code-ai-installer 4.0.0 → 4.0.1-a

package/dist/shared/tools.js

@@ -66,6 +66,14 @@ export const ListSkillsOutput = z.object({
 export const GetSkillInput = z.object({
     name: SkillName,
     domain: DomainId,
+    /**
+     * Optional run association. When provided, the fetch is logged as a skill
+     * invocation (Auditor telemetry, ADR-DEV-121). Existing callers that omit it
+     * are unaffected — nothing is logged. `gate` records where in the pipeline
+     * the skill was pulled.
+     */
+    task_id: TaskId.optional(),
+    gate: GateName.optional(),
 });
 export const GetSkillOutput = z.object({
     frontmatter: SkillFrontmatter,
@@ -300,6 +308,221 @@ export const RunDriftAuditOutput = z.object({
         to: SkillName,
     })),
 });
+// ─── audit_budget_compliance ─────────────────────────────────────────────────
+export const AuditBudgetComplianceInput = z.object({
+    domain: z.union([DomainId, z.literal("*")]),
+});
+const SchemaViolation = z.object({
+    domain: DomainId,
+    file: z.string(),
+    file_type: z.enum(["agent", "skill"]),
+    declared_budget: z.number().int(),
+    schema_max: z.number().int(),
+    message: z.string(),
+});
+const BudgetViolation = z.object({
+    domain: DomainId,
+    file: z.string(),
+    file_type: z.enum(["agent", "skill"]),
+    declared_budget: z.number().int(),
+    actual_lines: z.number().int(),
+    overage: z.number().int(),
+    message: z.string(),
+});
+export const AuditBudgetComplianceOutput = z.object({
+    schema_violations: z.array(SchemaViolation),
+    budget_violations: z.array(BudgetViolation),
+    scanned: z.object({
+        agents: z.number().int(),
+        skills: z.number().int(),
+    }),
+});
+// ─── audit_bilocale_parity ───────────────────────────────────────────────────
+export const AuditBilocaleParityInput = z.object({
+    domain: z.union([DomainId, z.literal("*")]),
+});
+const DeclaredMismatch = z.object({
+    domain: DomainId,
+    id: z.string(),
+    file_type: z.enum(["agent", "skill"]),
+    ru_path: z.string(),
+    en_path: z.string(),
+    ru_declared: z.number().int(),
+    en_declared: z.number().int(),
+    message: z.string(),
+});
+const ActualMismatch = z.object({
+    domain: DomainId,
+    id: z.string(),
+    file_type: z.enum(["agent", "skill"]),
+    ru_path: z.string(),
+    en_path: z.string(),
+    ru_actual: z.number().int(),
+    en_actual: z.number().int(),
+    diff: z.number().int(),
+    message: z.string(),
+});
+const ParityOrphan = z.object({
+    domain: DomainId,
+    id: z.string(),
+    file_type: z.enum(["agent", "skill"]),
+    present_locale: z.enum(["ru", "en"]),
+    present_path: z.string(),
+    missing_locale: z.enum(["ru", "en"]),
+    message: z.string(),
+});
+export const AuditBilocaleParityOutput = z.object({
+    declared_mismatches: z.array(DeclaredMismatch),
+    actual_mismatches: z.array(ActualMismatch),
+    orphans: z.array(ParityOrphan),
+    scanned: z.object({
+        pairs: z.number().int(),
+        agents: z.number().int(),
+        skills: z.number().int(),
+    }),
+});
+// ─── aggregate_run_metrics ───────────────────────────────────────────────────
+export const AggregateRunMetricsInput = z.object({
+    /** Small-sample guard (design >=3). Below this, met_threshold=false. */
+    min_runs: z.number().int().positive().default(3),
+});
+const WorkflowMetric = z.object({
+    mode: PipelineMode,
+    runs: z.number().int().nonnegative(),
+    completed: z.number().int().nonnegative(),
+    avg_dev_rollbacks: z.number(),
+    circuit_breaker_trips: z.number().int().nonnegative(),
+    total_exceptions: z.number().int().nonnegative(),
+});
+const AgentMetric = z.object({
+    role: z.string(),
+    gate: GateName,
+    runs_involved: z.number().int().nonnegative(),
+    reworked: z.number().int().nonnegative(),
+    first_try_rate: z.number(),
+    exceptions: z.number().int().nonnegative(),
+    classification_breakdown: z.object({
+        auto_resolve: z.number().int().nonnegative(),
+        fork: z.number().int().nonnegative(),
+        exception: z.number().int().nonnegative(),
+    }),
+});
+const SkillMetric = z.object({
+    skill: z.string(),
+    invocations: z.number().int().nonnegative(),
+    runs_invoked_in: z.number().int().nonnegative(),
+    gates: z.array(z.string()),
+});
+export const AggregateRunMetricsOutput = z.object({
+    runs_in_ledger: z.number().int().nonnegative(),
+    runs_completed: z.number().int().nonnegative(),
+    min_runs: z.number().int().positive(),
+    met_threshold: z.boolean(),
+    per_workflow: z.array(WorkflowMetric),
+    per_agent: z.array(AgentMetric),
+    per_skill: z.array(SkillMetric),
+    notes: z.array(z.string()),
+});
+// ─── propose_change / list_proposals (Auditor proposal store, ADR-DEV-123) ──
+/**
+ * The kind of change a proposal requests. Maps 1:1 to the autonomy-matrix risk
+ * tiers (ADR-DEV-122 agent.md): edit_minor → low (auto when gate off),
+ * add_asset → additive (auto when gate off, dedup-guarded in item 4c),
+ * destructive → high (always human, even in autonomy).
+ */
+export const ProposalChangeKind = z.enum(["edit_minor", "add_asset", "destructive"]);
+/** Risk tier surfaced on the record so the approval layer (4b) routes without re-deriving. */
+export const ProposalRisk = z.enum(["low", "additive", "high"]);
+/**
+ * Proposal lifecycle status. 4a (this ADR) only ever writes "pending"; the rest
+ * are forward-declared so the approval/apply layer (4b) extends behaviour without
+ * reshaping the record. list_proposals tolerates all of them.
+ */
+export const ProposalStatus = z.enum([
+    "pending",
+    "approved",
+    "applied",
+    "rejected",
+    "superseded",
+]);
+/** What asset a proposal targets. For add_asset, `name` is the proposed new asset's name. */
+export const ProposalTarget = z.object({
+    domain: DomainId,
+    asset: z.enum(["agent", "skill"]),
+    name: z.string().min(1),
+});
+export const ProposeChangeInput = z.object({
+    target: ProposalTarget,
+    change_kind: ProposalChangeKind,
+    /** Why — in words. */
+    rationale: z.string().min(1),
+    /** Which aggregate_run_metrics numbers / notes motivated this (free-form). */
+    evidence: z.string().min(1),
+    /** Whether aggregate_run_metrics.met_threshold was true when this was formed. */
+    threshold_met: z.boolean(),
+    /** The drafted change itself, inline — so the approver / 4b has everything to apply. */
+    draft: z.string().min(1),
+});
+export const ProposeChangeOutput = z.object({
+    id: z.string(),
+    status: ProposalStatus,
+    risk: ProposalRisk,
+    path: z.string(),
+});
+/** One stored proposal. Shared by the store reader and list_proposals output. */
+export const ProposalRecord = z.object({
+    id: z.string(),
+    created_at: z.string(),
+    status: ProposalStatus,
+    risk: ProposalRisk,
+    target: ProposalTarget,
+    change_kind: ProposalChangeKind,
+    rationale: z.string(),
+    evidence: z.string(),
+    threshold_met: z.boolean(),
+    draft: z.string(),
+});
+export const ListProposalsInput = z.object({
+    /** Optional surfacing filters — not enforcement. */
+    status: ProposalStatus.optional(),
+    risk: ProposalRisk.optional(),
+    domain: DomainId.optional(),
+});
+export const ListProposalsOutput = z.object({
+    proposals: z.array(ProposalRecord),
+});
+// ─── review_proposal (Auditor approval + autonomy matrix, ADR-DEV-124) ──────
+/**
+ * A status-transition event for a proposal. Appended to proposals.jsonl as a NEW line
+ * (event-sourcing — the original ProposalRecord is never rewritten). readProposals folds
+ * the latest event per id into the record's effective status. ADR-DEV-124.
+ */
+export const ProposalReviewEvent = z.object({
+    kind: z.literal("review"),
+    id: z.string(),
+    status: ProposalStatus,
+    /** Who authorized the transition. "auditor_auto" is matrix/toggle-gated in review_proposal. */
+    decided_by: z.enum(["den", "auditor_auto"]),
+    note: z.string().optional(),
+    reviewed_at: z.string(),
+});
+export const ReviewProposalInput = z.object({
+    id: z.string().min(1),
+    /** approve/reject act on a pending proposal; applied marks an approved one as written. */
+    decision: z.enum(["approve", "reject", "applied"]),
+    /** Authorizer. "auditor_auto" only valid for low/additive when the approval gate is OFF. */
+    decided_by: z.enum(["den", "auditor_auto"]),
+    note: z.string().optional(),
+});
+export const ReviewProposalOutput = z.object({
+    id: z.string(),
+    status: ProposalStatus,
+    risk: ProposalRisk,
+    decided_by: z.string(),
+    target: ProposalTarget,
+    /** Mandatory report — what was decided and the next step (e.g. apply via submit_artifact). */
+    next_step: z.string(),
+});
 // ════════════════════════════════════════════════════════════════════════════
 // PHASE 2 — DEV-DOMAIN SPECIFIC (stubbed initially)
 // ════════════════════════════════════════════════════════════════════════════
@@ -398,6 +621,12 @@ export const TOOL_REGISTRY = {
     recent_decisions: { input: RecentDecisionsInput, output: RecentDecisionsOutput },
     regenerate_manifest: { input: RegenerateManifestInput, output: RegenerateManifestOutput },
     run_drift_audit: { input: RunDriftAuditInput, output: RunDriftAuditOutput },
+    audit_budget_compliance: { input: AuditBudgetComplianceInput, output: AuditBudgetComplianceOutput },
+    audit_bilocale_parity: { input: AuditBilocaleParityInput, output: AuditBilocaleParityOutput },
+    aggregate_run_metrics: { input: AggregateRunMetricsInput, output: AggregateRunMetricsOutput },
+    propose_change: { input: ProposeChangeInput, output: ProposeChangeOutput },
+    list_proposals: { input: ListProposalsInput, output: ListProposalsOutput },
+    review_proposal: { input: ReviewProposalInput, output: ReviewProposalOutput },
     // Phase 2
     run_tests: { input: RunTestsInput, output: RunTestsOutput },
     apply_diff: { input: ApplyDiffInput, output: ApplyDiffOutput },

package/dist/shared/vocabulary.d.ts

@@ -6,8 +6,8 @@ import { z } from "zod";
  * `request_decision` → ADR → version bump of the shared types module (src/shared), then
  * propagate atomically to both consumers (installer + mcp).
  *
- * Sourced from: docs/architecture-redesign/2026-05-23-context.md
- *               (sections: STRUCTURED METADATA, ARTEFACTS AND LIMITS).
+ * Source of truth: the structured-metadata + artefact-limit design (STRUCTURED
+ * METADATA, ARTEFACTS AND LIMITS).
  */
 /** Three pipeline shapes per domain. Full = all gates; Bugfix = compressed; Hotfix = single RG gate. */
 export declare const PipelineMode: z.ZodEnum<{
@@ -16,7 +16,79 @@ export declare const PipelineMode: z.ZodEnum<{
     hotfix: "hotfix";
 }>;
 export type PipelineMode = z.infer<typeof PipelineMode>;
-/** Full development pipeline (8 gates). Other domains may use a subset; pipeline.yaml declares which. */
+/**
+ * Gate vocabulary is domain-scoped. Each domain declares its own gate enum; the
+ * exported `GateName` is the UNION of all of them, so every existing consumer
+ * (frontmatter, pipeline, task_state, tools) keeps compiling — it now accepts a
+ * superset. Domain isolation (a content gate must not be assigned to a dev role)
+ * is enforced via `DOMAIN_GATES` + `gateBelongsToDomain`, used in RoleFrontmatter.
+ */
+/** Full development pipeline (8 gates). */
+export declare const DevGateName: z.ZodEnum<{
+    PM: "PM";
+    UX: "UX";
+    ARCH: "ARCH";
+    DEV: "DEV";
+    REV: "REV";
+    OPS: "OPS";
+    TEST: "TEST";
+    RG: "RG";
+}>;
+export type DevGateName = z.infer<typeof DevGateName>;
+/**
+ * Content pipeline gates. Mirrors AGENTS.yaml `pipeline:` for content.
+ * CONDUCTOR is the orchestrator phase (routes the pipeline), not a signable gate
+ * — same convention as development, where CONDUCTOR isn't a GateName either.
+ */
+export declare const ContentGateName: z.ZodEnum<{
+    STRATEGIST: "STRATEGIST";
+    RESEARCHER: "RESEARCHER";
+    COPYWRITER: "COPYWRITER";
+    VISUAL_CONCEPT: "VISUAL_CONCEPT";
+    REVIEWER: "REVIEWER";
+    RELEASE_GATE: "RELEASE_GATE";
+}>;
+export type ContentGateName = z.infer<typeof ContentGateName>;
+/**
+ * Analytics pipeline gates (8). Mirrors AGENTS.yaml `pipeline:` for analytics.
+ * CONDUCTOR is the orchestrator phase (routes the pipeline), not a signable gate
+ * — same convention as development/content. MEDIATOR is a normal gate: the
+ * adversarial "two camps" dynamic lives in the agent prompts, not the state
+ * machine (the gate sequence is linear, as declared in AGENTS.yaml).
+ */
+export declare const AnalyticsGateName: z.ZodEnum<{
+    STRATEGIST: "STRATEGIST";
+    RESEARCHER: "RESEARCHER";
+    RELEASE_GATE: "RELEASE_GATE";
+    INTERVIEWER: "INTERVIEWER";
+    DATA_ANALYST: "DATA_ANALYST";
+    MEDIATOR: "MEDIATOR";
+    DESIGNER: "DESIGNER";
+    LAYOUTER: "LAYOUTER";
+}>;
+export type AnalyticsGateName = z.infer<typeof AnalyticsGateName>;
+/**
+ * Product pipeline gates (10). Mirrors AGENTS.yaml `pipeline:` for product.
+ * CONDUCTOR is the orchestrator phase, not a signable gate — same convention as
+ * the other domains. DATA_ANALYST / MEDIATOR / DESIGNER / LAYOUTER / RELEASE_GATE
+ * overlap with analytics; the union dedupes them (see uniqueGates). The dual
+ * adversarial axes (Customer-vs-Business, Build-vs-Cut) live in the agent
+ * prompts, not the state machine — the gate sequence is linear.
+ */
+export declare const ProductGateName: z.ZodEnum<{
+    PM: "PM";
+    RELEASE_GATE: "RELEASE_GATE";
+    DATA_ANALYST: "DATA_ANALYST";
+    MEDIATOR: "MEDIATOR";
+    DESIGNER: "DESIGNER";
+    LAYOUTER: "LAYOUTER";
+    DISCOVERY: "DISCOVERY";
+    PRODUCT_STRATEGIST: "PRODUCT_STRATEGIST";
+    UX_DESIGNER: "UX_DESIGNER";
+    TECH_LEAD: "TECH_LEAD";
+}>;
+export type ProductGateName = z.infer<typeof ProductGateName>;
+/** All gate names across all domains. Superset — keeps the `GateName` contract stable. */
 export declare const GateName: z.ZodEnum<{
     PM: "PM";
     UX: "UX";
@@ -26,6 +98,21 @@ export declare const GateName: z.ZodEnum<{
     OPS: "OPS";
     TEST: "TEST";
     RG: "RG";
+    STRATEGIST: "STRATEGIST";
+    RESEARCHER: "RESEARCHER";
+    COPYWRITER: "COPYWRITER";
+    VISUAL_CONCEPT: "VISUAL_CONCEPT";
+    REVIEWER: "REVIEWER";
+    RELEASE_GATE: "RELEASE_GATE";
+    INTERVIEWER: "INTERVIEWER";
+    DATA_ANALYST: "DATA_ANALYST";
+    MEDIATOR: "MEDIATOR";
+    DESIGNER: "DESIGNER";
+    LAYOUTER: "LAYOUTER";
+    DISCOVERY: "DISCOVERY";
+    PRODUCT_STRATEGIST: "PRODUCT_STRATEGIST";
+    UX_DESIGNER: "UX_DESIGNER";
+    TECH_LEAD: "TECH_LEAD";
 }>;
 export type GateName = z.infer<typeof GateName>;
 /**
@@ -62,6 +149,13 @@ export declare const DomainId: z.ZodEnum<{
     product: "product";
 }>;
 export type DomainId = z.infer<typeof DomainId>;
+/**
+ * Which gates belong to which domain — the isolation map. analytics/product are
+ * empty until their own governance sub-step migrates them (content-first pilot).
+ */
+export declare const DOMAIN_GATES: Record<DomainId, readonly GateName[]>;
+/** True if `gate` is a valid gate for `domain`. */
+export declare function gateBelongsToDomain(gate: GateName, domain: DomainId): boolean;
 /**
  * Per 2026-05-23-context.md § МЕТРИКИ SKILLS:
  *   mandatory     → compliance in outputs, not invocation count
@@ -78,8 +172,8 @@ export declare const SkillType: z.ZodEnum<{
 export type SkillType = z.infer<typeof SkillType>;
 /** "den" = the user. "mcp" = auto-pass via deterministic check. "system" = circuit-breaker / audit. */
 export declare const Signer: z.ZodEnum<{
-    mcp: "mcp";
     den: "den";
+    mcp: "mcp";
     system: "system";
 }>;
 export type Signer = z.infer<typeof Signer>;
@@ -90,6 +184,7 @@ export type Signer = z.infer<typeof Signer>;
  * the seeds here are placeholders for compile-time safety on shipped skills.
  */
 export declare const TechSeed: z.ZodEnum<{
+    mcp: "mcp";
     typescript: "typescript";
     node: "node";
     react: "react";

package/dist/shared/vocabulary.js

@@ -6,15 +6,22 @@ import { z } from "zod";
  * `request_decision` → ADR → version bump of the shared types module (src/shared), then
  * propagate atomically to both consumers (installer + mcp).
  *
- * Sourced from: docs/architecture-redesign/2026-05-23-context.md
- *               (sections: STRUCTURED METADATA, ARTEFACTS AND LIMITS).
+ * Source of truth: the structured-metadata + artefact-limit design (STRUCTURED
+ * METADATA, ARTEFACTS AND LIMITS).
  */
 // ─── Pipeline mode ────────────────────────────────────────────────────────────
 /** Three pipeline shapes per domain. Full = all gates; Bugfix = compressed; Hotfix = single RG gate. */
 export const PipelineMode = z.enum(["full", "bugfix", "hotfix"]);
-// ─── Gates ────────────────────────────────────────────────────────────────────
-/** Full development pipeline (8 gates). Other domains may use a subset; pipeline.yaml declares which. */
-export const GateName = z.enum([
+// ─── Gates (domain-scoped) ──────────────────────────────────────────────────
+/**
+ * Gate vocabulary is domain-scoped. Each domain declares its own gate enum; the
+ * exported `GateName` is the UNION of all of them, so every existing consumer
+ * (frontmatter, pipeline, task_state, tools) keeps compiling — it now accepts a
+ * superset. Domain isolation (a content gate must not be assigned to a dev role)
+ * is enforced via `DOMAIN_GATES` + `gateBelongsToDomain`, used in RoleFrontmatter.
+ */
+/** Full development pipeline (8 gates). */
+export const DevGateName = z.enum([
     "PM",
     "UX",
     "ARCH",
@@ -24,6 +31,72 @@ export const GateName = z.enum([
     "TEST",
     "RG",
 ]);
+/**
+ * Content pipeline gates. Mirrors AGENTS.yaml `pipeline:` for content.
+ * CONDUCTOR is the orchestrator phase (routes the pipeline), not a signable gate
+ * — same convention as development, where CONDUCTOR isn't a GateName either.
+ */
+export const ContentGateName = z.enum([
+    "STRATEGIST",
+    "RESEARCHER",
+    "COPYWRITER",
+    "VISUAL_CONCEPT",
+    "REVIEWER",
+    "RELEASE_GATE",
+]);
+/**
+ * Analytics pipeline gates (8). Mirrors AGENTS.yaml `pipeline:` for analytics.
+ * CONDUCTOR is the orchestrator phase (routes the pipeline), not a signable gate
+ * — same convention as development/content. MEDIATOR is a normal gate: the
+ * adversarial "two camps" dynamic lives in the agent prompts, not the state
+ * machine (the gate sequence is linear, as declared in AGENTS.yaml).
+ */
+export const AnalyticsGateName = z.enum([
+    "INTERVIEWER",
+    "RESEARCHER",
+    "DATA_ANALYST",
+    "STRATEGIST",
+    "MEDIATOR",
+    "DESIGNER",
+    "LAYOUTER",
+    "RELEASE_GATE",
+]);
+/**
+ * Product pipeline gates (10). Mirrors AGENTS.yaml `pipeline:` for product.
+ * CONDUCTOR is the orchestrator phase, not a signable gate — same convention as
+ * the other domains. DATA_ANALYST / MEDIATOR / DESIGNER / LAYOUTER / RELEASE_GATE
+ * overlap with analytics; the union dedupes them (see uniqueGates). The dual
+ * adversarial axes (Customer-vs-Business, Build-vs-Cut) live in the agent
+ * prompts, not the state machine — the gate sequence is linear.
+ */
+export const ProductGateName = z.enum([
+    "DISCOVERY",
+    "PRODUCT_STRATEGIST",
+    "PM",
+    "UX_DESIGNER",
+    "TECH_LEAD",
+    "DATA_ANALYST",
+    "MEDIATOR",
+    "DESIGNER",
+    "LAYOUTER",
+    "RELEASE_GATE",
+]);
+/**
+ * Dedupe shared gate names while keeping the literal union type. RELEASE_GATE
+ * (and DATA_ANALYST / MEDIATOR / DESIGNER / LAYOUTER) are shared across
+ * analytics + product; without this they would appear twice in `GateName.options`.
+ */
+function uniqueGates(gates) {
+    return [...new Set(gates)];
+}
+/** All gate names across all domains. Superset — keeps the `GateName` contract stable. */
+export const GateName = z.enum(uniqueGates([
+    ...DevGateName.options,
+    ...ContentGateName.options,
+    ...AnalyticsGateName.options,
+    ...ProductGateName.options,
+]));
+// DOMAIN_GATES + gateBelongsToDomain live below DomainId (they reference it).
 // ─── Classification (the only decision channel before each gate transition) ──
 /**
  * LLM MUST classify each gate before producing artifact. Per the silent-by-default contract:
@@ -67,6 +140,20 @@ export const DomainId = z.enum([
     "analytics",
     "product",
 ]);
+/**
+ * Which gates belong to which domain — the isolation map. analytics/product are
+ * empty until their own governance sub-step migrates them (content-first pilot).
+ */
+export const DOMAIN_GATES = {
+    development: DevGateName.options,
+    content: ContentGateName.options,
+    analytics: AnalyticsGateName.options,
+    product: ProductGateName.options,
+};
+/** True if `gate` is a valid gate for `domain`. */
+export function gateBelongsToDomain(gate, domain) {
+    return DOMAIN_GATES[domain].includes(gate);
+}
 // ─── Skill typing (metric-determining) ───────────────────────────────────────
 /**
  * Per 2026-05-23-context.md § МЕТРИКИ SKILLS:
@@ -136,6 +223,8 @@ export const TechSeed = z.enum([
     // Added 2026-05-29 for Test Integrity Initiative DEV-094 (test-integrity-hooks-setup):
     "husky",
     "pre-commit",
+    // Added 2026-05-28 for Step 3 DEV-104 (mcp-integration mandatory skill):
+    "mcp",
 ]);
 export const TopicSeed = z.enum([
     "architecture",