@iowarp/clio-coder 0.3.7 → 0.3.8

package/src/domains/evidence/trust-status.ts

@@ -1,5 +1,5 @@
 import type { GateDecisionArtifact, GateDecisionVerification } from "../dispatch/gate-decisions.js";
-import { type ReceiptIntegrityResult, verifyReceiptIntegrity } from "../dispatch/receipt-integrity.js";
+import { RUN_RECEIPT_INTEGRITY_VERSION, verifyReceiptIntegrity } from "../dispatch/receipt-integrity.js";
 import type {
 	RunBriefingProvenance,
 	RunEnvelope,
@@ -459,13 +459,89 @@ function compatibilitySource(receipt: PersistedRunReceiptTrustFacts, field: stri
 const DISPATCH_AUTHORITY: TrustStatusAuthority = { kind: "clio", id: "dispatch" };
 const COMPATIBILITY_AUTHORITY: TrustStatusAuthority = { kind: "unknown", id: "historical-persisted-format" };
 
+/**
+ * A receipt sealed under an integrity version this build no longer verifies.
+ * It is not migrated and not read as evidence, on the same terms as every
+ * prior integrity bump, but it is not a tampered receipt either: nothing was
+ * checked, so nothing failed. The outcome names both versions so an operator
+ * with a store full of last release's runs can tell a retired seal from a
+ * broken one.
+ */
+export interface RetiredReceiptIntegrity {
+	receiptVersion: number;
+	supportedVersion: number;
+}
+
+/**
+ * The dispatch verifier's result, widened with the retired-format diagnosis
+ * this module puts in front of it. A failure without `retired` is the
+ * verifier's own verdict: a malformed seal, a ledger mismatch, or a digest
+ * that does not match the receipt's contents.
+ */
+export type ReceiptIntegrityOutcome = { ok: true } | { ok: false; reason: string; retired?: RetiredReceiptIntegrity };
+
+/** The retired-version diagnosis for a receipt's integrity block, or null when the block is current or unreadable. */
+export function retiredReceiptIntegrity(integrity: unknown): RetiredReceiptIntegrity | null {
+	if (!isRecord(integrity)) return null;
+	const version = integrity.version;
+	if (typeof version !== "number" || !Number.isInteger(version) || version < 1) return null;
+	if (version >= RUN_RECEIPT_INTEGRITY_VERSION) return null;
+	return { receiptVersion: version, supportedVersion: RUN_RECEIPT_INTEGRITY_VERSION };
+}
+
+/** The one sentence every surface prints for a retired seal. It never calls the receipt invalid, broken, or corrupt. */
+export function retiredReceiptIntegrityReason(retired: RetiredReceiptIntegrity): string {
+	return `receipt integrity v${retired.receiptVersion} is retired; this build verifies v${retired.supportedVersion}; the receipt is not read as evidence`;
+}
+
+/**
+ * Verify a receipt against its ledger row, diagnosing a retired seal before
+ * the verifier can report it as a malformed one. Every trust-bearing
+ * verification goes through here so the CLI, the bundle, and the TUI receipt
+ * view agree on what a retired receipt is.
+ */
+export function verifyReceiptIntegrityOutcome(receipt: RunReceipt, envelope: RunEnvelope): ReceiptIntegrityOutcome {
+	const retired = retiredReceiptIntegrity(receipt.integrity);
+	if (retired !== null) return { ok: false, reason: retiredReceiptIntegrityReason(retired), retired };
+	return verifyReceiptIntegrity(receipt, envelope);
+}
+
+const RETIRED_INTEGRITY_SOURCE = /:integrity-v(\d+)-retired$/u;
+
+function retiredIntegritySourceId(runId: string, receiptVersion: number): string {
+	return `run_receipt:${runId}:integrity-v${receiptVersion}-retired`;
+}
+
+/**
+ * The retired integrity version a projected artifact-integrity axis names, or
+ * null when the axis says something else. The compatibility source id is the
+ * only place the persisted projection carries the version, so the human clause
+ * reads it back from there rather than from the receipt.
+ */
+export function retiredIntegrityVersionOf(status: ArtifactIntegrityStatus): number | null {
+	if (status.state !== "unknown" || status.source.kind !== "compatibility") return null;
+	const match = RETIRED_INTEGRITY_SOURCE.exec(status.source.id);
+	return match === null ? null : Number(match[1]);
+}
+
 /** Adapt receipt integrity verification without reading any receipt claim as self-authenticating. */
 export function adaptReceiptIntegrityStatus(
 	receipt: PersistedRunReceiptTrustFacts | null | undefined,
-	verification?: ReceiptIntegrityResult,
+	verification?: ReceiptIntegrityOutcome,
 ): ArtifactIntegrityStatus {
 	if (receipt === null || receipt === undefined) return absentTrustStatus("artifact_missing");
 	const artifacts = [receiptReference(receipt)];
+	// A retired seal was never checked, so the axis is unknown rather than
+	// failed, and the compatibility source names the version it was sealed
+	// under. `failed` stays reserved for a seal this build verified and rejected.
+	if (verification !== undefined && !verification.ok && verification.retired !== undefined) {
+		return attributed(
+			"unknown",
+			{ kind: "compatibility", id: retiredIntegritySourceId(receipt.runId, verification.retired.receiptVersion) },
+			COMPATIBILITY_AUTHORITY,
+			artifacts,
+		);
+	}
 	if (verification === undefined || (verification.ok && receipt.integrity === undefined)) {
 		return attributed(
 			"unknown",
@@ -576,15 +652,46 @@ function validBoundedProjectContext(context: RunProjectContextProvenance): boole
 	);
 }
 
+/**
+ * The one structured message a `none`-tier run can still receive. The tier is
+ * the CLIO-CODER.md handbook policy; the workspace-root message is sent
+ * regardless of it, and the producer records the characters and hash of
+ * every structured message it sent (`projectContextProvenanceFor` in the
+ * dispatch extension). A none-tier block naming exactly this section, with
+ * a well-formed count and hash, is therefore a consistent record of a real
+ * message, not a contradiction. Anything else under a none tier cannot be
+ * explained by the policy: a handbook section the policy forbids, a hash
+ * with no section to hash, or a malformed count.
+ */
+const NONE_TIER_SECTIONS: ReadonlyArray<string> = ["workspace-root"];
+
+function validNoneTierProjectContext(context: RunProjectContextProvenance): boolean {
+	return (
+		context.tier === "none" &&
+		context.sections !== undefined &&
+		context.sections.length === NONE_TIER_SECTIONS.length &&
+		context.sections.every((section) => NONE_TIER_SECTIONS.includes(section)) &&
+		Number.isSafeInteger(context.chars) &&
+		(context.chars ?? -1) >= 0 &&
+		typeof context.contentHash === "string" &&
+		/^[a-f0-9]{64}$/u.test(context.contentHash)
+	);
+}
+
+function recordedProjectContextHash(context: RunProjectContextProvenance | undefined): string | undefined {
+	if (context === undefined) return undefined;
+	if (context.tier === "bounded") return validBoundedProjectContext(context) ? context.contentHash : undefined;
+	return validNoneTierProjectContext(context) ? context.contentHash : undefined;
+}
+
 function contextArtifacts(receipt: PersistedRunReceiptTrustFacts): TrustArtifactReference[] {
 	const artifacts = [receiptReference(receipt)];
 	if (receipt.briefing !== undefined && validBriefing(receipt.briefing)) {
 		artifacts.push(sha256Reference("briefing", `${receipt.runId}:briefing`, receipt.briefing.contentHash));
 	}
-	if (receipt.projectContext?.tier === "bounded" && validBoundedProjectContext(receipt.projectContext)) {
-		artifacts.push(
-			sha256Reference("project_context", `${receipt.runId}:project-context`, receipt.projectContext.contentHash),
-		);
+	const recordedHash = recordedProjectContextHash(receipt.projectContext);
+	if (recordedHash !== undefined) {
+		artifacts.push(sha256Reference("project_context", `${receipt.runId}:project-context`, recordedHash));
 	}
 	return uniqueBoundedReferences(artifacts);
 }
@@ -604,12 +711,23 @@ export function adaptRunReceiptContextStatus(
 		return attributed("unknown", compatibilitySource(receipt, "projectContext"), COMPATIBILITY_AUTHORITY, artifacts);
 	}
 	if (context.tier === "none") {
-		if (context.chars !== undefined || context.contentHash !== undefined || context.sections !== undefined) {
-			return attributed("invalid", source, DISPATCH_AUTHORITY, artifacts);
+		const bare = context.chars === undefined && context.contentHash === undefined && context.sections === undefined;
+		if (bare) {
+			// Nothing structured was sent: the axis does not apply unless a
+			// briefing was recorded, which is context of its own.
+			return receipt.briefing === undefined
+				? attributed("not_applicable", source, DISPATCH_AUTHORITY, artifacts)
+				: attributed("recorded", source, DISPATCH_AUTHORITY, artifacts);
 		}
-		return receipt.briefing === undefined
-			? attributed("not_applicable", source, DISPATCH_AUTHORITY, artifacts)
-			: attributed("recorded", source, DISPATCH_AUTHORITY, artifacts);
+		// The workspace-root message is the one thing a none-tier run receives,
+		// and its record is valid; every other none-tier content shape is a
+		// record the policy cannot account for.
+		return attributed(
+			validNoneTierProjectContext(context) ? "recorded" : "invalid",
+			source,
+			DISPATCH_AUTHORITY,
+			artifacts,
+		);
 	}
 	return attributed(validBoundedProjectContext(context) ? "recorded" : "invalid", source, DISPATCH_AUTHORITY, artifacts);
 }
@@ -639,18 +757,19 @@ export function adaptRunReceiptAutonomyStatus(
 }
 
 export interface AdaptRunReceiptTrustOptions {
-	integrity?: ReceiptIntegrityResult;
+	integrity?: ReceiptIntegrityOutcome;
 }
 
 function receiptClaimsAreAuthenticated(
 	receipt: PersistedRunReceiptTrustFacts | null | undefined,
-	integrity: ReceiptIntegrityResult | undefined,
+	integrity: ReceiptIntegrityOutcome | undefined,
 ): boolean {
 	return receipt?.integrity !== undefined && integrity?.ok === true;
 }
 
 function unauthenticatedReceiptProjection(
 	receipt: PersistedRunReceiptTrustFacts | null | undefined,
+	integrity: ReceiptIntegrityOutcome | undefined,
 ): TrustStatusProjection {
 	if (receipt === null || receipt === undefined) {
 		return {
@@ -682,6 +801,15 @@ function unauthenticatedReceiptProjection(
 			),
 		};
 	}
+	// A retired seal leaves the receipt unread rather than rejected: its axes
+	// are absent because the format is historical, not because a check failed.
+	if (integrity !== undefined && !integrity.ok && integrity.retired !== undefined) {
+		return {
+			validationGrounding: absentTrustStatus("historical_format"),
+			contextProvenance: absentTrustStatus("historical_format"),
+			autonomyEnforcement: absentTrustStatus("historical_format"),
+		};
+	}
 	// The artifact-integrity axis retains the failure diagnostic. No other
 	// axis reads a field from a receipt that failed authentication.
 	return {
@@ -703,7 +831,7 @@ export function adaptRunReceiptTrustStatus(
 				contextProvenance: adaptRunReceiptContextStatus(receipt),
 				autonomyEnforcement: adaptRunReceiptAutonomyStatus(receipt),
 			}
-		: unauthenticatedReceiptProjection(receipt);
+		: unauthenticatedReceiptProjection(receipt, options.integrity);
 	return composeTrustStatus({
 		artifactIntegrity: adaptReceiptIntegrityStatus(receipt, options.integrity),
 		...receiptProjection,
@@ -715,7 +843,7 @@ export function adaptRunReceiptTrustStatus(
 }
 
 export interface RunReceiptTrustInspection {
-	integrity: ReceiptIntegrityResult;
+	integrity: ReceiptIntegrityOutcome;
 	status: CanonicalTrustStatus;
 }
 
@@ -728,14 +856,14 @@ export function inspectRunReceiptTrustStatus(
 	receipt: RunReceipt | null | undefined,
 	envelope: RunEnvelope | null | undefined,
 ): RunReceiptTrustInspection {
-	let integrity: ReceiptIntegrityResult;
+	let integrity: ReceiptIntegrityOutcome;
 	if (receipt === null || receipt === undefined) {
 		integrity = { ok: false, reason: "receipt unavailable" };
 	} else if (envelope === null || envelope === undefined) {
 		integrity = { ok: false, reason: "run ledger envelope unavailable" };
 	} else {
 		try {
-			integrity = verifyReceiptIntegrity(receipt, envelope);
+			integrity = verifyReceiptIntegrityOutcome(receipt, envelope);
 		} catch (error) {
 			integrity = {
 				ok: false,

package/src/domains/evidence/types.ts

@@ -23,7 +23,11 @@ export const EVIDENCE_TAGS = [
 	"escalation",
 	"external-bypass",
 	"external-approximation",
+	"independent-review",
+	"context-provenance",
+	"completion-evidence",
 	"receipt-integrity",
+	"receipt-retired",
 	"protected-artifact",
 	"tool-loop",
 	"test-failure",

package/src/domains/extensions/discovery.ts

@@ -1,4 +1,4 @@
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import path from "node:path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import type {
@@ -39,13 +39,99 @@ function normalizeResources(value: unknown): ExtensionManifestResources {
 	const out: ExtensionManifestResources = {};
 	const skills = trimString(value.skills);
 	const prompts = trimString(value.prompts);
+	const agents = trimString(value.agents);
+	const fleets = trimString(value.fleets);
 	const themes = trimString(value.themes);
 	if (skills) out.skills = skills;
 	if (prompts) out.prompts = prompts;
+	if (agents) out.agents = agents;
+	if (fleets) out.fleets = fleets;
 	if (themes) out.themes = themes;
 	return out;
 }
 
+function contained(root: string, candidate: string): boolean {
+	const relative = path.relative(root, candidate);
+	return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
+}
+
+function validateResourceTree(
+	root: string,
+	resourcePath: string,
+	kind: string,
+	diagnostics: ExtensionDiagnostic[],
+): void {
+	if (path.isAbsolute(resourcePath)) {
+		diagnostics.push({ type: "error", message: `resources.${kind} must be relative`, path: resourcePath });
+		return;
+	}
+	const resolvedRoot = path.resolve(root);
+	const resolved = path.resolve(resolvedRoot, resourcePath);
+	if (!contained(resolvedRoot, resolved) || resolved === resolvedRoot) {
+		diagnostics.push({ type: "error", message: `resources.${kind} escapes the extension root`, path: resourcePath });
+		return;
+	}
+	let canonicalRoot: string;
+	let canonicalResource: string;
+	try {
+		canonicalRoot = realpathSync(resolvedRoot);
+		canonicalResource = realpathSync(resolved);
+		if (!lstatSync(resolved).isDirectory()) {
+			diagnostics.push({ type: "error", message: `resources.${kind} is not a directory`, path: resolved });
+			return;
+		}
+	} catch (error) {
+		diagnostics.push({
+			type: "error",
+			message: `resources.${kind} cannot be resolved: ${error instanceof Error ? error.message : String(error)}`,
+			path: resolved,
+		});
+		return;
+	}
+	if (!contained(canonicalRoot, canonicalResource)) {
+		diagnostics.push({ type: "error", message: `resources.${kind} escapes through a symbolic link`, path: resolved });
+		return;
+	}
+
+	const pending = [resolved];
+	while (pending.length > 0) {
+		const directory = pending.pop();
+		if (!directory) continue;
+		for (const entry of readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+			const candidate = path.join(directory, entry.name);
+			if (entry.isSymbolicLink()) {
+				try {
+					if (!contained(canonicalRoot, realpathSync(candidate))) {
+						diagnostics.push({
+							type: "error",
+							message: `resources.${kind} contains an escaping symbolic link`,
+							path: candidate,
+						});
+					}
+				} catch (error) {
+					diagnostics.push({
+						type: "error",
+						message: `resources.${kind} contains an unresolved symbolic link: ${error instanceof Error ? error.message : String(error)}`,
+						path: candidate,
+					});
+				}
+			} else if (entry.isDirectory()) {
+				pending.push(candidate);
+			}
+		}
+	}
+}
+
+function validateResourceRoots(
+	root: string,
+	resources: ExtensionManifestResources,
+	diagnostics: ExtensionDiagnostic[],
+): void {
+	for (const [kind, resourcePath] of Object.entries(resources)) {
+		if (resourcePath) validateResourceTree(root, resourcePath, kind, diagnostics);
+	}
+}
+
 function stringArray(value: unknown): string[] | undefined {
 	if (!Array.isArray(value)) return undefined;
 	const out = value.map((entry) => trimString(entry)).filter((entry): entry is string => entry !== undefined);
@@ -123,6 +209,7 @@ export function loadManifestFromRoot(root: string): ExtensionCandidate {
 	}
 	try {
 		const parsed = parseExtensionManifest(readJsonOrYaml(manifestPath), manifestPath);
+		if (parsed.manifest) validateResourceRoots(root, parsed.manifest.resources, parsed.diagnostics);
 		return {
 			path: root,
 			manifestPath,

package/src/domains/extensions/resources.ts

@@ -1,4 +1,4 @@
-import { statSync } from "node:fs";
+import { lstatSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { listInstalledExtensions } from "./state.js";
 import type { ExtensionResourceKind, ExtensionResourceRoot } from "./types.js";
@@ -7,8 +7,24 @@ export function extensionResourcePath(rootPath: string, resourcePath: string): s
 	const root = path.resolve(rootPath);
 	const full = path.resolve(root, resourcePath);
 	const relative = path.relative(root, full);
-	if (relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative))) return full;
-	return null;
+	if (relative === "" || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+		return null;
+	try {
+		const rootReal = realpathSync(root);
+		const fullReal = realpathSync(full);
+		const canonicalRelative = path.relative(rootReal, fullReal);
+		if (
+			canonicalRelative === ".." ||
+			canonicalRelative.startsWith(`..${path.sep}`) ||
+			path.isAbsolute(canonicalRelative)
+		) {
+			return null;
+		}
+		if (!lstatSync(full).isDirectory()) return null;
+		return full;
+	} catch {
+		return null;
+	}
 }
 
 export function enabledExtensionResourceRoots(
@@ -22,15 +38,11 @@ export function enabledExtensionResourceRoots(
 		if (!rel) continue;
 		const full = extensionResourcePath(entry.rootPath, rel);
 		if (!full) continue;
-		try {
-			if (!statSync(full).isDirectory()) continue;
-		} catch {
-			continue;
-		}
 		roots.push({
 			id: entry.id,
 			scope: entry.scope,
 			path: full,
+			rootPath: entry.rootPath,
 			source: `extension:${entry.scope}:${entry.id}`,
 		});
 	}

package/src/domains/extensions/state.ts

@@ -129,7 +129,7 @@ export function installExtension(sourcePath: string, options: ExtensionInstallOp
 	const cwd = options.cwd ?? process.cwd();
 	const source = path.resolve(sourcePath);
 	const candidate = loadManifestFromRoot(source);
-	if (!candidate.manifest) return { diagnostics: candidate.diagnostics };
+	if (!candidate.manifest || !candidate.valid) return { diagnostics: candidate.diagnostics };
 	const targetRoot = path.join(extensionBaseDir(scope, cwd), candidate.manifest.id);
 	if (existsSync(targetRoot)) {
 		if (!options.force) {
@@ -152,7 +152,11 @@ export function installExtension(sourcePath: string, options: ExtensionInstallOp
 		rmSync(backupRoot, { recursive: true, force: true });
 		cpSync(source, stagingRoot, {
 			recursive: true,
-			filter: (src) => path.basename(src) !== "state.json",
+			// `state.json` beside the installed extension directories belongs to
+			// Clio's extension manager. An extension may legitimately ship nested
+			// resources with the same basename (for example a project-state JSON
+			// template), so exclude only a bookkeeping file at the package root.
+			filter: (src) => path.relative(source, src) !== "state.json",
 		});
 		if (existsSync(targetRoot)) {
 			renameSync(targetRoot, backupRoot);

package/src/domains/extensions/types.ts

@@ -1,9 +1,11 @@
 export type ExtensionScope = "user" | "project";
-export type ExtensionResourceKind = "skills" | "prompts" | "themes";
+export type ExtensionResourceKind = "skills" | "prompts" | "agents" | "fleets" | "themes";
 
 export interface ExtensionManifestResources {
 	skills?: string;
 	prompts?: string;
+	agents?: string;
+	fleets?: string;
 	themes?: string;
 }
 
@@ -52,6 +54,7 @@ export interface ExtensionResourceRoot {
 	id: string;
 	scope: ExtensionScope;
 	path: string;
+	rootPath: string;
 	source: string;
 }
 

package/src/domains/lifecycle/doctor.ts

@@ -5,8 +5,11 @@ import { initializeClioHome } from "../../core/init.js";
 import { resolveClioDirs } from "../../core/xdg.js";
 import { readSessionFileEntries, type SessionJsonlWarning } from "../../engine/session.js";
 import { detectInteropAgents, interopAgentKind, resolveOnPath } from "../interop/index.js";
-import { openAuthStorage } from "../providers/auth/index.js";
+import { openAuthStorage, resolveAuthTarget, targetRequiresAuth } from "../providers/auth/index.js";
+import { credentialsPresent } from "../providers/credentials.js";
 import { fingerprintNativeRuntime } from "../providers/probe/fingerprint.js";
+import type { ProbeContext, ProbeResult, RuntimeDescriptor } from "../providers/types/runtime-descriptor.js";
+import type { TargetDescriptor } from "../providers/types/target-descriptor.js";
 import { loadSkills, type SkillSource } from "../resources/skills/loader.js";
 import { readStateInfoResult } from "./state.js";
 import { getVersionInfo } from "./version.js";
@@ -534,3 +537,139 @@ export async function runDoctorRuntimeChecks(): Promise<DoctorFinding[]> {
 	);
 	return results.filter((finding): finding is DoctorFinding => finding !== null);
 }
+
+/** One configured model pointer at a target, named the way settings.yaml spells it. */
+interface ConfiguredModelRole {
+	role: string;
+	model: string;
+}
+
+function configuredModelRoles(
+	settings: ReturnType<typeof readSettings>,
+	target: TargetDescriptor,
+): ConfiguredModelRole[] {
+	const roles: ConfiguredModelRole[] = [];
+	if (target.defaultModel) roles.push({ role: "defaultModel", model: target.defaultModel });
+	if (settings.orchestrator.target === target.id && settings.orchestrator.model) {
+		roles.push({ role: "orchestrator.model", model: settings.orchestrator.model });
+	}
+	if (settings.background.target === target.id && settings.background.model) {
+		roles.push({ role: "background.model", model: settings.background.model });
+	}
+	if (settings.workers.default.target === target.id && settings.workers.default.model) {
+		roles.push({ role: "workers.default.model", model: settings.workers.default.model });
+	}
+	return roles;
+}
+
+/**
+ * Per-request budget for the model sweep. A target that does not answer in
+ * this time falls back to the list configure recorded, so a black-holed
+ * remote costs doctor a bounded wait rather than the probe's full timeout.
+ */
+const DOCTOR_MODEL_PROBE_TIMEOUT_MS = 2_500;
+
+async function doctorProbeContext(target: TargetDescriptor, runtime: RuntimeDescriptor): Promise<ProbeContext> {
+	const ctx: ProbeContext = { credentialsPresent: credentialsPresent(), httpTimeoutMs: DOCTOR_MODEL_PROBE_TIMEOUT_MS };
+	if (!targetRequiresAuth(target, runtime)) return ctx;
+	try {
+		const resolution = await openAuthStorage().resolveForTarget(resolveAuthTarget(target, runtime), {
+			includeFallback: false,
+		});
+		if (resolution.apiKey) ctx.authToken = resolution.apiKey;
+	} catch {
+		// The probe reports its own missing-auth failure; the wireModels fallback covers the check.
+	}
+	return ctx;
+}
+
+/** What the target advertises now, or null when it could not be asked. */
+async function probeAdvertisedModels(
+	target: TargetDescriptor,
+	runtime: RuntimeDescriptor,
+): Promise<{ advertised: string[]; resident: string[] } | null> {
+	if (runtime.kind !== "http" || typeof runtime.probe !== "function" || !target.url) return null;
+	let probe: ProbeResult;
+	try {
+		probe = await runtime.probe(target, await doctorProbeContext(target, runtime));
+	} catch {
+		return null;
+	}
+	if (!probe.ok || !probe.models || probe.models.length === 0) return null;
+	const advertised = [...probe.models];
+	const resident: string[] = [];
+	for (const [id, status] of Object.entries(probe.modelStates ?? {})) {
+		if (!advertised.includes(id)) advertised.push(id);
+		if (status.state === "loaded" || status.state === "loading") resident.push(id);
+	}
+	return { advertised, resident };
+}
+
+/**
+ * Model sweep: every model pointer settings.yaml aims at a target with no
+ * static catalog is checked against what that target advertises. The live
+ * list wins when the target answers; the `wireModels` list configure recorded
+ * stands in when it does not, so an unreachable server still gets the
+ * placeholder id it was saved with called out. A target with neither list is
+ * a WARN, not a pass, because nothing was verified. Network-bound like the
+ * runtime sweep, so it is not part of the synchronous `runDoctor()` core.
+ */
+export async function runDoctorModelChecks(): Promise<DoctorFinding[]> {
+	let settings: ReturnType<typeof readSettings>;
+	try {
+		settings = readSettings();
+	} catch {
+		return [];
+	}
+	if (settings.targets.length === 0) return [];
+	// Every runtime descriptor and the model catalog sit behind these two
+	// imports. They are loaded here, not at module load, so a doctor run on a
+	// home with no targets (the `--fix` seed every CLI test starts from) pays
+	// nothing for a sweep it has nothing to do.
+	const [{ getRuntimeRegistry }, { registerBuiltinRuntimes }, { listKnownModelsForRuntime }] = await Promise.all([
+		import("../providers/registry.js"),
+		import("../providers/runtimes/builtins.js"),
+		import("../providers/support.js"),
+	]);
+	const registry = getRuntimeRegistry();
+	// doctor never loads the providers domain, so the registry is empty here
+	// unless another command in this process filled it.
+	if (registry.list().length === 0) registerBuiltinRuntimes(registry);
+	const results = await Promise.all(
+		settings.targets.map(async (target): Promise<DoctorFinding | null> => {
+			const runtime = registry.get(target.runtime);
+			if (!runtime) return null;
+			// Cloud runtimes are validated against their catalog at configure time.
+			if (listKnownModelsForRuntime(runtime.id).length > 0) return null;
+			const roles = configuredModelRoles(settings, target);
+			if (roles.length === 0) return null;
+			const live = await probeAdvertisedModels(target, runtime);
+			const recorded = target.wireModels ?? [];
+			if (live === null && recorded.length === 0) {
+				return {
+					ok: true,
+					level: "warn",
+					name: `model ${target.id}`,
+					detail: `${roles.map((entry) => `${entry.role} '${entry.model}'`).join(", ")} could not be verified: the target did not answer and configure recorded no model list; run \`clio-coder targets --probe\` once it is up`,
+				};
+			}
+			const advertised = live ? live.advertised : recorded;
+			const source = live ? `advertised by ${target.url ?? target.id} now` : "recorded by configure at last save";
+			const missing = roles.filter((entry) => !advertised.includes(entry.model));
+			if (missing.length === 0) {
+				return {
+					ok: true,
+					name: `model ${target.id}`,
+					detail: `${roles.map((entry) => `${entry.role} '${entry.model}'`).join(", ")} ${source}`,
+				};
+			}
+			const resident = live && live.resident.length > 0 ? live.resident.join(", ") : live ? "none" : "unknown";
+			return {
+				ok: false,
+				name: `model ${target.id}`,
+				detail: `${missing.map((entry) => `${entry.role} '${entry.model}'`).join(", ")} not ${source} (${advertised.length} ids). Resident instances: ${resident}. Re-run \`clio-coder configure --id ${target.id} --model <advertised id>\`; \`clio-coder targets --probe\` lists them`,
+			};
+		}),
+	);
+	return results.filter((finding): finding is DoctorFinding => finding !== null);
+}

package/src/domains/prompts/contract.ts

@@ -15,11 +15,9 @@ export interface CompileWorkerPromptInput extends WorkerPromptInputs {
 	/** Working directory the rule loader and repo-awareness checks run against; defaults to `process.cwd()`. */
 	cwd?: string;
 	/**
-	 * Best-effort paths this worker's run actually touches (from `writeRoots`
-	 * and path-like tokens in the task/briefing text), used the same way the
-	 * session's `workingContextPaths` selects path-scoped project rules. There
-	 * is no structured path field on the model-facing dispatch tool, so this is
-	 * inference, not a guarantee: a rule can be missed, never fabricated.
+	 * Canonical paths for this worker's declared intent. Legacy requests without
+	 * intent retain path-like task and briefing inference. The prompt compiler
+	 * consumes the resolved set without deriving another one.
 	 */
 	workingContextPaths?: ReadonlyArray<string>;
 }