akm-cli 0.9.15 → 0.9.16-alpha.2

package/docs/reference/cli.md

@@ -1042,7 +1042,8 @@ akm bundle add https://docs.example.com --max-pages 100 --max-depth 5
 | `--provider` | Explicit provider for declarative source configuration; normally inferred from the input |
 | `--writable` | Mark a git source as writable so `akm sync` also pushes (default: false) |
 | `--options` | Provider options as JSON (e.g. `'{"ref":"main"}'`) |
-| `--allow-insecure` | Bypass plain-HTTP source rejection **and** dangerous env key blocking. Accepts two risks: (1) plain-HTTP download without TLS, (2) env keys that can hijack process execution. Use only after reviewing the bundle manually |
+| `--allow-insecure-transport` | Allow a plain-HTTP source URL after explicitly accepting transport substitution risk |
+| `--allow-dangerous-env-keys` | Allow reviewed process-hijacking env keys in the installed bundle; does not permit plain HTTP |
 | `--max-pages` | Maximum pages to crawl for website sources (default: 50) |
 | `--max-depth` | Maximum crawl depth for website sources (default: 3) |
 
@@ -1070,7 +1071,7 @@ config override injection).
 
 When dangerous keys are found, `akm bundle add` pauses and prompts for
 confirmation (default: No). In non-interactive mode (CI, scripts) the
-install fails with **exit 1** unless `--allow-insecure` is passed, and the
+install fails with **exit 1** unless `--allow-dangerous-env-keys` is passed, and the
 freshly-installed bundle is rolled back before the process exits.
 
 ```sh
@@ -1078,7 +1079,7 @@ freshly-installed bundle is rolled back before the process exits.
 akm bundle add github:owner/repo-with-sensitive-env
 
 # Non-interactive: fails unless bypassed
-akm bundle add github:owner/repo-with-sensitive-env --allow-insecure
+akm bundle add github:owner/repo-with-sensitive-env --allow-dangerous-env-keys
 ```
 
 Bundle publishers: see the [Author Bundles guide](https://github.com/itlackey/akm/blob/main/docs/guides/author-bundles.md#env-security)
@@ -1155,14 +1156,14 @@ akm bundle update npm:@scope/pkg
 akm bundle update --all
 akm bundle update --all --force   # Force fresh download even if version is unchanged
 akm bundle update --all --yes     # Skip confirmation when an update needs to delete a moved install dir
-akm bundle update npm:@scope/pkg --allow-insecure  # Explicitly approve reviewed dangerous env keys
+akm bundle update npm:@scope/pkg --allow-dangerous-env-keys  # Explicitly approve reviewed dangerous env keys
 ```
 
 | Flag | Description |
 | --- | --- |
 | `--all` | Update all managed sources |
 | `--force` | Delete cached extraction before re-downloading |
-| `--allow-insecure` | Permit a staged update containing dangerous environment keys after warning. Without it, an interactive terminal prompts with a default of No; non-interactive use fails closed. This is independent of `--yes`. |
+| `--allow-dangerous-env-keys` | Permit a staged update containing dangerous environment keys after warning. Without it, an interactive terminal prompts with a default of No; non-interactive use fails closed. This is independent of `--yes`. |
 | `-y`, `--yes` | Skip the confirmation prompt for the rare branch where the resolved content location moved and the previous install directory must be deleted. No effect on a normal refresh, which deletes nothing. |
 
 The audit examines key names in `.env`-suffixed files under the staged
@@ -1644,7 +1645,7 @@ akm registry add https://skills.sh --name skills.sh --provider skills-sh
 | `--name` | Human-friendly label for the registry |
 | `--provider` | Provider type (e.g. `static-index`, `skills-sh`). Default: `static-index` |
 | `--options` | Provider-specific options as JSON (e.g. `'{"apiKey":"key"}'`) |
-| `--allow-insecure` | Allow a plain HTTP registry URL (rejected by default) |
+| `--allow-insecure-transport` | Allow a plain HTTP registry URL (rejected by default) |
 
 Duplicate URLs are rejected.
 
@@ -1907,6 +1908,7 @@ akm env run env/prod --only A,B -- cmd  # inject only A and B
 akm env run env/prod --except DEBUG -- cmd
 akm env run env/prod --clean -- cmd
 akm env run env/prod --clean --inherit SSH_AUTH_SOCK -- cmd
+akm env run third-party//env/prod --allow-dangerous-env-keys -- cmd
 ```
 
 Runs the command with the env file's values injected **directly into the child
@@ -1919,7 +1921,8 @@ environment (PATH/HOME/locale/terminal basics) instead of inheriting the full
 parent environment; use `--inherit KEY1,KEY2` to pass specific parent vars
 through in clean mode. Before spawning, the injected key names are scanned for
 known process-hijacking variables (`LD_PRELOAD`, `PATH`, `GIT_CONFIG_*`, ...):
-a first-party bundle warns and proceeds; a third-party-sourced bundle is refused.
+a first-party bundle warns and proceeds; a third-party-sourced bundle is refused
+unless the reviewed run explicitly passes `--allow-dangerous-env-keys`.
 
 > The single-key `run <ref>/KEY` form was removed. To inject one value, store it
 > as a [secret](#secret) and use `akm secret run secrets/<name> <VAR> -- …`, or
@@ -2812,9 +2815,10 @@ shell commands. It manages on-disk task definitions under
 (cron / launchd / schtasks). Task source v4 YAML (`version: 4`) is the only
 executable source contract this release accepts; `akm task add` writes v4 —
 see the canonical [Tasks reference](tasks.md). The
-group is `add | run | explain | validate | list | sync | doctor | history | prune`
+group is `add | enable | disable | run | explain | validate | list | sync | doctor | history | prune`
 — there is no `show` or `remove`; use `akm show tasks/<id>` to inspect one
-task, and edit the file + `akm task sync` to change or remove a schedule.
+task. Use `task enable` / `task disable` for host-local activation; edit the
+file only to change the authored schedule or remove the task.
 `task list` is a delegating alias for `akm search --type task` — both
 spellings return the identical envelope.
 
@@ -2826,11 +2830,13 @@ akm task add <id> --schedule "@daily" \     # Register a new task and install it
 akm task add review --schedule "@daily" --prompt "Review recent changes" --engine reviewer
 akm task add nightly --schedule "@daily" --command "akm improve" --disabled  # register but leave off
 akm task add nightly --schedule "@daily" --command "akm improve" --force    # overwrite an existing task id
+akm task enable team//tasks/nightly       # Add local activation and sync its bundle
+akm task disable team//tasks/nightly      # Remove local activation and unschedule it
 akm task run <id>                           # Execute now (what the scheduler calls)
 akm task explain <ref>                      # Read-only: declared inputs, target, schedule — spawns nothing
 akm task validate <path>                    # Read-only: parse one task file by path, report sync's diagnostic
 akm task history [<id>] [--id <id>] [--limit <n>]  # Recent runs from state.db (positional id == --id)
-akm task sync                               # Reconcile on-disk YAML with scheduler
+akm task sync                               # Reconcile activated refs from all enabled configured bundles
 akm task sync --dry-run                     # Preview the reconcile — zero scheduler writes
 akm task sync --rebind                      # Also capture the current installed runtime
 akm task doctor                             # Report scheduler backend + paths
@@ -2863,21 +2869,19 @@ concept ref or id, and the file need not live in any configured bundle —
 and reports the same diagnostic `akm task sync` would produce for it,
 INCLUDING sync's own cron-dialect check and its per-schedule-entry
 input-contract check (so a file `sync` would reject can never be reported
-`valid`/`converts` here): `{ok, path, sourceVersion, outcome, reason?,
+`valid` here): `{ok, path, sourceVersion, outcome, reason?,
 resolved?}` where `outcome` is `valid` (parses as task source v4 directly
-and passes both sync checks), `converts` (task v2/v3 that the deterministic
-migrator converts in memory and which then also passes both sync checks),
-`blocked` (task v2/v3 the migrator itself cannot convert — needs a human
-decision), `invalid` (the YAML doesn't parse, or the document fails schema
+and passes both sync checks), `blocked` (task v2/v3 that must first be
+rewritten by `akm migrate apply`), `invalid` (the YAML doesn't parse, or the document fails schema
 validation, or it parsed but fails one of the two sync checks), or
 `not-a-task` (the YAML parses but never declares a `version:` field — not
 shaped like a task source). `resolved` is the compiled task shape
 `akm task sync` itself would build a scheduler binding from — id, the
 compiled schema version, resolved `uses`/`run` target, declared `inputs`
-contract, and `schedule` bindings — present only on `valid`/`converts`.
+contract, and `schedule` bindings — present only on `valid`.
 Unlike `akm task explain`, it never runs execution lowering: a command-kind
 task validates the same whether or not the local config has an engine
-configured. Exits 0 for `valid`/`converts`, 1 for
+configured. Exits 0 for `valid`, 1 for
 `blocked`/`invalid`/`not-a-task`, 2 for a missing or unreadable path.
 **Read-only**: it never touches the scheduler and never requires the file to
 be indexed or wired into a bundle.
@@ -2887,9 +2891,11 @@ time. Each run is recorded as a row in the durable `task_history` table
 (`state.db`), surfaced by `akm task history` — **not** by `akm log`; there is
 no `task_invoked`/`task_completed` event type on the `akm log` stream.
 
-To disable a scheduled task, set `enabled: false` on its `schedule:` entry
-(task source v4 has no document-level `enabled` flag — it lives per
-schedule-binding) and run `akm task sync`. To remove one, delete its file
+Task source cannot enable itself. `akm task enable <fully-qualified-ref>` adds
+an exact source-bound `{kind, ref, sourceId}` grant to this host's
+`scheduler.enabled` config and
+syncs that bundle; `akm task disable` removes it and unschedules the task.
+Manual `akm task run` remains available. To remove a task, delete its file
 (`<bundle>/tasks/<id>.yml`) and run `akm task sync` — sync uninstalls the
 orphaned scheduler entry.
 
@@ -2910,9 +2916,10 @@ to specific binding ids — naming an id that isn't a current orphan
 candidate (not installed, or it still resolves to a live bundle) is
 refused with a usage error and removes nothing.
 
-Scheduler activation captures the installed akm runtime. Ordinary `task sync`
-reconciles definitions, schedules, and enabled state while preserving that
-runtime binding. Use `task sync --rebind` only after intentionally moving or
+Scheduler activation is host-local config and captures the installed akm
+runtime. Ordinary `task sync` reconciles activated refs from all enabled
+configured bundles while preserving that runtime binding. Use `task sync
+--rebind` only after intentionally moving or
 replacing the installation, or to repair a stale runtime path, then verify the
 result with `akm task doctor`. Interactive `akm setup` reviews every embedded
 task template (both the core set and the improve-schedule set) and asks once
@@ -2930,9 +2937,10 @@ Setup reconfiguration preserves existing scheduler runtime bindings. Changing
 the AKM storage path or installed runtime path therefore requires an explicit
 `akm task sync --rebind`; setup does not silently migrate those entries.
 
-**Bundle targeting (`--bundle <bundle>`).** By default every subcommand
-operates on the primary/default bundle. `add`, `history`, `sync`, `run`, and
-`explain` all accept `--bundle <bundle>` to schedule, reconcile, or inspect
+**Bundle targeting (`--bundle <bundle>`).** By default read/write commands
+operate on the primary/default bundle, while an unscoped `sync` reconciles all
+enabled configured bundles. `add`, `enable`, `disable`, `history`, `sync`,
+`run`, and `explain` accept `--bundle <bundle>` to schedule, reconcile, or inspect
 tasks that live in another configured bundle (`doctor` reports scheduler-wide
 state and takes no `--bundle`; `validate` takes a bare filesystem path
 instead of a ref, so it has no bundle to target either):
@@ -2944,9 +2952,9 @@ akm task sync --bundle team-bundle             # reconcile only that bundle
 
 A non-default bundle is recorded in the installed scheduler entry as a
 `--bundle <bundle>` token, so the scheduled `akm task run` resolves the task
-(and its relative asset refs) from that bundle. `sync` reconciles one bundle at a
-time and only touches entries attributed to it, so a plain (primary) sync never
-disturbs another bundle's scheduled tasks. Scheduler ids are the bare task id and
+(and its relative asset refs) from that bundle. `sync --bundle` limits a run to
+one bundle; unscoped `sync` reconciles every configured bundle as one
+transaction. Scheduler ids are the bare task id and
 are never namespaced: registering a task whose id is already scheduled from a
 different bundle is a hard error.
 

package/docs/reference/configuration.md

@@ -16,14 +16,13 @@ auto-upgrade in memory (see "Version read shim" below). Missing, newer,
 numeric, and any other unrecognized version are rejected by ordinary
 commands without rewriting the file — an older binary never guesses at a
 newer, unknown shape. Pre-0.9 config and database layouts are not runtime
-inputs and are not migrated by `akm upgrade`. Configure the current schema
-directly. The standalone migrator exists only for explicit task migration:
-task v2 to task v3, then task v3 to task source v4, in one pass.
+inputs. Historical task sources and scheduler activation are handled by the
+standalone `akm-migrate` executable, also invoked by `akm migrate` / `akm
+upgrade`; ordinary runtime code reads only the current shape.
 
 ### Version read shim
 
-Like the task-source v2/v3 auto-shim (`akm migrate apply`'s in-memory
-counterpart, documented under Migration below), a known older `configVersion`
+For config only, a known older `configVersion`
 is converted to the current shape in memory on load — with a one-line stderr
 deprecation warning — rather than hard-failing every command. Nothing is
 written back to disk by the shim itself; the very next config-mutating
@@ -64,6 +63,9 @@ the first bump that will need it, per #863.
     "maxConcurrency": 8,
     "judgeEngine": "reviewer"
   },
+  "execution": {
+    "allowedTools": ["read_file", "search"]
+  },
   "improve": {
     "strategies": {
       "nightly": {
@@ -78,6 +80,25 @@ the first bump that will need it, per #863.
 }
 ```
 
+## Scheduler activation
+
+`scheduler.enabled` is this host's explicit scheduling allow-list. Each entry
+has a `kind` (`task` or `workflow`), a canonical fully qualified `ref`, and a
+`sourceId` binding the grant to the configured source installation that was
+approved. Absence means disabled. Replacing a bundle's path or locator under
+the same name invalidates the old grant; ordinary updates from the same origin
+do not. Authored task/workflow files may describe schedules but cannot grant
+themselves authority to create native scheduler entries. Do not edit
+`sourceId` manually: `akm task enable` writes it, and `akm migrate apply`
+upgrades grants written by older releases.
+
+This key is deliberately local: if a config uses `extends`, any `scheduler`
+section in the base is ignored with a warning. Only the top-level local config
+can activate schedules. Prefer `akm task enable <ref>` and `akm task disable
+<ref>` over editing the JSON by hand; both update the allow-list and sync the
+affected bundle. An unscoped `akm task sync` reconciles enabled refs across all
+enabled configured bundles.
+
 ## Engines
 
 `engines` is the only public execution map. An engine name is lowercase
@@ -112,6 +133,12 @@ An agent engine may set `bin`, `args`, `workspace`, `model`, and `timeoutMs`.
 Only `platform: "opencode-sdk"` may set `llmEngine`; it names
 the LLM engine used as that SDK engine's fallback connection.
 
+Executable assets may request tools, but the request is not authority. Configure
+the host-local `execution.allowedTools` list to define the ceiling; `"*"` is an
+explicit allow-all. The default is an empty list. Asset frontmatter cannot set
+`workspace`, `environment`, or opaque `runtime` values; those belong to local
+engine configuration or workflow environment bindings.
+
 `platform: "opencode-sdk"` needs the **`opencode` binary** on PATH (or a `bin`
 pointing at it). akm bundles `@opencode-ai/sdk`, but that package is an HTTP
 client with no dependencies — it spawns `opencode serve` and talks to it — so
@@ -551,6 +578,12 @@ bundle's `components.<id>.adapter` key pins it to a specific format adapter
 instead of relying on auto-detection — see [Bundle Types](bundle-types.md)
 for the full adapter list and what each one reads/writes.
 
+Each physical content root has one bundle id. Duplicate paths and symbolic-link
+aliases are rejected because source ownership, scheduler authority, and default
+selection must not depend on which spelling a caller used. If an older config
+contains aliases, choose the id whose durable refs should survive and remove
+the other entry before running ordinary commands.
+
 ### defaultWriteTarget
 
 `defaultWriteTarget` names the bundle that write commands (`akm remember`,
@@ -700,6 +733,16 @@ one file, and have each host's local config extend it.
   add`/`akm sync` first so the file is materialized locally, then point
   `extends` at it.
 
+Shared layers carry portable policy, not host authority. `bundles`, source and
+write defaults, registries, embedding connections, scheduler grants,
+`execution`, `experimental`, and setup state are ignored when inherited.
+Engine definitions may be shared, but credentials and executable authority
+(`apiKey`, `apiKeyFile`, `bin`, `args`, and `workspace`) must be supplied by
+the local file. Improve publication (`strategies.*.sync`) and reranker network
+configuration are local as well. Bundle-relative chains stay physically inside
+the bundle root for every hop; lexical `..` paths and symlink escapes are both
+rejected before a referenced file is read.
+
 There is no `extends: <url>` form: config load is synchronous and runs on
 every invocation, and akm deliberately does not fetch network resources at
 load time (the same reason `registries` is never fetched until a

package/docs/reference/tasks.md

@@ -148,12 +148,10 @@ name: Nightly review
 run: akm improve --strategy default
 schedule:
   - cron: "@daily"
-    enabled: false
 ```
 
-A bare string (`schedule: "0 8 * * 1"`) is shorthand for one enabled
-binding with no inputs. A list entry may set its own `enabled` (default
-`true`) and literal `inputs`; those literals are validated against the
+A bare string (`schedule: "0 8 * * 1"`) is shorthand for one trigger with
+no inputs. A list entry may set literal `inputs`; those literals are validated against the
 task's `inputs:` declarations both at parse time and again at
 `akm task sync` (once with declared defaults applied), and are
 **delivered** to the scheduled run: `akm task sync` compiles each entry's
@@ -163,18 +161,26 @@ fired run receives them exactly as `akm task run <id> --<name> <value>`
 would. Multiple schedule entries create deterministic scheduler bindings
 for the one source task.
 
-Task source v4 has **no document-level `enabled` flag** — enablement is
-per schedule binding. Disable one binding by setting its own
-`enabled: false`. `--schedule` is a required flag on every `akm task add`
-invocation, `--disabled` included — not a check specific to `--disabled` —
-so `akm task add --disabled` always has a schedule to write `enabled: false`
-onto and never needs to reject a schedule-less task with "nothing to
-disable."
+Task source v4 has **no enablement flag**. A source describes what may run;
+it cannot authorize its own host scheduling. Activation is an exact,
+host-local allow-list in `config.json` under `scheduler.enabled`, keyed by
+asset kind, fully qualified ref, and the approved source installation identity.
+Absence means disabled. A removed, disabled, or replaced bundle cannot reuse a
+grant written for an earlier source under the same name. Use `akm task
+enable <bundle>//tasks/<id>` and `akm task disable <bundle>//tasks/<id>` to
+change that list and immediately sync the affected bundle. `akm task add`
+enables its new task by default; `--disabled` writes the same task source but
+does not add the local activation.
 
 `akm task run <id>` executes a task immediately, including a disabled task.
-`akm task sync` validates the complete desired set before atomically
-reconciling scheduler state. Scheduled invocations re-read the guarded current
-task bytes; workflow targets then create a fresh durable workflow freeze.
+`akm task sync` scans every enabled configured bundle, selects only locally
+activated task/workflow refs, validates the complete desired set, and then
+atomically reconciles scheduler state. `--bundle <name>` narrows that pass to
+one active bundle. If every configured bundle is disabled, sync removes the
+attributable native entries without reading task content. Scheduled task
+invocations check both the local activation and current source identity again at
+fire time before re-reading the guarded current task bytes; workflow targets
+then create a fresh durable workflow freeze.
 
 ## Typed inputs and output
 
@@ -200,7 +206,6 @@ output:
 uses: commands/review
 schedule:
   - cron: "0 8 * * 1"
-    enabled: true
     inputs: { scope: all, ticket: OPS-1234 }
 timeout: 45000
 engine: reviewer
@@ -229,9 +234,7 @@ redact: [TOKEN]
   field path (`schedule`, or `schedule[<i>]`), naming the unsatisfied
   input. The rule covers every entry: the `schedule: "<cron>"` string
   shorthand, a list entry with no `inputs:` key, and an entry whose
-  `inputs:` mapping is present but incomplete — including one written
-  `enabled: false`, so enabling it later can never turn a parsed document
-  unrunnable. `akm task sync` keeps its own equivalent check over the
+  `inputs:` mapping is present but incomplete. `akm task sync` keeps its own equivalent check over the
   defaulted values and still rejects the whole desired set before touching
   any scheduler state. Give every schedule entry an explicit value for the
   input, or declare a `default` instead; manual runs are unaffected — a
@@ -343,7 +346,8 @@ Common v2 → v3 blocked reasons and what to do about each — these need a
 hand-authored replacement, not a re-run; see [the 0.9.1 to 0.9.2 migration
 guide](../migration/v0.9.1-to-v0.9.2.md#v2--v3-blocked-cases) for the full v2
 to v4 field mapping (`command:` array → `run:` + `shell:`, `timeoutMs:` →
-`timeout:`, document-level `enabled:` → per-`schedule:`-entry `enabled`):
+`timeout:`). Source-owned `enabled` fields are removed; native bindings that
+are provably enabled seed the host-local activation list:
 
 | Reason | Meaning | Fix |
 |---|---|---|
@@ -357,7 +361,6 @@ Common v3 → v4 blocked reasons and what to do about each:
 | `github-action-target-removed` | The task's `uses:` is a GitHub Action locator (`owner/repo[/path]@ref`); that spelling has no task source v4 equivalent. | Rewrite the target as `commands/`, `scripts/`, `workflows/`, or `akm/command` by hand. |
 | `with-on-non-command-target` | A `with:` block is authored on a target other than `uses: akm/command`. | Task-call inputs are declared and bound separately in v4 — author `inputs:` on the task and, if it is a workflow step's own composition, bind them with the step's `with:` instead. |
 | `ambiguous-scheduling-source` | The document declares both `akm.schedule` and `on:`. | Pick one; the migrator will not guess which one wins. |
-| `enabled-false-has-no-schedule-entry` | `akm.enabled: false` with no cron trigger to attach it to (the only trigger is `on.workflow_dispatch`). | Task source v4 has no document-level `enabled` flag — decide whether the task should be scheduled (add a cron) or left manual-only (drop `akm.enabled`), then re-run. |
 | `read-only-source` | The owning source or file is not writable. | Move or re-source the file somewhere writable, or edit it by hand. |
 | `invalid-v3-task` | The v3 document itself is structurally invalid (unknown fields, missing selector, malformed trigger, etc). | Fix the underlying v3 document first — the migrator translates structure, it does not repair it. |
 | `generated-v4-validation-failed` | The converted bytes fail the real task source v4 parser; the detail carries the parse error. | Read the detail — it names the offending field and why v4 refuses it — then fix that field in the v3 file and preview again. |
@@ -402,20 +405,20 @@ for full before/after examples and recovery guidance.
   anything — see [`akm task explain`](#akm-task-explain) above.
 - `akm task validate <path>` parses one task file by filesystem path (the
   file need not live in a configured bundle) and reports the same
-  `valid`/`converts`/`blocked`/`invalid`/`not-a-task` diagnostic
+  `valid`/`blocked`/`invalid`/`not-a-task` diagnostic
   `akm task sync` would produce for it — including sync's own cron-dialect
   check and its per-schedule-entry input-contract check — without touching
   the scheduler and without requiring a configured engine, even for a
   command-kind task. The envelope's own `sourceVersion` field names the
-  file's originally declared schema version (2, 3, or 4).
+  file's declared schema version. Version 2/3 files are `blocked` with an
+  `akm migrate apply` instruction; validation never migrates them in memory.
 - `akm task add` writes a task source v4 document and installs it after
   validation. `--params` renders typed `inputs:` declarations instead of a
-  `with:` bag; `--schedule` is required on every invocation, and
-  `--disabled` writes `schedule: [{cron: …, enabled: false}]` instead of a
-  document-level flag.
+  `with:` bag; `--schedule` is required on every invocation. `--disabled`
+  leaves the new ref absent from local scheduler activation.
 - `akm task history` reads durable run history from `state.db`.
-- Disable a binding by editing the source and syncing: set that schedule
-  entry's own `enabled: false`.
+- `akm task enable <ref>` / `akm task disable <ref>` change only local
+  scheduler config, then reconcile that bundle.
 - Delete the `.yml` source and sync to remove its derived binding(s).
 - `akm task sync --dry-run` previews the reconcile (adds/updates/removes,
   removals annotated with their owning bundle) without writing to the
@@ -469,8 +472,10 @@ on:
 refs consumed it as run params; command/script refs rejected it outright).
 A GitHub Action locator (`owner/repo[/path]@ref`) was a recognized `uses:`
 shape that was always rejected before dispatch — remote action acquisition
-was never implemented in any akm release. `akm.enabled: false` disabled the
-whole document, not a specific schedule binding.
+was never implemented in any akm release. `akm.enabled` was source-owned
+scheduling state. `akm migrate apply` removes it; migration preserves actual
+host activation only when the native scheduler proves that the corresponding
+binding is enabled.
 
 See [Migrating to task source v4](#migrating-to-task-source-v4) above to
 convert a file out of this grammar.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akm-cli",
-  "version": "0.9.15",
+  "version": "0.9.16-alpha.2",
   "type": "module",
   "description": "akm (Agent Knowledge Manager) — a portable, local-first capability library for AI agents. Discover, load, share, and improve reusable skills, scripts, workflows, and knowledge across any shell-capable coding agent, including Claude Code, OpenCode, and Cursor.",
   "keywords": [

package/schemas/akm-config.json

@@ -249,6 +249,20 @@
       },
       "additionalProperties": true
     },
+    "execution": {
+      "type": "object",
+      "properties": {
+        "allowedTools": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "default": []
+        }
+      },
+      "additionalProperties": false
+    },
     "index": {
       "type": "object",
       "properties": {
@@ -473,6 +487,10 @@
             "type": "string",
             "minLength": 1
           },
+          "credential": {
+            "type": "string",
+            "minLength": 1
+          },
           "writable": {
             "type": "boolean"
           },
@@ -623,7 +641,7 @@
               "maximum": 50
             }
           },
-          "additionalProperties": true
+          "additionalProperties": false
         }
       },
       "additionalProperties": true
@@ -1710,6 +1728,42 @@
       },
       "additionalProperties": true
     },
+    "scheduler": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "kind": {
+                "type": "string",
+                "enum": [
+                  "task",
+                  "workflow"
+                ]
+              },
+              "ref": {
+                "type": "string",
+                "minLength": 1
+              },
+              "sourceId": {
+                "type": "string",
+                "pattern": "^sha256:[0-9a-f]{64}$"
+              }
+            },
+            "required": [
+              "kind",
+              "ref",
+              "sourceId"
+            ],
+            "additionalProperties": false
+          },
+          "default": []
+        }
+      },
+      "additionalProperties": false
+    },
     "setup": {
       "type": "object",
       "properties": {},
@@ -1722,7 +1776,7 @@
           "type": "boolean"
         }
       },
-      "additionalProperties": true
+      "additionalProperties": false
     }
   },
   "required": [
@@ -1977,6 +2031,20 @@
           },
           "additionalProperties": true
         },
+        "execution": {
+          "type": "object",
+          "properties": {
+            "allowedTools": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              },
+              "default": []
+            }
+          },
+          "additionalProperties": false
+        },
         "index": {
           "type": "object",
           "properties": {
@@ -2201,6 +2269,10 @@
                 "type": "string",
                 "minLength": 1
               },
+              "credential": {
+                "type": "string",
+                "minLength": 1
+              },
               "writable": {
                 "type": "boolean"
               },
@@ -2351,7 +2423,7 @@
                   "maximum": 50
                 }
               },
-              "additionalProperties": true
+              "additionalProperties": false
             }
           },
           "additionalProperties": true
@@ -3438,6 +3510,42 @@
           },
           "additionalProperties": true
         },
+        "scheduler": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "kind": {
+                    "type": "string",
+                    "enum": [
+                      "task",
+                      "workflow"
+                    ]
+                  },
+                  "ref": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "sourceId": {
+                    "type": "string",
+                    "pattern": "^sha256:[0-9a-f]{64}$"
+                  }
+                },
+                "required": [
+                  "kind",
+                  "ref",
+                  "sourceId"
+                ],
+                "additionalProperties": false
+              },
+              "default": []
+            }
+          },
+          "additionalProperties": false
+        },
         "setup": {
           "type": "object",
           "properties": {},
@@ -3450,7 +3558,7 @@
               "type": "boolean"
             }
           },
-          "additionalProperties": true
+          "additionalProperties": false
         }
       },
       "required": [

package/schemas/akm-task.json

@@ -179,13 +179,12 @@
       "pattern": "^(?:[^\\s:.#/]+//)?commands/(?!\\.{1,2}(?:/|$))[^\\s#\\\\/\\u0000]+(?:/(?!\\.{1,2}(?:/|$))[^\\s#\\\\/\\u0000]+)*$"
     },
     "taskSourceV4ScheduleEntry": {
-      "description": "One schedule: list entry (D2-N5: per-entry enabled defaults true; inputs are validated against inputs: at parse time and delivered to the scheduled run's own invocation, P2b).",
+      "description": "One schedule: list entry. Activation is host-local scheduler configuration, never task source; inputs are validated against inputs: at parse time and delivered to the scheduled run's own invocation.",
       "type": "object",
       "required": ["cron"],
       "additionalProperties": false,
       "properties": {
         "cron": { "$ref": "#/definitions/nonemptyLiteral" },
-        "enabled": { "type": "boolean" },
         "inputs": { "$ref": "#/definitions/taskSourceV4ScheduleInputs" }
       }
     },