akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/core/config/schema/connections.js

@@ -0,0 +1,41 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * `connections`: the OpenAI-compatible endpoints akm reaches models through.
+ *
+ * akm owns `endpoint`, `apiKey`, `models`, `contextLength`, `timeoutMs` and
+ * `concurrency` (and keeps the retired `apiKeyFile` as written, never reading it). Every other key on a connection, or on a model entry, is a
+ * request field in the endpoint's own spelling and is sent with each request as
+ * written: the connection's fields apply to all its models, a model entry's
+ * override them.
+ */
+import { z } from "zod";
+import { WORKFLOW_MAX_TIMEOUT_MS } from "../../../workflows/resource-limits.js";
+import { connectionEndpoint, engineName, envReferenceApiKey, nonEmptyString, positiveInt, retiredApiKeyFile, } from "./primitives.js";
+/**
+ * Timeouts share the workflow ceiling: a larger value would pass config
+ * validation and then fail every run with an unlocated "invocation is invalid".
+ * `null` runs unbounded.
+ */
+export const timeoutMsField = z.union([positiveInt.max(WORKFLOW_MAX_TIMEOUT_MS), z.null()]).optional();
+/**
+ * One alias's target: the model's name, or an object holding it together with
+ * request fields of its own. The object is listed first so a JSON value given to
+ * `akm config set` is read as one.
+ */
+export const ModelEntrySchema = z.union([z.object({ model: nonEmptyString }).catchall(z.unknown()), nonEmptyString]);
+/** Alias (`fast`, `balanced`, `reasoning`, or any the user adds) to the model it names. */
+export const ModelAliasesSchema = z.record(nonEmptyString, ModelEntrySchema);
+export const ConnectionSchema = z
+    .object({
+    endpoint: connectionEndpoint,
+    apiKey: envReferenceApiKey.optional(),
+    apiKeyFile: retiredApiKeyFile.optional(),
+    models: ModelAliasesSchema.optional(),
+    contextLength: positiveInt.optional(),
+    timeoutMs: timeoutMsField,
+    concurrency: positiveInt.optional(),
+})
+    .catchall(z.unknown());
+export const ConnectionsSchema = z.record(engineName, ConnectionSchema);

package/dist/core/config/schema/embedding.js

@@ -6,7 +6,7 @@
  * `config-schema.ts` monolith — no behavior change.
  */
 import { z } from "zod";
-import { positiveInt, symbolicOrWarnApiKey } from "./primitives.js";
+import { envReferenceApiKey, positiveInt } from "./primitives.js";
 const EmbeddingOllamaOptionsSchema = z
     .object({
     num_ctx: positiveInt.optional(),
@@ -26,7 +26,7 @@ export const EmbeddingConnectionConfigSchema = z
     provider: z.string().optional(),
     endpoint: z.string().optional(),
     model: z.string().optional(),
-    apiKey: symbolicOrWarnApiKey("embedding.apiKey").optional(),
+    apiKey: envReferenceApiKey.optional(),
     dimension: positiveInt.optional(),
     localModel: z.string().min(1).optional(),
     /**

package/dist/core/config/schema/harnesses.js

@@ -0,0 +1,41 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * `harnesses`: agent programs the user already has (Claude Code, Codex,
+ * OpenCode, ...). An entry's key is its platform unless `platform` says
+ * otherwise, so `{ "claude": {} }` enables Claude Code and a second install is
+ * `{ "claude-work": { "platform": "claude", "bin": "/opt/claude-work/bin/claude" } }`.
+ */
+import { z } from "zod";
+import { HARNESS_CONFIG_PLATFORMS } from "../../../integrations/harnesses/index.js";
+import { ModelAliasesSchema, timeoutMsField } from "./connections.js";
+import { engineName, nonEmptyString } from "./primitives.js";
+export const HarnessSchema = z
+    .object({
+    platform: z.enum(HARNESS_CONFIG_PLATFORMS).optional(),
+    bin: nonEmptyString.optional(),
+    args: z.array(z.string()).optional(),
+    workspace: nonEmptyString.optional(),
+    /** The harness's native agent to run when a request names none (platforms with native agents only). */
+    agent: nonEmptyString.optional(),
+    timeoutMs: timeoutMsField,
+    /** Alias to model for this harness, over the map akm ships for its platform. A harness is given the name only. */
+    models: ModelAliasesSchema.optional(),
+    /** `false`: akm's own model calls are never sent here by default; a call that names this harness still runs on it. */
+    modelWork: z.boolean().optional(),
+})
+    .passthrough();
+/** Why a harness parsed from this entry cannot be run: it names no platform and its name is not one. */
+export function harnessNameProblem(name, harness) {
+    if (harness.platform !== undefined || HARNESS_CONFIG_PLATFORMS.includes(name))
+        return undefined;
+    return `harness "${name}" is not a platform name; set platform to one of ${HARNESS_CONFIG_PLATFORMS.join(", ")}`;
+}
+export const HarnessesSchema = z.record(engineName, HarnessSchema).superRefine((harnesses, ctx) => {
+    for (const [name, harness] of Object.entries(harnesses)) {
+        const message = harnessNameProblem(name, harness);
+        if (message !== undefined)
+            ctx.addIssue({ code: z.ZodIssueCode.custom, path: [name, "platform"], message });
+    }
+});

package/dist/core/config/schema/improve-processes.js

@@ -7,14 +7,14 @@
  */
 import { z } from "zod";
 import { IMPROVE_PROCESS_NAMES } from "../engine-semantics.js";
-import { engineName, LlmInvocationOverridesSchema, nonEmptyString, positiveInt } from "./primitives.js";
+import { nonEmptyString, positiveInt } from "./primitives.js";
 // ── Improve profile / process ──────────────────────────────────────────────
 //
 // WI-9.6 (§4.2/§10.2): each of the improve processes (reflect, distill,
 // consolidate, memoryInference, extract, validation, triage,
 // proactiveMaintenance — graphExtraction had one too, until the LLM
 // entity-graph it ran was retired in 0.9.17-alpha.9) gets its OWN schema
-// below — a shared base (engine, model, llm, enabled, timeoutMs) extended
+// below — a shared base (`enabled`) extended
 // with only the fields meaningful on that process — replacing the prior
 // single ImproveProcessConfigSchema reused via `.optional()` for all of them
 // (which accepted, and silently ignored, any field on any process). Field→process assignment is derived from each
@@ -34,12 +34,10 @@ import { engineName, LlmInvocationOverridesSchema, nonEmptyString, positiveInt }
 // `processes.<name>` uses the NARROW per-process schemas via
 // {@link ImproveProfileProcessesSchema} below — setting a field on the wrong
 // process there is now rejected (the intended §4.2 improvement).
+// A strategy says which processes run and how; where a process runs (connection,
+// harness, model, inference, timeout) is `improve.processes.<name>`, never here.
 const IMPROVE_PROCESS_BASE_FIELDS = {
-    engine: engineName.optional(),
-    model: nonEmptyString.optional(),
-    llm: LlmInvocationOverridesSchema.optional(),
     enabled: z.boolean().optional(),
-    timeoutMs: z.union([positiveInt, z.null()]).optional(),
 };
 /** Reflect/distill/consolidate: process-level asset-type filter (see improve-strategies.ts shouldSkipRef/DEFAULT_ALLOWED_TYPES). */
 const allowedTypesField = z.array(z.string().min(1)).optional();
@@ -61,17 +59,11 @@ const processLimitField = positiveInt.optional();
  * The distill and reflect LLM-as-judge quality gates. Default ON; set
  * `enabled: false` on the process to opt out. A judge error, timeout or
  * unparsable reply never passes: distill and reflect both send the content
- * to a person. `engine`, `model`, `timeoutMs` and `llm` give the
- * gate a judge of its own (#1011), resolved over the process's own settings;
- * with none set, the gate judges with the generator's runner.
+ * to a person. Where the judge runs is `improve.qualityGate`.
  */
 const qualityGateField = z
     .object({
     enabled: z.boolean().optional(),
-    engine: engineName.optional(),
-    model: nonEmptyString.optional(),
-    timeoutMs: z.union([positiveInt, z.null()]).optional(),
-    llm: LlmInvocationOverridesSchema.passthrough().optional(),
 })
     .passthrough()
     .optional();
@@ -120,20 +112,13 @@ const extractTriageGateField = z
 })
     .passthrough()
     .optional();
-// Unknown keys pass through here like every other nested surface (the loader
-// names them once); `extraParams` remains the arbitrary provider-parameter
-// escape hatch.
-const triageJudgmentLlmOverridesField = LlmInvocationOverridesSchema.passthrough();
+// Unknown keys pass through here like every other nested surface (the loader names them once).
 const triageJudgmentObjectField = z
     .object({
     enabled: z.boolean().optional(),
-    engine: engineName.optional(),
-    model: nonEmptyString.optional(),
-    timeoutMs: z.union([positiveInt, z.null()]).optional(),
-    llm: triageJudgmentLlmOverridesField.optional(),
 })
     .passthrough();
-/** Triage process: explicit LLM-as-judge enablement and execution overrides. */
+/** Triage process: whether the LLM-as-judge runs; it runs where `improve.processes.triage` says. */
 const triageJudgmentField = z
     .union([z.boolean(), triageJudgmentObjectField])
     .transform((value) => typeof value === "boolean" ? { enabled: value } : { ...value, enabled: value.enabled ?? true })
@@ -258,8 +243,8 @@ export const ProactiveMaintenanceProcessConfigSchema = z
 /**
  * Process names that once had a dedicated schema and are now gone. Setting
  * one, even with `enabled: true`, is tolerated rather than rejected by the
- * "unknown enabled process" check below — an old config must keep loading
- * (AGENTS.md "Reading persisted data"). `graphExtraction`: the LLM
+ * "unknown enabled process" check below — an old config must keep loading.
+ * `graphExtraction`: the LLM
  * entity-graph extraction it ran was retired in 0.9.17-alpha.9.
  * `feedbackDistillation`: a wrapper of `processes.distill.enabled`, removed in
  * 0.8.0.
@@ -297,10 +282,6 @@ const ImproveProfileProcessesSchema = z
 });
 export const ImproveProfileConfigSchema = z
     .object({
-    engine: engineName.optional(),
-    model: nonEmptyString.optional(),
-    timeoutMs: z.union([positiveInt, z.null()]).optional(),
-    llm: LlmInvocationOverridesSchema.optional(),
     description: z.string().min(1).optional(),
     processes: ImproveProfileProcessesSchema.optional(),
     limit: positiveInt.optional(),

package/dist/core/config/schema/improve.js

@@ -8,7 +8,7 @@
  */
 import { z } from "zod";
 import { ImproveProfileConfigSchema } from "./improve-processes.js";
-import { engineName, nonNegativeNumber } from "./primitives.js";
+import { engineName, LlmInvocationOverridesSchema, nonEmptyString, nonNegativeNumber, positiveInt } from "./primitives.js";
 // ── Improve top-level (event retention, salience, state GC) ────────────────
 const ImproveSalienceSchema = z.object({}).passthrough();
 // #733 — orphan-GC pass (Workstream C, lean by design: one config gate).
@@ -27,8 +27,43 @@ const ImproveStateGcSchema = z
     collect: z.boolean().optional(),
 })
     .passthrough();
+/**
+ * Where one improve call runs: a connection or a harness, the model (an alias or
+ * a name), inference settings and a timeout. Strategies say which processes run;
+ * this says where, whichever strategy is selected.
+ */
+export const ImproveWhereSchema = z
+    .object({
+    connection: nonEmptyString.optional(),
+    harness: nonEmptyString.optional(),
+    model: nonEmptyString.optional(),
+    llm: LlmInvocationOverridesSchema.optional(),
+    timeoutMs: z.union([positiveInt, z.null()]).optional(),
+})
+    .passthrough();
+/** The improve processes that make a model call; `proactiveMaintenance` makes none, so it has no place to run. */
+const ImproveProcessesSchema = z
+    .object({
+    reflect: ImproveWhereSchema.optional(),
+    distill: ImproveWhereSchema.optional(),
+    consolidate: ImproveWhereSchema.optional(),
+    memoryInference: ImproveWhereSchema.optional(),
+    extract: ImproveWhereSchema.optional(),
+    validation: ImproveWhereSchema.optional(),
+    triage: ImproveWhereSchema.optional(),
+})
+    .passthrough();
 export const ImproveConfigSchema = z
     .object({
+    /** The strategy `akm improve` runs when `--strategy` names none. */
+    strategy: engineName.optional(),
+    /** Where improve's model work runs: a connection, or a harness, over the default. */
+    connection: nonEmptyString.optional(),
+    harness: nonEmptyString.optional(),
+    /** Where each improve process runs, over `connection` / `harness` above. */
+    processes: ImproveProcessesSchema.optional(),
+    /** Where the judge of the reflect and distill quality gates runs, over `connection` / `harness` above (not over the process's own settings, which are the writer's). */
+    qualityGate: ImproveWhereSchema.optional(),
     strategies: z.record(engineName, ImproveProfileConfigSchema).optional(),
     eventRetentionDays: nonNegativeNumber.optional(),
     salience: ImproveSalienceSchema.optional(),

package/dist/core/config/schema/index-config.js

@@ -2,41 +2,34 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * `index` config: reserved feature sections + arbitrary per-pass entries.
- * Extracted verbatim from the former `config-schema.ts` monolith — no behavior
- * change.
+ * `index` config: the index-wide model-work settings + arbitrary per-pass entries.
  */
 import { z } from "zod";
-import { engineName, LlmInvocationOverridesSchema, nonEmptyString, positiveInt } from "./primitives.js";
+import { LlmInvocationOverridesSchema, nonEmptyString, positiveInt } from "./primitives.js";
 // ── Index / per-pass ────────────────────────────────────────────────────────
 /**
- * Per-pass `index.<pass>` entry. Unknown keys (including inline engine
+ * Per-pass `index.<pass>` entry. Unknown keys (including inline connection
  * settings an earlier release carried) are kept and named by the config
  * loader's schema walk like any other unknown key.
  */
 export const IndexPassConfigSchema = z
     .object({
-    engine: engineName.optional(),
+    connection: nonEmptyString.optional(),
     model: nonEmptyString.optional(),
     timeoutMs: z.union([positiveInt, z.null()]).optional(),
     enabled: z.boolean().optional(),
     llm: LlmInvocationOverridesSchema.optional(),
 })
     .passthrough();
-const IndexDefaultsSchema = z
-    .object({
-    engine: engineName.optional(),
-    model: nonEmptyString.optional(),
-    timeoutMs: z.union([positiveInt, z.null()]).optional(),
-    llm: LlmInvocationOverridesSchema.optional(),
-})
-    .passthrough();
+/** The keys that are settings for every pass, not a pass of their own. */
+const INDEX_WIDE_KEYS = ["connection", "model", "timeoutMs", "llm"];
 /**
- * Index config is a union of reserved feature sections and per-pass entries.
- * Passthrough so per-pass entries (keyed by arbitrary pass names like
- * `memory`, or a retired one like `graph`) can live next to the reserved keys.
- * The outer preprocess emits the legacy parser's actionable error messages
- * for the two most common type-shape mistakes:
+ * Index config is the index-wide model-work settings (`connection`, `model`,
+ * `timeoutMs`, `llm`) plus per-pass entries keyed by pass name. Passthrough so
+ * per-pass entries (keyed by arbitrary pass names like `memory`, or a retired
+ * one like `graph`) can live next to the index-wide keys. The outer preprocess
+ * emits the legacy parser's actionable error messages for the two most common
+ * type-shape mistakes:
  *   - An array at the `index` block.
  *   - A non-object at `index.<passName>`.
  * Inner field validation (invocation overrides, provider-key rejection) is
@@ -55,6 +48,8 @@ const IndexConfigRuntimeSchema = z.preprocess((raw, ctx) => {
     if (typeof raw !== "object")
         return raw;
     for (const [passName, value] of Object.entries(raw)) {
+        if (INDEX_WIDE_KEYS.includes(passName))
+            continue;
         if (typeof value !== "object" || value === null || Array.isArray(value)) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
@@ -66,7 +61,10 @@ const IndexConfigRuntimeSchema = z.preprocess((raw, ctx) => {
     return raw;
 }, z
     .object({
-    defaults: IndexDefaultsSchema.optional(),
+    connection: nonEmptyString.optional(),
+    model: nonEmptyString.optional(),
+    timeoutMs: z.union([positiveInt, z.null()]).optional(),
+    llm: LlmInvocationOverridesSchema.optional(),
 })
     .catchall(IndexPassConfigSchema));
 // The runtime catchall correctly validates arbitrary pass objects, but its

package/dist/core/config/schema/primitives.js

@@ -8,6 +8,8 @@
  */
 import { z } from "zod";
 import { validateExtraParams } from "../../extra-params.js";
+import { redactUrlCredentials } from "../../redaction.js";
+import { isSecretRefToken } from "../../ref-token.js";
 import { warnOnce } from "../../warn.js";
 import { ENGINE_NAME_PATTERN_SOURCE } from "../engine-semantics.js";
 /** Persisted config schema version. Package prerelease/patch versions do not change this value. */
@@ -28,24 +30,50 @@ export const httpUrl = z.string().refine((v) => v.startsWith("http://") || v.sta
 });
 const ENGINE_NAME_PATTERN = new RegExp(ENGINE_NAME_PATTERN_SOURCE);
 export const ENV_REFERENCE_PATTERN = /^\$[A-Za-z_][A-Za-z0-9_]*$|^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/;
-/** `secret://<name>` — an apiKey reference into the akm secret store, resolved via `resolveSecretFromStore`. */
-export const SECRET_STORE_REFERENCE_PATTERN = /^secret:\/\/(.+)$/;
 export const engineName = z
     .string()
     .max(63)
     .regex(ENGINE_NAME_PATTERN, "names must be lowercase kebab-case and must not begin with reserved akm-");
-/** The two symbolic apiKey forms akm accepts: an env-var reference or a secret-store reference. Never matches a literal key. */
+/** The two symbolic credential forms akm accepts in a bundle source's `credential`: an env-var reference (`$VAR`, `${VAR}`) or a `secrets/` ref (`${secrets/name}`). Never matches a literal key. */
 export function isApiKeyReference(value) {
-    return ENV_REFERENCE_PATTERN.test(value) || SECRET_STORE_REFERENCE_PATTERN.test(value);
+    return ENV_REFERENCE_PATTERN.test(value) || isSecretRefToken(value);
 }
-export function symbolicOrWarnApiKey(label) {
-    return z.string().superRefine((value) => {
-        if (isApiKeyReference(value))
-            return;
-        warnOnce(`config:literal-api-key:${label}`, `A ${label} in config.json is a literal API key, not a $VAR/\${VAR}/secret:// reference; using it as configured. Prefer \`akm config set ...apiKey '$VAR'\` (with the corresponding env var set) or \`secret://<name>\` (with \`akm secret set <name> ...\`) — see docs/reference/data-and-telemetry.md.`);
-    });
+/** A `$VAR` / `${VAR}` reference to an environment variable. */
+export function isEnvReference(value) {
+    return ENV_REFERENCE_PATTERN.test(value);
 }
-export const chatCompletionsEndpoint = z.string().superRefine((value, ctx) => {
+/** The variable a `$VAR` / `${VAR}` reference names. */
+export function envReferenceName(value) {
+    return /^\$(?:\{)?([A-Za-z_][A-Za-z0-9_]*)(?:\})?$/.exec(value)?.[1];
+}
+/**
+ * The `apiKey` of a connection, `embedding` or `search.curateRerank`: a `$VAR` /
+ * `${VAR}` reference, or absent (the key is then `credentials.json`'s under the
+ * block's name). Anything else is never read or sent: it is warned about once,
+ * never a load error, and kept as written so an ordinary write does not delete
+ * the user's key from their file (`akm migrate apply` moves it).
+ */
+export const envReferenceApiKey = z.string().transform((value) => {
+    if (isEnvReference(value))
+        return value;
+    if (isSecretRefToken(value)) {
+        warnOnce("config:secret-ref-api-key", "An apiKey that is a secret-store reference is ignored: akm reads a key from a $VAR or credentials.json. `akm migrate apply` moves it into credentials.json.");
+    }
+    else {
+        warnOnce("config:literal-api-key", "A literal apiKey in config.json is ignored: akm does not read keys from config. Use a $VAR reference, or run `akm migrate apply` to move the key into credentials.json.");
+    }
+    return value;
+});
+/**
+ * The retired `apiKeyFile` of an engine that `akm migrate apply` could not read yet: kept as written so a
+ * later run can move the key it names, never read, sent or printed by akm.
+ */
+export const retiredApiKeyFile = z.string().transform((value) => {
+    warnOnce("config:api-key-file", "An apiKeyFile in config.json is ignored: akm reads a key from a $VAR or credentials.json. `akm migrate apply` moves the key the file holds once it can be read.");
+    return value;
+});
+/** A connection endpoint: a complete http(s) URL, the OpenAI-compatible base (`…/v1`) or the chat-completions URL itself. */
+export const connectionEndpoint = z.string().superRefine((value, ctx) => {
     let url;
     try {
         url = new URL(value);
@@ -59,10 +87,9 @@ export const chatCompletionsEndpoint = z.string().superRefine((value, ctx) => {
         return;
     }
     if (url.username || url.password) {
-        warnOnce(`chatCompletionsEndpoint:userinfo:${value}`, `Config endpoint "${value}" embeds a username/password; consider moving the credential to the engine's apiKey field instead.`);
-    }
-    if (!url.pathname.endsWith("/chat/completions")) {
-        warnOnce(`chatCompletionsEndpoint:path:${value}`, `Config endpoint "${value}" does not end in /chat/completions; using it as configured.`);
+        // The warning names the endpoint without the credential it is about, and is keyed by that too.
+        const shown = redactUrlCredentials(value);
+        warnOnce(`connectionEndpoint:userinfo:${shown}`, `Config endpoint "${shown}" embeds a username/password; move the credential out of the URL (apiKey: "$VAR", or credentials.json).`);
     }
 });
 export const ExtraParamsSchema = z.record(z.unknown()).superRefine((value, ctx) => {
@@ -75,9 +102,7 @@ export const LlmInvocationOverridesSchema = z
     .object({
     temperature: z.number().finite().optional(),
     maxTokens: positiveInt.optional(),
-    supportsJsonSchema: z.boolean().optional(),
     extraParams: ExtraParamsSchema.optional(),
-    contextLength: positiveInt.optional(),
     enableThinking: z.boolean().optional(),
     reasoningEffort: nonEmptyString.optional(),
 })

package/dist/core/config/schema/search.js

@@ -6,21 +6,16 @@
  * reranker.
  */
 import { z } from "zod";
-import { httpUrl, nonEmptyString, positiveInt, symbolicOrWarnApiKey } from "./primitives.js";
+import { envReferenceApiKey, httpUrl, nonEmptyString, positiveInt } from "./primitives.js";
 // ── Search ──────────────────────────────────────────────────────────────────
 /**
  * `search.curateRerank` (#951) — an optional cross-encoder rerank pass over
  * `akm curate`'s top fused candidates.
  *
- * Deliberately its own small config arm rather than a third member of the
- * `engines` map (`EngineConfigSchema` in ./engines.ts): that union's "llm" /
- * "agent" kinds are load-bearing all the way through execution-lowering,
- * runner dispatch, and the harness model map (100+ call sites narrow on
- * `engine.kind`). A reranker is neither — it never dispatches an agent or
- * lowers to a chat-completions call — so folding it into that union would
- * force every one of those call sites to account for a kind they can't do
- * anything with. `endpoint` + `model` (+ optional `apiKey`) is the same
- * connection shape as an LLM engine without inheriting that machinery.
+ * Deliberately its own small config block rather than a `connections` entry: a
+ * reranker never dispatches an agent or lowers to a chat-completions call, and
+ * its `endpoint` is the full rerank URL. Its `apiKey` follows the connection
+ * rule (`$VAR`, or `credentials.json` under the name `curateRerank`).
  *
  * `curate_rerank` was removed as a dead `llm.features.*` key in 0.8.0 (no
  * implementation ever sent a request); this is a new, real implementation,
@@ -32,7 +27,7 @@ export const CurateRerankConfigSchema = z
     /** Full URL of the reranker's rerank endpoint, e.g. `http://host:port/rerank`. */
     endpoint: httpUrl.optional(),
     model: nonEmptyString.optional(),
-    apiKey: symbolicOrWarnApiKey("search.curateRerank.apiKey").optional(),
+    apiKey: envReferenceApiKey.optional(),
     timeoutMs: positiveInt.optional(),
     /** How many of the top fused search candidates curate sends to the reranker. Default 30. */
     topN: positiveInt.max(50).optional(),

package/dist/core/config/schema/sources-bundles.js

@@ -64,7 +64,7 @@ export const SourceConfigEntrySchema = z
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
             path: ["credential"],
-            message: "git credential must be a $VAR or secret://<name> reference",
+            message: "git credential must be a $VAR, ${VAR} or ${secrets/<name>} reference",
         });
     }
 });
@@ -77,20 +77,20 @@ export const RegistryConfigEntrySchema = z
     options: z.record(z.unknown()).optional(),
 })
     .passthrough();
-// ── Bundles (0.9.0 config-shape cutover, spec §10.1 / D-R5) ─────────────────
+// ── Bundles ─────────────────────────────────────────────────────────────────
 //
 // `bundles` + `defaultBundle` are the desired-configuration shape. Each bundle
 // entry carries ONE source descriptor (`path` | `git` | `website` | `npm`
 // — mirroring today's source types), an optional `writable`, an optional
 // `registryId` locator (the original registry install id, preserved verbatim so
 // a non-slug-legal id like `github:owner/repo` is not lost when its slug-legal
-// bundle KEY is derived), and an optional single-entry `components` map (spec
-// §10.1; the transitional one-component-per-bundle coupling — NOT multi-component
-// machinery). The map KEY is the workspace bundle slug (spec §11.1 charset: no
+// bundle KEY is derived), and an optional single-entry `components` map (the
+// transitional one-component-per-bundle coupling — NOT multi-component
+// machinery). The map KEY is the workspace bundle slug (charset: no
 // `/`, `:`, `.`, `#`, whitespace), validated with {@link isBundleSlug}.
 //
 // `bindings` is not accepted here; the top-level schema rejects it.
-/** Website source descriptor for a bundle entry (spec §10.1). */
+/** Website source descriptor for a bundle entry. */
 const BundleWebsiteDescriptorSchema = z
     .object({
     url: httpUrl,
@@ -110,7 +110,7 @@ const BundleWebsiteDescriptorSchema = z
     crawlTimeoutMs: z.number().int().min(0).optional(),
 })
     .passthrough();
-/** One component of a bundle (spec §10.1). Single-entry, transitional. */
+/** One component of a bundle. Single-entry, transitional. */
 const BundleComponentConfigSchema = z
     .object({
     root: z.string().min(1).optional(),
@@ -178,7 +178,7 @@ export const BundleConfigEntrySchema = z
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
             path: ["credential"],
-            message: "git credential must be a $VAR or secret://<name> reference",
+            message: "git credential must be a $VAR, ${VAR} or ${secrets/<name>} reference",
         });
     }
     const componentEntries = entry.components ? Object.entries(entry.components) : [];
@@ -216,7 +216,7 @@ export const BundleConfigEntrySchema = z
     }
 });
 /**
- * `bundles` map. Keys are workspace bundle slugs (spec §11.1 / D-R5 charset).
+ * `bundles` map. Keys are workspace bundle slugs.
  * The key charset is validated with {@link isBundleSlug} so a key can never carry
  * `/`, `:`, `.`, `#`, or whitespace (which would break the `bundle//conceptId`
  * ref grammar).

package/dist/core/config/schema/workflow.js

@@ -2,12 +2,10 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * `workflow` engine settings. Extracted verbatim from the former
- * `config-schema.ts` monolith — no behavior change.
+ * `workflow` settings (fan-out limits).
  */
 import { z } from "zod";
-import { engineName, positiveInt } from "./primitives.js";
-// ── Workflow engine ─────────────────────────────────────────────────────────
+import { positiveInt } from "./primitives.js";
 /**
  * Workflow-engine settings (`workflow`).
  *
@@ -34,7 +32,5 @@ export const WorkflowConfigSchema = z
     .object({
     maxConcurrency: positiveInt.optional(),
     defaultMapConcurrency: positiveInt.optional(),
-    /** Named LLM or agent engine frozen into every criteria-bearing gate. */
-    judgeEngine: engineName.optional(),
 })
     .passthrough();

package/dist/core/config/unusable-entries.js

@@ -0,0 +1,66 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { isRecord } from "../common.js";
+import { warnOnce } from "../warn.js";
+import { ConnectionSchema } from "./schema/connections.js";
+import { HarnessSchema, harnessNameProblem } from "./schema/harnesses.js";
+import { engineName } from "./schema/primitives.js";
+/** The first thing a schema found wrong with an entry, as a sentence fragment. */
+function firstIssue(error) {
+    const issue = error.issues[0];
+    const where = issue?.path.join(".");
+    return `${where ? `${where}: ` : ""}${issue?.message ?? "it is not valid"}`;
+}
+/** Why an entry cannot have this name, if it cannot: the rule every connection and harness name follows. */
+function nameProblem(name) {
+    const parsed = engineName.safeParse(name);
+    return parsed.success ? undefined : `its name breaks the naming rule (${firstIssue(parsed.error)})`;
+}
+/** Why a connection entry cannot be used, if it cannot: its name breaks the rule, or its own schema rejects it. */
+function connectionProblem(name, entry) {
+    const parsed = ConnectionSchema.safeParse(entry);
+    return nameProblem(name) ?? (parsed.success ? undefined : firstIssue(parsed.error));
+}
+/** Why a harness entry cannot be used, if it cannot: as for a connection, or it names no platform and is not one. */
+function harnessProblem(name, entry) {
+    const parsed = HarnessSchema.safeParse(entry);
+    return nameProblem(name) ?? (parsed.success ? harnessNameProblem(name, parsed.data) : firstIssue(parsed.error));
+}
+/** The connections and harnesses of `raw` that their own schemas reject, in file order. */
+export function findUnusableEntries(raw) {
+    const unusable = [];
+    const check = (entries, kind, problem) => {
+        if (!isRecord(entries))
+            return;
+        for (const [name, entry] of Object.entries(entries)) {
+            const why = problem(name, entry);
+            if (why !== undefined)
+                unusable.push({ kind, name, why });
+        }
+    };
+    check(raw.connections, "connection", connectionProblem);
+    check(raw.harnesses, "harness", harnessProblem);
+    return unusable;
+}
+/**
+ * A connection or harness its own schema rejects (no endpoint, an endpoint that
+ * is not a URL, a model that is not a name, a harness akm cannot run, a name that
+ * breaks the naming rule) is of no
+ * use, but it is not a reason to refuse the rest of the config or to disable the
+ * entries beside it: each is dropped from what is read, with one warning naming
+ * it and the first thing wrong. The file keeps it, and a write does not remove it.
+ */
+export function dropUnusableEntries(raw, sourcePath) {
+    const unusable = findUnusableEntries(raw);
+    if (unusable.length === 0)
+        return raw;
+    const out = { ...raw };
+    for (const { kind, name, why } of unusable) {
+        warnOnce(`config:unusable:${kind}:${sourcePath ?? "inline"}:${name}`, `Ignoring ${kind} "${name}"${sourcePath ? ` in ${sourcePath}` : ""}: ${why}.`);
+        const holder = kind === "connection" ? "connections" : "harnesses";
+        const { [name]: _dropped, ...kept } = out[holder];
+        out[holder] = kept;
+    }
+    return out;
+}

package/dist/core/content-safety.js

@@ -14,15 +14,12 @@ export function containsReflectPromptScaffolding(content) {
 }
 /**
  * Return a secret-free rejection reason when generated content is unsafe to
- * persist. `redactedContent` is the same body after applying the dispatch
- * lease's sensitive-value inventory; comparing it avoids exposing the value.
+ * persist. A dispatch redacts its reply before anything reads it, so content
+ * that echoed a credential reaches here carrying the marker.
  */
-export function generatedContentRejection(content, redactedContent) {
+export function generatedContentRejection(content) {
     if (containsRedactedContent(content)) {
         return `Agent proposal content contains ${REDACTED_CONTENT_MARKER}; refusing to persist already-redacted text.`;
     }
-    if (redactedContent !== content) {
-        return "Agent proposal content echoed a configured credential; refusing to persist either the secret or a redacted replacement.";
-    }
     return undefined;
 }