@telorun/analyzer 0.33.0 → 0.34.0

package/dist/validate-references.js

@@ -21,20 +21,26 @@ function checkKind(kind, entry, registry, aliases) {
         const targetDef = registry.resolve(targetKind);
         if (!targetDef)
             return [];
+        // Liskov substitutability: a value satisfies the slot when it transitively
+        // extends the target kind, or — for a CONCRETE target — IS that kind.
+        // `getByExtends` is the same transitive subtype index for abstract and
+        // concrete targets alike; an abstract is satisfied only by an implementer,
+        // never by the abstract kind itself (which is non-instantiable).
+        if (targetDef.kind !== "Telo.Abstract" && resolved === targetKind)
+            return [];
+        const subtypes = registry.getByExtends(targetKind);
+        const subtypeKinds = new Set(subtypes.map((d) => `${d.metadata.module}.${d.metadata.name}`));
+        if (subtypeKinds.has(resolved))
+            return [];
         if (targetDef.kind === "Telo.Abstract") {
-            const implementing = registry.getByExtends(targetKind);
-            if (implementing.length === 0)
+            if (subtypes.length === 0)
                 return []; // partial context — no implementations loaded yet
-            const implementingKinds = new Set(implementing.map((d) => `${d.metadata.module}.${d.metadata.name}`));
-            if (implementingKinds.has(resolved))
-                return [];
-            const options = [...implementingKinds].join(", ");
+            const options = [...subtypeKinds].join(", ");
             errors.push(`'${kind}' does not implement '${targetKind}' (known implementations: ${options})`);
         }
         else {
-            if (resolved === targetKind)
-                return [];
-            errors.push(`'${kind}' (resolved: '${resolved}') does not match required '${targetKind}'`);
+            const options = subtypeKinds.size > 0 ? ` or a subtype (${[...subtypeKinds].join(", ")})` : "";
+            errors.push(`'${kind}' (resolved: '${resolved}') does not match required '${targetKind}'${options}`);
         }
     }
     return errors;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telorun/analyzer",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "Telo Analyzer - Static manifest validator for Telo manifests.",
   "keywords": [
     "telo",
@@ -48,7 +48,7 @@
     "@types/node": "^20.0.0",
     "typescript": "^5.0.0",
     "vitest": "^2.1.8",
-    "@telorun/sdk": "0.41.0"
+    "@telorun/sdk": "0.44.0"
   },
   "peerDependencies": {
     "@telorun/sdk": "*"

package/src/analysis-registry.ts

@@ -262,16 +262,17 @@ export class AnalysisRegistry {
     const targetDef = this.defs.resolve(targetKind);
     if (!targetDef) return undefined;
 
+    // General single inheritance: the accepted set is the target kind plus every
+    // kind that transitively extends it (subtypes are substitutable). A concrete
+    // target contributes itself and any specializations; an abstract contributes
+    // its implementations. Same transitive index for both.
     const out = new Set<string>();
-    if (targetDef.kind === "Telo.Abstract") {
-      for (const def of this.defs.getByExtends(targetKind)) {
-        const module = (def.metadata as { module?: string } | undefined)?.module;
-        if (module && def.metadata?.name) {
-          out.add(`${module}.${def.metadata.name as string}`);
-        }
+    if (targetDef.kind !== "Telo.Abstract") out.add(targetKind);
+    for (const def of this.defs.getByExtends(targetKind)) {
+      const module = (def.metadata as { module?: string } | undefined)?.module;
+      if (module && def.metadata?.name) {
+        out.add(`${module}.${def.metadata.name as string}`);
       }
-    } else {
-      out.add(targetKind);
     }
     return out;
   }

package/src/analyzer.ts

@@ -11,6 +11,7 @@ import {
   type CelHandlers,
 } from "./cel-environment.js";
 import { DefinitionRegistry } from "./definition-registry.js";
+import { effectiveAuthorSchema } from "./extends-resolution.js";
 import { buildDependencyGraph, formatCycle } from "./dependency-graph.js";
 import { buildKernelGlobalsSchema, mergeKernelGlobalsIntoContext } from "./kernel-globals.js";
 import { computeSuggestKind } from "./kind-suggest.js";
@@ -39,6 +40,7 @@ import {
 } from "./validate-cel-context.js";
 import { buildEvalPaths, evalPathsCover } from "./eval-paths.js";
 import { validateExtends } from "./validate-extends.js";
+import { validateBaseMapping } from "./validate-base-mapping.js";
 import { validateNestedInlineResources } from "./validate-nested-inline.js";
 import { validateKindDescriptions } from "./validate-kind-descriptions.js";
 import { validateProviderCoherence } from "./validate-provider-coherence.js";
@@ -123,8 +125,20 @@ const SOURCE = "telo-analyzer";
  *  property the user declared in `schema:` plus synthetic `name` / `kind` and
  *  the metadata sub-object (kept open since metadata legitimately carries
  *  arbitrary user-added fields). */
-function buildSelfSchema(definition: Record<string, any>): Record<string, any> {
-  const userSchema = (definition.schema ?? {}) as Record<string, any>;
+function buildSelfSchema(
+  definition: Record<string, any>,
+  defs?: DefinitionRegistry,
+  aliases?: AliasResolver,
+): Record<string, any> {
+  // The author-facing schema resolves inheritance: with `base:` the child's own
+  // schema (the parent's config is internal); without it, `merge(parent, own)`.
+  const userSchema = (
+    defs
+      ? effectiveAuthorSchema(definition as unknown as ResourceDefinition, (k) =>
+          defs.resolve(aliases?.resolveKind(k) ?? k) ?? defs.resolve(k),
+        )
+      : (definition.schema ?? {})
+  ) as Record<string, any>;
   const userProps = (userSchema.properties ?? {}) as Record<string, any>;
   const userRequired = Array.isArray(userSchema.required) ? userSchema.required : [];
   return {
@@ -193,7 +207,7 @@ function manifestRootForResolver(
   const inputs = lookupTemplateInputsSchema(m, defs, aliases, allManifests);
   return {
     ...m,
-    schema: buildSelfSchema(m),
+    schema: buildSelfSchema(m, defs, aliases),
     ...(inputs ? { inputType: inputs } : {}),
   };
 }
@@ -1230,21 +1244,28 @@ export class StaticAnalyzer {
         continue;
       }
 
-      // Validate resource config against definition schema.
+      // Validate resource config against the definition's AUTHOR-FACING schema —
+      // inheritance-resolved: with `base:` the child's own schema (parent config
+      // is internal), else `merge(parent, own)` so a `base:`-less `extends` child
+      // is validated against the inherited fields it may set. For a definition
+      // that neither extends nor uses `base:` this is exactly its own schema.
       // `kind` and `metadata` are implicit on every resource — inject them so module
       // authors don't have to repeat them when using additionalProperties: false.
-      if (definition.schema) {
+      const authorSchema = effectiveAuthorSchema(definition, (k) =>
+        defs.resolve(aliases.resolveKind(k) ?? k) ?? defs.resolve(k),
+      );
+      if (authorSchema && Object.keys(authorSchema).length > 0) {
         const schema =
-          definition.schema.additionalProperties === false
+          authorSchema.additionalProperties === false
             ? {
-                ...definition.schema,
+                ...authorSchema,
                 properties: {
                   kind: { type: "string" },
                   metadata: { type: "object" },
-                  ...definition.schema.properties,
+                  ...authorSchema.properties,
                 },
               }
-            : definition.schema;
+            : authorSchema;
         // Phase 1: CEL type checking — walk data+schema together, check env.check() return types.
         // A Telo.Import's variables/secrets are a config-only contract evaluated against the
         // IMPORTING module's scope, so type them from the owning module doc (matched by
@@ -1628,6 +1649,8 @@ export class StaticAnalyzer {
     // Validate `extends` fields and flag legacy `capability: <UserAbstract>` overload.
     diagnostics.push(...validateExtends(allManifests, defs, aliases));
 
+    diagnostics.push(...validateBaseMapping(allManifests, defs, aliases));
+
     // Validate provider coherence rules for `provide:` template-target definitions.
     diagnostics.push(...validateProviderCoherence(allManifests, defs, aliases));
 

package/src/builtins.ts

@@ -209,6 +209,21 @@ export const KERNEL_BUILTINS: ResourceDefinition[] = [
             },
           },
         },
+        // `base:` ("super(...)") — construction mapping for an inherited
+        // (concrete-`extends`) definition. Its CEL is evaluated once against
+        // `self` (typed from this definition's `schema:`) to build the parent
+        // kind's config. Same `self`-only scope as a resource body.
+        base: {
+          type: "object",
+          additionalProperties: true,
+          "x-telo-context": {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+              self: { "x-telo-context-from-root": "schema" },
+            },
+          },
+        },
       },
     },
   },

package/src/definition-registry.ts

@@ -8,6 +8,7 @@ import {
   type ReferenceFieldMap,
 } from "./reference-field-map.js";
 import { createAjv, formatSingleError, navigateJsonPointer } from "./schema-compat.js";
+import { effectiveAuthorSchema } from "./extends-resolution.js";
 
 /** Pure kind → ResourceDefinition map. No controller loading, no lifecycle. */
 export class DefinitionRegistry {
@@ -37,7 +38,11 @@ export class DefinitionRegistry {
     const { name, module: mod } = definition.metadata;
     const key = mod ? `${mod}.${name}` : name;
     this.defs.set(key, definition);
-    this.fieldMaps.set(key, buildReferenceFieldMap(definition.schema ?? {}));
+    // Field maps derive from the AUTHOR-FACING (inheritance-resolved) schema, which
+    // depends on the parent — possibly registered after this child. Clear the cache
+    // so any already-computed map recomputes against the now-larger def set; the
+    // maps rebuild lazily on first `getFieldMap` (after all defs are registered).
+    this.fieldMaps.clear();
     // `capability` populates extendedBy for backward-compat with the legacy pattern where
     // a concrete definition overloaded `capability: <AbstractKind>` to mean "implements
     // this abstract." The canonical pattern is `extends` (below). Both populate the index,
@@ -204,9 +209,19 @@ export class DefinitionRegistry {
     return this.defs.get(kind);
   }
 
-  /** Returns the cached reference field map for the given kind, built once during register(). */
+  /** Returns the reference field map for the given kind, computed lazily from the
+   *  kind's AUTHOR-FACING (inheritance-resolved) schema and memoized. Lazy so a
+   *  child registered before its parent still sees the parent's inherited ref
+   *  slots once both are present. */
   getFieldMap(kind: string): ReferenceFieldMap | undefined {
-    return this.fieldMaps.get(kind);
+    const cached = this.fieldMaps.get(kind);
+    if (cached) return cached;
+    const def = this.defs.get(kind);
+    if (!def) return undefined;
+    const schema = effectiveAuthorSchema(def, (k) => this.resolve(k));
+    const map = buildReferenceFieldMap(schema ?? {});
+    this.fieldMaps.set(kind, map);
+    return map;
   }
 
   /** Returns the field map for `kind`, falling back to the alias-resolved kind when not found. */

package/src/extends-resolution.ts

@@ -0,0 +1,124 @@
+import type { ResourceDefinition } from "@telorun/sdk";
+import { mergeTypeSchemas } from "@telorun/sdk";
+
+/** Resolves a kind string (canonical or alias form, depending on the caller's
+ *  registry) to its `Telo.Definition` / `Telo.Abstract`, or undefined. */
+export type DefResolver = (kind: string) => ResourceDefinition | undefined;
+
+/** The template-body / controller fields a definition may carry. Kept local
+ *  because `ResourceDefinition` intentionally types only the stable surface;
+ *  template bodies are read structurally. */
+interface DefinitionBody {
+  extends?: string;
+  capability?: string;
+  controllers?: unknown[];
+  invoke?: unknown;
+  run?: unknown;
+  provide?: unknown;
+  mount?: unknown;
+  resources?: unknown[];
+  base?: Record<string, unknown>;
+  schema?: Record<string, any>;
+}
+
+const body = (def: ResourceDefinition | undefined): DefinitionBody =>
+  (def ?? {}) as unknown as DefinitionBody;
+
+/** The definition a given definition directly `extends`, or undefined when it
+ *  extends nothing / the target can't be resolved. */
+export function resolveParent(
+  def: ResourceDefinition | undefined,
+  resolve: DefResolver,
+): ResourceDefinition | undefined {
+  const ext = body(def).extends;
+  if (typeof ext !== "string" || ext.length === 0) return undefined;
+  return resolve(ext);
+}
+
+/** The `extends` ancestor chain, nearest-first, excluding `def` itself.
+ *  Cycle-guarded so a malformed self/mutual `extends` can't loop forever. */
+export function ancestorChain(
+  def: ResourceDefinition | undefined,
+  resolve: DefResolver,
+): ResourceDefinition[] {
+  const chain: ResourceDefinition[] = [];
+  const seen = new Set<ResourceDefinition>();
+  let cur = resolveParent(def, resolve);
+  while (cur && !seen.has(cur)) {
+    seen.add(cur);
+    chain.push(cur);
+    cur = resolveParent(cur, resolve);
+  }
+  return chain;
+}
+
+/** True when a definition carries its own controller (`controllers:`) or a
+ *  template body (`invoke:` / `run:` / `provide:` / `mount:` / `resources:`). */
+export function hasOwnControllerOrTemplate(def: ResourceDefinition | undefined): boolean {
+  const d = body(def);
+  return !!(
+    (d.controllers && d.controllers.length) ||
+    d.invoke ||
+    d.run ||
+    d.provide ||
+    d.mount ||
+    d.resources
+  );
+}
+
+/** The nearest concrete ancestor that provides a controller (own `controllers:`
+ *  or a template body) — the definition whose controller an inherited child
+ *  delegates to. Undefined when no controller-bearing concrete ancestor exists. */
+export function controllerBearingAncestor(
+  def: ResourceDefinition | undefined,
+  resolve: DefResolver,
+): ResourceDefinition | undefined {
+  for (const a of ancestorChain(def, resolve)) {
+    if (a.kind === "Telo.Abstract") continue;
+    if (hasOwnControllerOrTemplate(a)) return a;
+  }
+  return undefined;
+}
+
+/** True when this definition inherits its controller by delegation: it declares
+ *  `extends`, has no own controller/template body, and its nearest concrete
+ *  ancestor is controller-bearing. */
+export function isInheritedDelegation(
+  def: ResourceDefinition | undefined,
+  resolve: DefResolver,
+): boolean {
+  if (!body(def).extends || hasOwnControllerOrTemplate(def)) return false;
+  return controllerBearingAncestor(def, resolve) !== undefined;
+}
+
+/** The effective (possibly inherited) capability: the nearest self-or-ancestor
+ *  that declares a `capability`. Undefined when none in the chain does. */
+export function inheritedCapability(
+  def: ResourceDefinition | undefined,
+  resolve: DefResolver,
+): string | undefined {
+  if (body(def).capability) return body(def).capability;
+  for (const a of ancestorChain(def, resolve)) {
+    if (body(a).capability) return body(a).capability;
+  }
+  return undefined;
+}
+
+/** The author-facing schema for a definition:
+ *  - with `base:` present → the definition's **own** schema (the parent's config
+ *    fields are internal, set solely through `base:`).
+ *  - without `base:` but with `extends` → `merge(parent-effective, own)` (a pure
+ *    additive extension; child overrides on key conflicts), reusing the same
+ *    `mergeTypeSchemas` that `Type.JsonSchema.extends` uses.
+ *  - no `extends` → the own schema unchanged. */
+export function effectiveAuthorSchema(
+  def: ResourceDefinition | undefined,
+  resolve: DefResolver,
+): Record<string, any> {
+  const own = (body(def).schema ?? {}) as Record<string, any>;
+  const parent = resolveParent(def, resolve);
+  if (!parent) return own;
+  if (body(def).base) return own;
+  const parentSchema = effectiveAuthorSchema(parent, resolve);
+  return mergeTypeSchemas([parentSchema, own]) as Record<string, any>;
+}

package/src/index.ts

@@ -22,6 +22,18 @@ export {
     type ReExportSpec,
 } from "./flatten-for-analyzer.js";
 export { buildEvalPaths, evalPathCovers } from "./eval-paths.js";
+export {
+  ancestorChain,
+  controllerBearingAncestor,
+  effectiveAuthorSchema,
+  hasOwnControllerOrTemplate,
+  inheritedCapability,
+  isInheritedDelegation,
+  resolveParent,
+} from "./extends-resolution.js";
+export type { DefResolver } from "./extends-resolution.js";
+export { buildReferenceFieldMap, isRefEntry, isScopeEntry } from "./reference-field-map.js";
+export type { ReferenceFieldMap, RefFieldEntry } from "./reference-field-map.js";
 export { visitManifest } from "./manifest-visitor.js";
 export type {
     CelSiteEvent,

package/src/validate-base-mapping.ts

@@ -0,0 +1,154 @@
+import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
+import { isCompiledValue } from "@telorun/sdk";
+import type { AliasResolver } from "./alias-resolver.js";
+import type { DefinitionRegistry } from "./definition-registry.js";
+import { effectiveAuthorSchema, resolveParent, type DefResolver } from "./extends-resolution.js";
+import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
+
+const SOURCE = "telo-analyzer";
+
+/** True when a value subtree contains a compiled CEL leaf — such a value can
+ *  produce anything at runtime, so its type is not statically checkable. */
+function containsCel(value: unknown): boolean {
+  if (isCompiledValue(value)) return true;
+  if (Array.isArray(value)) return value.some(containsCel);
+  if (value && typeof value === "object") {
+    return Object.values(value as Record<string, unknown>).some(containsCel);
+  }
+  return false;
+}
+
+/**
+ * Phase 3c — Static validation of a definition's `base:` construction mapping
+ * against the parent kind's config schema. The kernel evaluates `base:` and
+ * passes the result to the inherited controller's `create()`, which validates it
+ * at boot; this mirrors that check statically so an omitted required field or a
+ * wrong literal type surfaces at `telo check`, not first boot.
+ *
+ * Diagnostics:
+ *  - BASE_MISSING_REQUIRED: `base:` omits a field the parent schema requires.
+ *  - BASE_UNKNOWN_FIELD: `base:` sets a field the parent schema (with
+ *    `additionalProperties: false`) does not declare.
+ *  - BASE_SCHEMA_MISMATCH: a CEL-free `base:` value violates the parent field's
+ *    schema (wrong type / constraint). CEL-bearing values are skipped — their
+ *    runtime value is unknown — but still count as present for required checks.
+ */
+export function validateBaseMapping(
+  manifests: ResourceManifest[],
+  registry: DefinitionRegistry,
+  aliases: AliasResolver,
+): AnalysisDiagnostic[] {
+  const diagnostics: AnalysisDiagnostic[] = [];
+  const resolveDef: DefResolver = (k) =>
+    registry.resolve(aliases.resolveKind(k) ?? k) ?? registry.resolve(k);
+
+  const importedModules = new Set<string>();
+  for (const m of manifests) {
+    if (m.kind !== "Telo.Import") continue;
+    const resolved = (m.metadata as { resolvedModuleName?: string } | undefined)?.resolvedModuleName;
+    if (resolved) importedModules.add(resolved);
+  }
+
+  for (const m of manifests) {
+    if (m.kind !== "Telo.Definition") continue;
+    const base = (m as { base?: unknown }).base;
+    if (!base || typeof base !== "object" || Array.isArray(base)) continue;
+    const name = m.metadata?.name as string | undefined;
+    if (!name) continue;
+    const ownModule = (m.metadata as { module?: string } | undefined)?.module;
+    if (ownModule && importedModules.has(ownModule)) continue;
+
+    const parent = resolveParent(m as unknown as ResourceDefinition, resolveDef);
+    // Missing / unresolved `extends` is already reported by validateExtends.
+    if (!parent) continue;
+    const parentSchema = effectiveAuthorSchema(parent, resolveDef);
+    if (!parentSchema || typeof parentSchema !== "object") continue;
+
+    const filePath = (m.metadata as { source?: string } | undefined)?.source;
+    const resource = { kind: m.kind, name };
+    const label = `${m.kind}/${name}`;
+    checkObject(base as Record<string, unknown>, parentSchema, "base", {
+      diagnostics,
+      registry,
+      label,
+      resource,
+      filePath,
+    });
+  }
+
+  return diagnostics;
+}
+
+interface CheckCtx {
+  diagnostics: AnalysisDiagnostic[];
+  registry: DefinitionRegistry;
+  label: string;
+  resource: { kind: string; name: string };
+  filePath: string | undefined;
+}
+
+function checkObject(
+  value: Record<string, unknown>,
+  schema: Record<string, any>,
+  path: string,
+  ctx: CheckCtx,
+): void {
+  const properties = (schema.properties ?? {}) as Record<string, Record<string, any>>;
+  const required = Array.isArray(schema.required) ? (schema.required as string[]) : [];
+  const additionalFalse = schema.additionalProperties === false;
+
+  for (const req of required) {
+    if (!(req in value)) {
+      ctx.diagnostics.push({
+        severity: DiagnosticSeverity.Error,
+        code: "BASE_MISSING_REQUIRED",
+        source: SOURCE,
+        message: `${ctx.label}: '${path}' does not set required parent field '${req}'.`,
+        data: { resource: ctx.resource, filePath: ctx.filePath, path },
+      });
+    }
+  }
+
+  for (const [key, fieldValue] of Object.entries(value)) {
+    const fieldPath = `${path}.${key}`;
+    const propSchema = properties[key];
+    if (!propSchema) {
+      if (additionalFalse) {
+        ctx.diagnostics.push({
+          severity: DiagnosticSeverity.Error,
+          code: "BASE_UNKNOWN_FIELD",
+          source: SOURCE,
+          message: `${ctx.label}: '${fieldPath}' is not a field of the parent kind's schema.`,
+          data: { resource: ctx.resource, filePath: ctx.filePath, path: fieldPath },
+        });
+      }
+      continue;
+    }
+    // A CEL-bearing value produces its shape at runtime — not statically
+    // checkable. Recurse into a partially-CEL nested object so its literal
+    // sub-fields still get validated; fully-literal values validate directly.
+    if (containsCel(fieldValue)) {
+      if (
+        fieldValue &&
+        typeof fieldValue === "object" &&
+        !Array.isArray(fieldValue) &&
+        !isCompiledValue(fieldValue) &&
+        propSchema.type === "object" &&
+        propSchema.properties
+      ) {
+        checkObject(fieldValue as Record<string, unknown>, propSchema, fieldPath, ctx);
+      }
+      continue;
+    }
+    const issues = ctx.registry.validateWithRefs(fieldValue, propSchema);
+    for (const issue of issues) {
+      ctx.diagnostics.push({
+        severity: DiagnosticSeverity.Error,
+        code: "BASE_SCHEMA_MISMATCH",
+        source: SOURCE,
+        message: `${ctx.label}: '${fieldPath}' does not match the parent field's schema: ${issue}`,
+        data: { resource: ctx.resource, filePath: ctx.filePath, path: fieldPath },
+      });
+    }
+  }
+}

package/src/validate-extends.ts

@@ -1,6 +1,7 @@
-import type { ResourceManifest } from "@telorun/sdk";
+import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
+import { inheritedCapability, type DefResolver } from "./extends-resolution.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
 
 const SOURCE = "telo-analyzer";
@@ -119,16 +120,28 @@ export function validateExtends(
                 message: `${label}: 'extends' target '${extendsValue}' (resolved: '${canonical}') is not a registered definition.`,
                 data: { resource, filePath, path: "extends" },
               });
-            } else if (targetDef.kind !== "Telo.Abstract") {
-              diagnostics.push({
-                severity: DiagnosticSeverity.Error,
-                code: "EXTENDS_NON_ABSTRACT",
-                source: SOURCE,
-                message:
-                  `${label}: 'extends' target '${extendsValue}' (resolved: '${canonical}') is a ${targetDef.kind}, not a Telo.Abstract. ` +
-                  `Only Telo.Abstract declarations may be extended.`,
-                data: { resource, filePath, path: "extends" },
-              });
+            } else {
+              // General single inheritance: any concrete or abstract kind may be
+              // extended. What inheritance must NOT do is change the lifecycle
+              // role — a child that restates `capability` differently from an
+              // ancestor is a hard error (no silent capability change).
+              const resolveDef: DefResolver = (k) =>
+                registry.resolve(aliases.resolveKind(k) ?? k) ?? registry.resolve(k);
+              const ownCap = (m as { capability?: unknown }).capability;
+              const ownCapResolved =
+                typeof ownCap === "string" ? aliases.resolveKind(ownCap) ?? ownCap : undefined;
+              const ancestorCap = inheritedCapability(targetDef, resolveDef);
+              if (ownCapResolved && ancestorCap && ownCapResolved !== ancestorCap) {
+                diagnostics.push({
+                  severity: DiagnosticSeverity.Error,
+                  code: "EXTENDS_CAPABILITY_MISMATCH",
+                  source: SOURCE,
+                  message:
+                    `${label}: declares 'capability: ${ownCap}' but extends '${extendsValue}' whose inherited capability is '${ancestorCap}'. ` +
+                    `Capability is inherited and immutable — omit 'capability' or restate it identically.`,
+                  data: { resource, filePath, path: "capability" },
+                });
+              }
             }
           }
         }

package/src/validate-provider-coherence.ts

@@ -1,6 +1,7 @@
-import type { ResourceManifest } from "@telorun/sdk";
+import type { ResourceDefinition, ResourceManifest } from "@telorun/sdk";
 import type { AliasResolver } from "./alias-resolver.js";
 import type { DefinitionRegistry } from "./definition-registry.js";
+import { controllerBearingAncestor, type DefResolver } from "./extends-resolution.js";
 import { DiagnosticSeverity, type AnalysisDiagnostic } from "./types.js";
 
 const SOURCE = "telo-analyzer";
@@ -234,7 +235,16 @@ export function validateProviderCoherence(
       }
     }
 
-    if (capability === "Telo.Provider" && !hasControllers && !hasProvide) {
+    // A definition that inherits a controller by delegation (concrete `extends`,
+    // no own controller/template) satisfies the implementation requirement
+    // through its parent — `base:` supplies the parent's config.
+    const resolveDef: DefResolver = (k) =>
+      registry.resolve(aliases.resolveKind(k) ?? k) ?? registry.resolve(k);
+    const inheritsController =
+      typeof md.extends === "string" &&
+      controllerBearingAncestor(m as ResourceDefinition, resolveDef) !== undefined;
+
+    if (capability === "Telo.Provider" && !hasControllers && !hasProvide && !inheritsController) {
       diagnostics.push({
         severity: DiagnosticSeverity.Error,
         code: "PROVIDER_MISSING_IMPLEMENTATION",

package/src/validate-references.ts

@@ -29,20 +29,24 @@ function checkKind(
     if (!targetKind) return [];
     const targetDef = registry.resolve(targetKind);
     if (!targetDef) return [];
+    // Liskov substitutability: a value satisfies the slot when it transitively
+    // extends the target kind, or — for a CONCRETE target — IS that kind.
+    // `getByExtends` is the same transitive subtype index for abstract and
+    // concrete targets alike; an abstract is satisfied only by an implementer,
+    // never by the abstract kind itself (which is non-instantiable).
+    if (targetDef.kind !== "Telo.Abstract" && resolved === targetKind) return [];
+    const subtypes = registry.getByExtends(targetKind);
+    const subtypeKinds = new Set(subtypes.map((d) => `${d.metadata.module}.${d.metadata.name}`));
+    if (subtypeKinds.has(resolved)) return [];
     if (targetDef.kind === "Telo.Abstract") {
-      const implementing = registry.getByExtends(targetKind);
-      if (implementing.length === 0) return []; // partial context — no implementations loaded yet
-      const implementingKinds = new Set(
-        implementing.map((d) => `${d.metadata.module}.${d.metadata.name}`),
-      );
-      if (implementingKinds.has(resolved)) return [];
-      const options = [...implementingKinds].join(", ");
+      if (subtypes.length === 0) return []; // partial context — no implementations loaded yet
+      const options = [...subtypeKinds].join(", ");
       errors.push(
         `'${kind}' does not implement '${targetKind}' (known implementations: ${options})`,
       );
     } else {
-      if (resolved === targetKind) return [];
-      errors.push(`'${kind}' (resolved: '${resolved}') does not match required '${targetKind}'`);
+      const options = subtypeKinds.size > 0 ? ` or a subtype (${[...subtypeKinds].join(", ")})` : "";
+      errors.push(`'${kind}' (resolved: '${resolved}') does not match required '${targetKind}'${options}`);
     }
   }
   return errors;