@awebai/oats 0.24.2 → 0.24.3

package/bin/oats.mjs

@@ -49,6 +49,10 @@ import { receiveAttachment, uploadAttachment, readStreamBounded, MAX_ATTACHMENT_
 import { capturedSelector } from "../lib/captured-selector.mjs";
 import { inspectCapturedPiOutcome } from "../lib/captured-pi-host.mjs";
 import { readCapturedResolution } from "../lib/captured-resolutions.mjs";
+import { readLock3 } from "../lib/portable-lock.mjs";
+import { oatsError } from "../lib/errors.mjs";
+import { readPortableBytes } from "../lib/portable-files.mjs";
+import { canonicalJson, parseStrictJson } from "../lib/portable-values.mjs";
 import { readPortablePreparationRequest } from "../lib/portable-onboarding-request.mjs";
 import { portableScope } from "../lib/portable-state.mjs";
 import { CAPTURED_OPERATION_TIMEOUT_MS, runCapturedOperationProcess } from "../lib/captured-operation-process.mjs";
@@ -99,15 +103,40 @@ const jsonOk = (result) => { console.log(JSON.stringify({ schemaVersion: 1, ok:
 
 function inspectOnboardingCmd() {
   const fail = (code, message) => JSON_MODE ? jsonFail(code, message) : die(message);
-  let file;
+  const values = new Map();
   for (let index = 1; index < args.length; index++) {
     if (args[index] === "--json") continue;
-    if (args[index] !== "--request" || file !== undefined || !args[index + 1] || args[index + 1].startsWith("--")) fail("E_BAD_ARGS", "source inspection accepts one --request <absolute-json> and --json only");
-    file = args[++index];
+    const key = args[index];
+    if (!["--request", "--emit-prepare-request"].includes(key) || values.has(key) || !args[index + 1] || args[index + 1].startsWith("--")) fail("E_BAD_ARGS", "source inspection accepts one --request <absolute-json>, optional --emit-prepare-request <new-absolute-json>, and --json");
+    values.set(key, args[++index]);
   }
   try {
-    const input = readPortablePreparationRequest({ file });
-    const result = inspectPortableOnboarding(input);
+    const output = values.get("--emit-prepare-request");
+    let parent;
+    const checkOutput = () => {
+      if (!isAbsolute(output) || resolve(output) !== output || output.includes("\0")) throw oatsError("E_BAD_ARGS", "prepare-request output needs a normalized absolute path");
+      let stat;
+      try {
+        stat = lstatSync(dirname(output));
+        if (!stat.isDirectory() || realpathSync(dirname(output)) !== dirname(output)) throw new Error();
+      } catch { throw oatsError("E_BAD_ARGS", "prepare-request output parent must be an existing real directory"); }
+      if (parent && (parent.dev !== stat.dev || parent.ino !== stat.ino)) throw oatsError("selection-changed", "prepare-request output parent changed during inspection");
+      try { lstatSync(output); }
+      catch (error) { if (error.code === "ENOENT") return stat; throw oatsError("E_BAD_ARGS", "prepare-request output could not be checked"); }
+      throw oatsError("E_BAD_ARGS", "prepare-request output already exists; choose a new file (nothing overwritten)");
+    };
+    if (output !== undefined) parent = checkOutput();
+    const input = readPortablePreparationRequest({ file: values.get("--request") });
+    const { prepareRequest, ...view } = inspectPortableOnboarding(input, { includePrepareRequest: output !== undefined });
+    let result = view;
+    if (output !== undefined) {
+      checkOutput();
+      try { writeFileSync(output, canonicalJson(prepareRequest) + "\n", { flag: "wx", mode: 0o600 }); }
+      catch { throw oatsError("E_BAD_ARGS", "prepare-request output could not be created exclusively; no existing file was overwritten"); }
+      const deployment = view.deployment.deployment.path;
+      result = { ...view, prepareRequestFile: output, effects: { ...view.effects, requestFileWrite: true,
+        deploymentWrites: output === deployment || output.startsWith(deployment + sep) } };
+    }
     if (JSON_MODE) jsonOk(result); else console.log(JSON.stringify(result, null, 2));
   } catch (error) { fail(error.code || "E_INSPECT_FAILED", error.message); }
 }
@@ -2446,6 +2475,28 @@ function trust() {
   if (!id || id.startsWith("--")) { cmdFail("E_USAGE", "usage: oats trust <capability> [--dir <dir>] | oats trust <package> --all-capabilities [--dir <dir>]"); return; }
   const dir = dirFlag();
   const all = args.includes("--all-capabilities");
+  // A v3 deployment needs an EXPLICIT immutable artifact-set selection. Never
+  // guess one or reinterpret its lock through the classic approval engine.
+  try {
+    for (const scope of lockLevelsUp(dir).reverse()) {
+      // Discriminate with the shared bounded decoder only. Classic readers
+      // retain all v1/v2 validation, including implicit (versionless) v1 locks.
+      let version;
+      try { version = parseStrictJson(readPortableBytes(join(scope, OATS_LOCK_FILE)))?.lockfileVersion; }
+      catch { continue; } // Let the existing classic reader diagnose its input.
+      if (version !== 3) continue;
+      const portable = readLock3(scope).lock;
+      if (!portable) throw oatsError("selection-changed", "selection lock disappeared; repeat explicit trust selection");
+      const sets = [...new Set(Object.values(portable.selections).map(row => row.available).filter(key => key && Object.hasOwn(portable.artifactSets[key].capabilities, id)))].sort();
+      const commands = sets.map(artifactSet => ({ artifactSet,
+        command: `oats trust ${shellQuote(id)} --deployment ${shellQuote(scope)} --artifact-set ${shellQuote(artifactSet)}` }));
+      const message = commands.length && !all
+        ? `lock v3 requires exact artifact-set approval; run ${commands.map(item => item.command).join(" or ")}`
+        : `lock v3 approvals are per capability; use prepare's selections[].artifactSet for each capability in approvalRequired[]: oats trust <capability> --deployment ${shellQuote(scope)} --artifact-set <sha256-artifact-set>`;
+      if (JSON_MODE) jsonFail("needs-configuration", message, { deployment: scope, commands });
+      die(message);
+    }
+  } catch (error) { cmdFail(error.code || "invalid-lock", error.message); return; }
   // Package-backed approval path (per-capability, or explicit bulk on a package id).
   let pkgs, locks;
   try { pkgs = listInstalledPackages(dir); locks = readPackageLocks(dir); } catch (e) { cmdFail(e.code || "invalid-lock", e.message || e); return; }
@@ -5361,8 +5412,10 @@ The turn record (core — every conversation captured, searchable, replicated):
                                             packages/experimental/README.md
 
   oats inspect --request <absolute-json-file> [--json]
-                                            read-only fresh source/workspace/member metadata;
-                                            no current config, provider execution or preparation authority
+      [--emit-prepare-request <new-absolute-json-file>]
+                                            fresh source/workspace/member metadata; optional private
+                                            request export uses the existing fresh-request builder;
+                                            no provider execution or preparation authority
   oats prepare --request <absolute-json-file> [--json]
                                             complete public preparation input; no mixed flags,
                                             inherited binding, implicit setup or launch authority
@@ -5374,6 +5427,10 @@ The turn record (core — every conversation captured, searchable, replicated):
                                             same preparation through workspace imports
   oats inspect --deployment <abs> --resolution <id> [--composition] [--json]
       [--helper <exact-map-key>]             inspect retained source/helper inputs, not today's configuration
+  oats trust <capability> --deployment <abs> --artifact-set <sha256-…> [--json]
+                                            approve one exact prepared artifact; use each
+                                            selections[].artifactSet for capability ids
+                                            in prepare's approvalRequired[] at that selection
   oats trust <capability> --deployment <abs> --resolution <id> [--json]
                                             explicitly approve that exact captured artifact
   oats <namespace> <command> --deployment <abs> --resolution <id> -- [args…]

package/docs/design/2026-09-20-redesign-program-board.md

@@ -2,7 +2,7 @@
 
 **Purpose:** the one accurate view of every work stream in the redesign, what is on main, what is in flight, who owns it, and what blocks it. Lead: `oats-expert` (redesign lead). Updated whenever anything merges, is returned, or reality changes. Older per-lane boards are superseded by this file.
 
-**Last update:** 2026-09-21 04:10Z · main `feef2a2f`+ · **OATS v0.24.2 tagged (CI)** · OKF v2.1.1 · oats-framework/v1.1.1 · aweb v1.11.0 · oats-knowledge 8d67eab4
+**Last update:** 2026-09-21 05:00Z · main `04e930e7` · **OATS v0.24.2 published** · OKF v2.1.1 · oats-framework/v1.1.1 · aweb v1.11.0 · oats-knowledge 8d67eab4
 
 Legend: ✅ on main/published · 🔄 in flight (PR/branch) · 🟡 preserved, not adopted · ⬜ not started · ⛔ blocked
 
@@ -11,7 +11,7 @@ Legend: ✅ on main/published · 🔄 in flight (PR/branch) · 🟡 preserved, n
 | # | Stream | State | Owner | Next action |
 |---|---|---|---|---|
 | S1 | Knowledge capability contract rework (kernel↔provider boundary, OKF 2.x) | ✅ OATS 0.24.1 / OKF 2.1.1 published | P | done for this phase |
-| S2 | Workspace/Portable Souls adoption of the OATS repos | ✅ workspace + seven indexes + **six imports** (five experts @caa341f3, setup expert @0aad753c) · ✅ second-operator gate run · 🔄 five seams → L, target 0.24.3 | lead, L, Antares | seams PR; Antares re-run on 0.24.2 (aweb 1.11.0) |
+| S2 | Workspace/Portable Souls adoption of the OATS repos | ✅ workspace + seven indexes + six imports · ✅ **0.24.2 published** (onboard verified from the npm tarball) · 🔄 Antares re-run requested · 🔄 five seams → L, 0.24.3 | lead, L, Antares | re-run report; seams PR |
 | S3 | Messaging capability readiness on the new infrastructure (aweb) | ✅ aweb 1.11.0 released · ✅ **catalog + six editions pin v1.11.0 (0.24.2)** · ⬜ second-operator re-run | P, lead | Antares re-run |
 | S4 | Official capabilities `oats.core` / `oats.setup` + explicit default + onboarding `oats-setup-expert` | ✅ D1, D2, **D3 merged (PR35)**: `oats onboard` verified live (acquire 1.1.1 → setup expert with both caps → scaffold composes the five capability skills, no legacy) · `oats.framework` 1.1.1 tagged | P, L | done; Desktop surfaces → S8 |
 | S5 | Official marketplace = reviewed list in oats repo | ✅ D4 merged · ✅ `oats.framework` 1.1.1 listed (`oats.core`, `oats.setup`, `oats.knowledge-theory` aliases) | M | Desktop view → S8 |
@@ -38,7 +38,7 @@ Fresh dir, local `@awebai/oats@0.24.1`, no prior state. `inspect --request` →
 2. `prepare` on the absent deployment inspect blessed → raw `ENOENT` + host path through the JSON envelope.
 3. `prepare` writes lock v3; `oats trust <cap> --dir` rejects it (`unsupported lockfileVersion 3`) → dead end from `--help`.
 4. The working `trust --deployment --artifact-set <sha256>` route is absent from `--help`.
-5. Problems carry `origins: []` and no slot/capability; aweb's missing interface masks OKF diagnostics — a valid and a bogus `stores.oats` binding produce byte-identical output. **Fix first.**
+5. Problems carry `origins: []` and no slot/capability, so a valid and a bogus `stores.oats` binding produce byte-identical output. **Root cause (L's trace):** both OKF `normalize` calls refused because the operator request had no OKF runtime settings (`bindings-file`, `state-dir` — absolute host paths, no defaults); the message never said so. Fix = attribute problems by slot/capability and name the missing item; the identical pair is correct output for that input and stays identical. Guidance for the required settings → P (oats-workspace-setup).
 
 ## S3 — Messaging (aweb) on the new infrastructure
 - ✅ **aweb PR3 merged → v1.11.0 (93f8ab96)**: `binding {normalize,bind,check}` on the existing wire; `check` = HOME-route operational custody only (explicit private team, `delivery: session`, kernel ≥0.24.2 via caller-owned `OATS_CLI_BIN`, retained `launchSelection` must be input-capable Claude/Codex; strict-Pi print → `needs-configuration`, never downgraded). Native adapter over existing `aw` commands with physical identity-dir custody and redacted tokens. Standalone 30/0; coupling 14/0 vs kernel b92f0d07. PR33 (launchSelection projection, OATS_CLI_BIN in codec env) merged b92f0d07.

package/docs/design/2026-09-20-workspace-onboarding-public.md

@@ -9,9 +9,11 @@ owned; production capability/profile readiness is not established by the fixture
 
 ```sh
 oats inspect --request /absolute/inspection.json --json
+# Optional explicit request export (new private file; never overwrite):
+oats inspect --request /absolute/inspection.json --emit-prepare-request /absolute/preparation.json --json
 ```
 
-This mode accepts only one request file and `--json`. Explicit captured selectors
+This mode accepts one request file, optional `--emit-prepare-request`, and `--json`. Explicit captured selectors
 or current-context flags conflict before file reads; inherited captured environment
 is not new-work input. Other existing inspect modes are unchanged. The shared
 bounded strict JSON request reader feeds the existing inspection validator intact:
@@ -66,21 +68,47 @@ have not been classified by their owner and are omitted. Import summaries expose
 `payloadOmitted`. Top-level `omitted:{providerPayloads:true,adoptionValues:true}`
 states that this is a metadata view, not a lossless request or a safe-payload claim.
 It is not an issued `buildFreshPreparationRequest` witness, even in the same
-process. Keep the original authored input for an explicit preparation request.
+process. The opt-in `--emit-prepare-request` route calls that existing builder
+on the real in-process inspection before dropping the private witness. It writes
+only `.preparation` to a new mode-0600 file at an explicit normalized absolute
+path with an existing real parent; existing files/symlinks are refused, never
+overwritten. JSON output names `prepareRequestFile` and records the explicit
+request-file write in `effects`; it does not echo the request contents. The
+export can carry unclassified adoption declarations and must remain private;
+requests must contain nonsecret values or credential references, never secrets.
+A held inspection cannot emit a fresh preparation request. Core callers can
+explicitly request this data via `{includePrepareRequest:true}`; the default
+metadata projection and its omissions are unchanged.
+
+The file is reusable new-work input, NOT a stored resolution, approval, admission,
+or serialized ready-inspection permission. Preparation performs fresh validation
+and observations, including re-resolving any mutable source selectors. Provider
+configuration still requires explicit operator choices; conversion invents none.
 
 Existing managed deployment state is preserved and reported, not repaired or
 migrated. An absent selected path requires explicit operator provisioning and
-reinspection. The serialized inspection does not lock the filesystem or authorize
+reinspection. Prepare refuses it with typed `needs-configuration` and provisioning
+guidance before fetching or writing managed state, not a raw ENOENT. Inspection's
+`ready` means the path is eligible for fresh setup, not already provisioned.
+The serialized inspection does not lock the filesystem or authorize
 later mutation; preparation retains its own existing validation/custody rules.
 The inspected work target does not become source identity or an implied placement
 choice. Supported captured directory scaffolds own their separate H/work.
 
 ## Existing preparation and retained execution
 
-`oats prepare --request` already accepts deployment/source/origin, workspace/member
-OR standalone context, operator policy/bindings, mode/local-input authorization,
-launch and helperLaunches. Do not pass the inspection result or workTarget/catalog
-wrapper. Exact executable approval is separate. A required provider whose binding
+`oats prepare --request` accepts deployment/source/origin, optional `workTarget`,
+workspace/member OR standalone context, operator policy/bindings,
+mode/local-input authorization, launch and helperLaunches. The original minimal
+inspection request (without inspection-only `catalogIndexes`) is also accepted;
+use the converter rather than stripping fields from a metadata/result wrapper.
+Explicit `workTarget` is validated with the same physical existing-directory
+validator as inspection and returned as work-context metadata. It takes precedence
+over any caller assumption about cwd: no cwd/config fallback selects its value.
+Omitting it preserves prior preparation behavior without inventing a placement.
+It does not change source identity, `operator.localBase`, work mode, or captured
+H/work placement. Do not pass an inspection result/catalog wrapper or private
+scratch `directory` to preparation. Exact executable approval is separate. A required provider whose binding
 code is unapproved may return `needs-configuration` with an `approval-required`
 problem and exact artifact-set/capability requests, before any record exists:
 
@@ -92,6 +120,44 @@ oats spawn <subject> --deployment <D> --resolution <R> --home <new-H> --no-launc
 oats session start --deployment <D> --resolution <R> --home <H> --request /absolute/native.json --json
 ```
 
+Each `selections[]` row carries an `artifactSet` id and an `approvalRequired[]`
+array of **capability ids**. Pair them: pass the capability to `trust` and that
+row's artifact-set id to `--artifact-set`. These are not interchangeable ids.
+`trust <capability> --dir <D>` against a v3 deployment now refuses with typed
+`needs-configuration` and exact available-set commands; it never picks or approves
+a set automatically. Classic v1/v2 trust remains the classic route.
+
+Provider preparation problems carry `slot` and `capability`, plus original
+provenance where available. A no-interface provider is identified with kernel-known
+manifest/version facts. Other supported slots still normalize, resolve through
+the same choice engine, and bind if their own choices are resolved; any required
+slot problem still prevents publication. Provider free text is not passed through.
+Different opaque inputs need not produce different public errors if both fail the
+same provider prerequisite. In particular, missing OKF host runtime settings can
+hold both syntactically valid Git locators; preparation does not test whether a
+remote repository exists. Required readiness checks remain later, with the provider.
+
+### Operator input
+
+When present, `operator` requires both `policy` (object; `{}` is valid) and
+`document` (`{ "kind": "operator", "id": "setup-attempt" }`). Its ONLY optional
+fields are `localBase`, `allowLocalPaths`, `sourceContext`, and `bindings`:
+
+- `policy`: explicit provider/additive selections with their selected sources and
+  settings, using the existing policy grammar. It cannot erase soul requirements.
+- `localBase`: explicit absolute base for relative local policy sources. Work
+  context/cwd is not a substitute.
+- `allowLocalPaths`: explicit boolean authorization for those local policy sources.
+  Top-level local acquisition authorization remains a separate input.
+- `sourceContext`: existing qualified repository anchor for `repo:` policy sources;
+  not a new repository inferred from workTarget.
+- `bindings`: provider-owned map. Kernel preserves it and its document pointers;
+  it does not interpret store names, Git destinations, credentials or private teams.
+
+Selecting an inherited store does not replace required provider runtime settings.
+Use the selected provider's instructions for those settings; kernel must not guess
+host-owned durable paths or copy native authentication.
+
 Repreparation after explicit approval is ordinary continuation in the selected,
 now-managed deployment; do not delete its state to make fresh preflight pass.
 Required hooks still run under their admitted custody with `--no-launch`; a parsed

package/docs/release-notes/v0.24.3.md

@@ -0,0 +1,13 @@
+# OATS v0.24.3 — second-operator `prepare` seams
+
+Kernel/Pi/Desktop **0.24.3**. Fixes the five usability seams an independent second operator hit adopting the shared workspace definition on 0.24.1/0.24.2 (see the [program board](../design/2026-09-20-redesign-program-board.md)). No contract, schema or authority change.
+
+- **Attributed provider problems.** Every preparation problem now carries `slot`, `capability` and its `origins`, with kernel-fixed text that names the missing item (for example `oats.okf knowledge normalize binding could not be prepared` / `oats.aweb@1.10.3 declares no binding interface; messaging cannot be prepared`). One unqualified slot no longer masks another slot's diagnostics: every slot that has a binding interface is normalized, and the single resolver reports each invalid choice under its slot. Provider free text still never crosses the wire.
+- **`oats trust <capability> --dir <deployment>` on a lock v3 deployment** returns a typed problem with the exact working command (`oats trust <cap> --deployment <abs> --artifact-set <sha256-…>`) instead of `unsupported lockfileVersion 3`. No auto-approval.
+- **Help** documents `--artifact-set` and how `prepare`'s `selections[].artifactSet` / `approvalRequired[]` pair with it.
+- **`prepare` on an absent deployment path** returns a typed explicit-provisioning hold, not a raw `ENOENT` with a host path.
+- **One request file for both commands.** `prepare --request` accepts the explicit `workTarget` that `inspect --request` requires (explicit beats cwd; it never implies captured placement or current config), and `oats inspect --request <f> --emit-prepare-request <out>` writes the converted preparation request through the existing builder.
+
+The second operator's recorded requests and results are preserved verbatim as regression fixtures (`test/fixtures/second-operator/`). Their valid-vs-bogus `stores.oats` pair remains identical by design: both refused on missing OKF runtime settings (`bindings-file`, `state-dir`), which the messages now say.
+
+Setup guidance for those settings lands in the next `oats.framework` payload.

package/lib/core.mjs

@@ -62,7 +62,7 @@ import { validateCapturedLaunchRequest } from "./captured-launch-request.mjs";
 import { validateCapabilityInputDeclarations } from "./capability-inputs.mjs";
 import { validateCapturedSessionBackend, validateCapturedSessionTarget, assertCapturedSessionPlacement } from "./captured-session-backend.mjs";
 import { createRepositoryTransaction } from "./repository-observation.mjs";
-import { inspectPortableOnboarding as inspectOnboarding, describePortableOnboarding } from "./portable-onboarding.mjs";
+import { inspectPortableOnboarding as inspectOnboarding, describePortableOnboarding, buildFreshPreparationRequest, inspectWorkTarget } from "./portable-onboarding.mjs";
 import { readLock3 } from "./portable-lock.mjs";
 import { portableScope, portableStateDirectory } from "./portable-state.mjs";
 import { objectAt } from "./portable-shape.mjs";
@@ -1211,13 +1211,17 @@ export function approveAvailableCapability(deployment, artifactSet, capability,
 /** Public read-only source/workspace inspection through the existing facade.
  * Owns only transient repository scratch, never deployment state, provisioning,
  * provider code, approvals or a serialized mutation witness. */
-export function inspectPortableOnboarding(input, { repositoryOptions = {} } = {}) {
+export function inspectPortableOnboarding(input, { repositoryOptions = {}, includePrepareRequest = false } = {}) {
   canonicalJson(input);
+  if (typeof includePrepareRequest !== "boolean") throw oatsError("invalid-declaration", "request conversion requires an explicit boolean option");
   const directory = mkdtempSync(join(realpathSync(tmpdir()), "oats-source-inspection-")), owned = lstatSync(directory);
   let repositories, primary;
   try {
     repositories = createRepositoryTransaction({ ...repositoryOptions, directory, accessContextKey: repositoryOptions.accessContextKey ?? "native" });
-    return describePortableOnboarding(inspectOnboarding(input, { repositories }));
+    const inspection = inspectOnboarding(input, { repositories }), result = describePortableOnboarding(inspection);
+    // Opt-in data export, not a serialized custody witness or executable grant.
+    // Default metadata continues to omit unclassified adoption/provider values.
+    return includePrepareRequest ? { ...result, prepareRequest: buildFreshPreparationRequest(inspection).preparation } : result;
   } catch (error) { primary = error; throw error; }
   finally {
     try {
@@ -1239,21 +1243,28 @@ export function inspectPortableOnboarding(input, { repositoryOptions = {} } = {}
  * a fabricated complete record. No lifecycle side effects run here. */
 export function prepareCapturedComposition(input, { repositoryOptions = {} } = {}) {
   canonicalJson(input);
-  objectAt(input, ["deployment", "source", "origin", "workspace", "member", "operator", "mode", "allowLocalPaths", "standaloneContextKey", "launch", "helperLaunches"], ["deployment", "source"]);
+  objectAt(input, ["deployment", "workTarget", "source", "origin", "workspace", "member", "operator", "mode", "allowLocalPaths", "standaloneContextKey", "launch", "helperLaunches"], ["deployment", "source"]);
   if (input.launch !== undefined) validateCapturedLaunchRequest(input.launch, validateLaunchConfig);
   if (input.helperLaunches !== undefined) {
     objectAt(input.helperLaunches, null, []);
     for (const request of Object.values(input.helperLaunches)) validateCapturedLaunchRequest(request, validateLaunchConfig);
   }
   if (input.mode !== undefined && !WORK_MODES.includes(input.mode)) throw oatsError("invalid-declaration", "invalid preparation work mode");
-  const deployment = portableScope(input.deployment);
+  const { workTarget, ...preparationInput } = input;
+  const target = Object.hasOwn(input, "workTarget") ? inspectWorkTarget(workTarget) : null;
+  let deployment;
+  try { deployment = portableScope(input.deployment); }
+  catch (error) {
+    if (error.code === "ENOENT") throw oatsError("needs-configuration", "deployment directory is absent; provision the explicitly selected directory and inspect again before preparation");
+    throw error;
+  }
   const previous = readLock3(deployment); // Old state refuses before scratch/fetch.
   const directory = mkdtempSync(join(portableStateDirectory(deployment, true), ".prepare-")), owned = lstatSync(directory);
   const origin = input.origin ?? { kind: "operator", document: { kind: "operator", id: "oats-prepare" }, pointer: "/source" };
   let repositories, primary, catalog;
   try {
     repositories = createRepositoryTransaction({ ...repositoryOptions, directory, accessContextKey: repositoryOptions.accessContextKey ?? "native" });
-    return prepareComposition({ ...input, deployment, origin, directory }, { repositories, previous, kernel: {
+    const result = prepareComposition({ ...preparationInput, deployment, origin, directory }, { repositories, previous, kernel: {
       loadPackageManifestAt, capabilityCompatibility, assertPlatformInvariantLocks, materializeCapability,
       manifest: loadRetainedManifest,
       binding: runCapturedProviderBinding,
@@ -1266,6 +1277,8 @@ export function prepareCapturedComposition(input, { repositoryOptions = {} } = {
         settings: assertCapabilitySettingValues, skills: skillEntriesIn, hooks: manifestHookDeclarations,
         validateLaunchConfig, runtimeRequirements: applicableRequirements }),
     } });
+    // Explicit work context never selects source/config, cwd, or H/work placement.
+    return target ? { ...result, workTarget: target } : result;
   } catch (error) { primary = error; throw error; }
   finally {
     try {

package/lib/portable-onboarding.mjs

@@ -108,7 +108,7 @@ export function preflightFreshDeployment({ deployment, maxEntries = 4096 }) {
   return result;
 }
 
-function workTarget(path) {
+export function inspectWorkTarget(path) {
   const canonical = canonicalExistingDirectory(path, "work target"), marker = present(join(canonical, ".git"));
   return { path: canonical, state: "existing", git: marker ? { present: true, kind: marker.isDirectory() ? "directory" : marker.isFile() ? "file" : "other" } : { present: false, kind: null } };
 }
@@ -146,7 +146,7 @@ export function inspectPortableOnboarding(input, { repositories } = {}) {
   validateOrigin(input.origin);
   const standalone = explicitContext(input);
   const deployment = preflightFreshDeployment({ deployment: input.deployment });
-  const target = workTarget(input.workTarget), discovery = createWorkspaceDiscovery(repositories);
+  const target = inspectWorkTarget(input.workTarget), discovery = createWorkspaceDiscovery(repositories);
   const witness = { deployment: preflightWitnesses.get(deployment), work: directoryIdentity(target.path) };
   const workspace = Object.hasOwn(input, "workspace") ? discovery.readWorkspace(input.workspace) : null;
   const selected = typeof input.source === "string" ? sourceOrigin(workspace, input.source) : { reference: input.source, origin: input.origin };
@@ -236,7 +236,7 @@ export function buildFreshPreparationRequest(inspection, options = {}) {
   const { operator, mode, allowLocalPaths = false } = options;
   if (typeof allowLocalPaths !== "boolean") throw oatsError("invalid-declaration", "allowLocalPaths must be boolean");
   if (mode !== undefined && (typeof mode !== "string" || !mode.trim())) throw oatsError("invalid-declaration", "preparation mode must be non-empty text");
-  const input = { deployment: inspection.deployment.deployment.path,
+  const input = { deployment: inspection.deployment.deployment.path, workTarget: inspection.workTarget.path,
     source: inspection.source.reference,
     origin: inspection.source.revision.provenance[0], allowLocalPaths,
     ...(inspection.workspace ? { workspace: inspection.workspace.request } : { standaloneContextKey: inspection.context.key }),

package/lib/prepared-bindings.mjs

@@ -37,24 +37,34 @@ export function prepareProviderBindings({seed,plan,manifests,declarations},invok
   const normalized=new Map(),problems=[],requirements=[...plan.requirements],candidates=[...plan.candidates];
   const settingsFor=id=>Object.fromEntries(Object.entries(plan.settings[id] ?? {}).map(([name,key])=>[name,plan.choices[key].value]));
   const run=(id,phase,input)=>invoke({artifacts:seed.artifacts,capability:id,phase,settings:settingsFor(id),input});
-  const refuse=error=>({code:safeCodes.has(error?.code)?error.code:'provider-not-qualified',message:'provider binding could not be prepared',origins:[]});
+  const originsFor=id=>[...new Map((plan.capabilities[id]?.choiceKeys ?? []).flatMap(key=>{
+    const choice=plan.choices[key];return choice?.selectedBy?[choice.selectedBy]:[];
+  }).map(origin=>[canonicalJson(origin),origin])).values()];
+  const problem=(slot,id,code,message,origins=originsFor(id))=>({code,message,origins,slot,capability:id});
+  const refuse=(slot,id,phase,error)=>problem(slot,id,safeCodes.has(error?.code)?error.code:'provider-not-qualified',
+    `${id} ${slot} ${phase} binding could not be prepared`); // Never provider free text.
   for (const [id,manifest] of manifests) {
     if (!Object.hasOwn(seed.artifacts.capabilities,id) || !manifest.layer) continue;
-    if (plan.providers[manifest.layer] !== id) problems.push({code:'needs-configuration',message:'fundamental capability must be selected in its own layer',origins:[]});
+    if (plan.providers[manifest.layer] !== id) problems.push(problem(manifest.layer,id,'needs-configuration','fundamental capability must be selected in its own layer'));
   }
-  if (problems.length) return {plan,seed,problems};
   for (const [slot,id] of Object.entries(plan.providers)) {
     if (id === null) continue;
     const manifest=manifests.get(id);
-    if (manifest?.layer !== slot || !manifest.binding) { problems.push({code:'provider-not-qualified',message:'selected provider has no matching binding interface',origins:[]});continue; }
+    if (manifest?.layer !== slot) { problems.push(problem(slot,id,'provider-not-qualified',`${id} does not declare the selected ${slot} layer`));continue; }
+    if (!manifest.binding) { problems.push(problem(slot,id,'provider-not-qualified',`${id}@${manifest.version} declares no binding interface; ${slot} cannot be prepared`));continue; }
     try {
       const value=run(id,'normalize',{declarations,context:seed.context});
       normalized.set(slot,{id,value}); requirements.push(...value.requirements);candidates.push(...value.candidates);
-    } catch(error) { problems.push(refuse(error)); }
+    } catch(error) { problems.push(refuse(slot,id,'normalize',error)); }
   }
-  if (problems.length) return {plan,seed,problems};
+  // One unsupported slot must not mask another slot's normalized requirements
+  // or invalid choices. The same resolver still decides every value.
   const resolved=resolveChoices({requirements,candidates});
-  if (resolved.status !== 'resolved') return {plan:{...plan,...resolved},seed,problems:resolved.problems};
+  for (const item of resolved.problems) {
+    const slot=Object.keys(plan.providers).find(slot=>bindingField(item.key,slot));
+    if (!slot) throw oatsError('invalid-binding-output','provider choice problem has no owned binding slot');
+    problems.push({...item,slot,capability:plan.providers[slot]});
+  }
   const nextPlan={...plan,...resolved,requirements,candidates},bindings=Object.create(null);
   let messagingChoice={schemaVersion:1,enabled:false};
   const known=[];
@@ -64,6 +74,7 @@ export function prepareProviderBindings({seed,plan,manifests,declarations},invok
   }
   const witnessed=origin=>bindingOriginWitnessed(origin,declarations) || known.some(candidate=>same(candidate,origin));
   for (const [slot,{id,value}] of normalized) {
+    if (resolved.problems.some(item=>bindingField(item.key,slot))) continue;
     try {
       const choices=Object.fromEntries(Object.entries(resolved.choices).filter(([key])=>bindingField(key,slot)));
       const bound=run(id,'bind',{model:value.model,choices,context:seed.context});
@@ -72,7 +83,9 @@ export function prepareProviderBindings({seed,plan,manifests,declarations},invok
       }
       bindings[slot]=bound.binding;
       if (slot === 'messaging') messagingChoice=bound.messagingChoice;
-    } catch(error) { problems.push(refuse(error)); }
+    } catch(error) { problems.push(refuse(slot,id,'bind',error)); }
   }
+  nextPlan.problems=problems;
+  nextPlan.status=problems.some(item=>item.code==='requirement-conflict')?'conflict':problems.length?'needs-configuration':'resolved';
   return {plan:nextPlan,seed:{...seed,choices:resolved.choices,bindings,messagingChoice},problems};
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/oats",
-  "version": "0.24.2",
+  "version": "0.24.3",
   "description": "OATS (Open Agent Team Specification) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oats CLI/kernel.",
   "keywords": [
     "agents",