACE.md existed has project-neutral methodology in
-    // a provider-named file. Report volume and destination per source, and surface the
-    // substantial ones as a decision rather than routing them silently (#2537).
-    const routing = rootOperator.map((source) => {
-        const neutral = neutralSources.includes(source.path);
-        return {
-            source: source.path,
-            operatorBytes: Buffer.byteLength(source.operatorContent, 'utf8'),
-            destination: neutral ? 'WORKSPACE.md' : providerContextOutput(projectPath, source.path),
-            scope: neutral ? 'project-neutral' : `${source.provider ?? 'provider'}-only`,
-            provider: neutral ? null : source.provider,
-        };
-    }).sort((a, b) => b.operatorBytes - a.operatorBytes);
-    const scopeReview = routing.filter((entry) => entry.scope !== 'project-neutral' && entry.operatorBytes >= SCOPE_REVIEW_BYTES);
+    // Report volume and destination per source. A substantial provider-named
+    // body is still surfaced for review (#2537): it now lands where every
+    // provider reads it, so anything genuinely provider-only should be moved to
+    // `.aiwg/context/providers/` by the operator after migration.
+    const routing = rootOperator.map((source) => ({
+        source: source.path,
+        operatorBytes: Buffer.byteLength(source.operatorContent, 'utf8'),
+        destination: 'WORKSPACE.md',
+        scope: 'project-neutral',
+        provider: source.path === 'WORKSPACE.md' ? null : source.provider,
+    })).sort((a, b) => b.operatorBytes - a.operatorBytes);
+    const scopeReview = routing.filter((entry) => entry.source !== 'WORKSPACE.md' && entry.operatorBytes >= SCOPE_REVIEW_BYTES);
     return {
         version: 1,
         projectPath,
@@ -742,34 +748,48 @@ export async function auditWorkspaceContext(projectPath) {
 function projectOutputPath(projectPath, absPath) {
     return path.relative(projectPath, absPath).replace(/\\/g, '/');
 }
-function providerContextOutput(projectPath, sourcePath) {
-    return projectOutputPath(projectPath, projectAiwgPath(projectPath, 'context', 'providers', sourcePath.replace(/[^A-Za-z0-9.-]+/g, '-').replace(/^-+/, '')));
-}
+const LEGACY_PROJECT_CONTEXT_PLACEHOLDER = [
+    '## Project Context',
+    '',
+    'Add provider-neutral project conventions and links here.',
+].join('\n');
+/**
+ * Operator content for the WORKSPACE.md operator block after migration.
+ *
+ * Existing WORKSPACE.md operator content is kept verbatim; the operator body
+ * of each provider startup file is appended once, verbatim, under an
+ * attributed heading. Tables, procedures, and code blocks survive intact —
+ * the earlier line-flattened directive list lost exactly the runbook content
+ * operators keep in CLAUDE.md (#2558). Re-running the migration is a no-op:
+ * a body that already appears in the block is not appended again.
+ */
 function neutralMigrationContent(audit) {
-    const selected = audit.sources.filter((source) => audit.plan.neutralSources.includes(source.path));
-    const seen = new Set();
-    const lines = ['## Project Context', ''];
-    for (const source of selected) {
-        const unique = directives(source.operatorContent).filter((directive) => !seen.has(directive));
-        for (const directive of unique)
-            seen.add(directive);
-        if (unique.length === 0)
+    const workspace = audit.sources.find((source) => source.path === 'WORKSPACE.md');
+    let base = workspace?.operatorContent.trim() ?? '';
+    if (base === PROJECT_CONTEXT_PLACEHOLDER || base === LEGACY_PROJECT_CONTEXT_PLACEHOLDER)
+        base = '';
+    const sections = [];
+    let accumulated = base;
+    for (const source of audit.sources) {
+        if (source.path === 'WORKSPACE.md' || !audit.plan.neutralSources.includes(source.path))
+            continue;
+        const body = source.operatorContent.trim();
+        if (!body || accumulated.includes(body))
             continue;
-        lines.push(`### From ${source.path}`, '', ...unique.map((directive) => `- ${directive}`), '');
+        sections.push([
+            `### Migrated from ${source.path}`,
+            '',
+            `Source attribution: migrated from \`${source.path}\`; checksum \`${source.checksum}\`.`,
+            '',
+            body,
+        ].join('\n'));
+        accumulated = `${accumulated}\n${body}`;
     }
-    if (lines.length === 2)
-        lines.push('Add project conventions, local hook/context pointers, and links to deeper project documents here.');
-    return lines.join('\n').trim();
-}
-function providerMigrationContent(source) {
-    return [
-        `# Provider-specific context from ${source.path}`,
-        '',
-        `Source attribution: migrated from \`${source.path}\`; checksum \`${source.checksum}\`.`,
-        '',
-        source.operatorContent.trim() || '(No operator-authored content remained after managed blocks were removed.)',
-        '',
-    ].join('\n');
+    const parts = [base || '## Project Context', ...sections];
+    if (!base && sections.length === 0) {
+        parts.push('Add project conventions, local hook/context pointers, and links to deeper project documents here.');
+    }
+    return parts.join('\n\n').trim();
 }
 async function configuredProviders(projectPath) {
     try {
@@ -784,17 +804,8 @@ async function configuredProviders(projectPath) {
 }
 async function stageMigrationWrites(projectPath, audit, options = {}) {
     const writes = new Map();
-    for (const source of audit.sources.filter((item) => audit.plan.providerSources.includes(item.path))) {
-        writes.set(providerContextOutput(projectPath, source.path), providerMigrationContent(source));
-    }
-    const providerFiles = [...new Set([
-            ...audit.sources.filter((source) => source.path.replace(/\\/g, '/').includes('/context/providers/')).map((source) => source.path),
-            ...writes.keys(),
-        ])].sort();
-    const existingWorkspace = audit.sources.find((source) => source.path === 'WORKSPACE.md');
-    let workspaceOperatorContent = existingWorkspace?.managed
-        ? existingWorkspace.operatorContent
-        : neutralMigrationContent(audit);
+    const providerFiles = [...new Set(audit.sources.filter((source) => source.path.replace(/\\/g, '/').includes('/context/providers/')).map((source) => source.path))].sort();
+    let workspaceOperatorContent = neutralMigrationContent(audit);
     if (options.extractProject) {
         const extracted = await extractExistingProjectContext(projectPath);
         workspaceOperatorContent = mergeProjectExtraction(workspaceOperatorContent, extracted.content);
@@ -1061,8 +1072,36 @@ export async function diagnoseWorkspaceContext(projectPath) {
     for (const conflict of audit.conflicts) {
         diagnostics.push({ severity: 'error', code: 'directive-conflict', message: `Conflicting duplicate directive group '${conflict.key}' appears in ${conflict.sources.map((source) => source.path).join(', ')}.` });
     }
+    // One diagnostic per source pair, not one per duplicated line: a shared
+    // pointer stub otherwise reports every line as a separate policy conflict
+    // and degrades the workspace over content that agrees with itself (#2558).
+    const duplicatesByPair = new Map();
     for (const overlap of audit.identical) {
-        diagnostics.push({ severity: 'warning', code: 'duplicate-directive', message: `Identical directive is duplicated across ${overlap.sources.join(', ')}.` });
+        const key = overlap.sources.join(', ');
+        duplicatesByPair.set(key, (duplicatesByPair.get(key) ?? 0) + overlap.directives.length);
+    }
+    const operatorBodies = new Map(audit.sources.map((source) => [source.path, source.operatorContent.trim()]));
+    for (const [pair, count] of duplicatesByPair) {
+        const paths = pair.split(', ');
+        const bodies = paths.map((item) => operatorBodies.get(item) ?? '');
+        const wholeFileDuplicate = bodies.every((body) => body.length > 0 && body === bodies[0]);
+        diagnostics.push({
+            severity: wholeFileDuplicate ? 'info' : 'warning',
+            code: 'duplicate-directive',
+            message: wholeFileDuplicate
+                ? `${pair} carry identical operator content (${count} directive(s)); keep one copy or accept the shared stub.`
+                : `${count} identical directive(s) duplicated across ${pair}.`,
+        });
+    }
+    for (const source of audit.sources) {
+        if (!source.path.replace(/\\/g, '/').includes('/context/providers/') || !source.operatorContent.trim())
+            continue;
+        diagnostics.push({
+            severity: 'info',
+            code: 'provider-context-not-loaded',
+            message: `${source.path} is linked from WORKSPACE.md but no provider bootstrap auto-loads it; move its operator content into the WORKSPACE.md Project Context section (\`aiwg regenerate --existing-project\` ports startup files there) or keep it as reference only.`,
+            path: source.path,
+        });
     }
     for (const finding of audit.sensitiveFindings) {
         diagnostics.push({ severity: 'error', code: 'possible-secret', message: 'Possible credential value found in context; remove it.', path: finding.path });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.9.9",
+  "version": "2026.9.10",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",

package/schemas/dataset/fortemi-capability-validation/1.0.1/authority.json

@@ -0,0 +1,61 @@
+{
+  "contract": "fortemi.dataset-capability-validation/v1",
+  "revision": "1.0.1",
+  "wireContract": "fortemi.dataset-execution-capabilities/v1",
+  "wireSchemaVersion": "1.0.0",
+  "consumerIssue": 2242,
+  "authority": {
+    "repository": "Fortemi/fortemi-react",
+    "issue": "https://git.integrolabs.net/Fortemi/fortemi-react/issues/422",
+    "commit": "5625215762a8fd06db8fef4ccedd87f3c370ec31",
+    "mergedCommit": "35edcd9f8429fcd91a417021cbe4c427f900ed73",
+    "path": "packages/core/schemas/dataset-execution-capabilities/validation/1.0.1",
+    "manifestSha256": "20b59bb871c3afc9bb972896b2a2da718970c6fe7ef54b49000418f62a5701c0"
+  },
+  "files": [
+    {
+      "path": "capability.schema.json",
+      "authorityPath": "schema.json",
+      "sha256": "a4e9b427da669a02e83db00d39f48c2e106770d6cd2ec1b717938c57793b754c"
+    },
+    {
+      "path": "../../../../test/fixtures/dataset/fortemi-capability/negotiation-vectors.json",
+      "authorityPath": "negotiation-vectors.json",
+      "sha256": "2793990a842d5969f1f64c90170ab97ca4ffc4b93d1302a2f358fae54631a6dc"
+    },
+    {
+      "path": "../../../../test/fixtures/dataset/fortemi-capability/wire-vectors.json",
+      "authorityPath": "wire-vectors.json",
+      "sha256": "c52d32d0b1d0d312cf8b242f11fc116c47d104a74112cbd5d0019e6d39df9744"
+    }
+  ],
+  "consumer": {
+    "repository": "roctinam/aiwg",
+    "implementation": "src/dataset/fortemi-capability.ts",
+    "binding": "src/dataset/fortemi-dataset-execution.ts",
+    "test": "test/unit/dataset/fortemi-capability.test.ts",
+    "boundary": "Independent AIWG implementation of the wire rules. AIWG never imports the producer's validator; agreement is established by the shared authority vectors."
+  },
+  "observedDescriptor": {
+    "source": "Fortemi/fortemi mcp-server/lib/dataset-execution.js buildDatasetExecutionDescriptor",
+    "commit": "a701847db779a0a3adfa36a09dfa1055a10a0a0a",
+    "fixture": "test/fixtures/dataset/fortemi-capability/server-descriptor.json",
+    "sha256": "66ee315912429645e97c77a96e3f5110fe9db5e6909ff3c39e8b6e22135d8b95",
+    "runtimeVersion": "2026.9.10",
+    "qualification": "Descriptor rendered from pinned producer source; not a released-artifact or live-session receipt."
+  },
+  "qualification": {
+    "status": "source-consumer-adoption",
+    "covers": [
+      "advertised capability descriptor validation before preview or execute",
+      "independent negotiation bound to the advertised descriptor",
+      "receipt capabilityDecision bound to that independent negotiation"
+    ],
+    "remaining": [
+      "clean installed and released consumer qualification",
+      "live Fortemi Server session evidence under roctinam/aiwg#2194 authorization"
+    ],
+    "maturity": "alpha",
+    "suiteAudit": "NO-GO"
+  }
+}