chati-dev 4.4.1 → 4.5.1

package/src/installer-v2/index.js

@@ -0,0 +1,301 @@
+/**
+ * Installer v2 is deliberately a planner, not an installer.
+ *
+ * It creates one provider-neutral installation artifact, inspects a target for
+ * legacy v1 markers, and returns a migration/rollback plan. Artifact writes
+ * are explicit through installV2 or authorized migrateV2. It never invokes a
+ * provider CLI or reads credentials.
+ */
+import { existsSync, mkdirSync, writeFileSync, renameSync, readFileSync, copyFileSync } from 'node:fs';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { canonicalize, canonicalSerialize, sha256, ContractError } from '@chati/core';
+import { validateInstallation } from '@chati/provider-registry';
+
+export const INSTALLATION_SCHEMA_VERSION = 2;
+export const INSTALLATION_ARTIFACT_PATH = '.chati/v2/installation.json';
+
+const V1_MARKERS = Object.freeze([
+  { provider_id: 'anthropic', harness_id: 'claude', path: '.claude/settings.json' },
+  { provider_id: 'anthropic', harness_id: 'claude', path: 'CLAUDE.local.md' },
+  { provider_id: 'openai', harness_id: 'codex', path: '.codex/config.toml' },
+  { provider_id: 'xai', harness_id: 'grok', path: '.grok/config.json' },
+  { provider_id: null, harness_id: null, path: '.chati/session.yaml' },
+]);
+
+const PROVIDER_SPECIFIC_ROOT_FILES = new Set([
+  'claude.md', 'claude.local.md', 'codex.md', 'codex.local.md', 'grok.md', 'grok.local.md',
+  '.claude.lock', '.codex.lock', '.grok.lock',
+]);
+
+function assertObject(value, code, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new ContractError(code, `${label} must be an object`);
+}
+
+function assertString(value, code, label) {
+  if (typeof value !== 'string' || value.trim() === '') throw new ContractError(code, `${label} must be a non-empty string`);
+}
+
+function readClock(clock) {
+  if (typeof clock !== 'function') throw new ContractError('MISSING_CLOCK', 'a deterministic clock function is required');
+  const result = clock();
+  const date = result instanceof Date ? result : new Date(result);
+  if (Number.isNaN(date.getTime())) throw new ContractError('INVALID_CLOCK', 'clock must return a valid timestamp');
+  return date.toISOString();
+}
+
+function ensureRelativePath(path) {
+  assertString(path, 'INVALID_MANAGED_PATH', 'managed path');
+  const normalized = path.replaceAll('\\', '/');
+  const root = normalized.split('/')[0];
+  if (normalized.startsWith('/') || normalized.split('/').includes('..')) {
+    throw new ContractError('INVALID_MANAGED_PATH', 'managed path must remain inside the project');
+  }
+  if (['.claude', '.codex', '.grok'].includes(root)) {
+    throw new ContractError('PROVIDER_SPECIFIC_MANAGED_PATH', 'installer v2 may not manage provider-specific configuration paths');
+  }
+  if (PROVIDER_SPECIFIC_ROOT_FILES.has(root.toLowerCase())) {
+    throw new ContractError('PROVIDER_SPECIFIC_MANAGED_PATH', 'installer v2 may not manage provider-specific root markers or locks');
+  }
+  return normalized;
+}
+
+function normalizeBrainReadCapability(capability) {
+  if (capability === undefined || capability === null || capability === false) return { status: 'not-configured' };
+  assertObject(capability, 'INVALID_BRAIN_CAPABILITY', 'brain_read_capability');
+  if (capability.status === 'not-configured') return { status: 'not-configured' };
+  if (capability.mode !== 'read-only') throw new ContractError('BRAIN_WRITE_FORBIDDEN', 'installer v2 permits only a read-only Brain capability');
+  assertString(capability.policy_ref, 'INVALID_BRAIN_CAPABILITY', 'brain_read_capability.policy_ref');
+  return { status: 'configured', mode: 'read-only', policy_ref: capability.policy_ref };
+}
+
+function artifactCore(input, createdAt) {
+  assertObject(input, 'INVALID_INSTALLATION', 'installation input');
+  assertObject(input.installation, 'INVALID_INSTALLATION', 'installation');
+  assertObject(input.capability_snapshot, 'INVALID_CATALOG', 'capability_snapshot');
+  assertString(input.project_id, 'INVALID_INSTALLATION', 'project_id');
+  const installation = validateInstallation(input.installation, input.capability_snapshot, { clock: () => createdAt });
+  const brain_read_capability = normalizeBrainReadCapability(input.brain_read_capability);
+  const managed_paths = (input.managed_paths ?? [INSTALLATION_ARTIFACT_PATH]).map(ensureRelativePath);
+  if (!managed_paths.includes(INSTALLATION_ARTIFACT_PATH)) managed_paths.unshift(INSTALLATION_ARTIFACT_PATH);
+  if (new Set(managed_paths).size !== managed_paths.length) throw new ContractError('DUPLICATE_MANAGED_PATH', 'managed_paths must be unique');
+  const selectedModelKeys = new Set(installation.enabled_providers.flatMap((binding) =>
+    binding.allowed_models.map((model_id) => `${binding.provider_id}:${model_id}`),
+  ));
+  const capability_snapshot = {
+    // This is a projection, not a catalog copy. Keep only attributes needed by
+    // the installation contract and only models explicitly selected by a binding.
+    snapshot_id: input.capability_snapshot.snapshot_id,
+    expires_at: input.capability_snapshot.expires_at,
+    models: input.capability_snapshot.models
+      .filter((model) => selectedModelKeys.has(`${model.provider_id}:${model.model_id}`))
+      .map(({ provider_id, model_id, actions, adjudication_priority, highest_reasoning_configuration }) => ({
+        provider_id,
+        model_id,
+        actions,
+        ...(adjudication_priority !== undefined ? { adjudication_priority } : {}),
+        ...(highest_reasoning_configuration !== undefined ? { highest_reasoning_configuration } : {}),
+      })),
+  };
+  return {
+    schema_version: INSTALLATION_SCHEMA_VERSION,
+    artifact_type: 'chati-installation',
+    project_id: input.project_id,
+    created_at: createdAt,
+    installation,
+    // An artifact exposes no capability information for providers not selected
+    // during installation. The full catalog remains an input, never an output.
+    capability_snapshot,
+    brain_read_capability,
+    managed_paths,
+  };
+}
+
+/** Creates a deterministic provider-neutral artifact. It never installs it. */
+export function createInstallationArtifact(input, { clock = () => new Date(), artifactId } = {}) {
+  const core = artifactCore(input, readClock(clock));
+  const digest = sha256(core);
+  const installation_artifact_id = artifactId ?? `install-v2-${digest.slice(0, 16)}`;
+  assertString(installation_artifact_id, 'INVALID_INSTALLATION', 'installation_artifact_id');
+  return Object.freeze(canonicalize({ ...core, installation_artifact_id, digest }));
+}
+
+/** Validates an artifact without inspecting provider-specific configuration files. */
+export function doctorV2(artifact, { clock = () => new Date() } = {}) {
+  const checks = [];
+  try {
+    assertObject(artifact, 'INVALID_ARTIFACT', 'artifact');
+    if (artifact.schema_version !== INSTALLATION_SCHEMA_VERSION || artifact.artifact_type !== 'chati-installation') {
+      throw new ContractError('UNSUPPORTED_INSTALLATION_ARTIFACT', 'expected a chati installation artifact v2');
+    }
+    const { digest, installation_artifact_id, ...core } = artifact;
+    assertString(installation_artifact_id, 'INVALID_ARTIFACT', 'installation_artifact_id');
+    if (sha256(core) !== digest) throw new ContractError('INSTALLATION_ARTIFACT_DRIFT', 'installation artifact digest does not match its content');
+    validateInstallation(artifact.installation, artifact.capability_snapshot, { clock: () => readClock(clock) });
+    normalizeBrainReadCapability(artifact.brain_read_capability);
+    if (!Array.isArray(artifact.managed_paths) || !artifact.managed_paths.every((path) => ensureRelativePath(path))) {
+      throw new ContractError('INVALID_MANAGED_PATH', 'managed_paths must be valid project-relative paths');
+    }
+    checks.push({ name: 'artifact', status: 'pass', message: 'artifact schema and digest are valid' });
+    checks.push({ name: 'selected-bindings', status: 'pass', message: 'only explicitly selected provider/harness bindings are present' });
+    checks.push({ name: 'brain-capability', status: 'pass', message: 'Brain capability is absent or read-only' });
+  } catch (error) {
+    checks.push({ name: 'artifact', status: 'fail', code: error.code ?? 'INVALID_ARTIFACT', message: error.message });
+  }
+  return Object.freeze({ schema_version: 1, doctor: 'chati-installation-v2', passed: checks.every((check) => check.status === 'pass'), checks });
+}
+
+/** Read-only detector for known v1 footprints. Marker presence never enables a provider. */
+export function detectV1Installation(projectDir, { exists = existsSync } = {}) {
+  assertString(projectDir, 'INVALID_PROJECT_DIR', 'projectDir');
+  if (typeof exists !== 'function') throw new ContractError('INVALID_DETECTOR', 'exists must be a function');
+  const markers = V1_MARKERS.filter((marker) => exists(join(projectDir, marker.path))).map((marker) => ({ ...marker }));
+  const bindings = markers
+    .filter((marker) => marker.provider_id)
+    .map(({ provider_id, harness_id }) => ({ provider_id, harness_id }))
+    .filter((binding, index, all) => all.findIndex((entry) => entry.provider_id === binding.provider_id && entry.harness_id === binding.harness_id) === index);
+  return Object.freeze({ detector_version: 1, detected: markers.length > 0, markers, detected_bindings: bindings });
+}
+
+/** Builds a backup plan only. The caller must separately authorize and execute any write. */
+export function createBackupPlan(projectDir, detector, artifact) {
+  assertString(projectDir, 'INVALID_PROJECT_DIR', 'projectDir');
+  assertObject(detector, 'INVALID_DETECTOR', 'detector');
+  assertObject(artifact, 'INVALID_ARTIFACT', 'artifact');
+  const backup_id = `backup-v2-${artifact.digest.slice(0, 16)}`;
+  const entries = detector.markers.map((marker) => ({ source_path: marker.path, backup_path: `.chati/v2/backups/${backup_id}/${marker.path}` }));
+  return Object.freeze(canonicalize({ schema_version: 1, backup_id, project_dir: resolve(projectDir), entries, write_required: false }));
+}
+
+/** Produces the inverse of a future authorized migration, without performing either operation. */
+export function createRollbackPlan(artifact, backupPlan) {
+  assertObject(artifact, 'INVALID_ARTIFACT', 'artifact');
+  assertObject(backupPlan, 'INVALID_BACKUP_PLAN', 'backupPlan');
+  return Object.freeze(canonicalize({
+    schema_version: 1,
+    rollback_id: `rollback-v2-${artifact.digest.slice(0, 16)}`,
+    installation_artifact_id: artifact.installation_artifact_id,
+    backup_id: backupPlan.backup_id,
+    restore_entries: backupPlan.entries,
+    remove_created_paths: artifact.managed_paths,
+    requires_explicit_authorization: true,
+    write_required: false,
+  }));
+}
+
+/**
+ * Read-only migration preview. It does not write a v2 artifact or back up v1.
+ * Re-running with the same inputs returns the same plans and does not duplicate
+ * provider bindings or managed paths.
+ */
+export function dryRunV2(input, { projectDir, clock = () => new Date(), exists = existsSync } = {}) {
+  assertString(projectDir, 'INVALID_PROJECT_DIR', 'projectDir');
+  const artifact = createInstallationArtifact(input, { clock });
+  const doctor = doctorV2(artifact, { clock });
+  const detector = detectV1Installation(projectDir, { exists });
+  const backup_plan = createBackupPlan(projectDir, detector, artifact);
+  const rollback_plan = createRollbackPlan(artifact, backup_plan);
+  const configured = new Set(artifact.installation.enabled_providers.map(({ provider_id, harness_id }) => `${provider_id}:${harness_id}`));
+  const incompatibilities = detector.detected_bindings
+    .filter(({ provider_id, harness_id }) => !configured.has(`${provider_id}:${harness_id}`))
+    .map(({ provider_id, harness_id }) => ({ code: 'V1_BINDING_NOT_SELECTED', provider_id, harness_id, message: 'legacy marker is not a selected v2 binding' }));
+  const pathOutsideProject = artifact.managed_paths.some((managedPath) => relative(resolve(projectDir), resolve(projectDir, managedPath)).split(sep).includes('..'));
+  if (pathOutsideProject) throw new ContractError('INVALID_MANAGED_PATH', 'managed path resolves outside project');
+  return Object.freeze(canonicalize({ schema_version: 1, mode: 'dry-run', writes_performed: false, artifact, doctor, detector, backup_plan, rollback_plan, incompatibilities }));
+}
+
+/** Explicit v2 installation. It writes only the provider-neutral artifact path. */
+export function installV2(input, { projectDir, clock = () => new Date(), exists = existsSync } = {}) {
+  const report = dryRunV2(input, { projectDir, clock, exists });
+  const artifactPath = join(projectDir, INSTALLATION_ARTIFACT_PATH);
+  const directory = join(projectDir, '.chati', 'v2');
+  mkdirSync(directory, { recursive: true });
+  const serialized = `${canonicalSerialize(report.artifact)}\n`;
+  if (existsSync(artifactPath)) {
+    const existing = readFileSync(artifactPath, 'utf8');
+    if (existing === serialized) return Object.freeze(canonicalize({ ...report, mode: 'installed', writes_performed: false, artifact_path: INSTALLATION_ARTIFACT_PATH }));
+    throw new ContractError('INSTALLATION_ARTIFACT_EXISTS', 'existing v2 artifact differs; use an explicit migration or rollback flow');
+  }
+  const temporary = `${artifactPath}.tmp-${process.pid}`;
+  writeFileSync(temporary, serialized, { encoding: 'utf8', flag: 'wx' });
+  renameSync(temporary, artifactPath);
+  return Object.freeze(canonicalize({ ...report, mode: 'installed', writes_performed: true, artifact_path: INSTALLATION_ARTIFACT_PATH }));
+}
+
+/**
+ * Explicitly replaces an existing v2 artifact after preserving its exact
+ * bytes in the project-local backup store. Provider-specific files are never
+ * read or rewritten by this operation.
+ */
+export function reconfigureV2(input, { projectDir, clock = () => new Date(), exists = existsSync } = {}) {
+  const report = dryRunV2(input, { projectDir, clock, exists });
+  const artifactPath = join(projectDir, INSTALLATION_ARTIFACT_PATH);
+  if (!existsSync(artifactPath)) return installV2(input, { projectDir, clock, exists });
+  const existing = readFileSync(artifactPath, 'utf8');
+  let existingArtifact;
+  try { existingArtifact = JSON.parse(existing); } catch (error) {
+    throw new ContractError('EXISTING_INSTALLATION_CORRUPT', `existing v2 artifact is not valid JSON: ${error.message}`);
+  }
+  if (existingArtifact?.schema_version !== INSTALLATION_SCHEMA_VERSION || existingArtifact?.artifact_type !== 'chati-installation') {
+    throw new ContractError('EXISTING_INSTALLATION_CORRUPT', 'existing v2 artifact has an unsupported schema');
+  }
+  const backupId = `reconfigure-${sha256({ previous: existingArtifact.digest, next: report.artifact.digest }).slice(0, 20)}`;
+  const backupPath = join(projectDir, '.chati', 'v2', 'backups', backupId, 'installation.json');
+  mkdirSync(dirname(backupPath), { recursive: true });
+  if (existsSync(backupPath) && readFileSync(backupPath, 'utf8') !== existing) {
+    throw new ContractError('RECONFIGURE_BACKUP_CONFLICT', 'reconfiguration backup path contains different material');
+  }
+  if (!existsSync(backupPath)) writeFileSync(backupPath, existing, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+  const serialized = `${canonicalSerialize(report.artifact)}\n`;
+  const temporary = `${artifactPath}.tmp-${process.pid}`;
+  writeFileSync(temporary, serialized, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+  renameSync(temporary, artifactPath);
+  return Object.freeze(canonicalize({
+    ...report,
+    mode: 'reconfigured',
+    writes_performed: true,
+    artifact_path: INSTALLATION_ARTIFACT_PATH,
+    backup_path: relative(projectDir, backupPath).replaceAll('\\', '/'),
+    provider_specific_files_rewritten: false,
+  }));
+}
+
+/**
+ * Performs the narrow, explicit v4 to v2 activation. It backs up detected
+ * legacy markers, writes the provider-neutral artifact, and never rewrites a
+ * provider-specific configuration file.
+ */
+export function migrateV2(input, { projectDir, authorize = false, clock = () => new Date(), exists = existsSync } = {}) {
+  const preview = dryRunV2(input, { projectDir, clock, exists });
+  if (authorize !== true) {
+    return Object.freeze(canonicalize({ ...preview, mode: 'migration-preview', writes_performed: false, requires_explicit_authorization: true }));
+  }
+
+  const artifactPath = join(projectDir, INSTALLATION_ARTIFACT_PATH);
+  if (existsSync(artifactPath)) {
+    const expected = `${canonicalSerialize(preview.artifact)}\n`;
+    if (readFileSync(artifactPath, 'utf8') !== expected) {
+      throw new ContractError('INSTALLATION_ARTIFACT_EXISTS', 'existing v2 artifact differs; use an explicit rollback flow');
+    }
+  }
+
+  const backed_up = [];
+  for (const entry of preview.backup_plan.entries) {
+    const source = join(projectDir, entry.source_path);
+    const destination = join(projectDir, entry.backup_path);
+    if (!existsSync(source) || existsSync(destination)) continue;
+    mkdirSync(dirname(destination), { recursive: true });
+    copyFileSync(source, destination, 0);
+    backed_up.push(entry);
+  }
+  const installed = installV2(input, { projectDir, clock, exists });
+  return Object.freeze(canonicalize({
+    ...preview,
+    mode: 'migrated',
+    writes_performed: installed.writes_performed || backed_up.length > 0,
+    backed_up,
+    artifact_path: installed.artifact_path,
+    provider_specific_files_rewritten: false,
+  }));
+}
+
+export { canonicalSerialize };

package/src/installer-v2/model-catalog-envelope.json

@@ -0,0 +1,59 @@
+{
+  "catalog": {
+    "snapshot_id": "chati-model-catalog-2026-08-26",
+    "expires_at": "2026-11-24T00:00:00.000Z",
+    "models": [
+      {
+        "provider_id": "anthropic",
+        "model_id": "fable",
+        "actions": [
+          "discovery",
+          "planning",
+          "build",
+          "review",
+          "adjudication"
+        ],
+        "adjudication_priority": 100,
+        "highest_reasoning_configuration": "xhigh"
+      },
+      {
+        "provider_id": "openai",
+        "model_id": "gpt-5.6-sol",
+        "actions": [
+          "discovery",
+          "planning",
+          "build",
+          "review",
+          "adjudication"
+        ],
+        "adjudication_priority": 100,
+        "highest_reasoning_configuration": "xhigh"
+      },
+      {
+        "provider_id": "xai",
+        "model_id": "grok-4.6",
+        "actions": [
+          "discovery",
+          "planning",
+          "build",
+          "review",
+          "adjudication"
+        ],
+        "adjudication_priority": 100,
+        "highest_reasoning_configuration": "xhigh"
+      },
+      {
+        "provider_id": "xai",
+        "model_id": "grok-4.5",
+        "actions": [
+          "discovery",
+          "planning",
+          "build",
+          "review"
+        ],
+        "adjudication_priority": 50
+      }
+    ]
+  },
+  "signature": "p7nTZ2/WlWVWeuqt2eKFTXnSEKZX0X6EM7C0T30+syGV09qjM8soj11U7G4Wjl9u5W6cwEErJZCXdP8WgXHeBA=="
+}

package/src/installer-v2/model-catalog.json

@@ -0,0 +1,33 @@
+{
+  "snapshot_id": "chati-model-catalog-2026-08-26",
+  "expires_at": "2026-11-24T00:00:00.000Z",
+  "models": [
+    {
+      "provider_id": "anthropic",
+      "model_id": "fable",
+      "actions": ["discovery", "planning", "build", "review", "adjudication"],
+      "adjudication_priority": 100,
+      "highest_reasoning_configuration": "xhigh"
+    },
+    {
+      "provider_id": "openai",
+      "model_id": "gpt-5.6-sol",
+      "actions": ["discovery", "planning", "build", "review", "adjudication"],
+      "adjudication_priority": 100,
+      "highest_reasoning_configuration": "xhigh"
+    },
+    {
+      "provider_id": "xai",
+      "model_id": "grok-4.6",
+      "actions": ["discovery", "planning", "build", "review", "adjudication"],
+      "adjudication_priority": 100,
+      "highest_reasoning_configuration": "xhigh"
+    },
+    {
+      "provider_id": "xai",
+      "model_id": "grok-4.5",
+      "actions": ["discovery", "planning", "build", "review"],
+      "adjudication_priority": 50
+    }
+  ]
+}

package/src/installer-v2/model-catalog.sig

@@ -0,0 +1 @@
+p7nTZ2/WlWVWeuqt2eKFTXnSEKZX0X6EM7C0T30+syGV09qjM8soj11U7G4Wjl9u5W6cwEErJZCXdP8WgXHeBA==

package/src/installer-v2/wizard-installation.js

@@ -0,0 +1,115 @@
+import { sha256 } from '@chati/core';
+
+const PROVIDER_BINDINGS = Object.freeze({
+  claude: Object.freeze({ provider_id: 'anthropic', harness_id: 'claude', default_model: 'fable' }),
+  codex: Object.freeze({ provider_id: 'openai', harness_id: 'codex', default_model: 'gpt-5.6-sol' }),
+  grok: Object.freeze({ provider_id: 'xai', harness_id: 'grok', default_model: 'grok-4.6' }),
+});
+
+/**
+ * Bootstrap suggestions used only when the installer has no fresh capability
+ * catalog. The selected values are always written explicitly to C-01.
+ */
+export const wizardDefaultModels = Object.freeze(Object.fromEntries(
+  Object.entries(PROVIDER_BINDINGS).map(([provider, binding]) => [provider, binding.default_model])
+));
+
+const V2_ACTIONS = Object.freeze(['discovery', 'planning', 'build', 'review', 'adjudication']);
+
+function fail(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  throw error;
+}
+
+function normalizeModels(provider, selections) {
+  const value = selections?.[provider];
+  const values = value === undefined ? [PROVIDER_BINDINGS[provider].default_model] : (Array.isArray(value) ? value : [value]);
+  const models = [...new Set(values.map((model) => typeof model === 'string' ? model.trim() : '').filter(Boolean))];
+  if (models.length === 0) fail('WIZARD_MODEL_REQUIRED', `${provider} requires at least one selected model`);
+  return models;
+}
+
+export function wizardModelSuggestions(provider, capabilityCatalog) {
+  const binding = PROVIDER_BINDINGS[provider];
+  if (!binding) fail('V2_PROVIDER_UNSUPPORTED', `${provider} is not supported by v2`);
+  const models = capabilityCatalog?.models
+    ?.filter((model) => model.provider_id === binding.provider_id)
+    .sort((left, right) => (right.adjudication_priority ?? 0) - (left.adjudication_priority ?? 0))
+    .map((model) => model.model_id);
+  return Object.freeze(models?.length ? [...new Set(models)] : [binding.default_model]);
+}
+
+/**
+ * Builds the explicit C-01 input consumed by installV2. This deliberately does
+ * not inspect installed binaries or silently add a provider. A future catalog
+ * refresh may replace defaults, but its result must be supplied as selections.
+ */
+export function buildWizardV2InstallationInput({
+  projectName,
+  selectedProviders,
+  primaryProvider,
+  modelSelections = {},
+  capabilityCatalog,
+  profile = 'other-supported-profile',
+  clock = () => new Date(),
+} = {}) {
+  if (typeof projectName !== 'string' || !projectName.trim()) fail('WIZARD_PROJECT_REQUIRED', 'projectName is required');
+  if (!Array.isArray(selectedProviders) || selectedProviders.length === 0) fail('WIZARD_PROVIDER_REQUIRED', 'at least one v2 provider is required');
+  const providers = [...new Set(selectedProviders)];
+  for (const provider of providers) if (!PROVIDER_BINDINGS[provider]) fail('V2_PROVIDER_UNSUPPORTED', `${provider} is not supported by v2`);
+  if (!providers.includes(primaryProvider)) fail('WIZARD_PRIMARY_PROVIDER_REQUIRED', 'primaryProvider must be selected');
+  const now = clock();
+  const issuedAt = (now instanceof Date ? now : new Date(now));
+  if (Number.isNaN(issuedAt.getTime())) fail('WIZARD_CLOCK_INVALID', 'clock must return a valid time');
+  const localExpiry = issuedAt.getTime() + (7 * 24 * 60 * 60 * 1000);
+  const sourceExpiry = capabilityCatalog ? Date.parse(capabilityCatalog.expires_at) : localExpiry;
+  if (Number.isNaN(sourceExpiry) || sourceExpiry <= issuedAt.getTime()) fail('WIZARD_CATALOG_EXPIRED', 'capability catalog is expired');
+  // A verified signed catalog keeps its authoritative expiry. The short local
+  // TTL applies only to the unsigned bootstrap seam used by direct API tests.
+  const expiresAt = new Date(capabilityCatalog ? sourceExpiry : localExpiry).toISOString();
+  const sourceCatalogId = capabilityCatalog?.snapshot_id || 'bootstrap';
+  const enabled_providers = providers.map((provider) => {
+    const binding = PROVIDER_BINDINGS[provider];
+    return {
+      provider_id: binding.provider_id,
+      harness_id: binding.harness_id,
+      allowed_models: normalizeModels(provider, modelSelections),
+      allowed_reasoning_configurations: ['low', 'medium', 'high', 'xhigh'],
+    };
+  });
+  const primary = PROVIDER_BINDINGS[primaryProvider];
+  const models = enabled_providers.flatMap((binding) => binding.allowed_models.map((model_id) => {
+    const catalogModel = capabilityCatalog?.models?.find((candidate) => candidate.provider_id === binding.provider_id && candidate.model_id === model_id);
+    if (capabilityCatalog && !catalogModel) fail('WIZARD_MODEL_NOT_IN_CATALOG', `${model_id} is not in the signed catalog for ${binding.provider_id}`);
+    return {
+      provider_id: binding.provider_id,
+      model_id,
+      actions: catalogModel?.actions || V2_ACTIONS,
+      ...(catalogModel?.adjudication_priority !== undefined ? { adjudication_priority: catalogModel.adjudication_priority } : {}),
+      ...(catalogModel?.highest_reasoning_configuration !== undefined
+        ? { highest_reasoning_configuration: catalogModel.highest_reasoning_configuration }
+        : (!capabilityCatalog ? { highest_reasoning_configuration: 'xhigh' } : {})),
+    };
+  }));
+  const selectionDigest = sha256({ source_catalog_ref: sourceCatalogId, models, enabled_providers }).slice(0, 20);
+  const snapshotId = `wizard-catalog-${selectionDigest}`;
+  const projectSlug = projectName.trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/(^-|-$)/g, '') || 'project';
+  const installation = {
+    installation_id: `wizard-${projectSlug}`,
+    profile,
+    primary_harness: primary.harness_id,
+    primary_binding: { provider_id: primary.provider_id, harness_id: primary.harness_id },
+    enabled_providers,
+    capability_snapshot_ref: snapshotId,
+    policy_ref: `policy://installation/${snapshotId}`,
+    ...(profile === 'focus-ai-internal' ? { external_integrations: { clickup: 'required' } } : {}),
+  };
+  return Object.freeze({
+    project_id: `project-${projectSlug}`,
+    installation,
+    capability_snapshot: { snapshot_id: snapshotId, expires_at: expiresAt, models },
+  });
+}
+
+export const supportedV2WizardProviders = Object.freeze(Object.keys(PROVIDER_BINDINGS));

package/src/intelligence/registry-manager.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
-import yaml from 'js-yaml';
+import * as yaml from 'js-yaml';
 import { resolveFrameworkDir } from '../utils/framework-dir.js';
 import { EXPECTED_ARTICLE_COUNT } from '../utils/constitution-meta.js';
 import { flattenEntitiesMap } from '../utils/flatten-entities.js';

package/src/license/client.js

@@ -1,7 +1,7 @@
 import { homedir } from 'os';
 import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'fs';
 import { join } from 'path';
-import yaml from 'js-yaml';
+import * as yaml from 'js-yaml';
 import { getMachineId, getMachineName } from './machine-id.js';
 
 const API_BASE = 'https://chati.dev/api';

package/src/memory/session-digest.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync } from 'fs';
 import { join } from 'path';
-import yaml from 'js-yaml';
+import * as yaml from 'js-yaml';
 
 const DIGEST_DIR = '.chati/memories/shared/session';
 

package/src/merger/yaml-merger.js

@@ -1,4 +1,4 @@
-import yaml from 'js-yaml';
+import * as yaml from 'js-yaml';
 
 const MANAGED_START = '# CHATI-MANAGED-START';
 const MANAGED_END = '# CHATI-MANAGED-END';

package/src/orchestrator/browser-runtime.js

@@ -0,0 +1,25 @@
+import { assertBrowserCapabilityForTask, BrowserCapability } from '@chati/browser-capability';
+
+/**
+ * G3 browser boundary. This runtime has no reference to Playwright, Chrome,
+ * MCP, credentials or a shared profile. It can only validate a task policy and
+ * use the internal fake adapter supplied by BrowserCapability.
+ */
+export function createProjectBrowserSession({ task, request } = {}) {
+  const policy = assertBrowserCapabilityForTask(task);
+  if (!policy) return Object.freeze({ state: 'not-required', manifest: null, capability: null });
+  const capability = new BrowserCapability({});
+  const manifest = capability.preflight({ ...request, policy });
+  return Object.freeze({ state: 'preflighted', policy, manifest, capability });
+}
+
+/** Only the same local session may advance its fake adapter past preflight. */
+export function launchProjectBrowserSession({ session, request } = {}) {
+  if (!session || session.state !== 'preflighted' || !session.capability || !session.policy) {
+    const error = new Error('browser launch requires a preflighted project-local browser session');
+    error.code = 'BROWSER_PREFLIGHT_REQUIRED';
+    throw error;
+  }
+  const manifest = session.capability.launch({ ...request, policy: session.policy });
+  return Object.freeze({ state: 'launched', manifest, fake_launches: session.capability.fakeLaunches, capability: session.capability, policy: session.policy });
+}