@wairon/cli 5.1.1-dev.92 → 5.1.1-dev.94

package/dist/index.js

@@ -3580,6 +3580,7 @@ __export(src_exports, {
   deregisterPackRef: () => deregisterPackRef,
   deriveExecutionProfile: () => deriveExecutionProfile,
   derivedDocPaths: () => derivedDocPaths,
+  describeProject: () => describeProject,
   detectDomainCandidates: () => detectDomainCandidates,
   diagnoseProjectPacks: () => diagnoseProjectPacks,
   diagramSetIndex: () => diagramSetIndex,
@@ -3621,6 +3622,7 @@ __export(src_exports, {
   getRequestParentReach: () => getRequestParentReach,
   getRequestProjectRoot: () => getRequestProjectRoot,
   getStatusReport: () => getStatusReport,
+  getWriteReach: () => getWriteReach,
   globalGuideFilePath: () => globalGuideFilePath,
   globalPacksDir: () => globalPacksDir,
   globalPacksEnabled: () => globalPacksEnabled,
@@ -3792,6 +3794,8 @@ __export(src_exports, {
   writeFileIfChanged: () => writeFileIfChanged,
   writeJsonFile: () => writeJsonFile,
   writeLockRecord: () => writeLockRecord,
+  writeReachDenials: () => writeReachDenials,
+  writeReachPermits: () => writeReachPermits,
   writeRootGuideDelegator: () => writeRootGuideDelegator,
   writeYamlFile: () => writeYamlFile
 });
@@ -3861,6 +3865,18 @@ function listFilesRecursive(dirPath, ext) {
   return files;
 }
 var projectRootOverride = null;
+var sameRoot = (a, b) => path.resolve(a) === path.resolve(b);
+function writeReachPermits(reach2, root, subsystemId) {
+  const own = subsystemId === null ? void 0 : reach2.subsystems.find((s) => s.subsystemId === subsystemId && sameRoot(s.root, root));
+  if (own) return own.writable;
+  return !reach2.unwritableRoots.some((r) => sameRoot(r, root));
+}
+function writeReachDenials(reach2, root) {
+  return reach2.subsystems.filter((s) => !s.writable && sameRoot(s.root, root));
+}
+function getWriteReach() {
+  return requestRootStore.getStore()?.writeReach ?? null;
+}
 var requestRootStore = new import_node_async_hooks.AsyncLocalStorage();
 function currentRootBinding() {
   return requestRootStore.getStore();
@@ -3876,7 +3892,8 @@ function runWithProjectBinding(dir, reach2, fn) {
       parentReach: reach2.parentReach,
       ...reach2.narrowed ? { narrowed: true } : {},
       ...reach2.unwritableRoots ? { unwritableRoots: reach2.unwritableRoots.map((r) => path.resolve(r)) } : {},
-      ...reach2.hostedLookup ? { hostedLookup: reach2.hostedLookup } : {}
+      ...reach2.hostedLookup ? { hostedLookup: reach2.hostedLookup } : {},
+      ...reach2.writeReach ? { writeReach: reach2.writeReach } : {}
     },
     fn
   );
@@ -4133,21 +4150,6 @@ var ExecutionBudgetSchema = import_zod.z.object({
   allowNestedDelegation: import_zod.z.boolean(),
   mcp: McpAccessSchema
 });
-function summarize(budget, profile) {
-  const lines = [
-    `- **Work shape**: ${profile.breadth} breadth, ${profile.reasoningDepth} reasoning${profile.writes ? "" : ", read-only"}${profile.delegates ? ", delegating" : ""}`,
-    `- **Why**: ${profile.rationale}`
-  ];
-  if (budget.modelTier) lines.push(`- **Capability tier**: ${budget.modelTier}`);
-  if (budget.effort) lines.push(`- **Effort**: ${budget.effort}`);
-  if (budget.maxTurns !== void 0) {
-    lines.push(`- **Turn ceiling**: ${budget.maxTurns} (a circuit breaker \u2014 hitting it should read as a scoping error, not a limit to work up to)`);
-  }
-  lines.push(`- **Tool grant**: ${budget.toolClass}`);
-  lines.push(`- **May delegate further**: ${budget.allowNestedDelegation ? "yes" : "no"}`);
-  lines.push(`- **MCP access**: ${budget.mcp}`);
-  return lines;
-}
 var BudgetTierSchema = import_zod.z.enum(["off", "free", "default", "trade", "aggressive"]);
 var ExecutionConfigSchema = import_zod.z.object({
   /**
@@ -4825,16 +4827,6 @@ var ProjectConfigSchema = import_zod3.z.object({
    * Can also be set via WAIRON_TEMPLATES_DIR environment variable.
    */
   globalTemplatesDir: import_zod3.z.string().optional(),
-  /**
-   * Tracks whether the wairon usage guide has been injected into each target's
-   * AI tool configuration files so the tool knows how to use wairon.
-   */
-  aiGuide: import_zod3.z.object({
-    claudeGlobal: import_zod3.z.boolean().default(false),
-    claudeLocal: import_zod3.z.boolean().default(false),
-    geminiGlobal: import_zod3.z.boolean().default(false),
-    geminiLocal: import_zod3.z.boolean().default(false)
-  }).optional(),
   /** Created by wairon at init time */
   createdAt: import_zod3.z.string().datetime(),
   updatedAt: import_zod3.z.string().datetime()
@@ -5698,6 +5690,9 @@ function registryOver(store, root) {
     setProjectType(projectType) {
       save({ ...current2(), projectType });
     },
+    describeProject(name, description) {
+      save({ ...current2(), name, ...description !== void 0 ? { description } : {} });
+    },
     recordProfileSelection(selection) {
       save({ ...current2(), profileSelection: selection });
     },
@@ -6063,6 +6058,9 @@ function projectConfigRepositoryOver(adapter, rootDir) {
     setProjectType(projectType) {
       registry.setProjectType(projectType);
     },
+    describeProject(name, description) {
+      registry.describeProject(name, description);
+    },
     recordProfileSelection(selection) {
       registry.recordProfileSelection(selection);
     },
@@ -6125,7 +6123,10 @@ function projectConfigRepositoryOver(adapter, rootDir) {
 function projectConfigRepositoryAt(rootDir) {
   return projectConfigRepositoryOver(projectConfigFsAdapterAt(rootDir), rootDir);
 }
-var bound = () => projectConfigRepositoryAt(getProjectRoot());
+var bound = () => {
+  const rootDir = getProjectRoot();
+  return projectConfigRepositoryOver(projectConfigFsAdapterAt(rootDir), rootDir);
+};
 var projectConfigRepository = {
   load() {
     return bound().load();
@@ -6151,6 +6152,9 @@ var projectConfigRepository = {
   setProjectType(projectType) {
     bound().setProjectType(projectType);
   },
+  describeProject(name, description) {
+    bound().describeProject(name, description);
+  },
   recordProfileSelection(selection) {
     bound().recordProfileSelection(selection);
   },
@@ -6418,19 +6422,19 @@ function withSortedMaps(record) {
 var fs5 = __toESM(require("fs"));
 var path7 = __toESM(require("path"));
 var SPEC_FILE_EXTENSION = ".yaml";
-function readSpecFile(filePath) {
-  return readYamlFile(filePath);
+function readSpecFile(specPath) {
+  return readYamlFile(specPath);
 }
-function writeSpecFile(filePath, document) {
-  writeYamlFile(filePath, document);
+function writeSpecFile(specPath, document) {
+  writeYamlFile(specPath, document);
 }
 function listSpecFiles(specsDir) {
   return listFilesRecursive(specsDir, SPEC_FILE_EXTENSION);
 }
-function removeSpecFile(filePath, specsRoot) {
-  if (!fs5.existsSync(filePath)) return false;
-  fs5.unlinkSync(filePath);
-  pruneEmptyDirs(path7.dirname(filePath), path7.resolve(specsRoot));
+function removeSpecFile(specPath, specsRoot) {
+  if (!fs5.existsSync(specPath)) return false;
+  fs5.unlinkSync(specPath);
+  pruneEmptyDirs(path7.dirname(specPath), path7.resolve(specsRoot));
   return true;
 }
 function pruneEmptyDirs(dir, specsRoot) {
@@ -14025,8 +14029,8 @@ function canonicalReferences(snapshot) {
     types: snapshot.types.map((def) => ({ ...def, fields: def.fields.map((f) => ({ ...f, type: canon(f.type) })) }))
   };
 }
-function listSnapshots(rootDir = getProjectRoot()) {
-  const dir = surfacesDir(rootDir);
+function listSnapshots() {
+  const dir = surfacesDir(getProjectRoot());
   if (!fs9.existsSync(dir)) return [];
   const out = [];
   for (const file of fs9.readdirSync(dir)) {
@@ -14041,8 +14045,8 @@ function listSnapshots(rootDir = getProjectRoot()) {
 function snapshotFilename(projectName) {
   return `${safeFilenamePart(projectName)}.yaml`;
 }
-function removeSnapshot(projectName, rootDir = getProjectRoot()) {
-  const dir = surfacesDir(rootDir);
+function removeSnapshot(projectName) {
+  const dir = surfacesDir(getProjectRoot());
   const direct = path13.join(dir, snapshotFilename(projectName));
   if (fs9.existsSync(direct)) {
     fs9.unlinkSync(direct);
@@ -14362,11 +14366,11 @@ function listExternals() {
 }
 
 // src/core/surface-portal.ts
-function listSnapshots2(rootDir) {
-  return listSnapshots(rootDir);
+function listSnapshots2() {
+  return listSnapshots();
 }
-function removeSnapshot2(projectName, rootDir) {
-  return removeSnapshot(projectName, rootDir);
+function removeSnapshot2(projectName) {
+  return removeSnapshot(projectName);
 }
 function listFamilyPins2() {
   return listFamilyPins();
@@ -15081,7 +15085,7 @@ function defaultTargetConfig(type) {
     enabled: true
   };
 }
-var WAIRON_VERSION = "5.1.1-dev.92";
+var WAIRON_VERSION = "5.1.1-dev.94";
 var GITHUB_REPO = "SYW-Apps/Waffle-AIron";
 var ARCHITECT_AGENT_ID = "agent-architect";
 var ARCHITECT_TEMPLATE_ID = "architect";
@@ -15528,13 +15532,13 @@ function resolvePackRef(ref, projectRoot) {
   }
   return resolved;
 }
-function readManifest(target, projectRoot) {
+function readManifest(target, resolveFrom) {
   if (isYamlPath(target)) {
     const raw = readYamlFile(target);
     if (raw == null) throw new Error("file not found or empty");
     return { ...DeclarativePackSchema.parse(raw), rules: [] };
   }
-  const req = (0, import_module.createRequire)(path17.join(projectRoot, "package.json"));
+  const req = (0, import_module.createRequire)(path17.join(resolveFrom, "package.json"));
   const modRaw = req(target);
   const mod = modRaw?.default ?? modRaw;
   const parsed = DeclarativePackSchema.parse({
@@ -18854,7 +18858,9 @@ var facadeForwardingRule = {
             "FACADE_FORWARDING",
             `Facade method "${method.name}" of ${comp.componentType} "${comp.id}" (implementation "${impl.id}") must be pure 1:1 forwarding \u2014 exactly one call step to an owned member (${comp.owns.join(", ") || "none declared"}) \u2014 but its narrative ${problem}. Move the logic into a member block, or lint.allow a deliberate exception.`,
             impl.id,
-            isDraftCtx
+            isDraftCtx,
+            void 0,
+            { at: method.name }
           );
         }
       }
@@ -21750,11 +21756,31 @@ var exportConformanceRule = {
         );
       }
     }
+    const typeMethodsAt = /* @__PURE__ */ new Map();
     for (const type of ctx.types) {
       if (!type.sourcePath) continue;
       promise(type.sourcePath, type.symbol ?? type.name);
       for (const method of type.methods ?? []) {
-        promise(method.sourcePath ?? type.sourcePath, method.symbol ?? method.name);
+        const at = pathKey(method.sourcePath ?? type.sourcePath);
+        const name = method.symbol ?? method.name;
+        promise(at, name);
+        let names = typeMethodsAt.get(at);
+        if (!names) typeMethodsAt.set(at, names = /* @__PURE__ */ new Set());
+        names.add(name);
+      }
+    }
+    for (const file of realization.paths) {
+      const facts = code.factsAt(file);
+      if (!facts || facts.status !== "analyzed" || facts.analysisGrade !== "exact") continue;
+      for (const binding of facts.reexportBindings ?? []) {
+        const target = resolveImport(file, binding.from, code.paths);
+        const methods = target ? typeMethodsAt.get(target) : void 0;
+        if (!methods) continue;
+        if (binding.local === "*") {
+          for (const name of methods) promise(file, name);
+        } else if (methods.has(binding.local)) {
+          promise(file, binding.exported);
+        }
       }
     }
     const takenFrom = /* @__PURE__ */ new Map();
@@ -24156,7 +24182,7 @@ function publishesFrom(module2, name, target, symbol, readReexports, visited = /
   }
   return false;
 }
-function findTestsReferencing(methods, projectRoot, testRoots = []) {
+function findTestsReferencing(methods, projectRoot, testRoots) {
   const scanned = readTestFiles(testRoots, projectRoot);
   if (scanned.length === 0) return [];
   const indiscriminateAbove = scanned.length / 10;
@@ -25147,7 +25173,7 @@ function boundProjectIdentity() {
   const lockedProjectId = readLockRecord()?.projectId;
   return projectIdentity(config, lockedProjectId);
 }
-function findTestsReferencing2(methods, projectRoot, testRoots = []) {
+function findTestsReferencing2(methods, projectRoot, testRoots) {
   return findTestsReferencing(methods, projectRoot, testRoots);
 }
 function issue(severity, code, message, agentId, specId) {
@@ -26846,6 +26872,34 @@ var PartReadOnly = class extends WaironError {
     this.name = "PartReadOnly";
   }
 };
+var SubsystemWriteDenied = class extends WaironError {
+  constructor(message) {
+    super(message);
+    this.name = "SubsystemWriteDenied";
+  }
+};
+function deniedOwners(reach2, owners) {
+  const seen = /* @__PURE__ */ new Set();
+  const denied = [];
+  for (const o of owners) {
+    const key = `${path21.resolve(o.root)}|${o.subsystemId ?? ""}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    if (writeReachPermits(reach2, o.root, o.subsystemId)) continue;
+    const rule = o.subsystemId === null ? void 0 : reach2.subsystems.find((s) => s.subsystemId === o.subsystemId && path21.resolve(s.root) === path21.resolve(o.root));
+    denied.push(o.subsystemId === null ? `project "${o.project}" itself (a spec of no subsystem, decided at the project rung)` : `subsystem "${o.subsystemId}" of project "${o.project}" (decided by ${rule?.decidedBy ?? "the project rung"})`);
+  }
+  return denied;
+}
+function assertSpecWritesPermitted(owners, what) {
+  const reach2 = getWriteReach();
+  if (!reach2) return;
+  const denied = deniedOwners(reach2, owners);
+  if (denied.length === 0) return;
+  throw new SubsystemWriteDenied(
+    `SubsystemWriteDenied: ${what} would change ${denied.length === 1 ? "a spec" : "specs"} this request may not change \u2014 ${denied.join("; ")}. Nothing was written.`
+  );
+}
 function unknownKeysIn(raw, parsed, at, out) {
   if (Array.isArray(raw)) {
     if (!Array.isArray(parsed) || parsed.length !== raw.length) return;
@@ -28856,6 +28910,92 @@ var SpecWorkspace = class {
       `The spec file ${file} belongs to the part "${held.part.alias}", fetched from git (${held.source?.git ?? "its repository"} at ${held.part.commit ?? "its pinned commit"}): a git part is read-only here. Edit it in its own repository, commit it there, and take it in with \`wairon member update ${held.part.alias}\`. Nothing was written.`
     );
   }
+  /**
+   * spec_registry.save step 5 / delete step 2: inside a hosted request, may the
+   * request change this spec? Judged against the request's write reach with the
+   * home's project root and the spec's owning subsystem — the document written
+   * and, when a stored document is replaced or removed, the one stored (a
+   * component moved out of a subsystem changes that subsystem too). Outside a
+   * hosted request nothing is judged.
+   */
+  assertHomeInReach(file, kind, document) {
+    if (!getWriteReach()) return;
+    const raw = this.homeRootOf(file);
+    const owners = [];
+    if (document !== null) owners.push(this.documentOwner(raw, kind, document));
+    if (pathExists(file)) {
+      try {
+        owners.push(this.documentOwner(raw, kind, readSpecFile(file)));
+      } catch {
+      }
+    }
+    assertSpecWritesPermitted(owners, `writing ${kind} spec ${path21.basename(path21.dirname(file))}/${path21.basename(file)}`);
+  }
+  /** The project root a spec file is homed under: the root whose specs folder, or one of whose parts' folders, holds it (deepest wins). */
+  homeRootOf(file) {
+    this.scanAll();
+    let best;
+    let depth = -1;
+    for (const raw of this.cachedRawRoots) {
+      const homes = [aiPathsAt(raw.dir).specsDir(), ...raw.record.parts.map((p) => p.directory).filter((d) => d !== void 0)];
+      for (const home of homes) {
+        if (isWithin(home, file) && path21.resolve(home).length > depth) {
+          best = raw;
+          depth = path21.resolve(home).length;
+        }
+      }
+    }
+    if (!best) return { dir: this.rootDir, namespace: "", project: path21.basename(this.rootDir) };
+    return { dir: best.dir, namespace: best.record.namespace, project: idOf(best) ?? (best.record.namespace || path21.basename(best.dir)) };
+  }
+  /**
+   * The owner of one spec DOCUMENT as stored in its root (its references local
+   * to that root): a subsystem is its own, a component or type names its
+   * subsystem, an interface or implementation follows its component; the L0, a
+   * system-level type and a type group belong to no subsystem.
+   */
+  documentOwner(root, kind, document) {
+    const doc = document ?? {};
+    const local = (v) => typeof v === "string" && v ? splitNamespace(v).localId : null;
+    const key = (v) => typeof v === "string" && v ? keyIn(root.namespace, splitNamespace(v).localId) : null;
+    let subsystemId = null;
+    if (kind === "subsystem") subsystemId = local(doc.id);
+    else if (kind === "component" || kind === "type") subsystemId = local(doc.subsystem);
+    else if (kind === "interface") subsystemId = this.componentSubsystem(key(doc.component));
+    else if (kind === "implementation") {
+      const contract = key(doc.contract);
+      subsystemId = this.componentSubsystem(contract ? this.loadInterfaceSpec(contract)?.component ?? null : null);
+    }
+    return { root: root.dir, project: root.project, subsystemId };
+  }
+  /** The local id of a component's subsystem, by the component's key; null when no such component is stored. */
+  componentSubsystem(componentKey) {
+    if (!componentKey) return null;
+    const subsystem = this.loadComponentSpec(componentKey)?.subsystem;
+    return subsystem ? splitNamespace(subsystem).localId : null;
+  }
+  /**
+   * The owner of one IN-MEMORY spec (its references keys, as the loader binds
+   * them) — what a multi-spec write (a rename, a method move) judges before its
+   * first write. `staged` answers a spec the write itself creates.
+   */
+  specOwner(kind, spec, staged) {
+    this.scanAll();
+    const id = kind === "system" ? "" : String(spec?.id ?? "");
+    const namespace = (kind === "system" ? "" : this.ownerKeyOf(id)) ?? "";
+    const raw = this.cachedRawRoots.find((r) => r.record.namespace === namespace);
+    const root = raw ? { dir: raw.dir, project: idOf(raw) ?? (namespace || path21.basename(raw.dir)) } : { dir: this.rootDir, project: path21.basename(this.rootDir) };
+    const localOfKey = (v) => v ? splitNamespace(v).localId : null;
+    let subsystemId = null;
+    if (kind === "subsystem") subsystemId = localOfKey(id);
+    else if (kind === "component" || kind === "type") subsystemId = localOfKey(spec?.subsystem);
+    else if (kind === "interface") subsystemId = this.componentSubsystem(spec?.component ?? null);
+    else if (kind === "implementation" && spec?.contract) {
+      const component = this.loadInterfaceSpec(spec.contract)?.component ?? staged?.("interface", spec.contract)?.component ?? null;
+      subsystemId = this.componentSubsystem(component);
+    }
+    return { root: root.dir, project: root.project, subsystemId };
+  }
   /**
    * The key one spec file is approved under (stage 8): its path from the bound
    * root, POSIX — or, for a part's file, `members/<alias>/<path inside the
@@ -28866,13 +29006,15 @@ var SpecWorkspace = class {
     return approvalKeyIn(file, this.rootDir, this.cachedRoots[0]?.parts ?? []);
   }
   /** The file store's write, at a home the writer resolved — a part's folder included, a git part's refused. */
-  writeHome(file, document) {
+  writeHome(file, document, kind) {
     this.assertHomeWritable(file);
+    this.assertHomeInReach(file, kind, document);
     writeSpecFile(file, document);
   }
   /** The file store's delete, pruning up to the specs folder the file lives in (its part's, for a part's file). */
-  removeHome(file) {
+  removeHome(file, kind) {
     this.assertHomeWritable(file);
+    this.assertHomeInReach(file, kind, null);
     const part = this.partHolding(file)?.part;
     return removeSpecFile(file, part?.directory ? aiPathsAt(part.directory).specsDir() : this.paths.specsDir());
   }
@@ -29223,6 +29365,7 @@ var SpecWorkspace = class {
   }
   saveSystemSpec(spec) {
     const p = this.paths.specsSystem();
+    this.assertHomeInReach(p, "system", spec);
     ensureDir(path21.dirname(p));
     writeSpecFile(p, parseOrThrow(SystemSpecSchema, spec, "system", spec.name));
     invalidateSpecCache();
@@ -29373,12 +29516,12 @@ var SpecWorkspace = class {
       }
     }
     specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-    this.writeHome(p, parseOrThrow(SubsystemSpecSchema, specToWrite, "subsystem", spec.id));
+    this.writeHome(p, parseOrThrow(SubsystemSpecSchema, specToWrite, "subsystem", spec.id), "subsystem");
     invalidateSpecCache();
   }
   deleteSubsystemSpec(id) {
     const p = this.getSubsystemPath(id);
-    if (!this.removeHome(p)) return false;
+    if (!this.removeHome(p, "subsystem")) return false;
     invalidateSpecCache();
     return true;
   }
@@ -29433,14 +29576,14 @@ var SpecWorkspace = class {
       );
     }
     specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-    this.writeHome(p, parseOrThrow(ComponentSpecSchema, specToWrite, "component", spec.id));
+    this.writeHome(p, parseOrThrow(ComponentSpecSchema, specToWrite, "component", spec.id), "component");
     invalidateSpecCache();
     this.normalizeComponentLayout();
     return notices;
   }
   deleteComponentSpec(id) {
     const p = this.getComponentPath(id);
-    if (!this.removeHome(p)) return false;
+    if (!this.removeHome(p, "component")) return false;
     invalidateSpecCache();
     return true;
   }
@@ -29562,13 +29705,13 @@ var SpecWorkspace = class {
       }
     }
     specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-    this.writeHome(p, parseOrThrow(InterfaceSpecSchema, specToWrite, "interface", spec.id));
+    this.writeHome(p, parseOrThrow(InterfaceSpecSchema, specToWrite, "interface", spec.id), "interface");
     invalidateSpecCache();
     return notices;
   }
   deleteInterfaceSpec(id) {
     const p = this.getInterfacePath(id);
-    if (!this.removeHome(p)) return false;
+    if (!this.removeHome(p, "interface")) return false;
     invalidateSpecCache();
     return true;
   }
@@ -29618,13 +29761,13 @@ var SpecWorkspace = class {
       }
     }
     specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-    this.writeHome(p, parseOrThrow(ImplementationSpecSchema, specToWrite, "implementation", spec.id));
+    this.writeHome(p, parseOrThrow(ImplementationSpecSchema, specToWrite, "implementation", spec.id), "implementation");
     invalidateSpecCache();
     return notices;
   }
   deleteImplementationSpec(id) {
     const p = this.getImplementationPath(id);
-    if (!this.removeHome(p)) return false;
+    if (!this.removeHome(p, "implementation")) return false;
     invalidateSpecCache();
     return true;
   }
@@ -29670,14 +29813,14 @@ var SpecWorkspace = class {
       }
     }
     specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-    this.writeHome(p, parseOrThrow(TypeSpecSchema, specToWrite, "type", spec.id));
+    this.writeHome(p, parseOrThrow(TypeSpecSchema, specToWrite, "type", spec.id), "type");
     invalidateSpecCache();
     return notices;
   }
   deleteTypeSpec(id) {
     const spec = this.loadTypeSpec(id);
     const p = this.getTypePath(id, spec?.subsystem, spec?.group);
-    if (!this.removeHome(p)) return false;
+    if (!this.removeHome(p, "type")) return false;
     invalidateSpecCache();
     return true;
   }
@@ -29700,12 +29843,12 @@ var SpecWorkspace = class {
       specToWrite.createdAt = existing.createdAt;
     }
     specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-    this.writeHome(p, parseOrThrow(GroupSpecSchema, specToWrite, "group", spec.id));
+    this.writeHome(p, parseOrThrow(GroupSpecSchema, specToWrite, "group", spec.id), "group");
     invalidateSpecCache();
   }
   deleteGroupSpec(id) {
     const p = this.getGroupPath(id);
-    if (!this.removeHome(p)) return false;
+    if (!this.removeHome(p, "group")) return false;
     invalidateSpecCache();
     return true;
   }
@@ -29903,7 +30046,7 @@ var SpecWorkspace = class {
       );
     }
     if (JSON.stringify(document) === JSON.stringify(stored)) return false;
-    this.writeHome(file, document);
+    this.writeHome(file, document, kind);
     invalidateSpecCache();
     return true;
   }
@@ -30817,6 +30960,7 @@ var SpecWorkspace = class {
       }
     }
     const carried = projectConfigRepository.rekeyCarried(rename, true);
+    this.assertMoveInReach(from, to, plan6, carried.length > 0);
     if (dryRun) {
       const edits2 = moveChangeReports([...plan6.edits.values()], true);
       return {
@@ -30856,6 +31000,14 @@ var SpecWorkspace = class {
       carried
     };
   }
+  /** Refuse a method move, naming every subsystem it may not change, before anything is written. */
+  assertMoveInReach(from, to, plan6, rekeysRegister) {
+    if (!getWriteReach()) return;
+    const staged = (kind, id) => plan6.edits.get(`${kind}:${id}`)?.after;
+    const owners = [...plan6.edits.values()].flatMap((e) => [e.before, e.after].filter((s) => s !== null && s !== void 0).map((s) => this.specOwner(e.kind, s, staged)));
+    if (rekeysRegister) owners.push(this.specOwner("system", null));
+    assertSpecWritesPermitted(owners, `moving methods from "${from}" to "${to}"`);
+  }
   /**
    * Rekey every lint allow keyed on a moved method, staging each spec it
    * changes like any other reference the move follows. An allow anchored at a
@@ -31504,6 +31656,9 @@ function removePackSelection(packName) {
 function setProjectType(projectType) {
   projectConfigRepository.setProjectType(projectType);
 }
+function describeProject(name, description) {
+  projectConfigRepository.describeProject(name, description);
+}
 function recordProfileSelection(selection) {
   projectConfigRepository.recordProfileSelection(selection);
 }
@@ -31586,6 +31741,14 @@ function normalizeReferences(kind, id) {
 function rewriteReferences(kind, id, edits) {
   return current().respellReferences(kind, id, edits);
 }
+function assertSpecsInReach(targets, what, projectRung = false) {
+  if (!getWriteReach()) return;
+  const ws = current();
+  const writable = ["system", "subsystem", "component", "interface", "implementation", "type"];
+  const owners = targets.map((t) => ws.specOwner(t.kind, t.kind === "system" ? null : (writable.includes(t.kind) ? ws.load(t.kind, t.id) : null) ?? { id: t.id }));
+  if (projectRung) owners.push(ws.specOwner("system", null));
+  assertSpecWritesPermitted(owners, what);
+}
 function moveMethods(from, to, methods, hooks, dryRun) {
   return current().moveMethods(from, to, methods, hooks, dryRun);
 }
@@ -33151,7 +33314,7 @@ function restateReExports(from, to) {
     publicInterfaces: entries.map((e) => e.from === from ? { ...e, from: to } : e)
   });
 }
-function rewriteRefFields(specsDir, remap, excludeDir) {
+function rewriteRefFields(specsDir, remap, excludeDir, dryRun = false) {
   const rewritten = [];
   for (const file of listFilesRecursive(specsDir, ".yaml")) {
     if (excludeDir && isWithinDir2(excludeDir, file)) continue;
@@ -33164,12 +33327,12 @@ function rewriteRefFields(specsDir, remap, excludeDir) {
     if (!raw || typeof raw !== "object") continue;
     const kind = specKind(raw);
     if (!rewriteSpecRefs(raw, remap) || !kind) continue;
-    writeYamlFile(file, raw);
+    if (!dryRun) writeYamlFile(file, raw);
     rewritten.push({ kind, id: kind === "system" ? "system" : String(raw.id) });
   }
   return rewritten;
 }
-function rekeyLintAllows(specsDir, rename) {
+function rekeyLintAllows(specsDir, rename, dryRun = false) {
   const rewritten = [];
   for (const file of listFilesRecursive(specsDir, ".yaml")) {
     let raw;
@@ -33200,7 +33363,7 @@ function rekeyLintAllows(specsDir, rename) {
       }
     }
     if (!changed) continue;
-    writeYamlFile(file, raw);
+    if (!dryRun) writeYamlFile(file, raw);
     rewritten.push({ kind, id: specId });
   }
   return rewritten;
@@ -33278,15 +33441,22 @@ function renameComponent(componentId, newId) {
     specs: renamed.map(({ from, to }) => ({ from, to })),
     components: [{ from: componentId, to: newId }]
   };
-  projectConfigRepository.rekeyCarried(rename, true);
-  const rewrittenRefs = rewriteRefFields(aiPathsAt(getProjectRoot()).specsDir(), (ref, position) => {
+  const registerEdits = projectConfigRepository.rekeyCarried(rename, true);
+  const remap = (ref, position) => {
     if (position === "component" || position === "entity-class" || position === "auth-source") {
       return ref === componentId ? newId : ref;
     }
     if (position === "interface" && ref === movingInterface?.id) return interfaceId;
     return ref;
-  });
-  const allowsRekeyed = rekeyLintAllows(aiPathsAt(getProjectRoot()).specsDir(), rename);
+  };
+  const specsDir = aiPathsAt(getProjectRoot()).specsDir();
+  assertSpecsInReach(
+    [...renamed.map(({ kind, from }) => ({ kind, id: from })), ...rewriteRefFields(specsDir, remap, void 0, true), ...rekeyLintAllows(specsDir, rename, true)],
+    `renaming component "${componentId}"`,
+    Array.isArray(registerEdits) && registerEdits.length > 0
+  );
+  const rewrittenRefs = rewriteRefFields(specsDir, remap);
+  const allowsRekeyed = rekeyLintAllows(specsDir, rename);
   const rewritten = [...new Set([...rewrittenRefs, ...allowsRekeyed].filter((spec) => !renamed.some((moved) => moved.kind === spec.kind && moved.from === spec.id)).map((spec) => spec.id))];
   invalidateSpecCache();
   moveRenamedSpecs(componentId, newId, component, movingInterface, movingImplementation);
@@ -33376,7 +33546,18 @@ function renameMethod(componentId, methodName, newName, pinSymbol) {
       ]
     }]
   };
-  projectConfigRepository.rekeyCarried(rename, true);
+  const registerEdits = projectConfigRepository.rekeyCarried(rename, true);
+  const methodRemap = (ref, position, owner) => position === "method" && owner === componentId && ref === methodName ? newName : ref;
+  const reachDir = aiPathsAt(getProjectRoot()).specsDir();
+  assertSpecsInReach(
+    [
+      ...(rename.methods?.[0]?.specs ?? []).map((id) => ({ kind: moving.some((i) => i.id === id) ? "interface" : "implementation", id })),
+      ...rewriteRefFields(reachDir, methodRemap, void 0, true),
+      ...rekeyLintAllows(reachDir, rename, true)
+    ],
+    `renaming method "${componentId}.${methodName}"`,
+    Array.isArray(registerEdits) && registerEdits.length > 0
+  );
   for (const contract of moving) {
     saveInterfaceSpec({
       ...contract,
@@ -33399,7 +33580,7 @@ function renameMethod(componentId, methodName, newName, pinSymbol) {
   }
   invalidateSpecCache();
   const specsDir = aiPathsAt(getProjectRoot()).specsDir();
-  const retargeted = rewriteRefFields(specsDir, (ref, position, owner) => position === "method" && owner === componentId && ref === methodName ? newName : ref);
+  const retargeted = rewriteRefFields(specsDir, methodRemap);
   const allowsRekeyed = rekeyLintAllows(specsDir, rename);
   const rewritten = [...new Set([...retargeted, ...allowsRekeyed].map((spec) => spec.id))];
   const mentions = collectMentions(specsDir, methodName, moving);
@@ -33789,16 +33970,16 @@ var path28 = __toESM(require("path"));
 function builtinTemplatesDir() {
   return path28.resolve(__dirname, "..", "templates");
 }
-function loadTemplate(id, globalOverride) {
-  const dirs = templateSearchDirs(globalOverride);
+function loadTemplate(templateName, globalTemplatesDir2) {
+  const dirs = templateSearchDirs(globalTemplatesDir2);
   for (const dir of dirs) {
-    const filePath = path28.join(dir, `${id}.yaml`);
+    const filePath = path28.join(dir, `${templateName}.yaml`);
     if (pathExists(filePath)) {
       const raw = readYamlFile(filePath);
-      return { ...TemplateSchema.parse(raw), templateName: id };
+      return { ...TemplateSchema.parse(raw), templateName };
     }
   }
-  throw new TemplateNotFoundError(id);
+  throw new TemplateNotFoundError(templateName);
 }
 function loadAgentOverride(agentId) {
   const filePath = path28.join(AI_PATHS.root(), "agents", `${agentId}.md`);
@@ -34081,7 +34262,7 @@ function inferSourcePathForComponent(comp, subsystems) {
     return null;
   }
 }
-function summarize2(text3, max = 140) {
+function summarize(text3, max = 140) {
   const clean = text3.replace(/\s+/g, " ").trim();
   const period = clean.indexOf(". ");
   const firstSentence = period > 0 ? clean.slice(0, period + 1) : clean;
@@ -34136,7 +34317,7 @@ function resolveLayer(delegate) {
   agents.push({
     id: "system-architect",
     name: `${system.name} Architect`,
-    description: `Global architect for ${system.name} \u2014 owns the spec tree and topology. ${summarize2(system.vision)}`,
+    description: `Global architect for ${system.name} \u2014 owns the spec tree and topology. ${summarize(system.vision)}`,
     template: "architect",
     creationReason: "Automatically inferred from L0 system spec",
     ownedPaths: [".wai/specs/**"],
@@ -34220,7 +34401,7 @@ function resolveLayer(delegate) {
     agents.push({
       id: `${sub.id}-owner`,
       name: `${sub.name} Owner`,
-      description: `Owns the ${sub.id} subsystem. ${summarize2(sub.description)}${partNote ? ` ${partNote}` : ""}`,
+      description: `Owns the ${sub.id} subsystem. ${summarize(sub.description)}${partNote ? ` ${partNote}` : ""}`,
       template: "domain-owner",
       creationReason: `Automatically inferred from L1 subsystem spec: ${sub.id}`,
       domainRoot: sub.id,
@@ -34285,7 +34466,7 @@ function resolveLayer(delegate) {
     agents.push({
       id: `${dom.id}-owner`,
       name: `${dom.name ?? dom.id} Owner`,
-      description: dom.description ? summarize2(dom.description) : `Owner agent for the free-standing "${dom.id}" domain.`,
+      description: dom.description ? summarize(dom.description) : `Owner agent for the free-standing "${dom.id}" domain.`,
       template: "domain-owner",
       creationReason: "Inferred from a free-standing domain in .wai/topology.yaml",
       domainRoot: dom.id,
@@ -35152,8 +35333,11 @@ function localGuideFilePath(projectRoot, targetType) {
   if (targetType === "gemini" || targetType === "agy") return path36.join(projectRoot, ".gemini", "GEMINI.md");
   return null;
 }
+function guideBody(scope) {
+  return scope === "global" ? GLOBAL_GUIDE_BODY : LOCAL_GUIDE_BODY;
+}
 function injectGuide(filePath, scope) {
-  const body = scope === "global" ? GLOBAL_GUIDE_BODY : LOCAL_GUIDE_BODY;
+  const body = guideBody(scope);
   const section = `
 
 ${GUIDE_MARKER_START}
@@ -35362,7 +35546,7 @@ function renderWaironGuide() {
     lines.push("---");
     lines.push("");
   }
-  lines.push(GLOBAL_GUIDE_BODY);
+  lines.push(guideBody("global"));
   lines.push("");
   return lines.join("\n");
 }
@@ -35823,22 +36007,6 @@ function packSkillId(skill) {
 function packNamespace(pack) {
   return pack.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
-function extensionsFor(builtin, packSkills) {
-  return packSkills.filter((s) => s.extends === builtin && fs22.existsSync(s.sourcePath));
-}
-function composeBuiltinSkill(name, packSkills) {
-  const srcPath = skillTemplatePath(name);
-  const base = fs22.existsSync(srcPath) ? fs22.readFileSync(srcPath, "utf-8") : "";
-  const sections = extensionsFor(name, packSkills);
-  if (sections.length === 0) return base;
-  const parts = [base.trimEnd()];
-  for (const section of sections) {
-    const body = fs22.readFileSync(section.sourcePath, "utf-8").replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "");
-    parts.push(`## Platform: ${section.pack}`, body.trim());
-  }
-  return `${parts.join("\n\n")}
-`;
-}
 function readFrontmatter(raw, fallbackName) {
   const match2 = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
   const block2 = match2 ? match2[1] : "";
@@ -35861,12 +36029,6 @@ function activeTargetTypes2() {
 }
 var SKILL_RESOURCE_SCHEME = "wairon-skill";
 var RESOURCE_SKILL_IDS = [...SKILL_NAMES].sort();
-var SkillResourceNotFoundError = class extends Error {
-  constructor(resourceId) {
-    super(`Unknown SDD skill resource id: "${resourceId}".`);
-    this.name = "SkillResourceNotFoundError";
-  }
-};
 function readSkillFrontmatter(name) {
   return readFrontmatter(fs22.readFileSync(skillTemplatePath(name), "utf-8"), name);
 }
@@ -35896,24 +36058,9 @@ function listSkillResources() {
   });
   return [...builtin, ...pack];
 }
-function readSkillResource(resourceId) {
-  const packSkills = loadProjectExtensions().skills;
-  if (SKILL_NAMES.includes(resourceId)) return composeBuiltinSkill(resourceId, packSkills);
-  const packSkill = packSkills.find((s) => s.extends === void 0 && packSkillId(s) === resourceId);
-  if (packSkill) return fs22.readFileSync(packSkill.sourcePath, "utf-8");
-  return fs22.readFileSync(skillTemplatePath(resourceId), "utf-8");
-}
-function listResources() {
-  return listSkillResources();
-}
 function buildServerInstructions2() {
   return buildServerInstructions();
 }
-function readResource(resourceId) {
-  const known = listSkillResources().some((d) => d.id === resourceId);
-  if (!known) throw new SkillResourceNotFoundError(resourceId);
-  return readSkillResource(resourceId);
-}
 
 // src/mcp/server.ts
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
@@ -39438,10 +39585,13 @@ function rehearse2(plan6) {
     return { ...plan6, refusals: [...plan6.refusals, { code: `${plan6.request.verb}-refused`, project: "", detail }] };
   }
   const changes = diff(rehearsal);
-  const outside = unwritableOwners(changes);
-  if (outside.length > 0) {
+  const refused2 = [
+    ...unwritableOwners(changes).map((o) => ({ code: "family-partial", project: o, detail: `the plan must write ${o}, which this request may not write` })),
+    ...deniedSubsystems(changes)
+  ];
+  if (refused2.length > 0) {
     discard(rehearsal);
-    return { ...plan6, refusals: [...plan6.refusals, ...outside.map((o) => ({ code: "family-partial", project: o, detail: `the plan must write ${o}, which this request may not write` }))] };
+    return { ...plan6, refusals: [...plan6.refusals, ...refused2] };
   }
   return { ...plan6, rehearsal, changes, relock: relockOf(plan6, changes) };
 }
@@ -39485,6 +39635,16 @@ function unwritableOwners(changes) {
   const owners = [...new Set(changes.map((c) => path47.resolve(c.project)))];
   return owners.filter((o) => denied.includes(o));
 }
+function deniedSubsystems(changes) {
+  const reach2 = getWriteReach();
+  if (!reach2) return [];
+  const owners = [...new Set(changes.map((c) => path47.resolve(c.project)))];
+  return owners.flatMap((o) => writeReachDenials(reach2, o).map((s) => ({
+    code: "subsystem-denied",
+    project: o,
+    detail: `the plan must change ${o}, which holds subsystem "${s.subsystemId}" this request may not change (decided by ${s.decidedBy}); a family migration reshapes its projects whole, so it needs write on every subsystem of every project it changes`
+  })));
+}
 function pathProducers(plan6, family) {
   const inside = (dir) => {
     const rel2 = path47.relative(plan6.familyRoot, dir);
@@ -40099,7 +40259,7 @@ function schemaFingerprint() {
     implementation: schemaShape(ImplementationSpecSchema),
     type: schemaShape(TypeSpecSchema)
   };
-  const registered = createMcpServer()._registeredTools;
+  const registered = createBareMcpServer()._registeredTools;
   const tools = [...SPEC_WRITE_TOOLS].sort().map((name) => [name, schemaShape(registered[name]?.inputSchema)]);
   runningFingerprint = crypto10.createHash("sha256").update(JSON.stringify({ version: FINGERPRINT_VERSION, specs, tools })).digest("hex");
   return runningFingerprint;
@@ -40203,113 +40363,7 @@ function reg(server, name, config, cb) {
 var statusInput = import_zod11.z.enum(STATUS_VALUES).optional().describe(
   "The spec's lifecycle status. Omitted means draft for a NEW spec and the status already stored for a re-authoring, so a restatement never reopens a frozen spec. State it to author straight at design or complete instead of promoting afterwards. A status that would LOWER the stored one is refused \u2014 reopening a spec for revision is sdd_update_spec's job, which sets the demotion deliberately."
 );
-var SKILL_RESOURCE_MIME = "text/markdown";
-function skillIdFromResourceUri(uri) {
-  try {
-    const u = new URL(uri);
-    return u.host || u.pathname.replace(/^\/+/, "") || uri;
-  } catch {
-    return uri;
-  }
-}
-var AGENT_BRIEF_SCHEME = "wairon-agent://";
-function listAgentBriefResources() {
-  try {
-    return resolveAgentTopology().map((a) => ({
-      uri: `${AGENT_BRIEF_SCHEME}${a.id}`,
-      name: a.name,
-      description: a.description,
-      mimeType: SKILL_RESOURCE_MIME
-    }));
-  } catch {
-    return [];
-  }
-}
-function renderAgentBriefMarkdown(brief) {
-  const lines = [
-    `# Agent brief: ${brief.agentId}`,
-    "",
-    `- **Name**: ${brief.name}`,
-    `- **Template**: ${brief.template}`,
-    ...brief.domainRoot ? [`- **Domain root**: ${brief.domainRoot}`] : [],
-    `- **Owned paths**: ${brief.ownedPaths.join(", ")}`,
-    ...brief.readPaths?.length ? [`- **Read paths**: ${brief.readPaths.join(", ")}`] : [],
-    "",
-    "## Instructions",
-    "",
-    brief.instructions
-  ];
-  if (brief.variantGuidance && !brief.instructions.includes(brief.variantGuidance)) {
-    lines.push("", "## Variant guidance", "", brief.variantGuidance);
-  }
-  if (brief.budget && brief.profile) {
-    lines.push(
-      "",
-      "## Execution budget",
-      "",
-      ...summarize(brief.budget, brief.profile),
-      "",
-      "Advisory \u2014 apply these when spawning. Map the capability tier onto your host tool's models; a tool that cannot express a field should ignore it rather than approximate it."
-    );
-  }
-  return `${lines.join("\n")}
-`;
-}
-function registerSkillResources(server, listChanged) {
-  server.server.registerCapabilities({ resources: listChanged ? { listChanged: true } : {} });
-  server.server.setRequestHandler(import_types12.ListResourcesRequestSchema, () => ({
-    resources: [
-      ...listResources().map((d) => ({
-        uri: d.resourceUri,
-        name: d.name,
-        description: d.description,
-        mimeType: SKILL_RESOURCE_MIME
-      })),
-      ...listAgentBriefResources()
-    ]
-  }));
-  server.server.setRequestHandler(import_types12.ReadResourceRequestSchema, (request) => {
-    const uri = request.params.uri;
-    if (uri.startsWith(AGENT_BRIEF_SCHEME)) {
-      try {
-        const brief = composeAgentBrief(uri.slice(AGENT_BRIEF_SCHEME.length));
-        return { contents: [{ uri, mimeType: SKILL_RESOURCE_MIME, text: renderAgentBriefMarkdown(brief) }] };
-      } catch (e) {
-        throw new import_types12.McpError(import_types12.ErrorCode.InvalidParams, e instanceof Error ? e.message : String(e));
-      }
-    }
-    try {
-      const content = readResource(skillIdFromResourceUri(uri));
-      return { contents: [{ uri, mimeType: SKILL_RESOURCE_MIME, text: content }] };
-    } catch (e) {
-      const message = e instanceof Error ? e.message : String(e);
-      throw new import_types12.McpError(import_types12.ErrorCode.InvalidParams, message);
-    }
-  });
-}
-function registerSkillPrompts(server, listChanged) {
-  server.server.registerCapabilities({ prompts: listChanged ? { listChanged: true } : {} });
-  server.server.setRequestHandler(import_types12.ListPromptsRequestSchema, () => ({
-    prompts: listResources().map((d) => ({
-      name: d.id,
-      title: d.name,
-      description: d.description
-    }))
-  }));
-  server.server.setRequestHandler(import_types12.GetPromptRequestSchema, (request) => {
-    const name = request.params.name;
-    try {
-      const content = readResource(name);
-      return {
-        description: `The wairon "${name}" skill.`,
-        messages: [{ role: "user", content: { type: "text", text: content } }]
-      };
-    } catch (e) {
-      throw new import_types12.McpError(import_types12.ErrorCode.InvalidParams, e instanceof Error ? e.message : String(e));
-    }
-  });
-}
-function createMcpServer(options = {}) {
+function createBareMcpServer(options = {}) {
   const server = new import_mcp.McpServer({
     name: "wairon",
     version: WAIRON_VERSION
@@ -41489,8 +41543,6 @@ ${testsBlock}` : ""}`, deletion);
       }
     }
   );
-  registerSkillResources(server, !options.hostedTools);
-  registerSkillPrompts(server, !options.hostedTools);
   try {
     const chainingParent = resolveChainingParent();
     if (chainingParent) {
@@ -41501,105 +41553,8 @@ ${testsBlock}` : ""}`, deletion);
     }
   } catch {
   }
-  advertiseHostedTools(server, options);
   return server;
 }
-function advertiseHostedTools(server, options) {
-  if (options.hostedTools) {
-    const hostedStub = () => errText("This hosted tool is dispatched by the hosting data plane before reaching the MCP server; it is unavailable outside a hosted request.");
-    reg(server, "sdd_host_lock_project", {
-      description: "Hosted project lifecycle (execute-primary): LOCK the bound project (validate-as-complete gate + commit-scoped lock record). Executes directly when your resolved permission is yes and returns the completed outcome; when it is approval, a pending approval request is created instead (await it with sdd_host_await_approval).",
-      inputSchema: {}
-    }, hostedStub);
-    reg(server, "sdd_host_initialize_project", {
-      description: "Hosted project lifecycle (execute-primary): initialize a new hosted project into its REQUIRED owner organization unit (with an optional profile selection). Executes directly when your resolved permission is yes; when it is approval, a pending approval request is created instead.",
-      inputSchema: {
-        id: import_zod11.z.string().describe("Requested project id"),
-        displayName: import_zod11.z.string().optional(),
-        description: import_zod11.z.string().optional(),
-        ownerUnitId: import_zod11.z.string().describe("REQUIRED organization unit that owns the new project (every project is placed at creation)"),
-        environment: import_zod11.z.string().optional()
-      }
-    }, hostedStub);
-    reg(server, "sdd_host_get_approval_status", {
-      description: "Hosted project lifecycle: read the status of one of your approval requests.",
-      inputSchema: { requestId: import_zod11.z.string() }
-    }, hostedStub);
-    reg(server, "sdd_host_await_approval", {
-      description: "Hosted project lifecycle: long-poll one of YOUR approval requests until it is decided (approved requests auto-execute, so an approval resolves as completed) or the timeout elapses. Returns the request in its current state.",
-      inputSchema: {
-        requestId: import_zod11.z.string(),
-        timeoutSeconds: import_zod11.z.number().optional().describe("How long to wait server-side (clamped; 0 returns the current state immediately)")
-      }
-    }, hostedStub);
-    reg(server, "sdd_landscape_list_reachable_projects", {
-      description: "Hosted landscape: the projects reachable from the BOUND project through ACTIVE cross-project relations (directional, relations-only), each with the relation ids/kinds and target public interface ids.",
-      inputSchema: {}
-    }, hostedStub);
-    reg(server, "sdd_landscape_list_reachable_project_interfaces", {
-      description: "Hosted landscape: redacted, audience-filtered public interface summaries of one reachable target project (Forbidden outside the reachable set; private by default).",
-      inputSchema: { projectId: import_zod11.z.string().describe("The reachable target project id") }
-    }, hostedStub);
-    reg(server, "sdd_landscape_list_visible_surfaces", {
-      description: "Hosted landscape: the visibility-resolved discovery catalog for the BOUND project \u2014 every target the organization unit graph exposes to it (open-within-tenant, closed groups hidden, exposeTo grants honored), with audience distance and audience-filtered summaries. No relation required.",
-      inputSchema: {}
-    }, hostedStub);
-    reg(server, "sdd_landscape_get_project_surface", {
-      description: `Hosted landscape: fetch a visible target project's CONTRACT-GRADE surface snapshot (full method contracts, dispatch tables, type closure) at your audience-distance ceiling, origin "exchanged" \u2014 save it under .wai/surfaces/ (wairon surface import) so your adapters validate against the declared contract.`,
-      inputSchema: { projectId: import_zod11.z.string().describe("The visible target project id") }
-    }, hostedStub);
-    reg(server, "sdd_host_pack_list", {
-      description: "Hosted project ops: list the BOUND project's registered extension packs (requires project:read over it).",
-      inputSchema: {}
-    }, hostedStub);
-    reg(server, "sdd_host_pack_install", {
-      description: "Hosted project ops: install a DECLARATIVE extension pack (profiles + language/platform tables \u2014 never rule/code packs) into the BOUND project (requires project:admin over it).",
-      inputSchema: {
-        name: import_zod11.z.string().describe("Pack name (letters, digits, dot, underscore, hyphen)"),
-        content: import_zod11.z.string().describe("The declarative pack YAML content")
-      }
-    }, hostedStub);
-    reg(server, "sdd_host_pack_impact", {
-      description: "Hosted project ops: measure, writing nothing, what installing a DECLARATIVE pack (content given) or adopting the server-global pack of that name (content omitted) would change on the BOUND project \u2014 the pack's doctrine against wairon's defaults (rules loosened, raised, turned off or added; profiles and concepts added, redefined or removed), which of its profiles would govern, and the findings that change. Show it to your human before sdd_host_pack_install, which applies without it. Nothing in it is a finding: packs exist to adjust wairon's checks. Requires project:read over the project.",
-      inputSchema: {
-        name: import_zod11.z.string().describe("Pack name (letters, digits, dot, underscore, hyphen); the server-global pack to adopt when content is omitted"),
-        content: import_zod11.z.string().optional().describe("The declarative pack YAML an install would upload; omitted, the server-global pack an adoption would vendor")
-      }
-    }, hostedStub);
-    reg(server, "sdd_host_policy_evaluate", {
-      description: "Hosted project ops: evaluate the BOUND project's packs and profile selection against the instance pack policy \u2014 compliance without side effects (requires project:write over it).",
-      inputSchema: {}
-    }, hostedStub);
-    reg(server, "sdd_host_policy_reconcile", {
-      description: "Hosted project ops: reconcile the BOUND project against the instance pack policy \u2014 under auto_reconcile enforcement the missing required/default declarative packs are applied (requires project:write over it).",
-      inputSchema: {}
-    }, hostedStub);
-    reg(server, "sdd_host_produce", {
-      description: "Hosted project ops: run a configured producer projection (Notion/Miro) of the BOUND project to the named target (requires project:admin over it).",
-      inputSchema: { target: import_zod11.z.string().describe("The configured producer target (e.g. notion, miro)") }
-    }, hostedStub);
-    reg(server, "sdd_host_commit_project", {
-      description: "Hosted project ops: publish a DELIBERATE, .wai/-scoped commit+push of the BOUND project's specs to its bound repository (commit = local save, push = the actual backup; a clean scope publishes nothing). The data plane binds ONE project, so there is no project argument. Requires project:write over it.",
-      inputSchema: {
-        subsystem: import_zod11.z.string().optional().describe("Narrow staging to .wai/specs/<subsystem>/ (a convenience \u2014 git history stays per-repo)"),
-        message: import_zod11.z.string().optional().describe("Commit message; defaults to a timestamped wairon message")
-      }
-    }, hostedStub);
-    reg(server, "sdd_host_export_tree", {
-      description: "Hosted spec-tree transfer: pack the BOUND project's WHOLE spec tree \u2014 its own .wai plus every chained subproject \u2014 into a .waitree archive, returned as base64 with its roots, file count and state id. The migration counterpart of an import: use it to take a hosted project local, or to move it to another instance. Requires project:read over the project. Bounded by the data-plane body cap; a very large tree exports through the web download route instead. Refuses when a chained mount cannot be packed (escaping, missing, cyclic, too deep, or holding no .wai), naming every one and why, unless allowPartial is set \u2014 then the archive is built anyway and the result lists what was skipped.",
-      inputSchema: {
-        allowPartial: import_zod11.z.boolean().optional().describe("Build the archive even when some members cannot be packed, listing them as skipped; default false (refuse and name them)")
-      }
-    }, hostedStub);
-    reg(server, "sdd_host_import_tree", {
-      description: "Hosted spec-tree transfer: REPLACE the BOUND project's spec tree from a base64 .waitree archive. Requires project:admin over the project (strictly above project:write \u2014 this replaces the whole design, not one spec). Refuses an occupied destination unless replaceExisting is set, always refuses executable entries (rule/code packs install only through the trusted filesystem), and moves the previous tree aside to a backup whose path is returned.",
-      inputSchema: {
-        archiveBase64: import_zod11.z.string().describe("The .waitree archive bytes, base64-encoded"),
-        replaceExisting: import_zod11.z.boolean().optional().describe("Replace a tree already present (backed up first); without it an occupied destination is refused")
-      }
-    }, hostedStub);
-  }
-}
 
 // src/index.ts
 function loadProjectConfig3() {
@@ -41804,6 +41759,7 @@ function loadProjectConfig3() {
   deregisterPackRef,
   deriveExecutionProfile,
   derivedDocPaths,
+  describeProject,
   detectDomainCandidates,
   diagnoseProjectPacks,
   diagramSetIndex,
@@ -41845,6 +41801,7 @@ function loadProjectConfig3() {
   getRequestParentReach,
   getRequestProjectRoot,
   getStatusReport,
+  getWriteReach,
   globalGuideFilePath,
   globalPacksDir,
   globalPacksEnabled,
@@ -42016,6 +41973,8 @@ function loadProjectConfig3() {
   writeFileIfChanged,
   writeJsonFile,
   writeLockRecord,
+  writeReachDenials,
+  writeReachPermits,
   writeRootGuideDelegator,
   writeYamlFile
 });