agent-contracts 0.24.1 → 0.30.0

package/dist/index.js

@@ -158,11 +158,11 @@ function __metadata(metadataKey, metadataValue) {
 }
 function __awaiter(thisArg, _arguments, P2, generator) {
   function adopt(value) {
-    return value instanceof P2 ? value : new P2(function(resolve7) {
-      resolve7(value);
+    return value instanceof P2 ? value : new P2(function(resolve8) {
+      resolve8(value);
     });
   }
-  return new (P2 || (P2 = Promise))(function(resolve7, reject) {
+  return new (P2 || (P2 = Promise))(function(resolve8, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -178,7 +178,7 @@ function __awaiter(thisArg, _arguments, P2, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve7(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve8(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -369,14 +369,14 @@ function __asyncValues(o3) {
   }, i3);
   function verb(n3) {
     i3[n3] = o3[n3] && function(v2) {
-      return new Promise(function(resolve7, reject) {
-        v2 = o3[n3](v2), settle(resolve7, reject, v2.done, v2.value);
+      return new Promise(function(resolve8, reject) {
+        v2 = o3[n3](v2), settle(resolve8, reject, v2.done, v2.value);
       });
     };
   }
-  function settle(resolve7, reject, d2, v2) {
+  function settle(resolve8, reject, d2, v2) {
     Promise.resolve(v2).then(function(v3) {
-      resolve7({ value: v3, done: d2 });
+      resolve8({ value: v3, done: d2 });
     }, reject);
   }
 }
@@ -12936,13 +12936,13 @@ var require_yaml2 = __commonJS({
     function getLocationForJsonPath(result, path) {
       return (0, yaml_1.getLocationForJsonPath)(result, path);
     }
-    var parseYaml4 = (input) => (0, yaml_1.parseWithPointers)(input, {
+    var parseYaml5 = (input) => (0, yaml_1.parseWithPointers)(input, {
       ignoreDuplicateKeys: false,
       mergeKeys: true,
       preserveKeyOrder: true,
       attachComments: false
     });
-    exports.parseYaml = parseYaml4;
+    exports.parseYaml = parseYaml5;
     exports.Yaml = {
       parse: exports.parseYaml,
       getLocationForJsonPath,
@@ -13032,11 +13032,11 @@ function __metadata2(metadataKey, metadataValue) {
 }
 function __awaiter2(thisArg, _arguments, P2, generator) {
   function adopt(value) {
-    return value instanceof P2 ? value : new P2(function(resolve7) {
-      resolve7(value);
+    return value instanceof P2 ? value : new P2(function(resolve8) {
+      resolve8(value);
     });
   }
-  return new (P2 || (P2 = Promise))(function(resolve7, reject) {
+  return new (P2 || (P2 = Promise))(function(resolve8, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -13052,7 +13052,7 @@ function __awaiter2(thisArg, _arguments, P2, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve7(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve8(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -13230,14 +13230,14 @@ function __asyncValues2(o3) {
   }, i3);
   function verb(n3) {
     i3[n3] = o3[n3] && function(v2) {
-      return new Promise(function(resolve7, reject) {
-        v2 = o3[n3](v2), settle(resolve7, reject, v2.done, v2.value);
+      return new Promise(function(resolve8, reject) {
+        v2 = o3[n3](v2), settle(resolve8, reject, v2.done, v2.value);
       });
     };
   }
-  function settle(resolve7, reject, d2, v2) {
+  function settle(resolve8, reject, d2, v2) {
     Promise.resolve(v2).then(function(v3) {
-      resolve7({ value: v3, done: d2 });
+      resolve8({ value: v3, done: d2 });
     }, reject);
   }
 }
@@ -18835,7 +18835,7 @@ function consumeBody() {
   let accum = [];
   let accumBytes = 0;
   let abort = false;
-  return new Body.Promise(function(resolve7, reject) {
+  return new Body.Promise(function(resolve8, reject) {
     let resTimeout;
     if (_this4.timeout) {
       resTimeout = setTimeout(function() {
@@ -18869,7 +18869,7 @@ function consumeBody() {
       }
       clearTimeout(resTimeout);
       try {
-        resolve7(Buffer.concat(accum, accumBytes));
+        resolve8(Buffer.concat(accum, accumBytes));
       } catch (err) {
         reject(new FetchError(`Could not create Buffer from response body for ${_this4.url}: ${err.message}`, "system", err));
       }
@@ -19132,7 +19132,7 @@ function fetch(url, opts) {
     throw new Error("native promise missing, set fetch.Promise to your favorite alternative");
   }
   Body.Promise = fetch.Promise;
-  return new fetch.Promise(function(resolve7, reject) {
+  return new fetch.Promise(function(resolve8, reject) {
     const request = new Request(url, opts);
     const options = getNodeRequestOptions(request);
     const send = (options.protocol === "https:" ? https : http).request;
@@ -19265,7 +19265,7 @@ function fetch(url, opts) {
               requestOpts.body = void 0;
               requestOpts.headers.delete("content-length");
             }
-            resolve7(fetch(new Request(locationURL, requestOpts)));
+            resolve8(fetch(new Request(locationURL, requestOpts)));
             finalize();
             return;
         }
@@ -19286,7 +19286,7 @@ function fetch(url, opts) {
       const codings = headers.get("Content-Encoding");
       if (!request.compress || request.method === "HEAD" || codings === null || res.statusCode === 204 || res.statusCode === 304) {
         response = new Response(body, response_options);
-        resolve7(response);
+        resolve8(response);
         return;
       }
       const zlibOptions = {
@@ -19296,7 +19296,7 @@ function fetch(url, opts) {
       if (codings == "gzip" || codings == "x-gzip") {
         body = body.pipe(zlib.createGunzip(zlibOptions));
         response = new Response(body, response_options);
-        resolve7(response);
+        resolve8(response);
         return;
       }
       if (codings == "deflate" || codings == "x-deflate") {
@@ -19308,12 +19308,12 @@ function fetch(url, opts) {
             body = body.pipe(zlib.createInflateRaw());
           }
           response = new Response(body, response_options);
-          resolve7(response);
+          resolve8(response);
         });
         raw.on("end", function() {
           if (!response) {
             response = new Response(body, response_options);
-            resolve7(response);
+            resolve8(response);
           }
         });
         return;
@@ -19321,11 +19321,11 @@ function fetch(url, opts) {
       if (codings == "br" && typeof zlib.createBrotliDecompress === "function") {
         body = body.pipe(zlib.createBrotliDecompress());
         response = new Response(body, response_options);
-        resolve7(response);
+        resolve8(response);
         return;
       }
       response = new Response(body, response_options);
-      resolve7(response);
+      resolve8(response);
     });
     writeToStream(req, request);
   });
@@ -20038,13 +20038,13 @@ var require_file = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     var fs_1 = __require("fs");
     function resolveFile(ref) {
-      return new Promise((resolve7, reject) => {
+      return new Promise((resolve8, reject) => {
         const path = ref.href();
         fs_1.readFile(path, "utf8", (err, data) => {
           if (err) {
             reject(err);
           } else {
-            resolve7(data);
+            resolve8(data);
           }
         });
       });
@@ -27647,12 +27647,12 @@ var require_reader = __commonJS({
         }
       } else {
         try {
-          return await new Promise((resolve7, reject) => {
+          return await new Promise((resolve8, reject) => {
             fs.readFile(name, opts.encoding, (err, data) => {
               if (err !== null) {
                 reject(err);
               } else {
-                resolve7(data);
+                resolve8(data);
               }
             });
           });
@@ -44537,14 +44537,14 @@ var require_AsyncFromSyncIteratorContinuation = __commonJS({
       if (!$Promise) {
         throw new $SyntaxError("This environment does not support Promises.");
       }
-      return new $Promise(function(resolve7) {
+      return new $Promise(function(resolve8) {
         var done = IteratorComplete(result);
         var value = IteratorValue(result);
         var valueWrapper = PromiseResolve($Promise, value);
         var onFulfilled = function(value2) {
           return CreateIteratorResultObject(value2, done);
         };
-        resolve7($then(valueWrapper, onFulfilled));
+        resolve8($then(valueWrapper, onFulfilled));
       });
     };
   }
@@ -45092,7 +45092,7 @@ var require_CreateAsyncFromSyncIterator = __commonJS({
         var O2 = this;
         SLOT.assert(O2, "[[SyncIteratorRecord]]");
         var argsLength = arguments.length;
-        return new $Promise(function(resolve7) {
+        return new $Promise(function(resolve8) {
           var syncIteratorRecord = SLOT.get(O2, "[[SyncIteratorRecord]]");
           var result;
           if (argsLength > 0) {
@@ -45100,7 +45100,7 @@ var require_CreateAsyncFromSyncIterator = __commonJS({
           } else {
             result = IteratorNext(syncIteratorRecord);
           }
-          resolve7(AsyncFromSyncIteratorContinuation(result));
+          resolve8(AsyncFromSyncIteratorContinuation(result));
         });
       },
       "return": function() {
@@ -45111,12 +45111,12 @@ var require_CreateAsyncFromSyncIterator = __commonJS({
         SLOT.assert(O2, "[[SyncIteratorRecord]]");
         var valueIsPresent = arguments.length > 0;
         var value = valueIsPresent ? arguments[0] : void 0;
-        return new $Promise(function(resolve7, reject) {
+        return new $Promise(function(resolve8, reject) {
           var syncIterator = SLOT.get(O2, "[[SyncIteratorRecord]]")["[[Iterator]]"];
           var iteratorReturn = GetMethod(syncIterator, "return");
           if (typeof iteratorReturn === "undefined") {
             var iterResult = CreateIteratorResultObject(value, true);
-            Call(resolve7, void 0, [iterResult]);
+            Call(resolve8, void 0, [iterResult]);
             return;
           }
           var result;
@@ -45129,7 +45129,7 @@ var require_CreateAsyncFromSyncIterator = __commonJS({
             Call(reject, void 0, [new $TypeError("Iterator `return` method returned a non-object value.")]);
             return;
           }
-          resolve7(AsyncFromSyncIteratorContinuation(result));
+          resolve8(AsyncFromSyncIteratorContinuation(result));
         });
       },
       "throw": function() {
@@ -45140,7 +45140,7 @@ var require_CreateAsyncFromSyncIterator = __commonJS({
         SLOT.assert(O2, "[[SyncIteratorRecord]]");
         var valueIsPresent = arguments.length > 0;
         var value = valueIsPresent ? arguments[0] : void 0;
-        return new $Promise(function(resolve7, reject) {
+        return new $Promise(function(resolve8, reject) {
           var syncIterator = SLOT.get(O2, "[[SyncIteratorRecord]]")["[[Iterator]]"];
           var throwMethod = GetMethod(syncIterator, "throw");
           if (typeof throwMethod === "undefined") {
@@ -45157,7 +45157,7 @@ var require_CreateAsyncFromSyncIterator = __commonJS({
             Call(reject, void 0, [new $TypeError("Iterator `throw` method returned a non-object value.")]);
             return;
           }
-          resolve7(AsyncFromSyncIteratorContinuation(
+          resolve8(AsyncFromSyncIteratorContinuation(
             result
             /* , promiseCapability */
           ));
@@ -48919,6 +48919,7 @@ var PrerequisiteSchema = z.object({
 var AgentSchema = z.object({
   role_name: z.string(),
   purpose: z.string(),
+  own_artifacts: z.array(z.string()).default([]),
   can_read_artifacts: z.array(z.string()).default([]),
   can_write_artifacts: z.array(z.string()).default([]),
   can_execute_tools: z.array(z.string()).default([]),
@@ -48974,11 +48975,12 @@ var CONTEXT_TYPES = [
   "policy",
   "guardrail",
   "guardrail_policy",
-  "system"
+  "system",
+  "navigation_index"
 ];
 var ContextTypeSchema = z3.enum(CONTEXT_TYPES);
 var ITERABLE_CONTEXT_TYPES = CONTEXT_TYPES.filter(
-  (t3) => t3 !== "system"
+  (t3) => t3 !== "system" && t3 !== "navigation_index"
 );
 
 // src/schema/binding.ts
@@ -49152,6 +49154,8 @@ var ExecutionStepSchema = z9.object({
   uses_tool: z9.string().optional(),
   produces_artifact: z9.string().optional(),
   reads_artifact: z9.string().optional(),
+  validates_artifact: z9.string().optional(),
+  validation_kind: z9.enum(["schema", "mechanical", "semantic", "approval", "provenance", "traceability", "fidelity"]).optional(),
   depends_on: z9.array(z9.string()).optional(),
   skip_condition: z9.string().optional(),
   wait_for_approval: z9.boolean().optional()
@@ -49214,11 +49218,15 @@ var CommandSchema = z12.object({
   purpose: z12.string().optional()
 });
 var ToolSchema = z12.object({
-  kind: z12.string(),
+  kind: z12.string().optional(),
+  extends: z12.string().optional(),
+  command: z12.string().optional(),
   description: z12.string().optional(),
   input_artifacts: z12.array(z12.string()).default([]),
   output_artifacts: z12.array(z12.string()).default([]),
   invokable_by: z12.array(z12.string()).default([]),
+  cli_contract: z12.string().optional(),
+  artifact_bindings: z12.record(z12.string(), z12.string()).default({}),
   side_effects: z12.array(z12.string()).default([]),
   commands: z12.array(CommandSchema).default([]),
   guardrails: z12.array(z12.string()).optional()
@@ -49229,8 +49237,8 @@ import { z as z13 } from "zod";
 var ValidationSchema = z13.object({
   target_artifact: z13.string(),
   kind: z13.enum(["schema", "mechanical", "semantic", "approval", "provenance", "traceability", "fidelity"]),
-  executor_type: z13.enum(["tool", "agent"]),
-  executor: z13.string(),
+  executor_type: z13.enum(["tool", "agent"]).optional(),
+  executor: z13.string().optional(),
   blocking: z13.boolean(),
   produces_evidence: z13.string().optional(),
   description: z13.string().optional()
@@ -50161,6 +50169,123 @@ function mergeDsl(base, project) {
 
 // src/resolver/resolve.ts
 import { dirname as dirname2, resolve as resolvePath } from "path";
+
+// src/resolver/tool-extends.ts
+var ToolExtendsError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ToolExtendsError";
+  }
+};
+function asStringArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function asRecord(value) {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    return value;
+  }
+  return {};
+}
+function asCommands(value) {
+  return Array.isArray(value) ? value : [];
+}
+function isUnset(value) {
+  return value === void 0 || value === null;
+}
+function mergeToolFields(base, child) {
+  const merged = { ...child };
+  merged.artifact_bindings = {
+    ...asRecord(base.artifact_bindings),
+    ...asRecord(child.artifact_bindings)
+  };
+  if (isUnset(child.kind) && !isUnset(base.kind)) {
+    merged.kind = base.kind;
+  }
+  if (isUnset(child.cli_contract) && !isUnset(base.cli_contract)) {
+    merged.cli_contract = base.cli_contract;
+  }
+  if (isUnset(child.description) && !isUnset(base.description)) {
+    merged.description = base.description;
+  }
+  const childInvokableBy = asStringArray(child.invokable_by);
+  const baseInvokableBy = asStringArray(base.invokable_by);
+  if (childInvokableBy.length === 0 && baseInvokableBy.length > 0) {
+    merged.invokable_by = [...baseInvokableBy];
+  }
+  const childInputArtifacts = asStringArray(child.input_artifacts);
+  const baseInputArtifacts = asStringArray(base.input_artifacts);
+  if (childInputArtifacts.length === 0 && baseInputArtifacts.length > 0) {
+    merged.input_artifacts = [...baseInputArtifacts];
+  }
+  const childOutputArtifacts = asStringArray(child.output_artifacts);
+  const baseOutputArtifacts = asStringArray(base.output_artifacts);
+  if (childOutputArtifacts.length === 0 && baseOutputArtifacts.length > 0) {
+    merged.output_artifacts = [...baseOutputArtifacts];
+  }
+  const childSideEffects = asStringArray(child.side_effects);
+  const baseSideEffects = asStringArray(base.side_effects);
+  if (childSideEffects.length === 0 && baseSideEffects.length > 0) {
+    merged.side_effects = [...baseSideEffects];
+  }
+  const childCommands = asCommands(child.commands);
+  const baseCommands = asCommands(base.commands);
+  if (childCommands.length === 0 && baseCommands.length > 0) {
+    merged.commands = [...baseCommands];
+  }
+  if (isUnset(child.guardrails) && !isUnset(base.guardrails)) {
+    merged.guardrails = base.guardrails;
+  }
+  return merged;
+}
+function resolveToolChain(id, tools, resolving, resolved) {
+  const cached = resolved.get(id);
+  if (cached !== void 0) {
+    return cached;
+  }
+  const tool = tools[id];
+  if (tool === void 0) {
+    throw new ToolExtendsError(`Tool "${id}" not found`);
+  }
+  const extendsId = tool.extends;
+  if (extendsId === void 0) {
+    resolved.set(id, tool);
+    return tool;
+  }
+  if (resolving.has(id)) {
+    throw new ToolExtendsError(
+      `Circular tool extends detected involving "${id}"`
+    );
+  }
+  const baseTool = tools[extendsId];
+  if (baseTool === void 0) {
+    resolved.set(id, tool);
+    return tool;
+  }
+  resolving.add(id);
+  try {
+    const resolvedBase = resolveToolChain(
+      extendsId,
+      tools,
+      resolving,
+      resolved
+    );
+    const merged = mergeToolFields(resolvedBase, tool);
+    resolved.set(id, merged);
+    return merged;
+  } finally {
+    resolving.delete(id);
+  }
+}
+function resolveToolExtends(tools) {
+  const resolved = /* @__PURE__ */ new Map();
+  const result = {};
+  for (const id of Object.keys(tools)) {
+    result[id] = resolveToolChain(id, tools, /* @__PURE__ */ new Set(), resolved);
+  }
+  return result;
+}
+
+// src/resolver/resolve.ts
 async function resolveExtendsChain(data, filePath, seen) {
   const extendsValue = data["extends"];
   if (typeof extendsValue !== "string") {
@@ -50190,6 +50315,10 @@ async function resolve3(projectDirOrFile) {
     projectResult.filePath,
     /* @__PURE__ */ new Set()
   );
+  const tools = data["tools"];
+  if (tools !== void 0 && tools !== null && typeof tools === "object" && !Array.isArray(tools)) {
+    data["tools"] = resolveToolExtends(tools);
+  }
   return {
     data,
     projectPath: projectResult.filePath,
@@ -50959,6 +51088,9 @@ function checkReferences(dsl) {
     }
   }
   for (const [id, agent] of Object.entries(dsl.agents)) {
+    for (const ref of agent.own_artifacts) {
+      checkExists(ref, artifactIds, "artifacts", `agents.${id}.own_artifacts`);
+    }
     for (const ref of agent.can_read_artifacts) {
       checkExists(ref, artifactIds, "artifacts", `agents.${id}.can_read_artifacts`);
     }
@@ -51004,7 +51136,7 @@ function checkReferences(dsl) {
   for (const [id, art] of Object.entries(dsl.artifacts)) {
     if (art.owner) {
       const ownerAgent = dsl.agents[art.owner];
-      if (ownerAgent && !ownerAgent.can_read_artifacts.includes(id)) {
+      if (ownerAgent && ownerAgent.can_read_artifacts.length > 0 && !ownerAgent.can_read_artifacts.includes(id)) {
         diagnostics.push({
           path: `artifacts.${id}.owner`,
           message: `Agent "${art.owner}" owns artifact "${id}" but cannot read it (missing from can_read_artifacts)`,
@@ -51014,7 +51146,7 @@ function checkReferences(dsl) {
     }
     for (const valId of art.required_validations) {
       const validation = dsl.validations[valId];
-      if (validation?.executor_type === "tool") {
+      if (validation?.executor_type === "tool" && validation.executor) {
         const tool = dsl.tools[validation.executor];
         if (tool && tool.invokable_by.length === 0) {
           diagnostics.push({
@@ -51027,17 +51159,29 @@ function checkReferences(dsl) {
     }
   }
   for (const [id, tool] of Object.entries(dsl.tools)) {
+    if (tool.extends) {
+      checkExists(
+        tool.extends,
+        toolIds,
+        "tools",
+        `tools.${id}.extends`,
+        "tool-extends-not-found"
+      );
+    }
     if (tool.invokable_by.length > 0) {
       for (const ref of tool.invokable_by) {
         checkExists(ref, agentIds, "agents", `tools.${id}.invokable_by`);
       }
     }
+    for (const ref of Object.values(tool.artifact_bindings)) {
+      checkExists(ref, artifactIds, "artifacts", `tools.${id}.artifact_bindings`);
+    }
   }
   for (const [id, val] of Object.entries(dsl.validations)) {
     checkExists(val.target_artifact, artifactIds, "artifacts", `validations.${id}.target_artifact`);
-    if (val.executor_type === "tool") {
+    if (val.executor_type === "tool" && val.executor) {
       checkExists(val.executor, toolIds, "tools", `validations.${id}.executor`);
-    } else if (val.executor_type === "agent") {
+    } else if (val.executor_type === "agent" && val.executor) {
       checkExists(val.executor, agentIds, "agents", `validations.${id}.executor`);
     }
   }
@@ -51106,14 +51250,16 @@ function checkReferences(dsl) {
           code: "result-handoff-not-returnable"
         });
       }
-      for (let j2 = 0; j2 < task.input_artifacts.length; j2++) {
-        const inputId = task.input_artifacts[j2];
-        if (!targetAgent.can_read_artifacts.includes(inputId)) {
-          diagnostics.push({
-            path: `tasks.${id}.input_artifacts[${j2}]`,
-            message: `Input artifact "${inputId}" is not in target agent "${task.target_agent}" can_read_artifacts`,
-            code: "input-artifact-not-readable"
-          });
+      if (targetAgent.can_read_artifacts.length > 0) {
+        for (let j2 = 0; j2 < task.input_artifacts.length; j2++) {
+          const inputId = task.input_artifacts[j2];
+          if (!targetAgent.can_read_artifacts.includes(inputId)) {
+            diagnostics.push({
+              path: `tasks.${id}.input_artifacts[${j2}]`,
+              message: `Input artifact "${inputId}" is not in target agent "${task.target_agent}" can_read_artifacts`,
+              code: "input-artifact-not-readable"
+            });
+          }
         }
       }
     }
@@ -51129,7 +51275,7 @@ function checkReferences(dsl) {
     if (agent.prerequisites) {
       for (let j2 = 0; j2 < agent.prerequisites.length; j2++) {
         const pre = agent.prerequisites[j2];
-        if (!agent.can_read_artifacts.includes(pre.target)) {
+        if (agent.can_read_artifacts.length > 0 && !agent.can_read_artifacts.includes(pre.target)) {
           diagnostics.push({
             path: `agents.${id}.prerequisites[${j2}].target`,
             message: `Prerequisite target "${pre.target}" is not in agent "${id}" can_read_artifacts`,
@@ -51461,7 +51607,7 @@ var toolExecutionRule = {
       }
     }
     for (const [valId, val] of Object.entries(dsl.validations)) {
-      if (val.executor_type !== "tool") continue;
+      if (val.executor_type !== "tool" || !val.executor) continue;
       const hasExecutor = Object.values(dsl.agents).some(
         (a3) => a3.can_execute_tools.includes(val.executor)
       );
@@ -51520,14 +51666,16 @@ var taskAgentBindingRule = {
     for (const [taskId, task] of Object.entries(dsl.tasks)) {
       const targetAgent = dsl.agents[task.target_agent];
       if (!targetAgent) continue;
-      for (const ref of task.input_artifacts) {
-        if (!targetAgent.can_read_artifacts.includes(ref)) {
-          diagnostics.push({
-            ruleId: "task-agent-binding",
-            severity: "error",
-            path: `tasks.${taskId}.input_artifacts`,
-            message: `Task "${taskId}" input_artifact "${ref}" not in target agent "${task.target_agent}" can_read_artifacts`
-          });
+      if (targetAgent.can_read_artifacts.length > 0) {
+        for (const ref of task.input_artifacts) {
+          if (!targetAgent.can_read_artifacts.includes(ref)) {
+            diagnostics.push({
+              ruleId: "task-agent-binding",
+              severity: "error",
+              path: `tasks.${taskId}.input_artifacts`,
+              message: `Task "${taskId}" input_artifact "${ref}" not in target agent "${task.target_agent}" can_read_artifacts`
+            });
+          }
         }
       }
       if (!targetAgent.can_return_handoffs.includes(task.result_handoff)) {
@@ -51563,7 +51711,7 @@ var taskAgentBindingRule = {
             });
           }
         }
-        if (step.produces_artifact) {
+        if (step.produces_artifact && targetAgent.can_write_artifacts.length > 0) {
           if (!targetAgent.can_write_artifacts.includes(step.produces_artifact)) {
             diagnostics.push({
               ruleId: "task-agent-binding",
@@ -51573,7 +51721,7 @@ var taskAgentBindingRule = {
             });
           }
         }
-        if (step.reads_artifact) {
+        if (step.reads_artifact && targetAgent.can_read_artifacts.length > 0) {
           if (!targetAgent.can_read_artifacts.includes(step.reads_artifact)) {
             diagnostics.push({
               ruleId: "task-agent-binding",
@@ -51638,7 +51786,8 @@ var artifactOwnershipRule = {
         }
         if (step.reads_artifact) {
           const artifact = dsl.artifacts[step.reads_artifact];
-          if (artifact && (artifact.consumers.length > 0 || artifact.producers.length > 0 || artifact.editors.length > 0)) {
+          const hasDeprecatedOwnership = !!artifact?.owner || (artifact?.producers.length ?? 0) > 0 || (artifact?.editors.length ?? 0) > 0 || (artifact?.consumers.length ?? 0) > 0;
+          if (artifact && hasDeprecatedOwnership) {
             const canRead = artifact.consumers.includes(agentId) || artifact.producers.includes(agentId) || artifact.editors.includes(agentId);
             if (!canRead) {
               diagnostics.push({
@@ -52041,6 +52190,7 @@ var validationExecutorNoContextRule = {
   run(dsl) {
     const diagnostics = [];
     for (const [validationId, val] of Object.entries(dsl.validations)) {
+      if (!val.executor) continue;
       if (val.executor_type === "agent") {
         const agent = dsl.agents[val.executor];
         if (!agent) continue;
@@ -52068,6 +52218,103 @@ var validationExecutorNoContextRule = {
   }
 };
 
+// src/linter/rules/artifact-ownership-consistency.ts
+var artifactOwnershipConsistencyRule = {
+  id: "artifact-ownership-consistency",
+  description: "Ensure own_artifacts entries are included in can_read_artifacts and check deprecated owner field consistency",
+  run(dsl) {
+    const diagnostics = [];
+    for (const [agentId, agent] of Object.entries(dsl.agents)) {
+      if (agent.own_artifacts.length === 0) continue;
+      for (const artId of agent.own_artifacts) {
+        if (!agent.can_read_artifacts.includes(artId)) {
+          diagnostics.push({
+            ruleId: "artifact-ownership-consistency",
+            severity: "warning",
+            path: `agents.${agentId}.own_artifacts`,
+            message: `Agent "${agentId}" owns artifact "${artId}" but does not include it in can_read_artifacts`
+          });
+        }
+      }
+    }
+    for (const [artId, art] of Object.entries(dsl.artifacts)) {
+      if (!art.owner) continue;
+      const ownerAgent = dsl.agents[art.owner];
+      if (ownerAgent && !ownerAgent.own_artifacts.includes(artId)) {
+        diagnostics.push({
+          ruleId: "artifact-ownership-consistency",
+          severity: "warning",
+          path: `artifacts.${artId}.owner`,
+          message: `Artifact "${artId}" has deprecated owner "${art.owner}" but agent does not list it in own_artifacts`
+        });
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/deprecated-ownership-fields.ts
+var ARTIFACT_FIELDS = ["owner", "producers", "editors", "consumers"];
+var AGENT_FIELDS = [
+  "own_artifacts",
+  "can_read_artifacts",
+  "can_write_artifacts"
+];
+function isArtifactFieldUsed(artifact, field) {
+  switch (field) {
+    case "owner":
+      return !!artifact.owner;
+    case "producers":
+      return artifact.producers.length > 0;
+    case "editors":
+      return artifact.editors.length > 0;
+    case "consumers":
+      return artifact.consumers.length > 0;
+  }
+}
+function isAgentFieldUsed(agent, field) {
+  switch (field) {
+    case "own_artifacts":
+      return agent.own_artifacts.length > 0;
+    case "can_read_artifacts":
+      return agent.can_read_artifacts.length > 0;
+    case "can_write_artifacts":
+      return agent.can_write_artifacts.length > 0;
+  }
+}
+var deprecatedOwnershipFieldsRule = {
+  id: "deprecated-ownership-fields",
+  description: "Warn when deprecated ownership/permission fields are used instead of artifact_bindings + artifact_slots",
+  run(dsl) {
+    const diagnostics = [];
+    for (const [artId, artifact] of Object.entries(dsl.artifacts)) {
+      for (const field of ARTIFACT_FIELDS) {
+        if (isArtifactFieldUsed(artifact, field)) {
+          diagnostics.push({
+            ruleId: "deprecated-ownership-fields",
+            severity: "warning",
+            path: `artifacts.${artId}.${field}`,
+            message: `Artifact "${artId}" uses deprecated field "${field}". Ownership is derived from artifact_bindings + artifact_slots in the binding model.`
+          });
+        }
+      }
+    }
+    for (const [agentId, agent] of Object.entries(dsl.agents)) {
+      for (const field of AGENT_FIELDS) {
+        if (isAgentFieldUsed(agent, field)) {
+          diagnostics.push({
+            ruleId: "deprecated-ownership-fields",
+            severity: "warning",
+            path: `agents.${agentId}.${field}`,
+            message: `Agent "${agentId}" uses deprecated field "${field}". Artifact permissions are derived from artifact_bindings + artifact_slots in the binding model.`
+          });
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+
 // src/linter/rules/extension-consumption.ts
 function isRecord4(v2) {
   return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
@@ -52238,6 +52485,194 @@ var extensionUndeclaredUsageRule = {
   }
 };
 
+// src/navigation-index/cli-contract-loader.ts
+import { existsSync, readFileSync } from "fs";
+import { isAbsolute, resolve as resolve4 } from "path";
+import { parse as parseYaml2 } from "yaml";
+function extractStringArray(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((item) => typeof item === "string");
+}
+function extractArtifactSlots(doc) {
+  const slots = doc.artifact_slots;
+  if (!slots || typeof slots !== "object") return null;
+  const result = {};
+  for (const [name, slotDef] of Object.entries(slots)) {
+    if (!slotDef || typeof slotDef !== "object") continue;
+    const direction = slotDef.direction;
+    if (direction === "read" || direction === "write" || direction === "readwrite") {
+      result[name] = { direction };
+    }
+  }
+  return Object.keys(result).length > 0 ? result : null;
+}
+function extractCommandEffects(doc) {
+  const result = {};
+  const commandSets = doc.command_sets;
+  if (!commandSets || typeof commandSets !== "object") return result;
+  for (const setDef of Object.values(commandSets)) {
+    if (!setDef || typeof setDef !== "object") continue;
+    const commands = setDef.commands;
+    if (!commands || typeof commands !== "object") continue;
+    for (const [cmdName, cmdDef] of Object.entries(commands)) {
+      if (!cmdDef || typeof cmdDef !== "object") continue;
+      const effects = cmdDef.effects;
+      if (!effects || typeof effects !== "object") continue;
+      result[cmdName] = {
+        reads: extractStringArray(effects.reads),
+        writes: extractStringArray(effects.writes)
+      };
+    }
+  }
+  return result;
+}
+function resolveCliContractPath(cliContractPath) {
+  return isAbsolute(cliContractPath) ? cliContractPath : resolve4(process.cwd(), cliContractPath);
+}
+function loadCliContractSlots(cliContractPath) {
+  const filePath = resolveCliContractPath(cliContractPath);
+  if (!existsSync(filePath)) return null;
+  let doc;
+  try {
+    doc = parseYaml2(readFileSync(filePath, "utf8"));
+  } catch {
+    return null;
+  }
+  if (!doc || typeof doc !== "object") return null;
+  const artifactSlots = extractArtifactSlots(doc);
+  if (!artifactSlots) return null;
+  return {
+    artifactSlots,
+    commandEffects: extractCommandEffects(doc)
+  };
+}
+function resolveSlotDirection(slot, command, slotInfo) {
+  const cmdEffects = slotInfo.commandEffects[command];
+  if (cmdEffects) {
+    if (cmdEffects.writes.includes(slot)) return "write";
+    if (cmdEffects.reads.includes(slot)) return "read";
+  }
+  const slotDecl = slotInfo.artifactSlots[slot];
+  if (slotDecl) {
+    if (slotDecl.direction === "write" || slotDecl.direction === "readwrite") {
+      return "write";
+    }
+    return "read";
+  }
+  return "read";
+}
+
+// src/linter/rules/binding-completeness.ts
+var bindingCompletenessRule = {
+  id: "binding-completeness",
+  description: "Check that artifact_bindings cover all slots referenced in the cli-contract command effects",
+  run(dsl) {
+    const diagnostics = [];
+    for (const [toolId, tool] of Object.entries(dsl.tools)) {
+      if (!tool.cli_contract || !tool.artifact_bindings) continue;
+      const slotInfo = loadCliContractSlots(tool.cli_contract);
+      if (!slotInfo?.artifactSlots) continue;
+      const command = tool.command ?? "";
+      const effects = slotInfo.commandEffects[command];
+      if (!effects) continue;
+      const referencedSlots = [...effects.reads, ...effects.writes];
+      const boundSlots = new Set(Object.keys(tool.artifact_bindings));
+      for (const slot of referencedSlots) {
+        if (boundSlots.has(slot)) continue;
+        diagnostics.push({
+          ruleId: "binding-completeness",
+          severity: "warning",
+          path: `tools.${toolId}.artifact_bindings`,
+          message: `Command "${command}" references slot "${slot}" but tool has no artifact_bindings entry for it`
+        });
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/binding-direction-match.ts
+function agentCanWriteArtifact(agentId, artifactId, dsl) {
+  const agent = dsl.agents[agentId];
+  if (!agent) return false;
+  return agent.can_write_artifacts.includes(artifactId) || agent.own_artifacts.includes(artifactId);
+}
+var bindingDirectionMatchRule = {
+  id: "binding-direction-match",
+  description: "Check that agents invoking a tool can write artifacts bound via write slots",
+  run(dsl) {
+    const diagnostics = [];
+    for (const [toolId, tool] of Object.entries(dsl.tools)) {
+      if (!tool.cli_contract || !tool.artifact_bindings) continue;
+      const slotInfo = loadCliContractSlots(tool.cli_contract);
+      if (!slotInfo) continue;
+      const command = tool.command ?? "";
+      for (const [slot, artifactId] of Object.entries(tool.artifact_bindings)) {
+        const direction = resolveSlotDirection(slot, command, slotInfo);
+        if (direction !== "write") continue;
+        for (const agentId of tool.invokable_by) {
+          if (agentCanWriteArtifact(agentId, artifactId, dsl)) continue;
+          diagnostics.push({
+            ruleId: "binding-direction-match",
+            severity: "warning",
+            path: `tools.${toolId}.artifact_bindings.${slot}`,
+            message: `Agent "${agentId}" invokes tool "${toolId}" which writes to artifact "${artifactId}" via slot "${slot}", but agent lacks can_write_artifacts or own_artifacts for it`
+          });
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/slot-declaration-exists.ts
+var slotDeclarationExistsRule = {
+  id: "slot-declaration-exists",
+  description: "Check that artifact_bindings keys reference slot names declared in the cli-contract",
+  run(dsl) {
+    const diagnostics = [];
+    for (const [toolId, tool] of Object.entries(dsl.tools)) {
+      if (!tool.cli_contract || !tool.artifact_bindings) continue;
+      const slotInfo = loadCliContractSlots(tool.cli_contract);
+      if (!slotInfo?.artifactSlots) continue;
+      for (const slot of Object.keys(tool.artifact_bindings)) {
+        if (slot in slotInfo.artifactSlots) continue;
+        diagnostics.push({
+          ruleId: "slot-declaration-exists",
+          severity: "warning",
+          path: `tools.${toolId}.artifact_bindings.${slot}`,
+          message: `artifact_bindings key "${slot}" is not declared in cli-contract artifactSlots`
+        });
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/config-path-consistency.ts
+var configPathConsistencyRule = {
+  id: "config-path-consistency",
+  description: "Check that control-authority artifacts bound by tools have path_patterns defined",
+  run(dsl) {
+    const diagnostics = [];
+    for (const [toolId, tool] of Object.entries(dsl.tools)) {
+      if (!tool.artifact_bindings) continue;
+      for (const [slot, artifactId] of Object.entries(tool.artifact_bindings)) {
+        const artifact = dsl.artifacts[artifactId];
+        if (!artifact || artifact.authority !== "control") continue;
+        if (artifact.path_patterns && artifact.path_patterns.length > 0) continue;
+        diagnostics.push({
+          ruleId: "config-path-consistency",
+          severity: "info",
+          path: `tools.${toolId}.artifact_bindings.${slot}`,
+          message: `Config artifact "${artifactId}" has no path_patterns; consider adding them for path-based lookup`
+        });
+      }
+    }
+    return diagnostics;
+  }
+};
+
 // src/linter/linter.ts
 var builtinRules = [
   validationCoverageRule,
@@ -52255,9 +52690,15 @@ var builtinRules = [
   entityNoGuardrailsRule,
   guardrailOrphanedRule,
   validationExecutorNoContextRule,
+  artifactOwnershipConsistencyRule,
+  deprecatedOwnershipFieldsRule,
   extensionDeclaredButUnusedRule,
   extensionScopeMismatchRule,
-  extensionUndeclaredUsageRule
+  extensionUndeclaredUsageRule,
+  bindingCompletenessRule,
+  bindingDirectionMatchRule,
+  slotDeclarationExistsRule,
+  configPathConsistencyRule
 ];
 function lint(dsl, rules = builtinRules) {
   const diagnostics = [];
@@ -52311,9 +52752,18 @@ var ref_exists_default = (0, import_spectral_core.createRulesetFunction)(
 
 // src/linter/spectral/functions/editors-not-empty.ts
 var import_spectral_core2 = __toESM(require_dist9(), 1);
+function allDeprecatedOwnershipFieldsEmpty(art) {
+  return !art.owner && (art.producers?.length ?? 0) === 0 && (art.editors?.length ?? 0) === 0 && (art.consumers?.length ?? 0) === 0;
+}
 var editors_not_empty_default = (0, import_spectral_core2.createRulesetFunction)(
   { input: { type: "array" }, options: null },
-  (targetVal, _options, _context) => {
+  (targetVal, _options, context) => {
+    const root = context.document.data;
+    const artId = context.path.length >= 2 ? String(context.path[1]) : void 0;
+    const artifact = artId && root.artifacts ? root.artifacts[artId] : void 0;
+    if (artifact && allDeprecatedOwnershipFieldsEmpty(artifact)) {
+      return [];
+    }
     if (targetVal.length === 0) {
       return [{ message: "editors must not be empty" }];
     }
@@ -52345,6 +52795,7 @@ var prerequisite_readable_default = (0, import_spectral_core4.createRulesetFunct
   (targetVal, _options, context) => {
     const readable = new Set(targetVal.can_read_artifacts ?? []);
     const prereqs = targetVal.prerequisites ?? [];
+    if (readable.size === 0) return [];
     const results = [];
     for (let i3 = 0; i3 < prereqs.length; i3++) {
       const p2 = prereqs[i3];
@@ -52746,7 +53197,7 @@ var ruleset = {
     },
     "artifact-owner-exists": {
       description: "(deprecated) Every artifact must have an owner",
-      severity: "warn",
+      severity: "off",
       given: "$.artifacts.*",
       then: {
         field: "owner",
@@ -53465,8 +53916,8 @@ function collectReferencedIds(workflow, dsl, relatedTasks) {
     } else if (step.type === "validation") {
       const val = dsl.validations[step.validation];
       if (val) {
-        if (val.executor_type === "agent") addAgent(val.executor);
-        else tools.add(val.executor);
+        if (val.executor && val.executor_type === "agent") addAgent(val.executor);
+        else if (val.executor) tools.add(val.executor);
         artifacts.add(val.target_artifact);
       }
     }
@@ -53620,7 +54071,7 @@ function emitExecutionStep(es, agentAlias2, participants, lines, indent) {
 }
 function emitValidationStep(step, participants, dsl, lastFromAgent, lines, indent) {
   const val = dsl.validations[step.validation];
-  if (!val) return;
+  if (!val || !val.executor) return;
   const executorAlias = participantAlias(participants, val.executor);
   const artifactAlias = participantAlias(participants, val.target_artifact);
   const fromAlias = lastFromAgent ? participantAlias(participants, lastFromAgent) : null;
@@ -53842,9 +54293,9 @@ function collectPhaseOps(dsl, wfId) {
     } else if (step.type === "validation") {
       const val = dsl.validations[step.validation];
       if (val) {
-        if (val.executor_type === "agent") {
+        if (val.executor_type === "agent" && val.executor) {
           addOp(agentOps, val.executor, "validate");
-        } else {
+        } else if (val.executor) {
           addOp(toolOps, val.executor, "verification");
         }
         addOp(artifactOps, val.target_artifact, "V");
@@ -53923,6 +54374,299 @@ function generateOverviewFlowchart(dsl) {
   return sections.join("\n\n");
 }
 
+// src/navigation-index/builder.ts
+var VALIDATOR_KINDS = /* @__PURE__ */ new Set(["linter", "checker", "validator", "test"]);
+var VALIDATION_TERMS = ["lint", "check", "validate", "test", "verify", "audit"];
+function sortUnique(values) {
+  return [...new Set(values)].sort();
+}
+function matchesValidationTerm(value) {
+  const lower = value.toLowerCase();
+  return VALIDATION_TERMS.some((term) => lower.includes(term));
+}
+function isValidatorTool(tool) {
+  if (tool.kind && VALIDATOR_KINDS.has(tool.kind)) {
+    return true;
+  }
+  if (tool.command && matchesValidationTerm(tool.command)) {
+    return true;
+  }
+  for (const cmd of tool.commands ?? []) {
+    if (matchesValidationTerm(cmd.category) || matchesValidationTerm(cmd.command)) {
+      return true;
+    }
+  }
+  return false;
+}
+function extractToolArtifactLinks(toolId, tool) {
+  const links = [];
+  if (tool.cli_contract) {
+    const command = tool.command ?? "";
+    const slotInfo = loadCliContractSlots(tool.cli_contract);
+    for (const [slot, artifactId] of Object.entries(tool.artifact_bindings ?? {})) {
+      const direction = slotInfo ? resolveSlotDirection(slot, command, slotInfo) : "read";
+      links.push({
+        toolId,
+        artifactId,
+        direction,
+        slot,
+        command
+      });
+    }
+    return links;
+  }
+  for (const cmd of tool.commands ?? []) {
+    for (const artifactId of cmd.reads ?? []) {
+      links.push({
+        toolId,
+        artifactId,
+        direction: "read",
+        slot: "",
+        command: cmd.command
+      });
+    }
+    for (const artifactId of cmd.writes ?? []) {
+      links.push({
+        toolId,
+        artifactId,
+        direction: "write",
+        slot: "",
+        command: cmd.command
+      });
+    }
+  }
+  return links;
+}
+function buildOperation(toolId, tool, link) {
+  return {
+    tool: toolId,
+    cli_contract: tool.cli_contract ?? "",
+    command: link.command || tool.command || "",
+    slot: link.slot,
+    invokable_by: [...tool.invokable_by ?? []]
+  };
+}
+function operationKey(op) {
+  return `${op.tool}:${op.command}:${op.slot}`;
+}
+function dedupeOperations(operations) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const op of operations) {
+    const key = operationKey(op);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    result.push(op);
+  }
+  return result.sort((a3, b3) => a3.tool.localeCompare(b3.tool) || a3.slot.localeCompare(b3.slot));
+}
+function buildAgentMapping(dsl, artifactId) {
+  const owners = [];
+  const editors = [];
+  const readers = [];
+  for (const [agentId, agent] of Object.entries(dsl.agents)) {
+    if (agent.own_artifacts?.includes(artifactId)) owners.push(agentId);
+    if (agent.can_write_artifacts?.includes(artifactId)) editors.push(agentId);
+    if (agent.can_read_artifacts?.includes(artifactId)) readers.push(agentId);
+  }
+  return {
+    owners: sortUnique(owners),
+    editors: sortUnique(editors),
+    readers: sortUnique(readers)
+  };
+}
+function buildRelations(artifactId, authority, linksByArtifact, allLinks) {
+  const sourceArtifacts = /* @__PURE__ */ new Set();
+  const derivedArtifacts = /* @__PURE__ */ new Set();
+  const writesToThis = allLinks.filter(
+    (link) => link.artifactId === artifactId && link.direction === "write"
+  );
+  if (authority === "generated" || authority === "derived") {
+    for (const writeLink of writesToThis) {
+      for (const readLink of allLinks) {
+        if (readLink.toolId === writeLink.toolId && readLink.direction === "read") {
+          sourceArtifacts.add(readLink.artifactId);
+        }
+      }
+    }
+  }
+  const readsThis = allLinks.filter(
+    (link) => link.artifactId === artifactId && link.direction === "read"
+  );
+  for (const readLink of readsThis) {
+    for (const writeLink of allLinks) {
+      if (writeLink.toolId === readLink.toolId && writeLink.direction === "write") {
+        derivedArtifacts.add(writeLink.artifactId);
+      }
+    }
+  }
+  const knownArtifacts = new Set(linksByArtifact.keys());
+  return {
+    source_artifacts: sortUnique(
+      [...sourceArtifacts].filter((id) => id !== artifactId && knownArtifacts.has(id))
+    ),
+    derived_artifacts: sortUnique(
+      [...derivedArtifacts].filter((id) => id !== artifactId && knownArtifacts.has(id))
+    )
+  };
+}
+function buildValidateRoutes(validators) {
+  return validators.map((validator) => ({
+    purpose: "validate",
+    steps: [
+      {
+        type: "run_operation",
+        operation: validator.tool,
+        candidate_agents: [...validator.invokable_by]
+      }
+    ]
+  }));
+}
+function buildRegenerateRoutes(sourceArtifacts, producers, agentsByArtifact) {
+  if (producers.length === 0) return [];
+  const editSteps = sourceArtifacts.map((artifactId) => ({
+    type: "edit_artifact",
+    artifact: artifactId,
+    candidate_agents: agentsByArtifact.get(artifactId)?.editors ?? []
+  }));
+  const runSteps = producers.map((producer) => ({
+    type: "run_operation",
+    operation: producer.tool,
+    candidate_agents: [...producer.invokable_by]
+  }));
+  return [
+    {
+      purpose: "regenerate",
+      steps: [...editSteps, ...runSteps]
+    }
+  ];
+}
+function buildUpdateRoutes(artifactId, validators, editors) {
+  const steps = [
+    {
+      type: "edit_artifact",
+      artifact: artifactId,
+      candidate_agents: [...editors]
+    }
+  ];
+  for (const validator of validators) {
+    steps.push({
+      type: "run_operation",
+      operation: validator.tool,
+      candidate_agents: [...validator.invokable_by]
+    });
+  }
+  return [
+    {
+      purpose: "update",
+      steps
+    }
+  ];
+}
+function defaultProperties(artifact) {
+  return {
+    type: artifact.type,
+    authority: artifact.authority ?? "canonical",
+    manual_edit: artifact.manual_edit ?? "allowed",
+    change_control: artifact.change_control ?? "none"
+  };
+}
+function buildNavigationIndex(dsl) {
+  const resolvedTools = resolveToolExtends(dsl.tools);
+  const allLinks = [];
+  for (const [toolId, tool] of Object.entries(resolvedTools)) {
+    allLinks.push(...extractToolArtifactLinks(toolId, tool));
+  }
+  const linksByArtifact = /* @__PURE__ */ new Map();
+  for (const link of allLinks) {
+    const existing = linksByArtifact.get(link.artifactId) ?? [];
+    existing.push(link);
+    linksByArtifact.set(link.artifactId, existing);
+  }
+  const toolWrites = /* @__PURE__ */ new Map();
+  for (const link of allLinks) {
+    if (link.direction !== "write") continue;
+    const writes = toolWrites.get(link.toolId) ?? /* @__PURE__ */ new Set();
+    writes.add(link.artifactId);
+    toolWrites.set(link.toolId, writes);
+  }
+  const artifacts = {};
+  const agentsByArtifact = /* @__PURE__ */ new Map();
+  for (const [artifactId, artifactDef] of Object.entries(dsl.artifacts)) {
+    const properties = defaultProperties(artifactDef);
+    const agents = buildAgentMapping(dsl, artifactId);
+    agentsByArtifact.set(artifactId, agents);
+    const artifactLinks = linksByArtifact.get(artifactId) ?? [];
+    const producers = [];
+    const validators = [];
+    const consumers = [];
+    const processedPairs = /* @__PURE__ */ new Set();
+    for (const link of artifactLinks) {
+      const tool = resolvedTools[link.toolId];
+      if (!tool) continue;
+      const pairKey = `${link.toolId}:${link.direction}:${link.slot}:${link.command}`;
+      if (processedPairs.has(pairKey)) continue;
+      processedPairs.add(pairKey);
+      const operation = buildOperation(link.toolId, tool, link);
+      const toolWritesArtifacts = toolWrites.get(link.toolId) ?? /* @__PURE__ */ new Set();
+      if (link.direction === "write" || toolWritesArtifacts.has(artifactId)) {
+        producers.push(operation);
+      } else if (isValidatorTool(tool)) {
+        validators.push(operation);
+      } else if (link.direction === "read") {
+        consumers.push(operation);
+      }
+    }
+    const relations = buildRelations(
+      artifactId,
+      properties.authority,
+      linksByArtifact,
+      allLinks
+    );
+    const routes = {};
+    const dedupedValidators = dedupeOperations(validators);
+    const dedupedProducers = dedupeOperations(producers);
+    if (dedupedValidators.length > 0) {
+      routes.validate = buildValidateRoutes(dedupedValidators);
+    }
+    if (properties.authority === "generated" && dedupedProducers.length > 0 && relations.source_artifacts.length > 0) {
+      routes.regenerate = buildRegenerateRoutes(
+        relations.source_artifacts,
+        dedupedProducers,
+        agentsByArtifact
+      );
+    }
+    if (properties.authority === "canonical") {
+      routes.update = buildUpdateRoutes(artifactId, dedupedValidators, agents.editors);
+    }
+    artifacts[artifactId] = {
+      id: artifactId,
+      files: {
+        path_patterns: artifactDef.path_patterns ?? [],
+        exclude_patterns: artifactDef.exclude_patterns ?? []
+      },
+      properties,
+      relations,
+      operations: {
+        producers: dedupeOperations(producers),
+        validators: dedupedValidators,
+        consumers: dedupeOperations(consumers)
+      },
+      agents,
+      routes
+    };
+  }
+  return {
+    version: "1.0.0",
+    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+    system: {
+      id: dsl.system.id,
+      name: dsl.system.name
+    },
+    artifacts
+  };
+}
+
 // src/renderer/renderer.ts
 Handlebars.registerHelper("eq", (a3, b3) => a3 === b3);
 Handlebars.registerHelper("notEmpty", (obj) => {
@@ -54232,6 +54976,8 @@ function buildEntityContext(dsl, context, entityId) {
       return buildGuardrailPolicyContext(dsl, entityId);
     case "system":
       return buildSystemContext(dsl);
+    case "navigation_index":
+      return buildNavigationIndex(dsl);
   }
 }
 async function loadTemplate(templatePath) {
@@ -54251,8 +54997,8 @@ async function renderFromConfig(dsl, renderTargets, options) {
   for (const target of renderTargets) {
     const templateContent = await loadTemplate(target.template);
     const compiled = Handlebars.compile(templateContent, { noEscape: false });
-    if (target.context === "system") {
-      const ctx = buildSystemContext(dsl, options);
+    if (target.context === "system" || target.context === "navigation_index") {
+      const ctx = target.context === "system" ? buildSystemContext(dsl, options) : buildNavigationIndex(dsl);
       const output = compiled(ctx);
       if (target.skip_empty && isEffectivelyEmpty(output)) {
         await removeIfExists(target.output);
@@ -54308,8 +55054,8 @@ async function checkDriftFromConfig(dsl, renderTargets, options) {
   for (const target of renderTargets) {
     const templateContent = await loadTemplate(target.template);
     const compiled = Handlebars.compile(templateContent, { noEscape: false });
-    if (target.context === "system") {
-      const ctx = buildSystemContext(dsl, options);
+    if (target.context === "system" || target.context === "navigation_index") {
+      const ctx = target.context === "system" ? buildSystemContext(dsl, options) : buildNavigationIndex(dsl);
       const expected = compiled(ctx);
       await checkExpectedVsExisting(expected, target.output, target.skip_empty, diffs);
     } else {
@@ -54331,14 +55077,14 @@ async function checkDriftFromConfig(dsl, renderTargets, options) {
 
 // src/config/binding-loader.ts
 import { readFile as readFile4 } from "fs/promises";
-import { dirname as dirname5, resolve as resolve5 } from "path";
+import { dirname as dirname5, resolve as resolve6 } from "path";
 import { stat as stat2 } from "fs/promises";
-import { parse as parseYaml3 } from "yaml";
+import { parse as parseYaml4 } from "yaml";
 
 // src/config/loader.ts
 import { readFile as readFile3, access } from "fs/promises";
-import { resolve as resolve4, dirname as dirname4 } from "path";
-import { parse as parseYaml2 } from "yaml";
+import { resolve as resolve5, dirname as dirname4 } from "path";
+import { parse as parseYaml3 } from "yaml";
 
 // src/config/types.ts
 import { z as z19 } from "zod";
@@ -54439,24 +55185,24 @@ function resolveTeamConfigs(teams, configDir) {
   for (const [key, team] of Object.entries(teams)) {
     if (key === "_defaults") continue;
     const mergedBindings = [...defaults?.bindings ?? [], ...team.bindings].map(
-      (b3) => resolve4(configDir, b3)
+      (b3) => resolve5(configDir, b3)
     );
     const mergedVars = defaults?.vars || team.vars ? { ...defaults?.vars ?? {}, ...team.vars ?? {} } : void 0;
     const mergedPaths = defaults?.paths || team.paths ? { ...defaults?.paths ?? {}, ...team.paths ?? {} } : void 0;
     result[key] = {
-      dsl: resolve4(configDir, team.dsl),
+      dsl: resolve5(configDir, team.dsl),
       bindings: mergedBindings,
       vars: mergedVars,
       activeGuardrailPolicy: team.active_guardrail_policy ?? defaults?.active_guardrail_policy,
       paths: mergedPaths,
-      interfaceOutput: team.interface_output ? resolve4(configDir, team.interface_output) : void 0
+      interfaceOutput: team.interface_output ? resolve5(configDir, team.interface_output) : void 0
     };
   }
   return result;
 }
 async function loadConfig(configPath) {
   const isExplicit = configPath !== void 0;
-  const targetPath = resolve4(configPath ?? DEFAULT_CONFIG_NAME);
+  const targetPath = resolve5(configPath ?? DEFAULT_CONFIG_NAME);
   if (!await fileExists2(targetPath)) {
     if (isExplicit) {
       throw new ConfigLoadError(
@@ -54477,7 +55223,7 @@ async function loadConfig(configPath) {
   }
   let raw;
   try {
-    raw = parseYaml2(content);
+    raw = parseYaml3(content);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     throw new ConfigLoadError(
@@ -54498,8 +55244,8 @@ ${issues}`,
   const config = result.data;
   const renders = config.renders.map((r3) => ({
     ...r3,
-    template: resolve4(configDir, r3.template),
-    output: resolve4(configDir, r3.output)
+    template: resolve5(configDir, r3.template),
+    output: resolve5(configDir, r3.output)
   }));
   if (config.teams) {
     return {
@@ -54515,11 +55261,11 @@ ${issues}`,
     };
   }
   return {
-    dsl: resolve4(configDir, config.dsl),
+    dsl: resolve5(configDir, config.dsl),
     vars: config.vars,
     renders,
     configDir,
-    bindings: (config.bindings ?? []).map((b3) => resolve4(configDir, b3)),
+    bindings: (config.bindings ?? []).map((b3) => resolve5(configDir, b3)),
     activeGuardrailPolicy: config.active_guardrail_policy,
     paths: config.paths,
     audit: config.audit ?? void 0
@@ -54527,12 +55273,12 @@ ${issues}`,
 }
 function resolveDslPath(dirArg, dirArgDefault, config) {
   if (dirArg !== void 0 && dirArg !== dirArgDefault) {
-    return resolve4(dirArg);
+    return resolve5(dirArg);
   }
   if (config) {
     return config.dsl;
   }
-  return resolve4(dirArgDefault);
+  return resolve5(dirArgDefault);
 }
 
 // src/config/binding-merger.ts
@@ -54571,7 +55317,7 @@ async function loadRawBinding(filePath) {
     );
   }
   try {
-    return parseYaml3(content);
+    return parseYaml4(content);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     throw new ConfigLoadError(
@@ -54588,7 +55334,7 @@ async function resolveBindingExtends(raw, filePath, seen) {
   const bindingDir = dirname5(filePath);
   let basePath;
   if (extendsValue.startsWith("./") || extendsValue.startsWith("../")) {
-    basePath = resolve5(bindingDir, extendsValue);
+    basePath = resolve6(bindingDir, extendsValue);
   } else {
     try {
       const resolved = import.meta.resolve(extendsValue);
@@ -54606,7 +55352,7 @@ async function resolveBindingExtends(raw, filePath, seen) {
       const candidates = ["binding.yaml", "binding.yml"];
       let found = false;
       for (const name of candidates) {
-        const candidate = resolve5(basePath, name);
+        const candidate = resolve6(basePath, name);
         try {
           const cs = await stat2(candidate);
           if (cs.isFile()) {
@@ -55028,10 +55774,10 @@ function collectAllXUsages(dsl) {
 function extractTemplateXReferences(config) {
   const refs = [];
   try {
-    const { readFileSync } = __require("fs");
+    const { readFileSync: readFileSync2 } = __require("fs");
     for (const target of config.renders) {
       try {
-        const content = readFileSync(target.template, "utf8");
+        const content = readFileSync2(target.template, "utf8");
         const matches = content.matchAll(/\{\{[^}]*?(x-[\w-]+)[^}]*?\}\}/g);
         for (const m2 of matches) refs.push(m2[1]);
       } catch {
@@ -55556,7 +56302,7 @@ var DslTaskResultSchema = z20.object({
 });
 var AuditResultSchema = z20.object({
   summary: z20.string(),
-  riskLevel: z20.enum(["low", "medium", "high", "critical"]),
+  risk_level: z20.enum(["low", "medium", "high", "critical"]),
   findings: z20.array(z20.object({
     id: z20.string().optional(),
     severity: z20.enum(["info", "warning", "error", "critical"]),
@@ -55574,7 +56320,7 @@ var AuditResultSchema = z20.object({
     })).optional(),
     details: z20.record(z20.string(), z20.unknown()).optional()
   })),
-  recommendedActions: z20.array(z20.object({
+  recommended_actions: z20.array(z20.object({
     kind: z20.enum(["run_command", "edit_file", "review", "confirm", "block", "ignore"]),
     title: z20.string(),
     command: z20.string().optional(),
@@ -55585,7 +56331,7 @@ var AuditResultSchema = z20.object({
     tool: z20.string().optional(),
     command: z20.string().optional(),
     version: z20.string().optional(),
-    generatedAt: z20.string().optional(),
+    generated_at: z20.string().optional(),
     adapter: z20.string().optional(),
     model: z20.string().optional()
   }).optional()
@@ -55864,7 +56610,7 @@ function computeExitCode(results, failOn) {
 
 // src/guardrail-generator/generator.ts
 import { readFile as readFile6, writeFile as writeFile2, mkdir as mkdir2, chmod, unlink as unlink2, copyFile } from "fs/promises";
-import { resolve as resolve6, dirname as dirname6 } from "path";
+import { resolve as resolve7, dirname as dirname6 } from "path";
 import Handlebars2 from "handlebars";
 import YAML from "yaml";
 
@@ -56086,9 +56832,9 @@ async function generateGuardrails(options) {
       if (pathResult.diagnostics.some((d2) => d2.severity === "error")) {
         continue;
       }
-      const targetPath = resolve6(config.configDir, pathResult.resolved);
+      const targetPath = resolve7(config.configDir, pathResult.resolved);
       if (outputDef.source) {
-        const sourcePath = resolve6(config.configDir, outputDef.source);
+        const sourcePath = resolve7(config.configDir, outputDef.source);
         if (!dryRun) {
           try {
             await mkdir2(dirname6(targetPath), { recursive: true });
@@ -56124,7 +56870,7 @@ async function generateGuardrails(options) {
           });
           continue;
         }
-        const templatePath = resolve6(config.configDir, outputDef.template);
+        const templatePath = resolve7(config.configDir, outputDef.template);
         try {
           templateContent = await readFile6(templatePath, "utf8");
         } catch {
@@ -56163,7 +56909,7 @@ async function generateGuardrails(options) {
           };
           const compiled = Handlebars2.compile(templateContent, { noEscape: true });
           const rendered = compiled(groupCtx);
-          const groupTarget = resolve6(targetPath, groupKey);
+          const groupTarget = resolve7(targetPath, groupKey);
           if (shouldSkipEmpty && rendered.trim().length === 0) {
             if (!dryRun) {
               try {
@@ -56211,7 +56957,7 @@ async function generateGuardrails(options) {
       if (renderTarget.inline_template) {
         templateContent = renderTarget.inline_template;
       } else if (renderTarget.template) {
-        const templatePath = resolve6(config.configDir, renderTarget.template);
+        const templatePath = resolve7(config.configDir, renderTarget.template);
         try {
           templateContent = await readFile6(templatePath, "utf8");
         } catch {
@@ -56233,12 +56979,12 @@ async function generateGuardrails(options) {
       const compiled = Handlebars2.compile(templateContent, { noEscape: true });
       const shouldSkipEmpty = renderTarget.skip_empty === true;
       const context = renderTarget.context;
-      if (context === "system") {
-        const sysCtx = buildSystemContext(dsl);
-        const mergedCtx = { ...sysCtx, vars, paths, binding, resolved_checks: checkResult.resolved };
+      if (context === "system" || context === "navigation_index") {
+        const baseCtx = context === "system" ? buildSystemContext(dsl) : buildNavigationIndex(dsl);
+        const mergedCtx = { ...baseCtx, vars, paths, binding, resolved_checks: checkResult.resolved };
         const rendered = compiled(mergedCtx);
         const resolvedOutput = resolveBindingRenderOutputPath(renderTarget.output, paths);
-        const outputPath = resolve6(config.configDir, resolvedOutput);
+        const outputPath = resolve7(config.configDir, resolvedOutput);
         if (shouldSkipEmpty && rendered.trim().length === 0) {
           if (!dryRun) {
             try {
@@ -56268,7 +57014,7 @@ async function generateGuardrails(options) {
           const expandedOutput = expandOutputPath(renderTarget.output, context, entityId, entity);
           if (hasUnresolvedPathVars(expandedOutput)) continue;
           const resolvedOutput = resolveBindingRenderOutputPath(expandedOutput, paths);
-          const outputPath = resolve6(config.configDir, resolvedOutput);
+          const outputPath = resolve7(config.configDir, resolvedOutput);
           if (shouldSkipEmpty && rendered.trim().length === 0) {
             if (!dryRun) {
               try {
@@ -56358,6 +57104,7 @@ export {
   buildGuardrailContext,
   buildGuardrailPolicyContext,
   buildHandoffTypeContext,
+  buildNavigationIndex,
   buildPerAgentContext,
   buildPolicyContext,
   buildSystemContext,