@transitrix/diagrams 1.13.3 → 1.14.0

package/dist/activities/action-fields.d.ts

@@ -0,0 +1,6 @@
+/** ACTION field types and the manifest-selected 7.0.0 numeric boundary. */
+export declare function validateActionFields(action: Record<string, unknown>, methodologyVersion?: string): Array<{
+    code: string;
+    message: string;
+    path: string;
+}>;

package/dist/activities/action-fields.js

@@ -0,0 +1,34 @@
+/** ACTION field types and the manifest-selected 7.0.0 numeric boundary. */
+export function validateActionFields(action, methodologyVersion) {
+    const errors = [];
+    const version = /^(\d+)\.(\d+)\.(\d+)(-[^+]+)?(?:\+.*)?$/.exec(methodologyVersion ?? '');
+    const nonnegative = version !== null && (Number(version[1]) > 7 ||
+        (Number(version[1]) === 7 && (Number(version[2]) > 0 || Number(version[3]) > 0 || !version[4])));
+    const type = (value) => value === null ? 'null' : Array.isArray(value) ? 'array' : typeof value;
+    const schema = (path, expected, value) => errors.push({
+        code: 'SCHEMA_INVALID', path,
+        message: `ACTION field '${path}' expected ${expected}, actual ${type(value)} (${String(value)}).`,
+    });
+    for (const field of ['duration', 'duration_days', 'labor_cost', 'resources_cost', 'effort', 'score', 'sort']) {
+        const value = action[field];
+        if (value === undefined || (value === null && (field === 'duration' || field === 'duration_days')))
+            continue;
+        const integer = field === 'score' || field === 'sort';
+        if (typeof value !== 'number' || !Number.isFinite(value) || (integer && !Number.isInteger(value))) {
+            schema(field, integer ? 'finite integer' : 'finite number', value);
+        }
+        else if (nonnegative && field !== 'sort' && value < 0) {
+            errors.push({ code: 'ACTION-011', path: field, message: `ACTION field '${field}' is negative (${value}).` });
+        }
+    }
+    if (action.predecessors !== undefined) {
+        if (!Array.isArray(action.predecessors))
+            schema('predecessors', 'array of strings', action.predecessors);
+        else
+            action.predecessors.forEach((value, index) => {
+                if (typeof value !== 'string')
+                    schema(`predecessors[${index}]`, 'string', value);
+            });
+    }
+    return errors;
+}

package/dist/activities/validate.d.ts

@@ -1,2 +1,4 @@
 import type { ActivityValidationResult } from './types.js';
-export declare function validateActivities(input: unknown): ActivityValidationResult;
+export declare function validateActivities(input: unknown, options?: {
+    methodologyVersion?: string;
+}): ActivityValidationResult;

package/dist/activities/validate.js

@@ -1,5 +1,10 @@
+import { validateActionFields } from './action-fields.js';
 import { isObject, str, reachesRootViaParent } from '../canon-resolver-utils.js';
 import { ACT_021_OMITTED_KEY } from './resolver.js';
+function validDate(value) {
+    const date = new Date(value);
+    return DATE_RE.test(value) && Number.isFinite(date.getTime()) && date.toISOString().slice(0, 10) === value;
+}
 const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 const VALID_WEEKDAYS = new Set(['mon', 'tue', 'wed', 'thu', 'fri', 'sat', 'sun']);
 function act021Message(actionId, rootId) {
@@ -54,7 +59,7 @@ function collectAct021FromAuthored(raw, actions) {
     }
     return out;
 }
-export function validateActivities(input) {
+export function validateActivities(input, options = {}) {
     const errors = [];
     const warnings = [];
     if (!input || typeof input !== 'object') {
@@ -92,7 +97,7 @@ export function validateActivities(input) {
     if (fromProjection.length === 0) {
         warnings.push(...collectAct021FromAuthored(raw, rawArray));
     }
-    // ACT-014 / ACT-015: project.calendar validation (run before per-activity loop;
+    // ACT-007 / ACT-008: project.calendar validation (run before per-activity loop;
     // surfaces clearly even when activities also have issues).
     if (raw.project && typeof raw.project === 'object') {
         const project = raw.project;
@@ -101,7 +106,7 @@ export function validateActivities(input) {
             const calendar = cal;
             if (calendar.working_days !== undefined) {
                 if (!Array.isArray(calendar.working_days)) {
-                    errors.push({ code: 'ACT-014', message: 'project.calendar.working_days must be an array of weekday names', path: 'project.calendar.working_days' });
+                    errors.push({ code: 'ACT-007', message: 'project.calendar.working_days must be an array of weekday names', path: 'project.calendar.working_days' });
                 }
                 else {
                     const seen = new Set();
@@ -110,14 +115,14 @@ export function validateActivities(input) {
                         const day = typeof raw === 'string' ? raw.toLowerCase() : '';
                         if (!VALID_WEEKDAYS.has(day)) {
                             errors.push({
-                                code: 'ACT-014',
+                                code: 'ACT-007',
                                 message: `project.calendar.working_days[${i}] "${String(raw)}" must be one of: mon, tue, wed, thu, fri, sat, sun`,
                                 path: `project.calendar.working_days[${i}]`,
                             });
                         }
                         else if (seen.has(day)) {
                             errors.push({
-                                code: 'ACT-014',
+                                code: 'ACT-007',
                                 message: `project.calendar.working_days has duplicate entry "${day}"`,
                                 path: `project.calendar.working_days[${i}]`,
                             });
@@ -130,14 +135,14 @@ export function validateActivities(input) {
             }
             if (calendar.holidays !== undefined) {
                 if (!Array.isArray(calendar.holidays)) {
-                    errors.push({ code: 'ACT-015', message: 'project.calendar.holidays must be an array of ISO 8601 dates', path: 'project.calendar.holidays' });
+                    errors.push({ code: 'ACT-008', message: 'project.calendar.holidays must be an array of ISO 8601 dates', path: 'project.calendar.holidays' });
                 }
                 else {
                     for (let i = 0; i < calendar.holidays.length; i++) {
                         const h = calendar.holidays[i];
-                        if (typeof h !== 'string' || !DATE_RE.test(h)) {
+                        if (typeof h !== 'string' || !validDate(h)) {
                             errors.push({
-                                code: 'ACT-015',
+                                code: 'ACT-008',
                                 message: `project.calendar.holidays[${i}] "${String(h)}" must be an ISO 8601 date (YYYY-MM-DD)`,
                                 path: `project.calendar.holidays[${i}]`,
                             });
@@ -188,15 +193,8 @@ export function validateActivities(input) {
         else {
             idSet.add(id);
         }
-        // ACT-009: non-negative numeric fields
-        const numericFields = ['duration', 'duration_days', 'labor_cost', 'resources_cost', 'effort', 'score', 'sort'];
-        for (const field of numericFields) {
-            const val = act[field];
-            if (val !== undefined && val !== null) {
-                if (typeof val !== 'number' || val < 0) {
-                    errors.push({ code: 'ACT-009', message: `Activity "${id}" field "${field}" must be a non-negative number, got ${String(val)}`, path });
-                }
-            }
+        for (const error of validateActionFields(act, options.methodologyVersion)) {
+            errors.push({ ...error, message: `Inline action actions[${i}].${error.path}: ${error.message}`, path: `actions[${i}].${error.path}` });
         }
         // ACT-011: warn if no duration (duration_days is accepted as an alias)
         // Network view is unaffected; this is only about CPM/Gantt rendering.
@@ -210,17 +208,20 @@ export function validateActivities(input) {
     for (let i = 0; i < doc.activities.length; i++) {
         const a = doc.activities[i];
         const path = `activities[${i}]`;
-        // ACT-007: self-loop
+        // ACTION-009: self-loop
         if (Array.isArray(a.predecessors) && a.predecessors.includes(a.id)) {
-            errors.push({ code: 'ACT-007', message: `Activity "${a.id}" lists itself as a predecessor`, path });
+            errors.push({ code: 'ACTION-009', message: `Activity "${a.id}" lists itself as a predecessor`, path });
+        }
+        if (typeof a.parent === 'string' && !idSet.has(a.parent)) {
+            warnings.push({ code: 'ACTION-007', message: `Action "${a.id}" parent "${a.parent}" does not resolve`, path: `${path}.parent` });
         }
-        // ACT-005: predecessor existence (intra-document)
+        // ACTION-007: predecessor existence (intra-document)
         for (const predId of (a.predecessors ?? [])) {
             if (!idSet.has(predId)) {
-                errors.push({ code: 'ACT-005', message: `Activity "${a.id}" references unknown predecessor "${predId}"`, path });
+                warnings.push({ code: 'ACTION-007', message: `Activity "${a.id}" references unknown predecessor "${predId}"`, path });
             }
         }
-        // ACT-008: date format validation + end_date >= start_date.
+        // ACTION-010: date format validation + end_date >= start_date.
         // The orchestrator's pre-release review flagged that the raw lexicographic
         // string compare is only correct for strict YYYY-MM-DD, with no format
         // check applied. Now we validate the format first; the order compare runs
@@ -228,27 +229,27 @@ export function validateActivities(input) {
         // be misleading).
         let startValid = true;
         let endValid = true;
-        if (a.start_date !== undefined) {
-            if (typeof a.start_date !== 'string' || !DATE_RE.test(a.start_date)) {
-                errors.push({ code: 'ACT-008', message: `Activity "${a.id}" start_date "${String(a.start_date)}" must be ISO 8601 YYYY-MM-DD`, path });
+        if (a.start_date !== undefined && a.start_date !== null) {
+            if (typeof a.start_date !== 'string' || !validDate(a.start_date)) {
+                errors.push({ code: 'ACTION-010', message: `Activity "${a.id}" start_date "${String(a.start_date)}" must be ISO 8601 YYYY-MM-DD`, path });
                 startValid = false;
             }
         }
-        if (a.end_date !== undefined) {
-            if (typeof a.end_date !== 'string' || !DATE_RE.test(a.end_date)) {
-                errors.push({ code: 'ACT-008', message: `Activity "${a.id}" end_date "${String(a.end_date)}" must be ISO 8601 YYYY-MM-DD`, path });
+        if (a.end_date !== undefined && a.end_date !== null) {
+            if (typeof a.end_date !== 'string' || !validDate(a.end_date)) {
+                errors.push({ code: 'ACTION-010', message: `Activity "${a.id}" end_date "${String(a.end_date)}" must be ISO 8601 YYYY-MM-DD`, path });
                 endValid = false;
             }
         }
         if (a.start_date && a.end_date && startValid && endValid) {
             if (a.end_date < a.start_date) {
-                errors.push({ code: 'ACT-008', message: `Activity "${a.id}" end_date "${a.end_date}" is before start_date "${a.start_date}"`, path });
+                errors.push({ code: 'ACTION-010', message: `Activity "${a.id}" end_date "${a.end_date}" is before start_date "${a.start_date}"`, path });
             }
         }
     }
     if (errors.length > 0)
         return { valid: false, errors, warnings };
-    // ACT-006: no cycles
+    // ACTION-008: no cycles
     const cycleError = detectCycle(doc.activities);
     if (cycleError)
         errors.push(cycleError);
@@ -349,13 +350,13 @@ export function validateActivities(input) {
             }
         }
     }
-    // ACT-019: Gantt view will not render when neither project.start_date nor
+    // ACT-009: Gantt view will not render when neither project.start_date nor
     // any per-activity pinned date pair is present. Network view is unaffected.
     const hasProjectStart = typeof doc.project?.start_date === 'string' && doc.project.start_date.length > 0;
     const hasPinnedActivity = doc.activities.some((a) => typeof a.start_date === 'string' && typeof a.end_date === 'string');
     if (!hasProjectStart && !hasPinnedActivity) {
         warnings.push({
-            code: 'ACT-019',
+            code: 'ACT-009',
             message: 'Gantt view will not render: project.start_date is absent and no activity has both start_date and end_date pinned. Network view is unaffected.',
         });
     }
@@ -379,7 +380,8 @@ function detectCycle(activities) {
         inDegree.set(a.id, 0);
     for (const a of activities) {
         for (const pred of (a.predecessors ?? [])) {
-            inDegree.set(a.id, (inDegree.get(a.id) ?? 0) + 1);
+            if (successors.has(pred))
+                inDegree.set(a.id, (inDegree.get(a.id) ?? 0) + 1);
         }
     }
     const queue = [];
@@ -400,7 +402,7 @@ function detectCycle(activities) {
     }
     if (processed < activities.length) {
         const cycleNodes = activities.filter(a => (inDegree.get(a.id) ?? 0) > 0).map(a => a.id);
-        return { code: 'ACT-006', message: `Cycle detected in activity dependency graph involving: ${cycleNodes.join(', ')}` };
+        return { code: 'ACTION-008', message: `Cycle detected in activity dependency graph involving: ${cycleNodes.join(', ')}` };
     }
     return null;
 }

package/dist/applications/validate.js

@@ -1,3 +1,4 @@
+import { schemaFinding } from '../schema-finding.js';
 const VALID_TYPES = new Set(['application', 'integration', 'platform', 'data_store']);
 const VALID_STATUSES = new Set(['Draft', 'Active', 'Deprecated', 'Decommissioning']);
 const VALID_DIRECTIONS = new Set(['inbound', 'outbound', 'bidirectional']);
@@ -18,21 +19,21 @@ const TIME_VARYING_FIELDS = ['owner_role', 'vendor', 'maturity'];
 export function validateApplicationsCatalogue(input) {
     const errors = [];
     const warnings = [];
-    if (!input || typeof input !== 'object') {
-        return { valid: false, errors: [{ code: 'APP-001', message: 'Input must be an object' }], warnings };
+    if (!input || typeof input !== 'object' || Array.isArray(input)) {
+        return { valid: false, errors: [schemaFinding('applications inline', '$', 'mapping', input)], warnings };
     }
     const raw = input;
     // APP-001: notation header
     if (!('notation' in raw)) {
-        errors.push({ code: 'APP-001', message: 'Missing required field: notation' });
+        errors.push({ code: 'HDR-001', message: 'notation field is missing' });
     }
     else if (raw['notation'] !== 'applications') {
-        errors.push({ code: 'APP-001', message: `notation must be "applications", got "${raw['notation']}"` });
+        errors.push({ code: 'HDR-002', message: 'notation must be applications' });
     }
     if (errors.length > 0)
         return { valid: false, errors, warnings };
     // APP-002: catalogue header fields
-    if (!raw['applications_catalogue'] || typeof raw['applications_catalogue'] !== 'object') {
+    if (!raw['applications_catalogue'] || typeof raw['applications_catalogue'] !== 'object' || Array.isArray(raw['applications_catalogue'])) {
         errors.push({ code: 'APP-002', message: 'Missing required field: applications_catalogue' });
         return { valid: false, errors, warnings };
     }
@@ -48,58 +49,58 @@ export function validateApplicationsCatalogue(input) {
     }
     if (errors.length > 0)
         return { valid: false, errors, warnings };
-    // APP-007: updated_at format
+    // Schema: updated_at format
     if (!DATE_RE.test(cat['updated_at'])) {
-        errors.push({ code: 'APP-007', message: `applications_catalogue.updated_at must be YYYY-MM-DD, got "${cat['updated_at']}"` });
+        errors.push(schemaFinding('applications inline', 'applications_catalogue.updated_at', 'YYYY-MM-DD string', cat['updated_at']));
     }
     const applications = cat['applications'];
     if (!Array.isArray(applications)) {
         errors.push({ code: 'APP-002', message: 'applications_catalogue.applications must be an array' });
         return { valid: false, errors, warnings };
     }
-    // APP-008: unique app_id
+    // Schema: unique app_id
     const seenIds = new Set();
     for (let i = 0; i < applications.length; i++) {
         const rawApp = applications[i];
         const idx = `applications[${i}]`;
-        if (!rawApp || typeof rawApp !== 'object') {
-            errors.push({ code: 'APP-003', message: `${idx} must be an object` });
+        if (!rawApp || typeof rawApp !== 'object' || Array.isArray(rawApp)) {
+            errors.push(schemaFinding('applications inline', `${idx}`, 'mapping', rawApp));
             continue;
         }
         const a = rawApp;
-        // APP-003: required per-application fields
+        // Schema: required per-application fields
         if (!a['app_id'] || typeof a['app_id'] !== 'string' || !a['app_id'].trim()) {
-            errors.push({ code: 'APP-003', message: `${idx}: app_id is required` });
+            errors.push(schemaFinding('applications inline', `${idx}.app_id`, 'nonempty string', a['app_id']));
         }
         else {
             const aid = a['app_id'];
             if (seenIds.has(aid)) {
-                errors.push({ code: 'APP-008', message: `Duplicate app_id: "${aid}"` });
+                errors.push(schemaFinding('applications inline', `${idx}.app_id`, 'unique identifier', a['app_id']));
             }
             seenIds.add(aid);
         }
         if (!a['name'] || typeof a['name'] !== 'string' || !a['name'].trim()) {
-            errors.push({ code: 'APP-003', message: `${idx}: name is required` });
+            errors.push(schemaFinding('applications inline', `${idx}.name`, 'nonempty string', a['name']));
         }
         if (!a['type']) {
-            errors.push({ code: 'APP-003', message: `${idx}: type is required` });
+            errors.push(schemaFinding('applications inline', `${idx}.type`, `one of ${[...VALID_TYPES].join(", ")}`, a['type']));
         }
         if (!a['status']) {
-            errors.push({ code: 'APP-003', message: `${idx}: status is required` });
+            errors.push(schemaFinding('applications inline', `${idx}.status`, `one of ${[...VALID_STATUSES].join(", ")}`, a['status']));
         }
-        // APP-004: type enum
+        // Schema: type enum
         if (a['type'] && !VALID_TYPES.has(a['type'])) {
-            errors.push({ code: 'APP-004', message: `${idx}: type "${a['type']}" must be one of: application, integration, platform, data_store` });
+            errors.push(schemaFinding('applications inline', `${idx}.type`, `one of ${[...VALID_TYPES].join(", ")}`, a['type']));
         }
-        // APP-005: status enum (4 values)
+        // Schema: status enum (4 values)
         if (a['status'] && !VALID_STATUSES.has(a['status'])) {
-            errors.push({ code: 'APP-005', message: `${idx}: status "${a['status']}" must be one of: Draft, Active, Deprecated, Decommissioning` });
+            errors.push(schemaFinding('applications inline', `${idx}.status`, `one of ${[...VALID_STATUSES].join(", ")}`, a['status']));
         }
-        // APP-006: maturity range
+        // Schema: maturity range
         if (a['maturity'] !== undefined) {
             const m = a['maturity'];
             if (typeof m !== 'number' || !Number.isInteger(m) || m < 1 || m > 5) {
-                errors.push({ code: 'APP-006', message: `${idx}: maturity must be an integer 1–5, got "${m}"` });
+                errors.push(schemaFinding('applications inline', `${idx}.maturity`, 'integer in 1–5', a['maturity']));
             }
         }
         // VERSIONED-004: time_varying fields must live in the sidecar, not inline.
@@ -112,18 +113,18 @@ export function validateApplicationsCatalogue(input) {
                 });
             }
         }
-        // APP-009: integrations[].direction enum
+        // Schema: integrations[].direction enum
         if (Array.isArray(a['integrations'])) {
             const integrations = a['integrations'];
             for (let j = 0; j < integrations.length; j++) {
                 const rawIntg = integrations[j];
-                if (!rawIntg || typeof rawIntg !== 'object') {
-                    errors.push({ code: 'APP-009', message: `${idx}.integrations[${j}] must be an object` });
+                if (!rawIntg || typeof rawIntg !== 'object' || Array.isArray(rawIntg)) {
+                    errors.push(schemaFinding('applications inline', `${idx}.integrations[${j}]`, 'mapping', rawIntg));
                     continue;
                 }
                 const intg = rawIntg;
                 if (intg['direction'] !== undefined && !VALID_DIRECTIONS.has(intg['direction'])) {
-                    errors.push({ code: 'APP-009', message: `${idx}.integrations[${j}]: direction "${intg['direction']}" must be one of: inbound, outbound, bidirectional` });
+                    errors.push(schemaFinding('applications inline', `${idx}.integrations[${j}].direction`, 'inbound | outbound | bidirectional', intg['direction']));
                 }
                 // INT-001 — when interface_semantics: true, four fields become required.
                 if (intg['interface_semantics'] === true) {

package/dist/capability-map/validate.d.ts

@@ -1,3 +1,6 @@
+import type { ResolvedCapabilityAttributes } from './resolve-maturity.js';
 import type { ValidationError, ValidationWarning, ValidationResult } from '../validation-types.js';
 export type { ValidationError, ValidationWarning, ValidationResult };
-export declare function validateCapabilityMap(input: unknown): ValidationResult;
+export declare function validateCapabilityMap(input: unknown, options?: {
+    resolvedAttributes?: ReadonlyMap<string, ResolvedCapabilityAttributes>;
+}): ValidationResult;

package/dist/capability-map/validate.js

@@ -1,3 +1,4 @@
+import { schemaFinding } from '../schema-finding.js';
 const VALID_TYPES = new Set(['domain', 'supporting']);
 const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 // Canonical form per `IDS_AND_REFERENCES.md` §2: `CAPABILITY-V…` /
@@ -5,30 +6,24 @@ const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 // legacy form (`V1`, `H1`) is still accepted so existing maps without the
 // canonical prefix do not break; migration is tracked separately.
 const CAP_ID_RE = /^(CAPABILITY-)?(V|H)\d+(\.\d+)*$/;
-export function validateCapabilityMap(input) {
+export function validateCapabilityMap(input, options = {}) {
     const errors = [];
     const warnings = [];
-    if (!input || typeof input !== 'object') {
-        return { valid: false, errors: [{ code: 'CMAP-001', message: 'Input must be an object' }], warnings };
+    if (!input || typeof input !== 'object' || Array.isArray(input)) {
+        return { valid: false, errors: [schemaFinding('capability-map inline', '$', 'mapping', input)], warnings };
     }
     const raw = input;
-    // HDR-001/002 — DSM's own rule codes for the same header check CMAP-001
-    // already makes (api02/internal/importer/capabilities.go ValidateCapMap),
-    // added alongside it (not instead of it) so DSM can map a finding straight
-    // back onto its own import-log taxonomy while CMAP-001 stays the richer,
-    // pre-existing Studio-native code for this notation's own validator.
+    // Shared header rules have precedence over generic schema findings.
     if (!('notation' in raw)) {
-        errors.push({ code: 'CMAP-001', message: 'Missing required field: notation' });
         errors.push({ code: 'HDR-001', message: 'notation field is missing' });
     }
     else if (raw['notation'] !== 'capability-map') {
-        errors.push({ code: 'CMAP-001', message: `notation must be "capability-map", got "${raw['notation']}"` });
         errors.push({ code: 'HDR-002', message: `notation must be "capability-map", got "${raw['notation']}"` });
     }
     if (errors.length > 0)
         return { valid: false, errors, warnings };
     const map = raw['capability_map'];
-    if (!map || typeof map !== 'object') {
+    if (!map || typeof map !== 'object' || Array.isArray(map)) {
         errors.push({ code: 'CMAP-002', message: 'Missing required field: capability_map' });
         return { valid: false, errors, warnings };
     }
@@ -42,61 +37,68 @@ export function validateCapabilityMap(input) {
     if (errors.length > 0)
         return { valid: false, errors, warnings };
     if (!DATE_RE.test(m['assessment_date']))
-        errors.push({ code: 'CMAP-007', message: `capability_map.assessment_date must be YYYY-MM-DD, got "${m['assessment_date']}"` });
+        errors.push(schemaFinding('capability-map inline', 'capability_map.assessment_date', 'YYYY-MM-DD string', m['assessment_date']));
     const caps = m['capabilities'];
     if (!Array.isArray(caps)) {
         errors.push({ code: 'CMAP-002', message: 'capability_map.capabilities must be an array' });
         return { valid: false, errors, warnings };
     }
     const seenIds = new Set();
-    validateCapabilityTree(caps, 'capabilities', errors, seenIds);
+    validateCapabilityTree(caps, 'capabilities', errors, seenIds, warnings, options.resolvedAttributes);
     return { valid: errors.length === 0, errors, warnings };
 }
-function validateCapabilityTree(nodes, pathPrefix, errors, seenIds) {
+function validateCapabilityTree(nodes, pathPrefix, errors, seenIds, warnings, resolved) {
     for (let i = 0; i < nodes.length; i++) {
         const rawNode = nodes[i];
         const nodePath = `${pathPrefix}[${i}]`;
-        if (!rawNode || typeof rawNode !== 'object') {
-            errors.push({ code: 'CMAP-003', message: `${nodePath} must be an object` });
+        if (!rawNode || typeof rawNode !== 'object' || Array.isArray(rawNode)) {
+            errors.push(schemaFinding('capability-map inline', `${nodePath}`, 'mapping', rawNode));
             continue;
         }
         const node = rawNode;
         if (!node['id'] || typeof node['id'] !== 'string' || !node['id'].trim()) {
-            errors.push({ code: 'CMAP-003', message: `${nodePath}: id is required` });
+            errors.push(schemaFinding('capability-map inline', `${nodePath}.id`, 'nonempty string', node['id']));
         }
         else {
             const id = node['id'];
             if (seenIds.has(id)) {
-                errors.push({ code: 'CMAP-008', message: `Duplicate capability id: "${id}"` });
+                errors.push(schemaFinding('capability-map inline', `${nodePath}.id`, 'unique identifier', node['id']));
             }
             seenIds.add(id);
             if (!CAP_ID_RE.test(id)) {
-                errors.push({ code: 'CMAP-009', message: `${nodePath}: id "${id}" must match the canonical pattern CAPABILITY-V[n] or CAPABILITY-H[n] with optional .n segments (e.g. CAPABILITY-V1, CAPABILITY-V1.2, CAPABILITY-H1.3); the bare V[n] / H[n] form is also accepted for legacy compatibility` });
+                errors.push(schemaFinding('capability-map inline', `${nodePath}.id`, 'CAPABILITY-V[n] / CAPABILITY-H[n] (legacy V[n] / H[n]) with optional .n segments', node['id']));
             }
         }
         if (!node['name'] || typeof node['name'] !== 'string' || !node['name'].trim())
-            errors.push({ code: 'CMAP-003', message: `${nodePath}: name is required` });
-        if (node['current_maturity'] === undefined) {
-            errors.push({ code: 'CMAP-003', message: `${nodePath}: current_maturity is required` });
+            errors.push(schemaFinding('capability-map inline', `${nodePath}.name`, 'nonempty string', node['name']));
+        for (const field of ['current_maturity', 'target_maturity', 'target_date', 'owner_role']) {
+            if (node[field] !== undefined)
+                errors.push({ code: 'VERSIONED-004', path: `${nodePath}.${field}`,
+                    message: `${nodePath}.${field} belongs in ${String(node['id'])}.history.yaml, not inline.` });
+        }
+        const currentMaturity = node['current_maturity'] ?? resolved?.get(String(node['id']))?.current_maturity;
+        if (currentMaturity === undefined && resolved === undefined) {
+            warnings.push({ code: 'NOTATION-SKIP-001', path: `${nodePath}.current_maturity`,
+                message: `${nodePath}.current_maturity cannot be checked without the capability sidecar catalogue; this file remains unvalidated.` });
         }
         else {
-            const cm = node['current_maturity'];
+            const cm = currentMaturity;
             if (typeof cm !== 'number' || !Number.isInteger(cm) || cm < 1 || cm > 5)
-                errors.push({ code: 'CMAP-005', message: `${nodePath}: current_maturity must be an integer 1–5, got "${cm}"` });
+                errors.push(schemaFinding('capability-map inline', `${nodePath}.current_maturity`, 'integer in 1–5 from the sidecar at the assessment date', currentMaturity));
         }
         if (node['target_maturity'] !== undefined) {
             const tm = node['target_maturity'];
             if (typeof tm !== 'number' || !Number.isInteger(tm) || tm < 1 || tm > 5)
-                errors.push({ code: 'CMAP-006', message: `${nodePath}: target_maturity must be an integer 1–5, got "${tm}"` });
+                errors.push(schemaFinding('capability-map inline', `${nodePath}.target_maturity`, 'integer in 1–5', node['target_maturity']));
         }
         if (node['type'] !== undefined && !VALID_TYPES.has(node['type']))
-            errors.push({ code: 'CMAP-004', message: `${nodePath}: type "${node['type']}" must be one of: domain, supporting` });
+            errors.push(schemaFinding('capability-map inline', `${nodePath}.type`, `one of ${[...VALID_TYPES].join(", ")}`, node['type']));
         if (node['target_date'] !== undefined) {
             if (typeof node['target_date'] !== 'string' || !DATE_RE.test(node['target_date']))
-                errors.push({ code: 'CMAP-007', message: `${nodePath}: target_date must be YYYY-MM-DD, got "${node['target_date']}"` });
+                errors.push(schemaFinding('capability-map inline', `${nodePath}.target_date`, 'YYYY-MM-DD string', node['target_date']));
         }
         if (node['applications'] !== undefined && !Array.isArray(node['applications']))
-            errors.push({ code: 'CMAP-003', message: `${nodePath}: applications must be an array` });
+            errors.push(schemaFinding('capability-map inline', `${nodePath}.applications`, 'array', node['applications']));
         // LIFECYCLE-001/004 — DSM's own rule codes (capabilities.go
         // ValidateCapMap/validateCapMapNodes) for `valid_from`/`valid_to`, the
         // CONTRACT.md §7 primitive-lifecycle fields. Net new: this notation's own
@@ -133,10 +135,10 @@ function validateCapabilityTree(nodes, pathPrefix, errors, seenIds) {
         }
         if (node['children'] !== undefined) {
             if (!Array.isArray(node['children'])) {
-                errors.push({ code: 'CMAP-003', message: `${nodePath}: children must be an array` });
+                errors.push(schemaFinding('capability-map inline', `${nodePath}.children`, 'array', node['children']));
             }
             else {
-                validateCapabilityTree(node['children'], `${nodePath}.children`, errors, seenIds);
+                validateCapabilityTree(node['children'], `${nodePath}.children`, errors, seenIds, warnings, resolved);
             }
         }
     }

package/dist/codex/validate.js

@@ -2,7 +2,7 @@
 //
 // CODEX-001 — shape, zone, id grammar, admission envelope.
 // CODEX-002 — `type` field matches the id TYPE prefix when present.
-// CODEX-003 — external artefact frontmatter (jurisdiction, effective_date).
+// CODEX-002 — external artefact frontmatter (jurisdiction, effective_date).
 // CODEX-004 — internal artefact frontmatter (issuing_authority, effective_date for
 //             POLICY/INTERNAL_STANDARD; statement, rationale for PRINCIPLE — §4.1).
 // CODEX-005 — jurisdiction must match the parent folder under codex/external/
@@ -70,7 +70,7 @@ export function validateCodex(input, options = {}) {
     if (artefactType && EXTERNAL_CODEX_TYPES.includes(artefactType)) {
         const jurisdiction = typeof c.jurisdiction === 'string' ? c.jurisdiction.trim() : '';
         if (!jurisdiction) {
-            errors.push({ code: 'CODEX-003', message: 'jurisdiction is required for external codex artefacts.', path: 'jurisdiction' });
+            errors.push({ code: 'CODEX-002', message: 'jurisdiction is required for external codex artefacts.', path: 'jurisdiction' });
         }
         else if (options.folderJurisdiction && jurisdiction.toLowerCase() !== options.folderJurisdiction.toLowerCase()) {
             errors.push({
@@ -80,7 +80,7 @@ export function validateCodex(input, options = {}) {
             });
         }
         if (typeof c.effective_date !== 'string' || c.effective_date.trim() === '') {
-            errors.push({ code: 'CODEX-003', message: 'effective_date is required for external codex artefacts.', path: 'effective_date' });
+            errors.push({ code: 'CODEX-002', message: 'effective_date is required for external codex artefacts.', path: 'effective_date' });
         }
     }
     if (artefactType && INTERNAL_CODEX_TYPES.includes(artefactType)) {

package/dist/compliance/canon-catalog.js

@@ -44,7 +44,7 @@ export function buildComplianceScan(docs) {
     const catalogMap = new Map();
     const pathById = new Map();
     for (const { path, data } of docs) {
-        const ingested = ingestComplianceDoc(complianceCanon, data);
+        const ingested = ingestComplianceDoc(complianceCanon, data, path);
         if (ingested)
             pathById.set(ingested, path);
         const admitted = admitDocumentToCatalog(catalogMap, data);

package/dist/compliance/classify.d.ts

@@ -1,3 +1,4 @@
+import type { ChainRecord, ChainFinding } from './types.js';
 import type { IndexAssertion, IndexRequirement, IndexVerification, IndexNeed, IndexValidation } from './types.js';
 export interface ComplianceProduct {
     id: string;
@@ -11,6 +12,8 @@ export interface ComplianceCodexDoc {
 }
 /** The bucketed result of scanning a repo for compliance canon. */
 export interface ComplianceCanon {
+    records: ChainRecord[];
+    findings: ChainFinding[];
     products: ComplianceProduct[];
     requirements: IndexRequirement[];
     assertions: IndexAssertion[];
@@ -49,4 +52,4 @@ export declare function emptyCanon(): ComplianceCanon;
  * its id duplicates one already ingested into the same bucket (see
  * `canon.duplicateIds`).
  */
-export declare function ingestComplianceDoc(canon: ComplianceCanon, doc: unknown): string | null;
+export declare function ingestComplianceDoc(canon: ComplianceCanon, doc: unknown, sourcePath?: string): string | null;

package/dist/compliance/classify.js

@@ -2,8 +2,11 @@
 // for "what is a compliance artefact" — used by both the Studio extension scan
 // (webview previews) and the CLI scan (`export-compliance`), so the recognition
 // rules live once. Pure: takes a parsed YAML document, no IO.
+import { typeOfId } from '../typed-id.js';
 export function emptyCanon() {
     return {
+        records: [],
+        findings: [],
         products: [],
         requirements: [],
         assertions: [],
@@ -40,7 +43,8 @@ function pushUnique(canon, list, item) {
  * its id duplicates one already ingested into the same bucket (see
  * `canon.duplicateIds`).
  */
-export function ingestComplianceDoc(canon, doc) {
+export function ingestComplianceDoc(canon, doc, sourcePath = '') {
+    retainChainRecord(canon, doc, sourcePath);
     if (doc === null || typeof doc !== 'object' || Array.isArray(doc))
         return null;
     const d = doc;
@@ -128,3 +132,19 @@ export function ingestComplianceDoc(canon, doc) {
     }
     return null;
 }
+/** Retain malformed values and cross-type duplicates without changing legacy buckets. */
+function retainChainRecord(canon, doc, sourcePath) {
+    if (!doc || typeof doc !== 'object' || Array.isArray(doc)) {
+        canon.findings.push({ id: `${sourcePath}:document`, owner: sourcePath, field: '',
+            code: 'INTAKE', message: 'Expected a document mapping', reference: false, severity: 'error' });
+        return;
+    }
+    const raw = structuredClone(doc);
+    if (typeof raw.id !== 'string' || !raw.id.trim()) {
+        if ('id' in raw || 'zone' in raw || ['requirement', 'verification', 'need', 'product', 'release', 'relation', 'driver'].includes(String(raw.notation)))
+            canon.findings.push({ id: `${sourcePath}:id`, owner: sourcePath,
+                field: 'id', code: 'INTAKE', message: 'Missing record identity', reference: false, severity: 'error' });
+        return;
+    }
+    canon.records.push({ id: raw.id, type: typeOfId(raw.id) ?? '', sourcePath, raw });
+}