agentic-workflow-manager 9.2.1 → 9.4.0

package/dist/src/commands/plan/index.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exitCodeFor = exitCodeFor;
+exports.formatReport = formatReport;
+exports.registerPlanCommand = registerPlanCommand;
+const validate_1 = require("../../core/plan/validate");
+const SUPPORTED_SCHEMA = 'compact-slices/v1';
+const MAX_PATH_LENGTH = 4096;
+const MAX_DIAGNOSTICS = 20;
+const MAX_DIAGNOSTIC_LENGTH = 4096;
+function assertText(value, name) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > MAX_PATH_LENGTH || value.startsWith('--') || /[\u0000-\u001F\u007F-\u009F]/.test(value)) {
+        throw new Error(`${name} must be a non-empty path without control characters`);
+    }
+}
+function terminalSafe(value) {
+    return value.replace(/[\u0000-\u001F\u007F-\u009F]/g, character => `\\u${character.codePointAt(0).toString(16).padStart(4, '0')}`);
+}
+function assertDependencies(deps) {
+    if (!deps || typeof deps.validatePlanFile !== 'function')
+        throw new Error('validatePlanFile must be a function');
+}
+function boundedDiagnostics(diagnostics) {
+    if (!Array.isArray(diagnostics))
+        throw new Error('plan validator returned invalid diagnostics');
+    return diagnostics.slice(0, MAX_DIAGNOSTICS).map((diagnostic) => {
+        if (!diagnostic || typeof diagnostic.code !== 'string' || typeof diagnostic.message !== 'string') {
+            throw new Error('plan validator returned an invalid diagnostic');
+        }
+        return {
+            code: diagnostic.code.slice(0, MAX_DIAGNOSTIC_LENGTH),
+            message: diagnostic.message.slice(0, MAX_DIAGNOSTIC_LENGTH),
+            ...(typeof diagnostic.field === 'string' ? { field: diagnostic.field.slice(0, MAX_DIAGNOSTIC_LENGTH) } : {}),
+        };
+    });
+}
+function reportPayload(report, planPath) {
+    switch (report.state) {
+        case 'valid':
+            return {
+                state: report.state, path: planPath, schema: report.schema, planId: report.manifest.planId,
+                requirements: report.manifest.requirements.length, sources: report.manifest.sources.length,
+                commands: report.manifest.commands.length, slices: report.manifest.slices.length, completeOwnership: true,
+            };
+        case 'legacy':
+            return { state: report.state, path: planPath, message: 'existing full-quality path applies; compact optimization was not requested.' };
+        case 'invalid':
+            return { state: report.state, path: planPath, diagnostics: boundedDiagnostics(report.diagnostics) };
+        case 'unsupported':
+            return {
+                state: report.state, path: planPath, schema: report.schema, supportedSchema: SUPPORTED_SCHEMA,
+                diagnostics: boundedDiagnostics(report.diagnostics), remedy: 'update AWM to support this compact plan schema.',
+            };
+        default:
+            throw new Error('plan validator returned an unknown report state');
+    }
+}
+function exitCodeFor(report) {
+    return report.state === 'valid' || report.state === 'legacy' ? 0 : 2;
+}
+function formatReport(report, planPath) {
+    const payload = reportPayload(report, planPath);
+    switch (report.state) {
+        case 'valid':
+            return `Plan validation: valid "${terminalSafe(planPath)}" (${terminalSafe(report.schema)}; ${payload.slices} slices; ${payload.requirements} requirements; complete ownership)\n`;
+        case 'legacy':
+            return `Plan validation: legacy "${terminalSafe(planPath)}" — existing full-quality path applies; compact optimization was not requested.\n`;
+        case 'invalid':
+            return `Plan validation: invalid "${terminalSafe(planPath)}"\n${payload.diagnostics.map(diagnostic => `- ${terminalSafe(diagnostic.code)}: ${terminalSafe(diagnostic.message)}${diagnostic.field ? ` (${terminalSafe(diagnostic.field)})` : ''}`).join('\n')}\n`;
+        case 'unsupported':
+            return `Plan validation: unsupported "${terminalSafe(planPath)}" (${terminalSafe(report.schema)}; supported: ${SUPPORTED_SCHEMA})\nUpdate AWM to support this compact plan schema.\n`;
+        default:
+            throw new Error('plan validator returned an unknown report state');
+    }
+}
+function registerPlanCommand(program, deps = { validatePlanFile: validate_1.validatePlanFile }) {
+    if (!program || typeof program.command !== 'function')
+        throw new Error('program must be a Commander command');
+    assertDependencies(deps);
+    const plan = program.command('plan').description('inspect plan contracts');
+    plan
+        .command('validate <plan-path>')
+        .description('validate a compact plan without modifying it')
+        .option('--json', 'emit one stable JSON report')
+        .option('--cwd <path>', 'repository root for plan containment and source resolution')
+        .action((planPath, options) => {
+        assertText(planPath, 'plan path');
+        const cwd = options.cwd ?? process.cwd();
+        assertText(cwd, '--cwd');
+        const report = deps.validatePlanFile(planPath, cwd);
+        const output = options.json === true
+            ? `${JSON.stringify(reportPayload(report, planPath))}\n`
+            : formatReport(report, planPath);
+        process.stdout.write(output);
+        const code = exitCodeFor(report);
+        process.exitCode = code;
+    });
+}

package/dist/src/commands/preflight/checks.js

@@ -13,6 +13,10 @@ const init_1 = require("../sensors/init");
 const baseline_1 = require("../sensors/baseline");
 const run_1 = require("../sensors/run");
 const paths_1 = require("../../core/paths");
+const registries_1 = require("../../core/registries");
+const inspect_1 = require("../../core/context-kernel/inspect");
+const registries_2 = require("../../core/registries");
+const check_1 = require("../../core/currentness/check");
 const MANIFEST = path_1.default.join('.awm', 'sensors.json');
 /**
  * The agent needs project context delivered every session. A repo with neither file
@@ -31,6 +35,54 @@ function checkContext(cwd) {
     }
     return { id: 'context', ok: true, detail: present.join(', ') };
 }
+function checkContextKernel(cwd) {
+    let resolution;
+    try {
+        resolution = (0, registries_1.resolveProjectContextSchema)();
+    }
+    catch {
+        return {
+            id: 'context-kernel', ok: false, advisory: false,
+            detail: 'configured registry inventory could not be read',
+            remedy: 'Repair the local registry inventory and rerun preflight.',
+        };
+    }
+    if (resolution.diagnostics.length > 0) {
+        return {
+            id: 'context-kernel',
+            ok: false,
+            advisory: false,
+            detail: `Context Kernel registry declaration is invalid: ${resolution.diagnostics.join('; ')}`,
+            remedy: 'repair the registry manifest or use the safe full-context project files until the registry is valid',
+        };
+    }
+    if (!resolution.declaration)
+        return null;
+    const inspection = (0, inspect_1.inspectContextKernel)(cwd);
+    if (inspection.state === 'legacy') {
+        return {
+            id: 'context-kernel',
+            ok: false,
+            advisory: true,
+            detail: 'legacy full context — Context Kernel v1 migration available',
+            remedy: 'run project-context-init and review the generated rule trace; awm update never rewrites project files',
+        };
+    }
+    if (inspection.state === 'valid') {
+        return {
+            id: 'context-kernel',
+            ok: true,
+            detail: `Context Kernel v${inspection.schema} valid (${inspection.fixedBytes} fixed bytes)`,
+        };
+    }
+    return {
+        id: 'context-kernel',
+        ok: false,
+        advisory: false,
+        detail: inspection.detail,
+        remedy: inspection.remedy,
+    };
+}
 function readManifest(cwd) {
     try {
         return JSON.parse(fs_1.default.readFileSync(path_1.default.join(cwd, MANIFEST), 'utf-8'));
@@ -339,14 +391,53 @@ function checkHost(cwd) {
     // Bitbucket, Azure DevOps, an internal git server, etc. — don't overclaim support.
     return { id: 'host', ok: true, detail: 'git host not recognized (github/gitlab) — PR/MR automation not applicable' };
 }
+function bounded(value, limit = 512) {
+    return value.length <= limit ? value : `${value.slice(0, limit - 1)}…`;
+}
+function checkCompatibility() {
+    let failures;
+    try {
+        failures = (0, registries_2.verifyMinCliVersions)();
+    }
+    catch {
+        return {
+            id: 'compatibility', ok: false,
+            detail: 'configured registry inventory could not be read',
+            remedy: 'Repair the local registry inventory and rerun strict preflight.',
+        };
+    }
+    if (failures.length === 0)
+        return { id: 'compatibility', ok: true, detail: 'all configured registry minCliVersion requirements are satisfied' };
+    return {
+        id: 'compatibility', ok: false,
+        detail: bounded(failures.map(failure => `${failure.name} requires CLI >= ${failure.min}`).join('; ')),
+        remedy: 'npm i -g agentic-workflow-manager@latest && rerun in a fresh process',
+    };
+}
+function checkAuthoritativeCurrentness(report) {
+    const failing = report.components.filter(component => component.status !== 'current');
+    const components = report.components.map(component => bounded(`${component.component}: installed=${component.installed ?? 'unknown'} latest=${component.latest ?? 'unknown'} `
+        + `channel=${component.channel} source=${component.source}${component.pin ? ` pin=${component.pin}` : ''} `
+        + `checkedAt=${component.checkedAt} status=${component.status}`));
+    return failing.length === 0
+        ? { id: 'currentness', ok: true, detail: `Currentness: current. ${components.join('; ')}` }
+        : {
+            id: 'currentness', ok: false, detail: `Currentness: ${failing.map(component => component.status).join(', ')}. ${components.join('; ')}`,
+            remedy: bounded(failing.map(component => component.remedy).join('; ')),
+        };
+}
 async function preflight(cwd = process.cwd(), opts = {}) {
-    if (!opts || typeof opts !== 'object' || Array.isArray(opts) || (opts.verifySensors !== undefined && typeof opts.verifySensors !== 'boolean')) {
-        throw new Error('preflight options must contain an optional boolean verifySensors');
+    if (!opts || typeof opts !== 'object' || Array.isArray(opts)
+        || (opts.verifySensors !== undefined && typeof opts.verifySensors !== 'boolean')
+        || (opts.requireCurrent !== undefined && typeof opts.requireCurrent !== 'boolean')) {
+        throw new Error('preflight options must contain optional boolean verifySensors and requireCurrent');
     }
     const manifest = readManifest(cwd);
     const manifestExists = fs_1.default.existsSync(path_1.default.join(cwd, MANIFEST));
+    const contextKernel = checkContextKernel(cwd);
     const checks = [
         checkContext(cwd),
+        ...(contextKernel ? [contextKernel] : []),
         checkManifest(cwd, manifest),
         // Skipped when there is no manifest: reporting "tools broken" (or nudging toward
         // a baseline that has nothing to snapshot) on a repo that was never set up
@@ -355,12 +446,26 @@ async function preflight(cwd = process.cwd(), opts = {}) {
         // The empirical mode is intentionally opt-in: ordinary preflight remains a
         // quick static inspection and must not dispatch project software.
         ...(opts.verifySensors === true ? [await checkSensorExecution(cwd)] : []),
+        // Strict mode is the only path that contacts authoritative npm/Git sources.
+        ...(opts.requireCurrent === true ? [checkCompatibility()] : []),
         // Runs unconditionally — orthogonal to sensor configuration entirely, this is
         // about PR/MR tooling, not sensors.
         checkHost(cwd),
     ];
-    const status = !manifestExists ? 'not_configured'
-        : checks.every(c => c.ok) ? 'ready'
-            : 'degraded';
-    return { status, checks };
+    const blockingFailure = (check) => !check.ok && check.advisory !== true;
+    const invalidContextKernel = contextKernel !== null && blockingFailure(contextKernel);
+    const status = invalidContextKernel ? 'degraded'
+        : !manifestExists ? 'not_configured'
+            : checks.some(blockingFailure) ? 'degraded'
+                : 'ready';
+    const currentness = opts.requireCurrent === true ? await (0, check_1.checkCurrentness)(cwd) : undefined;
+    if (currentness) {
+        checks.splice(checks.length - 1, 0, checkAuthoritativeCurrentness(currentness));
+    }
+    const strictFailure = checks.some(blockingFailure);
+    const strictStatus = invalidContextKernel ? 'degraded'
+        : !manifestExists ? 'not_configured'
+            : strictFailure ? 'degraded'
+                : 'ready';
+    return currentness ? { status: strictStatus, checks, currentness } : { status, checks };
 }

package/dist/src/commands/preflight/index.js

@@ -25,19 +25,18 @@ function formatReport(report) {
     // longer `PreflightCheck['id']` is added (confirmed: 'sensors-baseline', at 16
     // chars, broke a hardcoded 9-char pad).
     const idWidth = Math.max(0, ...report.checks.map(c => c.id.length));
-    const lines = report.checks.map(c => `  ${c.ok ? picocolors_1.default.green('✔') : picocolors_1.default.red('✘')}  ${c.id.padEnd(idWidth)} ${c.detail}`
+    const lines = report.checks.map(c => `  ${c.advisory === true ? picocolors_1.default.yellow('⚠') : c.ok ? picocolors_1.default.green('✔') : picocolors_1.default.red('✘')}  ${c.id.padEnd(idWidth)} ${c.detail}`
         + (c.remedy ? `\n       ${picocolors_1.default.dim('→ ' + c.remedy)}` : ''));
     if (report.status === 'ready') {
         return `${picocolors_1.default.green('✔')}  Harness ready — this project can be gated.\n${lines.join('\n')}\n`;
     }
     const headline = report.status === 'not_configured'
         ? `${picocolors_1.default.red('✘')}  AWM is not configured in this project.`
-        : `${picocolors_1.default.red('✘')}  Harness degraded — it declares sensors it cannot run.`;
+        : `${picocolors_1.default.red('✘')}  Harness degraded — it has blocking preflight failures.`;
     return `${headline}\n${lines.join('\n')}\n\n`
         + `   ${picocolors_1.default.bold('Do not hand this off to an unattended run.')} Every quality phase downstream\n`
-        + `   (implementer, reviewers, post-qa) consumes \`awm sensors run\`. With the harness in\n`
-        + `   this state the gate reports on checks that never ran, and nobody finds out until a\n`
-        + `   bad change is already merged.\n`;
+        + `   (implementer, reviewers, post-qa) consumes these gates. Resolve every blocking\n`
+        + `   check before handoff, so a bad change is not merged.\n`;
 }
 function registerPreflightCommand(program) {
     program
@@ -45,9 +44,13 @@ function registerPreflightCommand(program) {
         .description('verify the project harness can actually gate before development starts')
         .option('--json', 'emit the report as JSON')
         .option('--verify-sensors', 'run the complete sensor gate before unattended execution')
+        .option('--require-current', 'require authoritative CLI and registry currentness before unattended execution')
         .option('--cwd <path>', 'project directory to check (default: current)')
         .action(async (opts) => {
-        const report = await (0, checks_1.preflight)(opts.cwd ?? process.cwd(), { verifySensors: opts.verifySensors === true });
+        const report = await (0, checks_1.preflight)(opts.cwd ?? process.cwd(), {
+            verifySensors: opts.verifySensors === true,
+            requireCurrent: opts.requireCurrent === true,
+        });
         process.stdout.write(opts.json ? JSON.stringify(report, null, 2) + '\n' : formatReport(report));
         const code = exitCodeFor(report);
         // `process.exit()` may truncate the JSON written immediately above when

package/dist/src/core/context-kernel/inspect.js

@@ -0,0 +1,221 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectContextKernel = inspectContextKernel;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const INDEX_PATH = ['.awm', 'context', 'index.json'];
+const ROOT_CONTEXT_FILES = ['AGENTS.md', 'CONSTITUTION.md', 'CLAUDE.md'];
+const START_MARKER = '<!-- AWM:CONTEXT-KERNEL:START v1 -->';
+const END_MARKER = '<!-- AWM:CONTEXT-KERNEL:END v1 -->';
+const ANCHOR_MARKER_PREFIX = '<!-- awm-context:';
+const TOP_LEVEL_FIELDS = ['schema', 'kernelFiles', 'maxFixedBytes', 'entries'];
+const ENTRY_FIELDS = ['id', 'tier', 'path', 'anchor', 'when'];
+const REMEDY = 'run project-context-init and review the Context Kernel v1 artifacts';
+function invalid(detail) {
+    return { state: 'invalid', detail, remedy: REMEDY };
+}
+function within(root, candidate) {
+    const relative = path_1.default.relative(root, candidate);
+    return relative === '' || (!relative.startsWith(`..${path_1.default.sep}`) && relative !== '..' && !path_1.default.isAbsolute(relative));
+}
+function count(text, needle) {
+    return text.split(needle).length - 1;
+}
+function exactFields(raw, fields) {
+    const keys = Object.keys(raw);
+    return keys.length === fields.length && fields.every((field) => Object.prototype.hasOwnProperty.call(raw, field));
+}
+function isNormalizedRelative(value) {
+    if (typeof value !== 'string' || value.length === 0 || path_1.default.isAbsolute(value) || path_1.default.win32.isAbsolute(value))
+        return false;
+    if (value.includes('\\') || value.split('/').some((part) => part === '.' || part === '..' || part === ''))
+        return false;
+    return path_1.default.posix.normalize(value) === value;
+}
+function resolveRegularInside(root, relative) {
+    if (!isNormalizedRelative(relative))
+        return { detail: `invalid repository-relative path ${JSON.stringify(relative)}` };
+    const candidate = path_1.default.join(root, relative);
+    try {
+        const stat = fs_1.default.statSync(candidate);
+        if (!stat.isFile())
+            return { detail: `${relative} must resolve to a regular file` };
+        const real = fs_1.default.realpathSync(candidate);
+        if (!within(root, real))
+            return { detail: `${relative} resolves outside the project root` };
+        return { file: real };
+    }
+    catch (error) {
+        return { detail: `${relative} cannot be read: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+function parseEntry(raw) {
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw) || !exactFields(raw, ENTRY_FIELDS)) {
+        return { detail: 'each index entry must contain exactly id, tier, path, anchor, when' };
+    }
+    const value = raw;
+    if (typeof value.id !== 'string' || !/^CTX-[A-Z0-9]+(?:-[A-Z0-9]+)*$/.test(value.id) || Buffer.byteLength(value.id, 'utf8') > 80) {
+        return { detail: 'entry id must match CTX-[A-Z0-9-]+ and be at most 80 bytes' };
+    }
+    if (value.tier !== 'kernel' && value.tier !== 'selective')
+        return { detail: 'entry tier must be kernel or selective' };
+    if (!isNormalizedRelative(value.path))
+        return { detail: `invalid repository-relative path ${JSON.stringify(value.path)}` };
+    for (const field of ['anchor', 'when']) {
+        if (typeof value[field] !== 'string' || value[field].length === 0 || Buffer.byteLength(value[field], 'utf8') > 500) {
+            return { detail: `entry ${field} must be a non-empty string of at most 500 bytes` };
+        }
+    }
+    return { entry: { id: value.id, tier: value.tier, path: value.path, anchor: value.anchor, when: value.when } };
+}
+function parseIndex(contents) {
+    let raw;
+    try {
+        raw = JSON.parse(contents);
+    }
+    catch (error) {
+        return { detail: `index is not valid JSON: ${error instanceof Error ? error.message : String(error)}` };
+    }
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw) || !exactFields(raw, TOP_LEVEL_FIELDS)) {
+        return { detail: 'index must contain exactly schema, kernelFiles, maxFixedBytes, entries' };
+    }
+    const value = raw;
+    if (value.schema !== 1 || !Number.isSafeInteger(value.schema))
+        return { detail: 'index schema must be exactly 1' };
+    if (!Array.isArray(value.kernelFiles) || value.kernelFiles.length === 0 || value.kernelFiles.some((file) => !isNormalizedRelative(file)) || new Set(value.kernelFiles).size !== value.kernelFiles.length) {
+        return { detail: 'kernelFiles must be a non-empty unique normalized path array' };
+    }
+    if (value.kernelFiles.some((file) => file.includes('/')))
+        return { detail: 'kernelFiles must name root context files' };
+    if (!Number.isSafeInteger(value.maxFixedBytes) || value.maxFixedBytes < 1)
+        return { detail: 'maxFixedBytes must be a positive integer' };
+    if (!Array.isArray(value.entries) || value.entries.length === 0)
+        return { detail: 'entries must be a non-empty array' };
+    const entries = [];
+    for (const rawEntry of value.entries) {
+        const parsed = parseEntry(rawEntry);
+        if (!parsed.entry)
+            return { detail: parsed.detail };
+        entries.push(parsed.entry);
+    }
+    if (new Set(entries.map((entry) => entry.id)).size !== entries.length)
+        return { detail: 'entry ids must be unique' };
+    if (new Set(entries.map((entry) => entry.anchor)).size !== entries.length)
+        return { detail: 'entry anchors must be unique' };
+    return { index: { schema: 1, kernelFiles: value.kernelFiles, maxFixedBytes: value.maxFixedBytes, entries } };
+}
+function markerBounds(contents) {
+    if (count(contents, START_MARKER) !== 1 || count(contents, END_MARKER) !== 1)
+        return null;
+    const start = contents.indexOf(START_MARKER) + START_MARKER.length;
+    const end = contents.indexOf(END_MARKER);
+    return start < end ? { start, end } : null;
+}
+/** Inspects project-owned Context Kernel v1 artifacts. Invalid project artifacts are
+ * classified explicitly; only invalid public input throws. */
+function inspectContextKernel(cwd) {
+    if (typeof cwd !== 'string' || cwd.length === 0)
+        throw new Error('cwd must be a non-empty directory path');
+    let root;
+    try {
+        root = fs_1.default.realpathSync(cwd);
+        if (!fs_1.default.statSync(root).isDirectory())
+            throw new Error('not a directory');
+    }
+    catch (error) {
+        throw new Error(`cwd must resolve to an existing directory: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const indexFile = path_1.default.join(root, ...INDEX_PATH);
+    let indexExists;
+    try {
+        fs_1.default.lstatSync(indexFile);
+        indexExists = true;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            return invalid(`${indexFile} cannot be inspected`);
+        indexExists = false;
+    }
+    if (!indexExists) {
+        for (const name of ROOT_CONTEXT_FILES) {
+            const candidate = path_1.default.join(root, name);
+            try {
+                if (fs_1.default.existsSync(candidate) && fs_1.default.statSync(candidate).isFile()) {
+                    const contents = fs_1.default.readFileSync(candidate, 'utf8');
+                    if (!contents.includes('AWM:CONTEXT-KERNEL:') && !contents.includes(ANCHOR_MARKER_PREFIX))
+                        continue;
+                    return invalid(`${name} contains Context Kernel markers but ${INDEX_PATH.join('/')} is missing`);
+                }
+            }
+            catch (error) {
+                return invalid(`${name} cannot be inspected: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        return { state: 'legacy' };
+    }
+    const indexTarget = resolveRegularInside(root, INDEX_PATH.join('/'));
+    if (!indexTarget.file)
+        return invalid(`${INDEX_PATH.join('/')}: ${indexTarget.detail}`);
+    let parsed;
+    try {
+        parsed = parseIndex(fs_1.default.readFileSync(indexTarget.file, 'utf8'));
+    }
+    catch (error) {
+        return invalid(`${INDEX_PATH.join('/')}: cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!parsed.index)
+        return invalid(`${INDEX_PATH.join('/')}: ${parsed.detail}`);
+    const index = parsed.index;
+    const files = new Map();
+    for (const kernelFile of index.kernelFiles) {
+        const target = resolveRegularInside(root, kernelFile);
+        if (!target.file)
+            return invalid(`${kernelFile}: ${target.detail}`);
+        const contents = fs_1.default.readFileSync(target.file, 'utf8');
+        if (!markerBounds(contents))
+            return invalid(`${kernelFile}: requires exactly one ordered Context Kernel v1 marker pair`);
+        files.set(kernelFile, contents);
+    }
+    for (const entry of index.entries) {
+        const target = resolveRegularInside(root, entry.path);
+        if (!target.file)
+            return invalid(`${entry.path}: ${target.detail}`);
+        let contents;
+        try {
+            contents = files.get(entry.path) ?? fs_1.default.readFileSync(target.file, 'utf8');
+        }
+        catch (error) {
+            return invalid(`${entry.path}: cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const marker = `<!-- ${entry.anchor} -->`;
+        if (count(contents, marker) !== 1)
+            return invalid(`${entry.path}: anchor ${entry.anchor} must appear exactly once`);
+        const anchor = contents.indexOf(marker);
+        const bounds = files.has(entry.path) ? markerBounds(contents) : null;
+        if (entry.tier === 'kernel') {
+            if (!files.has(entry.path))
+                return invalid(`${entry.path}: kernel entry must point to a kernel file`);
+            if (!bounds || anchor < bounds.start || anchor >= bounds.end)
+                return invalid(`${entry.path}: kernel anchor ${entry.anchor} must be inside the protected region`);
+        }
+        else if (bounds && anchor >= bounds.start && anchor < bounds.end) {
+            return invalid(`${entry.path}: selective anchor ${entry.anchor} must be outside the protected region`);
+        }
+    }
+    let fixedBytes = 0;
+    for (const name of ROOT_CONTEXT_FILES) {
+        const candidate = path_1.default.join(root, name);
+        if (!fs_1.default.existsSync(candidate))
+            continue;
+        const target = resolveRegularInside(root, name);
+        if (!target.file)
+            return invalid(`${name}: ${target.detail}`);
+        fixedBytes += fs_1.default.statSync(target.file).size;
+    }
+    if (fixedBytes > index.maxFixedBytes)
+        return invalid(`fixed context bytes ${fixedBytes} exceed maxFixedBytes ${index.maxFixedBytes}`);
+    return { state: 'valid', schema: 1, index, fixedBytes };
+}

package/dist/src/core/context-kernel/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });