@opengsd/gsd-core 1.8.0 → 1.9.0

package/pi/gsd.cjs

@@ -197,10 +197,35 @@ function buildBeforeProviderRequestHandler({ tier = 'sonnet' } = {}) {
   return async function onBeforeProviderRequest(event, ctx) {
     try {
       const effectiveCwd = (ctx && ctx.cwd) || process.cwd();
-      const { resolveTierEntry } = require(path.join(GSD_CORE, 'bin', 'lib', 'model-resolver.cjs'));
       const { loadConfig } = require(path.join(GSD_CORE, 'bin', 'lib', 'config-loader.cjs'));
       const config = loadConfig(effectiveCwd);
       const overrides = (config && config.model_profile_overrides) || undefined;
+
+      // #2460: FAIL-OPEN when the user has not explicitly configured
+      // model_profile_overrides[runtime][tier]. pi is provider-agnostic
+      // (kimi-coding, zai, openrouter, openai-codex, minimax, anthropic, …);
+      // the built-in RUNTIME_PROFILE_MAP.pi.sonnet default is `claude-sonnet-5`,
+      // an Anthropic-ecosystem assumption that is wrong for every non-Anthropic
+      // provider. Returning the built-in default unconditionally rewrote every
+      // outgoing request to a model the active provider did not know.
+      //
+      // resolveTierEntry falls back to the built-in catalog when no override is
+      // present, so we cannot call it to detect "did the user opt in?" — we
+      // inspect the override map directly. Only when the user has explicitly
+      // set model_profile_overrides[runtime][tier] do we steer; otherwise we
+      // return undefined and pi's chosen model flows through untouched.
+      const userRaw = overrides && overrides.pi ? overrides.pi[tier] : undefined;
+      // `''` is treated the same as null/undefined: an explicit empty-string
+      // override is the user clearing a previously-set value, NOT opting in to
+      // steering. Without this guard, `resolveTierEntry`'s falsy `if (userRaw)`
+      // check would silently fall back to the built-in catalog and rewrite
+      // payload.model to claude-sonnet-5 — re-introducing the exact bug this
+      // handler exists to prevent.
+      if (userRaw === undefined || userRaw === null || userRaw === '') {
+        return undefined; // fail-open — leave pi's model untouched
+      }
+
+      const { resolveTierEntry } = require(path.join(GSD_CORE, 'bin', 'lib', 'model-resolver.cjs'));
       const entry = resolveTierEntry({ runtime: 'pi', tier, overrides });
       const modelId = entry && typeof entry.model === 'string' && entry.model.length > 0 ? entry.model : null;
       if (!modelId) return undefined; // fail-open — leave pi's model untouched

package/scripts/check-coverage-gate.cjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const summaryPath = path.join(process.cwd(), 'coverage', 'coverage-summary.json');
+if (!fs.existsSync(summaryPath)) {
+  console.error('check-coverage-gate: coverage/coverage-summary.json not found.');
+  console.error('Ensure c8 runs with --reporter json-summary before this script.');
+  process.exitCode = 1;
+  return;
+}
+
+const summary = JSON.parse(fs.readFileSync(summaryPath, 'utf8'));
+const errors = [];
+
+const OVERALL_LINES = 70;
+const OVERALL_BRANCHES = 60;
+const PER_FILE_BRANCHES = 70;
+const PER_FILE_FILES = [
+  'gsd-core/bin/lib/state.cjs',
+  'gsd-core/bin/lib/phase.cjs',
+  'gsd-core/bin/lib/verify.cjs',
+  'gsd-core/bin/lib/init.cjs',
+];
+
+const overall = summary.total;
+if (overall.lines.pct < OVERALL_LINES) {
+  errors.push(`Overall lines ${overall.lines.pct}% < ${OVERALL_LINES}%`);
+}
+if (overall.branches.pct < OVERALL_BRANCHES) {
+  errors.push(`Overall branches ${overall.branches.pct}% < ${OVERALL_BRANCHES}%`);
+}
+
+for (const file of PER_FILE_FILES) {
+  const key = Object.keys(summary).find((k) => k.endsWith(file));
+  if (!key) {
+    errors.push(`${file}: not found in coverage summary`);
+    continue;
+  }
+  const pct = summary[key].branches.pct;
+  if (pct < PER_FILE_BRANCHES) {
+    errors.push(`${file}: branches ${pct}% < ${PER_FILE_BRANCHES}%`);
+  }
+}
+
+if (errors.length > 0) {
+  for (const e of errors) console.error(`ERROR: ${e}`);
+  process.exitCode = 1;
+}

package/scripts/check-glossary-refs.cjs

@@ -64,6 +64,29 @@ const TRACKED_PREFIXES = [
 /** The only bare (no-prefix-match) tokens this gate checks by exact name. */
 const TRACKED_EXACT = new Set(['bin/install.js', 'package.json']);
 
+/**
+ * Paths CONTEXT.md documents whose ABSENCE is the healthy steady state (#2778).
+ *
+ * `TRACKED_PREFIXES` skips claims this gate *cannot* check. This is the narrower
+ * third case: a claim it must not check, because "does not exist" is the correct
+ * state rather than drift.
+ *
+ * `tests/emitted-drift-ack.json` is the acknowledgment file from ADR-2719 §3. Its
+ * whole design property is that it appears in the changed-files list ONLY when
+ * something rippled unexpectedly — "touching it IS the alarm". A permanently
+ * committed copy would signal nothing, which is exactly why the ADR rejected
+ * shipping an empty stub. So the file is absent on a healthy `next` and present
+ * only inside a PR that needs it, and asserting either way is wrong.
+ *
+ * Until #2778 this passed only by accident: CONTEXT.md's `RULESET.` entries are
+ * themselves backtick-wrapped and contain backticks, so the sequential pairing in
+ * `extractTrackedRefs` happened to leave this token outside a code span. Any edit
+ * that shifted the parity — such as #2778's own — exposed it. A gate that passes
+ * by luck is not passing; naming the exemption makes the intent explicit and
+ * survives the next edit.
+ */
+const INTENTIONALLY_ABSENT = new Set(['tests/emitted-drift-ack.json']);
+
 /**
  * Shape a backticked token must have to even be considered a path candidate:
  * one or more `/`-separated segments of word/dot/dash characters, with an
@@ -75,6 +98,7 @@ const PATH_TOKEN_RE = /^[\w.-]+(?:\/[\w.-]+)*(?::\d+)?$/;
 
 /** Whether `token` (line-suffix already stripped) is one this gate checks. */
 function isTracked(token) {
+  if (INTENTIONALLY_ABSENT.has(token)) return false;
   return TRACKED_EXACT.has(token) || TRACKED_PREFIXES.some((prefix) => token.startsWith(prefix));
 }
 

package/scripts/ci-test-scope.cjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 
+const path = require('path');
 const { execFileSync } = require('child_process');
 const { existsSync, readdirSync, appendFileSync } = require('fs');
 
@@ -105,9 +106,8 @@ const RULES = [
     fullMatrix: true,
     tests: [
       'tests/check-env.test.cjs',
-      'tests/npm-integrity-gate.test.cjs',
+      'tests/npm-integrity-gate.test.cjs', // #2758: absorbs the former tests/bug-3588-npm-audit-clean.test.cjs (folded into it by consolidation epic #1969 B6 #1975; the stale filename here was a silent coverage hole this rule never actually re-selected)
       'tests/package-manifest.test.cjs',
-      'tests/bug-3588-npm-audit-clean.test.cjs',
     ],
   },
   {
@@ -116,9 +116,9 @@ const RULES = [
     // still trigger the migrated module's tests (otherwise CI silently skips them).
     match: path => path.startsWith('src/') || path === 'tsconfig.build.json',
     tests: [
-      'tests/semver-compare.test.cjs',
-      'tests/bug-10-semver-policy-consolidation.test.cjs',
-      'tests/golden-install-parity.test.cjs', // any src/installer change can alter emitted install artifacts → re-verify golden install parity (drift guard)
+      'tests/semver-compare.test.cjs', // #2758: absorbs the former tests/bug-10-semver-policy-consolidation.test.cjs (folded into it by consolidation epic #1969 B3 #1972; the stale filename here was a silent coverage hole this rule never actually re-selected)
+      'tests/emitted-provenance.test.cjs', // any src/installer change can alter emitted install artifacts → re-verify provenance totality (#2724: golden-install-parity retired, this is the sole gate)
+      'tests/emitted-attribution.test.cjs',
     ],
   },
   {
@@ -142,19 +142,23 @@ const RULES = [
       // SCOPED_LANE_EXCLUDE guard below, which also drops it when it is itself a
       // changed test file.
       'tests/runtime-artifact-layout.test.cjs',
-      'tests/golden-install-parity.test.cjs', // any src/installer change can alter emitted install artifacts → re-verify golden install parity (drift guard)
+      'tests/emitted-provenance.test.cjs', // any src/installer change can alter emitted install artifacts → re-verify provenance totality (#2724: golden-install-parity retired, this is the sole gate)
+      'tests/emitted-attribution.test.cjs',
     ],
   },
   {
-    name: 'shipped install content (golden-parity drift guard, #2267)',
+    name: 'shipped install content (emitted-attribution drift guard, #2267/#2724)',
     // Every source file the installer EMITS into a runtime layout is captured by
-    // golden-install-parity + the install-tree snapshot. A source edit here that
-    // changes emitted output MUST re-verify the fixtures — otherwise stale golden
-    // fixtures merge silently (#2266: a hooks/gsd-statusline.js edit changed
-    // installed output but no rule selected golden-parity, so stale fixtures
-    // shipped to next undetected). Union semantics: this ADDS the parity guard on
-    // top of each path's existing content-specific tests. Targeted lane only (the
-    // golden test skips win32 by design), no fullMatrix.
+    // the emitted-attribution differential + the install-tree snapshot. A source
+    // edit here that changes emitted output MUST re-verify (#2266: a
+    // hooks/gsd-statusline.js edit changed installed output but no rule selected
+    // the drift guard, so a stale emitted state shipped to next undetected).
+    // Union semantics: this ADDS the drift guard on top of each path's existing
+    // content-specific tests. Targeted lane only (the real-tree test skips win32
+    // by design), no fullMatrix.
+    // #2724: golden-install-parity.test.cjs is retired (ADR-2719 Phase 4); the
+    // emitted differential (ADR-2719 Phase 2/3) is now the sole gate for a PR
+    // editing only shipped content, the archetypal emitted-ripple case.
     // NOTE: intentionally NOT a blanket 'gsd-core/' prefix, for two reasons:
     // (1) gsd-core/bin/** is tsc-compiled runtime output — EXCLUDED_PREFIXES-
     //     excluded from both manifests, and already covered by the 'installer and
@@ -172,8 +176,9 @@ const RULES = [
       (path.startsWith('gsd-core/bin/shared/') && path.endsWith('.json')) ||
       ['scripts/fix-slash-commands.cjs', 'scripts/gen-capability-registry.cjs', 'scripts/gen-loop-host-contract.cjs'].includes(path),
     tests: [
-      'tests/golden-install-parity.test.cjs',
       'tests/golden-install-tree.test.cjs',
+      'tests/emitted-provenance.test.cjs',
+      'tests/emitted-attribution.test.cjs',
     ],
   },
   {
@@ -236,7 +241,13 @@ const RULES = [
       'tests/workflow-size-budget.test.cjs',
       'tests/workflow-guard-registration.test.cjs',
       'tests/commands.test.cjs',
-      'tests/bug-3683-workflow-colon-namespace-leak.test.cjs',
+      // #2758: was 'tests/bug-3683-workflow-colon-namespace-leak.test.cjs', deleted by
+      // consolidation epic #1969 (B6 #1975) and folded into slash-command-namespace.test.cjs
+      // ("folded:bug-3683-workflow-colon-namespace-leak" describe block). The stale filename
+      // here was itself an instance of this issue's defect class — silently dropped by
+      // existingTests() below, so gsd-core/workflows/ changes stopped re-running this
+      // regression's coverage with nothing signaling it.
+      'tests/slash-command-namespace.test.cjs',
     ],
   },
   {
@@ -291,6 +302,41 @@ const RULES = [
   },
  ];
 
+/**
+ * Every RULES[].tests entry (deduped, across every rule) that does NOT exist on
+ * disk. #2758: a rule naming a test file that no longer exists is not merely
+ * inert — existingTests() below silently drops it out of targeted_tests, with
+ * nothing in the CI output signaling why. Phase 4 (#2724) deletes
+ * tests/golden-install-parity.test.cjs; without this check, any rule still
+ * naming it would stop selecting the guard entirely and CI would stay green
+ * throughout. Pure and independent of which rule / which file: it catches ANY
+ * phantom entry, not only the two names this issue is about.
+ * Paths resolve relative to the repo root (this file's parent directory), not
+ * the caller's cwd, so the check behaves identically whether invoked as the CLI
+ * (`node scripts/ci-test-scope.cjs ...`, cwd == repo root by convention) or
+ * required directly by a test.
+ */
+function missingRuleTestFiles(rules) {
+  const referenced = new Set();
+  for (const rule of rules) {
+    for (const f of rule.tests) referenced.add(f);
+  }
+  return [...referenced].filter(f => !existsSync(path.join(__dirname, '..', f))).sort();
+}
+
+// Fail loudly at module load, mirroring the PROTECTED_WORKFLOWS check above —
+// this fires on EVERY invocation of the CLI (including the real `changes` job
+// in .github/workflows/test.yml), not only when a test suite happens to run.
+{
+  const missing = missingRuleTestFiles(RULES);
+  if (missing.length > 0) {
+    throw new Error(
+      `ci-test-scope: RULES reference test file(s) that do not exist on disk ` +
+      `(silent coverage hole — see #2758):\n  ${missing.join('\n  ')}`,
+    );
+  }
+}
+
 function usage() {
   return [
     'Usage:',
@@ -523,4 +569,8 @@ function main() {
   }
 }
 
-runMain(main);
+if (require.main === module) {
+  runMain(main);
+}
+
+module.exports = { RULES, missingRuleTestFiles };

package/scripts/gen-adr-index.cjs

@@ -347,10 +347,12 @@ function validate({ adrs, byFile, byId, nonConforming }) {
   //
   // Only a RATIFIED (Accepted) claimant is owed the back-link. A Proposed ADR's
   // supersession claim is prospective — it has not taken effect, so stamping its
-  // target as superseded would assert something untrue (ADR-857 is Proposed and
-  // claims to generalize ADR-0011/ADR-58, both of which are Accepted and live).
-  // When such an ADR is ratified to Accepted, this check starts demanding the
-  // back-links at exactly the right moment.
+  // target as superseded would assert something untrue. When such an ADR is
+  // ratified to Accepted, this check starts demanding the back-links at exactly
+  // the right moment — as ADR-857 shows: it was Proposed when this guard was
+  // written, was ratified to Accepted on 2026-07-17 (its claim over ADR-0011 /
+  // ADR-58 restated as "Subsumes", since both remain Accepted and live), and
+  // both targets now carry the reciprocal "Subsumed by" back-link this demands.
   const OPPOSITE = { out: 'in', in: 'out' };
   for (const a of adrs) {
     for (const kind of Object.keys(RELATION_SPEC)) {

package/scripts/gen-capability-matrix.cjs

@@ -114,8 +114,15 @@ function buildMatrix(registry) {
   const extByCap = extensionsByCapability(registry);
   const featureTable = renderTable(caps, 'feature', extByCap);
   const runtimeTable = renderTable(caps, 'runtime', extByCap);
+  // ADR-2782 D3 added a third role. Rendering only feature+runtime silently
+  // DROPPED every role:"reviewer" capability from the catalogue — and because
+  // `--check` compares generated output against the committed file, both omitted
+  // them identically, so the drift guard reported "up to date" while five shipped
+  // capabilities were invisible. A guard blind to a whole role is not guarding.
+  const reviewerTable = renderTable(caps, 'reviewer', extByCap);
   const featureCount = caps.filter((c) => c.role === 'feature').length;
   const runtimeCount = caps.filter((c) => c.role === 'runtime').length;
+  const reviewerCount = caps.filter((c) => c.role === 'reviewer').length;
 
   return `# Capability matrix reference
 
@@ -138,7 +145,7 @@ See also: [ADR-1244](../adr/1244-capability-ecosystem.md) —
 | Column | Description |
 |---|---|
 | **id** | Canonical capability identifier; unique across first- and third-party capabilities. Reserved prefixes: \`gsd-\`, \`gsd-core-\`, \`anthropic-\`. |
-| **role** | \`feature\` — extends what the loop does; \`runtime\` — adapts GSD to a specific AI runtime/IDE. |
+| **role** | \`feature\` — extends what the loop does; \`runtime\` — adapts GSD to a specific AI runtime/IDE; \`reviewer\` — declares a cross-AI reviewer lane (ADR-2782). A capability may be both a runtime and a reviewer. |
 | **tier** | \`core\` — always active; \`standard\` — active when the runtime supports it; \`full\` — opt-in or runtime-specific. |
 | **engines.gsd** | Semver RANGE expressing host-version compatibility. A hard gate at install and at load. \`—\` means the capability declares no range. |
 | **extension points** | The loop points this capability registers hooks into (from the registry's \`byLoopPoint\` index). \`—\` means it registers none (typical for runtime capabilities, whose job is surface emission). |
@@ -180,6 +187,23 @@ emission), so their extension-point and hook-kind cells are \`—\`.
 
 ${runtimeTable}
 
+### Reviewer capabilities (role: reviewer) — ${reviewerCount}
+
+Reviewer capabilities declare a cross-AI **reviewer lane** — one external CLI or
+model endpoint \`/gsd:review\` hands a plan to (ADR-2782 D3). They are not install
+targets: they emit no skills, agents, hooks or surface files, so their
+extension-point and hook-kind cells are \`—\`. A host that is *also* a reviewer
+(Claude, Codex, Cursor, OpenCode, Qwen, Antigravity) keeps one manifest and
+appears under **runtime** above, carrying its lane alongside its runtime body;
+only lanes that GSD never installs into appear here.
+
+Because a lane receives the plan text, requirements, research findings and
+\`CONTEXT.md\` decisions, it is a disclosed executable surface and is consent-gated
+at install like any other — see
+[the trust model](../explanation/capability-trust-model.md).
+
+${reviewerTable}
+
 ---
 
 ## Third-party capabilities
@@ -199,7 +223,7 @@ fields described below, with \`source\` = \`third-party\`.
 | Column | Value |
 |---|---|
 | **id** | As declared in \`capability.json\`. Must not use reserved prefixes (\`gsd-\`, \`gsd-core-\`, \`anthropic-\`). |
-| **role** | \`feature\` or \`runtime\`, as declared. |
+| **role** | \`feature\`, \`runtime\`, or \`reviewer\`, as declared. |
 | **tier** | \`core\`, \`standard\`, or \`full\`, as declared. |
 | **engines.gsd** | Range from \`capability.json\`; verified at install and at each load. |
 | **extension points** | The loop points the capability registers into, validated against the known 12 identifiers. |

package/scripts/gen-capability-registry.cjs

@@ -71,6 +71,7 @@ const {
   validateArtifactKindEntry,
   validateArtifactLayout,
   validateRuntimeBody,
+  collectReviewerWarnings,
   materializeHookFragments,
   validateAgainstContract,
   validateConsumesGlobal,
@@ -128,6 +129,71 @@ function loadCentralConfigKeys(schemaPath = CONFIG_SCHEMA_PATH) {
   return new Set(Array.isArray(manifest.validKeys) ? manifest.validKeys : []);
 }
 
+/**
+ * Loads the central config-schema's DYNAMIC key patterns (#2797).
+ *
+ * `loadCentralConfigKeys` above reads `validKeys` only, so a federated key
+ * claimed by a central *pattern* was invisible to the exclusivity check. That is
+ * not a cosmetic gap: `isCentralConfigKey` consults these same patterns, and
+ * `mergeFederatedConfig` skips every key for which it returns true — so an
+ * overlapping slice is inert while the build stays green.
+ *
+ * The patterns are read from the SAME manifest the runtime reads and compiled
+ * with the same `source`, rather than re-implementing a matcher here, so the two
+ * cannot drift.
+ *
+ * Failure contract MATCHES `loadCentralConfigKeys` above deliberately — the two
+ * read the same file and must not disagree about what a broken one means:
+ *   - ENOENT → empty list. Legitimately absent.
+ *   - Any other read error, or a JSON parse error → prominent stderr + throw.
+ *
+ * An earlier revision swallowed the parse error and returned []. That is
+ * fail-OPEN on the gate this function exists to feed: with zero patterns,
+ * `validateCrossCapability`'s pattern-collision check silently passes and an
+ * inert federated slice ships green. It was masked in the one production call
+ * site only because `loadCentralConfigKeys` runs first against the same path and
+ * throws — a coincidence of ordering, not a guarantee, and this function is
+ * exported and called standalone.
+ *
+ * A single unparseable PATTERN is still skipped rather than fatal: that is a
+ * per-entry defect the central schema's own tests own, and skipping one pattern
+ * degrades to "checked less" rather than blocking every build.
+ */
+function loadCentralConfigPatterns(schemaPath = CONFIG_SCHEMA_PATH) {
+  let raw;
+  try {
+    raw = fs.readFileSync(schemaPath, 'utf8');
+  } catch (err) {
+    if (err && err.code === 'ENOENT') return [];
+    process.stderr.write(
+      '  ERROR  Failed to read config-schema manifest at ' + schemaPath + ': ' + err.message + '\n',
+    );
+    throw new ExitError(1, 'could not read config-schema manifest');
+  }
+
+  let manifest;
+  try {
+    manifest = JSON.parse(raw);
+  } catch (err) {
+    process.stderr.write(
+      '  ERROR  Config-schema manifest at ' + schemaPath + ' is broken (JSON parse error): ' + err.message + '\n',
+    );
+    throw new ExitError(1, 'config-schema manifest JSON is malformed');
+  }
+  const declared = Array.isArray(manifest.dynamicKeyPatterns) ? manifest.dynamicKeyPatterns : [];
+  const out = [];
+  for (const entry of declared) {
+    const src = entry && typeof entry.source === 'string' ? entry.source : null;
+    if (!src) continue;
+    try {
+      out.push(new RegExp(src));
+    } catch {
+      // Unparseable pattern — the central schema's own tests own that failure.
+    }
+  }
+  return out;
+}
+
 // ─── ADR-857 Phase 4a: Derived views ─────────────────────────────────────────
 
 // (Config-slice validation, per-capability validators, contract validators,
@@ -335,14 +401,21 @@ function runConsistencyGate(capabilityClusters, profileMembership, capMap) {
  *   (used during 3a-impl while migration is in-progress).
  * @param {string} [capabilitiesDir]    Override capabilities dir (for testing with fixtures).
  */
-function loadAndValidate(centralKeys, capabilitiesDir) {
+function loadAndValidate(centralKeys, capabilitiesDir, centralPatterns) {
   const resolvedCentralKeys = centralKeys !== undefined ? centralKeys : loadCentralConfigKeys();
+  // #2797: patterns default to the real manifest unless a caller passes its own
+  // (tests pass [] to isolate the exact-key path).
+  const resolvedCentralPatterns = centralPatterns !== undefined ? centralPatterns : loadCentralConfigPatterns();
   const resolvedCapDir = capabilitiesDir !== undefined ? capabilitiesDir : CAPABILITIES_DIR;
   const errors = [];
   const capMap = new Map();
+  // ADR-2782 D4 — non-fatal diagnostics (e.g. an unknown field inside a reviewer
+  // body). These NEVER fail the build; they surface on stderr so a forward-built
+  // manifest degrades visibly instead of silently.
+  const warnings = [];
 
   if (!fs.existsSync(resolvedCapDir)) {
-    return { capMap, errors };
+    return { capMap, errors, warnings };
   }
 
   // Compute wired points ONCE before iterating capabilities so the filesystem
@@ -366,6 +439,10 @@ function loadAndValidate(centralKeys, capabilitiesDir) {
       continue;
     }
 
+    // Collected BEFORE the error short-circuit below so a manifest that is both
+    // forward-built and invalid still reports why it looked unfamiliar.
+    for (const w of collectReviewerWarnings(cap)) warnings.push(folderId + '/capability.json: ' + w);
+
     const capErrors = validateCapability(cap, folderId);
     if (capErrors.length > 0) {
       for (const e of capErrors) errors.push(folderId + '/capability.json: ' + e);
@@ -397,7 +474,7 @@ function loadAndValidate(centralKeys, capabilitiesDir) {
   }
 
   // Cross-capability invariants — capMap contains only fully-valid capabilities at this point.
-  const crossErrors = validateCrossCapability(capMap, resolvedCentralKeys);
+  const crossErrors = validateCrossCapability(capMap, resolvedCentralKeys, resolvedCentralPatterns);
   errors.push(...crossErrors);
 
   // C2: Global consumes-satisfiability — runs after capMap is fully built so cross-capability
@@ -406,7 +483,7 @@ function loadAndValidate(centralKeys, capabilitiesDir) {
   const consumesErrors = validateConsumesGlobal(capMap);
   errors.push(...consumesErrors);
 
-  return { capMap, errors };
+  return { capMap, errors, warnings };
 }
 
 /**
@@ -446,6 +523,46 @@ function buildRegistry(capMap) {
     if (capId === '__proto__' || capId === 'constructor' || capId === 'prototype') continue;
     capabilities[capId] = cap;
 
+    // Federated config slice — harvested from ANY role that declares one.
+    //
+    // ADR-2782 D1/D9: this loop was nested inside the `role === 'feature'` branch,
+    // so a `role: "runtime"` capability's `config` was read by nothing and dropped
+    // in silence — the actual reason reviewer config keys are stranded in the
+    // central schema. (The often-cited reason, that the runtime body forbids
+    // feature-only fields, does not apply: `config` is NOT in
+    // FEATURE_FIELDS_FORBIDDEN_ON_RUNTIME.) Owning a config slice is a property of
+    // DECLARING one, not of being a feature. Verified inert at introduction — no
+    // shipped capability declares `config` on a non-feature role — so this changes
+    // no existing key; it stops a latent silent drop and unblocks Phase 4 (#2797).
+    for (const key of Object.keys(cap.config || {})) {
+      // S2b: inline literal guard at each write site (CodeQL barrier)
+      if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue;
+      configKeys[key] = capId;
+
+      // Build configSchema entry — validate the slice first (throw on violation)
+      const slice = (cap.config || {})[key];
+      const sliceErrors = validateConfigSliceEntry(capId, key, slice);
+      if (sliceErrors.length > 0) {
+        throw new Error(
+          'configSchema validation failed during registry build:\n' +
+          sliceErrors.map((e) => '  ' + e).join('\n'),
+        );
+      }
+      // S2b: inline literal guard for configSchema write site
+      if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
+        configSchema[key] = {
+          owner: capId,
+          type: slice.type,
+          default: slice.default,
+          description: slice.description,
+        };
+        // Preserve values array for enum types if present
+        if (slice.type === 'enum' && Array.isArray(slice.values)) {
+          configSchema[key].values = slice.values;
+        }
+      }
+    }
+
     if (cap.role === 'feature') {
       for (const skill of (cap.skills || [])) {
         // S2b: inline literal guard at each write site (CodeQL barrier)
@@ -457,34 +574,6 @@ function buildRegistry(capMap) {
         if (agent === '__proto__' || agent === 'constructor' || agent === 'prototype') continue;
         byAgent[agent] = capId;
       }
-      for (const key of Object.keys(cap.config || {})) {
-        // S2b: inline literal guard at each write site (CodeQL barrier)
-        if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue;
-        configKeys[key] = capId;
-
-        // Build configSchema entry — validate the slice first (throw on violation)
-        const slice = (cap.config || {})[key];
-        const sliceErrors = validateConfigSliceEntry(capId, key, slice);
-        if (sliceErrors.length > 0) {
-          throw new Error(
-            'configSchema validation failed during registry build:\n' +
-            sliceErrors.map((e) => '  ' + e).join('\n'),
-          );
-        }
-        // S2b: inline literal guard for configSchema write site
-        if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
-          configSchema[key] = {
-            owner: capId,
-            type: slice.type,
-            default: slice.default,
-            description: slice.description,
-          };
-          // Preserve values array for enum types if present
-          if (slice.type === 'enum' && Array.isArray(slice.values)) {
-            configSchema[key].values = slice.values;
-          }
-        }
-      }
 
       for (const step of (cap.steps || [])) {
         if (VALID_LOOP_POINTS.has(step.point)) {
@@ -741,7 +830,11 @@ function main() {
   if (flag === '--check') {
     // Fix #3: read the REAL central config keys so collision detection fires and is visible.
     const centralKeys = loadCentralConfigKeys();
-    const { capMap, errors } = loadAndValidate(centralKeys);
+    const { capMap, errors, warnings } = loadAndValidate(centralKeys);
+
+    // ADR-2782 D4 — non-fatal manifest diagnostics. Emitted BEFORE the hard-error
+    // exit so a forward-built manifest still explains itself on a failing build.
+    for (const w of warnings) process.stderr.write(w + '\n');
 
     // Separate pending-migration warnings from hard errors
     const { hardErrors, pendingMigrationWarnings } = classifyCrossErrors(errors);
@@ -778,7 +871,11 @@ function main() {
   } else if (flag === '--write') {
     // Fix #3: read the REAL central config keys so collision detection fires and is visible.
     const centralKeys = loadCentralConfigKeys();
-    const { capMap, errors } = loadAndValidate(centralKeys);
+    const { capMap, errors, warnings } = loadAndValidate(centralKeys);
+
+    // ADR-2782 D4 — non-fatal manifest diagnostics. Emitted BEFORE the hard-error
+    // exit so a forward-built manifest still explains itself on a failing build.
+    for (const w of warnings) process.stderr.write(w + '\n');
 
     // Separate pending-migration warnings from hard errors
     const { hardErrors, pendingMigrationWarnings } = classifyCrossErrors(errors);
@@ -828,6 +925,7 @@ module.exports = {
   validateCrossCapability,
   classifyCrossErrors,
   loadCentralConfigKeys,
+  loadCentralConfigPatterns,
   loadAndValidate,
   buildRegistry,
   serializeRegistry,