@cspeach/cli 0.8.0 → 1.0.0

package/dist/cost/pricing.js

@@ -11,16 +11,25 @@
  * BOTH this file AND the proxy's version. Verify on the public pricing page:
  *   https://www.anthropic.com/pricing
  *
- * Last verified 2026-05-12. Same as proxy.
+ * Last verified 2026-06-07. Same as proxy.
+ *
+ * 2026-06-07 SYNC: e294cff switched the default model to claude-opus-4-8 AND
+ * applied the 3x Opus correction, but only to the proxy copy — this CLI copy
+ * was left stale, so every opus-4-8 turn was an unknown model (footer $0) and
+ * opus-4-5/4-6/4-7 still carried the legacy $15/$75 (~3x overstated). Brought
+ * back in line with cspeach-proxy/src/anthropic/pricing.ts below.
  *
  * Unknown models → returns null + records the model name to a process-level
  * Set so we surface them as an obvious warning rather than silently zeroing.
  */
 const PRICING = {
-    // Claude Opus 4.x family — input 15, output 75, cache_read 1.50, cache_write 18.75
-    'claude-opus-4-7': { inputPer1M: 15.00, outputPer1M: 75.00, cacheReadPer1M: 1.50, cacheCreatePer1M: 18.75 },
-    'claude-opus-4-6': { inputPer1M: 15.00, outputPer1M: 75.00, cacheReadPer1M: 1.50, cacheCreatePer1M: 18.75 },
-    'claude-opus-4-5': { inputPer1M: 15.00, outputPer1M: 75.00, cacheReadPer1M: 1.50, cacheCreatePer1M: 18.75 },
+    // Claude Opus 4.5+ — input 5, output 25, cache_read 0.50, cache_write 6.25 (1.25x input).
+    // 2026-06-07 correction: 4.5/4.6/4.7 were carried at the LEGACY $15/$75; actual
+    // since Opus 4.5 is $5/$25. Only claude-opus-4 (4.0/4.1) genuinely was $15/$75.
+    'claude-opus-4-8': { inputPer1M: 5.00, outputPer1M: 25.00, cacheReadPer1M: 0.50, cacheCreatePer1M: 6.25 },
+    'claude-opus-4-7': { inputPer1M: 5.00, outputPer1M: 25.00, cacheReadPer1M: 0.50, cacheCreatePer1M: 6.25 },
+    'claude-opus-4-6': { inputPer1M: 5.00, outputPer1M: 25.00, cacheReadPer1M: 0.50, cacheCreatePer1M: 6.25 },
+    'claude-opus-4-5': { inputPer1M: 5.00, outputPer1M: 25.00, cacheReadPer1M: 0.50, cacheCreatePer1M: 6.25 },
     'claude-opus-4': { inputPer1M: 15.00, outputPer1M: 75.00, cacheReadPer1M: 1.50, cacheCreatePer1M: 18.75 },
     // Claude Sonnet 4.x family — input 3, output 15, cache_read 0.30, cache_write 3.75
     'claude-sonnet-4-6': { inputPer1M: 3.00, outputPer1M: 15.00, cacheReadPer1M: 0.30, cacheCreatePer1M: 3.75 },

package/dist/doctor/checks/_http-probe.js

@@ -35,6 +35,7 @@ export function probeGet(url, opts) {
             path: u.pathname + u.search,
             timeout: opts.timeoutMs ?? 8000,
             rejectUnauthorized: opts.rejectUnauthorized,
+            ...(opts.ca !== undefined ? { ca: opts.ca } : {}),
             headers,
         }, (res) => {
             const chunks = [];

package/dist/doctor/checks/cert.js

@@ -1,5 +1,5 @@
 import tls from 'node:tls';
-import { loadConfig } from '../../config/loader.js';
+import { loadConfig, resolveSapTls } from '../../config/loader.js';
 export async function checkCert() {
     const cfg = await loadConfig();
     const systems = Object.entries(cfg.sap).filter(([_, s]) => s.useSsl);
@@ -7,14 +7,25 @@ export async function checkCert() {
         return { name: 'cert', ok: true, message: 'n/a (no TLS SAP systems configured)' };
     const results = [];
     for (const [alias, sys] of systems) {
+        const tlsMode = resolveSapTls(sys);
         const info = await new Promise((resolve) => {
+            // Probe with rejectUnauthorized:false so we can always read the cert and
+            // report the OS-trust chain status, then describe the configured posture
+            // separately (verify / CA-trusted / INSECURE).
             const socket = tls.connect({ host: sys.host, port: sys.port, rejectUnauthorized: false, timeout: 5000 }, () => {
                 const cert = socket.getPeerCertificate();
                 const authorized = socket.authorized;
                 socket.end();
                 const chainValid = authorized ? 'yes' : 'no';
-                const clientAccepted = !sys.sslVerify ? 'yes (trust-manager allows self-signed)' : (authorized ? 'yes' : 'no');
-                resolve(`${alias}: chain valid: ${chainValid} / client accepted: ${clientAccepted} / subject: ${cert.subject?.CN ?? '?'}`);
+                // What the configured client mode means for acceptance:
+                //   verify     → accepts only if the OS/Node trust chain validates
+                //   CA-trusted → accepts via the configured CA (verification ON)
+                //   INSECURE   → accepts anything (verification OFF — dev only)
+                const clientAccepted = tlsMode.mode === 'insecure' ? 'yes (INSECURE — verification disabled, dev only)'
+                    : tlsMode.mode === 'ca-trusted' ? 'yes (CA-trusted — verification ON via configured CA)'
+                        : (authorized ? 'yes' : 'no (verify ON — configure ca_cert_path to trust an internal CA)');
+                resolve(`${alias}: mode: ${tlsMode.mode} / chain valid: ${chainValid} / ` +
+                    `client accepted: ${clientAccepted} / subject: ${cert.subject?.CN ?? '?'}`);
             });
             socket.on('error', (err) => resolve(`${alias}: ${err.message}`));
         });

package/dist/doctor/checks/sap.js

@@ -1,4 +1,5 @@
-import { loadConfig } from '../../config/loader.js';
+import { readFile } from 'node:fs/promises';
+import { loadConfig, resolveSapTls } from '../../config/loader.js';
 import { probeGet } from './_http-probe.js';
 export async function checkSap() {
     const cfg = await loadConfig();
@@ -9,23 +10,44 @@ export async function checkSap() {
     let anyFailed = false;
     for (const [alias, sys] of systems) {
         const url = `${sys.useSsl ? 'https' : 'http'}://${sys.host}:${sys.port}/sap/bc/adt/discovery`;
-        // Use node's https directly so we can honor sslVerify=false for
-        // self-signed dev systems — Node's built-in fetch() doesn't expose a
-        // per-request TLS-verify toggle. See checks/_http-probe.ts.
+        // TLS posture (2026-06-14): verification ON by default. resolveSapTls maps
+        // the per-alias config (ca_cert_path / insecure_skip_tls_verify, legacy
+        // sslVerify:false fallback). Node's built-in fetch() doesn't expose a
+        // per-request TLS-verify toggle, so we use node's https directly — see
+        // checks/_http-probe.ts.
+        const tls = resolveSapTls(sys);
+        // Tag the connectivity result with the cert mode so doctor surfaces it.
+        const modeTag = tls.mode === 'verify' ? 'verify'
+            : tls.mode === 'ca-trusted' ? 'CA-trusted'
+                : 'INSECURE';
+        let ca;
+        if (tls.mode === 'ca-trusted' && tls.caCertPath) {
+            try {
+                ca = await readFile(tls.caCertPath);
+            }
+            catch (e) {
+                // Fail closed, like the connection path: a configured-but-unreadable CA
+                // is an error, not a reason to drop verification.
+                results.push(`${alias}: CA unreadable at ${tls.caCertPath} (${e.message})`);
+                anyFailed = true;
+                continue;
+            }
+        }
         const r = await probeGet(url, {
-            rejectUnauthorized: sys.sslVerify,
+            rejectUnauthorized: tls.mode !== 'insecure',
+            ca,
             timeoutMs: 8000,
         });
         if (r.error) {
-            results.push(`${alias}: ${r.error}`);
+            results.push(`${alias}: ${r.error} [${modeTag}]`);
             anyFailed = true;
         }
         else if (r.status === 200 || r.status === 401) {
             // 200 = anonymous discovery allowed; 401 = reachable + auth-required (expected, fine)
-            results.push(`${alias}: reachable`);
+            results.push(`${alias}: reachable [${modeTag}]`);
         }
         else {
-            results.push(`${alias}: HTTP ${r.status}`);
+            results.push(`${alias}: HTTP ${r.status} [${modeTag}]`);
             anyFailed = true;
         }
     }

package/dist/doctor/checks/zcspeach.js

@@ -1,5 +1,6 @@
 import keytar from 'keytar';
-import { loadConfig } from '../../config/loader.js';
+import { readFile } from 'node:fs/promises';
+import { loadConfig, resolveSapTls } from '../../config/loader.js';
 import { probeGet } from './_http-probe.js';
 const SAP_SERVICE = 'cspeach-sap';
 export async function checkZcspeach() {
@@ -29,10 +30,24 @@ export async function checkZcspeach() {
             results.push(`${alias}: skipped (no password in keychain)`);
             continue;
         }
-        // Use node's https directly so we can honor sslVerify=false for
-        // self-signed dev systems. See checks/_http-probe.ts.
+        // TLS posture (2026-06-14): verification ON by default; resolveSapTls maps
+        // the per-alias config (ca_cert_path / insecure_skip_tls_verify, legacy
+        // sslVerify:false fallback). See checks/_http-probe.ts.
+        const tls = resolveSapTls(sys);
+        let ca;
+        if (tls.mode === 'ca-trusted' && tls.caCertPath) {
+            try {
+                ca = await readFile(tls.caCertPath);
+            }
+            catch (e) {
+                results.push(`${alias}: CA unreadable at ${tls.caCertPath} (${e.message})`);
+                anyFailed = true;
+                continue;
+            }
+        }
         const r = await probeGet(url, {
-            rejectUnauthorized: sys.sslVerify,
+            rejectUnauthorized: tls.mode !== 'insecure',
+            ca,
             auth: `${sys.username}:${pwd}`,
             accept: 'application/json',
             timeoutMs: 5000,

package/dist/one-shot.js

@@ -1,15 +1,18 @@
 import chalk from 'chalk';
-import { loadConfig } from './config/loader.js';
+import { loadConfig, resolveLocalBuild } from './config/loader.js';
 import { getStore } from './auth/api-key.js';
 import { getConnection } from './sap/connection-manager.js';
 import { AdtClient } from '@cspeach/sap-client';
 import { makeSessionId, saveSession } from './session/store.js';
 import { newSession } from './session/schema.js';
 import { createProviderForMode } from './agent/providers/factory.js';
+import { assertModeLicensed, CspeachLicenseError } from './agent/providers/license-gate.js';
 import { runTurn } from './agent/loop.js';
-import { classifyPrompt, parseShortcut } from './router/classifier.js';
-import { setRenderingOverride } from './renderer/tty.js';
+import { classifyPrompt, parseShortcut, rejectUnknownSkill } from './router/classifier.js';
+import { setRenderingOverride, setHeadlessOverride } from './renderer/tty.js';
 import { alwaysDeclinePreviewHook } from './repl/update-method-preview-hook.js';
+import { createClassicOutputEmitter } from './renderer/notices.js';
+import { applyLocalBuildConfig } from './tools/local-build.js';
 // Side-effect imports for tool registration.
 import './tools/sap-read.js';
 import './tools/sap-write.js';
@@ -19,16 +22,22 @@ import './tools/snapshot.js';
 import './tools/ask-question.js';
 import './tools/dispatch-skill.js';
 import './tools/filesystem/file-read.js';
+import './tools/filesystem/read-document.js';
 import './tools/filesystem/file-edit.js';
 import './tools/filesystem/file-write.js';
 import './tools/filesystem/glob.js';
 import './tools/filesystem/grep.js';
 import './tools/shell/shell_exec.js';
+import './tools/fiori/tools.js';
+import './tools/extend-model/tool.js';
+import './tools/capability/tool.js';
 import './tools/web/web_fetch.js';
 import './tools/web/web_search.js';
 import './tools/project/project_context_get.js';
 import './tools/project/playbook_get.js';
 import './tools/project/convention_get.js';
+import './tools/project/cca_merge.js';
+import './tools/project/upgrade_merge_progress.js';
 import './tools/subagent/_background-shared.js';
 import './tools/subagent/background_run.js';
 import './tools/subagent/monitor_emit.js';
@@ -37,12 +46,27 @@ import './tools/subagent/agent_run.js';
 export async function runOneShot(prompt, opts) {
     const cfg = await loadConfig();
     setRenderingOverride(cfg.ui.rendering);
+    // B5 (2026-06-11) — one-shot is headless by design: a single turn, no
+    // REPL, often piped (CI / battery). Any stdin prompt would hang forever
+    // (defect D1). The headless answer policy (ask_question auto-answers,
+    // save hook defaults YES, approvals fail fast) keys off this flag.
+    setHeadlessOverride(true);
     // Task C.10 — advisory-only is the only mode the one-shot announces, because
     // non-interactive output should stay minimal. The user needs to know that
     // writes will NOT be executed before a skill that normally writes runs.
     if (cfg.write_mode === 'advisory-only') {
         console.log(chalk.yellow('⚠  Advisory mode: writes will be proposed, not executed.'));
     }
+    // local_build toggle — force-enable the flag-gated filesystem tools AND
+    // shell_exec BEFORE the (single) turn when persisted-on. Resolve with backward
+    // compat (legacy `local_files = on` still applies). Announce so headless
+    // transcripts record that local file access + command execution were live
+    // (trust-visibility / auditability).
+    {
+        const announce = applyLocalBuildConfig(resolveLocalBuild(cfg), process.cwd());
+        if (announce)
+            console.log(chalk.dim(announce));
+    }
     const store = await getStore();
     if (!(await store.get())) {
         console.error('No API key configured. Run `cspeach` (interactive) first to set one.');
@@ -66,6 +90,14 @@ export async function runOneShot(prompt, opts) {
     const body = parsed.prompt;
     let skill;
     if (parsed.skill) {
+        // D35 (2026-06-11) — explicit slash naming a skill that isn't in the
+        // catalog. One-shot has no picker, so fail fast with the notice ("did
+        // you mean" / builtin-with-args) instead of dispatching to a
+        // nonexistent skill (and NEVER falling through to the classifier with
+        // the slash embedded). Shared gate: rejectUnknownSkill in classifier.ts.
+        if (rejectUnknownSkill(parsed, (m) => console.error(chalk.red(m)))) {
+            return 1;
+        }
         skill = parsed.skill;
     }
     else {
@@ -94,6 +126,19 @@ export async function runOneShot(prompt, opts) {
         }
         skill = c.skill;
     }
+    // License gate: non-managed modes (byok/local/ai-hub) bypass our proxy for
+    // inference, so without this anyone who never logged in could use the bundled
+    // skills untracked. Require a valid CSPeach login. (See license-gate.ts.)
+    try {
+        await assertModeLicensed(cfg.llm.mode, async () => (await store.get()) ?? '');
+    }
+    catch (e) {
+        if (e instanceof CspeachLicenseError) {
+            console.error(chalk.yellow(`\n${e.message}\n`));
+            process.exit(1);
+        }
+        throw e;
+    }
     const provider = createProviderForMode(cfg, async () => {
         const key = await store.get();
         if (!key)
@@ -104,7 +149,10 @@ export async function runOneShot(prompt, opts) {
         provider,
         userMessage: body,
         skill,
-        ctx: { adt, sapAlias: alias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: alwaysDeclinePreviewHook },
+        // B2 fix (2026-06-12): one-shot runs render tool notices ('warn'/'info'
+        // — Rule 9 transport overrides, snapshot lines) to stdout instead of
+        // dropping them. Headless transcripts need these for auditability.
+        ctx: { adt, sapAlias: alias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: alwaysDeclinePreviewHook, chunkEmitter: createClassicOutputEmitter() },
     });
     return 0;
 }

package/dist/projects/answer-blockers.js

@@ -0,0 +1,137 @@
+import { writeFileSync } from 'node:fs';
+import { readProjectFile } from './status.js';
+import { validateEnvelope } from './validate.js';
+/**
+ * The still-open BLOCKER-severity questions of a spec-gap envelope, in item
+ * order. Returns [] for any non-spec-gap artefact (only spec-gap has gaps with
+ * a severity + an `answered` status). Carries any candidate `options` so the
+ * answer UI can offer choices instead of a bare text box.
+ */
+export function openBlockers(env) {
+    if (env.artefactType !== 'spec-gap')
+        return [];
+    const gapById = new Map();
+    for (const s of env.content.sections) {
+        for (const g of s.gaps)
+            gapById.set(g.id, g);
+    }
+    const out = [];
+    for (const it of env.interaction.items) {
+        if (it.status !== 'open')
+            continue;
+        const g = gapById.get(it.id);
+        if (g?.severity !== 'BLOCKER')
+            continue;
+        const ob = { id: it.id, text: g.text };
+        if (g.options && g.options.length > 0) {
+            ob.options = g.options;
+            if (g.optionsMultiSelect)
+                ob.multiSelect = true;
+        }
+        out.push(ob);
+    }
+    return out;
+}
+/**
+ * Return a copy of `env` with each item in `answers` marked answered. Keys with
+ * a blank value are ignored (treated as skipped). version + history are left
+ * untouched (invariant version === history.length holds); lastEditedAt/By move
+ * to the answerer to reflect who filled them.
+ */
+export function applyBlockerAnswers(env, answers, answerer, nowIso) {
+    const items = env.interaction.items.map((it) => {
+        const a = answers.get(it.id);
+        if (a === undefined || a.trim().length === 0)
+            return it;
+        return {
+            ...it,
+            status: 'answered',
+            answer: a,
+            answeredBy: answerer,
+            answeredAt: nowIso,
+        };
+    });
+    return {
+        ...env,
+        interaction: { items },
+        lastEditedAt: nowIso,
+        lastEditedBy: answerer,
+    };
+}
+function affirmative(reply) {
+    const v = reply.trim().toLowerCase();
+    return v === 'y' || v === 'yes';
+}
+/**
+ * Offer to answer the open blockers of the just-saved spec-gap file inline.
+ * No-op (no prompt) when the file isn't a spec-gap or has no open blockers, so
+ * it is always safe to call after any save. In headless runs the prompt returns
+ * '' → declined → nothing happens.
+ *
+ * Returns the count recorded, or null when nothing was offered/written.
+ */
+export async function offerAnswerBlockers(args) {
+    let env;
+    try {
+        env = readProjectFile(args.path);
+    }
+    catch {
+        return null;
+    }
+    const blockers = openBlockers(env);
+    if (blockers.length === 0)
+        return null;
+    const reply = await args.prompt(`Answer the ${blockers.length} unanswered blocker(s) now? [y/N]: `);
+    if (!affirmative(reply))
+        return null;
+    const answers = new Map();
+    for (let i = 0; i < blockers.length; i++) {
+        const b = blockers[i];
+        args.log('');
+        args.log(`Blocker ${i + 1}/${blockers.length}: ${b.text}`);
+        // Choices first, where the question has them and a picker is available.
+        // 'write' falls through to the text box; 'skip' leaves the blocker open.
+        let askText = true;
+        if (b.options && b.options.length > 0 && args.choose) {
+            const c = await args.choose({
+                question: b.text,
+                options: b.options,
+                multiSelect: !!b.multiSelect,
+                index: i,
+                total: blockers.length,
+            });
+            if (c.kind === 'picked') {
+                if (c.answer.trim().length > 0)
+                    answers.set(b.id, c.answer.trim());
+                askText = false;
+            }
+            else if (c.kind === 'skip') {
+                askText = false;
+            }
+            // c.kind === 'write' → askText stays true
+        }
+        if (askText) {
+            const a = (await args.prompt('  Your answer (Enter to skip): ')).trim();
+            if (a.length > 0)
+                answers.set(b.id, a);
+        }
+    }
+    if (answers.size === 0) {
+        args.log('');
+        args.log('No answers entered — all blockers left open for the viewer.');
+        return null;
+    }
+    const nowIso = (args.now ?? (() => new Date().toISOString()))();
+    const revised = applyBlockerAnswers(env, answers, args.identity, nowIso);
+    const check = validateEnvelope(JSON.parse(JSON.stringify(revised)));
+    if (!check.ok) {
+        args.log(`[answer] revision invalid (${check.error.message}) — answers NOT saved.`);
+        return null;
+    }
+    writeFileSync(args.path, JSON.stringify(revised, null, 2), 'utf8');
+    const stillOpen = blockers.length - answers.size;
+    args.log('');
+    args.log(`Recorded ${answers.size} answer(s) in the file`
+        + (stillOpen > 0 ? ` — ${stillOpen} blocker(s) still open for the viewer.` : '.'));
+    return answers.size;
+}

package/dist/projects/email-template.js

@@ -11,6 +11,7 @@ const SUBJECT_BY_TYPE = {
     'cca-assessment': (t) => `Custom code assessment — ${t}`,
     'modernize-result': (t) => `Modernization result — ${t}`,
     'test-coverage': (t) => `Test coverage report — ${t}`,
+    'plan': (t) => `Project plan — ${t}`,
 };
 const BODY_BY_TYPE = {
     'spec-gap': (a) => `Attached is the gap analysis for the ${a.title}.\n${a.itemCount} ${a.itemNoun} across business / data / authorisation / edge cases.`,
@@ -24,6 +25,7 @@ const BODY_BY_TYPE = {
     'cca-assessment': (a) => `Attached is the custom code assessment for ${a.title}.\n${a.itemCount} ${a.itemNoun} classified — review keep / fix / retire / redesign per object.`,
     'modernize-result': (a) => `Attached is the modernization result for ${a.title}.\n${a.itemCount} ${a.itemNoun} attempted — review applied / skipped / failed per object before sign-off.`,
     'test-coverage': (a) => `Attached is the test coverage report for ${a.title}.\n${a.itemCount} test ${a.itemNoun} generated — review the targets + method counts before merging.`,
+    'plan': (a) => `Attached is the project plan for ${a.title}.\n${a.itemCount} ${a.itemNoun} ordered bottom-up — each phase runs in its own session via /abap-plan --resume.`,
 };
 export function renderEmailTemplate(a) {
     const subject = SUBJECT_BY_TYPE[a.artefactType](a.title);

package/dist/projects/extract-cca.js

@@ -9,7 +9,7 @@
  *   <!-- csforge:cca-manifest
  *   artefact: cca-assessment
  *   title: ZFI / ZSD — S/4HANA 2023 estate
- *   detail_path: .abapforge/cca/projects/zfi-zsd-2026-04/project.json
+ *   detail_path: .cspeach/cca/projects/zfi-zsd-2026-04/project.json
  *   project_id: zfi-zsd-2026-04
  *   scope: ZFI* + ZSD*
  *   atc_variant: S4HANA_READINESS_2023
@@ -78,6 +78,13 @@ function intOr(kv, key, fallback) {
     const n = Number.parseInt(v, 10);
     return Number.isFinite(n) ? n : fallback;
 }
+function optionalInt(kv, key) {
+    const v = kv[key];
+    if (v === undefined)
+        return undefined;
+    const n = Number.parseInt(v, 10);
+    return Number.isFinite(n) ? n : undefined;
+}
 const CLASSIFICATIONS = ['keep', 'fix', 'retire', 'redesign'];
 const CONFIDENCES = ['high', 'medium', 'low'];
 function asClassification(raw) {
@@ -92,6 +99,36 @@ function asConfidence(raw) {
         ? v
         : 'medium';
 }
+/**
+ * Parse the optional 6th table cell on a merged row:
+ *   `conflict=<label>:<cls>;<label>:<cls>`
+ * (rendered by merge-cca.ts:renderCcaMergeManifest). Returns undefined
+ * for absent / unrecognisable cells; invalid classification values are
+ * skipped pair-wise so one typo doesn't drop the whole record.
+ */
+function parseConflictCell(raw) {
+    if (!raw)
+        return undefined;
+    const m = /^conflict=(.+)$/.exec(raw.trim());
+    if (!m)
+        return undefined;
+    const values = {};
+    for (const pair of m[1].split(';')) {
+        const idx = pair.lastIndexOf(':');
+        if (idx === -1)
+            continue;
+        const label = pair.slice(0, idx).trim();
+        const cls = pair.slice(idx + 1).trim().toLowerCase();
+        if (label.length === 0)
+            continue;
+        if (!CLASSIFICATIONS.includes(cls))
+            continue;
+        values[label] = cls;
+    }
+    if (Object.keys(values).length === 0)
+        return undefined;
+    return { values, rule: 'most-restrictive' };
+}
 export function extractCcaAssessment(markdown) {
     const { kv, tables } = parseManifestBlock(markdown);
     if (kv.artefact !== 'cca-assessment') {
@@ -103,27 +140,82 @@ export function extractCcaAssessment(markdown) {
     if (!kv.project_id) {
         throw new Error("cca-assessment manifest missing required 'project_id'");
     }
-    const classifications = (tables.classifications ?? []).map((row, i) => ({
-        id: row[0] ?? `item-${String(i + 1).padStart(3, '0')}`,
-        objectName: row[1] ?? '',
-        objectType: row[2] ?? '',
-        classification: asClassification(row[3] ?? 'keep'),
-        confidence: asConfidence(row[4] ?? 'medium'),
-    }));
+    const classifications = (tables.classifications ?? []).map((row, i) => {
+        const conflict = parseConflictCell(row[5]);
+        return {
+            id: row[0] ?? `item-${String(i + 1).padStart(3, '0')}`,
+            objectName: row[1] ?? '',
+            objectType: row[2] ?? '',
+            classification: asClassification(row[3] ?? 'keep'),
+            confidence: asConfidence(row[4] ?? 'medium'),
+            ...(conflict ? { conflict } : {}),
+        };
+    });
+    const summary = {
+        totalObjects: intOr(kv, 'total_objects', classifications.length),
+        keep: intOr(kv, 'keep', 0),
+        fix: intOr(kv, 'fix', 0),
+        retire: intOr(kv, 'retire', 0),
+        redesign: intOr(kv, 'redesign', 0),
+        uncategorized: intOr(kv, 'uncategorized', 0),
+    };
+    // ── D6/D7 manifest integrity (2026-06-12) ───────────────────────────────
+    // Battery S4 caught manifests whose counts contradicted their own rows
+    // (`retire: 0` next to 7 retire rows) and tables silently truncated
+    // (27/104 rows, no marker). These manifests are CHAIN INPUT for
+    // /abap-cca-merge — a quiet save corrupts the consolidated estate
+    // numbers, so a contradiction fails the extract LOUDLY instead (same
+    // philosophy as extract-plan's loud-failure path in save-command.ts).
+    const truncated = kv.classifications_truncated === 'true';
+    const shown = optionalInt(kv, 'classifications_shown');
+    const totalCls = optionalInt(kv, 'classifications_total');
+    const rowTally = {
+        keep: 0, fix: 0, retire: 0, redesign: 0,
+    };
+    for (const c of classifications)
+        rowTally[c.classification]++;
+    if (truncated) {
+        if (shown !== undefined && shown !== classifications.length) {
+            throw new Error(`cca-assessment manifest contradiction: classifications_shown is ${shown} but the table has ${classifications.length} rows.`);
+        }
+        for (const cls of ['keep', 'fix', 'retire', 'redesign']) {
+            if (rowTally[cls] > summary[cls]) {
+                throw new Error(`cca-assessment manifest contradiction: ${rowTally[cls]} '${cls}' rows in the table but the summary says ${cls}: ${summary[cls]}. `
+                    + `Counts must cover every row even when the table is truncated.`);
+            }
+        }
+        if (totalCls !== undefined && totalCls < classifications.length) {
+            throw new Error(`cca-assessment manifest contradiction: classifications_total (${totalCls}) is smaller than the ${classifications.length} rows shown.`);
+        }
+    }
+    else {
+        for (const cls of ['keep', 'fix', 'retire', 'redesign']) {
+            if (rowTally[cls] !== summary[cls]) {
+                throw new Error(`cca-assessment manifest contradiction: summary says ${cls}: ${summary[cls]} but the table has ${rowTally[cls]} '${cls}' rows. `
+                    + `Counts must equal rows — if the table was capped, mark it with classifications_truncated: true + classifications_shown + classifications_total.`);
+            }
+        }
+    }
+    // total_objects must equal the class-count sum in BOTH branches — the
+    // summary counts cover the full estate even when the table is capped.
+    const expectedTotal = summary.keep + summary.fix + summary.retire + summary.redesign + summary.uncategorized;
+    if (summary.totalObjects !== expectedTotal) {
+        throw new Error(`cca-assessment manifest contradiction: total_objects is ${summary.totalObjects} but keep+fix+retire+redesign+uncategorized = ${expectedTotal}.`);
+    }
     const content = {
         detailPath: kv.detail_path,
         projectId: kv.project_id,
         scope: kv.scope ?? '',
         atcVariant: kv.atc_variant ?? '',
-        summary: {
-            totalObjects: intOr(kv, 'total_objects', classifications.length),
-            keep: intOr(kv, 'keep', 0),
-            fix: intOr(kv, 'fix', 0),
-            retire: intOr(kv, 'retire', 0),
-            redesign: intOr(kv, 'redesign', 0),
-            uncategorized: intOr(kv, 'uncategorized', 0),
-        },
+        summary,
         classifications,
+        ...(truncated
+            ? {
+                classificationsTruncated: true,
+                ...(shown !== undefined ? { classificationsShown: shown } : {}),
+                ...(totalCls !== undefined ? { classificationsTotal: totalCls } : {}),
+            }
+            : {}),
     };
     // One InteractionItem per classification entry, default status 'open'
     // (auto-classified by the AI, awaiting human review).

package/dist/projects/extract-modernize.js

@@ -11,7 +11,7 @@
  *   <!-- csforge:modernize-manifest
  *   artefact: modernize-result
  *   title: ZDPR_PAYMENTS — modernization
- *   detail_path: .abapforge/modernize/zdpr-payments/project.json
+ *   detail_path: .cspeach/modernize/zdpr-payments/project.json
  *   baseline_path: <project-relative path>
  *   baseline_sha256: <hex>
  *   transport: <id or ->