@kaelio/ktx 0.13.0 → 0.14.0

package/dist/context/ingest/isolated-diff/patch-integrator.d.ts

@@ -1,6 +1,5 @@
 import type { GitService } from '../../../context/core/git.service.js';
 import type { RepairVerification } from '../constrained-repair.js';
-import type { FinalGateRepairResult } from '../final-gate-repair.js';
 import type { IngestTraceWriter } from '../ingest-trace.js';
 import type { TextualConflictResolutionResult } from './textual-conflict-resolver.js';
 export type PatchIntegrationResult = {
@@ -8,19 +7,16 @@ export type PatchIntegrationResult = {
     commitSha: string;
     touchedPaths: string[];
     textualResolution?: TextualConflictResolutionResult;
-    gateRepair?: FinalGateRepairResult;
 } | {
     status: 'textual_conflict';
     reason: string;
     touchedPaths: string[];
     textualResolution?: TextualConflictResolutionResult;
-    gateRepair?: FinalGateRepairResult;
 } | {
     status: 'semantic_conflict';
     reason: string;
     touchedPaths: string[];
     textualResolution?: TextualConflictResolutionResult;
-    gateRepair?: FinalGateRepairResult;
 };
 export interface IntegrateWorkUnitPatchInput {
     unitKey: string;
@@ -41,12 +37,5 @@ export interface IntegrateWorkUnitPatchInput {
         reason: string;
         verify(changedPaths: string[]): Promise<RepairVerification>;
     }): Promise<TextualConflictResolutionResult>;
-    repairGateFailure?(input: {
-        unitKey: string;
-        patchPath: string;
-        touchedPaths: string[];
-        reason: string;
-        verify(changedPaths: string[]): Promise<RepairVerification>;
-    }): Promise<FinalGateRepairResult>;
 }
 export declare function integrateWorkUnitPatch(input: IntegrateWorkUnitPatchInput): Promise<PatchIntegrationResult>;

package/dist/context/ingest/isolated-diff/patch-integrator.js

@@ -153,50 +153,6 @@ export async function integrateWorkUnitPatch(input) {
             touchedPaths,
             reason,
         });
-        if (input.repairGateFailure) {
-            const gateRepair = await input.repairGateFailure({
-                unitKey: input.unitKey,
-                patchPath: input.patchPath,
-                touchedPaths,
-                reason,
-                verify: verifyAppliedTree,
-            });
-            if (gateRepair.status === 'failed') {
-                if (preApplyHead) {
-                    await input.integrationGit.resetHardTo(preApplyHead);
-                }
-                return {
-                    status: 'semantic_conflict',
-                    reason: gateRepair.reason,
-                    touchedPaths,
-                    gateRepair,
-                };
-            }
-            const commit = await input.integrationGit.commitFiles(gateRepair.changedPaths, `ingest: repair WorkUnit ${input.unitKey} gates`, input.author.name, input.author.email);
-            if (!commit.created) {
-                if (preApplyHead) {
-                    await input.integrationGit.resetHardTo(preApplyHead);
-                }
-                return {
-                    status: 'semantic_conflict',
-                    reason: 'gate repair produced no committable changes',
-                    touchedPaths: gateRepair.changedPaths,
-                    gateRepair,
-                };
-            }
-            await input.trace.event('debug', 'integration', 'patch_accepted_after_gate_repair', {
-                unitKey: input.unitKey,
-                commitSha: commit.commitHash,
-                touchedPaths: gateRepair.changedPaths,
-                attempts: gateRepair.attempts,
-            });
-            return {
-                status: 'accepted',
-                commitSha: commit.commitHash,
-                touchedPaths: gateRepair.changedPaths,
-                gateRepair,
-            };
-        }
         if (preApplyHead) {
             await input.integrationGit.resetHardTo(preApplyHead);
         }

package/dist/context/ingest/isolated-diff/work-unit-executor.d.ts

@@ -13,4 +13,5 @@ export interface RunIsolatedWorkUnitInput {
     run(child: IngestSessionWorktree): Promise<WorkUnitOutcome>;
     afterSuccess?(child: IngestSessionWorktree): Promise<void>;
 }
+export declare function workUnitPatchFileName(unitIndex: number, unitKey: string): string;
 export declare function runIsolatedWorkUnit(input: RunIsolatedWorkUnitInput): Promise<WorkUnitOutcome>;

package/dist/context/ingest/isolated-diff/work-unit-executor.js

@@ -1,7 +1,8 @@
 import { mkdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { captureIngestWorkUnitCachedArtifactFiles } from '../work-unit-cache.js';
 import { parsePatchTouchedPaths } from './git-patch.js';
-function patchFileName(unitIndex, unitKey) {
+export function workUnitPatchFileName(unitIndex, unitKey) {
     const safeKey = unitKey.replace(/[^a-zA-Z0-9_.-]+/g, '-');
     return `${String(unitIndex).padStart(4, '0')}-${safeKey}.patch`;
 }
@@ -49,21 +50,29 @@ export async function runIsolatedWorkUnit(input) {
         }
         await input.afterSuccess?.(child);
         await mkdir(input.patchDir, { recursive: true });
-        const patchPath = join(input.patchDir, patchFileName(input.unitIndex, input.workUnit.unitKey));
+        const patchPath = join(input.patchDir, workUnitPatchFileName(input.unitIndex, input.workUnit.unitKey));
         await child.git.writeBinaryNoRenamePatch(input.ingestionBaseSha, 'HEAD', patchPath);
         const patch = await readFile(patchPath, 'utf-8');
         const touched = parsePatchTouchedPaths(patch);
+        const patchTouchedPaths = touched.map((entry) => entry.path);
+        const artifactFiles = await captureIngestWorkUnitCachedArtifactFiles({
+            git: child.git,
+            workdir: child.workdir,
+            baseSha: input.ingestionBaseSha,
+            patchTouchedPaths,
+        });
         cleanupOutcome = 'success';
         await input.trace.event('debug', 'work_unit', 'work_unit_patch_collected', {
             unitKey: input.workUnit.unitKey,
             patchPath,
-            touchedPaths: touched.map((entry) => entry.path),
+            touchedPaths: patchTouchedPaths,
             patchBytes: Buffer.byteLength(patch),
         });
         return {
             ...outcome,
             patchPath,
-            patchTouchedPaths: touched.map((entry) => entry.path),
+            patchTouchedPaths,
+            artifactFiles,
             childWorktreePath: child.workdir,
         };
     }

package/dist/context/ingest/local-adapters.js

@@ -1,10 +1,12 @@
 import { join } from 'node:path';
+import { gdriveConnectionToPullConfig, parseGdriveConnectionConfig } from '../../context/connections/gdrive-config.js';
 import { localConnectionToWarehouseDescriptor } from '../../context/connections/local-warehouse-descriptor.js';
 import { notionConnectionToPullConfig, parseNotionConnectionConfig } from '../../context/connections/notion-config.js';
 import { resolveKtxConfigReference } from '../core/config-reference.js';
 import { ktxLocalStateDbPath } from '../../context/project/local-state-db.js';
 import { DbtSourceAdapter } from './adapters/dbt/dbt.adapter.js';
 import { FakeSourceAdapter } from './adapters/fake/fake.adapter.js';
+import { GdriveSourceAdapter } from './adapters/gdrive/gdrive.adapter.js';
 import { HistoricSqlSourceAdapter } from './adapters/historic-sql/historic-sql.adapter.js';
 import { PostgresPgssReader } from './adapters/historic-sql/postgres-pgss-reader.js';
 import { resolveQueryHistoryScopeFloor } from './adapters/historic-sql/scope-floor.js';
@@ -49,6 +51,7 @@ export function createDefaultLocalIngestAdapters(project, options = {}) {
         createLocalMetabaseSourceAdapter(project, {
             ...(options.logger ? { logger: options.logger } : {}),
         }),
+        new GdriveSourceAdapter(),
         new LookerSourceAdapter({
             clientFactory: {
                 async createClient(config, ctx) {
@@ -239,6 +242,9 @@ export async function localPullConfigForAdapter(project, adapter, connectionId,
             lastSuccessfulCursor: await localNotionRuntimeStore(project).readCursor(connectionId),
         };
     }
+    if (adapter.source === 'gdrive') {
+        return await gdriveConnectionToPullConfig(parseGdriveConnectionConfig(connection));
+    }
     if (adapter.source === 'metricflow') {
         const metricflow = connection.metricflow;
         const metricflowConfig = typeof metricflow === 'object' && metricflow !== null && !Array.isArray(metricflow)

package/dist/context/ingest/local-bundle-runtime.js

@@ -10,6 +10,7 @@ import { createLocalKtxLlmRuntimeFromConfig } from '../../context/llm/local-conf
 import { KtxIngestEmbeddingPortAdapter } from '../../context/llm/embedding-port.js';
 import { createRateLimitGovernorConfig, RateLimitGovernor } from '../../context/llm/rate-limit-governor.js';
 import { RuntimeAgentRunner } from '../../context/llm/runtime-port.js';
+import { getKtxCliPackageInfo } from '../../cli-runtime.js';
 import { ktxLocalStateDbPath } from '../../context/project/local-state-db.js';
 import { PromptService } from '../../context/prompts/prompt.service.js';
 import { SkillsRegistryService } from '../../context/skills/skills-registry.service.js';
@@ -40,6 +41,7 @@ import { WikiWriteTool } from '../../context/wiki/tools/wiki-write.tool.js';
 import { CandidateDedupService } from '../../context/ingest/context-candidates/candidate-dedup.service.js';
 import { ContextCandidateCarryforwardService } from '../../context/ingest/context-candidates/context-candidate-carryforward.service.js';
 import { CuratorPaginationService } from '../../context/ingest/context-candidates/curator-pagination.service.js';
+import { SqliteContentResultCache } from '../cache/sqlite-content-result-cache.js';
 import { createEmitHistoricSqlEvidenceTool } from './adapters/historic-sql/evidence-tool.js';
 import { ContextEvidenceIndexService } from '../../context/ingest/context-evidence/context-evidence-index.service.js';
 import { SqliteContextEvidenceStore } from '../../context/ingest/context-evidence/sqlite-context-evidence-store.js';
@@ -378,11 +380,11 @@ function parseKnowledgeIndexPath(file) {
     const segments = file.split('/');
     if (segments.length === 2 && segments[0] === 'global') {
         const pageKey = segments[1].replace(/\.md$/, '');
-        return /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(pageKey) ? { scope: 'GLOBAL', pageKey } : null;
+        return /^[a-zA-Z0-9_][a-zA-Z0-9_-]*$/.test(pageKey) ? { scope: 'GLOBAL', pageKey } : null;
     }
     if (segments.length === 3 && segments[0] === 'user') {
         const pageKey = segments[2].replace(/\.md$/, '');
-        return /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(pageKey) ? { scope: 'USER', pageKey } : null;
+        return /^[a-zA-Z0-9_][a-zA-Z0-9_-]*$/.test(pageKey) ? { scope: 'USER', pageKey } : null;
     }
     return null;
 }
@@ -519,6 +521,7 @@ export function createLocalBundleIngestRuntime(options) {
     mkdirSync(join(options.project.projectDir, '.ktx/cache/local-ingest'), { recursive: true });
     const store = new SqliteBundleIngestStore({ dbPath });
     const contextStore = new SqliteContextEvidenceStore({ dbPath });
+    const contentCache = new SqliteContentResultCache({ dbPath });
     const embeddingProvider = options.embeddingProvider ?? null;
     if (!embeddingProvider && options.project.config.ingest.embeddings.backend !== 'none') {
         // Embedding-dependent stages (CandidateDedup clustering, ContextEvidenceIndex
@@ -563,6 +566,7 @@ export function createLocalBundleIngestRuntime(options) {
         provenance: store,
         reports: store,
         canonicalPins: store,
+        contentCache,
         registry,
         diffSetService: new DiffSetService(store),
         sessionWorktreeService: new SessionWorktreeService({
@@ -576,6 +580,7 @@ export function createLocalBundleIngestRuntime(options) {
         storage,
         settings: {
             memoryIngestionModel: options.project.config.llm.models.default ?? 'local-ingest-model',
+            cliVersion: getKtxCliPackageInfo().version,
             probeRowCount: 0,
             workUnitMaxConcurrency: options.project.config.ingest.workUnits.maxConcurrency,
             workUnitStepBudget: options.project.config.ingest.workUnits.stepBudget,

package/dist/context/ingest/local-ingest.js

@@ -17,7 +17,7 @@ class LocalIngestPhase {
     }
 }
 function safeSegment(kind, value) {
-    if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(value)) {
+    if (!/^[a-zA-Z0-9_][a-zA-Z0-9_-]*$/.test(value)) {
         throw new Error(`Unsafe ${kind}: ${value}`);
     }
     return value;

package/dist/context/ingest/local-stage-ingest.d.ts

@@ -1,7 +1,7 @@
 import type { KtxLocalProject } from '../../context/project/project.js';
 import type { MemoryFlowEventSink } from './memory-flow/types.js';
 import type { KtxTableRefKey } from '../scan/table-ref.js';
-import type { IngestTrigger, SourceAdapter, WorkUnit } from './types.js';
+import type { IngestTrigger, SourceAdapter, SourceFetchReport, WorkUnit } from './types.js';
 type LocalIngestStatus = 'running' | 'done' | 'error';
 interface LocalIngestDiffPaths {
     added: string[];
@@ -34,6 +34,8 @@ export interface LocalIngestRunRecord {
     workUnits: Array<Pick<WorkUnit, 'unitKey' | 'rawFiles' | 'peerFileIndex' | 'dependencyPaths'>>;
     evictionDeletedRawPaths: string[];
     errors: string[];
+    /** Fetch-phase outcome (e.g. objects skipped during introspection). */
+    fetch?: SourceFetchReport;
 }
 export type LocalIngestReport = LocalIngestRunRecord & {
     rawContentHashes: Record<string, string>;

package/dist/context/ingest/local-stage-ingest.js

@@ -10,7 +10,7 @@ import { SqliteLocalIngestStore } from './sqlite-local-ingest-store.js';
 const LOCAL_AUTHOR = 'ktx';
 const LOCAL_AUTHOR_EMAIL = 'ktx@example.com';
 function safeSegment(kind, value) {
-    if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(value)) {
+    if (!/^[a-zA-Z0-9_][a-zA-Z0-9_-]*$/.test(value)) {
         throw new Error(`Unsafe ${kind}: ${value}`);
     }
     return value;
@@ -172,6 +172,7 @@ async function runLocalStageOnlyIngestInner(options) {
     if (!detected) {
         throw new Error(`Adapter "${adapter.source}" did not recognize ${sourceDir ?? 'fetched source output'}`);
     }
+    const fetchReport = adapter.readFetchReport ? await adapter.readFetchReport(stagedDir) : null;
     const relativeFiles = await walkFiles(stagedDir);
     options.memoryFlow?.update({ sourceDir });
     options.memoryFlow?.emit({
@@ -270,6 +271,7 @@ async function runLocalStageOnlyIngestInner(options) {
         })),
         evictionDeletedRawPaths: chunkResult.eviction?.deletedRawPaths ?? [],
         errors: [],
+        ...(fetchReport ? { fetch: fetchReport } : {}),
     };
     if (!options.dryRun) {
         store.saveCompletedRun({

package/dist/context/ingest/ports.d.ts

@@ -18,6 +18,7 @@ import type { ToolContext } from '../../context/tools/base-tool.js';
 import type { ToolSession } from '../../context/tools/tool-session.js';
 import type { KnowledgeIndexPort } from '../../context/wiki/ports.js';
 import type { KnowledgeWikiService } from '../../context/wiki/knowledge-wiki.service.js';
+import type { ContentResultCache } from '../cache/content-result-cache.js';
 import type { CanonicalPin } from './canonical-pins.js';
 import type { IngestTraceLevel } from './ingest-trace.js';
 import type { IngestReportSnapshot } from './reports.js';
@@ -108,6 +109,7 @@ export interface IngestSessionWorktreePort {
 }
 interface IngestSettingsPort {
     memoryIngestionModel: string;
+    cliVersion: string;
     probeRowCount: number;
     workUnitMaxConcurrency?: number;
     workUnitStepBudget?: number;
@@ -295,6 +297,7 @@ export interface IngestBundleRunnerDeps {
     provenance: IngestProvenancePort;
     reports: IngestReportsPort;
     canonicalPins: IngestCanonicalPinsPort;
+    contentCache: ContentResultCache;
     registry: SourceAdapterRegistryPort;
     diffSetService: DiffSetComputerPort;
     sessionWorktreeService: IngestSessionWorktreePort;

package/dist/context/ingest/report-snapshot.js

@@ -140,6 +140,17 @@ const finalizationOutcomeSchema = z.object({
     actions: z.array(ingestActionSchema).default([]),
     provenanceExclusions: z.array(finalizationProvenanceExclusionSchema).default([]),
 });
+const finalGatePrunedReferenceSchema = z.object({
+    kind: z.enum(['join', 'wiki_ref', 'wiki_sl_ref', 'wiki_body_ref']),
+    artifact: z.string(),
+    removedRef: z.string(),
+    absentTarget: z.string(),
+});
+const finalGateDroppedSourceSchema = z.object({
+    connectionId: z.string(),
+    sourceName: z.string(),
+    reason: z.string(),
+});
 const ingestReportSnapshotSchema = z
     .object({
     id: z.string().min(1),
@@ -169,9 +180,6 @@ const ingestReportSnapshotSchema = z
             resolverAttempts: z.number().int().min(0).default(0),
             resolverRepairs: z.number().int().min(0).default(0),
             resolverFailures: z.number().int().min(0).default(0),
-            gateRepairAttempts: z.number().int().min(0).default(0),
-            gateRepairs: z.number().int().min(0).default(0),
-            gateRepairFailures: z.number().int().min(0).default(0),
         })
             .optional(),
         workUnits: z.array(z.object({
@@ -198,6 +206,8 @@ const ingestReportSnapshotSchema = z
         provenanceRows: z.array(provenanceDetailSchema).default([]),
         toolTranscripts: z.array(toolTranscriptSummarySchema).default([]),
         finalization: finalizationOutcomeSchema.optional(),
+        finalGatePrunedReferences: z.array(finalGatePrunedReferenceSchema).default([]),
+        finalGateDroppedSources: z.array(finalGateDroppedSourceSchema).default([]),
         memoryFlow: memoryFlowReplayInputSchema.optional(),
     })
         .passthrough(),

package/dist/context/ingest/reports.d.ts

@@ -1,6 +1,7 @@
 import type { MemoryAction } from '../../context/memory/types.js';
 import type { TouchedSlSource } from '../../context/tools/touched-sl-sources.js';
 import type { MemoryFlowReplayInput } from './memory-flow/types.js';
+import type { FinalGateDroppedSource, FinalGatePrunedReference } from './final-gate-prune.js';
 import type { IngestProvenanceInsert } from './ports.js';
 import type { ArtifactResolutionRecord, ConflictResolvedRecord, EvictionAppliedRecord, StageIndex, UnmappedFallbackRecord } from './stages/stage-index.types.js';
 import type { WikiSlRefRepair } from './wiki-sl-ref-repair.js';
@@ -79,9 +80,6 @@ export interface IngestReportBody {
         resolverAttempts?: number;
         resolverRepairs?: number;
         resolverFailures?: number;
-        gateRepairAttempts?: number;
-        gateRepairs?: number;
-        gateRepairFailures?: number;
     };
     workUnits: IngestReportWorkUnit[];
     failedWorkUnits: string[];
@@ -98,6 +96,8 @@ export interface IngestReportBody {
     provenanceRows: IngestReportProvenanceDetail[];
     toolTranscripts: IngestReportToolTranscriptSummary[];
     finalization?: IngestReportFinalizationOutcome;
+    finalGatePrunedReferences?: FinalGatePrunedReference[];
+    finalGateDroppedSources?: FinalGateDroppedSource[];
     wikiSlRefRepairs?: WikiSlRefRepair[];
     wikiSlRefRepairWarnings?: string[];
     memoryFlow?: MemoryFlowReplayInput;

package/dist/context/ingest/reports.js

@@ -12,7 +12,9 @@ export function ingestReportOutcome(report) {
     if (report.body.status === 'failed') {
         return 'error';
     }
-    if (report.body.failedWorkUnits.length === 0) {
+    const hasPruneOrDrop = (report.body.finalGatePrunedReferences?.length ?? 0) > 0 ||
+        (report.body.finalGateDroppedSources?.length ?? 0) > 0;
+    if (report.body.failedWorkUnits.length === 0 && !hasPruneOrDrop) {
         return 'done';
     }
     const { wikiCount, slCount } = savedMemoryCountsForReport(report);

package/dist/context/ingest/stages/build-wu-context.d.ts

@@ -13,6 +13,7 @@ export declare function buildWuSystemPrompt(params: {
     skillsPrompt: string;
     syncId: string;
     sourceKey: string;
+    connectionId?: string;
     canonicalPins?: CanonicalPin[];
 }): string;
 export declare function buildWuUserPrompt(input: BuildWuPromptInput): string;

package/dist/context/ingest/stages/build-wu-context.js

@@ -6,12 +6,13 @@ import { createReadRawSpanTool } from '../tools/read-raw-span.tool.js';
 import { createVerificationLedgerState, VERIFICATION_LEDGER_PROMPT, withVerificationLedger, } from '../tools/verification-ledger.tool.js';
 const PEER_FILE_INDEX_PROMPT_LIMIT = 100;
 export function buildWuSystemPrompt(params) {
+    const connectionLine = params.connectionId ? `\nconnectionId: ${params.connectionId}` : '';
     const parts = [
         params.baseFraming.trimEnd(),
         VERIFICATION_LEDGER_PROMPT,
         params.skillsPrompt.trimEnd(),
         buildCanonicalPinsPromptBlock(params.canonicalPins ?? []),
-        `\n<context>\nsyncId: ${params.syncId}\nsource: ${params.sourceKey}\n</context>`,
+        `\n<context>\nsyncId: ${params.syncId}\nsource: ${params.sourceKey}${connectionLine}\n</context>`,
     ];
     return parts.filter(Boolean).join('\n');
 }

package/dist/context/ingest/stages/stage-3-work-units.d.ts

@@ -3,13 +3,13 @@ import type { AgentRunnerPort, KtxRuntimeToolSet, RunLoopMetrics } from '../../.
 import type { CaptureSession, MemoryAction } from '../../../context/memory/types.js';
 import { type TouchedSlSource } from '../../../context/tools/touched-sl-sources.js';
 import { type WuValidationResult } from './validate-wu-sources.js';
+import type { IngestWorkUnitCachedArtifactFile } from '../work-unit-cache.js';
 import type { WorkUnit } from '../types.js';
 export interface WorkUnitExecutionDeps {
     sessionWorktreeGit: {
         revParseHead(): Promise<string | null>;
     };
     agentRunner: AgentRunnerPort;
-    validateWikiRefs?: (actions: MemoryAction[]) => Promise<string[]>;
     validateTouchedSources: (touched: TouchedSlSource[]) => Promise<WuValidationResult>;
     resetHardTo: (targetSha: string) => Promise<void>;
     buildSystemPrompt: (wu: WorkUnit) => string;
@@ -37,6 +37,7 @@ export interface WorkUnitOutcome {
     slDisallowedReason?: 'lookml_connection_mismatch';
     patchPath?: string;
     patchTouchedPaths?: string[];
+    artifactFiles?: IngestWorkUnitCachedArtifactFile[];
     childWorktreePath?: string;
     /** Timing and token metrics for the work-unit agent loop, used for ingest profiling. */
     metrics?: RunLoopMetrics;

package/dist/context/ingest/stages/stage-3-work-units.js

@@ -1,6 +1,6 @@
 import { isAbortError } from '../../core/abort.js';
 import { listTouchedSlSources } from '../../../context/tools/touched-sl-sources.js';
-import { formatInvalidWuSources } from './validate-wu-sources.js';
+import { formatInvalidWuSources, hasBlockingWuSourceIssue, } from './validate-wu-sources.js';
 const MAX_WORK_UNIT_PROMPT_CHARS = 240_000;
 export async function executeWorkUnit(deps, wu) {
     const preSha = (await deps.sessionWorktreeGit.revParseHead()) ?? '';
@@ -87,18 +87,12 @@ export async function executeWorkUnit(deps, wu) {
     if (toolFailureCount > 0) {
         return failWithReset(`${toolFailureCount} tool call(s) failed during WorkUnit ${wu.unitKey}`);
     }
-    const danglingWikiRefs = (await deps.validateWikiRefs?.(deps.sessionActions)) ?? [];
-    if (danglingWikiRefs.length > 0) {
-        return failWithReset(`wiki references target missing page(s): ${danglingWikiRefs.join(', ')}`);
-    }
     const touched = listTouchedSlSources(deps.captureSession.touchedSlSources);
     if (touched.length > 0) {
         const validation = await deps.validateTouchedSources(touched);
-        if (validation.invalidSources.length > 0) {
-            // Spec: invalid SL writes reset the session worktree to the WU's pre-state, WU is marked failed,
-            // its files are absent from the Stage Index. Per-source surgical revert is the
-            // memory-agent pattern — NOT the bundle-ingest pattern.
-            return failWithReset(`sl_validate failed for: ${formatInvalidWuSources(validation.invalidSources)}`);
+        const blockingInvalidSources = validation.invalidSources.filter(hasBlockingWuSourceIssue);
+        if (blockingInvalidSources.length > 0) {
+            return failWithReset(`sl_validate failed for: ${formatInvalidWuSources(blockingInvalidSources)}`);
         }
     }
     return {

package/dist/context/ingest/stages/validate-wu-sources.d.ts

@@ -5,12 +5,24 @@ export interface InvalidWuSource {
     /** `${connectionId}:${sourceName}` */
     source: string;
     errors: string[];
+    issues?: WuValidationIssue[];
 }
 export interface WuValidationResult {
     validSources: string[];
     invalidSources: InvalidWuSource[];
 }
+type WuValidationIssue = {
+    kind: 'source_validation';
+    message: string;
+} | {
+    kind: 'missing_join_target';
+    targetSourceName: string;
+    caseMismatch: string | null;
+    message: string;
+};
 export declare function formatInvalidWuSources(invalid: InvalidWuSource[]): string;
+export declare function hasBlockingWuSourceIssue(source: InvalidWuSource): boolean;
 export declare function validateWuTouchedSources(deps: SlValidationDeps & {
     slValidator: SlValidatorPort<SlValidationDeps>;
 }, touched: TouchedSlSource[]): Promise<WuValidationResult>;
+export {};

package/dist/context/ingest/stages/validate-wu-sources.js

@@ -2,6 +2,14 @@ import { findMissingJoinTargets, formatMissingJoinTarget } from '../../../contex
 export function formatInvalidWuSources(invalid) {
     return invalid.map((entry) => `${entry.source} (${entry.errors.join('; ')})`).join(', ');
 }
+export function hasBlockingWuSourceIssue(source) {
+    const issues = source.issues ??
+        source.errors.map((message) => ({
+            kind: 'source_validation',
+            message,
+        }));
+    return issues.some((issue) => issue.kind === 'source_validation');
+}
 function uniqueTouchedSources(sources) {
     const seen = new Set();
     const unique = [];
@@ -61,8 +69,8 @@ function expandWithExistingJoinNeighbors(touched, sourcesByConnection) {
  * are out of scope — they must not block unrelated work. Resolution is the
  * Python engine's: exact source-name match within the connection.
  */
-function findJoinTargetErrors(touched, sourcesByConnection) {
-    const errorsBySource = new Map();
+function findJoinTargetIssues(touched, sourcesByConnection) {
+    const issuesBySource = new Map();
     const touchedByConnection = new Map();
     for (const source of touched) {
         const bucket = touchedByConnection.get(source.connectionId) ?? new Set();
@@ -85,11 +93,16 @@ function findJoinTargetErrors(touched, sourcesByConnection) {
                 continue;
             }
             const key = `${connectionId}:${source.name}`;
-            const messages = missing.map(formatMissingJoinTarget);
-            errorsBySource.set(key, [...(errorsBySource.get(key) ?? []), ...messages]);
+            const issues = missing.map((entry) => ({
+                kind: 'missing_join_target',
+                targetSourceName: entry.to,
+                caseMismatch: entry.caseMismatch,
+                message: formatMissingJoinTarget(entry),
+            }));
+            issuesBySource.set(key, [...(issuesBySource.get(key) ?? []), ...issues]);
         }
     }
-    return errorsBySource;
+    return issuesBySource;
 }
 export async function validateWuTouchedSources(deps, touched) {
     if (touched.length === 0) {
@@ -101,18 +114,20 @@ export async function validateWuTouchedSources(deps, touched) {
         sourcesByConnection.set(connectionId, sources);
     }
     const expanded = expandWithExistingJoinNeighbors(touched, sourcesByConnection);
-    const joinTargetErrors = findJoinTargetErrors(touched, sourcesByConnection);
+    const joinTargetIssues = findJoinTargetIssues(touched, sourcesByConnection);
     const valid = [];
     const invalid = [];
     for (const source of expanded) {
         const key = `${source.connectionId}:${source.sourceName}`;
         const result = await deps.slValidator.validateSingleSource(deps, source.connectionId, source.sourceName);
-        const errors = [...result.errors, ...(joinTargetErrors.get(key) ?? [])];
+        const sourceIssues = result.errors.map((message) => ({ kind: 'source_validation', message }));
+        const issues = [...sourceIssues, ...(joinTargetIssues.get(key) ?? [])];
+        const errors = issues.map((issue) => issue.message);
         if (errors.length === 0) {
             valid.push(key);
         }
         else {
-            invalid.push({ source: key, errors });
+            invalid.push({ source: key, errors, issues });
         }
     }
     return { validSources: valid, invalidSources: invalid };

package/dist/context/ingest/tools/read-raw-file.tool.js

@@ -1,22 +1,27 @@
 import { readFile, stat } from 'node:fs/promises';
-import { join, normalize, resolve } from 'node:path';
+import { isAbsolute, join, normalize, relative, resolve } from 'node:path';
 import { tool } from 'ai';
 import { z } from 'zod';
 const MAX_READ_RAW_FILE_BYTES = 120_000;
+function normalizeRawPath(path) {
+    return normalize(path).replace(/^[/\\]+/, '').replace(/\\/g, '/');
+}
 export function createReadRawFileTool(deps) {
     const stagedRoot = resolve(deps.stagedDir);
+    const allowedPaths = new Set([...deps.allowedPaths].map(normalizeRawPath));
     return tool({
         description: "Read the full text content of a raw source file inside this WorkUnit. `path` must be relative to the staged bundle root (no leading slash, no `..`) and must appear in the WorkUnit's rawFiles or dependencyPaths list.",
         inputSchema: z.object({
             path: z.string().describe('Path relative to the staged bundle root. Example: "views/customers/customer.lkml".'),
         }),
         execute: async ({ path }) => {
-            const normalized = normalize(path).replace(/^[/\\]+/, '');
-            if (normalized.startsWith('..') || !deps.allowedPaths.has(normalized)) {
-                return `Error: path "${path}" is not accessible from this WorkUnit. Allowed paths: ${[...deps.allowedPaths].sort().join(', ')}`;
+            const normalized = normalizeRawPath(path);
+            if (normalized.startsWith('..') || !allowedPaths.has(normalized)) {
+                return `Error: path "${path}" is not accessible from this WorkUnit. Allowed paths: ${[...allowedPaths].sort().join(', ')}`;
             }
             const absolute = resolve(join(stagedRoot, normalized));
-            if (!absolute.startsWith(`${stagedRoot}/`) && absolute !== stagedRoot) {
+            const stagedRelative = relative(stagedRoot, absolute);
+            if (stagedRelative.startsWith('..') || isAbsolute(stagedRelative)) {
                 return `Error: path "${path}" is not accessible from this WorkUnit.`;
             }
             try {

package/dist/context/ingest/tools/read-raw-span.tool.js

@@ -1,9 +1,13 @@
 import { readFile } from 'node:fs/promises';
-import { join, normalize, resolve } from 'node:path';
+import { isAbsolute, join, normalize, relative, resolve } from 'node:path';
 import { tool } from 'ai';
 import { z } from 'zod';
+function normalizeRawPath(path) {
+    return normalize(path).replace(/^[/\\]+/, '').replace(/\\/g, '/');
+}
 export function createReadRawSpanTool(deps) {
     const stagedRoot = resolve(deps.stagedDir);
+    const allowedPaths = new Set([...deps.allowedPaths].map(normalizeRawPath));
     return tool({
         description: 'Read a 1-based inclusive line range from a raw source file. Use this to resolve a provenance pointer like `file.lkml#L15-28` without loading the whole file into context.',
         inputSchema: z.object({
@@ -15,12 +19,13 @@ export function createReadRawSpanTool(deps) {
             if (startLine > endLine) {
                 return `Error: startLine must be <= endLine (got startLine=${startLine}, endLine=${endLine})`;
             }
-            const normalized = normalize(path).replace(/^[/\\]+/, '');
-            if (normalized.startsWith('..') || !deps.allowedPaths.has(normalized)) {
-                return `Error: path "${path}" is not accessible from this context. Allowed paths: ${[...deps.allowedPaths].sort().join(', ')}`;
+            const normalized = normalizeRawPath(path);
+            if (normalized.startsWith('..') || !allowedPaths.has(normalized)) {
+                return `Error: path "${path}" is not accessible from this context. Allowed paths: ${[...allowedPaths].sort().join(', ')}`;
             }
             const absolute = resolve(join(stagedRoot, normalized));
-            if (!absolute.startsWith(`${stagedRoot}/`) && absolute !== stagedRoot) {
+            const stagedRelative = relative(stagedRoot, absolute);
+            if (stagedRelative.startsWith('..') || isAbsolute(stagedRelative)) {
                 return `Error: path "${path}" is not accessible from this context.`;
             }
             try {

package/dist/context/ingest/tools/warehouse-verification/discover-data.tool.js

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import { BaseTool } from '../../../../context/tools/base-tool.js';
 const discoverDataInputSchema = z.object({
     query: z.string().optional(),
-    connectionId: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/).optional(),
+    connectionId: z.string().regex(/^[a-zA-Z0-9_][a-zA-Z0-9_-]*$/).optional(),
     limit: z.number().int().positive().max(50).optional().default(10),
     sourceName: z.string().optional(),
 }).strict();

package/dist/context/ingest/tools/warehouse-verification/entity-details.tool.js

@@ -10,7 +10,7 @@ const targetSchema = z.union([
     }),
 ]);
 const entityDetailsInputSchema = z.object({
-    connectionId: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/),
+    connectionId: z.string().regex(/^[a-zA-Z0-9_][a-zA-Z0-9_-]*$/),
     targets: z.array(targetSchema).min(1).max(50),
 }).strict();
 function allowedConnectionNames(context) {