akm-cli 0.9.16 → 0.9.17-alpha.2

package/dist/llm/graph-extract.js

@@ -25,7 +25,7 @@ import { toErrorMessage } from "../core/common.js";
 import { ConfigError } from "../core/errors.js";
 import { parseEmbeddedJsonResponse } from "../core/parse.js";
 import { warn, warnVerbose } from "../core/warn.js";
-import { isContextSizeError } from "./client.js";
+import { isContextSizeError, isTransportFailure, LlmCallError } from "./client.js";
 import { tryLlmFeature } from "./feature-gate.js";
 import { callStructured } from "./structured-call.js";
 /**
@@ -33,7 +33,7 @@ import { callStructured } from "./structured-call.js";
  * Chosen to be visually clear and unlikely to appear verbatim in asset bodies.
  */
 const BATCH_ASSET_SEPARATOR = "=== ASSET";
-export const GRAPH_EXTRACT_PROMPT_VERSION = "v2";
+export const GRAPH_EXTRACT_PROMPT_VERSION = "v3";
 /** Asset bodies longer than this are chunked instead of truncated. */
 const MAX_CHUNK_BODY_CHARS = 1600;
 /** Bodies longer than this are excluded from multi-asset batch prompts. */
@@ -44,10 +44,72 @@ const NON_ARRAY_BATCH_DISABLE_THRESHOLD = 2;
 const MAX_ENTITIES_PER_ASSET = 32;
 /** Hard cap on relations returned per asset. */
 const MAX_RELATIONS_PER_ASSET = 32;
+/**
+ * Default cap on chunks processed per asset (R12b + R20) — overridable via
+ * `processes.graphExtraction.maxChunksPerAsset`. Without a cap, one long file
+ * chunked at MAX_CHUNK_BODY_CHARS could spend dozens of calls on a single
+ * asset (one file spent 21 of 27 run calls this way) before its output was
+ * sliced to MAX_ENTITIES_PER_ASSET/MAX_RELATIONS_PER_ASSET anyway.
+ */
+const DEFAULT_MAX_CHUNKS_PER_ASSET = 8;
 const SYSTEM_PROMPT = systemPromptTemplate;
 const USER_PROMPT_PREFIX = userPromptTemplate
     .replace("{{MAX_ENTITIES}}", String(MAX_ENTITIES_PER_ASSET))
     .replace("{{MAX_RELATIONS}}", String(MAX_RELATIONS_PER_ASSET));
+/**
+ * Strict JSON Schema for one asset's extraction payload (R12b, compacted for
+ * R12). Sent via `responseSchema` to providers that opt into structured
+ * output (`runner.connection.supportsJsonSchema` — same lift as
+ * memory-infer.ts's `DERIVED_MEMORY_JSON_SCHEMA`); the client silently drops
+ * it otherwise. `maxItems` mirrors MAX_ENTITIES_PER_ASSET/MAX_RELATIONS_PER_ASSET
+ * so a compliant provider cannot pay for output beyond what
+ * parseGraphExtraction keeps. Relations are compact `[from, type, to]`
+ * triples (`type` may be `""`) rather than `{"from","to","type"}` objects —
+ * the object-keyed form cost 10+ tokens per relation for no signal, and
+ * output tokens cost far more than prompt tokens. There is deliberately no
+ * relation-level `confidence` in the schema (the prompt never asks for one);
+ * `parseGraphExtraction` still reads it from a legacy object-shaped relation
+ * for backward compatibility. `confidence` stays at the extraction level —
+ * parseGraphExtraction reads it into the merged confidence.
+ * `additionalProperties: false` forbids anything else. Reused as the `items`
+ * schema of a batch call's array response (see
+ * {@link buildBatchResponseSchema}) so a single-asset and a batched call
+ * bound entities/relations identically.
+ */
+const GRAPH_EXTRACTION_ITEM_SCHEMA = {
+    type: "object",
+    properties: {
+        entities: { type: "array", items: { type: "string" }, maxItems: MAX_ENTITIES_PER_ASSET },
+        relations: {
+            type: "array",
+            maxItems: MAX_RELATIONS_PER_ASSET,
+            items: {
+                type: "array",
+                items: { type: "string" },
+                minItems: 3,
+                maxItems: 3,
+            },
+        },
+        confidence: { type: "number" },
+    },
+    required: ["entities", "relations"],
+    additionalProperties: false,
+};
+/** Schema for {@link extractGraphFromBody}'s single-asset `responseSchema`. */
+const GRAPH_EXTRACTION_JSON_SCHEMA = GRAPH_EXTRACTION_ITEM_SCHEMA;
+/**
+ * Schema for {@link extractGraphFromBodies}' batch `responseSchema` — an
+ * array of exactly `count` {@link GRAPH_EXTRACTION_ITEM_SCHEMA} elements, one
+ * per asset in the batch, matching the batch prompt's contract.
+ */
+function buildBatchResponseSchema(count) {
+    return {
+        type: "array",
+        minItems: count,
+        maxItems: count,
+        items: GRAPH_EXTRACTION_ITEM_SCHEMA,
+    };
+}
 const GENERIC_ENTITIES = new Set([
     "agent",
     "application",
@@ -152,12 +214,14 @@ function mergeGraphExtractions(extractions) {
     const relationChunkCounts = new Map();
     let confidence;
     let truncationCount = 0;
+    let truncatedChunks = 0;
     let filteredGenericEntities = 0;
     let filteredInvalidRelations = 0;
     let filteredLowConfidenceRelations = 0;
     let firstFailureReason;
     for (const extraction of extractions) {
         truncationCount += extraction.truncationCount ?? 0;
+        truncatedChunks += extraction.truncatedChunks ?? 0;
         filteredGenericEntities += extraction.filteredGenericEntities ?? 0;
         filteredInvalidRelations += extraction.filteredInvalidRelations ?? 0;
         filteredLowConfidenceRelations += extraction.filteredLowConfidenceRelations ?? 0;
@@ -234,6 +298,7 @@ function mergeGraphExtractions(extractions) {
         reason,
         chunkCount: extractions.length,
         truncationCount,
+        truncatedChunks,
         filteredGenericEntities,
         filteredInvalidRelations,
         filteredLowConfidenceRelations,
@@ -283,13 +348,36 @@ function parseGraphExtraction(raw) {
     let filteredLowConfidenceRelations = 0;
     if (Array.isArray(item.relations)) {
         for (const relation of item.relations) {
-            if (typeof relation !== "object" || relation === null || Array.isArray(relation)) {
+            // Compact triple form `[from, type, to]` (R12) — `type` may be "".
+            // Legacy `{"from","to","type","confidence"}` object form still parses
+            // for backward compatibility (older cached prompts, other callers).
+            let fromRaw;
+            let toRaw;
+            let typeRaw;
+            let confidenceRaw;
+            if (Array.isArray(relation)) {
+                if (relation.length !== 3 ||
+                    typeof relation[0] !== "string" ||
+                    typeof relation[1] !== "string" ||
+                    typeof relation[2] !== "string") {
+                    filteredInvalidRelations += 1;
+                    continue;
+                }
+                fromRaw = normalizeEntityName(relation[0]);
+                typeRaw = relation[1];
+                toRaw = normalizeEntityName(relation[2]);
+            }
+            else if (typeof relation === "object" && relation !== null) {
+                const rel = relation;
+                fromRaw = typeof rel.from === "string" ? normalizeEntityName(rel.from) : "";
+                toRaw = typeof rel.to === "string" ? normalizeEntityName(rel.to) : "";
+                typeRaw = typeof rel.type === "string" ? rel.type : undefined;
+                confidenceRaw = rel.confidence;
+            }
+            else {
                 filteredInvalidRelations += 1;
                 continue;
             }
-            const rel = relation;
-            const fromRaw = typeof rel.from === "string" ? normalizeEntityName(rel.from) : "";
-            const toRaw = typeof rel.to === "string" ? normalizeEntityName(rel.to) : "";
             if (!fromRaw || !toRaw) {
                 filteredInvalidRelations += 1;
                 continue;
@@ -300,12 +388,12 @@ function parseGraphExtraction(raw) {
                 filteredInvalidRelations += 1;
                 continue;
             }
-            const type = typeof rel.type === "string" ? normalizeRelationType(rel.type) : undefined;
+            const type = typeRaw !== undefined ? normalizeRelationType(typeRaw) : undefined;
             if (type !== undefined && GENERIC_RELATION_TYPES.has(type)) {
                 filteredInvalidRelations += 1;
                 continue;
             }
-            const confidence = parseConfidence(rel.confidence);
+            const confidence = parseConfidence(confidenceRaw);
             if (confidence !== undefined && confidence < MIN_RELATION_CONFIDENCE) {
                 filteredLowConfidenceRelations += 1;
                 continue;
@@ -356,8 +444,8 @@ function parseGraphExtraction(raw) {
  *
  *   Expected model output (valid JSON array, no prose):
  *     [
- *       {"entities":["ServiceA","ServiceB"],"relations":[{"from":"ServiceA","to":"ServiceB","type":"integrates with"}]},
- *       {"entities":["Terraform","Prod cluster"],"relations":[{"from":"Terraform","to":"Prod cluster","type":"provisions"}]},
+ *       {"entities":["ServiceA","ServiceB"],"relations":[["ServiceA","integrates with","ServiceB"]]},
+ *       {"entities":["Terraform","Prod cluster"],"relations":[["Terraform","provisions","Prod cluster"]]},
  *       {"entities":[],"relations":[]}
  *     ]
  *
@@ -389,10 +477,10 @@ function buildBatchUserPrompt(bodies) {
     return (`Extract entities and relations from the N=${count} assets below.\n\n` +
         `Rules:\n` +
         `- Output ONLY a JSON array of exactly ${count} objects, one per asset, preserving input order.\n` +
-        `- Each object: {"entities": ["Entity One", ...], "relations": [{"from": "A", "to": "B", "type": "uses"}, ...]}\n` +
+        `- Each object: {"entities": ["Entity One", ...], "relations": [["A", "uses", "B"], ...]}\n` +
         `- Entities are short, canonical noun phrases (project names, services, tools, people, file/dir names, technical concepts).\n` +
-        `- Relations connect two entities that both appear in that asset's entities array.\n` +
-        `- "type" is a short verb phrase (e.g. "uses", "depends on", "owns"). Optional; omit when unsure.\n` +
+        `- Each relation is a 3-element array: [from, type, to]. Relations connect two entities that both appear in that asset's entities array.\n` +
+        `- "type" is a short verb phrase (e.g. "uses", "depends on", "owns"). Use "" when unsure.\n` +
         `- Drop pleasantries, meta-commentary, and timestamps.\n` +
         `- Limit to at most ${MAX_ENTITIES_PER_ASSET} entities and ${MAX_RELATIONS_PER_ASSET} relations per asset.\n` +
         `- Use {"entities":[],"relations":[]} for assets with no extractable graph content.\n` +
@@ -504,12 +592,26 @@ export async function extractGraphFromBodies(llmRunner, bodies, signal, akmConfi
     }
     const systemPrompt = buildBatchSystemPrompt();
     const userPrompt = buildBatchUserPrompt(nonEmptyBodies);
+    // Same responseSchema lift as extractGraphFromBody (R12b), scoped to this
+    // batch's asset count so a compliant provider bounds every element's
+    // entities/relations by the same maxItems as the single-asset path.
+    const batchResponseSchema = buildBatchResponseSchema(nonEmptyBodies.length);
     const truncatedBodies = nonEmptyBodies.filter((body) => body.length > MAX_BATCH_BODY_CHARS).length;
     if (truncatedBodies > 0) {
         warnVerbose(`graph extraction (batch): ${truncatedBodies}/${nonEmptyBodies.length} asset body/bodies exceed the batch body threshold of ${MAX_BATCH_BODY_CHARS} chars.`);
     }
     let batchContextError = false;
     let nonArrayResponse = false;
+    // R2: a dead/erroring provider must not be hammered with a per-asset
+    // fallback retry for every body in the batch — that is what turned one
+    // outage into 15,453 additional retry attempts. `isTransportFailure`
+    // (shared with client.ts's `isRetryable` — see its definition) covers
+    // `provider_error`, `network_error`, and `provider_html_error`: the
+    // provider itself is failing (a dead endpoint more often raises
+    // `network_error` or `provider_html_error` than a plain 5xx), not that this
+    // particular response was malformed; skip the fallback and record every
+    // asset as failed instead.
+    let batchProviderError = false;
     const batchOutcome = await tryLlmFeature("graph_extraction", akmConfig, async () => {
         try {
             const raw = await callGraphLlm(llmRunner, [
@@ -519,6 +621,7 @@ export async function extractGraphFromBodies(llmRunner, bodies, signal, akmConfi
                 temperature: 0.1,
                 timeoutMs: llmRunner.timeoutMs,
                 signal,
+                responseSchema: batchResponseSchema,
                 onRetryAttempt: () => bumpTelemetry(options.telemetry, "retryAttempts"),
             }, options.lease, options.onNotices);
             if (!raw)
@@ -535,7 +638,12 @@ export async function extractGraphFromBodies(llmRunner, bodies, signal, akmConfi
                 const retryRaw = await callGraphLlm(llmRunner, [
                     { role: "system", content: buildBatchRetrySystemPrompt() },
                     { role: "user", content: userPrompt },
-                ], { temperature: 0, timeoutMs: llmRunner.timeoutMs, signal }, options.lease, options.onNotices);
+                ], {
+                    temperature: 0,
+                    timeoutMs: llmRunner.timeoutMs,
+                    signal,
+                    responseSchema: batchResponseSchema,
+                }, options.lease, options.onNotices);
                 parsed = retryRaw ? parseEmbeddedJsonResponse(retryRaw, { expect: "array" }) : undefined;
             }
             if (!Array.isArray(parsed)) {
@@ -564,6 +672,12 @@ export async function extractGraphFromBodies(llmRunner, bodies, signal, akmConfi
                 warn(`graph extraction (batch): context size exceeded for ${nonEmptyBodies.length} asset(s); ` +
                     `skipping batch. promptChars=${userPrompt.length}${formatContextHint(llmRunner)}`);
             }
+            else if (err instanceof LlmCallError && isTransportFailure(err)) {
+                batchProviderError = true;
+                bumpTelemetry(options.telemetry, "failureCount", nonEmptyBodies.length);
+                warn(`graph extraction (batch): provider error (${err.code}) for ${nonEmptyBodies.length} asset(s); ` +
+                    `skipping per-asset fallback retries. promptChars=${userPrompt.length}${formatContextHint(llmRunner)}: ${errMsg}`);
+            }
             else {
                 warn(`graph extraction (batch) failed for ${nonEmptyBodies.length} asset(s); ` +
                     `promptChars=${userPrompt.length}${formatContextHint(llmRunner)}: ${errMsg}`);
@@ -581,6 +695,13 @@ export async function extractGraphFromBodies(llmRunner, bodies, signal, akmConfi
     if (batchResult !== null) {
         applySuccessfulBatchResults(results, batchResult, nonEmptyBodies, nonEmptyIndices, batchState);
     }
+    else if (batchProviderError) {
+        // No per-asset fallback against a failing provider — record every asset
+        // in this batch as a genuine failure so it is neither silently empty nor
+        // retried again below.
+        for (const origIdx of nonEmptyIndices)
+            results[origIdx] = { entities: [], relations: [], status: "failed", reason: "llm_error" };
+    }
     if (batchContextError && nonEmptyBodies.length > 1) {
         const splitAt = Math.ceil(nonEmptyBodies.length / 2);
         const left = await extractGraphFromBodies(llmRunner, nonEmptyBodies.slice(0, splitAt), signal, akmConfig, onFallback, options);
@@ -601,6 +722,8 @@ export async function extractGraphFromBodies(llmRunner, bodies, signal, akmConfi
     const fallbackIndices = nonEmptyIndices.filter((_origIdx, j) => {
         if (batchContextError)
             return false; // skip individual retries on context error
+        if (batchProviderError)
+            return false; // skip individual retries against a failing provider
         // Result is still empty → needs a fallback call.
         if (batchResult === null)
             return true;
@@ -653,17 +776,34 @@ export async function extractGraphFromBody(llmRunner, body, signal, akmConfig, o
         bumpTelemetry(options.telemetry, "truncationCount", chunked.truncationCount);
         warnVerbose(`graph extraction: split a long asset into ${chunked.chunks.length} chunk(s) with ${chunked.truncationCount} hard split(s).`);
     }
-    if (chunked.chunks.length > 1) {
+    // R12b + R20: bound per-asset cost by capping how many chunks of a long
+    // asset are ever sent to the LLM. Excess chunks are dropped, never
+    // processed — the coverage loss is recorded as truncatedChunks rather than
+    // silently absorbed.
+    const maxChunksPerAsset = options.maxChunksPerAsset ?? DEFAULT_MAX_CHUNKS_PER_ASSET;
+    const cappedChunks = chunked.chunks.length > maxChunksPerAsset ? chunked.chunks.slice(0, maxChunksPerAsset) : chunked.chunks;
+    const truncatedChunkCount = chunked.chunks.length - cappedChunks.length;
+    if (truncatedChunkCount > 0) {
+        bumpTelemetry(options.telemetry, "truncatedChunks", truncatedChunkCount);
+        warnVerbose(`graph extraction: capped a long asset to ${cappedChunks.length} of ${chunked.chunks.length} chunk(s) ` +
+            `(maxChunksPerAsset=${maxChunksPerAsset}); ${truncatedChunkCount} chunk(s) not processed.`);
+    }
+    if (cappedChunks.length > 1) {
         const chunkResults = [];
-        for (const chunk of chunked.chunks) {
+        for (const chunk of cappedChunks) {
             chunkResults.push(await extractGraphFromBody(llmRunner, chunk, signal, akmConfig, onFallback, options));
         }
         const merged = mergeGraphExtractions(chunkResults);
         merged.truncationCount = (merged.truncationCount ?? 0) + chunked.truncationCount;
+        merged.truncatedChunks = (merged.truncatedChunks ?? 0) + truncatedChunkCount;
         return merged;
     }
-    const userPrompt = `${USER_PROMPT_PREFIX}${trimmedBody}`;
-    return callStructured({
+    // When capped down to exactly one chunk from a body that originally split
+    // into more, that single surviving chunk (not the full trimmedBody) is what
+    // must be sent — otherwise the cap would have no effect on prompt size.
+    const bodyForCall = truncatedChunkCount > 0 ? (cappedChunks[0] ?? trimmedBody) : trimmedBody;
+    const userPrompt = `${USER_PROMPT_PREFIX}${bodyForCall}`;
+    const result = await callStructured({
         feature: "graph_extraction",
         akmConfig,
         runner: llmRunner,
@@ -676,6 +816,7 @@ export async function extractGraphFromBody(llmRunner, body, signal, akmConfig, o
             temperature: 0.1,
             timeoutMs: llmRunner.timeoutMs,
             signal,
+            responseSchema: GRAPH_EXTRACTION_JSON_SCHEMA,
             onRetryAttempt: () => bumpTelemetry(options.telemetry, "retryAttempts"),
         },
         onNotices: options.onNotices,
@@ -718,6 +859,9 @@ export async function extractGraphFromBody(llmRunner, body, signal, akmConfig, o
         fallback: empty(),
         onFallback,
     });
+    if (truncatedChunkCount > 0)
+        result.truncatedChunks = (result.truncatedChunks ?? 0) + truncatedChunkCount;
+    return result;
 }
 // deduplicateGraph lives in src/indexer/graph/graph-dedup.ts (pure utility, no
 // LLM calls) — import it from there directly. The re-export that used to live

package/dist/scripts/akm-migrate-node.js

@@ -12792,6 +12792,7 @@ var init_schema = __esm(() => {
     content_policy_reject: true,
     unsupported_type: true,
     no_change: true,
+    quality_rejected: true,
     aborted: true
   };
   PROGRAM_RETRY_REASONS = Object.keys(RETRY_REASON_SET);
@@ -76098,6 +76099,7 @@ var IMPROVE_PROCESS_BASE_FIELDS = {
   timeoutMs: exports_external.union([positiveInt, exports_external.null()]).optional()
 };
 var allowedTypesField = exports_external.array(exports_external.string().min(1)).optional();
+var excludeRefPrefixesField = exports_external.array(exports_external.string().min(1)).optional();
 var processLimitField = positiveInt.optional();
 var qualityGateField = exports_external.object({ enabled: exports_external.boolean().optional() }).passthrough().optional();
 var contradictionDetectionField = exports_external.object({ enabled: exports_external.boolean().optional() }).passthrough().optional();
@@ -76138,6 +76140,7 @@ var antiCollapseField = exports_external.object({
 }).passthrough().optional();
 var REFLECT_PROCESS_FIELDS = {
   allowedTypes: allowedTypesField,
+  excludeRefPrefixes: excludeRefPrefixesField,
   limit: processLimitField,
   qualityGate: qualityGateField,
   lowValueFilter: lowValueFilterField
@@ -76169,7 +76172,8 @@ var GRAPH_EXTRACTION_PROCESS_FIELDS = {
   topN: positiveInt.optional(),
   includeTypes: exports_external.array(exports_external.string().min(1)).min(1).optional(),
   batchSize: positiveInt.optional(),
-  fullScan: exports_external.boolean().optional()
+  fullScan: exports_external.boolean().optional(),
+  maxChunksPerAsset: positiveInt.optional()
 };
 var EXTRACT_PROCESS_FIELDS = {
   defaultSince: exports_external.string().min(1).optional(),
@@ -76220,6 +76224,15 @@ function checkRetiredProcessKeys(value, ctx) {
     }
   }
 }
+function rejectExcludeRefPrefixesOutsideReflect(value, ctx) {
+  if ("excludeRefPrefixes" in value) {
+    ctx.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      path: ["excludeRefPrefixes"],
+      message: "excludeRefPrefixes is only valid on the reflect process"
+    });
+  }
+}
 var ImproveProcessConfigSchema = exports_external.object({
   ...IMPROVE_PROCESS_BASE_FIELDS,
   ...REFLECT_PROCESS_FIELDS,
@@ -76232,8 +76245,8 @@ var ImproveProcessConfigSchema = exports_external.object({
   ...PROACTIVE_MAINTENANCE_PROCESS_FIELDS
 }).passthrough().superRefine(checkRetiredProcessKeys);
 var ReflectProcessConfigSchema = exports_external.object({ ...IMPROVE_PROCESS_BASE_FIELDS, ...REFLECT_PROCESS_FIELDS }).passthrough().superRefine(checkRetiredProcessKeys);
-var DistillProcessConfigSchema = exports_external.object({ ...IMPROVE_PROCESS_BASE_FIELDS, ...DISTILL_PROCESS_FIELDS }).passthrough().superRefine(checkRetiredProcessKeys);
-var ConsolidateProcessConfigSchema = exports_external.object({ ...IMPROVE_PROCESS_BASE_FIELDS, ...CONSOLIDATE_PROCESS_FIELDS }).passthrough().superRefine(checkRetiredProcessKeys);
+var DistillProcessConfigSchema = exports_external.object({ ...IMPROVE_PROCESS_BASE_FIELDS, ...DISTILL_PROCESS_FIELDS }).passthrough().superRefine(checkRetiredProcessKeys).superRefine(rejectExcludeRefPrefixesOutsideReflect);
+var ConsolidateProcessConfigSchema = exports_external.object({ ...IMPROVE_PROCESS_BASE_FIELDS, ...CONSOLIDATE_PROCESS_FIELDS }).passthrough().superRefine(checkRetiredProcessKeys).superRefine(rejectExcludeRefPrefixesOutsideReflect);
 var MemoryInferenceProcessConfigSchema = exports_external.object({ ...IMPROVE_PROCESS_BASE_FIELDS, ...MEMORY_INFERENCE_PROCESS_FIELDS }).passthrough().superRefine(checkRetiredProcessKeys);
 var GraphExtractionProcessConfigSchema = exports_external.object({ ...IMPROVE_PROCESS_BASE_FIELDS, ...GRAPH_EXTRACTION_PROCESS_FIELDS }).passthrough().superRefine(checkRetiredProcessKeys);
 var ExtractProcessConfigSchema = exports_external.object({ ...IMPROVE_PROCESS_BASE_FIELDS, ...EXTRACT_PROCESS_FIELDS }).passthrough().superRefine(checkRetiredProcessKeys);
@@ -77658,6 +77671,31 @@ function upgradeConfigVersion(raw, sourcePath) {
 
 // src/core/config/config.ts
 init_legacy_source_shape_shim();
+
+// src/core/config/retired-experimental-keys-shim.ts
+init_common();
+init_warn();
+var RETIRED_EXPERIMENTAL_KEYS = ["workflowEngine"];
+function retiredExperimentalKeysIn(raw) {
+  const experimental = raw.experimental;
+  if (!isRecord(experimental))
+    return [];
+  return RETIRED_EXPERIMENTAL_KEYS.filter((key) => (key in experimental));
+}
+function stripRetiredExperimentalKeys(raw, sourcePath) {
+  const present = retiredExperimentalKeysIn(raw);
+  if (present.length === 0)
+    return raw;
+  const original = raw.experimental;
+  const experimental = { ...original };
+  for (const key of present)
+    delete experimental[key];
+  const where = sourcePath ? ` at ${sourcePath}` : "";
+  warnOnce(`config:retired-experimental-key${sourcePath ? `:${sourcePath}` : ""}`, `Config${where} uses the retired experimental key(s) ${present.join(", ")} — ignored in memory. Run \`akm migrate apply\` to remove ${present.length === 1 ? "it" : "them"} from the config file and silence this warning.`);
+  return { ...raw, experimental };
+}
+
+// src/core/config/config.ts
 init_paths();
 init_warn();
 var DEFAULT_CONFIG = {
@@ -77717,7 +77755,8 @@ function loadUserConfig() {
 function runConfigFilePipeline(text, sourcePath) {
   const versioned = upgradeConfigVersion(parseConfigText(text, sourcePath), sourcePath);
   const parsedRaw = migrateLegacySourceShape(versioned, sourcePath);
-  return liftExtraParamsOrThrow(parsedRaw, sourcePath);
+  const liftedRaw = liftExtraParamsOrThrow(parsedRaw, sourcePath);
+  return stripRetiredExperimentalKeys(liftedRaw, sourcePath);
 }
 function liftExtraParamsOrThrow(parsedRaw, sourcePath) {
   const where = sourcePath ? ` at ${sourcePath}` : "";
@@ -86376,8 +86415,11 @@ function assertAkmAssetWrite(source, allowedAdapters = ["akm"]) {
     return;
   throw new UsageError(`Bundle "${source.name}" uses adapter "${source.adapterId}", which does not support AKM asset writes.`, "INVALID_FLAG_VALUE");
 }
+function isWriteCapableSourceKind(kind) {
+  return kind === "filesystem" || kind === "git";
+}
 function adaptConfiguredSource(runtime) {
-  if (runtime.type !== "filesystem" && runtime.type !== "git") {
+  if (!isWriteCapableSourceKind(runtime.type)) {
     throw new ConfigError(`write-source: source "${runtime.name}" has unsupported kind "${runtime.type}" for writes. ` + "Writes are only defined for `filesystem` and `git` sources.", "INVALID_CONFIG_FILE", 'Use `kind: "filesystem"` or `kind: "git"` for writable sources.');
   }
   const kind = runtime.type;
@@ -93213,32 +93255,7 @@ var GLOBAL_OUTPUT_ARGS2 = {
 init_errors();
 
 // scripts/akm-migrate/help.txt
-var help_default = `Usage: akm-migrate <command> [options]
-
-The one migration tool for an akm installation. Every historical shape akm
-has ever written lives here; the CLI proper reads only current schemas.
-\`status\` and \`apply\` run every step, in order, and print one combined JSON
-plan (exit 1 when any step is blocked):
-
-  1. legacy config \`extraParams\` keys lifted onto first-class engine fields
-  2. scheduler grants bound to the configured source installation that was
-     approved (stale grants whose bundle no longer exists are removed)
-  3. pending state.db migrations, historical-destructive ones included,
-     with a verified sibling safety copy (the only path that admits them)
-  4. task-v2 files to task v3, then task-v3 files to task source v4
-  5. superseded pre-0.9.0 \`.akm\` residue and stale filesystem transactions
-  6. live \`.akm\` writers relocated to \`$STATE\`/\`$CACHE\`, for every local
-     bundle (distill-rejected, eval-cases, measurement verdicts, and stale
-     improve-pipeline locks — a lock a live run still holds is left alone)
-
-\`akm migrate status|apply\` wraps this executable; \`akm upgrade\` runs
-\`apply\` after its install step, so an image that ships akm can put either
-in its entrypoint (a current installation is a no-op).
-
-Commands:
-  status              Inspect every pending migration without changing anything.
-  apply [--dry-run]   Back up and apply every pending migration.
-`;
+var help_default = "Usage: akm-migrate <command> [options]\n\nThe one migration tool for an akm installation. Every historical shape akm\nhas ever written lives here; the CLI proper reads only current schemas.\n`status` and `apply` run every step, in order, and print one combined JSON\nplan (exit 1 when any step is blocked):\n\n  1. legacy config `extraParams` keys lifted onto first-class engine fields\n  2. retired `experimental.*` config keys removed (today `workflowEngine`)\n  3. scheduler grants bound to the configured source installation that was\n     approved (stale grants whose bundle no longer exists are removed)\n  4. pending state.db migrations, historical-destructive ones included,\n     with a verified sibling safety copy (the only path that admits them)\n  5. source-owned schedule enablement converted to host-local scheduler\n     grants\n  6. task-v2 files to task v3, then task-v3 files to task source v4\n  7. superseded pre-0.9.0 `.akm` residue and stale filesystem transactions\n  8. live `.akm` writers relocated to `$STATE`/`$CACHE`, for every local\n     bundle (distill-rejected, eval-cases, measurement verdicts, and stale\n     improve-pipeline locks — a lock a live run still holds is left alone)\n\n`akm migrate status|apply` wraps this executable; `akm upgrade` runs\n`apply` after its install step, so an image that ships akm can put either\nin its entrypoint (a current installation is a no-op).\n\nCommands:\n  status              Inspect every pending migration without changing anything.\n  apply [--dry-run]   Back up and apply every pending migration.\n";
 
 // scripts/akm-migrate/run-migrate.ts
 init_common();
@@ -94774,10 +94791,44 @@ function applyConfigExtraParamsLift(configPath) {
   return { applied: true, lifted, conflicts: [] };
 }
 
+// scripts/akm-migrate/migrate/config-retired-experimental-keys.ts
+function readRawConfig2(configPath) {
+  const text = readConfigText(configPath);
+  if (text === undefined)
+    return;
+  return parseConfigText(text, configPath);
+}
+function findConfigRetiredExperimentalKeys(configPath) {
+  const raw = readRawConfig2(configPath);
+  if (!raw)
+    return { removed: [] };
+  return { removed: retiredExperimentalKeysIn(raw).map((key) => `experimental.${key}`) };
+}
+function applyConfigRetiredExperimentalKeys(configPath) {
+  const raw = readRawConfig2(configPath);
+  if (!raw)
+    return { applied: false, removed: [] };
+  const retired = retiredExperimentalKeysIn(raw);
+  if (retired.length === 0)
+    return { applied: false, removed: [] };
+  const experimental = { ...raw.experimental };
+  for (const key of retired)
+    delete experimental[key];
+  const config = { ...raw, experimental };
+  const release = acquireConfigLock();
+  try {
+    backupExistingConfig(configPath);
+    writeConfigAtomic(configPath, config);
+  } finally {
+    release();
+  }
+  return { applied: true, removed: retired.map((key) => `experimental.${key}`) };
+}
+
 // scripts/akm-migrate/migrate/config-scheduler-source-ids.ts
 init_asset_ref();
 init_bundle_id();
-function readRawConfig2(configPath) {
+function readRawConfig3(configPath) {
   const text = readConfigText(configPath);
   return text === undefined ? undefined : parseConfigText(text, configPath);
 }
@@ -94832,13 +94883,13 @@ function implicitBundleSourceId(raw, bundleId) {
   return implicitId === bundleId ? filesystemBundleSourceId(root) : undefined;
 }
 function findConfigSchedulerSourceIdMigration(configPath) {
-  const raw = readRawConfig2(configPath);
+  const raw = readRawConfig3(configPath);
   return Object.freeze({ changes: Object.freeze(raw ? migrationChanges(raw) : []) });
 }
 function applyConfigSchedulerSourceIdMigration(configPath) {
   const release = acquireConfigLock();
   try {
-    const raw = readRawConfig2(configPath);
+    const raw = readRawConfig3(configPath);
     if (!raw)
       return Object.freeze({ applied: false, changes: Object.freeze([]) });
     const changes = migrationChanges(raw);
@@ -97986,7 +98037,7 @@ var GATE_OUTCOMES = {
   "auto-rejected": true
 };
 function validatePresentMetadata(meta) {
-  const stringFields = ["sourceRun", "beforeHash", "backupContent"];
+  const stringFields = ["sourceRun", "beforeHash", "beforeHashNormalized", "backupContent"];
   for (const field of stringFields) {
     if (Object.hasOwn(meta, field) && typeof meta[field] !== "string")
       invalidPresentField(field);
@@ -98066,6 +98117,7 @@ function proposalRowToProposal(row) {
     changes,
     ...proposedTarget !== undefined ? { proposedTarget } : {},
     ...typeof meta.beforeHash === "string" ? { beforeHash: meta.beforeHash } : {},
+    ...typeof meta.beforeHashNormalized === "string" ? { beforeHashNormalized: meta.beforeHashNormalized } : {},
     ...meta.review !== undefined ? { review: meta.review } : {},
     ...typeof meta.confidence === "number" ? { confidence: meta.confidence } : {},
     ...meta.gateDecision !== undefined ? { gateDecision: meta.gateDecision } : {},
@@ -98092,6 +98144,8 @@ function proposalToRowValues(proposal, stashDir) {
     metaObj.proposedTarget = currentProposalTarget(proposal.proposedTarget);
   if (proposal.beforeHash !== undefined)
     metaObj.beforeHash = proposal.beforeHash;
+  if (proposal.beforeHashNormalized !== undefined)
+    metaObj.beforeHashNormalized = proposal.beforeHashNormalized;
   if (proposal.sourceRun !== undefined)
     metaObj.sourceRun = proposal.sourceRun;
   if (proposal.review !== undefined)
@@ -104055,12 +104109,16 @@ async function runMigration(options) {
   if (apply && configExtraParams.applied)
     resetConfigCache();
   const pendingLift = apply ? undefined : configExtraParams.pending;
+  const configRetiredExperimentalKeys = apply ? applyConfigRetiredExperimentalKeys(configPath) : { pending: findConfigRetiredExperimentalKeys(configPath) };
+  if (apply && configRetiredExperimentalKeys.applied)
+    resetConfigCache();
   if (pendingLift && pendingLift.lifted.length > 0) {
     return {
       schemaVersion: 1,
       status: "blocked",
       blockers: pendingLift.lifted,
       configExtraParams,
+      configRetiredExperimentalKeys,
       stateMigrations: { pending: listPendingStateMigrations() }
     };
   }
@@ -104075,6 +104133,7 @@ async function runMigration(options) {
       blockers: pendingSchedulerBindings.changes.map((change) => `${change.kind === "bind" ? "bind" : "drop"} scheduler activation ${change.ref}` + (change.reason ? `: ${change.reason}` : "")),
       configExtraParams,
       configSchedulerSourceIds,
+      configRetiredExperimentalKeys,
       stateMigrations: { pending: listPendingStateMigrations() }
     };
   }
@@ -104094,12 +104153,14 @@ async function runMigration(options) {
   }
   const stateStatus = "pending" in stateMigrations && stateMigrations.pending.length > 0 ? "ready" : "current";
   const schedulerStatus = "pending" in schedulerActivation && schedulerActivation.pending.length > 0 ? "ready" : "current";
+  const retiredKeysStatus = "pending" in configRetiredExperimentalKeys && configRetiredExperimentalKeys.pending.removed.length > 0 ? "ready" : "current";
   return {
     schemaVersion: 1,
-    status: worstStatus(worstStatus(worstStatus(taskV3.status, taskV4.status), stateStatus), schedulerStatus),
+    status: worstStatus(worstStatus(worstStatus(worstStatus(taskV3.status, taskV4.status), stateStatus), schedulerStatus), retiredKeysStatus),
     blockers: [...taskV3.blockers, ...taskV4.blockers],
     configExtraParams,
     configSchedulerSourceIds,
+    configRetiredExperimentalKeys,
     stateMigrations,
     schedulerActivation,
     taskV3Migration: taskV3.taskV3Migration,