akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/indexer/installations.js

@@ -2,31 +2,22 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * `deriveInstallations` — akm 0.9.0 Chunk 5, milestone M-a.
+ * `deriveInstallations`.
  *
  * Bridges the `SearchSource[]` model (the live indexer's source list,
  * `search-source.ts`) onto the durable `BundleInstallation[]` /
- * `BundleComponent[]` model (spec §1.1). LIVE: called from the indexer
+ * `BundleComponent[]` model. Called from the indexer
  * (provenance derivation), the proposal repository, and written-asset
- * indexing. The originally-planned full "Step-3" `scanComponent`-driven scan
- * swap was superseded by the narrower Chunk-5 F4a drain-dir engine swap; the
- * shadow-parity scaffolding module (`scan/scan-installations.ts`) was deleted
- * as dead in the 0.9.0 close-out.
+ * indexing.
  *
  * Per source → one installation:
  *   - `id`       = `source.registryId` ?? a deterministic slug of `source.path`
- *                  (the `<bundle>` prefix of every ref this installation emits,
- *                  spec §1.3). Slugs are made unique WITHIN a derivation batch
+ *                  (the `<bundle>` prefix of every ref this installation emits).
+ *                  Slugs are made unique WITHIN a derivation batch
  *                  by appending a short path-hash suffix on collision, so two
  *                  sources sharing a basename never mint the same bundle id.
- *   - `trusted`  = `source.writable === true`. 0.9.0 ships no first-class trust
- *                  record (spec §1.3 — "no new trust machinery"); the writable
- *                  primary/config stashes are the user's own and count as
- *                  trusted, read-only registry caches do not. Nothing consumes
- *                  `trusted` in the live path yet (installation grants nothing,
- *                  History D8) — this is the Tier-A placeholder mapping.
  *   - components = ONE component for the current single-root akm layout
- *                  (spec §1.2 rule 5): `{ id, root: source.path, adapter }`. The
+ *                  `{ id, root: source.path, adapter }`. The
  *                  akm layout's type dirs (`knowledge/`, `skills/`, …) are NOT
  *                  separate components — they are type-derived leading path
  *                  segments of the conceptId within the one component.
@@ -42,11 +33,11 @@
  * from the installation) is a downstream contract refinement — nothing in the
  * live path reads `IndexDocument.component` as distinct from `bundle` today.
  *
- * ── Adapter selection (spec §1.2 ordered probe) ──
+ * ── Adapter selection (ordered probe) ──
  *
  * The adapter is chosen by the ordered `looksLikeRoot` probe over the built-in
  * adapters (`getAdapters()`), first match wins. The registry is now a STATIC
- * FROZEN map (normative §12.6) populated at module load, so this probe runs in
+ * FROZEN map populated at module load, so this probe runs in
  * production with the full 11-family set — no registration call is required
  * first. Array order (`BUILTIN_ADAPTERS`) is the probe precedence, most-specific
  * first, so a `.claude`/dotenv/wiki root is claimed by its tight probe before
@@ -56,17 +47,17 @@
  * fallback is **`akm`** (see {@link FALLBACK_ADAPTER_ID}), preserving workspace
  * root behavior. Explicit configured ownership always wins over probing.
  */
-import { isSourceWriteActivated } from "../core/activation-policy.js";
 import { detectAdapterId } from "../core/adapter/detect-adapter.js";
 import { stashDirFor } from "../core/asset/asset-placement.js";
 import { deriveBundleId, deriveBundleIds, slugForPath } from "../core/bundle-id.js";
+import { isSourceWriteActivated } from "../core/write-source.js";
 export { deriveBundleId, deriveBundleIds, slugForPath };
 /**
  * The no-probe-match fallback adapter id.
  *
- * The status-quo-preserving default from spec §1.2(3):
+ * The status-quo-preserving default:
  *
- *  - Behavior discipline (spec line 267): the AKM workspace root's own indexing
+ *  - Behavior discipline: the AKM workspace root's own indexing
  *    MUST stay classified `akm`. In this transitional model there is no
  *    depends on either explicit adapter configuration, `akm.looksLikeRoot`
  *    firing (type dirs / `.stash` present), or this fallback. A genuinely empty
@@ -78,7 +69,7 @@ export { deriveBundleId, deriveBundleIds, slugForPath };
 const FALLBACK_ADAPTER_ID = "akm";
 /**
  * Resolve the adapter id for a component root via the ordered `looksLikeRoot`
- * probe (spec §1.2), first match wins; falls back to `akm` when no probe fires.
+ * probe, first match wins; falls back to `akm` when no probe fires.
  */
 export { detectAdapterId } from "../core/adapter/detect-adapter.js";
 /**
@@ -98,7 +89,6 @@ export function deriveInstallations(sources) {
         const adapter = source.adapterId ?? detectAdapterId(source.path, FALLBACK_ADAPTER_ID);
         installations.push({
             id,
-            trusted: writable,
             components: [
                 {
                     // Single-component akm layout: the component id == the bundle id so

package/dist/indexer/lookup/adapter-concept-owner.js

@@ -3,12 +3,15 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import fs from "node:fs";
 import path from "node:path";
+import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
 import { adapterForId } from "../../core/adapter/registry.js";
-import { compareCodePoints, hasErrnoCode, isWithin } from "../../core/common.js";
+import { compareCodePoints, hasErrnoCode } from "../../core/common.js";
 import { ConfigError, UsageError } from "../../core/errors.js";
 import { canonicalizeWorkflowName } from "../../core/recognition-util.js";
+import { sensitiveMarkerPath } from "../../core/sensitive-marker-path.js";
 import { warnOnce } from "../../core/warn.js";
 import { resolveUniqueWorkflowSource, workflowNameForConceptId, } from "../../workflows/source-files.js";
+import { deriveInstallations } from "../installations.js";
 import { buildFileContext } from "../walk/file-context.js";
 const CONTENT_READ_REQUIRED = Symbol("adapter ownership probe requires content");
 export class AdapterConceptOwnershipError extends UsageError {
@@ -40,22 +43,18 @@ function lexicallyWithin(candidate, root) {
     return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
 }
 /** Add case-only suffix spellings beside an adapter-authored read candidate. */
-function candidateSpellings(candidate, sourcePath, realRoot) {
+function candidateSpellings(candidate, sourcePath) {
     const authored = path.resolve(candidate.path);
     if (!lexicallyWithin(authored, sourcePath))
         return [{ ...candidate, path: authored }];
     const parent = path.dirname(authored);
-    let realParent;
     let entries;
     try {
-        realParent = fs.realpathSync(parent);
         entries = fs.readdirSync(parent, { withFileTypes: true });
     }
     catch {
         return [{ ...candidate, path: authored }];
     }
-    if (!isWithin(realParent, realRoot))
-        return [{ ...candidate, path: authored }];
     const extension = path.extname(authored);
     if (!extension)
         return [{ ...candidate, path: authored }];
@@ -67,7 +66,7 @@ function candidateSpellings(candidate, sourcePath, realRoot) {
     })
         .map((entry) => ({ ...candidate, path: path.join(parent, entry.name) }));
 }
-function inspectCandidate(sourcePath, realRoot, adapterId, candidate) {
+function inspectCandidate(sourcePath, adapterId, candidate) {
     const authoredPath = path.resolve(candidate.path);
     if (!lexicallyWithin(authoredPath, sourcePath))
         return undefined;
@@ -87,8 +86,6 @@ function inspectCandidate(sourcePath, realRoot, adapterId, candidate) {
     catch {
         return undefined;
     }
-    if (!isWithin(realPath, realRoot))
-        return undefined;
     try {
         if (!fs.statSync(realPath).isFile())
             return undefined;
@@ -118,6 +115,14 @@ function claimsWithoutContent(adapter, component, owner) {
         throw error;
     }
 }
+/** True for an env/secret file that a sibling `.sensitive` marker hides from the index. */
+function isMarkedSensitive(owner) {
+    const head = owner.conceptId.split("/")[0];
+    if (head !== "env" && head !== "secrets")
+        return false;
+    const marker = sensitiveMarkerPath(owner.path, head === "env" ? "env" : "secret");
+    return marker !== owner.path && fs.existsSync(marker);
+}
 /**
  * Resolve one adapter/component's exact physical concept owner without reading
  * authored bytes. Native workflow arbitration is reused verbatim; every other
@@ -129,9 +134,8 @@ export function resolveAdapterConceptOwner(sourcePath, adapterId, conceptId, opt
     const normalized = normalizedConceptId(conceptId);
     if (!adapter || !normalized)
         return undefined;
-    let realRoot;
     try {
-        realRoot = fs.realpathSync(sourcePath);
+        fs.realpathSync(sourcePath);
     }
     catch (error) {
         // Genuinely absent — "no owner" is correct. Any other failure (e.g.
@@ -168,13 +172,13 @@ export function resolveAdapterConceptOwner(sourcePath, adapterId, conceptId, opt
     // — see each adapter's own doc comment for its candidate classes), and
     // `candidateSpellings` adds case-only siblings via one `readdirSync` of
     // each candidate's own parent directory.
-    const spellings = (adapter.readCandidates?.(component, resolutionConceptId) ?? []).flatMap((candidate) => candidateSpellings(candidate, sourcePath, realRoot));
+    const spellings = (adapter.readCandidates?.(component, resolutionConceptId) ?? []).flatMap((candidate) => candidateSpellings(candidate, sourcePath));
     const inspected = [
         ...new Map(spellings.map((candidate) => [`${path.resolve(candidate.path)}\0${candidate.conceptId}`, candidate])).values(),
     ]
         .sort((left, right) => compareCodePoints(left.path, right.path))
         .flatMap((candidate) => {
-        const owner = inspectCandidate(sourcePath, realRoot, adapterId, candidate);
+        const owner = inspectCandidate(sourcePath, adapterId, candidate);
         return owner ? [owner] : [];
     });
     for (const candidate of inspected) {
@@ -183,8 +187,10 @@ export function resolveAdapterConceptOwner(sourcePath, adapterId, conceptId, opt
         const identity = `${path.resolve(candidate.path)}\0${candidate.conceptId}`;
         if (ownersByIdentity.has(identity))
             continue;
-        if (claimsWithoutContent(adapter, component, candidate))
+        if (claimsWithoutContent(adapter, component, candidate) ||
+            (options?.includeSensitive && isMarkedSensitive(candidate))) {
             ownersByIdentity.set(identity, candidate);
+        }
     }
     const owners = [...ownersByIdentity.values()]
         .filter((owner) => owner.conceptId === resolutionConceptId)
@@ -202,6 +208,26 @@ export function resolveAdapterConceptOwner(sourcePath, adapterId, conceptId, opt
     }
     return owners[0];
 }
+/**
+ * The one "where is asset X right now?" walk. `sources` is the ordered source
+ * list (`resolveSourceEntries`: default bundle first, then installation
+ * priority). The first source with a physical owner for the ref ends the
+ * walk; a qualified ref only considers its own bundle. Synchronous and
+ * index-free: it never opens a database, so a caller may use it at dispatch.
+ */
+export function resolveConceptOwner(ref, sources, options) {
+    const installations = deriveInstallations([...sources]);
+    for (const [index, source] of sources.entries()) {
+        const bundleId = installations[index]?.id;
+        if (!bundleId || (ref.bundle !== undefined && bundleId !== ref.bundle))
+            continue;
+        const adapterId = source.adapterId ?? detectAdapterId(source.path);
+        const owner = resolveAdapterConceptOwner(source.path, adapterId, ref.conceptId, options);
+        if (owner)
+            return { owner, source, bundleId, adapterId };
+    }
+    return undefined;
+}
 export function indexedPathMatchesOwner(indexedPath, owner) {
     if (path.resolve(indexedPath) !== path.resolve(owner.path))
         return false;

package/dist/indexer/materialize-embeddings.js

@@ -2,10 +2,12 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { getConfigPath } from "../core/paths.js";
+import { redactUrlCredentials } from "../core/redaction.js";
 import { isVerbose, warn, warnVerbose } from "../core/warn.js";
 import { embedBatch } from "../llm/embedder.js";
+import { effectiveEmbedding } from "../llm/embedders/connection.js";
 import { DETERMINISTIC_EMBED_MODEL_ID, isDeterministicEmbedEnabled } from "../llm/embedders/deterministic.js";
-import { DEFAULT_LOCAL_MODEL } from "../llm/embedders/local.js";
+import { DEFAULT_LOCAL_MODEL, LocalRuntimeUnavailableError } from "../llm/embedders/local.js";
 import { applyEmbeddingTemplate, documentTemplateFingerprint, resolveEmbeddingProfile } from "../llm/embedders/profile.js";
 import { capEmbeddingText, DEFAULT_MAX_INPUT_TOKENS, describeEmbeddingCredential, estimateTokenCount, hasRemoteEndpoint, normalizeEmbeddingEndpoint, } from "../llm/embedders/remote.js";
 import { getEmbeddableEntryCount } from "../storage/repositories/index-entries-repository.js";
@@ -80,27 +82,28 @@ export async function generateEmbeddingsForDb(db, config, onProgress, signal, en
         onProgress({ phase: "embeddings", message: "Semantic search disabled; skipping embeddings." });
         return { success: false, message: "Semantic search is disabled." };
     }
+    const embedding = effectiveEmbedding(config);
     // #953 field gap: the actionable outcome is a self-diagnosing run, not a
-    // fix (every RemoteEmbedder path already resolves secret:// through one
-    // boundary — a keyless request can only mean embedding.apiKey was absent
-    // from the config THIS run loaded). One default-level line, before the
-    // first provider request of the phase, naming the endpoint/model/credential
-    // SOURCE — never the credential value.
-    if (hasRemoteEndpoint(config.embedding ?? {})) {
-        const endpoint = normalizeEmbeddingEndpoint(config.embedding?.endpoint ?? "");
-        const credential = describeEmbeddingCredential(config.embedding?.apiKey);
+    // fix (every RemoteEmbedder path resolves its key through one boundary — a
+    // keyless request can only mean no key was configured in the config THIS run
+    // loaded). One default-level line, before the first provider request of the
+    // phase, naming the endpoint/model/credential SOURCE — never the credential
+    // value.
+    if (embedding && hasRemoteEndpoint(embedding)) {
+        const endpoint = redactUrlCredentials(normalizeEmbeddingEndpoint(embedding.endpoint ?? ""));
+        const credential = describeEmbeddingCredential(embedding);
         const configFileSuffix = isVerbose() ? `; config: ${getConfigPath()}` : "";
         onProgress({
             phase: "embeddings",
-            message: `[embed] endpoint ${endpoint}, model ${config.embedding?.model ?? "unknown"}; credential: ${credential}${configFileSuffix}`,
+            message: `[embed] endpoint ${endpoint}, model ${embedding.model ?? "unknown"}; credential: ${credential}${configFileSuffix}`,
         });
     }
-    const model = deriveSemanticProviderFingerprint(config.embedding);
+    const model = deriveSemanticProviderFingerprint(embedding);
     const storedModel = getMeta(db, "embeddingFingerprint");
     let targetEntryIds = entryIds;
     /** Set only when every entry is (re)embedded, so the up-front "Re-embedding N entries" line names why. */
     let rebuildReason;
-    const maxInputTokens = config.embedding?.maxInputTokens ?? DEFAULT_MAX_INPUT_TOKENS;
+    const maxInputTokens = embedding?.maxInputTokens ?? DEFAULT_MAX_INPUT_TOKENS;
     if (opts?.forceReembed) {
         // The explicit operator override: purge and re-embed everything. The model
         // is recorded in the SAME transaction as the purge, before any embedding
@@ -144,7 +147,7 @@ export async function generateEmbeddingsForDb(db, config, onProgress, signal, en
         let truncatedCount = 0;
         const texts = [];
         const pendingEntries = [];
-        const { documentTemplate } = resolveEmbeddingProfile(config.embedding);
+        const { documentTemplate } = resolveEmbeddingProfile(embedding);
         for (const entry of candidateEntries) {
             const capped = capEmbeddingText(entry.searchText, maxInputTokens);
             if (capped.text.length === 0)
@@ -240,7 +243,7 @@ export async function generateEmbeddingsForDb(db, config, onProgress, signal, en
             // Whether the remote provider's endpoint/model/token language is
             // meaningful for this run — the per-batch diagnostic line below is
             // remote-only, same gate the credential diagnostic (#953) above uses.
-            const reportPerBatchLine = hasRemoteEndpoint(config.embedding ?? {});
+            const reportPerBatchLine = embedding !== undefined && hasRemoteEndpoint(embedding);
             const onBatch = (indices, batchEmbeddings, outcome) => {
                 // #954 field-report follow-up: a "retrying" event carries nothing to
                 // commit — the request hasn't settled yet — only the notice that a
@@ -331,7 +334,7 @@ export async function generateEmbeddingsForDb(db, config, onProgress, signal, en
                     message: `Embedded ${storedCount}/${pendingEntries.length} entries.`,
                 });
             };
-            await embedBatch(texts, config.embedding, signal, onSkip, onBatch);
+            await embedBatch(texts, embedding, signal, onSkip, onBatch);
             throwIfAborted(signal);
             const elapsedSeconds = Math.max((Date.now() - embedStart) / 1000, 0.001);
             if (skippedCount > 0) {
@@ -429,6 +432,7 @@ export async function generateEmbeddingsForDb(db, config, onProgress, signal, en
         return {
             success: false,
             message: `Semantic search verification failed: ${message}`,
+            ...(error instanceof LocalRuntimeUnavailableError ? { runtimeUnavailable: error.kind } : {}),
         };
     }
 }
@@ -442,7 +446,7 @@ export function publishTargetedEmbeddingMeta(db, config) {
         return;
     }
     const entryCount = getEmbeddableEntryCount(db);
-    const embeddingCount = getEmbeddingCount(db, deriveSemanticProviderFingerprint(config.embedding));
+    const embeddingCount = getEmbeddingCount(db, deriveSemanticProviderFingerprint(effectiveEmbedding(config)));
     const ready = entryCount > 0 && embeddingCount >= entryCount;
     setMeta(db, "hasEmbeddings", ready ? "1" : "0");
 }

package/dist/indexer/passes/memory-inference.js

@@ -18,15 +18,10 @@
  * with `inferenceProcessed: true`. A subsequent `akm index` therefore skips
  * the parent without re-running the LLM.
  *
- * Disabling — two orthogonal gates:
- *   1. The selected strategy sets `processes.memoryInference.enabled = false`
- *      blocks the pass at the feature-flag layer (no network call may ever
- *      issue). Historically the v1 spec §14 gate, superseded by the 0.8.0
- *      profile shape.
- *   2. `index.memory.llm = false` (or no resolvable LLM profile) opts the
- *      pass out at the per-pass layer (#208).
- *   A pass runs iff both layers allow it. Existing inferred children are
- *   NEVER deleted — the user keeps what was already produced.
+ * Disabling — one gate: `index.memory.enabled = false` (or no resolvable
+ * connection or harness) leaves the pass with no runner, and no model call is
+ * made (#208). Existing inferred children are NEVER deleted — the user keeps
+ * what was already produced.
  *
  * Scope sync: on every run, an existing derived child (`<name>.derived.md`,
  * `inferred: true`, `derivedFrom` naming its parent) whose normalized scope
@@ -55,9 +50,7 @@ import { ConfigError } from "../../core/errors.js";
 import { warn } from "../../core/warn.js";
 import { beginWriteProvenance, recordWrittenPath } from "../../core/write-provenance.js";
 import { writeAssetToSource } from "../../core/write-source.js";
-import { runnerLlmConnection } from "../../integrations/agent/runner.js";
-import { assertRunnerCredentials } from "../../integrations/agent/runner-dispatch.js";
-import { isProcessEnabled } from "../../llm/feature-gate.js";
+import { noticeSet } from "../../execution/notices.js";
 import { resolveIndexPassExecution } from "../../llm/index-passes.js";
 import * as memoryInfer from "../../llm/memory-infer.js";
 import { computeBodyHash, getLlmCacheEntry } from "../../storage/repositories/index-llm-cache-repository.js";
@@ -125,7 +118,7 @@ function memoryExecutionForContext(ctx, config) {
 }
 async function inferPendingMemoryRecord(plan, ctx) {
     const { record } = plan;
-    const { config, featureConfig, signal, db, reEnrich, llmRunner, inferTelemetry, compressMemoryToDerivedMemory, onNotices, onConfigFailure, } = ctx;
+    const { signal, db, reEnrich, llmRunner, inferTelemetry, compressMemoryToDerivedMemory, onNotices, onConfigFailure } = ctx;
     if (signal?.aborted || plan.kind === "aborted")
         return { aborted: true };
     // Existing children are complete, but the parent may be unmarked after a
@@ -154,7 +147,7 @@ async function inferPendingMemoryRecord(plan, ctx) {
     const onRetryAttempt = () => {
         retryAttempts += 1;
     };
-    const infer = () => compressMemoryToDerivedMemory(llmRunner, record.effectiveInput, signal, featureConfig, (event) => warn(`[akm] LLM fallback for ${event.feature}: ${event.reason}`), inferTelemetry, onRetryAttempt, onNotices);
+    const infer = () => compressMemoryToDerivedMemory(llmRunner, record.effectiveInput, signal, inferTelemetry, onRetryAttempt, onNotices);
     let derived = plan.kind === "cache-hit" ? plan.decision : undefined;
     try {
         if (plan.kind === "model") {
@@ -164,7 +157,7 @@ async function inferPendingMemoryRecord(plan, ctx) {
                         fromCache = true;
                     },
                 })
-                : await compressMemoryToDerivedMemory(llmRunner, record.effectiveInput, signal, config, (event) => warn(`[akm] LLM fallback for ${event.feature}: ${event.reason}`), inferTelemetry, onRetryAttempt, onNotices);
+                : await compressMemoryToDerivedMemory(llmRunner, record.effectiveInput, signal, inferTelemetry, onRetryAttempt, onNotices);
         }
     }
     catch (error) {
@@ -230,7 +223,6 @@ export async function runMemoryInferencePass(ctx) {
 }
 async function runMemoryInferencePassBody(ctx, provenance) {
     const { config, sources, signal, db, reEnrich, onProgress, options = {} } = ctx;
-    const invocationOwnsRunner = Object.hasOwn(ctx, "llmRunner");
     const compressMemoryToDerivedMemory = options.compressMemoryToDerivedMemory ?? memoryInfer.compressMemoryToDerivedMemory;
     const result = {
         considered: 0,
@@ -248,36 +240,23 @@ async function runMemoryInferencePassBody(ctx, provenance) {
         writtenPaths: [],
     };
     // Mutable sink threaded into compressMemoryToDerivedMemory so the per-call
-    // HTML-error categorization (which is otherwise swallowed inside the feature
-    // gate) bubbles up into the pass result.
+    // HTML-error categorization (which is otherwise logged and dropped as a
+    // skipped memory) bubbles up into the pass result.
     const inferTelemetry = {};
-    const noticesByKey = new Map();
-    const onNotices = (notices) => {
-        for (const notice of notices)
-            noticesByKey.set(JSON.stringify(notice), notice);
-    };
+    const notices = noticeSet();
     const completeResult = () => {
-        if (noticesByKey.size > 0)
-            result.notices = Object.freeze([...noticesByKey.values()]);
+        Object.assign(result, notices.fields());
         // Non-destructive read — the wrapper's `finally` owns closing the journal.
         result.writtenPaths = provenance.writtenPaths();
         return result;
     };
-    // Gate 1 — feature gate via isProcessEnabled, which reads the 0.8.0 path
-    // (selected strategy's processes.memoryInference.enabled). Defaults to
-    // enabled when the key is absent.
-    if (!invocationOwnsRunner && !isProcessEnabled("index", "memory_inference", config))
-        return completeResult();
-    // Gate 2 — per-pass opt-out (#208). Returns the resolved llm config or
-    // `undefined` when the pass should not run.
+    // The one gate — per-pass opt-out (#208): no runner when `index.memory.enabled` is false or nothing is
+    // configured. A caller that owns the runner has decided to run.
     const execution = memoryExecutionForContext(ctx, config);
-    onNotices(execution.notices);
+    notices.add(execution.notices);
     const llmRunner = execution.runner;
     if (!llmRunner)
         return completeResult();
-    const featureConfig = invocationOwnsRunner
-        ? { ...config, index: { ...config.index, memory: { ...config.index?.memory, enabled: true } } }
-        : config;
     // The pass only writes to the default (working) stash, found by its
     // `isDefault` flag and never by array position. Read-only caches (git, npm,
     // website) are deliberately untouched — writing inferred children there
@@ -302,34 +281,26 @@ async function runMemoryInferencePassBody(ctx, provenance) {
     result.considered = pending.length;
     if (pending.length === 0)
         return completeResult();
-    // Classify the whole batch without mutation. Required credentials are
-    // materialized only when at least one record will actually dispatch; this
-    // keeps aborted, existing-child, and validated-cache-only batches available
-    // offline while preserving all-or-nothing preflight for mixed batches.
+    // Classify the whole batch without mutation.
     const plans = pending.map((record) => planPendingMemoryRecord(record, { signal, db, reEnrich }));
-    if (plans.some((plan) => plan.kind === "model"))
-        assertRunnerCredentials(llmRunner);
     let processed = 0;
     const total = pending.length;
     onProgress?.({ processed, total, writtenFacts: 0, noChange: 0, skippedNoFacts: 0 });
     let configFailure;
     const perRecordResults = await concurrentMap(plans, (plan) => inferPendingMemoryRecord(plan, {
-        config,
-        featureConfig,
         signal,
         db,
         reEnrich,
         llmRunner,
         inferTelemetry,
         compressMemoryToDerivedMemory,
-        onNotices,
+        onNotices: notices.add,
         onConfigFailure: (error) => {
             configFailure ??= error;
         },
     }), 
-    // Caller-set connection concurrency or 1: `resolveLlmEngineUse` does
-    // not forward `engines.<name>.concurrency`, so config cannot raise this.
-    runnerLlmConnection(llmRunner)?.concurrency ?? 1);
+    // The connection's own `concurrency` when it sets one, else 1.
+    (llmRunner.kind === "connection" ? llmRunner.concurrency : undefined) ?? 1);
     if (configFailure)
         throw configFailure;
     for (let i = 0; i < perRecordResults.length; i++) {
@@ -652,8 +623,8 @@ function markParentProcessed(parent) {
     // Frontmatter-only rewrite of an existing asset: not a new asset write,
     // so writeAssetToSource isn't a fit here (it would round-trip the body
     // through the asset-spec rendering layer instead of preserving the
-    // user's original markdown bytes verbatim). The narrow exception is
-    // documented in v1 spec §10 step 5 and CLAUDE.md write-source rules.
+    // user's original markdown bytes verbatim). This is the narrow exception
+    // to routing asset writes through writeAssetToSource.
     let raw;
     try {
         raw = fs.readFileSync(parent.filePath, "utf8");

package/dist/indexer/passes/metadata.js

@@ -8,7 +8,7 @@ import { parseFrontmatter } from "../../core/asset/frontmatter.js";
 import { asNonEmptyString } from "../../core/common.js";
 import { isVerbose, warn } from "../../core/warn.js";
 export const SCOPE_KEYS = ["user", "agent", "run", "channel"];
-// ── Quality semantics (v1 spec §4.2) ────────────────────────────────────────
+// ── Quality semantics ───────────────────────────────────────────────────────
 /**
  * Well-known quality values. `generated`, `curated`, and `enriched` are included in
  * default search; `proposed` is excluded by default and opt-in via
@@ -28,7 +28,7 @@ export function normalizeQuality(raw) {
         return raw;
     if (!warnedUnknownQualityValues.has(raw)) {
         warnedUnknownQualityValues.add(raw);
-        warn(`Warning: unknown quality value "${raw}" — entry remains searchable, but consider using "generated", "curated", or "proposed" (v1 spec §4.2).`);
+        warn(`Warning: unknown quality value "${raw}" — entry remains searchable, but consider using "generated", "curated", or "proposed".`);
     }
     return raw;
 }
@@ -41,7 +41,7 @@ export function _resetUnknownQualityWarnings() {
 }
 /**
  * Returns true if an entry's quality marks it as "proposed". Proposed
- * entries are excluded from default search per v1 spec §4.2.
+ * entries are excluded from default search.
  */
 export function isProposedQuality(quality) {
     return quality === "proposed";
@@ -473,7 +473,7 @@ function isWikiRole(value) {
 /**
  * Parse one `verified:` family value into the `IndexDocument.provenance` shape.
  * Accepts OKF v0.2's list form and its documented single-mapping shorthand
- * ("consumers MUST treat a bare mapping as a one-element list", SPEC §5.2).
+ * ("consumers MUST treat a bare mapping as a one-element list", per OKF v0.2).
  * Tolerant: an entry without a usable `by` is dropped individually.
  */
 function parseVerifiedFamily(value) {
@@ -823,7 +823,7 @@ function hasSessionMemoryMarker(fmData, body) {
  * like a top-level `key:` mapping entry. Ordinary prose bracketed by two
  * thematic-break `---` lines fails this test, so a decorative opening
  * callout is treated as the paragraph it is instead of being discarded
- * (review finding on SPEC-8 — the block finder alone accepts ANY content up
+ * (the block finder alone accepts ANY content up
  * to an arbitrarily distant closing `---`).
  */
 function isFrontmatterShaped(lines, block) {

package/dist/indexer/scan/doc-to-entry.js

@@ -52,7 +52,7 @@ export function indexDocumentToStashEntry(doc) {
         // basename the old pipeline stored). Always present on a recognized doc.
         filename: path.basename(doc.path ?? ""),
     };
-    // ── First-class IndexDocument members (spec §3) ──
+    // ── First-class IndexDocument members ──
     if (doc.description !== undefined)
         entry.description = doc.description;
     if (doc.tags !== undefined)

package/dist/indexer/scan/drain-dir.js

@@ -2,16 +2,14 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * Per-directory document drain — akm 0.9.0 Chunk 5, milestone F4a M-core-2 (the
- * engine swap). Replaces the live indexer's per-dir flat-walk matcher-pass
- * `IndexDocument` stream with the `akm` adapter's `recognize` `IndexDocument`
- * stream, reconstructing the durable `IndexDocument` via {@link
- * indexDocumentToStashEntry} (proven lossless by the shadow-parity gate).
+ * Per-directory document drain: turns the `akm` adapter's `recognize`
+ * `IndexDocument` stream into durable entries, reconstructing the durable
+ * `IndexDocument` via {@link indexDocumentToStashEntry}.
  *
  * Two behaviors the adapter fold does NOT carry, restored here at the drain
- * layer (spec §14.2 "drain the full document stream"):
+ * layer:
  *
- *  - **Broken-workflow drop (item 3).** The live path dropped a broken workflow
+ *  - **Broken-workflow drop.** The live path dropped a broken workflow
  *    via the renderer contributor's throw → metadata-pass skip-with-warning; the
  *    `akm` adapter's synchronous `foldRecognizedMetadata` SWALLOWS the parse
  *    error, so a broken workflow would otherwise silently index. We run the
@@ -20,7 +18,7 @@
  *    ({@link buildMetadataSkipWarning}), so the workflow-skip summary counts it.
  *
  * `doc.hash` (= sha256 of the file content) is surfaced per recognized file so
- * the persist layer can populate the `content_hash` column (item 2). It is keyed
+ * the persist layer can populate the `content_hash` column. It is keyed
  * by the file's absolute path rather than by the entry object.
  *
  * Pure of DB/global state; a new leaf (nothing imports it back), so it joins no
@@ -98,7 +96,7 @@ export function drainDirDocuments(adapter, component, fileContexts) {
         const entry = indexDocumentToStashEntry(doc);
         // Workflow docs: drop-with-warning if broken; otherwise cache a lossless
         // runtime projection when the current executor can represent the source.
-        const dropWarning = handleWorkflowDoc(doc, file, component.root);
+        const dropWarning = handleWorkflowDoc(doc, file);
         if (dropWarning !== null) {
             warnings.push(dropWarning);
             if (workflowName !== undefined)
@@ -138,13 +136,13 @@ export function recognizeStashEntries(stashRoot, files) {
  * `Skipped workflow …` drop warning when it is broken, or return `null` when
  * it compiles. Non-workflow docs return `null` immediately.
  */
-function handleWorkflowDoc(doc, file, workspaceRoot) {
+function handleWorkflowDoc(doc, file) {
     if (doc.type !== "workflow" ||
         (doc.adapterId !== "akm" && doc.adapterId !== "akm-workflow") ||
         (docRenderer(doc) !== WORKFLOW_MD_RENDERER && doc.adapterId !== "akm-workflow")) {
         return null;
     }
-    const result = compileWorkflowSource(file.content(), { path: file.relPath, workspaceRoot });
+    const result = compileWorkflowSource(file.content(), { path: file.relPath });
     if (!result.ok)
         return workflowDropWarning(file, result.errors);
     return null;