@geraldmaron/construct 1.0.18 → 1.0.20

package/README.md

@@ -159,9 +159,11 @@ The embed daemon writes its supervisor stdout log to `~/.cx/runtime/embed-daemon
 |---|---|
 | `construct capability` | Describe what this Construct install can do (embedded contract; read-only, secret-free) |
 | `construct claude:allow` | Manage Claude Code `permissions.allow` from the outside (auto-classifier blocks the agent from editing it) |
+| `construct execution` | Resolve the execution-capability contract for an embedded workflow (orchestrated vs prompt-only; descriptive, not enforced) |
 | `construct hosts` | Show host support for Construct orchestration |
 | `construct mcp` | Manage MCP integrations |
 | `construct models` | Show or update model tier assignments |
+| `construct orchestrate` | Construct-owned local orchestration runtime (Mode-A: single-process, filesystem-backed, no Docker) |
 | `construct plugin` | Manage external Construct plugin manifests |
 
 ### Integrations
@@ -177,16 +179,16 @@ The embed daemon writes its supervisor stdout log to `~/.cx/runtime/embed-daemon
 | Command | What it does |
 |---|---|
 | `construct efficiency` | Show read efficiency, repeated files, and context-budget guidance |
-| `construct eval-datasets` | Sync scored Langfuse traces into eval datasets for prompt regression testing |
+| `construct eval-datasets` | Sync scored traces from the telemetry backend into eval datasets for prompt regression testing |
 | `construct evals` | Show evaluator catalog for prompt and agent experiments |
 | `construct feedback:history` | Show recorded outcome ratings |
 | `construct feedback:record` | Record an outcome rating for a recent specialist invocation |
 | `construct llm-judge` | Run LLM-as-a-judge evaluations on unscored traces for continuous quality feedback |
-| `construct optimize` | Prompt optimization using Langfuse trace quality scores |
-| `construct review` | Generate agent performance review from Langfuse trace backend |
+| `construct optimize` | Prompt optimization using telemetry trace quality scores |
+| `construct review` | Generate agent performance review from the configured telemetry trace backend |
 | `construct telemetry` | Query telemetry traces and latency data |
 | `construct telemetry-backfill` | Backfill sparse traces with observations (trace backend) |
-| `construct telemetry-setup` | Configure Langfuse credentials and trace export |
+| `construct telemetry-setup` | Configure telemetry backend credentials and trace export (OTLP or Langfuse-compatible) |
 
 ### Diagnostics
 
@@ -212,6 +214,8 @@ The embed daemon writes its supervisor stdout log to `~/.cx/runtime/embed-daemon
 | `construct ci` | Local CI mirror: run CI jobs locally or view recent run status |
 | `construct completions` | Shell completion scripts |
 | `construct config` | Deployment mode configuration |
+| `construct decisions` | Index load-bearing decisions and their enforcement bindings |
+| `construct deployment` | Deployment posture tools (capability parity contract) |
 | `construct diff` | Show agent changes since HEAD |
 | `construct embed` | Embed mode management |
 | `construct gates:audit` | Audit policy gates |

package/bin/construct

@@ -1441,9 +1441,19 @@ async function cmdSearch(args) {
 async function cmdStorage(args) {
   const [action, ...rest] = args;
   if (!action) {
-    errorln('Usage: construct storage <sync|status|reset|delete-ingested|repair-migrations|migrations>');
+    errorln('Usage: construct storage <sync|status|reset|reconcile|delete-ingested|repair-migrations|migrations>');
     process.exit(1);
   }
+  if (action === 'reconcile') {
+    const { reconcileObservationEmbeddings } = await import('../lib/embed/reconcile.mjs');
+    const result = await reconcileObservationEmbeddings(process.cwd());
+    if (result.skipped) {
+      println(`Reconcile skipped: ${result.skipped} (no Postgres backend — local index is authoritative).`);
+      return;
+    }
+    println(`Reconciled observations: re-embedded ${result.reembedded} of ${result.checked} (model ${result.model}).`);
+    return;
+  }
   if (action === 'migrations') {
     const { describeMigrations } = await import('../lib/storage/migrations.mjs');
     const sqlClient = createSqlClient(process.env);
@@ -3325,6 +3335,83 @@ async function cmdValidate() {
   process.exit(1);
 }
 
+async function cmdExecution(args) {
+  if (args[0] === 'resolve') {
+    const flag = (name) => { const i = args.indexOf(name); return i !== -1 ? args[i + 1] : undefined; };
+    const { resolveExecution } = await import('../lib/embedded-contract/execution.mjs');
+    const { wrapContractResult } = await import('../lib/embedded-contract/envelope.mjs');
+    const request = {
+      workflowType: flag('--workflow-type'),
+      requestedStrategy: flag('--strategy'),
+      useConstruct: !args.includes('--no-construct'),
+      host: flag('--host'),
+      hostModel: flag('--host-model'),
+      hostProvider: flag('--host-provider'),
+      requestedTier: flag('--tier'),
+      capabilities: flag('--capabilities')?.split(',').map((s) => s.trim()).filter(Boolean),
+      allowCrossProviderFallback: args.includes('--allow-cross-provider'),
+    };
+    const envelope = wrapContractResult(resolveExecution(request), { surface: 'cli' });
+    println(JSON.stringify(envelope, null, 2));
+    return;
+  }
+  println('Usage: construct execution resolve [--workflow-type T] [--strategy orchestrated|prompt-only|auto] [--host-model M] [--host-provider P] [--tier reasoning|standard|fast] [--no-construct] [--allow-cross-provider] [--json]');
+}
+
+async function cmdOrchestrate(args) {
+  const sub = args[0];
+  const rest = args.slice(1);
+  const flag = (name) => { const i = rest.indexOf(name); return i !== -1 ? rest[i + 1] : undefined; };
+  const wantsJson = rest.includes('--json') || args.includes('--json');
+
+  if (sub === 'run') {
+    const { runOrchestration, planRun, hostAdapterMetadata } = await import('../lib/orchestration/runtime.mjs');
+    const positional = rest.filter((a, i) => !a.startsWith('--') && !(i > 0 && rest[i - 1].startsWith('--') && !['--no-construct', '--no-execute', '--json'].includes(rest[i - 1])));
+    const text = flag('--text') || positional.join(' ').trim();
+    if (!text) { errorln('Usage: construct orchestrate run "<request>" [--workflow-type T] [--strategy orchestrated|prompt-only|auto] [--host H] [--host-model M] [--no-construct] [--no-execute] [--json]'); process.exit(1); }
+    const request = {
+      request: text,
+      workflowType: flag('--workflow-type'),
+      requestedStrategy: flag('--strategy') || 'auto',
+      useConstruct: !rest.includes('--no-construct'),
+      host: flag('--host'),
+      hostModel: flag('--host-model'),
+      hostProvider: flag('--host-provider'),
+      fileCount: Number(flag('--file-count') || 0),
+      moduleCount: Number(flag('--module-count') || 0),
+    };
+    const run = rest.includes('--no-execute') ? planRun(request, {}) : runOrchestration(request, {});
+    if (wantsJson) { println(JSON.stringify(hostAdapterMetadata(run), null, 2)); return; }
+    println(`Run ${run.runId} — ${run.status} · executionMode=${run.execution.executionMode} · backend=${run.workerBackend} · hostRole=${run.hostRole}`);
+    if (run.execution.degraded) println(`  degraded: ${run.execution.degradationReason}`);
+    if (run.tasks.length) println(`  tasks: ${run.tasks.map((t) => `${t.role}(${t.status})`).join(' → ')}`);
+    else println('  tasks: none (no Construct-owned specialist sequence for this execution mode)');
+    return;
+  }
+
+  if (sub === 'status') {
+    const { getRun, getRuns, hostAdapterMetadata } = await import('../lib/orchestration/runtime.mjs');
+    const runId = rest.find((a) => !a.startsWith('--'));
+    if (runId) {
+      const run = getRun(process.cwd(), runId);
+      if (!run) { errorln(`Run not found: ${runId}`); process.exit(1); }
+      if (wantsJson) { println(JSON.stringify(hostAdapterMetadata(run), null, 2)); return; }
+      println(`Run ${run.runId} — ${run.status} · executionMode=${run.execution.executionMode}`);
+      for (const t of run.tasks) println(`  ${t.id} ${t.role} — ${t.status}`);
+      return;
+    }
+    const runs = getRuns(process.cwd());
+    if (wantsJson) { println(JSON.stringify(runs, null, 2)); return; }
+    if (!runs.length) { println('No orchestration runs recorded.'); return; }
+    for (const r of runs) println(`  ${r.runId} — ${r.status} · ${r.executionMode || ''} · ${r.createdAt}`);
+    return;
+  }
+
+  println('Usage: construct orchestrate <run|status> [options]');
+  println('  run "<request>" [--workflow-type T] [--strategy S] [--host H] [--host-model M] [--no-construct] [--no-execute] [--json]');
+  println('  status [run-id] [--json]');
+}
+
 async function cmdModels(args) {
   if (args[0] === 'resolve') {
     const flag = (name) => { const i = args.indexOf(name); return i !== -1 ? args[i + 1] : undefined; };
@@ -4097,7 +4184,7 @@ async function cmdCiPreview(args) {
   const jobsSection = jobsStart >= 0 ? yml.slice(jobsStart + 1) : '';
 
   // Find all top-level job keys (2-space indent) and slice blocks between them.
-  const jobKeyPattern = /^  (\w[\w-]*):\s*$/gm;
+  const jobKeyPattern = /^ {2}(\w[\w-]*):\s*$/gm;
   const jobPositions = [];
   let km;
   while ((km = jobKeyPattern.exec(jobsSection)) !== null) {
@@ -4111,7 +4198,7 @@ async function cmdCiPreview(args) {
     const end = jobPositions[i + 1]?.start ?? jobsSection.length;
     const block = jobsSection.slice(start, end);
 
-    const nameMatch = block.match(/^    name:\s*(.+)\s*$/m);
+    const nameMatch = block.match(/^ {4}name:\s*(.+)\s*$/m);
     const displayName = nameMatch
       ? nameMatch[1].replace(/\$\{\{[^}]+\}\}/g, '<matrix>').trim()
       : id;
@@ -5030,6 +5117,8 @@ const handlers = new Map([
   ['docs:reconcile', cmdDocsReconcile],
   ['init:update', cmdInitUpdate],
   ['models', cmdModels],
+  ['execution', cmdExecution],
+  ['orchestrate', cmdOrchestrate],
   ['beads:stats', async (args) => {
     const { getContentionStats, getHumanStatus } = await import('../lib/beads-optimistic.mjs');
     const jsonOutput = args.includes('--json');
@@ -5173,6 +5262,19 @@ const handlers = new Map([
   ['lint:research', cmdLintResearch],
   ['lint:agents', cmdLintAgents],
   ['lint:contracts', cmdLintContracts],
+  ['decisions', async (args) => {
+    const { runDecisionsCli } = await import('../lib/decisions/registry.mjs');
+    return runDecisionsCli(args);
+  }],
+  ['deployment', async (args) => {
+    const sub = args[0];
+    if (sub === 'parity') {
+      const { runDeploymentParityCli } = await import('../lib/deployment/parity-contract.mjs');
+      return runDeploymentParityCli(args.slice(1));
+    }
+    errorln(`Unknown deployment subcommand: ${sub || '(none)'}. Available: parity`);
+    process.exit(1);
+  }],
   ['audit', async (args) => {
     const sub = args[0];
     if (sub === 'skills') return runAuditSkillsCli(args.slice(1));

package/db/schema/003_observation_reconciliation.sql

@@ -0,0 +1,14 @@
+-- db/schema/003_observation_reconciliation.sql
+-- Stamp each observation with the content hash and embedding model that
+-- produced its vector. An idempotent reconciliation pass uses (content_hash,
+-- model) to find rows whose embedding is missing or stale — content edited, or
+-- the embedding model changed — and re-embed only those, rather than relying on
+-- the inline write at creation time always succeeding. Mirrors the
+-- (content_hash, model) tracking construct_embeddings already carries for
+-- documents. Fully idempotent: safe to re-apply.
+
+ALTER TABLE construct_observations ADD COLUMN IF NOT EXISTS content_hash text;
+ALTER TABLE construct_observations ADD COLUMN IF NOT EXISTS model text;
+
+CREATE INDEX IF NOT EXISTS idx_observations_content_hash ON construct_observations (content_hash);
+CREATE INDEX IF NOT EXISTS idx_observations_model ON construct_observations (model);

package/lib/bootstrap/resources.mjs

@@ -17,7 +17,6 @@
  * The registry is consulted by:
  *   - `construct init`         walks every resource, asks consent, installs
  *   - `construct doctor --bootstrap`  re-probes every resource verbosely
- *   - lazy-install paths in hooks (consult the cached consent silently)
  *
  * Resources are "additive" — anyone can register a new resource via
  * `registerResource()` so plugins (or future built-ins) can extend the set

package/lib/cli-commands.mjs

@@ -250,7 +250,7 @@ export const CLI_COMMANDS = [
     category: 'Work',
     core: false,
     description: 'Convert documents to indexed markdown',
-    usage: 'construct ingest <file> [--strict] [--legacy-extractor]',
+    usage: 'construct ingest <file> [--strategy=adapter|provider] [--strict] [--legacy-extractor]',
   },
   {
     name: 'infer',
@@ -323,6 +323,29 @@ export const CLI_COMMANDS = [
       { name: 'describe --json', desc: 'Emit versions, interfaces, roles, skills, workflows, schemas, models, policies, telemetry, plugins' },
     ],
   },
+  {
+    name: 'execution',
+    emoji: '🪢',
+    category: 'Models & Integrations',
+    core: false,
+    description: 'Resolve the execution-capability contract for an embedded workflow (orchestrated vs prompt-only; descriptive, not enforced)',
+    usage: 'construct execution resolve --json',
+    subcommands: [
+      { name: 'resolve --json', desc: 'Report executionMode, active Construct capabilities, and any degradation given host/strategy context' },
+    ],
+  },
+  {
+    name: 'orchestrate',
+    emoji: '🎼',
+    category: 'Models & Integrations',
+    core: false,
+    description: 'Construct-owned local orchestration runtime (Mode-A: single-process, filesystem-backed, no Docker)',
+    usage: 'construct orchestrate <run|status> [options]',
+    subcommands: [
+      { name: 'run "<request>" [--strategy S] [--host H] [--no-construct] [--no-execute] [--json]', desc: 'Plan and run a request through a Construct-owned specialist chain; returns host-adapter metadata' },
+      { name: 'status [run-id] [--json]', desc: 'Inspect a run, or list recent runs' },
+    ],
+  },
   {
     name: 'mcp',
     emoji: '🔌',
@@ -373,7 +396,7 @@ export const CLI_COMMANDS = [
     emoji: '📈',
     category: 'Observability',
     core: false,
-    description: 'Generate agent performance review from Langfuse trace backend',
+    description: 'Generate agent performance review from the configured telemetry trace backend',
     usage: 'construct review [--agent=<id>] [--days=N]',
   },
   {
@@ -381,7 +404,7 @@ export const CLI_COMMANDS = [
     emoji: '⚙️',
     category: 'Observability',
     core: false,
-    description: 'Prompt optimization using Langfuse trace quality scores',
+    description: 'Prompt optimization using telemetry trace quality scores',
     usage: 'construct optimize <agent>',
   },
   {
@@ -397,7 +420,7 @@ export const CLI_COMMANDS = [
     emoji: '📊',
     category: 'Observability',
     core: false,
-    description: 'Sync scored Langfuse traces into eval datasets for prompt regression testing',
+    description: 'Sync scored traces from the telemetry backend into eval datasets for prompt regression testing',
     usage: 'construct eval-datasets',
   },
   {
@@ -580,7 +603,7 @@ export const CLI_COMMANDS = [
     category: 'Advanced',
     core: false,
     description: 'Role framework management',
-    usage: 'construct role <list|set|latest>',
+    usage: 'construct role <list|latest|show|status|resolve|prune|reset>',
   },
   {
     name: 'embed',
@@ -646,6 +669,34 @@ export const CLI_COMMANDS = [
     description: 'Audit policy gates',
     usage: 'construct gates:audit',
   },
+  {
+    name: 'decisions',
+    emoji: '🧭',
+    category: 'Advanced',
+    core: false,
+    description: 'Index load-bearing decisions and their enforcement bindings',
+    usage: 'construct decisions [list|validate|json|check|baseline|golden]',
+    options: [
+      { flag: 'list', desc: 'Show decisions with status and enforcement (default)' },
+      { flag: 'validate', desc: 'Validate registry structure; exit 1 on error' },
+      { flag: 'check', desc: 'Fail on dangling markers, enforcement/supersede/linkage/precedence drift' },
+      { flag: 'baseline', desc: 'Print the enforced baseline; --write to regenerate it' },
+      { flag: 'golden', desc: 'Check the CLI/agent/hook surface snapshot; --write to regenerate it' },
+      { flag: 'json', desc: 'Emit the full registry as JSON' },
+    ],
+  },
+  {
+    name: 'deployment',
+    emoji: '🛰️',
+    category: 'Advanced',
+    core: false,
+    description: 'Deployment posture tools (capability parity contract)',
+    usage: 'construct deployment parity',
+    options: [
+      { flag: 'parity', desc: 'Show and validate capability parity across solo/team/enterprise' },
+      { flag: '--json', desc: 'Emit the parity contract as JSON' },
+    ],
+  },
   {
     name: 'policy',
     emoji: '🔒',
@@ -838,7 +889,7 @@ export const CLI_COMMANDS = [
     emoji: '🩹',
     category: 'Observability',
     core: false,
-    description: 'Configure Langfuse credentials and trace export',
+    description: 'Configure telemetry backend credentials and trace export (OTLP or Langfuse-compatible)',
     usage: 'construct telemetry-setup',
   },
   // ── Internal — callable but not advertised in help or completions ────

package/lib/comment-lint.mjs

@@ -223,6 +223,49 @@ function hasCitationNearby(lines, idx) {
   return false;
 }
 
+// A citation marker proves nothing if it resolves to nothing. Two marker kinds
+// are mechanically verifiable offline: a `[^n]` footnote must have a matching
+// `[^n]:` definition, and a `[source: <repo-path>]` must point at a file that
+// exists. URLs and free-text sources are left alone — unverifiable here, and
+// flagging them would punish honest prose. Skip code fences and tables so regex
+// examples and tabular data never read as dangling citations.
+
+function looksLikeRepoPath(value) {
+  return /^[\w./@-]+$/.test(value) && value.includes('/') && !/^https?:/i.test(value);
+}
+
+export function findDanglingCitations(content, { rootDir = process.cwd() } = {}) {
+  const lines = content.split('\n');
+  const skip = buildSkipMap(lines);
+  const defs = new Set();
+  lines.forEach((line, i) => {
+    if (skip[i]) return;
+    const d = line.match(/^\s*\[\^([^\]]+)\]:/);
+    if (d) defs.add(d[1]);
+  });
+
+  const violations = [];
+  lines.forEach((line, i) => {
+    if (skip[i] || line.includes('construct-lint-ignore')) return;
+    const scan = line.replace(/`[^`]*`/g, '');
+    let m;
+    const refRe = /\[\^([^\]]+)\](?!:)/g;
+    while ((m = refRe.exec(scan)) !== null) {
+      if (!defs.has(m[1])) {
+        violations.push({ line: i + 1, label: `dangling footnote citation [^${m[1]}] has no definition`, kind: 'artifact' });
+      }
+    }
+    const srcRe = /\[source:\s*([^\]]+)\]/gi;
+    while ((m = srcRe.exec(scan)) !== null) {
+      const value = m[1].trim();
+      if (looksLikeRepoPath(value) && !fs.existsSync(path.resolve(rootDir, value))) {
+        violations.push({ line: i + 1, label: `citation source path not found: ${value}`, kind: 'artifact' });
+      }
+    }
+  });
+  return violations;
+}
+
 function checkArtifactBanned(content, rel) {
   if (!isArtifactPath(rel)) return [];
   const lines = content.split('\n');
@@ -316,6 +359,7 @@ export function lintFile(filePath, { rootDir = process.cwd(), fix = false } = {}
   // kind:'artifact' so the hook can let the edit through while still surfacing
   // the finding.
   const artifactHits = checkArtifactBanned(content, rel);
+  if (isArtifactPath(rel)) artifactHits.push(...findDanglingCitations(content, { rootDir }));
   if (artifactHits.length > 0) {
     const mode = process.env.CONSTRUCT_ARTIFACT_LINT_MODE || 'warn';
     const bucket = mode === 'block' ? errors : warnings;

package/lib/config/schema.mjs

@@ -5,7 +5,7 @@
  * AJV/zod to keep Construct dependency-free at startup — the loader runs
  * before npm install completes in some bootstrap paths.
  *
- * Schema v1 covers: alias, deployment, providers, autoEmbed, telemetry.
+ * Schema v1 covers: alias, deployment, providers, autoEmbed, ingest, telemetry.
  * Tier model selection lives in `specialists/registry.json` only — this config
  * file is intentionally not a second edit surface for model assignments.
  * Later phases (6, 7b) extend it with `resources` and `costs` blocks
@@ -24,6 +24,14 @@ export const DEFAULT_PROFILE_ID = 'rnd';
 
 export const SURFACES = ['claude', 'opencode', 'codex', 'copilot', 'vscode', 'cursor'];
 
+export const INGEST_STRATEGIES = ['adapter', 'provider'];
+export const INGEST_FALLBACKS = ['none', 'provider', 'adapter'];
+
+// SessionStart context routing. `auto` keeps the rich payload on stdout for
+// interactive sessions and suppresses it (to a debug log) for non-interactive /
+// SDK invocations, so a one-shot command's stdout stays reserved for its output.
+export const HOOK_OUTPUT_MODES = ['auto', 'silent', 'stderr', 'stdout'];
+
 export const DEFAULT_PROJECT_CONFIG = Object.freeze({
   version: CONFIG_SCHEMA_VERSION,
   alias: 'Construct',
@@ -36,9 +44,16 @@ export const DEFAULT_PROJECT_CONFIG = Object.freeze({
   providers: Object.freeze({}),
   profile: DEFAULT_PROFILE_ID,
   autoEmbed: false,
+  ingest: Object.freeze({
+    strategy: 'adapter',
+    fallback: 'none',
+  }),
   telemetry: Object.freeze({
     enabled: true,
   }),
+  hooks: Object.freeze({
+    outputMode: 'auto',
+  }),
   roleSelection: Object.freeze({
     primary: null,
     secondary: null,
@@ -84,6 +99,14 @@ export const FIELD_RULES = {
   providers: { type: 'object', required: false },
   profile: { type: 'string', required: false, maxLength: 40 },
   autoEmbed: { type: 'boolean', required: false },
+  ingest: {
+    type: 'object',
+    required: false,
+    fields: {
+      strategy: { type: 'string', enum: INGEST_STRATEGIES },
+      fallback: { type: 'string', enum: INGEST_FALLBACKS },
+    },
+  },
   telemetry: {
     type: 'object',
     required: false,
@@ -91,6 +114,13 @@ export const FIELD_RULES = {
       enabled: { type: 'boolean' },
     },
   },
+  hooks: {
+    type: 'object',
+    required: false,
+    fields: {
+      outputMode: { type: 'string', enum: HOOK_OUTPUT_MODES },
+    },
+  },
   roleSelection: {
     type: 'object',
     required: false,

package/lib/contracts/validate.mjs

@@ -300,6 +300,77 @@ function hasSection(body, sectionTitle) {
   return false;
 }
 
+// A fenced ```mermaid block, optionally of a required diagram kind (the kind is
+// matched against the first keyword inside the fence, e.g. flowchart, sequenceDiagram).
+
+function hasMermaid(body, kind) {
+  const re = /```mermaid\s*\n([\s\S]*?)```/g;
+  let m;
+  while ((m = re.exec(body))) {
+    if (!kind) return true;
+    if (new RegExp(`\\b${kind}\\b`, 'i').test(m[1])) return true;
+  }
+  return false;
+}
+
+function hasTable(body) {
+  const lines = body.split('\n');
+  for (let i = 0; i < lines.length - 1; i++) {
+    if (/\|/.test(lines[i]) && /^\s*\|?[\s:-]*-[\s:|-]*\|?\s*$/.test(lines[i + 1]) && lines[i + 1].includes('-')) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// Header rows of every GFM table in the body, each as a lowercased cell list.
+// A table is a `| ... |` line immediately followed by a `|---|` separator row.
+
+function tableHeaderRows(body) {
+  const lines = body.split('\n');
+  const headers = [];
+  for (let i = 0; i < lines.length - 1; i++) {
+    if (/\|/.test(lines[i]) && /^\s*\|?[\s:-]*-[\s:|-]*\|?\s*$/.test(lines[i + 1]) && lines[i + 1].includes('-')) {
+      const cells = lines[i].split('|').map((c) => c.trim().toLowerCase()).filter(Boolean);
+      headers.push({ line: i + 1, cells, rowsBelow: countRows(lines, i + 2) });
+    }
+  }
+  return headers;
+}
+
+function countRows(lines, start) {
+  let n = 0;
+  for (let i = start; i < lines.length; i++) {
+    if (/^\s*\|/.test(lines[i]) || (/\|/.test(lines[i]) && lines[i].trim())) n += 1;
+    else break;
+  }
+  return n;
+}
+
+function tableWithColumns(body, columns) {
+  const want = columns.map((c) => c.trim().toLowerCase());
+  for (const header of tableHeaderRows(body)) {
+    if (want.every((w) => header.cells.includes(w))) return header;
+  }
+  return null;
+}
+
+function sectionIsNonEmpty(body, sectionTitle) {
+  const target = sectionTitle.trim().toLowerCase();
+  const lines = body.split('\n');
+  let inSection = false;
+  for (const line of lines) {
+    const heading = line.match(/^#{1,6}\s+(.+)$/);
+    if (heading) {
+      if (inSection) return false;
+      inSection = heading[1].trim().toLowerCase() === target;
+      continue;
+    }
+    if (inSection && line.trim() && !line.trim().startsWith('<!--')) return true;
+  }
+  return false;
+}
+
 function claimsHaveCitations(body) {
   const lines = body.split('\n');
   const offenders = [];
@@ -367,6 +438,41 @@ export function validateArtifactPostconditions({ contract, artifactPath }) {
         }
         break;
       }
+      case 'artifact-has-mermaid': {
+        if (!hasMermaid(body, pc.diagram)) {
+          errors.push(`[${tag}] artifact missing required mermaid diagram${pc.diagram ? ` (${pc.diagram})` : ''}`);
+        }
+        break;
+      }
+      case 'artifact-has-table': {
+        if (!hasTable(body)) {
+          errors.push(`[${tag}] artifact missing a required table`);
+        }
+        break;
+      }
+      case 'artifact-table-has-columns': {
+        if (!Array.isArray(pc.columns) || pc.columns.length === 0) {
+          errors.push(`[${tag}] postcondition missing 'columns' for artifact-table-has-columns`);
+          break;
+        }
+        const match = tableWithColumns(body, pc.columns);
+        if (!match) {
+          errors.push(`[${tag}] no table has the required columns: ${pc.columns.join(', ')}`);
+        } else if (match.rowsBelow === 0) {
+          errors.push(`[${tag}] required table (${pc.columns.join(', ')}) has no data rows`);
+        }
+        break;
+      }
+      case 'artifact-section-nonempty': {
+        if (!pc.section) {
+          errors.push(`[${tag}] postcondition missing 'section' for artifact-section-nonempty`);
+          break;
+        }
+        if (!sectionIsNonEmpty(body, pc.section)) {
+          errors.push(`[${tag}] required section is empty or missing: "${pc.section}"`);
+        }
+        break;
+      }
       default:
         errors.push(`[${tag}] unknown postcondition check: ${pc.check}`);
     }

package/lib/decisions/enforced-baseline.json

@@ -0,0 +1,25 @@
+{
+  "enforced": [
+    "ADR-0015",
+    "ADR-0016",
+    "ADR-0017",
+    "ADR-0018",
+    "ADR-0019",
+    "ADR-0020",
+    "any-to-business-strategist",
+    "any-to-explorer",
+    "architect-to-data-engineer",
+    "architect-to-evaluator",
+    "architect-to-legal-compliance",
+    "construct-to-rd-lead",
+    "product-manager-to-architect",
+    "product-manager-to-data-analyst",
+    "product-manager-to-ux-researcher",
+    "qa-to-test-automation",
+    "researcher-to-product-manager",
+    "rule:common/comments",
+    "rule:common/no-fabrication",
+    "rule:common/precedence",
+    "rule:common/research-sources"
+  ]
+}