@habitat-ai/cli 0.2.0 → 0.2.1

package/dist/nx-plugin.js

@@ -1742,50 +1742,46 @@ function createHabitatNxPlugin(binding) {
       const result = await client.catalog.resolve({});
       if (result._tag === "Rejected")
         throw rejectedCatalogError(result);
-      return projectApplications(matchedFiles, result.catalog, binding.runtimeInputs);
+      return projectCatalogTargets(matchedFiles, result.catalog, binding.runtimeInputs);
     }
   ];
   return Object.freeze({ createNodes });
 }
-function projectApplications(matchedFiles, catalog, runtimeInputs) {
-  if (catalog.applications.length === 0)
+function projectCatalogTargets(matchedFiles, catalog, runtimeInputs) {
+  if (catalog.applications.length === 0 && catalog.compatibility.rules.length === 0)
     return [];
   const authorityFiles = new Set(matchedFiles);
   const instances = indexInstances(catalog.instances);
   const rootsByOwner = new Map;
+  const ownersByRoot = new Map;
   const projects = new Map;
+  for (const [ownerProject, ownerRoot] of Object.entries(catalog.compatibility.ownerRoots).sort(([left], [right]) => compareText(left, right))) {
+    recordOwnerRoot(ownerProject, ownerRoot, rootsByOwner, ownersByRoot);
+  }
   for (const application of catalog.applications) {
     const instance = requireApplicationInstance(application, instances);
-    const manifestPath = normalizeWorkspacePath(application.manifestPath);
-    if (!authorityFiles.has(manifestPath)) {
-      throw new Error(`Habitat Nx projection rejected instance '${instance.id}': manifest '${manifestPath}' is outside the matched authority files.`);
-    }
-    const root = projectRootFor(manifestPath);
-    const priorRoot = rootsByOwner.get(application.ownerProject);
-    if (priorRoot !== undefined && priorRoot !== root) {
-      throw new Error(`Habitat Nx projection rejected owner '${application.ownerProject}': roots '${priorRoot}' and '${root}' collide.`);
-    }
-    rootsByOwner.set(application.ownerProject, root);
-    const project = projects.get(root) ?? {
-      manifestPath,
-      ownerProject: application.ownerProject,
-      targets: {}
-    };
-    if (project.ownerProject !== application.ownerProject) {
-      throw new Error(`Habitat Nx projection rejected root '${root}': owners '${project.ownerProject}' and '${application.ownerProject}' collide.`);
-    }
+    const manifestPath = requireMatchedManifest(application.manifestPath, authorityFiles, `instance '${instance.id}'`);
+    const root = recordOwnerRoot(application.ownerProject, projectRootFor(manifestPath), rootsByOwner, ownersByRoot);
+    const project = projectFor(projects, root, application.ownerProject);
+    project.applicationManifests.add(manifestPath);
     const targetName = applicationTargetName(application);
-    if (Object.hasOwn(project.targets, targetName)) {
-      throw new Error(`Habitat Nx projection rejected duplicate target '${application.ownerProject}:${targetName}'.`);
+    addLeafTarget(project, targetName, applicationTarget(application, runtimeInputs));
+  }
+  for (const rule of catalog.compatibility.rules) {
+    const root = rootsByOwner.get(rule.ownerProject);
+    if (root === undefined) {
+      throw new Error(`Habitat Nx projection rejected compatibility rule '${rule.ruleId}': owner '${rule.ownerProject}' has no root.`);
     }
-    project.targets[targetName] = applicationTarget(application, runtimeInputs);
-    projects.set(root, project);
+    const manifestPath = requireMatchedManifest(rule.manifestPath, authorityFiles, `compatibility rule '${rule.ruleId}'`);
+    const project = projectFor(projects, root, rule.ownerProject);
+    project.compatibilityManifests.add(manifestPath);
+    addLeafTarget(project, compatibilityTargetName(rule), compatibilityTarget(rule, runtimeInputs));
   }
   return [...projects.entries()].sort(([left], [right]) => compareText(left, right)).map(([root, project]) => {
     const leafTargets = Object.keys(project.targets).sort();
-    project.targets[DEFAULT_CHECK_TARGET] = ownerTarget(project.ownerProject, leafTargets);
+    project.targets[DEFAULT_CHECK_TARGET] = ownerTarget(project.ownerProject, leafTargets, project.compatibilityManifests.size > 0);
     return [
-      project.manifestPath,
+      projectionSource(project),
       {
         projects: {
           [root]: {
@@ -1796,6 +1792,60 @@ function projectApplications(matchedFiles, catalog, runtimeInputs) {
     ];
   });
 }
+function recordOwnerRoot(ownerProject, ownerRoot, rootsByOwner, ownersByRoot) {
+  const root = normalizeWorkspacePath(ownerRoot);
+  const priorRoot = rootsByOwner.get(ownerProject);
+  if (priorRoot !== undefined && priorRoot !== root) {
+    throw new Error(`Habitat Nx projection rejected owner '${ownerProject}': roots '${priorRoot}' and '${root}' collide.`);
+  }
+  const priorOwner = ownersByRoot.get(root);
+  if (priorOwner !== undefined && priorOwner !== ownerProject) {
+    throw new Error(`Habitat Nx projection rejected root '${root}': owners '${priorOwner}' and '${ownerProject}' collide.`);
+  }
+  rootsByOwner.set(ownerProject, root);
+  ownersByRoot.set(root, ownerProject);
+  return root;
+}
+function projectFor(projects, root, ownerProject) {
+  const project = projects.get(root);
+  if (project !== undefined) {
+    if (project.ownerProject !== ownerProject) {
+      throw new Error(`Habitat Nx projection rejected root '${root}': owners '${project.ownerProject}' and '${ownerProject}' collide.`);
+    }
+    return project;
+  }
+  const created = {
+    ownerProject,
+    applicationManifests: new Set,
+    compatibilityManifests: new Set,
+    targets: {}
+  };
+  projects.set(root, created);
+  return created;
+}
+function requireMatchedManifest(path, authorityFiles, subject) {
+  const manifestPath = normalizeWorkspacePath(path);
+  if (!authorityFiles.has(manifestPath)) {
+    throw new Error(`Habitat Nx projection rejected ${subject}: manifest '${manifestPath}' is outside the matched authority files.`);
+  }
+  return manifestPath;
+}
+function addLeafTarget(project, targetName, target) {
+  if (Object.hasOwn(project.targets, targetName)) {
+    throw new Error(`Habitat Nx projection rejected duplicate target '${project.ownerProject}:${targetName}'.`);
+  }
+  project.targets[targetName] = target;
+}
+function projectionSource(project) {
+  const applicationManifest = [...project.applicationManifests].sort(compareText)[0];
+  if (applicationManifest !== undefined)
+    return applicationManifest;
+  const compatibilityManifest = [...project.compatibilityManifests].sort(compareText)[0];
+  if (compatibilityManifest === undefined) {
+    throw new Error(`Habitat Nx projection rejected owner '${project.ownerProject}': projected targets have no manifest.`);
+  }
+  return compatibilityManifest;
+}
 function requireApplicationInstance(application, instances) {
   const instance = instances.get(application.instanceId);
   if (!instance) {
@@ -1825,6 +1875,9 @@ function indexInstances(instances) {
 function applicationTargetName(application) {
   return `habitat:application:${application.instanceId}:${application.ruleId}`;
 }
+function compatibilityTargetName(rule) {
+  return `habitat:rule:${rule.ruleId}`;
+}
 function applicationTarget(application, runtimeInputs) {
   return {
     command: `${HABITAT_EXECUTABLE} check --instance ${application.instanceId} --rule ${application.ruleId}`,
@@ -1837,13 +1890,25 @@ function applicationTarget(application, runtimeInputs) {
     }
   };
 }
-function ownerTarget(ownerProject, leafTargets) {
+function compatibilityTarget(rule, runtimeInputs) {
+  return {
+    command: `${HABITAT_EXECUTABLE} check --rule ${rule.ruleId}`,
+    cache: true,
+    inputs: compatibilityInputs(rule, runtimeInputs),
+    outputs: [],
+    options: { cwd: "{workspaceRoot}" },
+    metadata: { description: `Check Habitat compatibility rule ${rule.ruleId}` }
+  };
+}
+function ownerTarget(ownerProject, leafTargets, hasCompatibility) {
   return {
     executor: "nx:noop",
     cache: false,
     outputs: [],
     dependsOn: leafTargets.map((target) => ({ target })),
-    metadata: { description: `Check resolved Habitat applications owned by ${ownerProject}` }
+    metadata: {
+      description: hasCompatibility ? `Check resolved Habitat policy owned by ${ownerProject}` : `Check resolved Habitat applications owned by ${ownerProject}`
+    }
   };
 }
 function applicationInputs(application, runtimeInputs) {
@@ -1862,6 +1927,16 @@ function applicationInputs(application, runtimeInputs) {
   }
   return [...runtimeInputs, ...[...files].sort()];
 }
+function compatibilityInputs(rule, runtimeInputs) {
+  const files = new Set(HABITAT_CATALOG_PATHS.map(workspaceInput));
+  files.add(workspaceInput(".habitat/**"));
+  files.add(workspaceInput(rule.manifestPath));
+  files.add(workspaceInput(rule.baseline.relativePath));
+  for (const pattern of rule.coveragePatterns)
+    files.add(workspaceInput(pattern));
+  files.add(workspaceInput(rule.runner.name === "grit" ? rule.runner.pattern.relativePath : rule.runner.structure.relativePath));
+  return [...runtimeInputs, ...[...files].sort(compareText)];
+}
 function addSubjectInputs(target, path, kind) {
   const exact = workspaceInput(path);
   target.add(exact);
@@ -48484,11 +48559,142 @@ var ResolvedRuleApplicationSchema = exports_typebox.Object({
     description: "Fully resolved runner and acquisition facts."
   })
 }, { additionalProperties: false, description: "One resolved instance/rule application." });
-var CompatibilityRuleSchema = exports_typebox.Object({
+var CompatibilityPlacementSchema = exports_typebox.Object({
+  niche: exports_typebox.String({
+    minLength: 1,
+    description: "Frozen version-two niche classification."
+  }),
+  blueprint: exports_typebox.String({
+    minLength: 1,
+    description: "Frozen version-two blueprint classification."
+  }),
+  category: exports_typebox.Union([
+    exports_typebox.Literal("boundary"),
+    exports_typebox.Literal("contract"),
+    exports_typebox.Literal("execution"),
+    exports_typebox.Literal("output"),
+    exports_typebox.Literal("policy"),
+    exports_typebox.Literal("quality"),
+    exports_typebox.Literal("structure")
+  ], { description: "Frozen version-two rule category." })
+}, { additionalProperties: false, description: "Legacy rule classification metadata." });
+var CompatibilityPathCoverageSchema = exports_typebox.Object({
+  kind: exports_typebox.Literal("exact-path", {
+    description: "Legacy exact repository-path subject declaration."
+  }),
+  patterns: exports_typebox.Array(exports_typebox.String({
+    minLength: 1,
+    maxLength: 4096,
+    description: "Repository-relative path or glob admitted for checking and caching."
+  }), {
+    minItems: 1,
+    uniqueItems: true,
+    description: "Unique repository path patterns covered by the rule."
+  })
+}, { additionalProperties: false, description: "Legacy exact-path coverage entry." });
+var CompatibilitySupportFilesSchema = exports_typebox.Object({
+  baseline: RelativePathSchema
+}, { additionalProperties: false, description: "Legacy rule support-file locators." });
+var CompatibilityGritRunnerSourceSchema = exports_typebox.Object({
+  name: exports_typebox.Literal("grit", { description: "Grit runner identity." }),
+  files: exports_typebox.Object({
+    pattern: RelativePathSchema
+  }, { additionalProperties: false, description: "Grit rule asset locator." }),
+  patternName: PatternNameSchema,
+  acquisition: exports_typebox.Object({
+    kind: exports_typebox.Literal("check", { description: "Supported compatibility operation." }),
+    roots: exports_typebox.Array(RelativePathSchema, {
+      minItems: 1,
+      uniqueItems: true,
+      description: "Concrete repository roots supplied to Grit."
+    })
+  }, { additionalProperties: false, description: "Compatibility Grit acquisition roots." })
+}, { additionalProperties: false, description: "Supported legacy Grit runner declaration." });
+var CompatibilityStructureRunnerSourceSchema = exports_typebox.Object({
+  name: exports_typebox.Literal("habitat", { description: "Native Habitat runner identity." }),
+  mode: exports_typebox.Literal("structure", { description: "Native structure evaluation mode." }),
+  files: exports_typebox.Object({
+    structure: RelativePathSchema
+  }, { additionalProperties: false, description: "Structure rule asset locator." })
+}, { additionalProperties: false, description: "Supported legacy structure runner declaration." });
+var CompatibilityRuleSourceCommon = {
+  schemaVersion: exports_typebox.Literal(2, { description: "Legacy rule schema version." }),
   id: IdSchema,
+  title: exports_typebox.String({ minLength: 1, maxLength: 500, description: "Legacy rule title." }),
+  placement: CompatibilityPlacementSchema,
+  operation: exports_typebox.Object({
+    kind: exports_typebox.Literal("check", { description: "Only admitted compatibility operation." })
+  }, { additionalProperties: false, description: "Legacy rule operation." }),
+  ownerProject: ProjectIdSchema,
+  lane: exports_typebox.Literal("enforced", { description: "Only admitted compatibility policy lane." }),
+  forbids: exports_typebox.String({
+    minLength: 1,
+    maxLength: 16384,
+    description: "State excluded by the compatibility rule."
+  }),
+  why: exports_typebox.String({
+    minLength: 1,
+    maxLength: 16384,
+    description: "Reason the compatibility rule exists."
+  }),
+  remediate: exports_typebox.String({
+    minLength: 1,
+    maxLength: 16384,
+    description: "Operator remediation for one finding."
+  }),
+  message: RuleMessageSchema,
+  pathCoverage: exports_typebox.Tuple([CompatibilityPathCoverageSchema], {
+    description: "Single exact-path cache boundary for the compatibility rule."
+  }),
+  supportFiles: CompatibilitySupportFilesSchema
+};
+var CompatibilityGritRuleSourceSchema = exports_typebox.Object({
+  ...CompatibilityRuleSourceCommon,
+  hookCheck: exports_typebox.Literal(true, {
+    description: "The legacy hook executes this Grit check."
+  }),
+  runner: CompatibilityGritRunnerSourceSchema
+}, { additionalProperties: false, description: "Supported legacy Grit rule source." });
+var CompatibilityStructureRuleSourceSchema = exports_typebox.Object({
+  ...CompatibilityRuleSourceCommon,
+  runner: CompatibilityStructureRunnerSourceSchema
+}, { additionalProperties: false, description: "Supported legacy structure rule source." });
+var ResolvedCompatibilityGritRunnerSchema = exports_typebox.Object({
+  name: exports_typebox.Literal("grit", { description: "Grit runner identity." }),
+  pattern: ResolvedRuleAssetSchema,
+  patternName: PatternNameSchema,
+  acquisition: exports_typebox.Object({
+    kind: exports_typebox.Literal("check", { description: "Resolved compatibility operation." }),
+    entries: exports_typebox.Array(exports_typebox.Object({
+      kind: PathKindSchema,
+      path: RelativePathSchema
+    }, { additionalProperties: false, description: "Resolved compatibility subject root." }), {
+      minItems: 1,
+      description: "Concrete compatibility roots in declared order."
+    })
+  }, { additionalProperties: false, description: "Resolved compatibility Grit acquisition." })
+}, { additionalProperties: false, description: "Resolved compatibility Grit runner." });
+var ResolvedCompatibilityStructureRunnerSchema = exports_typebox.Object({
+  name: exports_typebox.Literal("habitat", { description: "Native Habitat runner identity." }),
+  mode: exports_typebox.Literal("structure", { description: "Native structure evaluation mode." }),
+  structure: ResolvedRuleAssetSchema
+}, { additionalProperties: false, description: "Resolved compatibility structure runner." });
+var CompatibilityRuleSchema = exports_typebox.Object({
+  ruleId: IdSchema,
   ownerProject: ProjectIdSchema,
-  manifestPath: RelativePathSchema
-}, { additionalProperties: false, description: "Inert version 2 rule identity summary." });
+  manifestPath: RelativePathSchema,
+  lane: exports_typebox.Literal("enforced", { description: "Compatibility rule policy lane." }),
+  message: RuleMessageSchema,
+  remediate: RuleRemediationSchema,
+  provenance: LocalAuthorityProvenanceSchema,
+  coveragePatterns: exports_typebox.Array(exports_typebox.String({ minLength: 1, maxLength: 4096 }), {
+    minItems: 1,
+    uniqueItems: true,
+    description: "Repository path patterns that define compatibility subjects and cache inputs."
+  }),
+  baseline: ResolvedRuleAssetSchema,
+  runner: exports_typebox.Union([ResolvedCompatibilityStructureRunnerSchema, ResolvedCompatibilityGritRunnerSchema], { description: "Resolved compatibility runner and its concrete assets." })
+}, { additionalProperties: false, description: "One executable version 2 compatibility rule." });
 var CompatibilityIndexSchema = exports_typebox.Object({
   $comment: exports_typebox.Optional(exports_typebox.String({ description: "Optional legacy index comment." })),
   schemaVersion: exports_typebox.Literal(2, { description: "Legacy registry schema version." }),
@@ -48497,20 +48703,19 @@ var CompatibilityIndexSchema = exports_typebox.Object({
     description: "Legacy owner roots keyed by project identity."
   })
 }, { additionalProperties: false, description: "Legacy version 2 registry index." });
-var CompatibilityRuleSourceSchema = exports_typebox.Object({
-  schemaVersion: exports_typebox.Literal(2, { description: "Legacy rule schema version." }),
-  id: IdSchema,
-  ownerProject: ProjectIdSchema
-}, { additionalProperties: true, description: "Legacy rule source identity projected inertly." });
+var CompatibilityRuleSourceSchema = exports_typebox.Union([CompatibilityGritRuleSourceSchema, CompatibilityStructureRuleSourceSchema], { description: "Supported version 2 compatibility rule source." });
+var CompatibilityBaselineSchema = exports_typebox.Tuple([], {
+  description: "Empty compatibility baseline; every observed finding remains live."
+});
 var CompatibilityCatalogSchema = exports_typebox.Object({
   schemaVersion: exports_typebox.Literal(2, { description: "Legacy compatibility catalog version." }),
   ownerRoots: exports_typebox.Record(ProjectIdSchema, RelativePathSchema, {
     description: "Validated legacy owner roots keyed by project identity."
   }),
   rules: exports_typebox.Array(CompatibilityRuleSchema, {
-    description: "Stable inert legacy rule identity summaries."
+    description: "Resolved executable compatibility rules in stable identity order."
   })
-}, { additionalProperties: false, description: "Inert version 2 compatibility facts." });
+}, { additionalProperties: false, description: "Version 2 compatibility rule catalog." });
 var ResolvedPolicyPackSchema = exports_typebox.Object({
   name: PackageNameSchema,
   version: PackageVersionSchema,
@@ -48622,6 +48827,44 @@ var CheckSelectionIssueSchema = exports_typebox.Object({
   additionalProperties: false,
   description: "One expected application-selection refusal."
 });
+var ReportOwnerProjectSchema = exports_typebox.String({
+  minLength: 1,
+  maxLength: 250,
+  description: "Repository project that owns the checked rule."
+});
+var ReportInstanceIdSchema = exports_typebox.String({
+  minLength: 1,
+  maxLength: 250,
+  description: "Repository-unique version-three instance identity."
+});
+var ReportRuleIdSchema = exports_typebox.String({
+  minLength: 1,
+  maxLength: 200,
+  description: "Resolved rule identity."
+});
+var ReportLaneSchema = exports_typebox.Union([exports_typebox.Literal("enforced"), exports_typebox.Literal("advisory")], {
+  description: "Rule lane that determines finding severity and terminal status."
+});
+var ReportMessageSchema = exports_typebox.String({
+  minLength: 1,
+  maxLength: 8192,
+  description: "Rule-authored diagnostic message."
+});
+var ReportRemediationSchema = exports_typebox.Union([exports_typebox.String({ maxLength: 16384 }), exports_typebox.Null()], {
+  description: "Rule-authored remediation when supplied."
+});
+var InstanceReportLockSchema = exports_typebox.Literal(false, {
+  description: "Version-three applications do not use compatibility baseline locking."
+});
+var CompatibilityReportLockSchema = exports_typebox.Literal(true, {
+  description: "The compatibility rule has an admitted exact empty baseline."
+});
+var GritRunnerSchema = exports_typebox.Literal("grit", {
+  description: "Mechanical Grit runner used by this check."
+});
+var StructureRunnerSchema = exports_typebox.Literal("habitat", {
+  description: "Native Habitat structure runner used by this check."
+});
 var GritCheckFindingSchema = exports_typebox.Object({
   path: exports_typebox.String({
     minLength: 1,
@@ -48637,7 +48880,7 @@ var GritCheckFindingSchema = exports_typebox.Object({
     description: "Service-owned severity derived from the application lane."
   }),
   baselined: exports_typebox.Literal(false, {
-    description: "Version-three findings are not admitted through the predecessor baseline model."
+    description: "No admitted baseline suppresses this observed finding."
   })
 }, {
   additionalProperties: false,
@@ -48651,80 +48894,83 @@ var CheckApplicationStatusSchema = exports_typebox.Union([
 ], {
   description: "Semantic terminal status for one resolved application."
 });
-var GritCheckApplicationDispositionSchema = exports_typebox.Union([
-  exports_typebox.Object({
-    kind: exports_typebox.Literal("evaluated", {
-      description: "The application completed mechanical evaluation."
-    })
-  }, {
-    additionalProperties: false,
-    description: "Completed mechanical evaluation disposition."
-  }),
-  exports_typebox.Object({
-    kind: exports_typebox.Literal("failed", {
-      description: "The application could not produce trusted findings."
-    }),
-    reason: exports_typebox.Union([
-      RuleEvaluationFailureReasonSchema,
-      exports_typebox.Literal("PatternReadFailed"),
-      exports_typebox.Literal("PatternInvalid"),
-      exports_typebox.Literal("FindingPathInvalid")
-    ], {
-      description: "Stable operational failure reason."
-    }),
-    detail: exports_typebox.String({
-      minLength: 1,
-      maxLength: 4096,
-      description: "Bounded operational failure detail."
-    })
-  }, {
-    additionalProperties: false,
-    description: "Failed application evaluation disposition."
+var GritEvaluatedDispositionSchema = exports_typebox.Object({
+  kind: exports_typebox.Literal("evaluated", {
+    description: "The application completed mechanical evaluation."
   })
-], {
-  description: "Mechanical disposition underlying one semantic application status."
+}, {
+  additionalProperties: false,
+  description: "Completed mechanical evaluation disposition."
 });
-var GritCheckApplicationReportSchema = exports_typebox.Object({
-  ownerProject: exports_typebox.String({
-    minLength: 1,
-    maxLength: 250,
-    description: "Repository project that owns the resolved application."
+var GritFailedDispositionSchema = exports_typebox.Object({
+  kind: exports_typebox.Literal("failed", {
+    description: "The application could not produce trusted findings."
   }),
-  instanceId: exports_typebox.String({
-    minLength: 1,
-    maxLength: 250,
-    description: "Repository-unique instance identity."
+  reason: exports_typebox.Union([
+    RuleEvaluationFailureReasonSchema,
+    exports_typebox.Literal("PatternReadFailed"),
+    exports_typebox.Literal("PatternInvalid"),
+    exports_typebox.Literal("FindingPathInvalid")
+  ], {
+    description: "Stable operational failure reason."
   }),
-  ruleId: exports_typebox.String({
+  detail: exports_typebox.String({
     minLength: 1,
-    maxLength: 200,
-    description: "Resolved rule identity."
-  }),
-  runner: exports_typebox.Literal("grit", {
-    description: "Mechanical runner used by this check operation."
-  }),
-  lane: exports_typebox.Union([exports_typebox.Literal("enforced"), exports_typebox.Literal("advisory")], {
-    description: "Application policy lane."
-  }),
-  locked: exports_typebox.Literal(false, {
-    description: "Version-three applications do not inherit predecessor baseline locking."
+    maxLength: 4096,
+    description: "Bounded operational failure detail."
+  })
+}, {
+  additionalProperties: false,
+  description: "Failed application evaluation disposition."
+});
+var GritNotApplicableDispositionSchema = exports_typebox.Object({
+  kind: exports_typebox.Literal("not-applicable", {
+    description: "The compatibility rule had no live exact-coverage subjects."
   }),
+  reason: exports_typebox.Literal("no-matched-acquisition-roots", {
+    description: "No regular file matched both exact coverage and declared authority."
+  })
+}, {
+  additionalProperties: false,
+  description: "Compatibility rule with no current subject files."
+});
+var GritCheckApplicationDispositionSchema = exports_typebox.Union([GritEvaluatedDispositionSchema, GritFailedDispositionSchema], { description: "Version-three Grit evaluation disposition." });
+var CompatibilityGritCheckApplicationDispositionSchema = exports_typebox.Union([GritEvaluatedDispositionSchema, GritNotApplicableDispositionSchema, GritFailedDispositionSchema], { description: "Compatibility Grit evaluation disposition." });
+var GritInstanceCheckApplicationReportSchema = exports_typebox.Object({
+  ownerProject: ReportOwnerProjectSchema,
+  instanceId: ReportInstanceIdSchema,
+  ruleId: ReportRuleIdSchema,
+  runner: GritRunnerSchema,
+  lane: ReportLaneSchema,
+  locked: InstanceReportLockSchema,
   status: CheckApplicationStatusSchema,
-  message: exports_typebox.String({
-    minLength: 1,
-    maxLength: 8192,
-    description: "Rule-authored finding message."
-  }),
-  remediate: exports_typebox.Union([exports_typebox.String({ maxLength: 16384 }), exports_typebox.Null()], {
-    description: "Rule-authored remediation when supplied."
-  }),
+  message: ReportMessageSchema,
+  remediate: ReportRemediationSchema,
   disposition: GritCheckApplicationDispositionSchema,
   findings: exports_typebox.Array(GritCheckFindingSchema, {
     description: "Deterministically ordered findings for this application."
   })
 }, {
   additionalProperties: false,
-  description: "One resolved application check report."
+  description: "One version-three Grit application report."
+});
+var CompatibilityGritCheckApplicationReportSchema = exports_typebox.Object({
+  ownerProject: ReportOwnerProjectSchema,
+  instanceId: exports_typebox.Null({ description: "Compatibility rules have no version-three instance." }),
+  ruleId: ReportRuleIdSchema,
+  runner: GritRunnerSchema,
+  lane: ReportLaneSchema,
+  locked: CompatibilityReportLockSchema,
+  status: CheckApplicationStatusSchema,
+  message: ReportMessageSchema,
+  remediate: ReportRemediationSchema,
+  disposition: CompatibilityGritCheckApplicationDispositionSchema,
+  findings: exports_typebox.Array(GritCheckFindingSchema, {
+    description: "Deterministically ordered findings for this compatibility rule."
+  })
+}, {
+  additionalProperties: false,
+  description: "One version-two compatibility Grit report."
 });
 var StructureFindingCodeSchema = exports_typebox.Union([
   exports_typebox.Literal("root-missing"),
@@ -48749,7 +48995,7 @@ var StructureCheckFindingSchema = exports_typebox.Object({
     description: "Service-owned severity derived from the application lane."
   }),
   baselined: exports_typebox.Literal(false, {
-    description: "Version-three findings do not inherit predecessor baselines."
+    description: "No admitted baseline suppresses this observed finding."
   })
 }, { additionalProperties: false, description: "One path-only native structure finding." });
 var StructureCheckApplicationDispositionSchema = exports_typebox.Union([
@@ -48775,46 +49021,42 @@ var StructureCheckApplicationDispositionSchema = exports_typebox.Union([
     })
   }, { additionalProperties: false, description: "Failed native structure evaluation." })
 ], { description: "Native structure evaluation disposition." });
-var StructureCheckApplicationReportSchema = exports_typebox.Object({
-  ownerProject: exports_typebox.String({
-    minLength: 1,
-    maxLength: 250,
-    description: "Repository project that owns this structure application."
-  }),
-  instanceId: exports_typebox.String({
-    minLength: 1,
-    maxLength: 250,
-    description: "Resolved instance evaluated by this structure application."
-  }),
-  ruleId: exports_typebox.String({
-    minLength: 1,
-    maxLength: 200,
-    description: "Native structure rule evaluated for this instance."
-  }),
-  runner: exports_typebox.Literal("habitat", {
-    description: "Native Habitat runner used by this application."
-  }),
-  lane: exports_typebox.Union([exports_typebox.Literal("enforced"), exports_typebox.Literal("advisory")], {
-    description: "Policy lane that determines finding severity and completion status."
-  }),
-  locked: exports_typebox.Literal(false, {
-    description: "Native structure reports do not expose Grit lock semantics."
-  }),
+var StructureInstanceCheckApplicationReportSchema = exports_typebox.Object({
+  ownerProject: ReportOwnerProjectSchema,
+  instanceId: ReportInstanceIdSchema,
+  ruleId: ReportRuleIdSchema,
+  runner: StructureRunnerSchema,
+  lane: ReportLaneSchema,
+  locked: InstanceReportLockSchema,
   status: CheckApplicationStatusSchema,
-  message: exports_typebox.String({
-    minLength: 1,
-    maxLength: 8192,
-    description: "Catalog-authored human guidance for this structure rule."
-  }),
-  remediate: exports_typebox.Union([exports_typebox.String({ maxLength: 16384 }), exports_typebox.Null()], {
-    description: "Optional catalog-authored remediation guidance."
-  }),
+  message: ReportMessageSchema,
+  remediate: ReportRemediationSchema,
   disposition: StructureCheckApplicationDispositionSchema,
   findings: exports_typebox.Array(StructureCheckFindingSchema, {
     description: "Deterministically ordered path-only structure findings."
   })
-}, { additionalProperties: false, description: "One native Habitat structure report." });
-var CheckApplicationReportSchema = exports_typebox.Union([GritCheckApplicationReportSchema, StructureCheckApplicationReportSchema], { description: "Runner-discriminated application check report." });
+}, { additionalProperties: false, description: "One version-three native structure report." });
+var CompatibilityStructureCheckApplicationReportSchema = exports_typebox.Object({
+  ownerProject: ReportOwnerProjectSchema,
+  instanceId: exports_typebox.Null({ description: "Compatibility rules have no version-three instance." }),
+  ruleId: ReportRuleIdSchema,
+  runner: StructureRunnerSchema,
+  lane: ReportLaneSchema,
+  locked: CompatibilityReportLockSchema,
+  status: CheckApplicationStatusSchema,
+  message: ReportMessageSchema,
+  remediate: ReportRemediationSchema,
+  disposition: StructureCheckApplicationDispositionSchema,
+  findings: exports_typebox.Array(StructureCheckFindingSchema, {
+    description: "Deterministically ordered path-only compatibility findings."
+  })
+}, { additionalProperties: false, description: "One version-two compatibility structure report." });
+var CheckApplicationReportSchema = exports_typebox.Union([
+  GritInstanceCheckApplicationReportSchema,
+  CompatibilityGritCheckApplicationReportSchema,
+  StructureInstanceCheckApplicationReportSchema,
+  CompatibilityStructureCheckApplicationReportSchema
+], { description: "Runner- and authority-discriminated application check report." });
 var CheckCatalogResultSchema = exports_typebox.Union([
   exports_typebox.Object({
     _tag: exports_typebox.Literal("CatalogRejected", {
@@ -49849,6 +50091,7 @@ var policyPackPackageJsonValidator = new Validator({}, PolicyPackPackageJsonSche
 var instanceValidator = new Validator({}, HabitatInstanceManifestSchema);
 var compatibilityIndexValidator = new Validator({}, CompatibilityIndexSchema);
 var compatibilityRuleValidator = new Validator({}, CompatibilityRuleSourceSchema);
+var compatibilityBaselineValidator = new Validator({}, CompatibilityBaselineSchema);
 function admitPolicyPackSelection(selection, path) {
   const issues = [];
   if (!path.isAbsolute(selection.packageJsonPath)) {
@@ -49899,8 +50142,29 @@ function admitCompatibilityRule(value4, relativePath) {
   const admitted = admit(compatibilityRuleValidator, value4, relativePath);
   return admitted.ok ? { ok: true, source: { rule: admitted.value, relativePath } } : admitted;
 }
+function admitCompatibilityBaseline(value4, relativePath) {
+  return admit(compatibilityBaselineValidator, value4, relativePath);
+}
 function referencedRepositoryPaths(documents, path) {
   const references = new Set;
+  for (const root of Object.values(documents.compatibilityIndex?.ownerRoots ?? {})) {
+    if (relativePathIssues(root, ".habitat/index.json", path).length === 0) {
+      references.add(toRepositoryPath(root, path));
+    }
+  }
+  for (const source of documents.compatibilityRules) {
+    const rule = source.rule;
+    const paths = [
+      rule.supportFiles.baseline,
+      rule.runner.name === "grit" ? rule.runner.files.pattern : rule.runner.files.structure,
+      ...rule.runner.name === "grit" ? rule.runner.acquisition.roots : []
+    ];
+    for (const referencedPath of paths) {
+      if (relativePathIssues(referencedPath, source.relativePath, path).length === 0) {
+        references.add(toRepositoryPath(referencedPath, path));
+      }
+    }
+  }
   for (const source of documents.blueprints) {
     const directory = path.dirname(source.relativePath);
     for (const rule of source.definition.rules) {
@@ -49949,10 +50213,10 @@ function resolveCatalog(documents, pathFacts, workspaceRoot, workspaceRealRoot,
   for (const source of blueprints) {
     issues.push(...validateBlueprint(source, path));
   }
-  const compatibility = resolveCompatibility(documents, issues, path);
+  const compatibility = resolveCompatibility(documents, issues, pathFacts, workspaceRoot, workspaceRealRoot, path);
   const ruleSources = [
     ...blueprints.flatMap((source) => source.definition.rules.map((rule) => ({ identity: rule.id, path: source.relativePath }))),
-    ...compatibility.rules.map((rule) => ({ identity: rule.id, path: rule.manifestPath }))
+    ...compatibility.rules.map((rule) => ({ identity: rule.ruleId, path: rule.manifestPath }))
   ];
   issues.push(...duplicateIssues(ruleSources, "authority-duplicate-rule", "rule"));
   const definitions = new Map(blueprints.map((source) => [blueprintIdentity(source.definition), source]));
@@ -50090,22 +50354,72 @@ function rejected(issues) {
     issues: stable.length > 0 ? stable : [issue("authority-resolution-failed", "", "Catalog resolution failed.")]
   };
 }
-function resolveCompatibility(documents, issues, path) {
+function resolveCompatibility(documents, issues, pathFacts, workspaceRoot, workspaceRealRoot, path) {
   if (!documents.compatibilityIndex) {
     return { schemaVersion: 2, ownerRoots: {}, rules: [] };
   }
   const ownerRoots = Object.fromEntries(Object.entries(documents.compatibilityIndex.ownerRoots).sort(([left], [right]) => textOrder(left, right)));
   for (const [owner, root] of Object.entries(ownerRoots)) {
     issues.push(...relativePathIssues(root, `.habitat/index.json#ownerRoots:${owner}`, path));
+    issues.push(...pathFactIssues(root, "directory", `.habitat/index.json#ownerRoots:${owner}`, pathFacts, workspaceRoot, workspaceRealRoot, path));
   }
   const rules = [...documents.compatibilityRules].sort((left, right) => textOrder(left.rule.id, right.rule.id) || textOrder(left.relativePath, right.relativePath)).map((source) => {
-    if (!Object.hasOwn(ownerRoots, source.rule.ownerProject)) {
-      issues.push(issue("authority-compatibility-invalid", source.relativePath, `Legacy rule ownerProject "${source.rule.ownerProject}" has no owner root.`));
+    const rule = source.rule;
+    if (!Object.hasOwn(ownerRoots, rule.ownerProject)) {
+      issues.push(issue("authority-compatibility-invalid", source.relativePath, `Legacy rule ownerProject "${rule.ownerProject}" has no owner root.`));
+    }
+    for (const pattern4 of rule.pathCoverage[0].patterns) {
+      issues.push(...repositoryPatternIssues(pattern4, source.relativePath, path));
+    }
+    const baselinePath = rule.supportFiles.baseline;
+    const runnerAssetPath = rule.runner.name === "grit" ? rule.runner.files.pattern : rule.runner.files.structure;
+    issues.push(...pathFactIssues(baselinePath, "file", source.relativePath, pathFacts, workspaceRoot, workspaceRealRoot, path), ...pathFactIssues(runnerAssetPath, "file", source.relativePath, pathFacts, workspaceRoot, workspaceRealRoot, path));
+    const provenance = {
+      kind: "local",
+      authorityRoot: workspaceRoot,
+      relativePath: source.relativePath
+    };
+    const asset = (relativePath) => ({
+      provenance,
+      relativePath,
+      absolutePath: path.resolve(workspaceRoot, relativePath)
+    });
+    const common = {
+      ruleId: rule.id,
+      ownerProject: rule.ownerProject,
+      manifestPath: source.relativePath,
+      lane: rule.lane,
+      message: rule.message,
+      remediate: rule.remediate,
+      provenance,
+      coveragePatterns: [...rule.pathCoverage[0].patterns],
+      baseline: asset(baselinePath)
+    };
+    if (rule.runner.name === "habitat") {
+      return {
+        ...common,
+        runner: {
+          name: "habitat",
+          mode: "structure",
+          structure: asset(runnerAssetPath)
+        }
+      };
+    }
+    const entries3 = [];
+    for (const root of rule.runner.acquisition.roots) {
+      const admission = pathFactAnyIssues(root, source.relativePath, pathFacts, workspaceRoot, workspaceRealRoot, path);
+      issues.push(...admission.issues);
+      if (admission.kind !== undefined)
+        entries3.push({ kind: admission.kind, path: root });
     }
     return {
-      id: source.rule.id,
-      ownerProject: source.rule.ownerProject,
-      manifestPath: source.relativePath
+      ...common,
+      runner: {
+        name: "grit",
+        pattern: asset(runnerAssetPath),
+        patternName: rule.runner.patternName,
+        acquisition: { kind: "check", entries: entries3 }
+      }
     };
   });
   return { schemaVersion: 2, ownerRoots, rules };
@@ -50309,6 +50623,15 @@ function pathFactIssues(relativePath, expectedKind, sourcePath, facts, workspace
   }
   return [];
 }
+function pathFactAnyIssues(relativePath, sourcePath, facts, workspaceRoot, workspaceRealRoot, path) {
+  const normalized = toRepositoryPath(relativePath, path);
+  const fact = facts.get(normalized);
+  const kind = fact?.kind === "directory" || fact?.kind === "file" ? fact.kind : undefined;
+  return {
+    kind,
+    issues: pathFactIssues(normalized, kind ?? "directory", sourcePath, facts, workspaceRoot, workspaceRealRoot, path)
+  };
+}
 function ruleAssetPath(source, rule, path) {
   const asset = rule.runner.name === "habitat" ? rule.runner.structure : rule.runner.pattern;
   return toRepositoryPath(path.join(path.dirname(source.relativePath), asset), path);
@@ -50319,6 +50642,12 @@ function relativePathIssues(candidate, sourcePath, path) {
     issue("authority-path-invalid", sourcePath, `Path must be normalized, repository-relative, traversal-free, and non-glob: "${candidate}".`)
   ] : [];
 }
+function repositoryPatternIssues(candidate, sourcePath, path) {
+  const invalid2 = candidate.includes("\\") || path.isAbsolute(candidate) || candidate.includes("//") || candidate.endsWith("/") || candidate.split("/").some((segment) => segment === "" || segment === "..") || /[\u0000-\u001f\u007f]/u.test(candidate);
+  return invalid2 ? [
+    issue("authority-path-invalid", sourcePath, `Coverage pattern must be repository-relative and traversal-free: "${candidate}".`)
+  ] : [];
+}
 function pathTemplateIssues(template2, sourcePath, path) {
   const placeholderCount = template2.split(MEMBER_PLACEHOLDER).length - 1;
   const substituted = template2.replaceAll(MEMBER_PLACEHOLDER, "member");
@@ -50425,7 +50754,11 @@ function selectCheckApplications(catalog2, input) {
   }
   if (issues.length > 0)
     return refused(issues);
-  const selected = catalog2.applications.filter((application) => (selectors?.owner === undefined || application.ownerProject === selectors.owner) && (selectors?.instance === undefined || application.instanceId === selectors.instance) && (requestedRules.length === 0 || requestedRules.includes(application.ruleId)) && (selectors?.runner === undefined || application.runner.name === selectors.runner));
+  const applications = [
+    ...catalog2.applications,
+    ...catalog2.compatibility.rules
+  ];
+  const selected = applications.filter((application) => (selectors?.owner === undefined || application.ownerProject === selectors.owner) && (selectors?.instance === undefined || isInstanceApplication(application) && application.instanceId === selectors.instance) && (requestedRules.length === 0 || requestedRules.includes(application.ruleId)) && (selectors?.runner === undefined || application.runner.name === selectors.runner));
   if (hasExplicitSelectors && selected.length === 0 && !isKnownEmptyRunnerSelection(selectors)) {
     return refused([
       issue2("selector-empty", "selectors", "The requested selector intersection contains no resolved applications.")
@@ -50433,7 +50766,7 @@ function selectCheckApplications(catalog2, input) {
   }
   const unsupported = selected.filter(isUnsupportedGritApplication);
   if (unsupported.length > 0) {
-    return refused(unsupported.map((application) => issue2("runner-unsupported", `${application.instanceId}:${application.ruleId}`, `Rule "${application.ruleId}" requires Grit ${application.runner.acquisition.kind}, which catalog.check does not execute.`)));
+    return refused(unsupported.map((application) => issue2("runner-unsupported", applicationIdentityText(application), `Rule "${application.ruleId}" requires Grit ${application.runner.acquisition.kind}, which catalog.check does not execute.`)));
   }
   return {
     ok: true,
@@ -50479,6 +50812,21 @@ function failedApplication(application, reason, detail) {
     findings: []
   };
 }
+function notApplicableApplication(application) {
+  return {
+    ownerProject: application.ownerProject,
+    instanceId: null,
+    ruleId: application.ruleId,
+    runner: "grit",
+    lane: application.lane,
+    locked: true,
+    message: application.message,
+    remediate: application.remediate,
+    status: "pass",
+    disposition: { kind: "not-applicable", reason: "no-matched-acquisition-roots" },
+    findings: []
+  };
+}
 function evaluatedStructureApplication(application, diagnostics) {
   const severity = application.lane === "enforced" ? "error" : "advisory";
   return {
@@ -50508,6 +50856,18 @@ function completedCheck(applications) {
   };
 }
 function applicationIdentity(application) {
+  if (isCompatibilityRule(application)) {
+    return {
+      ownerProject: application.ownerProject,
+      instanceId: null,
+      ruleId: application.ruleId,
+      runner: "grit",
+      lane: application.lane,
+      locked: true,
+      message: application.message,
+      remediate: application.remediate
+    };
+  }
   return {
     ownerProject: application.ownerProject,
     instanceId: application.instanceId,
@@ -50520,6 +50880,18 @@ function applicationIdentity(application) {
   };
 }
 function structureApplicationIdentity(application) {
+  if (isCompatibilityRule(application)) {
+    return {
+      ownerProject: application.ownerProject,
+      instanceId: null,
+      ruleId: application.ruleId,
+      runner: "habitat",
+      lane: application.lane,
+      locked: true,
+      message: application.message,
+      remediate: application.remediate
+    };
+  }
   return {
     ownerProject: application.ownerProject,
     instanceId: application.instanceId,
@@ -50541,7 +50913,7 @@ function isExecutableCheckApplication(application) {
   return application.runner.name === "habitat" || isGritCheckApplication(application);
 }
 function compareApplications(left, right) {
-  return compareText5(left.ruleId, right.ruleId) || compareText5(left.instanceId, right.instanceId) || compareText5(left.ownerProject, right.ownerProject);
+  return compareText5(left.ruleId, right.ruleId) || compareText5(instanceId(left) ?? "", instanceId(right) ?? "") || compareText5(left.ownerProject, right.ownerProject);
 }
 function compareText5(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
@@ -50553,17 +50925,34 @@ function issue2(code, selector, message) {
   return { code, selector, message };
 }
 function selectionIssue(catalog2, kind, value4) {
+  const applications = [
+    ...catalog2.applications,
+    ...catalog2.compatibility.rules
+  ];
   const matches = {
-    owner: catalog2.applications.some((application) => application.ownerProject === value4),
+    owner: applications.some((application) => application.ownerProject === value4),
     instance: catalog2.applications.some((application) => application.instanceId === value4),
-    rule: catalog2.applications.some((application) => application.ruleId === value4),
-    runner: catalog2.applications.some((application) => application.runner.name === value4)
+    rule: applications.some((application) => application.ruleId === value4),
+    runner: applications.some((application) => application.runner.name === value4)
   };
   if (matches[kind] || kind === "runner" && knownRunnerSelectors.has(value4))
     return;
   const actualKind = ["owner", "instance", "rule", "runner"].find((candidate) => candidate !== kind && matches[candidate]);
   return actualKind === undefined ? issue2("selector-unknown", `${kind}:${value4}`, `No resolved application uses ${kind} "${value4}".`) : issue2("selector-wrong-namespace", `${kind}:${value4}`, `"${value4}" is a known ${actualKind}, not a ${kind}.`);
 }
+function isCompatibilityRule(application) {
+  return "baseline" in application;
+}
+function isInstanceApplication(application) {
+  return "instanceId" in application;
+}
+function instanceId(application) {
+  return isInstanceApplication(application) ? application.instanceId : null;
+}
+function applicationIdentityText(application) {
+  const instance = instanceId(application);
+  return instance === null ? application.ruleId : `${instance}:${application.ruleId}`;
+}
 function isKnownEmptyRunnerSelection(selectors) {
   return selectors?.owner === undefined && selectors?.instance === undefined && selectors?.rule === undefined && selectors?.rules === undefined && selectors?.runner !== undefined && knownRunnerSelectors.has(selectors.runner);
 }
@@ -50626,6 +51015,33 @@ var StructureScopeSchema = exports_typebox.Object({
     description: "Unique direct-child globs rejected in every scope mode."
   }))
 }, { additionalProperties: false, description: "One closed Habitat structure scope." });
+var CompatibilityStructureScopeSchema = exports_typebox.Object({
+  name: exports_typebox.String({
+    minLength: 1,
+    maxLength: 200,
+    description: "Stable identity for one compatibility structure scope."
+  }),
+  root: RootRelativePatternSchema,
+  kind: exports_typebox.Union([exports_typebox.Literal("directory"), exports_typebox.Literal("file")], {
+    description: "Expected kind for every matched scope root."
+  }),
+  mode: exports_typebox.Union([exports_typebox.Literal("open"), exports_typebox.Literal("closed")], {
+    description: "Whether unmatched direct children are admitted."
+  }),
+  allowEmpty: exports_typebox.Optional(exports_typebox.Boolean({ description: "Whether a scope may match no visible roots." })),
+  required: exports_typebox.Optional(exports_typebox.Array(DirectChildPatternSchema, {
+    uniqueItems: true,
+    description: "Unique direct-child globs that must each match at least one child."
+  })),
+  allowed: exports_typebox.Optional(exports_typebox.Array(DirectChildPatternSchema, {
+    uniqueItems: true,
+    description: "Unique direct-child globs admitted by a closed scope."
+  })),
+  forbidden: exports_typebox.Optional(exports_typebox.Array(DirectChildPatternSchema, {
+    uniqueItems: true,
+    description: "Unique direct-child globs rejected in every scope mode."
+  }))
+}, { additionalProperties: false, description: "One closed compatibility structure scope." });
 var StructureDocumentShapeSchema = exports_typebox.Object({
   schemaVersion: exports_typebox.Literal(2, { description: "Structure document schema version." }),
   scopes: exports_typebox.Array(StructureScopeSchema, {
@@ -50634,9 +51050,20 @@ var StructureDocumentShapeSchema = exports_typebox.Object({
   })
 }, { additionalProperties: false, description: "Closed Habitat structure document." });
 var StructureDocumentSchema = exports_typebox.Refine(StructureDocumentShapeSchema, hasUniqueScopeNames, () => "Expected unique structure scope names");
+var CompatibilityStructureDocumentShapeSchema = exports_typebox.Object({
+  schemaVersion: exports_typebox.Literal(1, { description: "Compatibility structure schema version." }),
+  scopes: exports_typebox.Array(CompatibilityStructureScopeSchema, {
+    minItems: 1,
+    description: "Compatibility structure scopes evaluated in declared order."
+  })
+}, { additionalProperties: false, description: "Closed compatibility structure document." });
+var CompatibilityStructureDocumentSchema = exports_typebox.Refine(CompatibilityStructureDocumentShapeSchema, hasUniqueCompatibilityScopeNames, () => "Expected unique compatibility structure scope names");
 function hasUniqueScopeNames(document) {
   return new Set(document.scopes.map((scope3) => scope3.name)).size === document.scopes.length;
 }
+function hasUniqueCompatibilityScopeNames(document) {
+  return new Set(document.scopes.map((scope3) => scope3.name)).size === document.scopes.length;
+}
 function isSafeRootRelativePattern(value4) {
   if (!isValidGlob(value4))
     return false;
@@ -50661,7 +51088,34 @@ function isHabitatStructureApplication(application) {
   return application.runner.name === "habitat";
 }
 var structureValidator = new Validator({}, StructureDocumentSchema);
+var compatibilityStructureValidator = new Validator({}, CompatibilityStructureDocumentSchema);
 function admitStructureDocument(value4, application) {
+  if (isCompatibilityStructureApplication(application)) {
+    if (!compatibilityStructureValidator.Check(value4)) {
+      const [, errors4] = compatibilityStructureValidator.Errors(value4);
+      return {
+        ok: false,
+        detail: errors4.slice(0, 20).map((error2) => error2.message).join("; ") || "Structure document does not satisfy compatibility schema version 1."
+      };
+    }
+    return {
+      ok: true,
+      admitted: {
+        application,
+        scopes: value4.scopes.map((scope3) => ({
+          name: scope3.name,
+          relativePath: scope3.root,
+          kind: scope3.kind,
+          mode: scope3.mode,
+          allowEmpty: scope3.allowEmpty ?? false,
+          ...scope3.required === undefined ? {} : { required: scope3.required },
+          ...scope3.allowed === undefined ? {} : { allowed: scope3.allowed },
+          ...scope3.forbidden === undefined ? {} : { forbidden: scope3.forbidden },
+          bindingPath: "."
+        }))
+      }
+    };
+  }
   if (!structureValidator.Check(value4)) {
     const [, errors4] = structureValidator.Errors(value4);
     return {
@@ -50691,10 +51145,23 @@ function admitStructureDocument(value4, application) {
         detail: `Structure scope "${scope3.name}" resolves beyond the maximum repository path length.`
       };
     }
-    scopes.push({ ...scope3, allowEmpty: scope3.allowEmpty ?? false, bindingPath: binding.path });
+    scopes.push({
+      name: scope3.name,
+      relativePath: scope3.relativePath,
+      kind: scope3.kind,
+      mode: scope3.mode,
+      allowEmpty: scope3.allowEmpty ?? false,
+      ...scope3.required === undefined ? {} : { required: scope3.required },
+      ...scope3.allowed === undefined ? {} : { allowed: scope3.allowed },
+      ...scope3.forbidden === undefined ? {} : { forbidden: scope3.forbidden },
+      bindingPath: binding.path
+    });
   }
   return { ok: true, admitted: { application, scopes } };
 }
+function isCompatibilityStructureApplication(application) {
+  return "baseline" in application;
+}
 function makeStructureUniverse(inventory) {
   const trackedNonFilePaths = new Set(inventory.trackedNonFilePaths);
   const visiblePaths = inventory.paths.filter((candidate) => !ancestors(candidate).some((ancestor) => trackedNonFilePaths.has(ancestor)));
@@ -50921,6 +51388,13 @@ var excludedDirectorySegments = new Set([
   "vendor"
 ]);
 var excludedRepositoryGlobs = [...excludedDirectorySegments].map((segment) => `**/${segment}/**`);
+var compatibilityProtectedRoots = [
+  ".git",
+  ".habitat/cache/patterns",
+  "dist",
+  "node_modules",
+  "tools/habitat/dist"
+];
 var MAX_MANIFEST_DIRECTORIES = 50000;
 function resolveCurrentCatalog(context4) {
   return exports_Effect.gen(function* () {
@@ -51229,10 +51703,69 @@ function resolveCurrentCatalog(context4) {
         continue;
       }
       const admitted = admitCompatibilityRule(parsed.success, relativePath);
-      if (admitted.ok)
-        compatibilityRules.push(admitted.source);
-      else
+      if (!admitted.ok) {
         issues.push(...admitted.issues);
+        continue;
+      }
+      const baselinePath = admitted.source.rule.supportFiles.baseline;
+      const absoluteBaselinePath = path.resolve(workspaceRoot, baselinePath);
+      if (!isContained2(workspaceRoot, absoluteBaselinePath, path)) {
+        issues.push({
+          code: "authority-path-escape",
+          path: baselinePath,
+          message: "Compatibility baseline escapes workspaceRoot."
+        });
+        continue;
+      }
+      const baselineRealPath = yield* exports_Effect.result(fileSystem.realPath(absoluteBaselinePath));
+      if (baselineRealPath._tag === "Failure") {
+        issues.push(filesystemIssue(baselineRealPath.failure, baselinePath, "resolve compatibility baseline", "Compatibility baseline does not exist."));
+        continue;
+      }
+      if (!isContained2(workspaceRealRoot, baselineRealPath.success, path)) {
+        issues.push({
+          code: "authority-path-escape",
+          path: baselinePath,
+          message: "Compatibility baseline escapes workspaceRoot through a symbolic link."
+        });
+        continue;
+      }
+      const baselineStat = yield* exports_Effect.result(fileSystem.stat(baselineRealPath.success));
+      if (baselineStat._tag === "Failure") {
+        issues.push(filesystemIssue(baselineStat.failure, baselinePath, "inspect compatibility baseline", "Compatibility baseline does not exist."));
+        continue;
+      }
+      if (baselineStat.success.type !== "File") {
+        issues.push({
+          code: "authority-path-kind-mismatch",
+          path: baselinePath,
+          message: "Compatibility baseline must be a regular file."
+        });
+        continue;
+      }
+      const baselineRead = yield* exports_Effect.result(fileSystem.readFileString(baselineRealPath.success));
+      if (baselineRead._tag === "Failure") {
+        issues.push(filesystemIssue(baselineRead.failure, baselinePath, "read compatibility baseline", "Compatibility baseline does not exist."));
+        continue;
+      }
+      const baselineParsed = yield* exports_Effect.result(exports_Effect.try({
+        try: () => JSON.parse(baselineRead.success),
+        catch: (cause) => cause
+      }));
+      if (baselineParsed._tag === "Failure") {
+        issues.push({
+          code: "authority-json-invalid",
+          path: baselinePath,
+          message: "Compatibility baseline is not valid JSON."
+        });
+        continue;
+      }
+      const baseline = admitCompatibilityBaseline(baselineParsed.success, baselinePath);
+      if (!baseline.ok) {
+        issues.push(...baseline.issues);
+        continue;
+      }
+      compatibilityRules.push({ ...admitted.source, baseline: baseline.value });
     }
     if (issues.length > 0)
       return rejected(issues);
@@ -51447,7 +51980,19 @@ var check7 = module3.check.effect(function* ({ context: context4, input }) {
       reports.push(failedApplication(application, "PatternInvalid", program.detail));
       continue;
     }
-    const subjects = resolvedSubjects(application, context4.workspaceRoot, context4.path);
+    const subjectPreparation = yield* prepareGritSubjects(application, context4.workspaceRoot, context4.fileSystem, context4.path);
+    if (subjectPreparation.kind === "failed") {
+      reports.push(failedApplication(application, "SetupFailed", subjectPreparation.detail));
+      continue;
+    }
+    if (subjectPreparation.kind === "not-applicable") {
+      if (!isCompatibilityRule(application)) {
+        return yield* exports_Effect.die(new Error("Version-three Grit applications cannot be not applicable."));
+      }
+      reports.push(notApplicableApplication(application));
+      continue;
+    }
+    const subjects = subjectPreparation.subjects;
     const evaluation = yield* exports_Effect.result(context4.ruleEvaluation.evaluate({
       program: program.program,
       subjectPaths: subjects.map((subject) => subject.absolutePath)
@@ -51492,6 +52037,100 @@ function hasExactCauseCode(error2, code) {
   const cause = "cause" in error2.reason ? error2.reason.cause : undefined;
   return typeof cause === "object" && cause !== null && "code" in cause && cause.code === code;
 }
+function prepareGritSubjects(application, workspaceRoot, fileSystem, path) {
+  if (!isCompatibilityRule(application)) {
+    return exports_Effect.succeed({
+      kind: "ready",
+      subjects: resolvedSubjects(application, workspaceRoot, path)
+    });
+  }
+  return exports_Effect.gen(function* () {
+    const workspaceRealPath = yield* exports_Effect.result(fileSystem.realPath(workspaceRoot));
+    if (workspaceRealPath._tag === "Failure") {
+      return {
+        kind: "failed",
+        detail: "Unable to canonicalize the compatibility workspace root."
+      };
+    }
+    const authority = resolvedSubjects(application, workspaceRoot, path);
+    for (const root of authority) {
+      const canonical = yield* exports_Effect.result(fileSystem.realPath(root.absolutePath));
+      if (canonical._tag === "Failure") {
+        return {
+          kind: "failed",
+          detail: `Unable to canonicalize compatibility acquisition root "${toRepositoryPath2(path.relative(workspaceRoot, root.absolutePath), path.sep)}".`
+        };
+      }
+      const expectedCanonical = path.resolve(workspaceRealPath.success, path.relative(workspaceRoot, root.absolutePath));
+      if (canonical.success !== expectedCanonical || !isContained2(workspaceRealPath.success, canonical.success, path)) {
+        return {
+          kind: "failed",
+          detail: `Compatibility acquisition root "${toRepositoryPath2(path.relative(workspaceRoot, root.absolutePath), path.sep)}" is a symbolic link; compatibility checks accept direct workspace roots only.`
+        };
+      }
+    }
+    const resolvedCoveragePatterns = application.coveragePatterns.map((pattern4) => path.resolve(workspaceRoot, pattern4));
+    const compatibilityExcludes = [path.resolve(workspaceRoot, "**/node_modules/**")];
+    const globAttempts = yield* exports_Effect.all(resolvedCoveragePatterns.map((pattern4) => exports_Effect.result(fileSystem.glob(pattern4, { exclude: compatibilityExcludes }))));
+    const failedGlob = globAttempts.find((attempt) => attempt._tag === "Failure");
+    if (failedGlob?._tag === "Failure") {
+      return {
+        kind: "failed",
+        detail: "Unable to enumerate compatibility exact-path coverage."
+      };
+    }
+    const directAttempts = yield* exports_Effect.all(resolvedCoveragePatterns.map((pattern4) => exports_Effect.result(fileSystem.stat(pattern4))));
+    const failedDirect = directAttempts.find((attempt) => attempt._tag === "Failure" && !isNotFound(attempt.failure));
+    if (failedDirect?._tag === "Failure") {
+      return {
+        kind: "failed",
+        detail: "Unable to inspect compatibility exact-path coverage."
+      };
+    }
+    const candidates2 = stablePaths([
+      ...globAttempts.flatMap((attempt) => attempt._tag === "Success" ? attempt.success.map((candidate) => path.isAbsolute(candidate) ? path.resolve(candidate) : path.resolve(workspaceRoot, candidate)) : []),
+      ...directAttempts.flatMap((attempt, index4) => attempt._tag === "Success" && attempt.success.type === "File" ? [resolvedCoveragePatterns[index4]] : [])
+    ].filter((candidate) => candidate !== undefined)).filter((candidate) => !isCompatibilityProtectedSubject(candidate, workspaceRoot, path) && authority.some((root) => root.kind === "file" ? candidate === root.absolutePath : isContained2(root.absolutePath, candidate, path)));
+    const subjects = [];
+    for (const candidate of candidates2) {
+      const canonical = yield* exports_Effect.result(fileSystem.realPath(candidate));
+      if (canonical._tag === "Failure") {
+        if (isNotFound(canonical.failure))
+          continue;
+        return {
+          kind: "failed",
+          detail: `Unable to canonicalize compatibility subject "${toRepositoryPath2(path.relative(workspaceRoot, candidate), path.sep)}".`
+        };
+      }
+      const expectedCanonical = path.resolve(workspaceRealPath.success, path.relative(workspaceRoot, candidate));
+      if (canonical.success !== expectedCanonical || !isContained2(workspaceRealPath.success, canonical.success, path)) {
+        return {
+          kind: "failed",
+          detail: `Exact coverage selected symbolic link "${toRepositoryPath2(path.relative(workspaceRoot, candidate), path.sep)}"; compatibility checks accept regular files only.`
+        };
+      }
+      const stat3 = yield* exports_Effect.result(fileSystem.stat(canonical.success));
+      if (stat3._tag === "Failure") {
+        if (isNotFound(stat3.failure))
+          continue;
+        return {
+          kind: "failed",
+          detail: `Unable to inspect compatibility subject "${toRepositoryPath2(path.relative(workspaceRoot, candidate), path.sep)}".`
+        };
+      }
+      if (stat3.success.type === "File") {
+        subjects.push({ absolutePath: candidate, kind: "file" });
+      }
+    }
+    return subjects.length === 0 ? { kind: "not-applicable" } : { kind: "ready", subjects };
+  });
+}
+function isCompatibilityProtectedSubject(candidate, workspaceRoot, path) {
+  const relative = toRepositoryPath2(path.relative(workspaceRoot, candidate), path.sep);
+  if (relative.split("/").includes("node_modules"))
+    return true;
+  return compatibilityProtectedRoots.some((root) => relative === root || relative.startsWith(`${root}/`));
+}
 function resolvedSubjects(application, workspaceRoot, path) {
   const subjects = new Map;
   for (const entry of application.runner.acquisition.entries) {

package/oclif.manifest.json

@@ -1,4 +1,4 @@
 {
   "commands": {},
-  "version": "0.2.0"
+  "version": "0.2.1"
 }

package/package.json

@@ -1,7 +1,12 @@
 {
   "name": "@habitat-ai/cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rawr-ai/rawr-hq-template.git",
+    "directory": "apps/habitat"
+  },
   "description": "Habitat structural authority CLI and Nx projection",
   "license": "MIT",
   "type": "module",
@@ -43,10 +48,10 @@
   "dependencies": {
     "@effect/platform-node": "4.0.0-beta.101",
     "@getgrit/cli": "0.1.0-alpha.1743007075",
-    "@habitat-ai/plugin-cli": "0.2.0",
-    "@habitat-ai/resource-rule-evaluation": "0.2.0",
-    "@habitat-ai/resource-source-inventory": "0.2.0",
-    "@habitat-ai/service": "0.2.0",
+    "@habitat-ai/plugin-cli": "0.2.1",
+    "@habitat-ai/resource-rule-evaluation": "0.2.1",
+    "@habitat-ai/resource-source-inventory": "0.2.1",
+    "@habitat-ai/service": "0.2.1",
     "@nx/devkit": "23.1.0",
     "@oclif/core": "^4.11.4",
     "@oclif/plugin-help": "^6.2.27",
@@ -61,7 +66,7 @@
     "vitest": "^4.0.18"
   },
   "peerDependencies": {
-    "@habitat-ai/blueprints": "0.2.0"
+    "@habitat-ai/blueprints": "0.2.1"
   },
   "oclif": {
     "bin": "habitat",