@webpresso/agent-kit 0.28.0 → 0.29.1

package/dist/esm/build/package-manifest.js

@@ -8,6 +8,7 @@ const DEPENDENCY_SECTIONS = [
     'optionalDependencies',
     'peerDependencies',
 ];
+const NON_PUBLISHABLE_DEPENDENCY_PROTOCOLS = ['link:', 'workspace:', 'file:'];
 const BACKUP_FILENAME = '.package.json.prepack.backup';
 const DIST_BACKUP_DIRNAME = '.dist-prepack-backup';
 function asStringMap(value) {
@@ -61,16 +62,23 @@ export function resolveCatalogSpecifier(dependencyName, version, workspaceCatalo
     }
     return resolved;
 }
+function assertPublishableDependencySpecifier(section, dependencyName, version) {
+    const blockedProtocol = NON_PUBLISHABLE_DEPENDENCY_PROTOCOLS.find((protocol) => version.startsWith(protocol));
+    if (!blockedProtocol)
+        return;
+    throw new Error(`Cannot pack ${section}.${dependencyName} with non-publishable ${blockedProtocol} specifier ${JSON.stringify(version)}`);
+}
 export function createPackedManifest(manifest, workspaceCatalogs) {
     const packedManifest = { ...manifest };
     for (const section of DEPENDENCY_SECTIONS) {
         const dependencies = manifest[section];
         if (!dependencies)
             continue;
-        packedManifest[section] = Object.fromEntries(Object.entries(dependencies).map(([dependencyName, version]) => [
-            dependencyName,
-            resolveCatalogSpecifier(dependencyName, version, workspaceCatalogs),
-        ]));
+        packedManifest[section] = Object.fromEntries(Object.entries(dependencies).map(([dependencyName, version]) => {
+            const resolvedVersion = resolveCatalogSpecifier(dependencyName, version, workspaceCatalogs);
+            assertPublishableDependencySpecifier(section, dependencyName, resolvedVersion);
+            return [dependencyName, resolvedVersion];
+        }));
     }
     if ('bin' in packedManifest) {
         packedManifest.bin = normalizePackedBinField(packedManifest.bin);

package/dist/esm/build/release-policy.d.ts

@@ -1,27 +1,18 @@
 /**
- * Release-time policy decisions for the publish pipeline.
+ * Release-time policy decisions for the native runtime publish pipeline.
  *
- * The per-platform native runtime packages (`@webpresso/agent-kit-runtime-*`)
- * are a deferred capability: they are not yet created on the registry, the main
- * package declares no `optionalDependencies` on them, and the plugin manifest
- * still launches via the node entrypoint rather than a staged native `bin/wp`.
- *
- * Until that native-distribution work is intentionally activated, the release
- * MUST NOT attempt to publish the matrix: a first-time `npm publish` of a
- * never-created scoped package returns 404, which previously aborted the entire
- * release before the main `@webpresso/agent-kit` package published (the root
- * cause of the 0.22.x publish stall).
- *
- * The matrix publish is therefore gated behind an explicit opt-in. When the
- * native-distribution feature lands, the release workflow sets
- * `WP_PUBLISH_RUNTIME_MATRIX=1` (after bootstrapping the scoped packages on the
- * registry) to turn it back on.
+ * The canonical package surface now includes the per-platform
+ * `@webpresso/agent-kit-runtime-*` packages plus the staged native `bin/wp`
+ * launcher, so release publishes the runtime matrix by default. Operators may
+ * still set `WP_PUBLISH_RUNTIME_MATRIX=0` to force a diagnostics-only dry lane
+ * when debugging a broken registry/bootstrap environment, but the normal
+ * shipping path is "publish the matrix".
  */
 export declare const PUBLISH_RUNTIME_MATRIX_ENV = "WP_PUBLISH_RUNTIME_MATRIX";
 /**
  * Whether the release pipeline should build, stage, and publish the per-platform
- * native runtime matrix. Defaults to `false` (matrix deferred); enabled only
- * when `WP_PUBLISH_RUNTIME_MATRIX=1` is set explicitly.
+ * native runtime matrix. Defaults to `true`; only an explicit
+ * `WP_PUBLISH_RUNTIME_MATRIX=0` disables the matrix.
  */
 export declare function shouldPublishRuntimeMatrix(env: NodeJS.ProcessEnv): boolean;
 //# sourceMappingURL=release-policy.d.ts.map

package/dist/esm/build/release-policy.js

@@ -1,29 +1,20 @@
 /**
- * Release-time policy decisions for the publish pipeline.
+ * Release-time policy decisions for the native runtime publish pipeline.
  *
- * The per-platform native runtime packages (`@webpresso/agent-kit-runtime-*`)
- * are a deferred capability: they are not yet created on the registry, the main
- * package declares no `optionalDependencies` on them, and the plugin manifest
- * still launches via the node entrypoint rather than a staged native `bin/wp`.
- *
- * Until that native-distribution work is intentionally activated, the release
- * MUST NOT attempt to publish the matrix: a first-time `npm publish` of a
- * never-created scoped package returns 404, which previously aborted the entire
- * release before the main `@webpresso/agent-kit` package published (the root
- * cause of the 0.22.x publish stall).
- *
- * The matrix publish is therefore gated behind an explicit opt-in. When the
- * native-distribution feature lands, the release workflow sets
- * `WP_PUBLISH_RUNTIME_MATRIX=1` (after bootstrapping the scoped packages on the
- * registry) to turn it back on.
+ * The canonical package surface now includes the per-platform
+ * `@webpresso/agent-kit-runtime-*` packages plus the staged native `bin/wp`
+ * launcher, so release publishes the runtime matrix by default. Operators may
+ * still set `WP_PUBLISH_RUNTIME_MATRIX=0` to force a diagnostics-only dry lane
+ * when debugging a broken registry/bootstrap environment, but the normal
+ * shipping path is "publish the matrix".
  */
 export const PUBLISH_RUNTIME_MATRIX_ENV = 'WP_PUBLISH_RUNTIME_MATRIX';
 /**
  * Whether the release pipeline should build, stage, and publish the per-platform
- * native runtime matrix. Defaults to `false` (matrix deferred); enabled only
- * when `WP_PUBLISH_RUNTIME_MATRIX=1` is set explicitly.
+ * native runtime matrix. Defaults to `true`; only an explicit
+ * `WP_PUBLISH_RUNTIME_MATRIX=0` disables the matrix.
  */
 export function shouldPublishRuntimeMatrix(env) {
-    return env[PUBLISH_RUNTIME_MATRIX_ENV] === '1';
+    return env[PUBLISH_RUNTIME_MATRIX_ENV] !== '0';
 }
 //# sourceMappingURL=release-policy.js.map

package/dist/esm/build/runtime-surface-policy.d.ts

@@ -0,0 +1,14 @@
+export declare const AGENT_KIT_TARBALL_SIZE_BUDGET_BYTES = 29704296;
+export declare const AGENT_KIT_TARBALL_UNPACKED_SIZE_BUDGET_BYTES = 86643227;
+export interface TarballSizeBudgetInput {
+    readonly size?: number;
+    readonly unpackedSize?: number;
+}
+export interface TarballSizeBudgetResult {
+    readonly sizeOk: boolean;
+    readonly unpackedOk: boolean;
+    readonly size: number;
+    readonly unpackedSize: number;
+}
+export declare function evaluateAgentKitTarballSizeBudget(packSummary: TarballSizeBudgetInput): TarballSizeBudgetResult;
+//# sourceMappingURL=runtime-surface-policy.d.ts.map

package/dist/esm/build/runtime-surface-policy.js

@@ -0,0 +1,13 @@
+export const AGENT_KIT_TARBALL_SIZE_BUDGET_BYTES = 29_704_296;
+export const AGENT_KIT_TARBALL_UNPACKED_SIZE_BUDGET_BYTES = 86_643_227;
+export function evaluateAgentKitTarballSizeBudget(packSummary) {
+    const size = packSummary.size ?? 0;
+    const unpackedSize = packSummary.unpackedSize ?? 0;
+    return {
+        sizeOk: size <= AGENT_KIT_TARBALL_SIZE_BUDGET_BYTES,
+        unpackedOk: unpackedSize <= AGENT_KIT_TARBALL_UNPACKED_SIZE_BUDGET_BYTES,
+        size,
+        unpackedSize,
+    };
+}
+//# sourceMappingURL=runtime-surface-policy.js.map

package/dist/esm/cli/commands/audit-core.d.ts

@@ -1,5 +1,5 @@
 import type { RepoAuditResult } from '#audit/repo-guardrails';
-export type AuditKind = 'tph' | 'tph-e2e' | 'bundle-budget' | 'commit-message' | 'blueprint-lifecycle' | 'roadmap-links' | 'docs-frontmatter' | 'catalog-drift' | 'package-surface' | 'agents' | 'tech-debt' | 'no-relative-parent-imports' | 'no-link-protocol' | 'vision' | 'bucket-boundary' | 'skill-sizes' | 'broken-refs' | 'memory-rotation' | 'gitignore-agent-surfaces' | 'memory-unified' | 'compile-drift' | 'architecture-drift' | 'cloudflare-deploy-contract' | 'toolchain-isolation' | 'absolute-path-policy' | 'no-first-party-mjs' | 'agent-cost' | 'blueprint-db-consistency' | 'blueprint-lifecycle-sql' | 'tech-debt-cadence' | 'cross-repo-correlation' | 'ai-contracts' | 'mutation' | 'quality' | 'guardrails' | 'hook-surface' | 'no-relative-package-scripts';
+export type AuditKind = 'tph' | 'tph-e2e' | 'bundle-budget' | 'commit-message' | 'blueprint-readme-drift' | 'blueprint-lifecycle' | 'roadmap-links' | 'docs-frontmatter' | 'catalog-drift' | 'package-surface' | 'agents' | 'tech-debt' | 'no-relative-parent-imports' | 'no-link-protocol' | 'vision' | 'bucket-boundary' | 'skill-sizes' | 'broken-refs' | 'memory-rotation' | 'gitignore-agent-surfaces' | 'memory-unified' | 'compile-drift' | 'architecture-drift' | 'cloudflare-deploy-contract' | 'toolchain-isolation' | 'absolute-path-policy' | 'no-first-party-mjs' | 'agent-cost' | 'blueprint-db-consistency' | 'tech-debt-cadence' | 'cross-repo-correlation' | 'ai-contracts' | 'mutation' | 'quality' | 'guardrails' | 'hook-surface' | 'no-relative-package-scripts';
 export type AuditOutcome = {
     kind: 'invalid-usage';
     message: string;
@@ -34,7 +34,7 @@ export interface AuditActionOptions {
     htmlEntry?: string;
     ignore?: string | string[];
     json?: boolean;
-    legacyOmx?: boolean;
+    omxPlans?: boolean;
     loreWarn?: boolean;
     maxHtmlEagerJsAssetBytes?: string;
     maxHtmlEagerJsTotalBytes?: string;

package/dist/esm/cli/commands/audit.js

@@ -13,7 +13,12 @@ import { resolveAuditScriptPath } from '#audit/resolve-audit-script';
 const REPO_AUDIT_REGISTRY = {
     'catalog-drift': async (root) => (await import('#audit/repo-guardrails')).auditCatalogDrift(root),
     'package-surface': async (root) => (await import('#audit/package-surface')).auditPackageSurface(root),
-    'blueprint-lifecycle': async (root, _options) => (await import('#audit/blueprint-lifecycle-sql')).auditBlueprintLifecycleSql(root),
+    'blueprint-readme-drift': async (root, options) => (await import('#audit/blueprint-readme-drift')).auditBlueprintReadmeDrift(root, {
+        fix: options.fix,
+    }),
+    'blueprint-lifecycle': async (root, options) => (await import('#audit/blueprint-lifecycle-sql')).auditBlueprintLifecycleSql(root, {
+        includeOmxPlans: options.omxPlans,
+    }),
     'roadmap-links': async (root, options) => (await import('#audit/roadmap-links')).auditRoadmapLinks(root, {
         failOrphans: options.strict,
     }),
@@ -65,7 +70,6 @@ const REPO_AUDIT_REGISTRY = {
     'no-first-party-mjs': async (root) => (await import('#audit/no-first-party-mjs')).auditNoFirstPartyMjs(root),
     'agent-cost': async (root) => (await import('#audit/agent-cost')).auditAgentCost(root),
     'blueprint-db-consistency': async (root) => (await import('#audit/blueprint-db-consistency')).auditBlueprintDbConsistency(root),
-    'blueprint-lifecycle-sql': async (root) => (await import('#audit/blueprint-lifecycle-sql')).auditBlueprintLifecycleSql(root),
     'tech-debt-cadence': async (root) => (await import('#audit/tech-debt-cadence')).auditTechDebtCadence(root),
     'cross-repo-correlation': async (root) => (await import('#audit/cross-repo-correlation')).auditCrossRepoCorrelationAsRepoResult(root),
     'ai-contracts': async (root) => (await import('#audit/ai-contracts')).auditAiContracts(root),
@@ -189,7 +193,7 @@ export function registerAuditCommand(cli) {
         .option('--message-file <file>', 'Commit message file for commit-message')
         .option('--require-lore', 'Require Lore trailers (hard-fail on missing/malformed trailers)')
         .option('--lore-warn', 'Warn about missing Lore trailers but always exit 0 (soft adoption mode)')
-        .option('--legacy-omx', 'Include legacy .omx plan checks for blueprint-lifecycle')
+        .option('--omx-plans', 'Also audit .omx/plans derived-handoff governance for blueprint-lifecycle')
         .option('--html-entry <file>', 'HTML entry relative to dist for bundle-budget')
         .option('--max-js-asset-bytes <bytes>', 'Max size for any generated JS asset')
         .option('--max-html-eager-js-asset-bytes <bytes>', 'Max size for any HTML-eager JS asset')

package/dist/esm/cli/commands/blueprint/db-commands.js

@@ -5,7 +5,6 @@ import path from 'node:path';
 import { coldStartIfNeeded } from '#db/cold-start.js';
 import { openDb } from '#db/connection.js';
 import { ingestAll } from '#db/ingester.js';
-import { migrateLegacyAgentDb } from '#db/legacy-migration.js';
 import { resolveBlueprintProjectionDbPath, withProjectionDbWriteLock } from '#db/paths.js';
 import { runTemplate } from '#db/template-runner.js';
 // ---------------------------------------------------------------------------
@@ -13,8 +12,6 @@ import { runTemplate } from '#db/template-runner.js';
 // ---------------------------------------------------------------------------
 const METADATA_FILENAME = '.datasette-metadata.json';
 function agentDbPath(projectRoot) {
-    // Migrate any legacy DB (idempotent + memoized) before resolving canonical path.
-    migrateLegacyAgentDb(projectRoot);
     return resolveBlueprintProjectionDbPath(projectRoot);
 }
 function agentMetadataPath(projectRoot) {

package/dist/esm/cli/commands/blueprint/mutations.d.ts

@@ -2,7 +2,8 @@
  * Blueprint mutation verbs — advanceTask, promoteBlueprint, finalizeBlueprint
  *
  * All mutations:
- *   1. Edit the canonical _overview.md on disk (atomic tmp+rename)
+ *   1. Edit the canonical blueprint markdown document on disk (flat `.md` or
+ *      folder `_overview.md`) via atomic tmp+rename
  *   2. Re-ingest into the structured-store DB via ingestAll
  *
  * Platform-first sync (Tasks 2.6 + 2.7):
@@ -85,7 +86,7 @@ export interface PromoteBlueprintResult {
     readonly message: string;
 }
 /**
- * Advance a task's status in its blueprint's _overview.md, then re-ingest.
+ * Advance a task's status in its blueprint markdown document, then re-ingest.
  *
  * Atomic: writes to a temp file then renames onto the original.
  * Idempotent: if the task is already at `toStatus`, reports "already <toStatus>" and exits cleanly.

package/dist/esm/cli/commands/blueprint/mutations.js

@@ -2,7 +2,8 @@
  * Blueprint mutation verbs — advanceTask, promoteBlueprint, finalizeBlueprint
  *
  * All mutations:
- *   1. Edit the canonical _overview.md on disk (atomic tmp+rename)
+ *   1. Edit the canonical blueprint markdown document on disk (flat `.md` or
+ *      folder `_overview.md`) via atomic tmp+rename
  *   2. Re-ingest into the structured-store DB via ingestAll
  *
  * Platform-first sync (Tasks 2.6 + 2.7):
@@ -18,8 +19,8 @@ import path from 'node:path';
 import { parseBlueprint } from '#core/parser';
 import { openDb } from '#db/connection.js';
 import { ingestAll } from '#db/ingester.js';
-import { migrateLegacyAgentDb } from '#db/legacy-migration.js';
 import { resolveBlueprintProjectionDbPath, withMarkdownWriteLock, withProjectionDbWriteLock, } from '#db/paths.js';
+import { getBlueprintDocumentPaths } from '#utils/document-paths.js';
 import { resolveBlueprintRoot } from '#utils/blueprint-root.js';
 import { assertAllTasksHaveCanonicalPassingEvidence } from '#verification.js';
 /**
@@ -80,16 +81,27 @@ const TASK_STATUSES = ['todo', 'in-progress', 'blocked', 'done', 'dropped'];
 // Helpers
 // ---------------------------------------------------------------------------
 function dbPath(cwd) {
-    // Migrate any legacy `.agent/.blueprints.db` once per process per repo
-    // before resolving the canonical worktree-scoped path.
-    migrateLegacyAgentDb(cwd);
     return resolveBlueprintProjectionDbPath(cwd);
 }
-function findBlueprintDir(blueprintRoot, slug) {
+function findBlueprintDocument(blueprintRoot, slug) {
     for (const state of ALL_STATES) {
-        const d = path.join(blueprintRoot, state, slug);
-        if (existsSync(d))
-            return { dir: d, state };
+        const paths = getBlueprintDocumentPaths(blueprintRoot, state, slug);
+        if (existsSync(paths.flat)) {
+            return {
+                dir: path.dirname(paths.flat),
+                documentPath: paths.flat,
+                shape: 'flat',
+                state,
+            };
+        }
+        if (existsSync(paths.folder)) {
+            return {
+                dir: paths.directory,
+                documentPath: paths.folder,
+                shape: 'folder',
+                state,
+            };
+        }
     }
     return null;
 }
@@ -164,7 +176,7 @@ function findTaskStatusLine(lines, taskId) {
 // advanceTask
 // ---------------------------------------------------------------------------
 /**
- * Advance a task's status in its blueprint's _overview.md, then re-ingest.
+ * Advance a task's status in its blueprint markdown document, then re-ingest.
  *
  * Atomic: writes to a temp file then renames onto the original.
  * Idempotent: if the task is already at `toStatus`, reports "already <toStatus>" and exits cleanly.
@@ -175,15 +187,11 @@ export async function advanceTask(cwd, blueprintSlug, taskId, toStatus) {
 }
 async function advanceTaskLocked(cwd, blueprintSlug, taskId, toStatus) {
     const blueprintRoot = resolveBlueprintRoot(cwd);
-    const found = findBlueprintDir(blueprintRoot, blueprintSlug);
+    const found = findBlueprintDocument(blueprintRoot, blueprintSlug);
     if (!found) {
         throw new Error(`Blueprint "${blueprintSlug}" not found in any state directory under ${blueprintRoot}`);
     }
-    const overviewPath = path.join(found.dir, '_overview.md');
-    if (!existsSync(overviewPath)) {
-        throw new Error(`Blueprint overview not found: ${overviewPath}`);
-    }
-    const content = readFileSync(overviewPath, 'utf8');
+    const content = readFileSync(found.documentPath, 'utf8');
     const lines = content.split('\n');
     const result = findTaskStatusLine(lines, taskId);
     if (!result) {
@@ -226,7 +234,7 @@ async function advanceTaskLocked(cwd, blueprintSlug, taskId, toStatus) {
     const updatedLines = [...lines];
     updatedLines[lineIndex] = `**Status:** ${toStatus}`;
     const newContent = updatedLines.join('\n');
-    atomicWriteFile(overviewPath, newContent);
+    atomicWriteFile(found.documentPath, newContent);
     await reIngestDb(cwd);
     return {
         blueprintSlug,
@@ -253,25 +261,21 @@ export async function promoteBlueprint(cwd, slug, toState) {
 }
 async function promoteBlueprintLocked(cwd, slug, toState) {
     const blueprintRoot = resolveBlueprintRoot(cwd);
-    const found = findBlueprintDir(blueprintRoot, slug);
+    const found = findBlueprintDocument(blueprintRoot, slug);
     if (!found) {
         throw new Error(`Blueprint "${slug}" not found in any state directory under ${blueprintRoot}`);
     }
-    const { dir: currentDir, state: currentState } = found;
-    const overviewPath = path.join(currentDir, '_overview.md');
-    if (!existsSync(overviewPath)) {
-        throw new Error(`Blueprint overview not found: ${overviewPath}`);
-    }
+    const { dir: currentDir, documentPath: currentDocumentPath, shape, state: currentState, } = found;
     // Guard: refuse to complete if any tasks are not done/dropped
     if (toState === 'completed') {
-        const markdown = readFileSync(overviewPath, 'utf8');
+        const markdown = readFileSync(currentDocumentPath, 'utf8');
         const blueprint = parseBlueprint(markdown, slug);
-        const unfinished = blueprint.tasks.filter((task) => task.status !== 'done');
+        const unfinished = blueprint.tasks.filter((task) => task.status !== 'done' && task.status !== 'dropped');
         if (unfinished.length > 0) {
             const list = unfinished.map((task) => `${task.id} (${task.status})`).join(', ');
-            throw new Error(`Cannot promote "${slug}" to completed: the following tasks are not done: ${list}`);
+            throw new Error(`Cannot promote "${slug}" to completed: the following tasks are not done/dropped: ${list}`);
         }
-        assertAllTasksHaveCanonicalPassingEvidence(markdown, blueprint.tasks.map((task) => task.id));
+        assertAllTasksHaveCanonicalPassingEvidence(markdown, blueprint.tasks.filter((task) => task.status === 'done').map((task) => task.id));
         const target = dbPath(cwd);
         if (existsSync(target)) {
             const conn = openDb(target);
@@ -311,37 +315,39 @@ async function promoteBlueprintLocked(cwd, slug, toState) {
     // Always update local markdown + SQLite.
     // Platform-first: these become derived artifacts; disabled: these are canonical.
     // Update frontmatter in the current location first, then move
-    let content = readFileSync(overviewPath, 'utf8');
+    let content = readFileSync(currentDocumentPath, 'utf8');
     content = updateFrontmatterStatus(content, toState);
     if (toState === 'completed') {
         const today = new Date().toISOString().split('T')[0] ?? new Date().toISOString();
         content = upsertCompletedAt(content, today);
     }
-    const destDir = path.join(blueprintRoot, toState, slug);
-    const destOverviewPath = path.join(destDir, '_overview.md');
-    if (currentDir === destDir) {
+    const targetPaths = getBlueprintDocumentPaths(blueprintRoot, toState, slug);
+    const destDir = targetPaths.directory;
+    const destDocumentPath = shape === 'flat' ? targetPaths.flat : targetPaths.folder;
+    if (currentDocumentPath === destDocumentPath) {
         // Same directory — only update frontmatter
-        atomicWriteFile(overviewPath, content);
+        atomicWriteFile(currentDocumentPath, content);
         await reIngestDb(cwd);
         return {
             slug,
             oldState: currentState,
             newState: toState,
-            newPath: overviewPath,
-            message: `Promoted ${slug}: ${currentState} → ${toState} (path unchanged: ${overviewPath})`,
+            newPath: currentDocumentPath,
+            message: `Promoted ${slug}: ${currentState} → ${toState} (path unchanged: ${currentDocumentPath})`,
         };
     }
-    // Write updated content to current location first, then move directory
-    atomicWriteFile(overviewPath, content);
+    // Write updated content to the current location first, then move the owning
+    // file/directory according to the blueprint shape.
+    atomicWriteFile(currentDocumentPath, content);
     mkdirSync(path.dirname(destDir), { recursive: true });
-    renameSync(currentDir, destDir);
+    renameSync(shape === 'flat' ? currentDocumentPath : currentDir, shape === 'flat' ? destDocumentPath : destDir);
     await reIngestDb(cwd);
     return {
         slug,
         oldState: currentState,
         newState: toState,
-        newPath: destOverviewPath,
-        message: `Promoted ${slug}: ${currentState} → ${toState} (new path: ${destOverviewPath})`,
+        newPath: destDocumentPath,
+        message: `Promoted ${slug}: ${currentState} → ${toState} (new path: ${destDocumentPath})`,
     };
 }
 // ---------------------------------------------------------------------------

package/dist/esm/cli/commands/blueprint/router-output.js

@@ -22,7 +22,7 @@ const BLUEPRINT_HELP = [
     '  move <slug> <status> --force-recovery',
 ].join('\n');
 export function formatTaskLine(task) {
-    const checkbox = task.status === 'done' ? 'x' : ' ';
+    const checkbox = task.status === 'done' || task.status === 'dropped' ? 'x' : ' ';
     return `- [${checkbox}] ${task.id} ${task.title}`;
 }
 export function getBlueprintHelpText() {
@@ -113,7 +113,7 @@ export function formatBlueprintSummaries(summaries) {
     return [...lines, inventorySummary].join('\n');
 }
 export function formatBlueprintDetails(result) {
-    const doneTasks = result.blueprint.tasks.filter((task) => task.status === 'done').length;
+    const doneTasks = result.blueprint.tasks.filter((task) => task.status === 'done' || task.status === 'dropped').length;
     const header = [
         `title: ${result.blueprint.title}`,
         `slug: ${result.slug}`,

package/dist/esm/cli/commands/doctor.d.ts

@@ -3,7 +3,7 @@ export interface RunDoctorOptions {
     root?: string;
     docsRoot?: string;
     fix?: boolean;
-    legacyOmx?: boolean;
+    omxPlans?: boolean;
 }
 export declare function runDoctor(options?: RunDoctorOptions): Promise<number>;
 export declare function registerDoctorCommand(cli: CAC): void;

package/dist/esm/cli/commands/doctor.js

@@ -1,4 +1,5 @@
-import { auditBlueprintLifecycle, auditCatalogDrift, auditDocsFrontmatter, formatRepoAuditReport, } from '#audit/repo-guardrails';
+import { auditBlueprintLifecycleSql } from '#audit/blueprint-lifecycle-sql';
+import { auditCatalogDrift, auditDocsFrontmatter, formatRepoAuditReport, } from '#audit/repo-guardrails';
 const REMEDIATIONS = {
     'Catalog drift': 'wp audit catalog-drift',
     'Catalog drift — single package (no workspace file)': 'none needed',
@@ -14,9 +15,7 @@ export async function runDoctor(options = {}) {
                 docsRoot: options.docsRoot,
                 fix: options.fix,
             }),
-            auditBlueprintLifecycle(root, {
-                includeLegacyOmx: options.legacyOmx,
-            }),
+            await auditBlueprintLifecycleSql(root, { includeOmxPlans: options.omxPlans }),
         ];
         let failed = false;
         for (const result of results) {
@@ -44,7 +43,7 @@ export function registerDoctorCommand(cli) {
         .option('--root <dir>', 'Repository root to inspect')
         .option('--docs-root <dir>', 'Docs directory for docs-frontmatter')
         .option('--fix', 'Apply supported safe fixes during doctor (currently docs-frontmatter)')
-        .option('--legacy-omx', 'Include legacy .omx plan checks for blueprint-lifecycle')
+        .option('--omx-plans', 'Also audit .omx/plans derived-handoff governance for blueprint-lifecycle')
         .action(async (options) => {
         const code = await runDoctor(options);
         return code;

package/dist/esm/cli/commands/init/config.d.ts

@@ -1,12 +1,18 @@
 import type { AgentHost, VisibilityStatus } from './host-visibility.js';
 export declare const CONFIG_VERSION = "1";
 export declare const CONFIG_FILENAME = ".webpressorc.json";
+export declare const LEGACY_CONFIG_FILENAME = ".agent-kitrc.json";
 export declare const DEFAULT_DURABLE_PLANNING_ROOT = ".agent/planning/";
 export interface AgentkitConfig {
     version: string;
     installed: {
         tier3Skills: string[];
     };
+    audit?: {
+        toolchainIsolation?: {
+            allowDependencies?: string[];
+        };
+    };
     hosts?: {
         selected: AgentHost[];
         requiredCapabilities: string[];
@@ -24,16 +30,6 @@ export interface AgentkitConfig {
         packageManager?: 'vp-only';
         scriptRoutes?: Record<string, string>;
     };
-    /** Audit policy overrides. `mechanism` lives in agent-kit; this is per-repo
-     *  `data`. `toolchainIsolation.allowDependencies` lists dependency names that
-     *  are exempt from the toolchain-isolation audit because they are legitimate
-     *  app-specific runtimes (e.g. `tsx` for a Pulumi program's TS loader,
-     *  `@playwright/test` imported by e2e specs), not generic toolchain. */
-    audit?: {
-        toolchainIsolation?: {
-            allowDependencies?: string[];
-        };
-    };
     rules: {
         overrides: string[];
     };

package/dist/esm/cli/commands/init/config.js

@@ -7,6 +7,7 @@ import { join } from 'node:path';
 import { REQUIRED_CORE_CAPABILITIES } from './host-visibility.js';
 export const CONFIG_VERSION = '1';
 export const CONFIG_FILENAME = '.webpressorc.json';
+export const LEGACY_CONFIG_FILENAME = '.agent-kitrc.json';
 export const DEFAULT_DURABLE_PLANNING_ROOT = '.agent/planning/';
 function readOptionalString(value) {
     if (typeof value !== 'string')
@@ -27,14 +28,12 @@ export function defaultConfig() {
         durablePlanningRoot: DEFAULT_DURABLE_PLANNING_ROOT,
     };
 }
-export function readConfig(repoRoot) {
-    const path = join(repoRoot, CONFIG_FILENAME);
-    if (!existsSync(path))
-        return null;
+function parseConfigFile(path) {
     try {
         const raw = readFileSync(path, 'utf8');
         const parsed = JSON.parse(raw);
         const installed = parsed.installed;
+        const audit = parsed.audit;
         const mcp = parsed.mcp;
         const hosts = parsed.hosts;
         const rules = parsed.rules;
@@ -60,12 +59,17 @@ export function readConfig(repoRoot) {
                 ...(scriptRoutes ? { scriptRoutes } : {}),
             }
             : undefined;
-        const auditConfig = parsed.audit;
-        const rawAllowDeps = auditConfig?.toolchainIsolation?.allowDependencies;
-        const allowDependencies = Array.isArray(rawAllowDeps)
-            ? rawAllowDeps.filter((s) => typeof s === 'string' && s.length > 0)
-            : [];
-        const normalizedAudit = allowDependencies.length > 0 ? { toolchainIsolation: { allowDependencies } } : undefined;
+        const rawToolchainIsolation = audit?.toolchainIsolation;
+        const allowDependencies = Array.isArray(rawToolchainIsolation?.allowDependencies)
+            ? rawToolchainIsolation.allowDependencies.filter((value) => typeof value === 'string' && value.length > 0)
+            : undefined;
+        const normalizedAudit = allowDependencies && allowDependencies.length > 0
+            ? {
+                toolchainIsolation: {
+                    allowDependencies,
+                },
+            }
+            : undefined;
         const selectedHosts = Array.isArray(hosts?.selected)
             ? hosts.selected.filter((s) => ['codex', 'claude', 'opencode'].includes(String(s)))
             : [];
@@ -83,9 +87,9 @@ export function readConfig(repoRoot) {
                 requiredCapabilities,
                 ...(visibility ? { visibility } : {}),
             },
+            ...(normalizedAudit ? { audit: normalizedAudit } : {}),
             ...(normalizedMcp ? { mcp: normalizedMcp } : {}),
             ...(normalizedGuard ? { guard: normalizedGuard } : {}),
-            ...(normalizedAudit ? { audit: normalizedAudit } : {}),
             rules: { overrides: overrides.filter((s) => typeof s === 'string') },
             scripts: {
                 'setup-agent': readOptionalString(scripts?.['setup-agent']),
@@ -102,6 +106,15 @@ export function readConfig(repoRoot) {
         return null;
     }
 }
+export function readConfig(repoRoot) {
+    const configPath = join(repoRoot, CONFIG_FILENAME);
+    if (existsSync(configPath))
+        return parseConfigFile(configPath);
+    const legacyConfigPath = join(repoRoot, LEGACY_CONFIG_FILENAME);
+    if (existsSync(legacyConfigPath))
+        return parseConfigFile(legacyConfigPath);
+    return null;
+}
 export function mergeConfig(existing, incoming) {
     if (!existing)
         return incoming;
@@ -113,6 +126,17 @@ export function mergeConfig(existing, incoming) {
             ...incoming.mcp,
         }
         : undefined;
+    const mergedAllowDependencies = Array.from(new Set([
+        ...(existing.audit?.toolchainIsolation?.allowDependencies ?? []),
+        ...(incoming.audit?.toolchainIsolation?.allowDependencies ?? []),
+    ])).toSorted();
+    const mergedAudit = mergedAllowDependencies.length > 0
+        ? {
+            toolchainIsolation: {
+                allowDependencies: mergedAllowDependencies,
+            },
+        }
+        : undefined;
     const mergedScriptRoutes = existing.guard?.scriptRoutes || incoming.guard?.scriptRoutes
         ? { ...existing.guard?.scriptRoutes, ...incoming.guard?.scriptRoutes }
         : undefined;
@@ -123,21 +147,13 @@ export function mergeConfig(existing, incoming) {
             ...(mergedScriptRoutes ? { scriptRoutes: mergedScriptRoutes } : {}),
         }
         : undefined;
-    const existingAllowDeps = existing.audit?.toolchainIsolation?.allowDependencies;
-    const incomingAllowDeps = incoming.audit?.toolchainIsolation?.allowDependencies;
-    const mergedAllowDeps = existingAllowDeps || incomingAllowDeps
-        ? Array.from(new Set([...(existingAllowDeps ?? []), ...(incomingAllowDeps ?? [])])).toSorted()
-        : undefined;
-    const mergedAudit = mergedAllowDeps
-        ? { toolchainIsolation: { allowDependencies: mergedAllowDeps } }
-        : undefined;
     return {
         version: incoming.version,
         installed: { tier3Skills: tier3 },
         hosts: incoming.hosts ?? existing.hosts,
+        ...(mergedAudit ? { audit: mergedAudit } : {}),
         ...(mergedMcp ? { mcp: mergedMcp } : {}),
         ...(mergedGuard ? { guard: mergedGuard } : {}),
-        ...(mergedAudit ? { audit: mergedAudit } : {}),
         rules: { overrides },
         scripts: {
             'setup-agent': incoming.scripts['setup-agent'] ?? existing.scripts['setup-agent'],

package/dist/esm/cli/commands/init/gitignore-patcher.js

@@ -73,7 +73,6 @@ export const GENERATED_PATHS_BLOCK = {
         '.agent/.merged.provenance.json',
         '.agent/.compile-manifest.json',
         '.agent/.rotation-log.jsonl',
-        '.agent/.blueprints.db',
         '.agent/.blueprints.lock',
         '.agent/.blueprints.snapshot.sql',
         '.agent/.tail-hint-history.jsonl',

package/dist/esm/cli/commands/init/index.d.ts

@@ -17,7 +17,14 @@ export declare const EXIT_SUCCESS = 0;
 export declare const EXIT_SETUP_FAIL = 1;
 export declare const EXIT_USER_ABORT = 2;
 export declare const EXIT_WRITE_FAIL = 3;
-export declare function resolveCatalogDir(): string;
+export interface ResolveCatalogDirOptions {
+    readonly moduleUrl?: string;
+    readonly execPath?: string;
+    readonly argv0?: string;
+    readonly argv1?: string;
+    readonly pathEnv?: string;
+}
+export declare function resolveCatalogDir(options?: ResolveCatalogDirOptions): string;
 export declare function runInit(flags: InitFlags): Promise<number>;
 export type InitCommandName = 'setup' | 'init';
 export declare function registerInitCommand(cli: CAC, commandName?: InitCommandName): void;