@open-mercato/cli 0.6.7-develop.6814.1.0627c7e9f1 → 0.6.7-develop.6824.1.21fff90682

package/dist/agentic/shared/ai/harness/cases.json

@@ -13586,5 +13586,95 @@
   {"id":"OMH-199","title":"Load a supplier spreadsheet in bulk without a hand-written parser","family":"architecture","mode":"analysis","evaluationKind":"routing","risk":"medium","prompt":"In a freshly scaffolded standalone Open Mercato app, a supplier sends a monthly spreadsheet and back-office staff retype several hundred rows by hand. They want to upload that file themselves and have the rows loaded, with a record of who uploaded what and whether the load succeeded. Decide the smallest safe design against what the installed modules already provide, keep tenant and organization boundaries intact, state the access-control posture for viewing an upload versus running one, and identify the smallest relevant validation. Do not write a bespoke spreadsheet parser or upload endpoint before establishing whether an installed module already owns this capability.","tags":["architecture","module-facts","reuse-installed","bulk-import"],"owner":{"kind":"facts","path":".ai/guides/modules/sync_excel.md","ruleIds":["BC-01","BC-04"]},"expectedRouter":{"required":["architecture"],"allowedExtra":["integration","module-data","framework-context","umes"]},"requiredSkills":["om-integration-builder"],"context":{"required":["AGENTS.md",".ai/guides/architecture.md",".ai/skills/om-integration-builder/SKILL.md",".ai/guides/modules/sync_excel.md"],"allowedExtra":[".ai/guides/integrations.md",".ai/guides/contracts.md",".ai/guides/modules/data_sync.md",".ai/skills/om-help/SKILL.md"],"warn":["node_modules/@open-mercato/*/src/**"],"forbidden":[".env*",".git/**"]},"requiredDecisions":["facts-first","tenant-scope","acl-features","smallest-validation"],"forbiddenPatterns":["node_modules.{0,40}(?:write|edit|patch)","(?:tenant|organization).{0,30}(?:unscoped|scope optional)"],"validators":["catalog.schema","owner.reference","skills.reference","router.contract","context.budget","context.forbidden","patterns.forbidden"],"maxContextFiles":11,"maxInitialContextBytes":57344,"maxTotalContextBytes":147456,"relatedCases":["OMH-002","OMH-195"]},
   {"id":"OMH-200","title":"Charge cards through the installed payment provider rather than a bespoke client","family":"architecture","mode":"analysis","evaluationKind":"routing","risk":"high","prompt":"In a freshly scaffolded standalone Open Mercato app, the business has a Stripe account and wants to start charging cards at checkout this week. Decide the smallest safe design against what the installed modules already provide, say where a payment provider belongs in a standalone app and how it is turned on for this one, state the access-control posture for viewing versus configuring it and how the provider credential is held, keep tenant and organization boundaries intact, and identify the smallest relevant validation. Do not write a bespoke provider client or a new payments module before establishing whether an installed module already owns this capability.","tags":["architecture","module-facts","reuse-installed","payment-provider"],"owner":{"kind":"facts","path":".ai/guides/modules/gateway_stripe.md","ruleIds":["BC-01","BC-04"]},"expectedRouter":{"required":["architecture"],"allowedExtra":["integration","module-data","framework-context","umes"]},"requiredSkills":["om-integration-builder"],"context":{"required":["AGENTS.md",".ai/guides/architecture.md",".ai/skills/om-integration-builder/SKILL.md",".ai/guides/modules/gateway_stripe.md"],"allowedExtra":[".ai/guides/integrations.md",".ai/guides/contracts.md",".ai/guides/modules/payment_gateways.md",".ai/skills/om-help/SKILL.md"],"warn":["node_modules/@open-mercato/*/src/**"],"forbidden":[".env*",".git/**"]},"requiredDecisions":["facts-first","app-module-activation","acl-features","smallest-validation"],"forbiddenPatterns":["node_modules.{0,40}(?:write|edit|patch)","(?:tenant|organization).{0,30}(?:unscoped|scope optional)"],"validators":["catalog.schema","owner.reference","skills.reference","router.contract","context.budget","context.forbidden","patterns.forbidden"],"maxContextFiles":11,"maxInitialContextBytes":57344,"maxTotalContextBytes":147456,"relatedCases":["OMH-002","OMH-195"]},
   {"id":"OMH-201","title":"Pull product data from the PIM the business already runs without a new connector","family":"architecture","mode":"analysis","evaluationKind":"routing","risk":"medium","prompt":"In a freshly scaffolded standalone Open Mercato app, the merchandising team maintains product data in Akeneo and wants it to reach this application on a schedule instead of being copied over by hand. Decide the smallest safe design against what the installed modules already provide, say how that capability is turned on for this application, keep tenant and organization boundaries intact, and identify the smallest relevant validation. Do not design a bespoke connector, mapping layer, or import endpoint before establishing whether an installed module already owns this capability.","tags":["architecture","module-facts","reuse-installed","pim-sync"],"owner":{"kind":"facts","path":".ai/guides/modules/sync_akeneo.md","ruleIds":["BC-01","BC-04"]},"expectedRouter":{"required":["architecture"],"allowedExtra":["integration","module-data","framework-context","umes"]},"requiredSkills":["om-integration-builder"],"context":{"required":["AGENTS.md",".ai/guides/architecture.md",".ai/skills/om-integration-builder/SKILL.md",".ai/guides/modules/sync_akeneo.md"],"allowedExtra":[".ai/guides/integrations.md",".ai/guides/contracts.md",".ai/guides/modules/data_sync.md",".ai/skills/om-help/SKILL.md"],"warn":["node_modules/@open-mercato/*/src/**"],"forbidden":[".env*",".git/**"]},"requiredDecisions":["facts-first","app-module-activation","tenant-scope","smallest-validation"],"forbiddenPatterns":["node_modules.{0,40}(?:write|edit|patch)","(?:tenant|organization).{0,30}(?:unscoped|scope optional)"],"validators":["catalog.schema","owner.reference","skills.reference","router.contract","context.budget","context.forbidden","patterns.forbidden"],"maxContextFiles":11,"maxInitialContextBytes":57344,"maxTotalContextBytes":147456,"relatedCases":["OMH-002","OMH-195"]},
-  {"id":"OMH-202","title":"Keep stock counts per warehouse honest and hold goods for confirmed orders without a new module","family":"architecture","mode":"analysis","evaluationKind":"routing","risk":"medium","prompt":"In a freshly scaffolded standalone Open Mercato app, the operations team keeps stock for two storage sites in a spreadsheet: how much of each product sits in which aisle, how much is already promised to confirmed orders, and what has been received, moved, or counted since the last check. They also want a heads-up when an item drops below the level they consider safe. Decide the smallest safe design against what the installed modules already provide, say how that capability is turned on for this application, keep tenant and organization boundaries intact, state the access-control posture for viewing counts versus adjusting them, and identify the smallest relevant validation. Do not model your own stock, location, or reservation tables before establishing whether an installed module already owns this capability.","tags":["architecture","module-facts","reuse-installed","stock-on-hand"],"owner":{"kind":"facts","path":".ai/guides/modules/wms.md","ruleIds":["BC-01","BC-04"]},"expectedRouter":{"required":["architecture"],"allowedExtra":["module-data","backend-ui","umes","framework-context"]},"requiredSkills":["om-help"],"context":{"required":["AGENTS.md",".ai/guides/architecture.md",".ai/skills/om-help/SKILL.md",".ai/guides/modules/wms.md"],"allowedExtra":[".ai/guides/contracts.md",".ai/guides/modules/catalog.md",".ai/guides/modules/sales.md",".ai/skills/om-data-model-design/SKILL.md"],"warn":["node_modules/@open-mercato/*/src/**"],"forbidden":[".env*",".git/**"]},"requiredDecisions":["facts-first","app-module-activation","tenant-scope","acl-features","smallest-validation"],"forbiddenPatterns":["node_modules.{0,40}(?:write|edit|patch)","(?:tenant|organization).{0,30}(?:unscoped|scope optional)"],"validators":["catalog.schema","owner.reference","skills.reference","router.contract","context.budget","context.forbidden","patterns.forbidden"],"maxContextFiles":11,"maxInitialContextBytes":57344,"maxTotalContextBytes":147456,"relatedCases":["OMH-002","OMH-194"]}
+  {"id":"OMH-202","title":"Keep stock counts per warehouse honest and hold goods for confirmed orders without a new module","family":"architecture","mode":"analysis","evaluationKind":"routing","risk":"medium","prompt":"In a freshly scaffolded standalone Open Mercato app, the operations team keeps stock for two storage sites in a spreadsheet: how much of each product sits in which aisle, how much is already promised to confirmed orders, and what has been received, moved, or counted since the last check. They also want a heads-up when an item drops below the level they consider safe. Decide the smallest safe design against what the installed modules already provide, say how that capability is turned on for this application, keep tenant and organization boundaries intact, state the access-control posture for viewing counts versus adjusting them, and identify the smallest relevant validation. Do not model your own stock, location, or reservation tables before establishing whether an installed module already owns this capability.","tags":["architecture","module-facts","reuse-installed","stock-on-hand"],"owner":{"kind":"facts","path":".ai/guides/modules/wms.md","ruleIds":["BC-01","BC-04"]},"expectedRouter":{"required":["architecture"],"allowedExtra":["module-data","backend-ui","umes","framework-context"]},"requiredSkills":["om-help"],"context":{"required":["AGENTS.md",".ai/guides/architecture.md",".ai/skills/om-help/SKILL.md",".ai/guides/modules/wms.md"],"allowedExtra":[".ai/guides/contracts.md",".ai/guides/modules/catalog.md",".ai/guides/modules/sales.md",".ai/skills/om-data-model-design/SKILL.md"],"warn":["node_modules/@open-mercato/*/src/**"],"forbidden":[".env*",".git/**"]},"requiredDecisions":["facts-first","app-module-activation","tenant-scope","acl-features","smallest-validation"],"forbiddenPatterns":["node_modules.{0,40}(?:write|edit|patch)","(?:tenant|organization).{0,30}(?:unscoped|scope optional)"],"validators":["catalog.schema","owner.reference","skills.reference","router.contract","context.budget","context.forbidden","patterns.forbidden"],"maxContextFiles":11,"maxInitialContextBytes":57344,"maxTotalContextBytes":147456,"relatedCases":["OMH-002","OMH-194"]},
+  {
+    "id": "OMH-203",
+    "title": "Evaluate CRM detail-tab UMES routing",
+    "family": "umes",
+    "mode": "analysis",
+    "evaluationKind": "routing",
+    "risk": "medium",
+    "prompt": "How can I add a tab to the customer page?",
+    "tags": [
+      "umes",
+      "backend-ui",
+      "framework-context"
+    ],
+    "owner": {
+      "kind": "skill",
+      "path": ".ai/skills/om-system-extension/SKILL.md",
+      "ruleIds": [
+        "BC-06"
+      ]
+    },
+    "expectedRouter": {
+      "required": [
+        "umes",
+        "backend-ui",
+        "framework-context"
+      ]
+    },
+    "requiredSkills": [
+      "om-system-extension",
+      "om-backend-ui-design",
+      "om-framework-context"
+    ],
+    "context": {
+      "required": [
+        "AGENTS.md",
+        ".ai/guides/extensions.md",
+        ".ai/guides/backend-ui.md",
+        ".ai/guides/modules/customers.md",
+        ".ai/skills/om-system-extension/SKILL.md",
+        ".ai/skills/om-backend-ui-design/SKILL.md",
+        ".ai/skills/om-framework-context/SKILL.md"
+      ],
+      "allowedExtra": [
+        ".ai/skills/om-system-extension/references/extension-branches.md",
+        ".ai/skills/om-system-extension/references/mechanism-selector.md"
+      ],
+      "forbidden": [
+        ".env*",
+        ".git/**",
+        "node_modules/**"
+      ]
+    },
+    "requiredDecisions": [
+      "extension-mechanism",
+      "additive-before-replacement",
+      "extension-entity",
+      "eject-last",
+      "widget-injection-files",
+      "person-detail-tab-spot",
+      "company-detail-tab-spot",
+      "guidance-before-framework-context",
+      "installed-packages-read-only"
+    ],
+    "forbiddenPatterns": [
+      "node_modules.{0,40}(?:write|edit|patch)",
+      "(?:tenant|organization).{0,30}(?:unscoped|scope optional)"
+    ],
+    "validators": [
+      "catalog.schema",
+      "owner.reference",
+      "skills.reference",
+      "router.contract",
+      "context.budget",
+      "context.forbidden",
+      "patterns.forbidden"
+    ],
+    "frameworkContext": [
+      {
+        "module": "customers",
+        "query": "detail:customers."
+      }
+    ],
+    "maxContextFiles": 10,
+    "maxInitialContextBytes": 57344,
+    "maxTotalContextBytes": 131072,
+    "relatedCases": [
+      "OMH-026",
+      "OMH-027"
+    ]
+  }
 ]

package/dist/agentic/shared/ai/harness/cases.schema.json

@@ -3,8 +3,8 @@
   "$id": "https://open-mercato.dev/schemas/standalone-harness-cases.schema.json",
   "title": "Open Mercato standalone harness case catalog",
   "type": "array",
-  "minItems": 202,
-  "maxItems": 202,
+  "minItems": 203,
+  "maxItems": 203,
   "items": {
     "type": "object",
     "additionalProperties": false,
@@ -15,7 +15,7 @@
       "maxTotalContextBytes", "relatedCases"
     ],
     "properties": {
-      "id": { "type": "string", "pattern": "^OMH-(00[1-9]|0[1-9][0-9]|1[0-9][0-9]|20[0-2])$" },
+      "id": { "type": "string", "pattern": "^OMH-(00[1-9]|0[1-9][0-9]|1[0-9][0-9]|20[0-3])$" },
       "title": { "type": "string", "minLength": 12, "maxLength": 180 },
       "family": { "enum": ["architecture", "module", "umes", "integration", "ai-workflow", "bugfix", "business", "testing"] },
       "mode": { "enum": ["analysis", "one-shot", "spec", "bugfix", "review"] },

package/dist/agentic/shared/ai/harness/validators.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "catalog": {
-    "expectedCaseCount": 202,
+    "expectedCaseCount": 203,
     "maxContextFiles": 16,
     "maxInitialContextBytes": 98304,
     "maxTotalContextBytes": 262144,

package/dist/agentic/shared/ai/skills/om-system-extension/SKILL.md

@@ -13,7 +13,7 @@ Route before reading: choose routes from the request and mechanism selector, the
 
 1. Read `.ai/guides/extensions.md` and `references/mechanism-selector.md`; choose UMES, supported override, package, or eject.
 2. Resolve host entity/route/spot/component/event IDs from generated facts. Invoke `om-framework-context` only when facts omit the needed contract.
-3. Follow the selected branch in `references/extension-branches.md` for enricher, API/command interceptor, guard, widget/menu, extension entity, subscriber, or component replacement. For `entry.overrides`, load `references/unified-overrides.md` and select the exact domain/key.
+3. Follow the matching `references/extension-branches.md` branch. UI widgets live in `src/modules/<id>/widgets/injection/**` and register an exact facts- or context-resolved spot in `src/modules/<id>/widgets/injection-table.ts`. For `entry.overrides`, load `references/unified-overrides.md` and select the exact domain/key.
 4. Invoke `om-data-model-design` only when the extension adds app-owned persistence; an enricher/interceptor/widget-only round trip does not need it.
 5. For editable additions, follow `references/read-write-roundtrip.md`; implement input, authenticated write, stored data, list/detail read, UI hydration, clear-to-null, and conflict behavior. An editable addition that must survive reload is necessarily a persisted field: select `module-data`, read contracts, and invoke `om-data-model-design`.
 6. Run `yarn generate`; verify host-present/absent, authorized/denied/wildcard, cache/search, and failure fallback using `references/verification.md`.

package/dist/agentic/shared/scripts/evaluate-agent-harness.mjs

@@ -518,8 +518,8 @@ function validateCatalog({ root, cases, registry, releaseMatrix, fixtures, seeds
     for (const related of item.relatedCases ?? []) if (!idSet.has(related)) add(id, `dangling related case ${related}`)
     const writable = WRITABLE_KINDS.has(item.evaluationKind)
     if (item.frameworkContext !== undefined) {
-      if (!writable || !Array.isArray(item.frameworkContext) || item.frameworkContext.length === 0 || item.frameworkContext.length > 3) {
-        add(id, 'frameworkContext requires one to three writable-case queries')
+      if (!Array.isArray(item.frameworkContext) || item.frameworkContext.length === 0 || item.frameworkContext.length > 3) {
+        add(id, 'frameworkContext requires one to three queries')
       }
       for (const request of item.frameworkContext ?? []) {
         const selectors = [request?.module, request?.package].filter((value) => value !== undefined)
@@ -1420,7 +1420,16 @@ function prepareCaseFrameworkContext(caseRecord, controllerRoot, runRoot) {
       throw new Error(`framework context queries resolved to the same output root for ${caseRecord.id}: ${outputRoot}`)
     }
     patterns.add(outputPattern)
-    entries.push({ manifest, searchResult, sourceRoot, query: request.query })
+    const sourceFiles = [...new Set(fs.readFileSync(searchPath, 'utf8')
+      .split(/\r?\n/)
+      .flatMap((line) => {
+        const match = /^(.+?):\d+:/.exec(line)
+        return match && isSafeRelative(match[1]) && match[1].startsWith(`${sourceRoot}/`) ? [match[1]] : []
+      }))].sort()
+    if (sourceFiles.length === 0) {
+      throw new Error(`framework context query returned no exact source matches for ${caseRecord.id}: ${request.query}`)
+    }
+    entries.push({ manifest, searchResult, sourceRoot, sourceFiles, query: request.query })
   }
   return { patterns: [...patterns].sort(), entries }
 }
@@ -1515,6 +1524,7 @@ function observedContext(stdout, root, caseRecord, writable, reviewExpectedReads
   for (const event of events) collectRefusedToolCallIds(event, state.refusedCallIds)
   for (const event of events) recursivelyFindTraceCandidates(event, state)
   const paths = new Set()
+  const readOrder = []
   const refusedReads = new Set()
   const metadataPaths = new Set()
   let metadataEntries = 0
@@ -1595,7 +1605,10 @@ function observedContext(stdout, root, caseRecord, writable, reviewExpectedReads
       // Keep it out of instruction/fact budgets and selectedContext accounting while
       // still failing closed above for every non-allowlisted read.
       else if (isAllowedObservedPath(file, caseRecord, writable)) {
-        if (!writable || reviewExpectedReads || permittedContextPath(file, caseRecord)) paths.add(file)
+        if (!writable || reviewExpectedReads || permittedContextPath(file, caseRecord)) {
+          paths.add(file)
+          if (!readOrder.includes(file)) readOrder.push(file)
+        }
       }
       else violations.add(`unsafe arbitrary app-root read ${file}`)
     }
@@ -1610,6 +1623,7 @@ function observedContext(stdout, root, caseRecord, writable, reviewExpectedReads
   return {
     available: state.available,
     paths: [...paths].sort(),
+    readOrder,
     refusedPaths: [...refusedReads].sort(),
     metadataPaths: [...metadataPaths].sort(),
     metadataEntries,
@@ -1666,7 +1680,7 @@ function contextStats(root, paths, metadata = {}) {
   }
 }
 
-function evaluateRouting(caseRecord, response, stats) {
+function evaluateRouting(caseRecord, response, stats, readOrder = []) {
   const failures = []
   const selectedRoutes = new Set(response.selectedRouter)
   for (const required of caseRecord.expectedRouter.required) if (!selectedRoutes.has(required)) failures.push(`missing route ${required}`)
@@ -1709,6 +1723,19 @@ function evaluateRouting(caseRecord, response, stats) {
       failures.push(`observed context not declared ${observed}`)
     }
   }
+  if (caseRecord.materializedFrameworkContextPatterns?.length) {
+    const frameworkReads = readOrder.filter((observed) =>
+      caseRecord.materializedFrameworkContextPatterns.some((pattern) => globToRegExp(pattern).test(observed)))
+    const sourceReads = frameworkReads.filter((observed) => observed.includes('/source/'))
+    if (sourceReads.length === 0) failures.push('framework context source not observed')
+    const firstFrameworkRead = frameworkReads.length ? readOrder.indexOf(frameworkReads[0]) : -1
+    if (firstFrameworkRead >= 0) {
+      for (const required of caseRecord.context.required.filter((reference) => !reference.startsWith('.ai/framework-context/'))) {
+        const guidanceRead = readOrder.findIndex((observed) => globToRegExp(required).test(observed))
+        if (guidanceRead > firstFrameworkRead) failures.push(`framework context read before required guidance ${required}`)
+      }
+    }
+  }
   const standardGuides = new Map()
   for (const [route, standard] of Object.entries(ROUTE_STANDARD_CONTEXT)) {
     for (const guide of standard.guides) {
@@ -1738,7 +1765,7 @@ function evaluateRouting(caseRecord, response, stats) {
 }
 
 function isCorrectableRoutingFailure(violation) {
-  return /^(?:missing (?:route|skill|context|decision)|unexpected (?:route|skill|context|decision)|unmandated decision|selected skill context (?:missing|not observed)|optional skill .+ requires route|standard (?:skill|context) .+ requires route|required context not observed|selected context not observed|observed context not declared|initial context (?:file|byte) budget exceeded|context byte budget exceeded)/.test(violation)
+  return /^(?:missing (?:route|skill|context|decision)|unexpected (?:route|skill|context|decision)|unmandated decision|selected skill context (?:missing|not observed)|optional skill .+ requires route|standard (?:skill|context) .+ requires route|required context not observed|selected context not observed|observed context not declared|framework context (?:source not observed|read before required guidance)|initial context (?:file|byte) budget exceeded|context byte budget exceeded)/.test(violation)
 }
 
 function isCorrectableTraceStartupFailure(violation) {
@@ -1800,7 +1827,7 @@ function buildPrompt(caseRecord, root, writable, frameworkContextEntries = []) {
     ? 'This is an explicitly disposable writable evaluation. You must implement the complete request with repeated use of the allowlisted harness write tool before returning the routing object, then re-read the completed implementation. A manifest of intended files, metadata-only stub, TODO, placeholder, or response that only plans/routes fails: create every requested source, API, command, UI, registration, locale, migration snapshot, and focused test surface inside the write allowlist. You may read allowlisted target source files as implementation inputs, but selectedContext records only instruction/fact paths and must never include those target source paths. Write only inside the allowlist provided after the task; do not use network access or inspect environment values.'
     : 'Work read-only: do not edit files, run mutations, use network access, or inspect environment values. Do not implement the request. Accept the task premise for routing; fixture and implementation-target paths may be absent in this controller, so do not inspect them or report their absence as a blocker.'
   const frameworkContextInstruction = frameworkContextEntries.length
-    ? ` The controller has already materialized bounded read-only installed-package evidence for this case. Read each exact manifest and search result first, then read only exact source paths named by those search results beneath the supplied source root: ${frameworkContextEntries.map((entry) => `manifest=${entry.manifest}; search=${entry.searchResult}; source=${entry.sourceRoot}; query=${JSON.stringify(entry.query)}`).join(' | ')}. You may also follow an exact installed-source link from a generated module fact when it is useful; never enumerate node_modules or read outside @open-mercato package src trees. These successful reads belong in selectedContext.`
+    ? ` The controller has already materialized bounded read-only installed-package evidence for this case. Read every required routed guide and skill before this evidence, then read each exact manifest and search result and every exact source path named by those search results beneath the supplied source root: ${frameworkContextEntries.map((entry) => `manifest=${entry.manifest}; search=${entry.searchResult}; source=${entry.sourceRoot}; query=${JSON.stringify(entry.query)}`).join(' | ')}. You may also follow an exact installed-source link from a generated module fact when it is useful; never enumerate node_modules or read outside @open-mercato package src trees. These successful reads belong in selectedContext.`
     : ''
   const toolInstruction = `The only MCP server is harness. Its exact-path tool is named read and takes JSON arguments {"path":"<exact app-relative path>"}${writable ? '; its allowlisted replacement tool is named write and takes {"path":"<exact app-relative path>","content":"<complete file>"}' : ''}. Call harness.read${writable ? ' or harness.write' : ''}; never call read_mcp_resource or any resource API.`
   return `You are evaluating routing for a standalone Open Mercato application. ${modeInstruction}${frameworkContextInstruction} ${toolInstruction} No shell, process, environment, discovery, or network tool exists. Your first tool action must call harness.read with {"path":"AGENTS.md"}, even when the runner auto-injected it, then load only the smallest task-matching context. Do not execute framework-context, generation, test, package, release, installer, or skill workflow commands during routing; select the instructions that would govern that later execution. Do not emit a provisional structured response. Do not inspect .ai/harness/**; those are evaluator internals, and decision labels never name readable paths. Never enumerate, glob, recursively search, or bulk-read .ai/guides, .ai/skills, .agents/skills, or module fact directories; an all-guides/all-skills/all-facts read is an automatic failure. The emitted AGENTS.md and the context it routes are the only task-routing authority. Before the final response, open every instruction or fact path you will put in selectedContext with direct harness read calls. Never rely only on skill descriptions, filenames, discovery, metadata, or prior knowledge: an unobserved selected path automatically fails this evaluation.
@@ -2705,9 +2732,7 @@ function liveRun({ options, selected, registry, releaseMatrix, fixtures, root, h
         const targetErrors = verifyWritableTarget(runRoot, root, caseRecord, fixtures)
         if (targetErrors.length) throw new Error(`${caseRecord.id}: ${targetErrors.join('; ')}`)
       }
-      const preparedFrameworkContext = writable
-        ? prepareCaseFrameworkContext(caseRecord, root, runRoot)
-        : { patterns: [], entries: [] }
+      const preparedFrameworkContext = prepareCaseFrameworkContext(caseRecord, root, runRoot)
       const evaluationCase = preparedFrameworkContext.patterns.length
         ? {
             ...caseRecord,
@@ -2715,7 +2740,7 @@ function liveRun({ options, selected, registry, releaseMatrix, fixtures, root, h
               ...caseRecord.context,
               required: [
                 ...caseRecord.context.required,
-                ...preparedFrameworkContext.entries.flatMap(({ manifest, searchResult }) => [manifest, searchResult]),
+                ...preparedFrameworkContext.entries.flatMap(({ manifest, searchResult, sourceFiles }) => [manifest, searchResult, ...sourceFiles]),
               ],
             },
             materializedFrameworkContextPatterns: preparedFrameworkContext.patterns,
@@ -2771,7 +2796,7 @@ function liveRun({ options, selected, registry, releaseMatrix, fixtures, root, h
           const declared = response.selectedContext
             .filter((entry) => isSafeRelative(entry) && isPathInside(runRoot, path.resolve(runRoot, entry)) && fs.existsSync(path.resolve(runRoot, entry)))
           declaredStats = contextStats(runRoot, [...new Set(declared)].sort())
-          violations.push(...evaluateRouting(evaluationCase, response, stats))
+          violations.push(...evaluateRouting(evaluationCase, response, stats, trace.readOrder))
         } else violations.push(`${attempt.kind}: ${sanitize(attempt.error, runRoot)}`)
         return { response, trace, stats, declaredStats, violations }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.6.7-develop.6814.1.0627c7e9f1",
+  "version": "0.6.7-develop.6824.1.21fff90682",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,8 +60,8 @@
     "@mikro-orm/decorators": "^7.1.8",
     "@mikro-orm/migrations": "^7.1.8",
     "@mikro-orm/postgresql": "^7.1.8",
-    "@open-mercato/queue": "0.6.7-develop.6814.1.0627c7e9f1",
-    "@open-mercato/shared": "0.6.7-develop.6814.1.0627c7e9f1",
+    "@open-mercato/queue": "0.6.7-develop.6824.1.21fff90682",
+    "@open-mercato/shared": "0.6.7-develop.6824.1.21fff90682",
     "cross-spawn": "^7.0.6",
     "pg": "8.22.0",
     "semver": "^7.8.5",
@@ -72,10 +72,10 @@
     "typescript-js": "npm:typescript@6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.7-develop.6814.1.0627c7e9f1"
+    "@open-mercato/shared": "0.6.7-develop.6824.1.21fff90682"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.7-develop.6814.1.0627c7e9f1",
+    "@open-mercato/shared": "0.6.7-develop.6824.1.21fff90682",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12"