@cspeach/cli 0.9.0 → 1.1.0

package/dist/models/server-config.js

@@ -0,0 +1,155 @@
+// model-governance step 2d (2026-07-10) — the CLI-side reader for the served
+// model-governance config.
+//
+// The proxy serves `GET {proxy_url}/v1/model-config` (Task 3):
+//   { roles: { session_default, audit, compact, router },
+//     pricing: Record<model, { inputPer1M, outputPer1M, cacheReadPer1M, cacheCreatePer1M? }>,
+//     updated_at }
+// top-level keys snake_case, pricing entries camelCase, Cache-Control 60s, no auth.
+//
+// This module fetches that config ONCE at startup (fire-and-forget from repl.tsx
+// / one-shot.ts) and holds it in a synchronous module snapshot that
+// resolveModelRole (resolve.ts) reads. Precedence-wise the served config sits
+// BELOW env + local config and ABOVE the built-in constants — so nothing set ⇒
+// built-ins ⇒ byte-identical to before this feature.
+//
+// Fail-safe contract (locked):
+//   - managed mode ONLY — non-managed modes (byok/local/ai-hub) never fetch.
+//   - startup is NEVER blocked on the fetch: a turn that starts before the fetch
+//     lands simply uses the built-ins.
+//   - on ANY failure (timeout, network, non-2xx, malformed) fall back to a disk
+//     cache written by the last good fetch, but only if it is < 24h old; else
+//     leave the snapshot null (built-ins win).
+//   - loadServerModelConfig NEVER throws.
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { cspeachRoot } from '../config/paths.js';
+// ── Synchronous module snapshot ───────────────────────────────────────────────
+let snapshot = null;
+/** The current served-config snapshot, or null (⇒ built-ins win). Pure sync read. */
+export function getServerModelConfig() {
+    return snapshot;
+}
+/** Test-only setter for the module snapshot. */
+export function __setServerModelConfigForTests(c) {
+    snapshot = c;
+}
+// ── Constants ─────────────────────────────────────────────────────────────────
+const FETCH_TIMEOUT_MS = 5_000;
+const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24h
+function cacheFilePath() {
+    return path.join(cspeachRoot(), 'model-config.json');
+}
+const ROLE_KEYS = ['session_default', 'audit', 'compact', 'router'];
+// ── Coercion ──────────────────────────────────────────────────────────────────
+/** Keep only string, non-empty role entries; unknown keys are dropped. */
+function coerceRoles(raw) {
+    const out = {};
+    if (!raw || typeof raw !== 'object')
+        return out;
+    const r = raw;
+    for (const k of ROLE_KEYS) {
+        const v = r[k];
+        if (typeof v === 'string' && v.trim().length > 0)
+            out[k] = v.trim();
+    }
+    return out;
+}
+function coercePricing(raw) {
+    return raw && typeof raw === 'object' && !Array.isArray(raw)
+        ? raw
+        : {};
+}
+/**
+ * Map a served (or cached) document to a ServerModelConfig, or null when the
+ * shape is unusable. `fetchedAt`, when provided, is preserved (disk-cache read);
+ * otherwise a fresh client timestamp is stamped (live fetch). A document with
+ * NO recognised role is treated as unusable (null) — there is nothing to serve.
+ */
+function coerceDocument(body, fetchedAt) {
+    if (!body || typeof body !== 'object')
+        return null;
+    const b = body;
+    const roles = coerceRoles(b.roles);
+    if (Object.keys(roles).length === 0)
+        return null;
+    return {
+        roles,
+        pricing: coercePricing(b.pricing),
+        fetchedAt: typeof fetchedAt === 'string' && fetchedAt.length > 0 ? fetchedAt : new Date().toISOString(),
+    };
+}
+// ── Disk cache (net-new; whole-document atomic tmp+rename, same as session/store) ─
+async function writeDiskCache(c) {
+    const dir = cspeachRoot();
+    await fs.mkdir(dir, { recursive: true });
+    const file = cacheFilePath();
+    const tmp = `${file}.tmp`;
+    await fs.writeFile(tmp, JSON.stringify(c, null, 2), 'utf-8');
+    await fs.rename(tmp, file);
+}
+/** Read the disk cache, returning it ONLY when parseable AND < 24h old. */
+async function readFreshDiskCache() {
+    let parsed;
+    try {
+        const raw = await fs.readFile(cacheFilePath(), 'utf-8');
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null; // absent or corrupt/unparseable = no cache
+    }
+    const fetchedAt = parsed && typeof parsed === 'object'
+        ? parsed.fetchedAt
+        : undefined;
+    const doc = coerceDocument(parsed, typeof fetchedAt === 'string' ? fetchedAt : undefined);
+    if (!doc)
+        return null;
+    const age = Date.now() - Date.parse(doc.fetchedAt);
+    if (!Number.isFinite(age) || age < 0 || age >= CACHE_MAX_AGE_MS)
+        return null;
+    return doc;
+}
+// ── Public entrypoint ─────────────────────────────────────────────────────────
+/**
+ * Fetch the served model-config and update the module snapshot. Managed mode
+ * ONLY. Fire-and-forget from startup; NEVER throws.
+ */
+export async function loadServerModelConfig(cfg) {
+    // Non-managed modes bypass the proxy for inference and must never fetch.
+    if (cfg.llm?.mode !== 'managed')
+        return;
+    try {
+        // URL construction lives INSIDE the try: a degenerate config (e.g. a
+        // non-string proxy_url that loader.ts never coerced) would otherwise throw
+        // synchronously out of this fire-and-forget call and become an unhandled
+        // rejection that crashes startup. Keep it caught like every other failure.
+        const url = `${cfg.proxy_url.replace(/\/$/, '')}/v1/model-config`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+        timer.unref?.();
+        let body;
+        try {
+            const r = await fetch(url, { signal: controller.signal });
+            if (!r.ok)
+                throw new Error(`model-config fetch: status ${r.status}`);
+            body = await r.json();
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        const doc = coerceDocument(body);
+        if (!doc)
+            throw new Error('model-config fetch: malformed payload');
+        snapshot = doc;
+        // Best-effort cache write — a cache-write failure must not fail the fetch.
+        await writeDiskCache(doc).catch(() => { });
+        return;
+    }
+    catch {
+        // On ANY failure fall back to a fresh (<24h) disk cache; else leave the
+        // snapshot as-is (null at startup) so the built-ins win.
+        const cached = await readFreshDiskCache();
+        if (cached)
+            snapshot = cached;
+    }
+}

package/dist/one-shot.js

@@ -1,15 +1,22 @@
 import chalk from 'chalk';
-import { loadConfig } from './config/loader.js';
+import { loadConfig, resolveLocalBuild } from './config/loader.js';
 import { getStore } from './auth/api-key.js';
 import { getConnection } from './sap/connection-manager.js';
 import { AdtClient } from '@cspeach/sap-client';
 import { makeSessionId, saveSession } from './session/store.js';
 import { newSession } from './session/schema.js';
+import { resolveModelRole } from './models/resolve.js';
+import { loadServerModelConfig } from './models/server-config.js';
 import { createProviderForMode } from './agent/providers/factory.js';
+import { assertModeLicensed, CspeachLicenseError } from './agent/providers/license-gate.js';
 import { runTurn } from './agent/loop.js';
-import { classifyPrompt, parseShortcut } from './router/classifier.js';
-import { setRenderingOverride } from './renderer/tty.js';
+import { classifyPrompt, parseShortcut, rejectUnknownSkill } from './router/classifier.js';
+import { setRenderingOverride, setHeadlessOverride } from './renderer/tty.js';
 import { alwaysDeclinePreviewHook } from './repl/update-method-preview-hook.js';
+import { createClassicOutputEmitter } from './renderer/notices.js';
+import { todoEmitter } from './ui/todo-emitter.js';
+import { applyLocalBuildConfig } from './tools/local-build.js';
+import { getEffectiveWriteMode } from './repl/mode-cycle.js';
 // Side-effect imports for tool registration.
 import './tools/sap-read.js';
 import './tools/sap-write.js';
@@ -18,17 +25,24 @@ import './tools/approval.js';
 import './tools/snapshot.js';
 import './tools/ask-question.js';
 import './tools/dispatch-skill.js';
+import './tools/todo.js';
 import './tools/filesystem/file-read.js';
+import './tools/filesystem/read-document.js';
 import './tools/filesystem/file-edit.js';
 import './tools/filesystem/file-write.js';
 import './tools/filesystem/glob.js';
 import './tools/filesystem/grep.js';
 import './tools/shell/shell_exec.js';
+import './tools/fiori/tools.js';
+import './tools/extend-model/tool.js';
+import './tools/capability/tool.js';
 import './tools/web/web_fetch.js';
 import './tools/web/web_search.js';
 import './tools/project/project_context_get.js';
 import './tools/project/playbook_get.js';
 import './tools/project/convention_get.js';
+import './tools/project/cca_merge.js';
+import './tools/project/upgrade_merge_progress.js';
 import './tools/subagent/_background-shared.js';
 import './tools/subagent/background_run.js';
 import './tools/subagent/monitor_emit.js';
@@ -37,12 +51,40 @@ import './tools/subagent/agent_run.js';
 export async function runOneShot(prompt, opts) {
     const cfg = await loadConfig();
     setRenderingOverride(cfg.ui.rendering);
+    // model-governance step 2d — fire-and-forget fetch of the served model-config
+    // (managed mode only, never blocks). A turn that starts before it lands uses
+    // the built-ins (fail-safe).
+    void loadServerModelConfig(cfg);
+    // B5 (2026-06-11) — one-shot is headless by design: a single turn, no
+    // REPL, often piped (CI / battery). Any stdin prompt would hang forever
+    // (defect D1). The headless answer policy (ask_question auto-answers,
+    // save hook defaults YES, approvals fail fast) keys off this flag.
+    setHeadlessOverride(true);
     // Task C.10 — advisory-only is the only mode the one-shot announces, because
     // non-interactive output should stay minimal. The user needs to know that
     // writes will NOT be executed before a skill that normally writes runs.
-    if (cfg.write_mode === 'advisory-only') {
+    //
+    // Task 3 (ux-wave1) — gate on the EFFECTIVE mode: one-shot's alias choice is
+    // deterministic (--sap-alias or first configured), so the role clamp can be
+    // computed here. A prd alias makes the run advisory even when the config
+    // says gated/auto — the banner must say so. No role ⇒ effective === config
+    // (byte-identical). Alias absent (no SAP configured) ⇒ error out below,
+    // same as before.
+    const oneShotAlias = opts?.sapAlias ?? Object.keys(cfg.sap)[0];
+    const oneShotRole = oneShotAlias !== undefined ? cfg.sap[oneShotAlias]?.role : undefined;
+    if (getEffectiveWriteMode(cfg.write_mode, oneShotRole) === 'advisory-only') {
         console.log(chalk.yellow('⚠  Advisory mode: writes will be proposed, not executed.'));
     }
+    // local_build toggle — force-enable the flag-gated filesystem tools AND
+    // shell_exec BEFORE the (single) turn when persisted-on. Resolve with backward
+    // compat (legacy `local_files = on` still applies). Announce so headless
+    // transcripts record that local file access + command execution were live
+    // (trust-visibility / auditability).
+    {
+        const announce = applyLocalBuildConfig(resolveLocalBuild(cfg), process.cwd());
+        if (announce)
+            console.log(chalk.dim(announce));
+    }
     const store = await getStore();
     if (!(await store.get())) {
         console.error('No API key configured. Run `cspeach` (interactive) first to set one.');
@@ -60,12 +102,20 @@ export async function runOneShot(prompt, opts) {
     }
     const conn = await getConnection(alias, cfg.sap[alias]);
     const adt = new AdtClient(conn);
-    const session = newSession(makeSessionId(), alias, null, cfg.default_model);
+    const session = newSession(makeSessionId(), alias, null, resolveModelRole('session_default', cfg));
     await saveSession(session);
     const parsed = parseShortcut(prompt);
     const body = parsed.prompt;
     let skill;
     if (parsed.skill) {
+        // D35 (2026-06-11) — explicit slash naming a skill that isn't in the
+        // catalog. One-shot has no picker, so fail fast with the notice ("did
+        // you mean" / builtin-with-args) instead of dispatching to a
+        // nonexistent skill (and NEVER falling through to the classifier with
+        // the slash embedded). Shared gate: rejectUnknownSkill in classifier.ts.
+        if (rejectUnknownSkill(parsed, (m) => console.error(chalk.red(m)))) {
+            return 1;
+        }
         skill = parsed.skill;
     }
     else {
@@ -94,6 +144,19 @@ export async function runOneShot(prompt, opts) {
         }
         skill = c.skill;
     }
+    // License gate: non-managed modes (byok/local/ai-hub) bypass our proxy for
+    // inference, so without this anyone who never logged in could use the bundled
+    // skills untracked. Require a valid CSPeach login. (See license-gate.ts.)
+    try {
+        await assertModeLicensed(cfg.llm.mode, async () => (await store.get()) ?? '');
+    }
+    catch (e) {
+        if (e instanceof CspeachLicenseError) {
+            console.error(chalk.yellow(`\n${e.message}\n`));
+            process.exit(1);
+        }
+        throw e;
+    }
     const provider = createProviderForMode(cfg, async () => {
         const key = await store.get();
         if (!key)
@@ -104,7 +167,14 @@ export async function runOneShot(prompt, opts) {
         provider,
         userMessage: body,
         skill,
-        ctx: { adt, sapAlias: alias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: alwaysDeclinePreviewHook },
+        // B2 fix (2026-06-12): one-shot runs render tool notices ('warn'/'info'
+        // — Rule 9 transport overrides, snapshot lines) to stdout instead of
+        // dropping them. Headless transcripts need these for auditability.
+        // Task 5 (ux-wave2): todoEmitter wired for the uniform top-level-ctx
+        // contract — no listener exists in one-shot, so emits are no-ops, but
+        // "top-level ctxs carry it / subagent ctxs omit it" stays the single
+        // rule (see ui/todo-emitter.ts).
+        ctx: { adt, sapAlias: alias, session, cwd: process.cwd(), provider, skillSource: provider.skillSource, previewHook: alwaysDeclinePreviewHook, chunkEmitter: createClassicOutputEmitter(), todoEmitter },
     });
     return 0;
 }

package/dist/projects/answer-blockers.js

@@ -0,0 +1,137 @@
+import { writeFileSync } from 'node:fs';
+import { readProjectFile } from './status.js';
+import { validateEnvelope } from './validate.js';
+/**
+ * The still-open BLOCKER-severity questions of a spec-gap envelope, in item
+ * order. Returns [] for any non-spec-gap artefact (only spec-gap has gaps with
+ * a severity + an `answered` status). Carries any candidate `options` so the
+ * answer UI can offer choices instead of a bare text box.
+ */
+export function openBlockers(env) {
+    if (env.artefactType !== 'spec-gap')
+        return [];
+    const gapById = new Map();
+    for (const s of env.content.sections) {
+        for (const g of s.gaps)
+            gapById.set(g.id, g);
+    }
+    const out = [];
+    for (const it of env.interaction.items) {
+        if (it.status !== 'open')
+            continue;
+        const g = gapById.get(it.id);
+        if (g?.severity !== 'BLOCKER')
+            continue;
+        const ob = { id: it.id, text: g.text };
+        if (g.options && g.options.length > 0) {
+            ob.options = g.options;
+            if (g.optionsMultiSelect)
+                ob.multiSelect = true;
+        }
+        out.push(ob);
+    }
+    return out;
+}
+/**
+ * Return a copy of `env` with each item in `answers` marked answered. Keys with
+ * a blank value are ignored (treated as skipped). version + history are left
+ * untouched (invariant version === history.length holds); lastEditedAt/By move
+ * to the answerer to reflect who filled them.
+ */
+export function applyBlockerAnswers(env, answers, answerer, nowIso) {
+    const items = env.interaction.items.map((it) => {
+        const a = answers.get(it.id);
+        if (a === undefined || a.trim().length === 0)
+            return it;
+        return {
+            ...it,
+            status: 'answered',
+            answer: a,
+            answeredBy: answerer,
+            answeredAt: nowIso,
+        };
+    });
+    return {
+        ...env,
+        interaction: { items },
+        lastEditedAt: nowIso,
+        lastEditedBy: answerer,
+    };
+}
+function affirmative(reply) {
+    const v = reply.trim().toLowerCase();
+    return v === 'y' || v === 'yes';
+}
+/**
+ * Offer to answer the open blockers of the just-saved spec-gap file inline.
+ * No-op (no prompt) when the file isn't a spec-gap or has no open blockers, so
+ * it is always safe to call after any save. In headless runs the prompt returns
+ * '' → declined → nothing happens.
+ *
+ * Returns the count recorded, or null when nothing was offered/written.
+ */
+export async function offerAnswerBlockers(args) {
+    let env;
+    try {
+        env = readProjectFile(args.path);
+    }
+    catch {
+        return null;
+    }
+    const blockers = openBlockers(env);
+    if (blockers.length === 0)
+        return null;
+    const reply = await args.prompt(`Answer the ${blockers.length} unanswered blocker(s) now? [y/N]: `);
+    if (!affirmative(reply))
+        return null;
+    const answers = new Map();
+    for (let i = 0; i < blockers.length; i++) {
+        const b = blockers[i];
+        args.log('');
+        args.log(`Blocker ${i + 1}/${blockers.length}: ${b.text}`);
+        // Choices first, where the question has them and a picker is available.
+        // 'write' falls through to the text box; 'skip' leaves the blocker open.
+        let askText = true;
+        if (b.options && b.options.length > 0 && args.choose) {
+            const c = await args.choose({
+                question: b.text,
+                options: b.options,
+                multiSelect: !!b.multiSelect,
+                index: i,
+                total: blockers.length,
+            });
+            if (c.kind === 'picked') {
+                if (c.answer.trim().length > 0)
+                    answers.set(b.id, c.answer.trim());
+                askText = false;
+            }
+            else if (c.kind === 'skip') {
+                askText = false;
+            }
+            // c.kind === 'write' → askText stays true
+        }
+        if (askText) {
+            const a = (await args.prompt('  Your answer (Enter to skip): ')).trim();
+            if (a.length > 0)
+                answers.set(b.id, a);
+        }
+    }
+    if (answers.size === 0) {
+        args.log('');
+        args.log('No answers entered — all blockers left open for the viewer.');
+        return null;
+    }
+    const nowIso = (args.now ?? (() => new Date().toISOString()))();
+    const revised = applyBlockerAnswers(env, answers, args.identity, nowIso);
+    const check = validateEnvelope(JSON.parse(JSON.stringify(revised)));
+    if (!check.ok) {
+        args.log(`[answer] revision invalid (${check.error.message}) — answers NOT saved.`);
+        return null;
+    }
+    writeFileSync(args.path, JSON.stringify(revised, null, 2), 'utf8');
+    const stillOpen = blockers.length - answers.size;
+    args.log('');
+    args.log(`Recorded ${answers.size} answer(s) in the file`
+        + (stillOpen > 0 ? ` — ${stillOpen} blocker(s) still open for the viewer.` : '.'));
+    return answers.size;
+}

package/dist/projects/extract-cca.js

@@ -9,7 +9,7 @@
  *   <!-- csforge:cca-manifest
  *   artefact: cca-assessment
  *   title: ZFI / ZSD — S/4HANA 2023 estate
- *   detail_path: .abapforge/cca/projects/zfi-zsd-2026-04/project.json
+ *   detail_path: .cspeach/cca/projects/zfi-zsd-2026-04/project.json
  *   project_id: zfi-zsd-2026-04
  *   scope: ZFI* + ZSD*
  *   atc_variant: S4HANA_READINESS_2023
@@ -30,7 +30,9 @@
  * Parsing is permissive — missing optional fields produce defaults; a
  * missing manifest block throws so callers know to surface the error.
  */
-const MANIFEST_RE = /<!--\s*csforge:cca-manifest\s*\n([\s\S]*?)\n\s*-->/;
+// E2 dual-read: accept both the legacy `csforge:` and current `cspeach:`
+// prefixes (legacy acceptance is permanent — old saved artifacts carry it).
+const MANIFEST_RE = /<!--\s*(?:csforge|cspeach):cca-manifest\s*\n([\s\S]*?)\n\s*-->/;
 function parseManifestBlock(markdown) {
     const m = MANIFEST_RE.exec(markdown);
     if (!m) {
@@ -78,6 +80,13 @@ function intOr(kv, key, fallback) {
     const n = Number.parseInt(v, 10);
     return Number.isFinite(n) ? n : fallback;
 }
+function optionalInt(kv, key) {
+    const v = kv[key];
+    if (v === undefined)
+        return undefined;
+    const n = Number.parseInt(v, 10);
+    return Number.isFinite(n) ? n : undefined;
+}
 const CLASSIFICATIONS = ['keep', 'fix', 'retire', 'redesign'];
 const CONFIDENCES = ['high', 'medium', 'low'];
 function asClassification(raw) {
@@ -92,6 +101,36 @@ function asConfidence(raw) {
         ? v
         : 'medium';
 }
+/**
+ * Parse the optional 6th table cell on a merged row:
+ *   `conflict=<label>:<cls>;<label>:<cls>`
+ * (rendered by merge-cca.ts:renderCcaMergeManifest). Returns undefined
+ * for absent / unrecognisable cells; invalid classification values are
+ * skipped pair-wise so one typo doesn't drop the whole record.
+ */
+function parseConflictCell(raw) {
+    if (!raw)
+        return undefined;
+    const m = /^conflict=(.+)$/.exec(raw.trim());
+    if (!m)
+        return undefined;
+    const values = {};
+    for (const pair of m[1].split(';')) {
+        const idx = pair.lastIndexOf(':');
+        if (idx === -1)
+            continue;
+        const label = pair.slice(0, idx).trim();
+        const cls = pair.slice(idx + 1).trim().toLowerCase();
+        if (label.length === 0)
+            continue;
+        if (!CLASSIFICATIONS.includes(cls))
+            continue;
+        values[label] = cls;
+    }
+    if (Object.keys(values).length === 0)
+        return undefined;
+    return { values, rule: 'most-restrictive' };
+}
 export function extractCcaAssessment(markdown) {
     const { kv, tables } = parseManifestBlock(markdown);
     if (kv.artefact !== 'cca-assessment') {
@@ -103,27 +142,82 @@ export function extractCcaAssessment(markdown) {
     if (!kv.project_id) {
         throw new Error("cca-assessment manifest missing required 'project_id'");
     }
-    const classifications = (tables.classifications ?? []).map((row, i) => ({
-        id: row[0] ?? `item-${String(i + 1).padStart(3, '0')}`,
-        objectName: row[1] ?? '',
-        objectType: row[2] ?? '',
-        classification: asClassification(row[3] ?? 'keep'),
-        confidence: asConfidence(row[4] ?? 'medium'),
-    }));
+    const classifications = (tables.classifications ?? []).map((row, i) => {
+        const conflict = parseConflictCell(row[5]);
+        return {
+            id: row[0] ?? `item-${String(i + 1).padStart(3, '0')}`,
+            objectName: row[1] ?? '',
+            objectType: row[2] ?? '',
+            classification: asClassification(row[3] ?? 'keep'),
+            confidence: asConfidence(row[4] ?? 'medium'),
+            ...(conflict ? { conflict } : {}),
+        };
+    });
+    const summary = {
+        totalObjects: intOr(kv, 'total_objects', classifications.length),
+        keep: intOr(kv, 'keep', 0),
+        fix: intOr(kv, 'fix', 0),
+        retire: intOr(kv, 'retire', 0),
+        redesign: intOr(kv, 'redesign', 0),
+        uncategorized: intOr(kv, 'uncategorized', 0),
+    };
+    // ── D6/D7 manifest integrity (2026-06-12) ───────────────────────────────
+    // Battery S4 caught manifests whose counts contradicted their own rows
+    // (`retire: 0` next to 7 retire rows) and tables silently truncated
+    // (27/104 rows, no marker). These manifests are CHAIN INPUT for
+    // /abap-cca-merge — a quiet save corrupts the consolidated estate
+    // numbers, so a contradiction fails the extract LOUDLY instead (same
+    // philosophy as extract-plan's loud-failure path in save-command.ts).
+    const truncated = kv.classifications_truncated === 'true';
+    const shown = optionalInt(kv, 'classifications_shown');
+    const totalCls = optionalInt(kv, 'classifications_total');
+    const rowTally = {
+        keep: 0, fix: 0, retire: 0, redesign: 0,
+    };
+    for (const c of classifications)
+        rowTally[c.classification]++;
+    if (truncated) {
+        if (shown !== undefined && shown !== classifications.length) {
+            throw new Error(`cca-assessment manifest contradiction: classifications_shown is ${shown} but the table has ${classifications.length} rows.`);
+        }
+        for (const cls of ['keep', 'fix', 'retire', 'redesign']) {
+            if (rowTally[cls] > summary[cls]) {
+                throw new Error(`cca-assessment manifest contradiction: ${rowTally[cls]} '${cls}' rows in the table but the summary says ${cls}: ${summary[cls]}. `
+                    + `Counts must cover every row even when the table is truncated.`);
+            }
+        }
+        if (totalCls !== undefined && totalCls < classifications.length) {
+            throw new Error(`cca-assessment manifest contradiction: classifications_total (${totalCls}) is smaller than the ${classifications.length} rows shown.`);
+        }
+    }
+    else {
+        for (const cls of ['keep', 'fix', 'retire', 'redesign']) {
+            if (rowTally[cls] !== summary[cls]) {
+                throw new Error(`cca-assessment manifest contradiction: summary says ${cls}: ${summary[cls]} but the table has ${rowTally[cls]} '${cls}' rows. `
+                    + `Counts must equal rows — if the table was capped, mark it with classifications_truncated: true + classifications_shown + classifications_total.`);
+            }
+        }
+    }
+    // total_objects must equal the class-count sum in BOTH branches — the
+    // summary counts cover the full estate even when the table is capped.
+    const expectedTotal = summary.keep + summary.fix + summary.retire + summary.redesign + summary.uncategorized;
+    if (summary.totalObjects !== expectedTotal) {
+        throw new Error(`cca-assessment manifest contradiction: total_objects is ${summary.totalObjects} but keep+fix+retire+redesign+uncategorized = ${expectedTotal}.`);
+    }
     const content = {
         detailPath: kv.detail_path,
         projectId: kv.project_id,
         scope: kv.scope ?? '',
         atcVariant: kv.atc_variant ?? '',
-        summary: {
-            totalObjects: intOr(kv, 'total_objects', classifications.length),
-            keep: intOr(kv, 'keep', 0),
-            fix: intOr(kv, 'fix', 0),
-            retire: intOr(kv, 'retire', 0),
-            redesign: intOr(kv, 'redesign', 0),
-            uncategorized: intOr(kv, 'uncategorized', 0),
-        },
+        summary,
         classifications,
+        ...(truncated
+            ? {
+                classificationsTruncated: true,
+                ...(shown !== undefined ? { classificationsShown: shown } : {}),
+                ...(totalCls !== undefined ? { classificationsTotal: totalCls } : {}),
+            }
+            : {}),
     };
     // One InteractionItem per classification entry, default status 'open'
     // (auto-classified by the AI, awaiting human review).

package/dist/projects/extract-modernize.js

@@ -11,7 +11,7 @@
  *   <!-- csforge:modernize-manifest
  *   artefact: modernize-result
  *   title: ZDPR_PAYMENTS — modernization
- *   detail_path: .abapforge/modernize/zdpr-payments/project.json
+ *   detail_path: .cspeach/modernize/zdpr-payments/project.json
  *   baseline_path: <project-relative path>
  *   baseline_sha256: <hex>
  *   transport: <id or ->
@@ -27,7 +27,9 @@
  * Parsing is permissive — missing optional fields produce defaults; a
  * missing manifest block throws so callers know to surface the error.
  */
-const MANIFEST_RE = /<!--\s*csforge:modernize-manifest\s*\n([\s\S]*?)\n\s*-->/;
+// E2 dual-read: accept both the legacy `csforge:` and current `cspeach:`
+// prefixes (legacy acceptance is permanent — old saved artifacts carry it).
+const MANIFEST_RE = /<!--\s*(?:csforge|cspeach):modernize-manifest\s*\n([\s\S]*?)\n\s*-->/;
 function parseManifestBlock(markdown) {
     const m = MANIFEST_RE.exec(markdown);
     if (!m) {