akm-cli 0.8.7 → 0.8.14

package/dist/commands/{secret.js → env/secret.js}

@@ -24,10 +24,11 @@
  * Values are stored as raw bytes (no quoting, multi-line allowed) so they
  * round-trip byte-exact, unlike env values which forbid literal newlines.
  */
-import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { probeLock, releaseLock, tryAcquireLockSync } from "../core/file-lock";
+import { writeFileAtomic } from "../../core/common.js";
+import { probeLock, releaseLock, tryAcquireLockSync } from "../../core/file-lock.js";
+import { sleepSync } from "../../runtime.js";
 // ── Write-lock helper ─────────────────────────────────────────────────────────
 /**
  * Acquire an exclusive lock for the given secret path, run `fn`, then release.
@@ -50,16 +51,7 @@ export function withSecretLock(secretPath, fn) {
                 : ` Lock file ${lockPath} could not be inspected.`;
             throw new Error(`Could not acquire secret lock for ${secretPath} after 5s.${holderHint} Retry once any other akm secret operation finishes, or remove the stale lock file.`);
         }
-        if (typeof globalThis.Bun?.sleepSync ===
-            "function") {
-            globalThis.Bun.sleepSync(10);
-        }
-        else {
-            let spin = 0;
-            while (spin++ < 100_000) {
-                /* yield */
-            }
-        }
+        sleepSync(10);
     }
     try {
         return fn();
@@ -69,40 +61,6 @@ export function withSecretLock(secretPath, fn) {
     }
 }
 // ── Atomic byte write ──────────────────────────────────────────────────────────
-/**
- * Atomically write `data` to `target` at mode 0600. Unlike `writeFileAtomic`
- * in core/common (string content), this accepts a Buffer so secret bytes
- * round-trip exactly — binary certs and CRLF/LF line endings are preserved.
- */
-function writeSecretAtomic(target, data) {
-    const tmp = `${target}.tmp.${process.pid}.${crypto.randomBytes(8).toString("hex")}`;
-    const fd = fs.openSync(tmp, "w", 0o600);
-    try {
-        fs.writeSync(fd, data);
-        try {
-            fs.fdatasyncSync(fd);
-        }
-        catch {
-            // Best-effort durability; some pseudo-filesystems lack fdatasync.
-        }
-    }
-    finally {
-        fs.closeSync(fd);
-    }
-    fs.renameSync(tmp, target);
-    try {
-        const dirFd = fs.openSync(path.dirname(target), "r");
-        try {
-            fs.fsyncSync(dirFd);
-        }
-        finally {
-            fs.closeSync(dirFd);
-        }
-    }
-    catch {
-        // Directory fsync is unsupported on FAT / some FUSE mounts / Windows.
-    }
-}
 function ensureParentDir(filePath) {
     const dir = path.dirname(filePath);
     if (!fs.existsSync(dir))
@@ -153,7 +111,8 @@ export function readValue(secretPath) {
 export function setSecret(secretPath, value) {
     ensureParentDir(secretPath);
     withSecretLock(secretPath, () => {
-        writeSecretAtomic(secretPath, value);
+        // Mode 0600: secrets must never be world-readable, even transiently.
+        writeFileAtomic(secretPath, value, 0o600);
     });
 }
 /**

package/dist/commands/events.js

@@ -10,10 +10,10 @@
  * text-renderer pipeline as the rest of the CLI (no silent
  * `JSON.stringify` fallback).
  */
-import { parseAssetRef } from "../core/asset-ref";
-import { UsageError } from "../core/errors";
-import { readEvents, tailEvents } from "../core/events";
-import { parseSinceToIso } from "../core/time";
+import { parseAssetRef } from "../core/asset/asset-ref.js";
+import { UsageError } from "../core/errors.js";
+import { readEvents, tailEvents } from "../core/events.js";
+import { parseSinceToIso } from "../core/time.js";
 /**
  * Parse `--since` accepting either a byte-offset cursor (`@offset:<int>`) for
  * cross-process resumption, or a timestamp / epoch-ms (the existing form).

package/dist/commands/feedback-cli.js

@@ -3,19 +3,19 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import fs from "node:fs";
 import { defineCommand } from "citty";
-import { output, parseAllFlagValues, runWithJsonErrors } from "../cli/shared";
-import { parseAssetRef } from "../core/asset-ref";
-import { assembleAsset } from "../core/asset-serialize";
-import { writeFileAtomic } from "../core/common";
-import { FEEDBACK_FAILURE_MODES, loadConfig } from "../core/config";
-import { UsageError } from "../core/errors";
-import { appendEvent } from "../core/events";
-import { parseFrontmatter, parseFrontmatterBlock } from "../core/frontmatter";
-import { warn } from "../core/warn";
-import { applyFeedbackToUtilityScore, closeDatabase, findEntryIdByRef, openExistingDatabase } from "../indexer/db";
-import { ensureIndex } from "../indexer/ensure-index";
-import { resolveSourceEntries } from "../indexer/search-source";
-import { insertUsageEvent } from "../indexer/usage-events";
+import { output, parseAllFlagValues, runWithJsonErrors } from "../cli/shared.js";
+import { parseAssetRef } from "../core/asset/asset-ref.js";
+import { assembleAsset } from "../core/asset/asset-serialize.js";
+import { parseFrontmatter, parseFrontmatterBlock } from "../core/asset/frontmatter.js";
+import { writeFileAtomic } from "../core/common.js";
+import { FEEDBACK_FAILURE_MODES, loadConfig } from "../core/config/config.js";
+import { UsageError } from "../core/errors.js";
+import { appendEvent } from "../core/events.js";
+import { warn } from "../core/warn.js";
+import { applyFeedbackToUtilityScore, closeDatabase, findEntryIdByRef, getEntryFilePathById, openExistingDatabase, } from "../indexer/db/db.js";
+import { ensureIndex } from "../indexer/ensure-index.js";
+import { resolveSourceEntries } from "../indexer/search/search-source.js";
+import { countFeedbackSignals, insertUsageEvent } from "../indexer/usage/usage-events.js";
 // ── Tag validation ────────────────────────────────────────────────────────────
 const TAG_KEY_RE = /^[a-z_][a-z0-9_]*$/;
 const MAX_FEEDBACK_TAGS = 10;
@@ -64,12 +64,12 @@ function appendLessonStrength(type, name, feedbackRef) {
             warn(`[feedback] --applied-to: lesson ${ref} is not in the index.`);
             return null;
         }
-        const row = db.prepare("SELECT file_path FROM entries WHERE id = ?").get(entryId);
-        if (!row?.file_path) {
+        const resolvedPath = getEntryFilePathById(db, entryId);
+        if (!resolvedPath) {
             warn(`[feedback] --applied-to: cannot resolve file path for ${ref}.`);
             return null;
         }
-        filePath = row.file_path;
+        filePath = resolvedPath;
     }
     finally {
         closeDatabase(db);
@@ -136,7 +136,6 @@ export const feedbackCommand = defineCommand({
             type: "string",
             description: "Reason for the feedback (required for negative feedback by default; used by distillation)",
         },
-        note: { type: "string", description: "Alias for --reason (backward-compatible, prefer --reason)" },
         "failure-mode": {
             type: "string",
             description: `Structured failure-mode taxonomy for negative feedback (F-3 / #384). ` +
@@ -168,14 +167,7 @@ export const feedbackCommand = defineCommand({
                 throw new UsageError("Specify --positive or --negative.");
             }
             const signal = args.positive ? "positive" : "negative";
-            // `--note` is a deprecated back-compat alias for `--reason` (removed in
-            // 0.9.0). Warn on stderr when it is used as the sole source (i.e. without
-            // an explicit `--reason`). Warnings go to stderr only so JSON stdout
-            // consumers are unaffected.
-            if (args.note !== undefined && args.reason === undefined) {
-                warn("warning: '--note' is deprecated for 'akm feedback'; use '--reason'. Removed in 0.9.0.");
-            }
-            const reason = args.reason ?? args.note;
+            const reason = args.reason;
             // F-3 / #384: Validate --failure-mode against the curated enum.
             const failureMode = args["failure-mode"]?.trim() || undefined;
             if (failureMode) {
@@ -242,15 +234,7 @@ export const feedbackCommand = defineCommand({
                 // usage_events so the delta reflects the entire signal history.
                 // Uses MemRL bounded-step EMA (F-5 / #386, arXiv:2601.03192).
                 try {
-                    const counts = db
-                        .prepare(`SELECT
-                 SUM(CASE WHEN signal = 'positive' THEN 1 ELSE 0 END) AS pos,
-                 SUM(CASE WHEN signal = 'negative' THEN 1 ELSE 0 END) AS neg
-               FROM usage_events
-               WHERE event_type = 'feedback' AND entry_id = ?`)
-                        .get(entryId);
-                    const pos = counts?.pos ?? 0;
-                    const neg = counts?.neg ?? 0;
+                    const { pos, neg } = countFeedbackSignals(db, entryId);
                     utilityResult = applyFeedbackToUtilityScore(db, entryId, pos, neg);
                 }
                 catch {

package/dist/commands/graph/graph-cli.js

@@ -0,0 +1,132 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * `akm graph` command family. Extracted verbatim from src/cli.ts (WS6) so the
+ * God Module shrinks; the `main.subCommands.graph` key and every subcommand's
+ * args/output shape are byte-identical. Each handler is migrated to
+ * `defineJsonCommand`, which wraps the body in `runWithJsonErrors` and emits the
+ * same JSON envelope (stdout/stderr/exit-code) as the inline `runWithJsonErrors`
+ * form it replaces.
+ */
+import { defineCommand } from "citty";
+import { hasSubcommand, parsePositiveIntFlag } from "../../cli/parse-args.js";
+import { defineJsonCommand, output, runWithJsonErrors } from "../../cli/shared.js";
+import { akmGraphEntities, akmGraphEntity, akmGraphExport, akmGraphOrphans, akmGraphRelated, akmGraphRelations, akmGraphSummary, akmGraphUpdate, } from "./graph.js";
+// Single source of truth: the routing set is derived from the subCommands keys
+// (M10) so adding a subcommand can never silently desync from `hasSubcommand`.
+const graphSubCommands = {
+    summary: defineJsonCommand({
+        meta: { name: "summary", description: "Show entity-graph counts and quality telemetry" },
+        args: {
+            source: { type: "string", description: "Source name/path (default: primary stash source)" },
+        },
+        run({ args }) {
+            output("graph-summary", akmGraphSummary({ source: args.source }));
+        },
+    }),
+    entities: defineJsonCommand({
+        meta: { name: "entities", description: "List entities with per-file occurrence counts" },
+        args: {
+            source: { type: "string", description: "Source name/path (default: primary stash source)" },
+            limit: { type: "string", description: "Maximum entities to return" },
+        },
+        run({ args }) {
+            output("graph-entities", akmGraphEntities({ source: args.source, limit: parsePositiveIntFlag(args.limit ?? undefined) }));
+        },
+    }),
+    relations: defineJsonCommand({
+        meta: { name: "relations", description: "List relations with occurrence counts" },
+        args: {
+            source: { type: "string", description: "Source name/path (default: primary stash source)" },
+            limit: { type: "string", description: "Maximum relations to return" },
+        },
+        run({ args }) {
+            output("graph-relations", akmGraphRelations({ source: args.source, limit: parsePositiveIntFlag(args.limit ?? undefined) }));
+        },
+    }),
+    related: defineJsonCommand({
+        meta: { name: "related", description: "Show graph-related neighboring assets for a ref" },
+        args: {
+            ref: { type: "positional", description: "Asset ref", required: true },
+            source: { type: "string", description: "Source name/path (default: primary stash source)" },
+            limit: { type: "string", description: "Maximum related assets to return" },
+        },
+        async run({ args }) {
+            output("graph-related", await akmGraphRelated({
+                ref: args.ref ?? "",
+                source: args.source,
+                limit: parsePositiveIntFlag(args.limit ?? undefined),
+            }));
+        },
+    }),
+    entity: defineJsonCommand({
+        meta: { name: "entity", description: "List assets that contain the given entity" },
+        args: {
+            name: { type: "positional", description: "Entity name", required: true },
+            source: { type: "string", description: "Source name/path (default: primary stash source)" },
+            limit: { type: "string", description: "Maximum matches to return" },
+        },
+        run({ args }) {
+            output("graph-entity", akmGraphEntity({
+                name: args.name ?? "",
+                source: args.source,
+                limit: parsePositiveIntFlag(args.limit ?? undefined),
+            }));
+        },
+    }),
+    orphans: defineJsonCommand({
+        meta: { name: "orphans", description: "List assets with no extracted graph entities" },
+        args: {
+            source: { type: "string", description: "Source name/path (default: primary stash source)" },
+            limit: { type: "string", description: "Maximum orphans to return" },
+        },
+        run({ args }) {
+            output("graph-orphans", akmGraphOrphans({ source: args.source, limit: parsePositiveIntFlag(args.limit ?? undefined) }));
+        },
+    }),
+    export: defineJsonCommand({
+        meta: { name: "export", description: "Export graph artifact as JSON or JSONL" },
+        args: {
+            source: { type: "string", description: "Source name/path (default: primary stash source)" },
+            out: { type: "string", description: "Output path" },
+            format: { type: "string", description: "Export format (json|jsonl)", default: "json" },
+        },
+        run({ args }) {
+            output("graph-export", akmGraphExport({
+                source: args.source,
+                out: args.out ?? "",
+                format: args.format,
+            }));
+        },
+    }),
+    update: defineJsonCommand({
+        meta: { name: "update", description: "Re-run graph extraction, optionally scoped to specific asset refs" },
+        args: {
+            refs: {
+                type: "positional",
+                description: "Zero or more asset refs to scope extraction (omit for a full re-extract)",
+                required: false,
+                default: "",
+            },
+            source: { type: "string", description: "Source name/path (default: primary stash source)" },
+        },
+        async run({ args }) {
+            // `refs` is a single positional; collect remaining argv tokens as well.
+            const rawRefs = [args.refs, ...(Array.isArray(args._) ? args._ : [])].filter((r) => typeof r === "string" && r.trim().length > 0);
+            output("graph-update", await akmGraphUpdate({ refs: rawRefs.length > 0 ? rawRefs : undefined, source: args.source }));
+        },
+    }),
+};
+const GRAPH_SUBCOMMAND_SET = new Set(Object.keys(graphSubCommands));
+export const graphCommand = defineCommand({
+    meta: { name: "graph", description: "Inspect the indexed entity graph stored in SQLite" },
+    subCommands: graphSubCommands,
+    run({ args }) {
+        return runWithJsonErrors(() => {
+            if (hasSubcommand(args, GRAPH_SUBCOMMAND_SET))
+                return;
+            output("graph-summary", akmGraphSummary());
+        });
+    },
+});

package/dist/commands/{graph.js → graph/graph.js}

@@ -3,18 +3,18 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import fs from "node:fs";
 import path from "node:path";
-import { parseAssetRef } from "../core/asset-ref";
-import { loadConfig } from "../core/config";
-import { NotFoundError, UsageError } from "../core/errors";
-import { getDbPath } from "../core/paths";
-import { warn } from "../core/warn";
-import { closeDatabase, findEntryIdByRef, getEntryById, openDatabase, openExistingDatabase } from "../indexer/db";
-import { listRelatedPathsForFile } from "../indexer/graph-boost";
-import { loadStoredGraphSnapshot } from "../indexer/graph-db";
-import { runGraphExtractionPass } from "../indexer/graph-extraction";
-import { lookup } from "../indexer/indexer";
-import { resolveAssetPath } from "../indexer/path-resolver";
-import { findSourceForPath, resolveSourceEntries } from "../indexer/search-source";
+import { parseAssetRef } from "../../core/asset/asset-ref.js";
+import { loadConfig } from "../../core/config/config.js";
+import { NotFoundError, UsageError } from "../../core/errors.js";
+import { getDbPath } from "../../core/paths.js";
+import { warn } from "../../core/warn.js";
+import { closeDatabase, findEntryIdByRef, getEntryById, getEntryRefRowsForStashRoot, openDatabase, openExistingDatabase, } from "../../indexer/db/db.js";
+import { loadStoredGraphSnapshot } from "../../indexer/db/graph-db.js";
+import { listRelatedPathsForFile } from "../../indexer/graph/graph-boost.js";
+import { runGraphExtractionPass } from "../../indexer/graph/graph-extraction.js";
+import { lookup } from "../../indexer/indexer.js";
+import { findSourceForPath, resolveSourceEntries } from "../../indexer/search/search-source.js";
+import { resolveAssetPath } from "../../indexer/walk/path-resolver.js";
 function resolveGraphStashPath(source) {
     const sources = resolveSourceEntries(undefined, loadConfig());
     if (sources.length === 0) {
@@ -243,9 +243,7 @@ function normalizeGraphName(value) {
     return value.trim().toLowerCase();
 }
 function buildRefByPath(stashRoot, db) {
-    const rows = db
-        .prepare("SELECT file_path, entry_json FROM entries WHERE stash_dir = ? OR file_path LIKE ?")
-        .all(stashRoot, `${stashRoot}%`);
+    const rows = getEntryRefRowsForStashRoot(db, stashRoot);
     const map = new Map();
     for (const row of rows) {
         if (map.has(row.file_path))
@@ -432,7 +430,15 @@ export async function akmGraphUpdate(options) {
             const file = path.basename(event.currentPath);
             warn(`[graph] extracting ${event.processed}/${event.total} ${file}`);
         };
-        const result = await extractionFn(config, sources, undefined, db, false, onProgress, passOptions);
+        const result = await extractionFn({
+            config,
+            sources,
+            signal: undefined,
+            db,
+            reEnrich: false,
+            onProgress,
+            options: passOptions,
+        });
         const durationMs = Date.now() - startMs;
         return {
             shape: "graph-update",

package/dist/commands/health/checks.js

@@ -0,0 +1,279 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { spawnSync } from "node:child_process";
+import { loadConfig } from "../../core/config/config.js";
+import { detectAgentCliProfiles, requireAgentProfile } from "../../integrations/agent/index.js";
+const ACTIVE_RUN_WARN_MS = 15 * 60 * 1000;
+/**
+ * Probe the configured agent profile. Self-contained (reads config + PATH); the
+ * only check that performs IO at dispatch time, preserving the original inline
+ * `runAgentProbe()` call site behaviour exactly.
+ */
+export function runAgentProbe() {
+    const config = loadConfig();
+    // v2: check profiles.agent first
+    if (config.profiles?.agent) {
+        const defaultName = config.defaults?.agent;
+        const profileCount = Object.keys(config.profiles.agent).length;
+        if (profileCount === 0) {
+            return {
+                name: "agent-profile",
+                kind: "deterministic",
+                status: "unknown",
+                confidence: "high",
+                message: "No agent profiles configured in profiles.agent.",
+            };
+        }
+        const profileName = defaultName ?? Object.keys(config.profiles.agent)[0];
+        const profile = config.profiles.agent[profileName];
+        return {
+            name: "agent-profile",
+            kind: "deterministic",
+            status: "pass",
+            confidence: "high",
+            message: `v2 agent profile "${profileName}" configured (platform: ${profile?.platform ?? "unknown"}).`,
+            evidence: { profile: profileName, platform: profile?.platform, profileCount },
+        };
+    }
+    if (!config.profiles?.agent && !config.defaults?.agent) {
+        return {
+            name: "agent-profile",
+            kind: "deterministic",
+            status: "unknown",
+            confidence: "high",
+            message: "No agent config present.",
+        };
+    }
+    let profile;
+    try {
+        profile = requireAgentProfile(config);
+    }
+    catch (error) {
+        return {
+            name: "agent-profile",
+            kind: "deterministic",
+            status: "warn",
+            confidence: "high",
+            message: error instanceof Error ? error.message : String(error),
+        };
+    }
+    if (profile.sdkMode === true) {
+        return {
+            name: "agent-profile",
+            kind: "deterministic",
+            status: profile.model ? "pass" : "warn",
+            confidence: "high",
+            message: profile.model
+                ? `SDK mode profile "${profile.name}" is configured.`
+                : `SDK mode profile "${profile.name}" has no explicit model.`,
+            evidence: { profile: profile.name, sdkMode: true, model: profile.model ?? null },
+        };
+    }
+    const detections = detectAgentCliProfiles(config);
+    const detection = detections.find((entry) => entry.name === profile.name);
+    if (!detection?.available) {
+        return {
+            name: "agent-profile",
+            kind: "deterministic",
+            status: "fail",
+            confidence: "high",
+            message: `Default agent profile "${profile.name}" is not available on PATH.`,
+            evidence: { profile: profile.name, bin: profile.bin },
+        };
+    }
+    const version = spawnSync(profile.bin, ["--version"], { encoding: "utf8", timeout: 5_000 });
+    if ((version.status ?? 1) !== 0) {
+        return {
+            name: "agent-profile",
+            kind: "deterministic",
+            status: "warn",
+            confidence: "medium",
+            message: `Agent binary "${profile.bin}" was found but \`--version\` failed.`,
+            evidence: {
+                profile: profile.name,
+                bin: profile.bin,
+                exitCode: version.status ?? null,
+                stderr: (version.stderr ?? "").trim(),
+            },
+        };
+    }
+    return {
+        name: "agent-profile",
+        kind: "deterministic",
+        status: "pass",
+        confidence: "high",
+        message: `Agent profile "${profile.name}" is available.`,
+        evidence: { profile: profile.name, bin: profile.bin, version: (version.stdout ?? "").trim() },
+    };
+}
+/**
+ * The ordered health-check registry. ORDER IS LOAD-BEARING: `akmHealth`
+ * iterates this array and appends to hardChecks/advisories in sequence, so the
+ * declaration order below is exactly the emission order (hard checks first in
+ * their array, advisories in theirs). Each `run` is a verbatim copy of the
+ * corresponding former inline block.
+ */
+export const HEALTH_CHECKS = [
+    {
+        name: "state-db-schema",
+        channel: "hard",
+        run: (ctx) => ({
+            name: "state-db-schema",
+            kind: "deterministic",
+            status: ctx.missingTables.length === 0 ? "pass" : "fail",
+            confidence: "high",
+            message: ctx.missingTables.length === 0
+                ? "state.db opened and required tables are present."
+                : `state.db is missing required tables: ${ctx.missingTables.join(", ")}`,
+            evidence: { path: ctx.stateDbPath, tables: ctx.tableNames },
+        }),
+    },
+    {
+        name: "state-db-round-trip",
+        channel: "hard",
+        run: (ctx) => ({
+            name: "state-db-round-trip",
+            kind: "deterministic",
+            status: ctx.probe.ok ? "pass" : "fail",
+            confidence: "high",
+            message: ctx.probe.ok
+                ? "state.db append/read round-trip succeeded."
+                : `state.db round-trip failed: ${ctx.probe.error}`,
+            evidence: { path: ctx.stateDbPath, durationMs: ctx.probe.durationMs },
+        }),
+    },
+    {
+        name: "task-history-read",
+        channel: "hard",
+        run: (ctx) => ({
+            name: "task-history-read",
+            kind: "deterministic",
+            status: "pass",
+            confidence: "high",
+            message: `Read ${ctx.taskRowCount} task-history row(s) since ${ctx.since}.`,
+            evidence: { rows: ctx.taskRowCount, since: ctx.since },
+        }),
+    },
+    {
+        name: "task-log-backing",
+        channel: "hard",
+        run: (ctx) => ({
+            name: "task-log-backing",
+            kind: "deterministic",
+            status: ctx.logBackingRate === 1 ? "pass" : "fail",
+            confidence: "high",
+            message: ctx.logBackingRate === 1
+                ? "Every task_history log_path resolved on disk."
+                : `${ctx.taskRowsWithLogsCount - ctx.existingLogRowsCount} task log(s) referenced in task_history are missing.`,
+            evidence: { totalWithLogs: ctx.taskRowsWithLogsCount, existingLogs: ctx.existingLogRowsCount },
+        }),
+    },
+    {
+        name: "active-runs",
+        channel: "hard",
+        run: (ctx) => ({
+            name: "active-runs",
+            kind: "deterministic",
+            status: ctx.stuckActiveRuns === 0 ? "pass" : "warn",
+            confidence: "high",
+            message: ctx.stuckActiveRuns === 0
+                ? "No active task runs exceeded the stale threshold."
+                : `${ctx.stuckActiveRuns} active task run(s) are older than ${Math.round(ACTIVE_RUN_WARN_MS / 60000)} minutes.`,
+            evidence: { stuckActiveRuns: ctx.stuckActiveRuns },
+        }),
+    },
+    {
+        name: "agent-profile",
+        channel: "hard",
+        run: () => runAgentProbe(),
+    },
+    {
+        name: "semantic-search-runtime",
+        channel: "advisory",
+        run: (ctx) => ({
+            name: "semantic-search-runtime",
+            kind: "deterministic",
+            status: !ctx.semanticStatus ||
+                ctx.semanticStatus.status === "pending" ||
+                ctx.semanticStatus.status === "ready-js" ||
+                ctx.semanticStatus.status === "ready-vec"
+                ? "pass"
+                : "warn",
+            confidence: "medium",
+            message: ctx.semanticStatus
+                ? `Semantic search status: ${ctx.semanticStatus.status}`
+                : "No semantic-search runtime status recorded yet.",
+            evidence: ctx.semanticStatus ? { ...ctx.semanticStatus } : undefined,
+        }),
+    },
+    {
+        // session-log-failures: demoted to informational — the ERROR_PATTERNS regex
+        // scans pre-LLM session text and produces false positives on diagnostic
+        // conversation. It does not gate the real extraction pipeline (akmExtract).
+        // Never triggers warn; kept for backward-compat visibility only.
+        name: "session-log-failures",
+        channel: "advisory",
+        run: (ctx) => ({
+            name: "session-log-failures",
+            kind: "heuristic",
+            status: "pass",
+            confidence: "low",
+            message: ctx.sessionLogEntries.length === 0
+                ? "No repeated external session-log failure patterns were detected."
+                : `${ctx.sessionLogEntries.length} raw session-log keyword match(es) detected (pre-LLM, informational only).`,
+            evidence: { candidates: ctx.sessionLogEntries.slice(0, 5) },
+        }),
+    },
+    {
+        name: "session-extraction",
+        channel: "advisory",
+        run: (ctx) => {
+            const sx = ctx.sessionExtraction;
+            const sxWarnReasons = [];
+            if (sx.warnings > 0)
+                sxWarnReasons.push(`${sx.warnings} harness error(s)`);
+            if (sx.ran && sx.sessionsScanned >= 5 && sx.proposalsCreated === 0)
+                sxWarnReasons.push("no proposals generated across scanned sessions");
+            return {
+                name: "session-extraction",
+                kind: "heuristic",
+                status: sxWarnReasons.length > 0 ? "warn" : "pass",
+                confidence: sx.ran ? "medium" : "low",
+                message: sx.ran
+                    ? sxWarnReasons.length > 0
+                        ? `Session extraction degraded: ${sxWarnReasons.join("; ")}.`
+                        : `Session extraction healthy: ${sx.sessionsScanned} scanned, ${sx.sessionsExtracted} extracted, ${sx.proposalsCreated} proposal(s) created.`
+                    : "Session extraction not active (feature disabled or no harness available).",
+                evidence: {
+                    ran: sx.ran,
+                    sessionsScanned: sx.sessionsScanned,
+                    sessionsExtracted: sx.sessionsExtracted,
+                    sessionsSkipped: sx.sessionsSkipped,
+                    proposalsCreated: sx.proposalsCreated,
+                    warnings: sx.warnings,
+                    durationMs: sx.durationMs,
+                },
+            };
+        },
+    },
+    {
+        name: "auto-accept-validation",
+        channel: "advisory",
+        run: (ctx) => {
+            const aa = ctx.autoAccept;
+            return {
+                name: "auto-accept-validation",
+                kind: "heuristic",
+                status: aa.validationFailed > 0 ? "warn" : "pass",
+                confidence: aa.promoted + aa.validationFailed > 0 ? "high" : "low",
+                message: aa.validationFailed > 0
+                    ? `${aa.validationFailed} proposal(s) passed confidence threshold but failed auto-accept validation (truncated description, invalid frontmatter, etc.) — they remain in the queue for manual review.`
+                    : aa.promoted > 0
+                        ? `Auto-accept healthy: ${aa.promoted} proposal(s) promoted, 0 validation failures.`
+                        : "Auto-accept gate did not run (disabled or no proposals above threshold).",
+                evidence: { promoted: aa.promoted, validationFailed: aa.validationFailed },
+            };
+        },
+    },
+];