@klhapp/skillmux 0.2.1 → 0.4.3

package/src/config.ts

@@ -27,6 +27,7 @@ const remoteThresholdsSchema = z.object({
 
 const configSchema = z.object({
   vault_path: z.string().min(1),
+  local_vault_paths: z.array(z.string()),
   state_dir: z.string().min(1),
   recall: z.object({ k_lexical: z.number().int().positive(), k_vector: z.number().int().positive() }).strict(),
   thresholds: z.object({
@@ -59,6 +60,7 @@ const configSchema = z.object({
         api_key_env: z.string().min(1).optional(),
       }).strict().optional(),
       thresholds: remoteThresholdsSchema.optional(),
+      calibration: z.object({ run_id: z.string().min(1) }).strict().optional(),
     }).strict(),
   ]),
   server: z.object({
@@ -71,6 +73,10 @@ const configSchema = z.object({
       requests_per_minute: z.number().int().positive(),
       trust_proxy: z.boolean().optional(),
     }).strict().optional(),
+    admin: z.object({
+      enabled: z.boolean(),
+      token_env: z.string().min(1),
+    }).strict().optional(),
   }).strict().optional(),
 }).strict();
 
@@ -80,6 +86,7 @@ export const LOCAL_BUNDLE_ID = "gte-small-v1";
 
 const DEFAULTS: Config = {
   vault_path: "~/skills",
+  local_vault_paths: [],
   state_dir: "~/.local/state/skillmux",
   recall: { k_lexical: 20, k_vector: 20 },
   thresholds: { candidate_limit: 5 },

package/src/context.ts

@@ -0,0 +1,183 @@
+import { existsSync, mkdirSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { expandHome } from "./config";
+
+export interface ContextRecord {
+  server: string;
+  token_env?: string;
+}
+
+export interface ContextConfig {
+  default_context: string;
+  contexts: Record<string, ContextRecord>;
+}
+
+export type ResolvedTarget =
+  | { type: "local"; name: "local" }
+  | { type: "remote"; name: string; server: string; token_env?: string };
+
+export const DEFAULT_CONTEXTS_PATH = "~/.config/skillmux/contexts.toml";
+
+export async function loadContextConfig(filePath?: string): Promise<ContextConfig> {
+  const targetPath = expandHome(filePath ?? DEFAULT_CONTEXTS_PATH);
+  const base: ContextConfig = {
+    default_context: "local",
+    contexts: { local: { server: "local" } },
+  };
+
+  if (!existsSync(targetPath)) {
+    return base;
+  }
+
+  try {
+    const text = await Bun.file(targetPath).text();
+    const parsed = Bun.TOML.parse(text) as Partial<ContextConfig>;
+    const default_context = typeof parsed.default_context === "string" ? parsed.default_context : "local";
+    const contexts: Record<string, ContextRecord> = { local: { server: "local" } };
+
+    if (parsed.contexts && typeof parsed.contexts === "object") {
+      for (const [name, rec] of Object.entries(parsed.contexts)) {
+        if (name === "local") continue;
+        if (rec && typeof rec === "object" && typeof (rec as ContextRecord).server === "string") {
+          contexts[name] = {
+            server: (rec as ContextRecord).server,
+            ...(typeof (rec as ContextRecord).token_env === "string" ? { token_env: (rec as ContextRecord).token_env } : {}),
+          };
+        }
+      }
+    }
+
+    return { default_context, contexts };
+  } catch {
+    return base;
+  }
+}
+
+export async function saveContextConfig(config: ContextConfig, filePath?: string): Promise<void> {
+  const targetPath = expandHome(filePath ?? DEFAULT_CONTEXTS_PATH);
+  const dir = dirname(targetPath);
+  mkdirSync(dir, { recursive: true });
+
+  // Serialize to TOML
+  let tomlStr = `default_context = "${config.default_context}"\n\n[contexts]\n`;
+  for (const [name, rec] of Object.entries(config.contexts)) {
+    if (name === "local") {
+      tomlStr += `[contexts.local]\nserver = "local"\n\n`;
+      continue;
+    }
+    tomlStr += `[contexts.${name}]\nserver = "${rec.server}"\n`;
+    if (rec.token_env) {
+      tomlStr += `token_env = "${rec.token_env}"\n`;
+    }
+    tomlStr += `\n`;
+  }
+
+  const tmpPath = join(dir, `.contexts-${Math.random().toString(36).slice(2)}.tmp`);
+  writeFileSync(tmpPath, tomlStr, "utf-8");
+  renameSync(tmpPath, targetPath);
+}
+
+export async function listContexts(filePath?: string): Promise<Array<{ name: string; server: string; token_env?: string; isDefault: boolean }>> {
+  const config = await loadContextConfig(filePath);
+  return Object.entries(config.contexts).map(([name, rec]) => ({
+    name,
+    server: rec.server,
+    token_env: rec.token_env,
+    isDefault: name === config.default_context,
+  }));
+}
+
+export async function getCurrentContext(filePath?: string): Promise<{ name: string; server: string; token_env?: string }> {
+  const config = await loadContextConfig(filePath);
+  const name = config.contexts[config.default_context] ? config.default_context : "local";
+  const rec = config.contexts[name] ?? { server: "local" };
+  return { name, server: rec.server, token_env: rec.token_env };
+}
+
+export async function addContext(name: string, record: ContextRecord, filePath?: string): Promise<void> {
+  if (name === "local") {
+    throw new Error('Context "local" is reserved and cannot be added or modified');
+  }
+  const config = await loadContextConfig(filePath);
+  config.contexts[name] = record;
+  await saveContextConfig(config, filePath);
+}
+
+export async function removeContext(name: string, filePath?: string): Promise<void> {
+  if (name === "local") {
+    throw new Error('Context "local" is reserved and cannot be removed');
+  }
+  const config = await loadContextConfig(filePath);
+  if (!config.contexts[name]) {
+    throw new Error(`Context "${name}" does not exist`);
+  }
+  delete config.contexts[name];
+  if (config.default_context === name) {
+    config.default_context = "local";
+  }
+  await saveContextConfig(config, filePath);
+}
+
+export async function useContext(name: string, filePath?: string): Promise<void> {
+  const config = await loadContextConfig(filePath);
+  if (!config.contexts[name]) {
+    throw new Error(`Context "${name}" does not exist`);
+  }
+  config.default_context = name;
+  await saveContextConfig(config, filePath);
+}
+
+export async function resolveTarget(
+  flags: { context?: string; server?: string },
+  filePath?: string
+): Promise<ResolvedTarget> {
+  // Precedence 1: Explicit flags
+  if (flags.context && flags.server) {
+    throw new Error("Cannot specify both --context and --server");
+  }
+  if (flags.context) {
+    if (flags.context === "local") return { type: "local", name: "local" };
+    const config = await loadContextConfig(filePath);
+    const rec = config.contexts[flags.context];
+    if (!rec) {
+      throw new Error(`Specified context "${flags.context}" does not exist`);
+    }
+    if (rec.server === "local") return { type: "local", name: "local" };
+    return { type: "remote", name: flags.context, server: rec.server, token_env: rec.token_env };
+  }
+  if (flags.server) {
+    if (flags.server === "local") return { type: "local", name: "local" };
+    return { type: "remote", name: "custom", server: flags.server };
+  }
+
+  // Precedence 2: Environment variables
+  const envContext = process.env.SKILLMUX_CONTEXT;
+  const envServer = process.env.SKILLMUX_SERVER;
+  if (envContext && envServer) {
+    throw new Error("Cannot specify both SKILLMUX_CONTEXT and SKILLMUX_SERVER");
+  }
+  if (envContext) {
+    if (envContext === "local") return { type: "local", name: "local" };
+    const config = await loadContextConfig(filePath);
+    const rec = config.contexts[envContext];
+    if (!rec) {
+      throw new Error(`Configured SKILLMUX_CONTEXT "${envContext}" does not exist`);
+    }
+    if (rec.server === "local") return { type: "local", name: "local" };
+    return { type: "remote", name: envContext, server: rec.server, token_env: rec.token_env };
+  }
+  if (envServer) {
+    if (envServer === "local") return { type: "local", name: "local" };
+    return { type: "remote", name: "custom", server: envServer };
+  }
+
+  // Precedence 3 & 4: Configured default context -> local
+  const config = await loadContextConfig(filePath);
+  const defName = config.contexts[config.default_context] ? config.default_context : "local";
+  const defRec = config.contexts[defName] ?? { server: "local" };
+
+  if (defName === "local" || defRec.server === "local") {
+    return { type: "local", name: "local" };
+  }
+  return { type: "remote", name: defName, server: defRec.server, token_env: defRec.token_env };
+}

package/src/dataset-generator.ts

@@ -0,0 +1,140 @@
+import type { DecisionSplit, DecisionOutcome } from "./calibrate";
+import type { VaultSkill } from "./vault";
+
+export interface RawDecisionCase {
+  query: string;
+  split: DecisionSplit;
+  expected_outcome: DecisionOutcome;
+  relevant_skill_ids: string[];
+}
+
+export interface GenerateDatasetOptions {
+  /** Target number of queries per split. Default: 10. */
+  queriesPerSplit?: number;
+}
+
+const GENERIC_NO_MATCH_QUERIES = [
+  "what is the weather in Paris today",
+  "recipe for baking sourdough bread at home",
+  "what is the distance from Earth to Mars",
+  "explain quantum entanglement simply",
+  "how do I solve a quadratic equation",
+  "who won the 1998 World Cup",
+];
+
+/**
+ * Automatically generate a synthetic decision-policy calibration dataset
+ * from local vault skill definitions. Runs 100% locally with zero data leaks.
+ */
+export function generateDataset(
+  skills: VaultSkill[],
+  options: GenerateDatasetOptions = {},
+): RawDecisionCase[] {
+  const cases: RawDecisionCase[] = [];
+
+  // --- 1. Matched Cases ---
+  for (const skill of skills) {
+    // Primary query from title + description
+    cases.push({
+      query: `how do I ${skill.title.toLowerCase()}: ${skill.description.toLowerCase()}`,
+      split: "tune",
+      expected_outcome: "matched",
+      relevant_skill_ids: [skill.skill_id],
+    });
+
+    // Secondary query from aliases
+    if (skill.aliases.length > 0) {
+      cases.push({
+        query: `help me with ${skill.aliases[0]}`,
+        split: "test",
+        expected_outcome: "matched",
+        relevant_skill_ids: [skill.skill_id],
+      });
+    } else {
+      cases.push({
+        query: `execute task related to ${skill.title}`,
+        split: "test",
+        expected_outcome: "matched",
+        relevant_skill_ids: [skill.skill_id],
+      });
+    }
+  }
+
+  // --- 2. Ambiguous Cases ---
+  if (skills.length >= 2) {
+    // Pair skills for ambiguous multi-match
+    for (let i = 0; i < skills.length - 1; i += 2) {
+      const s1 = skills[i]!;
+      const s2 = skills[i + 1]!;
+      const split: DecisionSplit = i % 4 === 0 ? "tune" : "test";
+      cases.push({
+        query: `automated task using ${s1.title} and ${s2.title}`,
+        split,
+        expected_outcome: "ambiguous",
+        relevant_skill_ids: [s1.skill_id, s2.skill_id],
+      });
+    }
+  } else {
+    // Fallback ambiguous cases if fewer than 2 skills
+    cases.push({
+      query: "automate browser workflow testing",
+      split: "tune",
+      expected_outcome: "ambiguous",
+      relevant_skill_ids: ["mock-e2e", "mock-browser"],
+    });
+    cases.push({
+      query: "extract and fetch clean web text",
+      split: "test",
+      expected_outcome: "ambiguous",
+      relevant_skill_ids: ["mock-fetch", "mock-extract"],
+    });
+  }
+
+  // Ensure both tune and test have ambiguous cases
+  if (!cases.some((c) => c.split === "tune" && c.expected_outcome === "ambiguous")) {
+    const sIds = skills.length >= 2 ? [skills[0]!.skill_id, skills[1]!.skill_id] : ["mock-a", "mock-b"];
+    cases.push({
+      query: "integrated workflow multi skill query",
+      split: "tune",
+      expected_outcome: "ambiguous",
+      relevant_skill_ids: sIds,
+    });
+  }
+  if (!cases.some((c) => c.split === "test" && c.expected_outcome === "ambiguous")) {
+    const sIds = skills.length >= 2 ? [skills[0]!.skill_id, skills[1]!.skill_id] : ["mock-a", "mock-b"];
+    cases.push({
+      query: "combined operations multi skill query",
+      split: "test",
+      expected_outcome: "ambiguous",
+      relevant_skill_ids: sIds,
+    });
+  }
+
+  // --- 3. No Match Cases ---
+  GENERIC_NO_MATCH_QUERIES.forEach((q, idx) => {
+    cases.push({
+      query: q,
+      split: idx % 2 === 0 ? "tune" : "test",
+      expected_outcome: "no_match",
+      relevant_skill_ids: [],
+    });
+  });
+
+  // Ensure both splits have at least 1 matched case if skills were empty
+  if (skills.length === 0) {
+    cases.push({
+      query: "run mock container action",
+      split: "tune",
+      expected_outcome: "matched",
+      relevant_skill_ids: ["mock-container"],
+    });
+    cases.push({
+      query: "search mock API docs",
+      split: "test",
+      expected_outcome: "matched",
+      relevant_skill_ids: ["mock-docs"],
+    });
+  }
+
+  return cases;
+}

package/src/doctor.ts

@@ -1,7 +1,10 @@
 import { existsSync, mkdirSync } from "node:fs";
 import { createClients } from "./clients";
 import { embeddingDimension, expandHome } from "./config";
+import { resolveManifestPath } from "./manifest";
+import { readSkillmuxMarker } from "./sync";
 import type { Config } from "./types";
+import { findShadowedSkills } from "./vault";
 
 export interface DoctorCheck {
   name: string;
@@ -19,6 +22,46 @@ export async function diagnose(config: Config): Promise<DoctorReport> {
   const checks: DoctorCheck[] = [];
   checks.push({ name: "vault", ok: existsSync(expandHome(config.vault_path)), detail: expandHome(config.vault_path) });
 
+  for (const localPath of config.local_vault_paths) {
+    const expanded = expandHome(localPath);
+    checks.push({ name: `local_vault:${localPath}`, ok: existsSync(expanded), detail: expanded });
+
+    const strayManifest = resolveManifestPath(expanded);
+    if (strayManifest) {
+      checks.push({
+        name: `local_vault_manifest:${localPath}`,
+        ok: false,
+        detail: `stray manifest at ${strayManifest} — skillmux.toml only ever lives in vault_path, never in local_vault_paths`,
+      });
+    }
+
+    const marker = readSkillmuxMarker(expanded);
+    const currentVaultPath = expandHome(config.vault_path);
+    if (!marker || marker.role !== "local_vault") {
+      checks.push({
+        name: `local_vault_marker:${localPath}`,
+        ok: false,
+        detail: `no marker — run: skillmux local-vault init "${expanded}"`,
+      });
+    } else if (marker.vault_path !== currentVaultPath) {
+      checks.push({
+        name: `local_vault_marker:${localPath}`,
+        ok: false,
+        detail: `marker recorded vault_path ${marker.vault_path}, currently configured vault_path is ${currentVaultPath} — drift, re-run skillmux local-vault init`,
+      });
+    } else {
+      checks.push({ name: `local_vault_marker:${localPath}`, ok: true, detail: expanded });
+    }
+  }
+
+  for (const shadow of findShadowedSkills(expandHome(config.vault_path), config.local_vault_paths.map(expandHome))) {
+    checks.push({
+      name: `shadowed:${shadow.skill_id}`,
+      ok: true,
+      detail: `served from ${shadow.winner}; shadows ${shadow.shadowed.join(", ")}`,
+    });
+  }
+
   try {
     mkdirSync(expandHome(config.state_dir), { recursive: true });
     const probe = Bun.file(expandHome(`${config.state_dir}/.doctor`));

package/src/eval.ts

@@ -11,10 +11,14 @@ export interface EvalCase {
   expected: string[];
 }
 
-const evalCasesSchema = z.array(z.object({
+const rawEvalItemSchema = z.object({
   query: z.string().min(1),
-  expected: z.array(z.string().min(1)).min(1),
-}).strict());
+  expected: z.array(z.string().min(1)).optional(),
+  relevant_skill_ids: z.array(z.string()).optional(),
+  split: z.string().optional(),
+  expected_outcome: z.string().optional(),
+});
+
 
 export interface EvalMetrics {
   recall_at_3: number;
@@ -48,9 +52,23 @@ function metrics(rankings: string[][], cases: EvalCase[]): EvalMetrics {
 }
 
 export function loadEvalCases(path = join(import.meta.dir, "..", "eval", "queries.json")): EvalCase[] {
-  return evalCasesSchema.parse(JSON.parse(readFileSync(path, "utf8")));
+  const raw = JSON.parse(readFileSync(path, "utf8"));
+  if (!Array.isArray(raw)) throw new Error("Eval cases file must contain a JSON array");
+  const parsed = z.array(rawEvalItemSchema).parse(raw);
+  const result: EvalCase[] = [];
+  for (const item of parsed) {
+    const expected = item.expected ?? item.relevant_skill_ids;
+    if (expected && expected.length > 0) {
+      result.push({ query: item.query, expected });
+    }
+  }
+  if (parsed.length > 0 && result.length === 0) {
+    throw new Error("Eval cases file contained no cases with expected targets");
+  }
+  return result;
 }
 
+
 export async function evalVault(cases = loadEvalCases()): Promise<EvalReport> {
   const { config, db, clients } = await getRuntime();
   if (config.inference.mode !== "local") throw new Error('Default evaluation requires inference.mode = "local".');

package/src/init.ts

@@ -80,7 +80,7 @@ export function applyInit(vaultPath: string, confirmedTargets: ConfirmedTarget[]
   const manifest: Manifest = {
     ...proposeManifest([]),
     targets: Object.fromEntries(
-      confirmedTargets.map((target) => [target.name, { dir: target.dir, project: false }]),
+      confirmedTargets.map((target) => [target.name, { dir: target.dir, project_groups: [] }]),
     ),
   };
 

package/src/manifest.ts

@@ -2,7 +2,7 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { expandHome } from "./config";
-import { SKILL_ID_PATTERN } from "./vault";
+import { resolveSkillRoot, SKILL_ID_PATTERN } from "./vault";
 
 export const MANIFEST_FILENAME = "skillmux.toml";
 export const LEGACY_MANIFEST_FILENAME = "skr.toml";
@@ -25,7 +25,7 @@ const projectGroupSchema = z.object({
 
 const targetSchema = z.object({
   dir: z.string().min(1),
-  project: z.boolean().default(false),
+  project_groups: z.array(groupNameSchema).default([]),
 }).strict();
 
 const manifestSchema = z.object({
@@ -40,7 +40,24 @@ export type Manifest = z.infer<typeof manifestSchema>;
 
 export function parseManifest(toml: string): Manifest {
   const parsed = Bun.TOML.parse(toml) as Record<string, unknown>;
-  return manifestSchema.parse(parsed);
+  try {
+    return manifestSchema.parse(parsed);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      for (const issue of error.issues) {
+        if (
+          issue.code === "unrecognized_keys" &&
+          issue.path[0] === "targets" &&
+          issue.keys.includes("project")
+        ) {
+          throw new Error(
+            `[targets.${String(issue.path[1])}] uses the removed field "project" (boolean) — replace it with "project_groups" (an array of [project.<group>] names).`,
+          );
+        }
+      }
+    }
+    throw error;
+  }
 }
 
 function tomlStringArray(values: string[]): string {
@@ -58,19 +75,111 @@ export function serializeManifest(manifest: Manifest): string {
   }
 
   for (const [name, target] of Object.entries(manifest.targets)) {
-    sections.push(`[targets.${name}]\ndir = ${JSON.stringify(target.dir)}\nproject = ${target.project}`);
+    sections.push(
+      `[targets.${name}]\ndir = ${JSON.stringify(target.dir)}\nproject_groups = ${tomlStringArray(target.project_groups)}`,
+    );
   }
 
   return `${sections.join("\n\n")}\n`;
 }
 
+function findExistingPin(manifest: Manifest, skillId: string): string | null {
+  if (manifest.core.skills.includes(skillId)) return "[core]";
+  for (const [groupName, group] of Object.entries(manifest.project ?? {})) {
+    if (group.skills.includes(skillId)) return `[project.${groupName}]`;
+  }
+  return null;
+}
+
+export function pinCore(manifest: Manifest, skillId: string): Manifest {
+  const existing = findExistingPin(manifest, skillId);
+  if (existing) {
+    throw new Error(`skill "${skillId}" already pinned in ${existing}`);
+  }
+  return { ...manifest, core: { skills: [...manifest.core.skills, skillId] } };
+}
+
+export function unpinCore(manifest: Manifest, skillId: string): Manifest {
+  if (!manifest.core.skills.includes(skillId)) {
+    throw new Error(`skill "${skillId}" is not pinned in [core]`);
+  }
+  return { ...manifest, core: { skills: manifest.core.skills.filter((id) => id !== skillId) } };
+}
+
+export function pinProject(manifest: Manifest, skillId: string, group: string, repos?: string[]): Manifest {
+  if (!groupNameSchema.safeParse(group).success) {
+    throw new Error(`invalid group name "${group}" — must match /^[a-z][a-z0-9_-]*$/ (max 64 chars)`);
+  }
+  const existingGroup = manifest.project?.[group];
+
+  if (!existingGroup) {
+    if (!repos || repos.length === 0) {
+      throw new Error(`group "${group}" does not exist — pass --repo <path> at least once to create it`);
+    }
+    const existing = findExistingPin(manifest, skillId);
+    if (existing) {
+      throw new Error(`skill "${skillId}" already pinned in ${existing}`);
+    }
+    return {
+      ...manifest,
+      project: { ...manifest.project, [group]: { repos, skills: [skillId] } },
+    };
+  }
+
+  if (repos && repos.length > 0) {
+    throw new Error(`group "${group}" already exists — --repo is only used when creating a new group`);
+  }
+  const existing = findExistingPin(manifest, skillId);
+  if (existing) {
+    throw new Error(`skill "${skillId}" already pinned in ${existing}`);
+  }
+  return {
+    ...manifest,
+    project: { ...manifest.project, [group]: { ...existingGroup, skills: [...existingGroup.skills, skillId] } },
+  };
+}
+
+export function unpinProject(manifest: Manifest, skillId: string, group: string): Manifest {
+  const existingGroup = manifest.project?.[group];
+  if (!existingGroup) {
+    throw new Error(`[project.${group}] does not exist`);
+  }
+  if (!existingGroup.skills.includes(skillId)) {
+    throw new Error(`skill "${skillId}" is not pinned in [project.${group}]`);
+  }
+  return {
+    ...manifest,
+    project: {
+      ...manifest.project,
+      [group]: { ...existingGroup, skills: existingGroup.skills.filter((id) => id !== skillId) },
+    },
+  };
+}
+
 export interface ManifestValidationResult {
   notes: string[];
 }
 
 const CORE_SKILL_LIMIT = 25;
 
-export function validateManifest(manifest: Manifest, vaultSkillIds: Set<string>): ManifestValidationResult {
+function requireCoreVaultRoot(skillId: string, vaultPath: string, localVaultPaths: string[], location: string): void {
+  const root = resolveSkillRoot(skillId, vaultPath, localVaultPaths);
+  if (root === null) {
+    throw new Error(`${location} skill "${skillId}" does not exist in the vault`);
+  }
+  if (root !== vaultPath) {
+    throw new Error(
+      `${location} skill "${skillId}" only exists in a local vault path (${root}) — pins in the shared ` +
+        `manifest must be backed by the canonical vault_path (${vaultPath}) to stay portable across machines`,
+    );
+  }
+}
+
+export function validateManifest(
+  manifest: Manifest,
+  vaultPath: string,
+  localVaultPaths: string[] = [],
+): ManifestValidationResult {
   if (manifest.core.skills.length > CORE_SKILL_LIMIT) {
     throw new Error(
       `[core] has ${manifest.core.skills.length} skills, exceeding the limit of ${CORE_SKILL_LIMIT}`,
@@ -79,17 +188,22 @@ export function validateManifest(manifest: Manifest, vaultSkillIds: Set<string>)
 
   const coreSet = new Set(manifest.core.skills);
   for (const skillId of manifest.core.skills) {
-    if (!vaultSkillIds.has(skillId)) {
-      throw new Error(`[core] skill "${skillId}" does not exist in the vault`);
+    requireCoreVaultRoot(skillId, vaultPath, localVaultPaths, "[core]");
+  }
+
+  const groupNames = new Set(Object.keys(manifest.project ?? {}));
+  for (const [targetName, target] of Object.entries(manifest.targets)) {
+    for (const groupName of target.project_groups) {
+      if (!groupNames.has(groupName)) {
+        throw new Error(`[targets.${targetName}] project_groups references undefined group "${groupName}"`);
+      }
     }
   }
 
   const notes: string[] = [];
   for (const [groupName, group] of Object.entries(manifest.project ?? {})) {
     for (const skillId of group.skills) {
-      if (!vaultSkillIds.has(skillId)) {
-        throw new Error(`[project.${groupName}] skill "${skillId}" does not exist in the vault`);
-      }
+      requireCoreVaultRoot(skillId, vaultPath, localVaultPaths, `[project.${groupName}]`);
       if (coreSet.has(skillId)) {
         throw new Error(`skill "${skillId}" appears in both [core] and [project.${groupName}]`);
       }