akm-cli 0.9.0-beta.9 → 0.9.0-rc.1

package/dist/core/config/config-schema.js

@@ -22,8 +22,14 @@
  * - Two exceptions (hard-rejected): openviking source type and legacy
  *   `stashes[]` key. Both have explicit migration paths; silently dropping
  *   would mask user data loss.
- * - `.strict()` walls still gate `registries[]`, `sources[]`, `profiles.*`
- *   sub-shapes so typos in those structured records are caught (#462).
+ * - UNKNOWN-KEY POLICY: object schemas use passthrough (unknown keys are
+ *   preserved and ignored, NOT rejected). akm runs across multiple installed
+ *   versions sharing one config.json; a newer version writes keys an older
+ *   version's schema doesn't know yet, so hard-rejecting unknown keys turned
+ *   benign version skew into `INVALID_CONFIG_FILE` failures. Known keys are
+ *   still type-checked; passthrough preserves unknown keys across a
+ *   load→save round trip so an older reader never strips a newer writer's
+ *   settings. (Replaced the prior strict-mode object walls.)
  * - `defaultWriteTarget` resolution and similar cross-field invariants are
  *   enforced at save time via `superRefine` on the top-level schema.
  */
@@ -43,14 +49,27 @@ const nonEmptyString = z
 const httpUrl = z.string().refine((v) => v.startsWith("http://") || v.startsWith("https://"), {
     message: "endpoint must start with http:// or https://",
 });
-// ── Feedback failure modes ──────────────────────────────────────────────────
-export const FEEDBACK_FAILURE_MODES = ["incorrect", "outdated", "dangerous", "incomplete", "redundant"];
+// ── Feedback failure modes (F-3 / #384) ─────────────────────────────────────
+/**
+ * Curated taxonomy of failure modes for negative feedback.
+ *
+ * Structured failure modes enable aggregation across feedback events so the
+ * distill pipeline can detect that "5 assets failed for the same reason" and
+ * act on it — free-text strings about the same issue are not aggregatable.
+ */
+export const FEEDBACK_FAILURE_MODES = [
+    "incorrect", // Factually wrong or logically flawed content
+    "outdated", // Correct at some point but now stale
+    "dangerous", // Could cause harm if followed (security, safety)
+    "incomplete", // Missing key steps, context, or caveats
+    "redundant", // Duplicates another asset without adding value
+];
 // ── Connection configs (LLM / embedding) ────────────────────────────────────
 const LlmCapabilitiesSchema = z
     .object({
     structuredOutput: z.boolean().optional(),
 })
-    .strict();
+    .passthrough();
 /**
  * Connection config used for both top-level `llm` (after migration) and
  * `profiles.llm[*]`. `model` is required at schema level — partial entries
@@ -75,15 +94,15 @@ export const LlmConnectionConfigSchema = z
     judgeModel: z.string().min(1).optional(),
     enableThinking: z.boolean().optional(),
 })
-    .strict();
+    .passthrough();
 export const LlmProfileConfigSchema = LlmConnectionConfigSchema.extend({
     supportsJsonSchema: z.boolean().optional(),
-}).strict();
+}).passthrough();
 const EmbeddingOllamaOptionsSchema = z
     .object({
     num_ctx: positiveInt.optional(),
 })
-    .strict();
+    .passthrough();
 /**
  * Embedding connection config. Both `endpoint` and `model` are optional:
  *   - Remote: provide `endpoint` (http/https URL) + `model`.
@@ -107,7 +126,7 @@ export const EmbeddingConnectionConfigSchema = z
     contextLength: positiveInt.optional(),
     ollamaOptions: EmbeddingOllamaOptionsSchema.optional(),
 })
-    .strict();
+    .passthrough();
 // ── Agent profiles ──────────────────────────────────────────────────────────
 // Derives from the canonical VALID_HARNESS_IDS (#565) so the Zod gate cannot
 // drift from the TS union / parse check / setup detection.
@@ -119,8 +138,17 @@ export const AgentProfileConfigSchema = z
     args: z.array(z.string()).optional(),
     workspace: z.string().min(1).optional(),
     model: z.string().min(1).optional(),
+    // Per-call timeout (ms) used when a command does not pass an explicit
+    // timeout (e.g. `akm wiki ingest` without `--timeout-ms`). null = no
+    // timeout. Honored by resolveAgentProfile (integrations/agent/config.ts).
+    timeoutMs: z.union([positiveInt, z.null()]).optional(),
+    // Per-profile model aliases: lowercase alias → exact model string for
+    // this profile's CLI. Highest-precedence tier in resolveModel
+    // (integrations/agent/model-aliases.ts) — beats the config-root
+    // `modelAliases` table and the built-in opus/sonnet/haiku entries.
+    modelAliases: z.record(z.string().min(1), z.string().min(1)).optional(),
 })
-    .strict();
+    .passthrough();
 // ── Improve profile / process ──────────────────────────────────────────────
 export const ImproveProcessConfigSchema = z
     .object({
@@ -133,8 +161,39 @@ export const ImproveProcessConfigSchema = z
     // consolidation pass skips entirely (emits `pool_below_min_size`). 0 disables
     // the guard. Only meaningful on the `consolidate` process. Default 500.
     minPoolSize: z.number().int().min(0).optional(),
-    qualityGate: z.object({ enabled: z.boolean().optional() }).strict().optional(),
-    contradictionDetection: z.object({ enabled: z.boolean().optional() }).strict().optional(),
+    // Consolidate process: deterministic near-duplicate dedup pre-pass (#617).
+    // A cheap, no-LLM fast path that collapses obvious duplicates (`.derived`
+    // origin pairs + content twins) before the LLM consolidation. Default OFF
+    // — when absent the consolidate pass behaves byte-identically to today.
+    // `cosineThreshold` is a strict floor in [0, 1] (default 0.97) for the
+    // optional embedding-similarity match; exact normalized content-hash
+    // equality always collapses regardless of the threshold. Only meaningful
+    // on the `consolidate` process.
+    dedup: z
+        .object({
+        enabled: z.boolean().optional(),
+        cosineThreshold: z.number().min(0).max(1).optional(),
+        // WS-3a: maximum pool size for the O(n²) cosine-similarity twin compare.
+        // Only the first `cosineCandidateLimit` memories are cosine-compared;
+        // exact-hash matches still run over the full pool. Default 500. Raise
+        // with care — cost is O(n²).
+        cosineCandidateLimit: z.number().int().positive().optional(),
+    })
+        .passthrough()
+        .optional(),
+    // Consolidate process: judged-state cache (#581). When enabled, a memory
+    // whose current content hash equals its cached judged hash is SKIPPED from
+    // the LLM pool (judged-unchanged → no re-judge), letting one run sweep the
+    // whole corpus at O(changed/new) cost instead of narrowing to a recent
+    // time-window slice. Default OFF — when absent the consolidate pass behaves
+    // byte-identically to today (the incrementalSince path is unaffected). Only
+    // meaningful on the `consolidate` process.
+    judgedCache: z.object({ enabled: z.boolean().optional() }).passthrough().optional(),
+    // Distill process: LLM-as-judge lesson quality gate. Default ON (R3);
+    // fail-open — judge failure/timeout/parse errors pass through. Set
+    // `enabled: false` on the distill process to opt out.
+    qualityGate: z.object({ enabled: z.boolean().optional() }).passthrough().optional(),
+    contradictionDetection: z.object({ enabled: z.boolean().optional() }).passthrough().optional(),
     // Extract process config (only meaningful for extract process)
     defaultSince: z.string().min(1).optional(),
     maxTotalChars: positiveInt.optional(),
@@ -162,9 +221,28 @@ export const ImproveProcessConfigSchema = z
     // proactiveMaintenance process: top-N bound per run (default 25). Alias for
     // `limit`; `maxPerRun` wins when both are set.
     maxPerRun: positiveInt.optional(),
-    // proactiveMaintenance process: optional per-type importance overrides,
-    // merged over the built-in defaults. Only meaningful on `proactiveMaintenance`.
-    importanceWeights: z.record(z.string().min(1), z.number()).optional(),
+    // graphExtraction process (#624 P2): when set, rank eligible files by
+    // utility_scores DESC and process only the top-N per run (incremental
+    // high-signal-first sweep). Unset = process all eligible (current
+    // behavior). Only meaningful on `graphExtraction`.
+    topN: positiveInt.optional(),
+    // graphExtraction process: full-corpus scan. When true, graph extraction
+    // runs on ALL stash files instead of only files touched by actionable refs
+    // in the current run. Used by the `graph-refresh` built-in profile / a
+    // scheduled weekly task. Only meaningful on `graphExtraction`.
+    fullScan: z.boolean().optional(),
+    // #626 — extract process: pre-LLM heuristic triage gate. When enabled, a
+    // deterministic scorer decides BEFORE the extraction LLM call whether a
+    // session carries enough signal to be worth extracting; low-signal sessions
+    // are skipped at zero LLM cost. Default OFF. Only meaningful on `extract`.
+    // `minScore` is the minimum total heuristic score to PASS (default 2).
+    triage: z
+        .object({
+        enabled: z.boolean().optional(),
+        minScore: z.number().min(0).optional(),
+    })
+        .passthrough()
+        .optional(),
     // MemoryInference process: minimum pending memory count to run the pass.
     minPendingCount: z.number().int().min(0).optional(),
     // Extract process: minimum number of new (unseen, in-window) candidate
@@ -173,12 +251,146 @@ export const ImproveProcessConfigSchema = z
     // disables the guard. Only meaningful on the `extract` process. Default 0
     // (disabled) so existing behaviour is preserved; only opted-in profiles set it.
     minNewSessions: z.number().int().min(0).optional(),
+    // Extract process: cap on NEW sessions processed (LLM-called) per run; the
+    // rest roll to the next run (still unseen). 0 disables. Absent = default 25.
+    maxSessionsPerRun: z.number().int().min(0).optional(),
     // #561 — index agent sessions as a searchable `session` asset (extract
     // process). Absent = on-when-an-LLM-is-available (fail-open when offline).
+    // COST: when on, each processed session makes a SECOND LLM call (the session
+    // summary) on top of the extraction call — i.e. ~2 LLM calls/session. Set to
+    // false to halve per-session extract cost at the price of unsearchable
+    // sessions. (Unchanged/skip sessions still cost zero — the content-hash
+    // ledger gates both calls upstream.)
     indexSessions: z.boolean().optional(),
     // #561 — minimum session duration in minutes for session indexing. 0
     // disables the gate. Absent = default 5. Only meaningful on `extract`.
     minSessionDuration: z.number().min(0).optional(),
+    // Consolidate process: fallback p90 wall-clock time per consolidation chunk
+    // in seconds, used for cold-start budget estimation when no telemetry
+    // history exists. The actual p90 is derived from observed run durations
+    // once sufficient history accumulates; this value is only used on the very
+    // first run. Default 30 s. Only meaningful on the `consolidate` process.
+    p90ChunkSecondsDefault: z.number().finite().positive().optional(),
+    // (WS-3b step 0a `homeostaticDemotion` was removed — R4. The key is
+    // tolerated via passthrough if an old config still carries it; continuous
+    // decay is now part of the always-applied salience recency term.)
+    // WS-3b: Schema-similarity gate (step 0b). At intake, if a new candidate's
+    // body embedding is within epsilon of an existing derived-layer lesson/knowledge
+    // node, mark it schema-consistent and lower its priority. Default ON for
+    // the `extract` process since R3 (fail-open; set `enabled: false` to opt out).
+    // Only meaningful on the `consolidate` and `extract` processes.
+    schemaSimilarity: z
+        .object({
+        enabled: z.boolean().optional(),
+        // Epsilon: cosine similarity threshold above which a candidate is schema-consistent
+        // (default 0.85 — looser than dedup's 0.97 since we want to catch conceptual overlap).
+        epsilon: z.number().min(0).max(1).optional(),
+        // Multiplicative factor applied to candidate confidence when schema-consistent.
+        // Default 0.5 — halves the confidence so schema-consistent candidates are less likely
+        // to pass the quality gate and create redundant stash entries.
+        confidencePenalty: z.number().min(0).max(1).optional(),
+    })
+        .passthrough()
+        .optional(),
+    // WS-3b: Hot-probation intake buffer (step 0c, #604). New system-generated
+    // extractions enter captureMode: hot-probation and spend ONE consolidation
+    // cycle in probation. Dedup + quality second-pass runs before promotion.
+    // Default OFF. Only meaningful on the `extract` process.
+    hotProbation: z
+        .object({
+        enabled: z.boolean().optional(),
+    })
+        .passthrough()
+        .optional(),
+    // WS-3b: Anti-collapse guards (step 8). Prevents the consolidation pipeline
+    // from collapsing too aggressively and losing diversity.
+    //   - maxGeneration: refuse to merge two assets both above this generation (default 2).
+    //   - lexicalDiversityCheck: low n-gram diversity ⇒ raise merge threshold.
+    //   - randomClusterFraction: occasional random (non-similar) cluster in pool (default 0.05).
+    //   - mergeInformationFloor: measure that merges keep provenance + specificity
+    //     (R5 §4.2; ADVISORY in v1 — counted, never refused).
+    //   - minSpecificityRetention: distinct-token retention floor for merges (default 0.6).
+    // Default ON since R5 (opt out via enabled: false). Only meaningful on the
+    // `consolidate` process.
+    antiCollapse: z
+        .object({
+        enabled: z.boolean().optional(),
+        maxGeneration: z.number().int().min(1).optional(),
+        lexicalDiversityCheck: z.boolean().optional(),
+        randomClusterFraction: z.number().min(0).max(1).optional(),
+        mergeInformationFloor: z.boolean().optional(),
+        minSpecificityRetention: z.number().min(0).max(1).optional(),
+    })
+        .passthrough()
+        .optional(),
+    // WS-3b: CLS (Complementary Learning System) interleaving (step 9).
+    // distill/memoryInference prompts include embedding-retrieved existing adjacent
+    // lessons/knowledge to prevent catastrophic interference with prior generalizations.
+    // Default OFF. Only meaningful on `distill` and `memoryInference` processes.
+    cls: z
+        .object({
+        enabled: z.boolean().optional(),
+        // Number of adjacent lessons/knowledge to include in prompts (default 3).
+        adjacentCount: z.number().int().min(1).optional(),
+    })
+        .passthrough()
+        .optional(),
+    // WS-3b: Distill→source fidelity check (step 10). After a distill proposal,
+    // check it against its cited source memories; a contradiction flag forces
+    // human review. Default OFF. Only meaningful on `distill` process.
+    fidelityCheck: z
+        .object({
+        enabled: z.boolean().optional(),
+    })
+        .passthrough()
+        .optional(),
+    // #609 — recombine process: minimum related-memory cluster size before an
+    // LLM generalization call. Default 3. Only meaningful on `recombine`.
+    minClusterSize: z.number().int().min(2).optional(),
+    // #609 — recombine process: hard cap on clusters processed per run (one
+    // bounded LLM call each). Default 5. Only meaningful on `recombine`.
+    maxClustersPerRun: positiveInt.optional(),
+    // #632 — recombine process: max members a cluster may contain before it is
+    // SKIPPED (drops bland over-broad buckets). When set, largest-first ranking
+    // no longer starves tighter clusters. Default UNSET = no cap. Only
+    // meaningful on `recombine`.
+    maxClusterSize: positiveInt.optional(),
+    // #632 — recombine process: tag values that must never form a tag cluster
+    // (generic project-wide tags). Default UNSET/[]. Only meaningful on
+    // `recombine`.
+    excludeTags: z.array(z.string().min(1)).optional(),
+    // #632 — recombine process: entity_norm values that must never form an
+    // entity cluster (user counterpart to the built-in generic-entity filter).
+    // Default UNSET/[]. Only meaningful on `recombine`.
+    excludeEntities: z.array(z.string().min(1)).optional(),
+    // #609 — recombine process: relatedness signal used to form clusters
+    // (tags | graph | both). Clustering is by relatedness, never embedding
+    // similarity. Default "both" (#632). Only meaningful on `recombine`.
+    relatednessSource: z.enum(["tags", "graph", "both"]).optional(),
+    // #609 — recombine process: consecutive re-inductions required before a
+    // hypothesis is promoted to a lesson. Default 2. Only meaningful on
+    // `recombine`.
+    confirmThreshold: z.number().int().min(1).optional(),
+    // #615 — procedural process: minimum number of distinct assets sharing the
+    // same successful normalized ordered-action sequence before it is compiled
+    // into a workflow proposal. Default 3. Only meaningful on `procedural`.
+    minRecurrence: z.number().int().min(2).optional(),
+    // #615 — procedural process: hard cap on workflow proposals emitted per run
+    // (one bounded LLM call each). Default 3. Only meaningful on `procedural`.
+    maxProposalsPerRun: positiveInt.optional(),
+    // #615 — procedural process: asset type a compiled sequence is emitted as.
+    // Reserved; v1 always emits "workflow". Only meaningful on `procedural`.
+    emitAs: z.enum(["workflow", "skill"]).optional(),
+    // #639 — semantic value-floor filter for the `reflect` process. When
+    // enabled, proposals classified as "low-value" by the deterministic noise
+    // gate are deferred. DEFAULT OFF (absent / { enabled: false } = pre-#639
+    // byte-identical behaviour). Only meaningful on the `reflect` process.
+    lowValueFilter: z.object({ enabled: z.boolean().optional() }).passthrough().optional(),
+    // #641 — procedural-aware floor for the `extract` process triage gate.
+    // When true, a session must have markers>=1 OR editCommit>=0.5 to pass, even
+    // if score>=minScore. DEFAULT OFF (absent/false = pre-#641 byte-identical).
+    // Only meaningful on the `extract` process when triage is also enabled.
+    proceduralAwareFloor: z.boolean().optional(),
     // Triage process config (only meaningful for the `triage` process)
     applyMode: z.enum(["queue", "promote"]).optional(),
     policy: z.string().min(1).optional(),
@@ -191,10 +403,10 @@ export const ImproveProcessConfigSchema = z
         profile: z.string().min(1).optional(),
         timeoutMs: z.union([positiveInt, z.null()]).optional(),
     })
-        .strict()
+        .passthrough()
         .optional(),
 })
-    .strict();
+    .passthrough();
 const ImproveProfileProcessesSchema = z
     .object({
     reflect: ImproveProcessConfigSchema.optional(),
@@ -202,42 +414,27 @@ const ImproveProfileProcessesSchema = z
     consolidate: ImproveProcessConfigSchema.optional(),
     memoryInference: ImproveProcessConfigSchema.optional(),
     graphExtraction: ImproveProcessConfigSchema.optional(),
+    extract: ImproveProcessConfigSchema.optional(),
     validation: ImproveProcessConfigSchema.optional(),
     triage: ImproveProcessConfigSchema.optional(),
     proactiveMaintenance: ImproveProcessConfigSchema.optional(),
+    recombine: ImproveProcessConfigSchema.optional(),
+    procedural: ImproveProcessConfigSchema.optional(),
 })
     .passthrough()
     .superRefine((val, ctx) => {
     // 0.8.0 removed the duplicated `feedbackDistillation` process key — it was
-    // a thin wrapper around `processes.distill.enabled`. Single source of truth.
-    const raw = val;
-    if ("feedbackDistillation" in raw) {
+    // a thin wrapper around `processes.distill.enabled`. Keep the migration
+    // hint so a stale config gets an actionable message rather than silently
+    // doing nothing. All OTHER unknown process keys are tolerated (passthrough)
+    // — see the unknown-key policy in this file's header. Hard-rejecting them
+    // turned benign cross-version skew into INVALID_CONFIG_FILE failures.
+    if ("feedbackDistillation" in val) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
             message: "feedbackDistillation was removed in 0.8.0 — use processes.distill.enabled instead. " +
                 "It now controls both the orchestration gate and the LLM-call gate.",
         });
-        return;
-    }
-    const allowed = new Set([
-        "reflect",
-        "distill",
-        "consolidate",
-        "memoryInference",
-        "graphExtraction",
-        "validation",
-        "extract",
-        "triage",
-        "proactiveMaintenance",
-    ]);
-    for (const k of Object.keys(raw)) {
-        if (!allowed.has(k)) {
-            ctx.addIssue({
-                code: z.ZodIssueCode.unrecognized_keys,
-                keys: [k],
-                message: `Unrecognized improve process key: "${k}".`,
-            });
-        }
     }
 });
 export const ImproveProfileConfigSchema = z
@@ -246,16 +443,26 @@ export const ImproveProfileConfigSchema = z
     processes: ImproveProfileProcessesSchema.optional(),
     autoAccept: nonNegativeNumber.optional(),
     limit: positiveInt.optional(),
+    // #616 — bounded multi-cycle phasing. Number of prep->loop->post-loop
+    // cycles per run. positiveInt forbids 0/negative. DEFAULT 1 => byte-identical
+    // single-pass behavior.
+    maxCycles: positiveInt.optional(),
+    // #614 — symmetric valence weighting in the eligibility sort. When true,
+    // the attention term becomes |valence| MAGNITUDE so BOTH strong positive
+    // and strong negative feedback drive attention (utility stays dominant) and
+    // strong-signed assets are routed to a fix/reinforce lane. DEFAULT OFF —
+    // false/absent preserves the legacy negative-only ranking byte-for-byte.
+    symmetricValence: z.boolean().optional(),
     sync: z
         .object({
         enabled: z.boolean().optional(),
         push: z.boolean().optional(),
         message: z.string().min(1).optional(),
     })
-        .strict()
+        .passthrough()
         .optional(),
 })
-    .strict();
+    .passthrough();
 // ── Profiles / defaults ────────────────────────────────────────────────────
 export const ProfilesSchema = z
     .object({
@@ -263,14 +470,14 @@ export const ProfilesSchema = z
     agent: z.record(z.string(), AgentProfileConfigSchema).optional(),
     improve: z.record(z.string(), ImproveProfileConfigSchema).optional(),
 })
-    .strict();
+    .passthrough();
 export const DefaultsSchema = z
     .object({
     llm: z.string().min(1).optional(),
     agent: z.string().min(1).optional(),
     improve: z.string().min(1).optional(),
 })
-    .strict();
+    .passthrough();
 // ── Sources / registries / installed ────────────────────────────────────────
 const SourceConfigEntryOptionsSchema = z
     .object({
@@ -294,7 +501,7 @@ export const SourceConfigEntrySchema = z
     options: SourceConfigEntryOptionsSchema.optional(),
     wikiName: z.string().min(1).optional(),
 })
-    .strict()
+    .passthrough()
     .superRefine((entry, ctx) => {
     if (entry.writable === true && (entry.type === "website" || entry.type === "npm")) {
         ctx.addIssue({
@@ -313,7 +520,7 @@ export const RegistryConfigEntrySchema = z
     provider: z.string().min(1).optional(),
     options: z.record(z.unknown()).optional(),
 })
-    .strict();
+    .passthrough();
 const KitSourceSchema = z.enum(["filesystem", "git", "npm", "github", "website", "local"]);
 export const InstalledStashEntrySchema = z
     .object({
@@ -329,7 +536,7 @@ export const InstalledStashEntrySchema = z
     resolvedRevision: z.string().min(1).optional(),
     wikiName: z.string().min(1).optional(),
 })
-    .strict()
+    .passthrough()
     .superRefine((entry, ctx) => {
     if (entry.writable === true && entry.source !== "git" && entry.source !== "filesystem") {
         ctx.addIssue({
@@ -344,7 +551,7 @@ export const OutputConfigSchema = z
     format: z.enum(["json", "yaml", "text"]).optional(),
     detail: z.enum(["brief", "normal", "full"]).optional(),
 })
-    .strict();
+    .passthrough();
 // ── Search ──────────────────────────────────────────────────────────────────
 const SearchGraphBoostSchema = z
     .object({
@@ -358,34 +565,122 @@ const SearchGraphBoostSchema = z
     /** Range [0, 1]; values > 1 hard-error (no silent clamp). */
     confidenceWeight: z.number().finite().min(0).max(1).default(0.2).optional(),
 })
-    .strict();
+    .passthrough();
 export const SearchConfigSchema = z
     .object({
     minScore: nonNegativeNumber.optional(),
-    curateRerank: z.object({ enabled: z.boolean().optional() }).strict().optional(),
+    defaultExcludeTypes: z.array(nonEmptyString).optional(),
     graphBoost: SearchGraphBoostSchema.optional(),
 })
-    .strict();
+    .passthrough();
 // ── Feedback ────────────────────────────────────────────────────────────────
 export const FeedbackConfigSchema = z
     .object({
     requireReason: z.boolean().optional(),
     allowedFailureModes: z.array(nonEmptyString).optional(),
 })
-    .strict();
+    .passthrough();
 // ── Improve top-level (utility decay, event retention) ─────────────────────
 const ImproveUtilityDecaySchema = z
     .object({
     halfLifeDays: z.number().finite().min(0.1).optional(),
     feedbackStabilityBoost: z.number().finite().min(1).optional(),
 })
-    .strict();
+    .passthrough();
+// #612 / WS-4 — auto-accept gate calibration + bounded, opt-in per-phase
+// threshold auto-tune. DEFAULT OFF: when absent (or `autoTune: false`) no
+// tuning occurs, so the gate behaves byte-identically to today.
+// WS-4 adds: per-phase persistence (state.db) + auto-tune ceiling default 85.
+const ImproveCalibrationSchema = z
+    .object({
+    /** Master switch for the bounded threshold auto-tune. Default false (parity). */
+    autoTune: z.boolean().optional(),
+    /** Lower bound (0-100) the tuned threshold may never drop below. */
+    minThreshold: z.number().int().min(0).max(100).optional(),
+    /**
+     * Upper bound (0-100) the tuned threshold may never rise above.
+     * WS-4 default: 85 (prevents gate converging to pure exploitation).
+     */
+    maxThreshold: z.number().int().min(0).max(100).optional(),
+    /** Maximum adjustment magnitude (points) applied in one tune step. */
+    maxStep: positiveInt.optional(),
+    /** Minimum acted-on sample count required before any adjustment. */
+    minSamples: nonNegativeNumber.optional(),
+    /** Target realized accept rate in [0, 1]. Default 0.9. */
+    targetAcceptRate: z.number().finite().min(0).max(1).optional(),
+})
+    .passthrough();
+// WS-4 — exploration budget: a fixed fraction of proposals accepted per run
+// regardless of confidence. DEFAULT OFF.
+const ImproveExplorationSchema = z
+    .object({
+    /**
+     * Enable the exploration budget lane. Default false (parity).
+     * When true, a fraction of proposals are accepted regardless of confidence.
+     */
+    enabled: z.boolean().optional(),
+    /**
+     * Fraction of proposals per run to accept as exploration [0, 1].
+     * Default 0.05 (5%). Clamped to [0, 1] at read time.
+     */
+    budgetFraction: z.number().finite().min(0).max(1).optional(),
+})
+    .passthrough();
+const ImproveSalienceSchema = z
+    .object({
+    /**
+     * WS-2 Part-V gate: enable the outcome-weight term in the salience projection.
+     * Default false (parity — WS-1 weights w_e=0.30, w_r=0.70 until Part-V confirms
+     * no regression). Set to true after running scripts/akm-eval + health report.
+     */
+    outcomeWeightEnabled: z.boolean().optional(),
+    /**
+     * Minimum encoding salience score [0, 1] for a zero-feedback asset to be
+     * admitted to the high-salience improve lane (#608).
+     * Default 0.75. Set to 1.0 to disable the lane entirely.
+     */
+    salienceThreshold: z.number().min(0).max(1).optional(),
+    /**
+     * Per-run additive replay budget (#610). Up to this many top-salience refs are
+     * revisited even with no reactive signal and regardless of cooldown. Additive
+     * on top of --limit. Default 0 = no replay.
+     */
+    replayBudget: z.number().int().min(0).optional(),
+})
+    .passthrough();
+// R5 — longitudinal collapse/churn detector (observe-only in v1; deterministic,
+// fail-open, runs only on cycles where consolidate/recombine did work).
+// Default ON; opt out via `improve.collapseDetector.enabled: false`.
+// See docs/design/improve-collapse-churn-detector-design.md.
+const ImproveCollapseDetectorSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    // Canary set size minted on first run (owner-approved 30–50 range; default 40).
+    canaryCount: z.number().int().min(3).max(200).optional(),
+    // Top-K cutoff for canary recall/nDCG (default 10).
+    k: z.number().int().min(1).max(100).optional(),
+    // Trend window in qualifying cycles (default 5).
+    windowCycles: z.number().int().min(2).max(50).optional(),
+    // Absolute mean-recall drop vs window median that fires collapse (default 0.15).
+    recallDropThreshold: z.number().min(0).max(1).optional(),
+    // distinct-content-ratio decline over the window that fires collapse (default 0.05).
+    entropyDropThreshold: z.number().min(0).max(1).optional(),
+    // Accepted-action volume over the window below which churn never fires (default 25).
+    churnMinAcceptedActions: z.number().int().min(1).optional(),
+    // improve_cycle_metrics retention (default 365 days, owner-approved).
+    retentionDays: z.number().int().min(1).optional(),
+})
+    .passthrough();
 export const ImproveConfigSchema = z
     .object({
     utilityDecay: ImproveUtilityDecaySchema.optional(),
     eventRetentionDays: nonNegativeNumber.optional(),
+    calibration: ImproveCalibrationSchema.optional(),
+    exploration: ImproveExplorationSchema.optional(),
+    salience: ImproveSalienceSchema.optional(),
+    collapseDetector: ImproveCollapseDetectorSchema.optional(),
 })
-    .strict();
+    .passthrough();
 // ── Index / per-pass ────────────────────────────────────────────────────────
 const GRAPH_EXTRACTION_INCLUDE_TYPES_ALLOWED = [
     "memory",
@@ -397,6 +692,7 @@ const GRAPH_EXTRACTION_INCLUDE_TYPES_ALLOWED = [
     "lesson",
     "task",
     "wiki",
+    "fact",
 ];
 const INDEX_PASS_PROVIDER_KEYS = new Set([
     "endpoint",
@@ -413,6 +709,7 @@ const INDEX_PASS_KNOWN_KEYS = new Set([
     "graphExtractionBatchSize",
     "graphExtractionIncludeTypes",
     "memoryInferenceBatchSize",
+    "lazyGraphExtraction",
 ]);
 /**
  * Per-pass `index.<pass>` entry. Uses preprocess + manual validation so we can
@@ -439,8 +736,8 @@ export const IndexPassConfigSchema = z.preprocess((raw, ctx) => {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
                 message: `Unknown key \`${[...(ctx.path ?? []), key].join(".")}\`. Per-pass entries support \`llm\` ` +
-                    "(boolean opt-out), `graphExtractionBatchSize`, `graphExtractionIncludeTypes`, and " +
-                    "`memoryInferenceBatchSize`.",
+                    "(boolean opt-out), `graphExtractionBatchSize`, `graphExtractionIncludeTypes`, " +
+                    "`memoryInferenceBatchSize`, and `lazyGraphExtraction`.",
             });
             return raw;
         }
@@ -459,15 +756,23 @@ export const IndexPassConfigSchema = z.preprocess((raw, ctx) => {
     graphExtractionBatchSize: positiveInt.optional(),
     graphExtractionIncludeTypes: z.array(z.enum(GRAPH_EXTRACTION_INCLUDE_TYPES_ALLOWED)).nonempty().optional(),
     memoryInferenceBatchSize: positiveInt.optional(),
+    lazyGraphExtraction: z.boolean().optional(),
 })
     .passthrough());
-const MetadataEnhanceSchema = z.object({ enabled: z.boolean().optional() }).strict();
+const MetadataEnhanceSchema = z.object({ enabled: z.boolean().optional() }).passthrough();
+/**
+ * RETIRED (meta-review 10-Q3): the staleness-detect pass was deleted; nothing
+ * reads this section anymore. The key stays TOLERATED here so configs that
+ * still carry `index.stalenessDetection` (written by 0.8.x migrations) do not
+ * fail validation — deleting the key would route it into the per-pass
+ * catchall, which rejects its `enabled`/`thresholdDays` fields.
+ */
 const StalenessDetectionSchema = z
     .object({
     enabled: z.boolean().optional(),
     thresholdDays: positiveInt.optional(),
 })
-    .strict();
+    .passthrough();
 /**
  * Index config is a union of reserved feature sections and per-pass entries.
  * Passthrough so per-pass entries (keyed by arbitrary pass names like `graph`,
@@ -527,6 +832,26 @@ export const IndexConfigSchema = z.preprocess((raw, ctx) => {
     stalenessDetection: StalenessDetectionSchema.optional(),
 })
     .catchall(IndexPassConfigSchema));
+// ── Workflow engine ─────────────────────────────────────────────────────────
+/**
+ * Workflow-engine settings (`workflow`).
+ *
+ * `maxConcurrency` is the engine-wide ceiling on concurrent units for native
+ * fan-out (`akm workflow run`). It replaces the hard-coded `min(16, cores−2)`
+ * cap (which matched Claude Code) with a user knob:
+ *   - UNSET  → the CPU-derived default `min(16, max(1, cores−2))`.
+ *   - SET    → the explicit positive integer, CLAMPED at read time to
+ *     `[1, WORKFLOW_MAX_CONCURRENCY_CEILING]` (64). Values above the ceiling
+ *     are clamped, not rejected, so a config shared across machines with wildly
+ *     different core counts never hard-fails validation.
+ * The R3 brief/report driver surface does NOT consult this — drivers own their
+ * own parallelism (the engine only caps native dispatch).
+ */
+export const WorkflowConfigSchema = z
+    .object({
+    maxConcurrency: positiveInt.optional(),
+})
+    .passthrough();
 // ── Setup-derived recommendations ──────────────────────────────────────────
 /**
  * Cron-style schedule hints derived by `akm setup --reset-recommended`.
@@ -540,12 +865,12 @@ export const SetupTaskSchedulesSchema = z
     improve: z.string().min(1).optional(),
     index: z.string().min(1).optional(),
 })
-    .strict();
+    .passthrough();
 export const SetupConfigSchema = z
     .object({
     taskSchedules: SetupTaskSchedulesSchema.optional(),
 })
-    .strict();
+    .passthrough();
 // ── Top-level AkmConfig ────────────────────────────────────────────────────
 /**
  * Base object schema used both as the top-level shape and as the source of
@@ -561,10 +886,25 @@ export const AkmConfigShape = {
     configVersion: z.union([z.string().min(1), z.number()]).optional(),
     profiles: ProfilesSchema.optional(),
     defaults: DefaultsSchema.optional(),
+    // Global model-alias tiers: alias → platform → exact model string, with a
+    // reserved `"*"` platform key as fallback. Lets workflows/callers name a
+    // semantic tier ("fast", "deep") that resolves per-harness at dispatch
+    // time. Values are literal model strings, never other aliases (one
+    // resolution level). Platform keys match the platform string a command
+    // builder resolves against ("claude", "opencode", "opencode-sdk", or a
+    // custom profile's name for the default builder) — unknown keys are inert.
+    // Precedence: profile modelAliases > this table > built-in aliases.
+    modelAliases: z.record(z.string().min(1), z.record(z.string().min(1), z.string().min(1))).optional(),
     stashDir: nonEmptyString.optional(),
     semanticSearchMode: z.enum(["off", "auto"]).default("auto"),
     embedding: EmbeddingConnectionConfigSchema.optional(),
     index: IndexConfigSchema.optional(),
+    // The `installed[]` shape is OWNED by the registry (`InstalledStashEntry`):
+    // its `source` is the 4-value `InstallKind` produced by the registry ref
+    // parser, and installed entries never carry the extra passthrough keys. The
+    // schema still validates entries at runtime, but its OUTPUT type is pinned to
+    // the domain type so config consumers get the registry `InstalledStashEntry`
+    // (not a looser schema-local mirror) — the single-source-of-truth boundary.
     installed: z.array(InstalledStashEntrySchema).optional(),
     registries: z.array(RegistryConfigEntrySchema).optional(),
     sources: z.array(SourceConfigEntrySchema).optional(),
@@ -575,9 +915,10 @@ export const AkmConfigShape = {
     feedback: FeedbackConfigSchema.optional(),
     archiveRetentionDays: nonNegativeNumber.optional(),
     improve: ImproveConfigSchema.optional(),
+    workflow: WorkflowConfigSchema.optional(),
     setup: SetupConfigSchema.optional(),
 };
-export const AkmConfigBaseSchema = z.object(AkmConfigShape).strict();
+export const AkmConfigBaseSchema = z.object(AkmConfigShape).passthrough();
 export const AkmConfigSchema = AkmConfigBaseSchema.superRefine((config, ctx) => {
     // #464.a: defaultWriteTarget must name a configured source when sources
     // are present. With no sources configured, error out instead of silently