@danielblomma/cortex-mcp 2.4.0 → 2.4.2

package/scaffold/mcp/tests/workflow-synced-capabilities.test.mjs

@@ -10,6 +10,7 @@ import {
 } from "../dist/core/workflow/synced-capability-registry.js";
 import { evaluateToolCall } from "../dist/core/workflow/enforcement.js";
 import { createRun } from "../dist/core/workflow/run-lifecycle.js";
+import { enterpriseCredentialId } from "../dist/core/license.js";
 
 function makeWorkspace() {
   return fs.mkdtempSync(path.join(os.tmpdir(), "cortex-synced-caps-"));
@@ -49,6 +50,23 @@ function writeCache(dir, payload) {
   );
 }
 
+function configureEnterprise(cwd) {
+  const endpoint = "https://licenses.example.com";
+  const apiKey = "ent_capability_12345678";
+  fs.mkdirSync(path.join(cwd, ".context"), { recursive: true });
+  fs.writeFileSync(
+    path.join(cwd, ".context", "enterprise.yml"),
+    [
+      "enterprise:",
+      `  api_key: ${apiKey}`,
+      `  endpoint: ${endpoint}`,
+      "",
+    ].join("\n"),
+    "utf8",
+  );
+  return enterpriseCredentialId(endpoint, apiKey);
+}
+
 test("syncedCapabilitiesCachePath: defaults to ~/.cortex/capabilities.local.json", () => {
   const expected = path.join(os.homedir(), ".cortex", "capabilities.local.json");
   assert.equal(syncedCapabilitiesCachePath(), expected);
@@ -107,16 +125,33 @@ test("loadSyncedCapabilities: returns valid capability definitions", () => {
   assert.deepEqual(loaded["frontend-builder"].write_globs, ["src/components/**"]);
 });
 
+test("loadSyncedCapabilities: rejects a cache bound to another Enterprise identity", () => {
+  const dir = makeWorkspace();
+  writeCache(dir, {
+    credential_id: "identity-a",
+    capabilities: {
+      "frontend-builder": {
+        capability_name: "frontend-builder",
+        updated_at: "2026-05-07T12:00:00.000Z",
+        definition: FRONTEND_BUILDER,
+      },
+    },
+  });
+  assert.deepEqual(loadSyncedCapabilities(dir, "identity-b"), {});
+});
+
 test("evaluateToolCall integration: synced capability is consulted via merged registry", () => {
   const cwd = makeWorkspace();
   // Sandbox the home-dir-based loader.
   const fakeHome = makeWorkspace();
   process.env.HOME = fakeHome;
   try {
+    const credentialId = configureEnterprise(cwd);
     fs.mkdirSync(path.join(fakeHome, ".cortex"), { recursive: true });
     fs.writeFileSync(
       path.join(fakeHome, ".cortex", "capabilities.local.json"),
       JSON.stringify({
+        credential_id: credentialId,
         capabilities: {
           "frontend-builder": {
             capability_name: "frontend-builder",
@@ -163,6 +198,7 @@ test("evaluateToolCall integration: synced capability with same name as bundled
   const fakeHome = makeWorkspace();
   process.env.HOME = fakeHome;
   try {
+    const credentialId = configureEnterprise(cwd);
     // Override the bundled "builder" capability with a much stricter version
     // — only test files writable.
     const stricterBuilder = {
@@ -176,6 +212,7 @@ test("evaluateToolCall integration: synced capability with same name as bundled
     fs.writeFileSync(
       path.join(fakeHome, ".cortex", "capabilities.local.json"),
       JSON.stringify({
+        credential_id: credentialId,
         capabilities: {
           builder: {
             capability_name: "builder",

package/scaffold/mcp/tests/workflow-synced-registry.test.mjs

@@ -11,6 +11,7 @@ import {
 import { resolveWorkflowDefinition } from "../dist/core/workflow/resolution.js";
 import { runWorkflowStart } from "../dist/core/workflow/mcp-tools.js";
 import { SECURE_BUILD_WORKFLOW } from "../dist/core/workflow/default-workflows.js";
+import { enterpriseCredentialId } from "../dist/core/license.js";
 
 function makeWorkspace() {
   return fs.mkdtempSync(path.join(os.tmpdir(), "cortex-synced-registry-"));
@@ -49,6 +50,23 @@ function writeCache(dir, payload) {
   );
 }
 
+function configureEnterprise(cwd) {
+  const endpoint = "https://licenses.example.com";
+  const apiKey = "ent_workflow_12345678";
+  fs.mkdirSync(path.join(cwd, ".context"), { recursive: true });
+  fs.writeFileSync(
+    path.join(cwd, ".context", "enterprise.yml"),
+    [
+      "enterprise:",
+      `  api_key: ${apiKey}`,
+      `  endpoint: ${endpoint}`,
+      "",
+    ].join("\n"),
+    "utf8",
+  );
+  return enterpriseCredentialId(endpoint, apiKey);
+}
+
 test("syncedWorkflowsCachePath: defaults to ~/.cortex/workflows.local.json", () => {
   const expected = path.join(os.homedir(), ".cortex", "workflows.local.json");
   assert.equal(syncedWorkflowsCachePath(), expected);
@@ -110,6 +128,22 @@ test("loadSyncedWorkflows: returns valid workflow definitions keyed by workflow_
   assert.equal(loaded.tiny.stages.length, 2);
 });
 
+test("loadSyncedWorkflows: rejects a cache bound to another Enterprise identity", () => {
+  const dir = makeWorkspace();
+  writeCache(dir, {
+    credential_id: "identity-a",
+    workflows: {
+      tiny: {
+        workflow_id: "tiny",
+        version: 1,
+        updated_at: "2026-05-06T12:00:00.000Z",
+        definition: TINY_WORKFLOW,
+      },
+    },
+  });
+  assert.deepEqual(loadSyncedWorkflows(dir, "identity-b"), {});
+});
+
 test("resolveWorkflow integration: synced workflow takes precedence over bundled default", () => {
   // We can't easily intercept loadSyncedWorkflows() from inside
   // mcp-tools.ts (it reads from a fixed home-dir path). Instead, exercise
@@ -148,10 +182,12 @@ test("resolveWorkflow integration: synced cache adds new workflow_ids beyond def
   const fakeHome = makeWorkspace();
   process.env.HOME = fakeHome;
   try {
+    const credentialId = configureEnterprise(cwd);
     fs.mkdirSync(path.join(fakeHome, ".cortex"), { recursive: true });
     fs.writeFileSync(
       path.join(fakeHome, ".cortex", "workflows.local.json"),
       JSON.stringify({
+        credential_id: credentialId,
         workflows: {
           tiny: {
             workflow_id: "tiny",
@@ -215,7 +251,10 @@ test("resolveWorkflowDefinition: unknown workflow errors list bundled and synced
   const fakeHome = makeWorkspace();
   process.env.HOME = fakeHome;
   try {
+    const cwd = makeWorkspace();
+    const credentialId = configureEnterprise(cwd);
     writeCache(path.join(fakeHome, ".cortex"), {
+      credential_id: credentialId,
       workflows: {
         tiny: {
           workflow_id: "tiny",
@@ -226,7 +265,7 @@ test("resolveWorkflowDefinition: unknown workflow errors list bundled and synced
       },
     });
     assert.throws(
-      () => resolveWorkflowDefinition("missing-workflow"),
+      () => resolveWorkflowDefinition("missing-workflow", { cwd }),
       /Available bundled: secure-build\. Available synced: tiny\./,
     );
   } finally {

package/scaffold/ownership/baseline-v2.4.1.json

@@ -0,0 +1,22 @@
+{
+  "schemaVersion": 1,
+  "baselineId": "v2.4.1",
+  "sourceCommit": "5ae3b00948bad26af2e5eaea60ce0b52567db352",
+  "files": [
+    {
+      "target": ".context/scripts/ingest-parsers.mjs",
+      "sha256": "e971886462c23cd832474729928207985d4fc8e3c60dcf5cf9a0e5f3f8ce5591",
+      "legacyTarget": "scripts/ingest-parsers.mjs"
+    },
+    {
+      "target": ".context/scripts/ingest-worker.mjs",
+      "sha256": "5240b2339b152908dba06d349c2190ecca1881b5be4808cf8021f63fb9557aba",
+      "legacyTarget": "scripts/ingest-worker.mjs"
+    },
+    {
+      "target": ".context/scripts/ingest.mjs",
+      "sha256": "359f213f868e280212c44972a9fc8af58edb6cba28bc3c767d0ec288b52ee6e6",
+      "legacyTarget": "scripts/ingest.mjs"
+    }
+  ]
+}

package/scaffold/ownership/current.json

@@ -0,0 +1,4 @@
+{
+  "schemaVersion": 1,
+  "manifestVersion": 1
+}

package/scaffold/ownership/v1.json

@@ -0,0 +1,456 @@
+{
+  "schemaVersion": 1,
+  "manifestVersion": 1,
+  "managedRoots": [
+    {
+      "source": "mcp",
+      "target": ".context/mcp",
+      "optionalPrefixes": [
+        "dist"
+      ],
+      "files": [
+        "build.mjs",
+        "dist/.cortex-build-hash",
+        "dist/cli/enterprise-setup.js",
+        "dist/cli/govern.js",
+        "dist/cli/query.js",
+        "dist/cli/run.js",
+        "dist/cli/stage.js",
+        "dist/cli/telemetry-test.js",
+        "dist/cli/ungoverned-detector.js",
+        "dist/contextEntities.js",
+        "dist/core/audit/query.js",
+        "dist/core/audit/writer.js",
+        "dist/core/config.js",
+        "dist/core/enterprise-host-identity.js",
+        "dist/core/enterprise-identity.js",
+        "dist/core/enterprise-rotation.js",
+        "dist/core/govern-paths.js",
+        "dist/core/index.js",
+        "dist/core/license.js",
+        "dist/core/policy/enforce.js",
+        "dist/core/policy/injection.js",
+        "dist/core/policy/store.js",
+        "dist/core/rbac/check.js",
+        "dist/core/secure-endpoint.js",
+        "dist/core/telemetry/collector.js",
+        "dist/core/telemetry/state-dir.js",
+        "dist/core/validators/builtins.js",
+        "dist/core/validators/config.js",
+        "dist/core/validators/engine.js",
+        "dist/core/validators/evaluators/code_comments.js",
+        "dist/core/validators/evaluators/regex.js",
+        "dist/core/workflow/artifact-io.js",
+        "dist/core/workflow/capabilities.js",
+        "dist/core/workflow/default-workflows.js",
+        "dist/core/workflow/enforcement.js",
+        "dist/core/workflow/envelope.js",
+        "dist/core/workflow/index.js",
+        "dist/core/workflow/mcp-tools.js",
+        "dist/core/workflow/resolution.js",
+        "dist/core/workflow/run-lifecycle.js",
+        "dist/core/workflow/schemas.js",
+        "dist/core/workflow/synced-capability-registry.js",
+        "dist/core/workflow/synced-registry.js",
+        "dist/daemon/capability-sync-checker.js",
+        "dist/daemon/client.js",
+        "dist/daemon/egress-proxy.js",
+        "dist/daemon/global-host-events.js",
+        "dist/daemon/heartbeat-pusher.js",
+        "dist/daemon/heartbeat-tracker.js",
+        "dist/daemon/host-events-pusher.js",
+        "dist/daemon/main.js",
+        "dist/daemon/paths.js",
+        "dist/daemon/project-service-registry.js",
+        "dist/daemon/protocol.js",
+        "dist/daemon/server.js",
+        "dist/daemon/skill-sync-checker.js",
+        "dist/daemon/sync-checker.js",
+        "dist/daemon/ungoverned-scanner.js",
+        "dist/daemon/workflow-sync-checker.js",
+        "dist/defaults.js",
+        "dist/embed.js",
+        "dist/embedScheduler.js",
+        "dist/embeddings.js",
+        "dist/enterprise/audit/push.js",
+        "dist/enterprise/index.js",
+        "dist/enterprise/model/deploy.js",
+        "dist/enterprise/policy/sync.js",
+        "dist/enterprise/privacy/boundary.js",
+        "dist/enterprise/reviews/changed-files.js",
+        "dist/enterprise/reviews/pattern-context.js",
+        "dist/enterprise/reviews/policy-selection.js",
+        "dist/enterprise/reviews/push.js",
+        "dist/enterprise/reviews/trust-state.js",
+        "dist/enterprise/telemetry/sync.js",
+        "dist/enterprise/tools/enterprise.js",
+        "dist/enterprise/tools/harness.js",
+        "dist/enterprise/tools/walk.js",
+        "dist/enterprise/violations/push.js",
+        "dist/enterprise/workflow/push.js",
+        "dist/enterprise/workflow/state.js",
+        "dist/frontmatter.js",
+        "dist/graph.js",
+        "dist/graphCsv.js",
+        "dist/graphMetrics.js",
+        "dist/hooks/permission-request.js",
+        "dist/hooks/post-tool-use.js",
+        "dist/hooks/pre-compact.js",
+        "dist/hooks/pre-tool-use.js",
+        "dist/hooks/session-end.js",
+        "dist/hooks/session-start.js",
+        "dist/hooks/shared.js",
+        "dist/hooks/stop.js",
+        "dist/hooks/user-prompt-submit.js",
+        "dist/impactPresentation.js",
+        "dist/impactRanking.js",
+        "dist/impactResponse.js",
+        "dist/impactResults.js",
+        "dist/impactSeed.js",
+        "dist/impactTraversal.js",
+        "dist/jsonl.js",
+        "dist/loadGraph.js",
+        "dist/lruCache.js",
+        "dist/paths.js",
+        "dist/patternEvidence.js",
+        "dist/plugin.js",
+        "dist/presets.js",
+        "dist/relatedResponse.js",
+        "dist/relatedTraversal.js",
+        "dist/rules.js",
+        "dist/search.js",
+        "dist/searchCore.js",
+        "dist/searchResults.js",
+        "dist/server.js",
+        "dist/types.js",
+        "package-lock.json",
+        "package.json",
+        "src/cli/enterprise-setup.ts",
+        "src/cli/govern.ts",
+        "src/cli/query.ts",
+        "src/cli/run.ts",
+        "src/cli/stage.ts",
+        "src/cli/telemetry-test.ts",
+        "src/cli/ungoverned-detector.ts",
+        "src/contextEntities.ts",
+        "src/core/audit/query.ts",
+        "src/core/audit/writer.ts",
+        "src/core/config.ts",
+        "src/core/enterprise-host-identity.ts",
+        "src/core/enterprise-identity.ts",
+        "src/core/enterprise-rotation.ts",
+        "src/core/govern-paths.ts",
+        "src/core/index.ts",
+        "src/core/license.ts",
+        "src/core/policy/enforce.ts",
+        "src/core/policy/injection.ts",
+        "src/core/policy/store.ts",
+        "src/core/rbac/check.ts",
+        "src/core/secure-endpoint.ts",
+        "src/core/telemetry/collector.ts",
+        "src/core/telemetry/state-dir.ts",
+        "src/core/validators/builtins.ts",
+        "src/core/validators/config.ts",
+        "src/core/validators/engine.ts",
+        "src/core/validators/evaluators/code_comments.ts",
+        "src/core/validators/evaluators/regex.ts",
+        "src/core/workflow/artifact-io.ts",
+        "src/core/workflow/capabilities.ts",
+        "src/core/workflow/default-workflows.ts",
+        "src/core/workflow/enforcement.ts",
+        "src/core/workflow/envelope.ts",
+        "src/core/workflow/index.ts",
+        "src/core/workflow/mcp-tools.ts",
+        "src/core/workflow/resolution.ts",
+        "src/core/workflow/run-lifecycle.ts",
+        "src/core/workflow/schemas.ts",
+        "src/core/workflow/synced-capability-registry.ts",
+        "src/core/workflow/synced-registry.ts",
+        "src/daemon/capability-sync-checker.ts",
+        "src/daemon/client.ts",
+        "src/daemon/egress-proxy.ts",
+        "src/daemon/global-host-events.ts",
+        "src/daemon/heartbeat-pusher.ts",
+        "src/daemon/heartbeat-tracker.ts",
+        "src/daemon/host-events-pusher.ts",
+        "src/daemon/main.ts",
+        "src/daemon/paths.ts",
+        "src/daemon/project-service-registry.ts",
+        "src/daemon/protocol.ts",
+        "src/daemon/server.ts",
+        "src/daemon/skill-sync-checker.ts",
+        "src/daemon/sync-checker.ts",
+        "src/daemon/ungoverned-scanner.ts",
+        "src/daemon/workflow-sync-checker.ts",
+        "src/defaults.ts",
+        "src/embed.ts",
+        "src/embedScheduler.ts",
+        "src/embeddings.ts",
+        "src/enterprise/audit/push.ts",
+        "src/enterprise/index.ts",
+        "src/enterprise/model/deploy.ts",
+        "src/enterprise/policy/sync.ts",
+        "src/enterprise/privacy/boundary.ts",
+        "src/enterprise/reviews/changed-files.ts",
+        "src/enterprise/reviews/pattern-context.ts",
+        "src/enterprise/reviews/policy-selection.ts",
+        "src/enterprise/reviews/push.ts",
+        "src/enterprise/reviews/trust-state.ts",
+        "src/enterprise/telemetry/sync.ts",
+        "src/enterprise/tools/enterprise.ts",
+        "src/enterprise/tools/harness.ts",
+        "src/enterprise/tools/walk.ts",
+        "src/enterprise/violations/push.ts",
+        "src/enterprise/workflow/push.ts",
+        "src/enterprise/workflow/state.ts",
+        "src/frontmatter.ts",
+        "src/graph.ts",
+        "src/graphCsv.ts",
+        "src/graphMetrics.ts",
+        "src/hooks/permission-request.ts",
+        "src/hooks/post-tool-use.ts",
+        "src/hooks/pre-compact.ts",
+        "src/hooks/pre-tool-use.ts",
+        "src/hooks/session-end.ts",
+        "src/hooks/session-start.ts",
+        "src/hooks/shared.ts",
+        "src/hooks/stop.ts",
+        "src/hooks/user-prompt-submit.ts",
+        "src/impactPresentation.ts",
+        "src/impactRanking.ts",
+        "src/impactResponse.ts",
+        "src/impactResults.ts",
+        "src/impactSeed.ts",
+        "src/impactTraversal.ts",
+        "src/jsonl.ts",
+        "src/loadGraph.ts",
+        "src/lruCache.ts",
+        "src/paths.ts",
+        "src/patternEvidence.ts",
+        "src/plugin.ts",
+        "src/presets.ts",
+        "src/relatedResponse.ts",
+        "src/relatedTraversal.ts",
+        "src/rules.ts",
+        "src/search.ts",
+        "src/searchCore.ts",
+        "src/searchResults.ts",
+        "src/server.ts",
+        "src/types.ts",
+        "tests/changed-files.test.mjs",
+        "tests/copilot-shim.test.mjs",
+        "tests/daemon-client.test.mjs",
+        "tests/egress-proxy.test.mjs",
+        "tests/embed-entities.test.mjs",
+        "tests/embed-scheduler.test.mjs",
+        "tests/embedding-jsonl.test.mjs",
+        "tests/enterprise-config.test.mjs",
+        "tests/enterprise-identity-sync.test.mjs",
+        "tests/enterprise-pattern-context.test.mjs",
+        "tests/enterprise-review-trust.test.mjs",
+        "tests/enterprise-setup.test.mjs",
+        "tests/fixtures/org-skillz-contract.json",
+        "tests/fixtures/review-trust-contract.json",
+        "tests/global-host-events.test.mjs",
+        "tests/govern-install.test.mjs",
+        "tests/govern-repair.test.mjs",
+        "tests/govern-status.test.mjs",
+        "tests/govern.test.mjs",
+        "tests/graph-bulk-load.test.mjs",
+        "tests/graph-csv.test.mjs",
+        "tests/heartbeat-pusher.test.mjs",
+        "tests/heartbeat-tracker.test.mjs",
+        "tests/host-events-pusher.test.mjs",
+        "tests/license.test.mjs",
+        "tests/lru-cache.test.mjs",
+        "tests/paths.test.mjs",
+        "tests/pattern-evidence.test.mjs",
+        "tests/policy-check.test.mjs",
+        "tests/project-service-registry.test.mjs",
+        "tests/query-cli.test.mjs",
+        "tests/repo-name.test.mjs",
+        "tests/review-policy-selection.test.mjs",
+        "tests/review-trust-contract.test.mjs",
+        "tests/review-validator-source.test.mjs",
+        "tests/run.test.mjs",
+        "tests/search-graph-score.test.mjs",
+        "tests/secure-enterprise-endpoint.test.mjs",
+        "tests/server.test.mjs",
+        "tests/skill-sync-checker.test.mjs",
+        "tests/sync-checker.test.mjs",
+        "tests/telemetry-collector.test.mjs",
+        "tests/ungoverned-detector.test.mjs",
+        "tests/ungoverned-scanner.test.mjs",
+        "tests/vector-index.test.mjs",
+        "tests/workflow-cli.test.mjs",
+        "tests/workflow-enforcement.test.mjs",
+        "tests/workflow-envelope.test.mjs",
+        "tests/workflow-mcp-tools.test.mjs",
+        "tests/workflow-synced-capabilities.test.mjs",
+        "tests/workflow-synced-registry.test.mjs",
+        "tests/workflow-validators-override.test.mjs",
+        "tests/workflow.test.mjs",
+        "tsconfig.json"
+      ]
+    },
+    {
+      "source": "scripts",
+      "target": ".context/scripts",
+      "files": [
+        "bootstrap.sh",
+        "context.sh",
+        "dashboard.mjs",
+        "dashboard.sh",
+        "doctor.sh",
+        "embed.sh",
+        "ingest-parsers.mjs",
+        "ingest-worker.mjs",
+        "ingest.mjs",
+        "ingest.sh",
+        "install-git-hooks.sh",
+        "lib/enterprise-check.sh",
+        "lib/ingest/arguments.mjs",
+        "lib/ingest/chunks.mjs",
+        "lib/ingest/config.mjs",
+        "lib/ingest/constants.mjs",
+        "lib/ingest/files.mjs",
+        "lib/ingest/incremental-state.mjs",
+        "lib/ingest/io.mjs",
+        "lib/ingest/main.mjs",
+        "lib/ingest/parser-composition.mjs",
+        "lib/ingest/parser-registry.mjs",
+        "lib/ingest/pipeline-stages.mjs",
+        "lib/ingest/projects.mjs",
+        "lib/ingest/relations.mjs",
+        "lib/ingest/runtime-paths.mjs",
+        "lib/ingest/workers.mjs",
+        "load-kuzu.sh",
+        "load-ryu.sh",
+        "memory-compile.mjs",
+        "memory-compile.sh",
+        "memory-lint.mjs",
+        "memory-lint.sh",
+        "parsers/bash-treesitter.mjs",
+        "parsers/config.mjs",
+        "parsers/cpp-dispatch.mjs",
+        "parsers/cpp-treesitter.mjs",
+        "parsers/cpp.mjs",
+        "parsers/csharp.mjs",
+        "parsers/dotnet/CSharpParser/CSharpParser.csproj",
+        "parsers/dotnet/CSharpParser/Program.cs",
+        "parsers/dotnet/VbNetParser/Program.cs",
+        "parsers/dotnet/VbNetParser/VbNetParser.csproj",
+        "parsers/go-treesitter.mjs",
+        "parsers/java-treesitter.mjs",
+        "parsers/javascript.mjs",
+        "parsers/javascript/ast.mjs",
+        "parsers/javascript/calls.mjs",
+        "parsers/javascript/chunks.mjs",
+        "parsers/javascript/imports.mjs",
+        "parsers/javascript/patterns.mjs",
+        "parsers/javascript/scope-analysis.mjs",
+        "parsers/javascript/scope-builder.mjs",
+        "parsers/javascript/scope-resolver.mjs",
+        "parsers/markdown.mjs",
+        "parsers/package-lock.json",
+        "parsers/package.json",
+        "parsers/python-treesitter.mjs",
+        "parsers/resources.mjs",
+        "parsers/ruby-treesitter.mjs",
+        "parsers/rust-dispatch.mjs",
+        "parsers/rust-treesitter.mjs",
+        "parsers/rust.mjs",
+        "parsers/sql.mjs",
+        "parsers/tree-sitter/base.mjs",
+        "parsers/tree-sitter/queries/bash.calls.scm",
+        "parsers/tree-sitter/queries/bash.chunks.scm",
+        "parsers/tree-sitter/queries/bash.imports.scm",
+        "parsers/tree-sitter/queries/cpp.calls.scm",
+        "parsers/tree-sitter/queries/cpp.chunks.scm",
+        "parsers/tree-sitter/queries/cpp.imports.scm",
+        "parsers/tree-sitter/queries/go.calls.scm",
+        "parsers/tree-sitter/queries/go.chunks.scm",
+        "parsers/tree-sitter/queries/go.imports.scm",
+        "parsers/tree-sitter/queries/java.calls.scm",
+        "parsers/tree-sitter/queries/java.chunks.scm",
+        "parsers/tree-sitter/queries/java.imports.scm",
+        "parsers/tree-sitter/queries/python.calls.scm",
+        "parsers/tree-sitter/queries/python.chunks.scm",
+        "parsers/tree-sitter/queries/python.imports.scm",
+        "parsers/tree-sitter/queries/ruby.calls.scm",
+        "parsers/tree-sitter/queries/ruby.chunks.scm",
+        "parsers/tree-sitter/queries/ruby.imports.scm",
+        "parsers/tree-sitter/queries/rust.calls.scm",
+        "parsers/tree-sitter/queries/rust.chunks.scm",
+        "parsers/tree-sitter/queries/rust.imports.scm",
+        "parsers/vb6.mjs",
+        "parsers/vbnet.mjs",
+        "refresh.sh",
+        "status.sh",
+        "update-context.sh",
+        "watch.sh"
+      ]
+    },
+    {
+      "source": ".githooks",
+      "target": ".githooks",
+      "files": [
+        "_cortex-update-runner.sh",
+        "post-checkout",
+        "post-commit",
+        "post-merge",
+        "post-rewrite"
+      ]
+    },
+    {
+      "source": "docs",
+      "target": "docs",
+      "files": [
+        {
+          "source": "architecture.md",
+          "target": "cortex-architecture.md"
+        }
+      ]
+    }
+  ],
+  "legacyRoots": [
+    {
+      "sourceManagedRoot": ".context/scripts",
+      "target": "scripts"
+    }
+  ],
+  "preStateBaselines": [
+    "v2.4.1"
+  ],
+  "protectedFiles": [
+    ".context/config.yaml",
+    ".context/enterprise.yaml",
+    ".context/enterprise.yml",
+    ".context/ontology.cypher",
+    ".context/rules.yaml",
+    "AGENTS.md",
+    "CLAUDE.md"
+  ],
+  "preservedFiles": [
+    {
+      "source": ".context/config.yaml",
+      "target": ".context/config.yaml"
+    },
+    {
+      "source": ".context/ontology.cypher",
+      "target": ".context/ontology.cypher"
+    },
+    {
+      "source": ".context/rules.yaml",
+      "target": ".context/rules.yaml"
+    },
+    {
+      "source": "AGENTS.md",
+      "target": "AGENTS.md"
+    },
+    {
+      "source": "CLAUDE.md",
+      "target": "CLAUDE.md"
+    }
+  ]
+}