@kody-ade/kody-engine 0.4.430 → 0.4.432

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.430",
+      version: "0.4.432",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -40,6 +40,7 @@ var init_package = __esm({
         posttest: "tsx scripts/check-coverage-floor.ts",
         "test:smoke": "vitest run tests/smoke --no-coverage",
         "test:e2e": "vitest run tests/e2e --no-coverage",
+        "test:runtime-services": 'node --test "tests/runtime-services/*.test.mjs"',
         "test:all": "vitest run tests --no-coverage",
         typecheck: "tsc --noEmit",
         lint: "biome check",
@@ -47,13 +48,14 @@ var init_package = __esm({
         format: "biome format --write",
         "verify:package": "node scripts/verify-package-tarball.cjs",
         "brain:publish": "docker buildx build --platform linux/amd64 -f runner/Dockerfile.brain -t ghcr.io/${KODY_BRAIN_GHCR_OWNER:-aharonyaircohen}/kody-brain:latest --push runner",
-        prepublishOnly: "pnpm typecheck && vitest run tests/unit tests/int --no-coverage && pnpm build && pnpm verify:package"
+        prepublishOnly: "pnpm typecheck && vitest run tests/unit tests/int --no-coverage && pnpm test:runtime-services && pnpm build && pnpm verify:package"
       },
       dependencies: {
         "@actions/cache": "^6.0.0",
         "@anthropic-ai/claude-agent-sdk": "0.2.119",
         "@kody-ade/agency-domain": "0.5.1",
         "@modelcontextprotocol/sdk": "^1.29.0",
+        ajv: "^8.18.0",
         convex: "^1.17.0",
         zod: "^4.0.0"
       },
@@ -255,6 +257,7 @@ function loadConfig(projectDir = process.cwd()) {
       ...parsePerImplementationReasoningEffort(agent.perImplementationReasoningEffort),
       ...parseAgentReasoningEffort(agent.reasoningEffort)
     },
+    execution: parseExecutionConfig(raw.execution),
     issueContext: parseIssueContext(raw.issueContext),
     testRequirements: parseTestRequirements(raw.testRequirements),
     defaultImplementation: typeof raw.defaultImplementation === "string" && raw.defaultImplementation.length > 0 ? raw.defaultImplementation : "run",
@@ -267,6 +270,18 @@ function loadConfig(projectDir = process.cwd()) {
     access: parseAccessConfig(raw.access)
   };
 }
+function parseExecutionConfig(value) {
+  const execution = recordValue(value);
+  const bindings = recordValue(execution?.capabilityBindings);
+  if (!bindings) return void 0;
+  const capabilityBindings = {};
+  for (const [capabilityId, implementationId] of Object.entries(bindings)) {
+    if (/^[a-z][a-z0-9-]*$/.test(capabilityId) && typeof implementationId === "string" && /^[a-z][a-z0-9-]*$/.test(implementationId)) {
+      capabilityBindings[capabilityId] = implementationId;
+    }
+  }
+  return Object.keys(capabilityBindings).length > 0 ? { capabilityBindings } : void 0;
+}
 function parseAccessConfig(raw) {
   if (raw === void 0 || raw === null) {
     return { allowedAssociations: [...DEFAULT_ALLOWED_ASSOCIATIONS] };
@@ -747,7 +762,7 @@ function buildVerifyEnv(source = process.env) {
   return env;
 }
 function runCommand(command, cwd) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve19) => {
     const start = Date.now();
     const child = spawn(command, {
       cwd,
@@ -776,11 +791,11 @@ function runCommand(command, cwd) {
     child.on("exit", (code) => {
       clearTimeout(timer);
       const tail = Buffer.concat(buffers).toString("utf-8").slice(-TAIL_CHARS);
-      resolve17({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
+      resolve19({ exitCode: code ?? -1, durationMs: Date.now() - start, tail });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve17({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
+      resolve19({ exitCode: -1, durationMs: Date.now() - start, tail: err.message });
     });
   });
 }
@@ -1631,10 +1646,71 @@ var init_issue = __esm({
   }
 });
 
+// src/agency/implementation-resolution.ts
+function resolveCapabilityImplementation(input) {
+  const compatible = input.implementations.filter(
+    (implementation) => implementation.capabilityRef.id === input.capabilityId && implementation.compatibleCapabilityRevision === input.capabilityRevision
+  );
+  if (input.explicitOverride) {
+    if (!input.authorizeOverride?.(input.explicitOverride)) {
+      throw new ImplementationResolutionError(`Implementation override "${input.explicitOverride}" is not authorized`);
+    }
+    return selectNamed(input.explicitOverride, input, compatible, "override");
+  }
+  if (input.repositoryBinding) {
+    return selectNamed(input.repositoryBinding, input, compatible, "repository binding");
+  }
+  if (compatible.length === 1) return compatible[0];
+  if (compatible.length === 0) {
+    throw new ImplementationResolutionError(
+      `No compatible Implementation is available for Capability "${input.capabilityId}" at revision "${input.capabilityRevision}"`
+    );
+  }
+  throw new ImplementationResolutionError(
+    `Capability "${input.capabilityId}" has ${compatible.length} compatible Implementations; configure a repository binding`
+  );
+}
+function selectNamed(id, input, compatible, source) {
+  const known = input.implementations.find((implementation) => implementation.id === id);
+  if (!known) {
+    throw new ImplementationResolutionError(`Implementation ${source} "${id}" is not available`);
+  }
+  const selected = compatible.find((implementation) => implementation.id === id);
+  if (!selected) {
+    throw new ImplementationResolutionError(
+      `Implementation ${source} "${id}" is not compatible with Capability "${input.capabilityId}" at revision "${input.capabilityRevision}"`
+    );
+  }
+  return selected;
+}
+var ImplementationResolutionError;
+var init_implementation_resolution = __esm({
+  "src/agency/implementation-resolution.ts"() {
+    "use strict";
+    ImplementationResolutionError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "ImplementationResolutionError";
+      }
+    };
+  }
+});
+
 // src/capabilityFolders.ts
 import * as fs4 from "fs";
 import * as path5 from "path";
 function capabilityOutputConditionPaths(config) {
+  if (config.outputSchema) {
+    const properties = isPlainObject(config.outputSchema.properties) ? config.outputSchema.properties : void 0;
+    const factContract = isPlainObject(properties?.facts) ? properties.facts : void 0;
+    const facts = isPlainObject(factContract?.properties) ? factContract.properties : void 0;
+    return /* @__PURE__ */ new Set([
+      ...properties?.status ? ["result.status"] : [],
+      ...properties?.summary ? ["result.summary"] : [],
+      ...properties?.resultClass ? ["result.resultClass"] : [],
+      ...Object.keys(facts ?? {}).map((fact) => `result.facts.${fact}`)
+    ]);
+  }
   const result = config.output?.result;
   if (!result) return /* @__PURE__ */ new Set();
   return /* @__PURE__ */ new Set([
@@ -1655,16 +1731,19 @@ function listCapabilityFolderSlugs(absDir) {
   return entries.filter((e) => e.isDirectory() && !e.name.startsWith("_") && !e.name.startsWith(".")).filter((e) => isCapabilityFolder(path5.join(absDir, e.name))).map((e) => e.name).sort();
 }
 function isCapabilityFolder(dir) {
-  return fs4.existsSync(path5.join(dir, CAPABILITY_PROFILE_FILE)) && fs4.existsSync(path5.join(dir, CAPABILITY_BODY_FILE));
+  return (fs4.existsSync(path5.join(dir, CAPABILITY_DEFINITION_FILE)) || fs4.existsSync(path5.join(dir, CAPABILITY_PROFILE_FILE))) && fs4.existsSync(path5.join(dir, CAPABILITY_BODY_FILE));
 }
 function readCapabilityFolder(root, slug) {
   const dir = path5.join(root, slug);
-  const profilePath = path5.join(dir, CAPABILITY_PROFILE_FILE);
+  const definitionPath = path5.join(dir, CAPABILITY_DEFINITION_FILE);
+  const legacyProfilePath = path5.join(dir, CAPABILITY_PROFILE_FILE);
+  const profilePath = fs4.existsSync(definitionPath) ? definitionPath : legacyProfilePath;
   const bodyPath = path5.join(dir, CAPABILITY_BODY_FILE);
   if (!fs4.existsSync(profilePath) || !fs4.statSync(profilePath).isFile()) return null;
   if (!fs4.existsSync(bodyPath) || !fs4.statSync(bodyPath).isFile()) return null;
   try {
-    const rawProfile = JSON.parse(fs4.readFileSync(profilePath, "utf-8"));
+    const rawDefinition = JSON.parse(fs4.readFileSync(profilePath, "utf-8"));
+    const rawProfile = rawDefinition;
     const rawBody = fs4.readFileSync(bodyPath, "utf-8");
     const { title, body } = parseCapabilityBody(rawBody, slug);
     return {
@@ -1700,11 +1779,12 @@ function parseCapabilityConfig(raw) {
     capabilityToolMode: parseCapabilityToolMode(raw.capabilityToolMode),
     implementations,
     role: stringField(raw.role),
-    describe: stringField(raw.describe),
+    describe: stringField(raw.describe) ?? stringField(raw.purpose),
     stage: stringField(raw.stage),
     readsFrom: stringList(raw.readsFrom ?? raw.reads_from),
     writesTo: stringList(raw.writesTo ?? raw.writes_to),
     output: parseCapabilityOutput(raw.output),
+    outputSchema: isPlainObject(raw.outputSchema) ? raw.outputSchema : void 0,
     workflow: parseCapabilityWorkflow(raw.workflow)
   };
 }
@@ -1873,11 +1953,12 @@ function isSafeSlug(value) {
 function isSafeStepId(value) {
   return /^[A-Za-z][A-Za-z0-9_-]*$/.test(value) && !value.includes("..");
 }
-var CAPABILITY_PROFILE_FILE, CAPABILITY_BODY_FILE;
+var CAPABILITY_PROFILE_FILE, CAPABILITY_DEFINITION_FILE, CAPABILITY_BODY_FILE;
 var init_capabilityFolders = __esm({
   "src/capabilityFolders.ts"() {
     "use strict";
     CAPABILITY_PROFILE_FILE = "profile.json";
+    CAPABILITY_DEFINITION_FILE = "definition.json";
     CAPABILITY_BODY_FILE = "capability.md";
   }
 });
@@ -1903,6 +1984,9 @@ function hasExplicitDefinitionsRoot(cwd = process.cwd(), env = process.env) {
 function capabilitiesRoot(cwd = process.cwd()) {
   return path6.join(definitionsRoot(cwd), "capabilities");
 }
+function implementationsRoot(cwd = process.cwd()) {
+  return path6.join(definitionsRoot(cwd), "implementations");
+}
 function agentsRoot(cwd = process.cwd()) {
   return path6.join(definitionsRoot(cwd), "agents");
 }
@@ -1913,6 +1997,7 @@ var init_definition_paths = __esm({
 });
 
 // src/registry.ts
+import { createHash as createHash2 } from "crypto";
 import * as fs6 from "fs";
 import * as path7 from "path";
 function getImplementationsRoot() {
@@ -1930,6 +2015,18 @@ function getImplementationsRoot() {
   }
   return candidates[0];
 }
+function getRuntimeServicesRoot() {
+  const here = path7.dirname(new URL(import.meta.url).pathname);
+  const candidates = [
+    path7.join(here, "runtime-services"),
+    path7.join(here, "..", "runtime-services"),
+    path7.join(here, "..", "src", "runtime-services")
+  ];
+  for (const candidate of candidates) {
+    if (fs6.existsSync(candidate) && fs6.statSync(candidate).isDirectory()) return candidate;
+  }
+  return candidates[0];
+}
 function getProjectCapabilitiesRoot() {
   return capabilitiesRoot();
 }
@@ -1952,7 +2049,10 @@ function getImplementationRoots() {
   return getImplementationRootsForCwd(process.cwd());
 }
 function getImplementationRootsForCwd(cwd) {
-  return [capabilitiesRoot(cwd), getImplementationsRoot()];
+  return [implementationsRoot(cwd), getImplementationsRoot()];
+}
+function getRuntimeProfileRootsForCwd(cwd) {
+  return [...getImplementationRootsForCwd(cwd), getRuntimeServicesRoot()];
 }
 function getCapabilityRoots(projectCapabilitiesRoot = getProjectCapabilitiesRoot()) {
   return [projectCapabilitiesRoot, getBuiltinCapabilitiesRoot()];
@@ -1968,7 +2068,7 @@ function listImplementations(roots = getImplementationRoots()) {
     for (const ent of entries) {
       if (!ent.isDirectory()) continue;
       if (seen.has(ent.name)) continue;
-      const profilePath = path7.join(root, ent.name, CAPABILITY_PROFILE_FILE);
+      const profilePath = implementationRuntimePath(root, ent.name);
       if (fs6.existsSync(profilePath) && fs6.statSync(profilePath).isFile() && isImplementationProfile(profilePath, requireImplementationProfile)) {
         out.push({ name: ent.name, profilePath });
         seen.add(ent.name);
@@ -1977,15 +2077,18 @@ function listImplementations(roots = getImplementationRoots()) {
   }
   return out.sort((a, b) => a.name.localeCompare(b.name));
 }
-function resolveImplementation(name, roots = getImplementationRoots()) {
+function listRuntimeProfilesForCwd(cwd) {
+  return listImplementations(getRuntimeProfileRootsForCwd(cwd));
+}
+function resolveImplementation(name, roots = getRuntimeProfileRootsForCwd(process.cwd())) {
   return resolveImplementationCandidates(name, roots)[0] ?? null;
 }
-function resolveImplementationCandidates(name, roots = getImplementationRoots()) {
+function resolveImplementationCandidates(name, roots = getRuntimeProfileRootsForCwd(process.cwd())) {
   if (!isSafeName(name)) return [];
   const rootList = typeof roots === "string" ? [roots] : roots;
   const out = [];
   for (const root of rootList) {
-    const profilePath = path7.join(root, name, "profile.json");
+    const profilePath = implementationRuntimePath(root, name);
     if (fs6.existsSync(profilePath) && fs6.statSync(profilePath).isFile() && isImplementationProfile(profilePath, isCapabilityRoot(root))) {
       out.push(profilePath);
     }
@@ -2023,9 +2126,43 @@ function resolveCapabilityFolder(slug, projectCapabilitiesRoot = getProjectCapab
 function getCapabilityActionInputs(action, projectCapabilitiesRoot = getProjectCapabilitiesRoot()) {
   const resolved = resolveCapabilityAction(action, projectCapabilitiesRoot);
   if (!resolved) return null;
+  const capability = resolveCapabilityFolder(resolved.capability, projectCapabilitiesRoot);
+  if (capability && path7.basename(capability.profilePath) === "definition.json") {
+    const schema = capability.rawProfile.inputSchema;
+    if (!schema || typeof schema !== "object" || Array.isArray(schema)) return [];
+    const properties = schema.properties;
+    if (!properties || typeof properties !== "object" || Array.isArray(properties)) return [];
+    const required2 = new Set(
+      Array.isArray(schema.required) ? schema.required.filter((value) => typeof value === "string") : []
+    );
+    return Object.entries(properties).map(([name, value]) => {
+      const property = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+      const type = property.type === "integer" ? "int" : property.type === "boolean" ? "bool" : Array.isArray(property.enum) ? "enum" : "string";
+      return {
+        name,
+        flag: `--${name}`,
+        type,
+        required: required2.has(name),
+        ...type === "enum" && Array.isArray(property.enum) ? { values: property.enum.filter((item) => typeof item === "string") } : {},
+        describe: typeof property.description === "string" ? property.description : name
+      };
+    });
+  }
   return getProfileInputs(resolved.implementation);
 }
 function resolveCapabilityExecution(capability, cwd = process.cwd()) {
+  if (path7.basename(capability.profilePath) === "definition.json") {
+    const implementations = readExternalImplementations(cwd);
+    const definition = JSON.parse(fs6.readFileSync(capability.profilePath, "utf-8"));
+    const capabilityRevision = createHash2("sha256").update(canonical(definition)).digest("hex");
+    const selected = resolveCapabilityImplementation({
+      capabilityId: capability.slug,
+      capabilityRevision,
+      implementations,
+      repositoryBinding: repositoryImplementationBinding(capability.slug, cwd)
+    });
+    return { implementation: selected.id, cliArgs: {} };
+  }
   const firstWorkflowStep = capability.config.workflow?.steps[0];
   if (firstWorkflowStep) {
     const implementation2 = firstWorkflowStep.implementation ?? firstWorkflowStep.capability;
@@ -2035,11 +2172,42 @@ function resolveCapabilityExecution(capability, cwd = process.cwd()) {
   const cliArgs = implementationDeclaresInput(implementation, "capability", cwd) ? { capability: capability.slug } : {};
   return { implementation, cliArgs };
 }
+function repositoryImplementationBinding(capabilityId, cwd) {
+  try {
+    return loadConfig(cwd).execution?.capabilityBindings[capabilityId];
+  } catch {
+    return void 0;
+  }
+}
+function readExternalImplementations(cwd) {
+  const root = implementationsRoot(cwd);
+  if (!fs6.existsSync(root)) return [];
+  const definitions = [];
+  for (const entry of fs6.readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isDirectory() || !isSafeName(entry.name)) continue;
+    const definitionPath = path7.join(root, entry.name, "definition.json");
+    if (!fs6.existsSync(definitionPath)) continue;
+    try {
+      const definition = JSON.parse(fs6.readFileSync(definitionPath, "utf-8"));
+      definitions.push(definition);
+    } catch {
+    }
+  }
+  return definitions;
+}
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
 function implementationDeclaresInput(implementation, inputName, cwd = process.cwd()) {
-  const profilePath = resolveImplementation(implementation, getImplementationRootsForCwd(cwd));
+  const profilePath = resolveImplementation(implementation, getRuntimeProfileRootsForCwd(cwd));
   if (!profilePath) return false;
   try {
-    const raw = JSON.parse(fs6.readFileSync(profilePath, "utf-8"));
+    const document = JSON.parse(fs6.readFileSync(profilePath, "utf-8"));
+    const raw = document.config ?? document;
     if (!Array.isArray(raw.inputs)) return false;
     return raw.inputs.some((entry) => {
       if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
@@ -2059,6 +2227,10 @@ function isCapabilityRoot(root) {
   const knownRoots = [getProjectCapabilitiesRoot(), getBuiltinCapabilitiesRoot()];
   return knownRoots.some((candidate) => candidate && path7.normalize(candidate) === normalized);
 }
+function implementationRuntimePath(root, name) {
+  const runtimePath = path7.join(root, name, "runtime.json");
+  return fs6.existsSync(runtimePath) ? runtimePath : path7.join(root, name, CAPABILITY_PROFILE_FILE);
+}
 function isImplementationProfile(profilePath, requireImplementationProfile) {
   if (!requireImplementationProfile) return true;
   try {
@@ -2126,8 +2298,10 @@ function getProfileInputs(name, roots = getImplementationRoots()) {
   const profilePath = resolveImplementation(name, roots);
   if (!profilePath) return null;
   try {
-    const raw = JSON.parse(fs6.readFileSync(profilePath, "utf-8"));
-    if (!raw || typeof raw !== "object" || !Array.isArray(raw.inputs)) return [];
+    const document = JSON.parse(fs6.readFileSync(profilePath, "utf-8"));
+    if (!document || typeof document !== "object") return [];
+    const raw = "config" in document && document.config && typeof document.config === "object" ? document.config : document;
+    if (!Array.isArray(raw.inputs)) return [];
     return raw.inputs;
   } catch {
     return null;
@@ -2162,7 +2336,9 @@ var PUBLIC_IMPLEMENTATION_ROLES;
 var init_registry = __esm({
   "src/registry.ts"() {
     "use strict";
+    init_implementation_resolution();
     init_capabilityFolders();
+    init_config();
     init_definition_paths();
     PUBLIC_IMPLEMENTATION_ROLES = /* @__PURE__ */ new Set(["primitive", "orchestrator", "container", "watch", "utility"]);
   }
@@ -3256,7 +3432,7 @@ var init_repoWorkspace = __esm({
     defaultCloneRepo = (repo, token, dir) => {
       fs7.mkdirSync(path8.dirname(dir), { recursive: true });
       const clone = buildCloneProcess(repo, token);
-      return new Promise((resolve17, reject) => {
+      return new Promise((resolve19, reject) => {
         const child = spawn2("git", ["clone", "--depth=1", clone.url, dir], {
           env: clone.env,
           stdio: "inherit"
@@ -3276,7 +3452,7 @@ var init_repoWorkspace = __esm({
             }
           } catch {
           }
-          resolve17();
+          resolve19();
         });
         child.on("error", reject);
       });
@@ -3590,10 +3766,10 @@ async function runAgent(opts) {
         let timer;
         let next;
         if (turnTimeoutMs > 0) {
-          const timeoutPromise = new Promise((resolve17) => {
+          const timeoutPromise = new Promise((resolve19) => {
             timer = setTimeout(() => {
               timedOut = true;
-              resolve17({ done: true, value: void 0 });
+              resolve19({ done: true, value: void 0 });
             }, turnTimeoutMs);
           });
           next = await Promise.race([nextPromise, timeoutPromise]);
@@ -3609,7 +3785,7 @@ async function runAgent(opts) {
             try {
               await Promise.race([
                 iterator.return(void 0).catch(() => void 0),
-                new Promise((resolve17) => setTimeout(resolve17, 1e4).unref())
+                new Promise((resolve19) => setTimeout(resolve19, 1e4).unref())
               ]);
             } catch {
             }
@@ -4166,6 +4342,40 @@ var init_agencyBoundaryEval = __esm({
   }
 });
 
+// src/agency/capability-contract-validation.ts
+import Ajv from "ajv";
+function validateCapabilityContractValue(boundary, schema, value) {
+  const validate = validator.compile(schema);
+  if (!validate(value)) {
+    throw new CapabilityContractValidationError(boundary, validate.errors ?? []);
+  }
+}
+var validator, CapabilityContractValidationError;
+var init_capability_contract_validation = __esm({
+  "src/agency/capability-contract-validation.ts"() {
+    "use strict";
+    validator = new Ajv({
+      allErrors: true,
+      strict: true,
+      validateFormats: false
+    });
+    CapabilityContractValidationError = class extends Error {
+      constructor(boundary, errors) {
+        super(
+          `Capability ${boundary} does not match its canonical contract: ${validator.errorsText([...errors], {
+            separator: "; "
+          })}`
+        );
+        this.boundary = boundary;
+        this.errors = errors;
+        this.name = "CapabilityContractValidationError";
+      }
+      boundary;
+      errors;
+    };
+  }
+});
+
 // src/capabilityReport.ts
 function parseCapabilityReportsFromText(text2) {
   const reports = [];
@@ -4603,10 +4813,12 @@ var init_buildSyntheticPlugin = __esm({
       const resolvePart = (bucket, entry) => {
         const local = path17.join(profile.dir, bucket, entry);
         if (fs18.existsSync(local)) return local;
+        const shared = path17.resolve(profile.dir, "..", "..", "shared", bucket, entry);
+        if (fs18.existsSync(shared)) return shared;
         const central = path17.join(catalog, bucket, entry);
         if (fs18.existsSync(central)) return central;
         throw new Error(
-          `buildSyntheticPlugin: ${bucket} entry '${entry}' not found in implementation dir (${profile.dir}/${bucket}/) or catalog (${catalog}/${bucket}/)`
+          `buildSyntheticPlugin: ${bucket} entry '${entry}' not found in implementation dir (${profile.dir}/${bucket}/), Store shared assets (${path17.dirname(shared)}/), or catalog (${catalog}/${bucket}/)`
         );
       };
       if (cc.skills.length > 0) {
@@ -4670,9 +4882,13 @@ function splitFrontmatter(raw) {
 function resolveAgentFile2(profileDir, name) {
   const local = path18.join(profileDir, "agents", `${name}.md`);
   if (fs19.existsSync(local)) return local;
+  const shared = path18.resolve(profileDir, "..", "..", "shared", "agents", `${name}.md`);
+  if (fs19.existsSync(shared)) return shared;
   const central = path18.join(getPluginsCatalogRoot(), "agents", `${name}.md`);
   if (fs19.existsSync(central)) return central;
-  throw new Error(`loadSubagents: agent '${name}' not found in ${profileDir}/agents/ or shared catalog`);
+  throw new Error(
+    `loadSubagents: agent '${name}' not found in ${profileDir}/agents/, hydrated shared assets, or engine catalog`
+  );
 }
 function captureSubagentTemplates(profile) {
   const names = profile.claudeCode.subagents;
@@ -4715,6 +4931,7 @@ var init_subagents = __esm({
 });
 
 // src/profile.ts
+import { createHash as createHash3 } from "crypto";
 import * as fs20 from "fs";
 import * as path19 from "path";
 function loadProfile(profilePath) {
@@ -4730,7 +4947,8 @@ function loadProfile(profilePath) {
   if (!raw || typeof raw !== "object") {
     throw new ProfileError(profilePath, "profile must be a JSON object");
   }
-  const r = raw;
+  const document = raw;
+  const r = compileRuntimeDocument(profilePath, document);
   const unknownKeys = Object.keys(r).filter((k) => !KNOWN_PROFILE_KEYS.has(k));
   if (unknownKeys.length > 0) {
     process.stderr.write(
@@ -4877,6 +5095,67 @@ function loadProfile(profilePath) {
   profile.subagentTemplates = captureSubagentTemplates(profile);
   return profile;
 }
+function compileRuntimeDocument(runtimePath, document) {
+  if (path19.basename(runtimePath) !== "runtime.json") return document;
+  if (document.adapter !== "kody-engine-profile") {
+    throw new ProfileError(runtimePath, "unsupported runtime adapter document");
+  }
+  const implementationDir = path19.dirname(runtimePath);
+  const implementation = readJsonObject(path19.join(implementationDir, "definition.json"), "Implementation definition");
+  const definitionsRoot2 = path19.dirname(path19.dirname(implementationDir));
+  const capabilityId = implementation.capabilityRef && typeof implementation.capabilityRef === "object" && !Array.isArray(implementation.capabilityRef) ? implementation.capabilityRef.id : void 0;
+  if (typeof capabilityId !== "string" || !capabilityId) {
+    throw new ProfileError(runtimePath, "Implementation capabilityRef is invalid");
+  }
+  const capability = readJsonObject(
+    path19.join(definitionsRoot2, "capabilities", capabilityId, "definition.json"),
+    "Capability definition"
+  );
+  const {
+    adapter: _adapter,
+    inputBindings: _inputBindings,
+    outputBindings: _outputBindings,
+    requirements: _requirements,
+    config: nestedConfig,
+    ...inlineConfig
+  } = document;
+  const config = nestedConfig && typeof nestedConfig === "object" && !Array.isArray(nestedConfig) ? nestedConfig : inlineConfig;
+  const agentRef = implementation.agentRef && typeof implementation.agentRef === "object" && !Array.isArray(implementation.agentRef) ? implementation.agentRef.id : void 0;
+  return {
+    ...config,
+    name: implementation.id,
+    action: capability.action,
+    describe: capability.purpose,
+    inputs: config.inputs ?? [],
+    agent: agentRef,
+    canonicalContract: {
+      capabilityId,
+      capabilityRevision: createHash3("sha256").update(canonical2(capability)).digest("hex"),
+      implementationId: String(implementation.id),
+      implementationRevision: createHash3("sha256").update(canonical2(implementation)).digest("hex"),
+      inputSchema: capability.inputSchema,
+      outputSchema: capability.outputSchema
+    }
+  };
+}
+function canonical2(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical2).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonical2(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function readJsonObject(filePath, label) {
+  try {
+    const value = JSON.parse(fs20.readFileSync(filePath, "utf-8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new Error("must be an object");
+    }
+    return value;
+  } catch (error) {
+    throw new ProfileError(filePath, `${label} is invalid: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
 function parseCapabilityToolMode2(profilePath, raw) {
   if (raw === void 0 || raw === null || raw === "") return void 0;
   if (raw === "lock" || raw === "append") return raw;
@@ -5256,6 +5535,7 @@ var init_profile = __esm({
     VALID_CONTAINER_CHILD_TARGETS = /* @__PURE__ */ new Set(["issue", "pr"]);
     VALID_PHASES = /* @__PURE__ */ new Set(["research", "planning", "implementing", "reviewing", "shipped", "failed", "idle"]);
     KNOWN_PROFILE_KEYS = /* @__PURE__ */ new Set([
+      "canonicalContract",
       "name",
       "action",
       "implementation",
@@ -6779,11 +7059,11 @@ async function nextAvailableLitellmUrl(url) {
   throw new Error(`no free LiteLLM port found after ${startPort}`);
 }
 function canListen(port, host) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve19) => {
     const server = net.createServer();
-    server.once("error", () => resolve17(false));
+    server.once("error", () => resolve19(false));
     server.once("listening", () => {
-      server.close(() => resolve17(true));
+      server.close(() => resolve19(true));
     });
     server.listen(port, host);
   });
@@ -6899,6 +7179,9 @@ function runIndexRowFromJobContext(input) {
     capability: stringValue(input.data.jobCapability) ?? void 0,
     workflow: workflow ?? void 0,
     implementation: stringValue(input.data.selectedImplementation) ?? input.profileName,
+    parentRunId: stringValue(input.data.parentRunId) ?? void 0,
+    capabilityRevision: stringValue(input.data.capabilityRevision) ?? void 0,
+    implementationRevision: stringValue(input.data.implementationRevision) ?? void 0,
     agent: stringValue(input.data.jobAgent) ?? input.profile.agent ?? void 0,
     model: stringValue(input.data.jobModel) ?? void 0,
     modelProvider: stringValue(input.data.jobModelProvider) ?? void 0,
@@ -6963,7 +7246,7 @@ function statusFromExitCode(exitCode) {
   return exitCode === 0 ? "success" : "failed";
 }
 function isRunSubjectType(value) {
-  return value === "goal" || value === "loop" || value === "workflow";
+  return value === "goal" || value === "loop" || value === "workflow" || value === "capability";
 }
 function stagedRunIndexRows(data) {
   const value = data[STAGED_RUN_INDEX_ROWS_KEY];
@@ -8472,9 +8755,9 @@ function goalInstanceTime(state) {
   return Number.isNaN(parsed) ? 0 : parsed;
 }
 function loadGoalTemplate(cwd, targetId) {
-  return readJsonObject(path24.join(cwd, ".kody-engine", "definitions", "goals", targetId, "state.json"));
+  return readJsonObject2(path24.join(cwd, ".kody-engine", "definitions", "goals", targetId, "state.json"));
 }
-function readJsonObject(filePath) {
+function readJsonObject2(filePath) {
   if (!fs27.existsSync(filePath)) return null;
   const parsed = JSON.parse(fs27.readFileSync(filePath, "utf8"));
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
@@ -9504,6 +9787,7 @@ async function planGoalCapabilitySchedule(opts) {
       capability2,
       slug,
       backend,
+      opts.cwd,
       opts.previousScheduleState?.capabilities[slug]
     );
     statuses[slug] = status;
@@ -9558,21 +9842,19 @@ async function planGoalCapabilitySchedule(opts) {
     }
   };
 }
-async function describeCapabilitySchedule(capability, slug, backend, previous) {
+async function describeCapabilitySchedule(capability, slug, backend, cwd, previous) {
   if (!capability) return { slug, state: "blocked", reason: "capability folder missing" };
-  const { config } = capability;
-  if (config.disabled === true) {
+  if (capability.config.disabled === true) {
     return { slug, title: capability.title, state: "disabled", reason: "disabled" };
   }
-  if (!config.agent || config.agent.trim().length === 0) {
-    return { slug, title: capability.title, state: "blocked", reason: "no agent assigned" };
-  }
-  if (config.implementations && config.implementations.length > 1) {
+  try {
+    resolveCapabilityExecution(capability, cwd);
+  } catch (error) {
     return {
       slug,
       title: capability.title,
       state: "blocked",
-      reason: "multi-implementation capability needs task-jobs route"
+      reason: error instanceof Error ? error.message : "Implementation unavailable"
     };
   }
   let lastFiredAt = validIso(previous?.lastFiredAt) ? previous?.lastFiredAt : void 0;
@@ -13242,7 +13524,7 @@ var init_triggerDispatcher = __esm({
 });
 
 // src/goal/policyResolver.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 function resolveDispatchPolicy(input) {
   const operation = input.catalog.operations.get(input.owner.definition.operationId);
   if (!operation) throw new Error(`Dispatch blocked: Operation "${input.owner.definition.operationId}" is unresolved`);
@@ -13260,7 +13542,7 @@ function resolveDispatchPolicy(input) {
   const snapshotValue = { policy, constraints };
   return {
     snapshot: {
-      hash: createHash2("sha256").update(stableJson(snapshotValue)).digest("hex"),
+      hash: createHash4("sha256").update(stableJson(snapshotValue)).digest("hex"),
       ...snapshotValue
     },
     operation,
@@ -13602,10 +13884,10 @@ async function runAttempt(run, job, timeoutSeconds) {
         exitCode: 99,
         reason: error instanceof Error ? error.message : String(error)
       })),
-      new Promise((resolve17) => {
+      new Promise((resolve19) => {
         timer = setTimeout(() => {
           abortController.abort();
-          resolve17({ exitCode: 124, reason: `target timed out after ${formatSeconds(timeoutSeconds)}s` });
+          resolve19({ exitCode: 124, reason: `target timed out after ${formatSeconds(timeoutSeconds)}s` });
         }, timeoutSeconds * 1e3);
       })
     ]);
@@ -13645,7 +13927,7 @@ function formatSeconds(seconds) {
 }
 async function wait(milliseconds) {
   if (milliseconds <= 0) return;
-  await new Promise((resolve17) => setTimeout(resolve17, milliseconds));
+  await new Promise((resolve19) => setTimeout(resolve19, milliseconds));
 }
 function repositoryTenant(config) {
   const owner = config.github?.owner?.trim() || process.env.GITHUB_REPOSITORY?.split("/")[0]?.trim();
@@ -14825,7 +15107,7 @@ function performInit(cwd, force) {
     fs36.writeFileSync(workflowPath, loadKodyWorkflowTemplate());
     wrote.push(".github/workflows/kody.yml");
   }
-  for (const exe of listImplementations()) {
+  for (const exe of listRuntimeProfilesForCwd(cwd)) {
     let profile;
     try {
       profile = loadProfile(exe.profilePath);
@@ -15233,7 +15515,7 @@ function retryDelaysMs() {
 }
 function sleep(ms) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve17) => setTimeout(resolve17, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 async function fetchGoalStateWithRetry(config, goalId, cwd) {
   let state = await fetchGoalStateAsync(config, goalId, cwd);
@@ -15531,9 +15813,9 @@ var init_kodyVariables = __esm({
 });
 
 // src/backendVault.ts
-import { createDecipheriv, createHash as createHash3 } from "crypto";
+import { createDecipheriv, createHash as createHash5 } from "crypto";
 function cacheKey(owner, repo, masterKey) {
-  const keyHash = createHash3("sha256").update(masterKey).digest("hex").slice(0, 16);
+  const keyHash = createHash5("sha256").update(masterKey).digest("hex").slice(0, 16);
   return `${owner}/${repo}:${keyHash}`.toLowerCase();
 }
 function decryptVault(payload, masterKey) {
@@ -16182,7 +16464,7 @@ var init_notifyTerminal = __esm({
 });
 
 // src/scripts/openAgencyModelReviewPr.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function parseAgencyModelProposal(raw) {
   const text2 = raw.trim();
   const jsonText = (text2.match(/^```(?:json)?\s*\n([\s\S]*?)\n```$/i)?.[1] ?? text2).trim();
@@ -16234,7 +16516,7 @@ function normalizeBundleFiles(bundle) {
   });
 }
 function buildProposalId(issueNumber, bundle, sourceLabel) {
-  const digest = createHash4("sha256").update(JSON.stringify({ issueNumber, sourceLabel, title: bundle.title, files: normalizeBundleFiles(bundle) })).digest("hex").slice(0, 16);
+  const digest = createHash6("sha256").update(JSON.stringify({ issueNumber, sourceLabel, title: bundle.title, files: normalizeBundleFiles(bundle) })).digest("hex").slice(0, 16);
   return `issue-${issueNumber}-${digest}`;
 }
 function isDryRun(ctx) {
@@ -18306,9 +18588,9 @@ var init_runFlow = __esm({
 });
 
 // src/scripts/previewBuildHelpers.ts
-import { createDecipheriv as createDecipheriv2, createHash as createHash5, hkdfSync as hkdfSync2 } from "crypto";
+import { createDecipheriv as createDecipheriv2, createHash as createHash7, hkdfSync as hkdfSync2 } from "crypto";
 function shortHash(s) {
-  return createHash5("sha256").update(s).digest("hex").slice(0, 6);
+  return createHash7("sha256").update(s).digest("hex").slice(0, 6);
 }
 function previewAppName(repo, pr) {
   const [owner, name] = repo.split("/");
@@ -18341,7 +18623,7 @@ function formatPreviewComment(args) {
   ].join("\n");
 }
 function defaultImageTag(repo, ref) {
-  return createHash5("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
+  return createHash7("sha256").update(`${repo}@${ref}`).digest("hex").slice(0, 12);
 }
 var init_previewBuildHelpers = __esm({
   "src/scripts/previewBuildHelpers.ts"() {
@@ -18352,7 +18634,7 @@ var init_previewBuildHelpers = __esm({
 // src/scripts/previewBuildRun.ts
 import { spawn as spawn5 } from "child_process";
 async function runCmd(cmd, args, opts = {}) {
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve19, reject) => {
     const child = spawn5(cmd, args, {
       cwd: opts.cwd,
       env: { ...process.env, ...opts.env ?? {} },
@@ -18364,7 +18646,7 @@ async function runCmd(cmd, args, opts = {}) {
     }
     child.on("error", reject);
     child.on("close", (code) => {
-      if (code === 0) resolve17();
+      if (code === 0) resolve19();
       else reject(new Error(`${cmd} ${args.join(" ")} exited ${code}`));
     });
   });
@@ -19628,7 +19910,7 @@ function stripAnsi2(s) {
   return s.replace(ANSI_RE2, "");
 }
 function runCommand2(command, cwd) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve19) => {
     const child = spawn6(command, {
       cwd,
       shell: true,
@@ -19655,11 +19937,11 @@ function runCommand2(command, cwd) {
     }, TEST_TIMEOUT_MS);
     child.on("exit", (code) => {
       clearTimeout(timer);
-      resolve17({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
+      resolve19({ exitCode: code ?? -1, output: Buffer.concat(buffers).toString("utf-8") });
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve17({ exitCode: -1, output: err.message });
+      resolve19({ exitCode: -1, output: err.message });
     });
   });
 }
@@ -20065,21 +20347,21 @@ function lineStream(stream) {
     tryDeliver();
   });
   return {
-    next: (timeoutMs) => new Promise((resolve17) => {
+    next: (timeoutMs) => new Promise((resolve19) => {
       if (queue.length > 0) {
-        resolve17(queue.shift());
+        resolve19(queue.shift());
         return;
       }
       if (ended) {
-        resolve17(null);
+        resolve19(null);
         return;
       }
-      waiter = resolve17;
+      waiter = resolve19;
       const t = setTimeout(
         () => {
-          if (waiter === resolve17) {
+          if (waiter === resolve19) {
             waiter = null;
-            resolve17(null);
+            resolve19(null);
           }
         },
         Math.max(0, timeoutMs)
@@ -20747,6 +21029,9 @@ async function runImplementation(profileName, input) {
   let args;
   try {
     args = validateInputs(profile.inputs, input.cliArgs);
+    if (profile.canonicalContract) {
+      validateCapabilityContractValue("input", profile.canonicalContract.inputSchema, args);
+    }
   } catch (err) {
     return finishAndEnd({ exitCode: 64, reason: err instanceof Error ? err.message : String(err) });
   }
@@ -20807,6 +21092,12 @@ async function runImplementation(profileName, input) {
   ctx.data.jobModelProvider = model.provider;
   ctx.data.jobModelName = model.model;
   if (reasoningEffort) ctx.data.jobReasoningEffort = reasoningEffort;
+  if (profile.canonicalContract) {
+    ctx.data.jobCapability = profile.canonicalContract.capabilityId;
+    ctx.data.selectedImplementation = profile.canonicalContract.implementationId;
+    ctx.data.capabilityRevision = profile.canonicalContract.capabilityRevision;
+    ctx.data.implementationRevision = profile.canonicalContract.implementationRevision;
+  }
   const runIndexStartedAt = new Date(stageStartedAt).toISOString();
   if (!input.skipConfig) {
     await upsertRunIndexRowBestEffortAsync(
@@ -21116,6 +21407,25 @@ async function runImplementation(profileName, input) {
         outcome: postOutcome
       });
     }
+    const capabilityResults = Array.isArray(ctx.data.capabilityResults) ? ctx.data.capabilityResults : void 0;
+    if (profile.canonicalContract) {
+      try {
+        validateCapabilityContractValue(
+          "output",
+          profile.canonicalContract.outputSchema,
+          capabilityResults?.at(-1) ?? {
+            exitCode: ctx.output.exitCode ?? 0,
+            reason: ctx.output.reason,
+            prUrl: ctx.output.prUrl
+          }
+        );
+      } catch (error) {
+        return finishAndEnd({
+          exitCode: 99,
+          reason: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
     return finishAndEnd({
       exitCode: ctx.output.exitCode ?? 0,
       prUrl: ctx.output.prUrl,
@@ -21124,7 +21434,7 @@ async function runImplementation(profileName, input) {
       nextJob: ctx.output.nextJob,
       afterNextJob: ctx.output.afterNextJob,
       taskState: ctx.data.taskState,
-      capabilityResults: Array.isArray(ctx.data.capabilityResults) ? ctx.data.capabilityResults : void 0
+      capabilityResults
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -21311,7 +21621,7 @@ function clearStampedLifecycleLabels(profile, ctx) {
   }
 }
 function resolveProfilePath(profileName, cwd = process.cwd()) {
-  const found = resolveImplementation(profileName, getImplementationRootsForCwd(cwd));
+  const found = resolveImplementation(profileName, getRuntimeProfileRootsForCwd(cwd));
   if (found) return found;
   const here = path45.dirname(new URL(import.meta.url).pathname);
   const candidates = [
@@ -21328,10 +21638,7 @@ function resolveProfilePath(profileName, cwd = process.cwd()) {
   return candidates[0];
 }
 function loadRunnableProfile(profileName, cwd) {
-  const candidates = resolveImplementationCandidates(
-    profileName,
-    getImplementationRootsForCwd(cwd)
-  );
+  const candidates = resolveImplementationCandidates(profileName, getRuntimeProfileRootsForCwd(cwd));
   const skipped = [];
   for (const profilePath2 of candidates) {
     const profile2 = loadProfile(profilePath2);
@@ -21484,14 +21791,14 @@ async function runShellEntry(entry, ctx, profile) {
   let killTimer;
   let escalateTimer;
   const result = await new Promise(
-    (resolve17) => {
+    (resolve19) => {
       let settled = false;
       const settle = (code, signal, spawnErr) => {
         if (settled) return;
         settled = true;
         if (killTimer) clearTimeout(killTimer);
         if (escalateTimer) clearTimeout(escalateTimer);
-        resolve17({ code, signal, spawnErr });
+        resolve19({ code, signal, spawnErr });
       };
       child.on("error", (err) => settle(null, null, err));
       child.on("close", (code, signal) => settle(code, signal));
@@ -21583,6 +21890,7 @@ var MUTATING_POSTFLIGHTS, SHELL_MARKER_RE, TASK_ARTIFACT_WRITE_TOOLS, MAX_CHAIN_
 var init_executor = __esm({
   "src/executor.ts"() {
     "use strict";
+    init_capability_contract_validation();
     init_agent();
     init_agents();
     init_capabilityReport();
@@ -21786,7 +22094,52 @@ async function runJob(job, base) {
       ...valid.workflowState ?? persistedState ? { workflowState: valid.workflowState ?? persistedState ?? void 0 } : {}
     };
     const checkpoint = valid.workflowRunId && workflowIdentity && base.config ? (state) => writeWorkflowRunState(base.config, base.cwd, workflowIdentity, valid.workflowRunId, state) : void 0;
-    const result = await runCapabilityWorkflow(workflowJob, workflow, workflowCapability, base, checkpoint);
+    const parentRunId = `workflow:${workflowIdentity}:${valid.workflowRunId ?? newJobId(valid.flavor)}`;
+    const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const parentRow = {
+      version: 1,
+      id: parentRunId,
+      subjectType: "workflow",
+      subjectId: workflowIdentity,
+      subjectLabel: workflowCapability.title,
+      status: "running",
+      title: workflowCapability.title,
+      startedAt,
+      updatedAt: startedAt,
+      workflow: workflowIdentity,
+      kodyRunId: valid.workflowRunId,
+      sourceType: "job"
+    };
+    const persistRun = Boolean(base.config && !base.skipConfig && hasStateBackendConfig());
+    if (base.config && persistRun) {
+      await upsertRunIndexRowBestEffortAsync(base.config, base.cwd, parentRow);
+    }
+    const workflowBase = {
+      ...base,
+      preloadedData: { ...base.preloadedData ?? {}, parentRunId }
+    };
+    let result;
+    try {
+      result = await runCapabilityWorkflow(workflowJob, workflow, workflowCapability, workflowBase, checkpoint);
+    } catch (error) {
+      if (base.config && persistRun) {
+        await upsertRunIndexRowBestEffortAsync(base.config, base.cwd, {
+          ...parentRow,
+          status: "failed",
+          summary: error instanceof Error ? error.message : String(error),
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+      throw error;
+    }
+    if (base.config && persistRun) {
+      await upsertRunIndexRowBestEffortAsync(base.config, base.cwd, {
+        ...parentRow,
+        status: result.exitCode === 0 ? "success" : "failed",
+        summary: result.reason,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
     if (valid.workflowRunId && workflowIdentity && base.config && result.workflowState) {
       await writeWorkflowRunState(base.config, base.cwd, workflowIdentity, valid.workflowRunId, result.workflowState);
     }
@@ -21926,6 +22279,9 @@ async function runLinearCapabilityWorkflow(parent, workflow, capability, base) {
       ...base,
       preloadedData: {
         ...chainData,
+        runSubjectType: "capability",
+        runSubjectId: step.capability,
+        runSubjectLabel: label,
         workflowStep: label,
         workflowStepIndex: index + 1,
         workflowStepReason: step.reason,
@@ -22070,6 +22426,9 @@ async function runGraphCapabilityWorkflow(parent, workflow, capability, base, ch
       ...base,
       preloadedData: {
         ...chainData,
+        runSubjectType: "capability",
+        runSubjectId: step.capability,
+        runSubjectLabel: step.id,
         workflowStep: step.id,
         workflowStepIndex: index + 1,
         workflowStepReason: step.reason,
@@ -22323,7 +22682,7 @@ function hydratedCapabilitiesRoot(cwd) {
   return path46.join(cwd, ".kody-engine", "definitions", "capabilities");
 }
 function loadWorkflowContext(slug, base) {
-  if (!slug || !base.config || !isWorkflowDefinitionId(slug)) return null;
+  if (!slug || !isWorkflowDefinitionId(slug)) return null;
   const workflow = readWorkflowDefinition(base.config, base.cwd, slug);
   return workflow ? workflowDefinitionToCapabilityFolder(slug, workflow) : null;
 }
@@ -22359,6 +22718,8 @@ var init_job = __esm({
     init_capabilityFolders();
     init_executor();
     init_registry();
+    init_runIndex();
+    init_state_backend();
     init_workflowDefinitions();
     init_workflowRunState();
     init_workflowValidation();
@@ -22637,9 +22998,9 @@ var CodexAppServerClient = class {
     await this.request("thread/resume", { threadId });
   }
   async runTurn(args) {
-    await new Promise((resolve17, reject) => {
+    await new Promise((resolve19, reject) => {
       this.process.turnWaiters.set(args.threadId, {
-        resolve: resolve17,
+        resolve: resolve19,
         reject,
         onNotification: args.onNotification,
         queue: Promise.resolve()
@@ -22656,8 +23017,8 @@ var CodexAppServerClient = class {
   }
   request(method, params) {
     const id = this.process.nextId++;
-    return new Promise((resolve17, reject) => {
-      this.process.pending.set(id, { resolve: resolve17, reject });
+    return new Promise((resolve19, reject) => {
+      this.process.pending.set(id, { resolve: resolve19, reject });
       this.process.child.stdin.write(`${JSON.stringify({ method, id, params })}
 `);
     });
@@ -23941,7 +24302,7 @@ function dispatchScheduledWatches(opts) {
   const envWindow = Number(process.env.KODY_SCHEDULE_WINDOW_SEC);
   const windowSec = opts?.windowSec ?? (Number.isFinite(envWindow) && envWindow > 0 ? envWindow : 300);
   const out = [];
-  for (const exe of listImplementations()) {
+  for (const exe of listRuntimeProfilesForCwd(opts?.cwd ?? process.cwd())) {
     let raw;
     try {
       raw = fs16.readFileSync(exe.profilePath, "utf-8");
@@ -24535,8 +24896,14 @@ async function runCi(argv) {
       if (noTarget && capabilityInput) {
         forceRunAction = capabilityInput;
         if (messageInput) {
-          const route = resolveCapabilityAction(capabilityInput);
-          const textInputs = route?.implementation ? (getProfileInputs(route.implementation) ?? []).filter(
+          const route = resolveCapabilityAction(
+            capabilityInput,
+            capabilitiesRoot(cwd)
+          );
+          const textInputs = route?.implementation ? (getProfileInputs(
+            route.implementation,
+            getRuntimeProfileRootsForCwd(cwd)
+          ) ?? []).filter(
             (input) => input.type === "string"
           ) : [];
           if (textInputs.length === 1) {
@@ -24569,7 +24936,7 @@ async function runCi(argv) {
       workflow: forceRunAction,
       cliArgs: {}
     };
-    const scheduledWatchRoute = manualGoalManager || capabilityRoute || workflowRoute ? void 0 : dispatchScheduledWatches({ force: true }).find(
+    const scheduledWatchRoute = manualGoalManager || capabilityRoute || workflowRoute ? void 0 : dispatchScheduledWatches({ force: true, cwd }).find(
       (match) => match.action === forceRunAction || match.capability === forceRunAction || match.implementation === forceRunAction
     );
     const route = manualGoalManager ? {
@@ -24822,7 +25189,10 @@ ${CI_HELP}`);
   }
 }
 async function runScheduledFanOut(cwd, args, opts) {
-  const matches = dispatchScheduledWatches({ force: opts.force });
+  const matches = dispatchScheduledWatches({
+    force: opts.force,
+    cwd
+  });
   if (matches.length === 0) {
     process.stdout.write(
       `\u2192 kody: scheduled wake \u2014 no watches matched ${opts.force ? "(force mode, no watches discovered)" : "(window)"}, exiting cleanly
@@ -25109,17 +25479,17 @@ function authOk(req, expected) {
   return false;
 }
 function readJsonBody(req) {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve19, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve17({});
+        resolve19({});
         return;
       }
       try {
-        resolve17(JSON.parse(raw));
+        resolve19(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -25459,11 +25829,11 @@ async function brainServe(opts) {
     litellmUrl,
     driver
   });
-  await new Promise((resolve17) => {
+  await new Promise((resolve19) => {
     server.listen(port, "0.0.0.0", () => {
       process.stdout.write(`[brain-serve] listening on 0.0.0.0:${port} (cwd=${opts.cwd})
 `);
-      resolve17();
+      resolve19();
     });
   });
   const shutdown = (signal) => {
@@ -25718,14 +26088,14 @@ async function startBrainProxy(opts) {
   const { httpServer, handler } = buildBrainProxy(opts);
   const port = opts.port ?? 0;
   const host = opts.host ?? "127.0.0.1";
-  await new Promise((resolve17) => httpServer.listen(port, host, () => resolve17()));
+  await new Promise((resolve19) => httpServer.listen(port, host, () => resolve19()));
   const addr = httpServer.address();
   return {
     httpServer,
     port: addr.port,
     url: `http://${host}:${addr.port}`,
-    stop: () => new Promise((resolve17) => {
-      httpServer.close(() => resolve17());
+    stop: () => new Promise((resolve19) => {
+      httpServer.close(() => resolve19());
     }),
     handler
   };
@@ -25875,23 +26245,23 @@ function buildMcpHttpServer(opts) {
     httpServer,
     routes,
     port,
-    stop: () => new Promise((resolve17) => {
+    stop: () => new Promise((resolve19) => {
       let pending = transports.size;
       if (pending === 0) {
-        httpServer.close(() => resolve17());
+        httpServer.close(() => resolve19());
         return;
       }
       for (const transport of transports.values()) {
         void transport.close().finally(() => {
           pending--;
-          if (pending === 0) httpServer.close(() => resolve17());
+          if (pending === 0) httpServer.close(() => resolve19());
         });
       }
     })
   };
 }
 function listenMcpHttpServer(server, host = "127.0.0.1") {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve19, reject) => {
     server.httpServer.once("error", reject);
     server.httpServer.listen(server.port, host, () => {
       server.httpServer.off("error", reject);
@@ -25899,7 +26269,7 @@ function listenMcpHttpServer(server, host = "127.0.0.1") {
       if (addr && typeof addr === "object") {
         server.port = addr.port;
       }
-      resolve17();
+      resolve19();
     });
   });
 }
@@ -26049,7 +26419,7 @@ async function waitForNextUserMessage(opts) {
   }
 }
 function sleep3(ms) {
-  return new Promise((resolve17) => setTimeout(resolve17, ms));
+  return new Promise((resolve19) => setTimeout(resolve19, ms));
 }
 function currentBranch(cwd) {
   try {
@@ -26384,10 +26754,10 @@ init_definition_paths();
 
 // src/definition-hydration.ts
 init_state_backend();
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import * as fs50 from "fs";
 import * as path51 from "path";
-var SLUG_RE2 = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+var SLUG_RE2 = /^[a-z0-9][a-z0-9_-]{0,127}$/;
 function assertSafeDefinitionPath(filePath) {
   const segments = filePath.split("/");
   if (!filePath || filePath.startsWith("/") || filePath.includes("\\") || filePath.includes("\0") || segments.some((segment) => !segment || segment === "." || segment === "..")) {
@@ -26405,7 +26775,7 @@ function normalizeDefinitionBundle(bundle) {
   return { schemaVersion: 1, files };
 }
 function definitionVersion(bundle) {
-  return `sha256:${createHash6("sha256").update(JSON.stringify(normalizeDefinitionBundle(bundle))).digest("hex")}`;
+  return `sha256:${createHash8("sha256").update(JSON.stringify(normalizeDefinitionBundle(bundle))).digest("hex")}`;
 }
 function verifyDefinition(definition) {
   if (!SLUG_RE2.test(definition.slug)) throw new Error(`invalid definition slug: ${definition.slug}`);
@@ -26415,6 +26785,13 @@ function verifyDefinition(definition) {
   }
   return bundle;
 }
+function writeBundle(root, bundle) {
+  for (const [filePath, contents] of Object.entries(bundle.files)) {
+    const target = path51.join(root, filePath);
+    fs50.mkdirSync(path51.dirname(target), { recursive: true });
+    fs50.writeFileSync(target, contents, "utf8");
+  }
+}
 function writeDefinition(root, kind, definition) {
   const bundle = verifyDefinition(definition);
   if (kind === "agent") {
@@ -26424,20 +26801,18 @@ function writeDefinition(root, kind, definition) {
     return;
   }
   if (kind === "goal") {
-    const goalRoot = path51.join(root, "goals", definition.slug);
-    for (const [filePath, contents] of Object.entries(bundle.files)) {
-      const target = path51.join(goalRoot, filePath);
-      fs50.mkdirSync(path51.dirname(target), { recursive: true });
-      fs50.writeFileSync(target, contents, "utf8");
-    }
+    writeBundle(path51.join(root, "goals", definition.slug), bundle);
     return;
   }
-  const capabilityRoot = path51.join(root, "capabilities", definition.slug);
-  for (const [filePath, contents] of Object.entries(bundle.files)) {
-    const target = path51.join(capabilityRoot, filePath);
-    fs50.mkdirSync(path51.dirname(target), { recursive: true });
-    fs50.writeFileSync(target, contents, "utf8");
+  if (kind === "implementation") {
+    writeBundle(path51.join(root, "implementations", definition.slug), bundle);
+    return;
   }
+  if (kind === "asset") {
+    writeBundle(path51.join(root, "shared"), bundle);
+    return;
+  }
+  writeBundle(path51.join(root, "capabilities", definition.slug), bundle);
 }
 async function hydrateDefinitions(options) {
   const root = path51.join(options.cwd, ".kody-engine", "definitions");
@@ -26446,11 +26821,15 @@ async function hydrateDefinitions(options) {
   fs50.mkdirSync(path51.join(staging, "agents"), { recursive: true });
   fs50.mkdirSync(path51.join(staging, "capabilities"), { recursive: true });
   fs50.mkdirSync(path51.join(staging, "goals"), { recursive: true });
+  fs50.mkdirSync(path51.join(staging, "implementations"), { recursive: true });
+  fs50.mkdirSync(path51.join(staging, "shared"), { recursive: true });
   try {
-    const [capabilities, agents, goals] = await Promise.all([
+    const [capabilities, agents, goals, implementations, assets] = await Promise.all([
       options.backend.listDefinitions(options.tenantId, "capability"),
       options.backend.listDefinitions(options.tenantId, "agent"),
-      options.backend.listDefinitions(options.tenantId, "goal")
+      options.backend.listDefinitions(options.tenantId, "goal"),
+      options.backend.listDefinitions(options.tenantId, "implementation"),
+      options.backend.listDefinitions(options.tenantId, "asset")
     ]);
     const versions = {};
     for (const definition of capabilities) {
@@ -26465,6 +26844,14 @@ async function hydrateDefinitions(options) {
       writeDefinition(staging, "goal", definition);
       versions[`goal:${definition.slug}`] = definition.version;
     }
+    for (const definition of implementations) {
+      writeDefinition(staging, "implementation", definition);
+      versions[`implementation:${definition.slug}`] = definition.version;
+    }
+    for (const definition of assets) {
+      writeDefinition(staging, "asset", definition);
+      versions[`asset:${definition.slug}`] = definition.version;
+    }
     const manifest = {
       schemaVersion: 1,
       tenantId: options.tenantId,
@@ -27095,14 +27482,14 @@ function sendJson2(res, status, body) {
   res.end(JSON.stringify(body));
 }
 function readJsonBody2(req) {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve19, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
-      if (!raw.trim()) return resolve17({});
+      if (!raw.trim()) return resolve19({});
       try {
-        resolve17(JSON.parse(raw));
+        resolve19(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -27313,10 +27700,10 @@ async function poolServe() {
     }
   });
   const apiHost = process.env.POOL_API_HOST ?? "::";
-  await new Promise((resolve17) => {
+  await new Promise((resolve19) => {
     server.listen(apiPort, apiHost, () => {
       log(`listening on ${apiHost}:${apiPort} (min=${min}, app=${app}, region=${region})`);
-      resolve17();
+      resolve19();
     });
   });
   if (loopTickEnabled) void runLoopTick();
@@ -27356,17 +27743,17 @@ function authOk2(req, expected) {
   return false;
 }
 function readJsonBody3(req) {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve19, reject) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve17({});
+        resolve19({});
         return;
       }
       try {
-        resolve17(JSON.parse(raw));
+        resolve19(JSON.parse(raw));
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -27500,13 +27887,13 @@ async function defaultRunJob(job) {
     ...interactive && job.idleExitMs ? { KODY_IDLE_EXIT_MS: String(job.idleExitMs) } : {},
     ...interactive && job.hardCapMs ? { KODY_HARD_CAP_MS: String(job.hardCapMs) } : {}
   };
-  const run = (cmd, args, cwd) => new Promise((resolve17) => {
+  const run = (cmd, args, cwd) => new Promise((resolve19) => {
     const child = spawn9(cmd, args, { stdio: "inherit", env: childEnv, cwd });
-    child.on("exit", (code) => resolve17(code ?? 0));
+    child.on("exit", (code) => resolve19(code ?? 0));
     child.on("error", (err) => {
       process.stderr.write(`[runner-serve] ${cmd} failed: ${err.message}
 `);
-      resolve17(1);
+      resolve19(1);
     });
   });
   process.stdout.write(`[runner-serve] job ${job.jobId}: cloning ${job.repo}@${branch}
@@ -27582,11 +27969,11 @@ async function runnerServe() {
   const port = Number(process.env.PORT ?? DEFAULT_PORT2);
   const server = buildServer2({ apiKey });
   const host = process.env.RUNNER_HOST ?? "::";
-  await new Promise((resolve17) => {
+  await new Promise((resolve19) => {
     server.listen(port, host, () => {
       process.stdout.write(`[runner-serve] listening on ${host}:${port} (idle, awaiting job)
 `);
-      resolve17();
+      resolve19();
     });
   });
   const shutdown = (signal) => {
@@ -27655,14 +28042,14 @@ async function serve(opts) {
 `);
     const args = ["--dangerously-skip-permissions", "--model", model.model];
     const child = spawn10("claude", args, { stdio: "inherit", env: editorEnv, cwd: opts.cwd });
-    const exitCode = await new Promise((resolve17) => {
-      child.on("exit", (code) => resolve17(code ?? 0));
+    const exitCode = await new Promise((resolve19) => {
+      child.on("exit", (code) => resolve19(code ?? 0));
       child.on("error", (err) => {
         process.stderr.write(`[kody serve] failed to launch Claude Code: ${err.message}
 `);
         process.stderr.write(`  Install: https://docs.anthropic.com/claude/docs/claude-code
 `);
-        resolve17(1);
+        resolve19(1);
       });
     });
     killProxy();