create-agdf 0.14.5 → 0.20.1

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/runtime/local-validator.js

@@ -2,6 +2,8 @@ import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import process from "node:process";
+import { resolveHostCommand } from "../host-command.js";
+import { runtimeEnvironment } from "../skill-dispatch/binding.js";
 import {
   INSTALLATION_PROVENANCE_FILE,
   digestDirectory,
@@ -9,7 +11,7 @@ import {
   inspectGeneratedRepositoryMarketplace,
   inspectInstallationProvenance,
   validateDistributionProfiles,
-} from "./plugin-provenance.js";
+} from "#agdf-core/runtime/plugin-provenance.js";
 
 function readJson(path) {
   try {
@@ -25,6 +27,23 @@ function canonicalPath(path) {
 
 export { digestDirectory };
 
+const PLUGIN_HOST_SURFACES = new Set(["codex", "claude", "copilot", "opencode", "plugin"]);
+
+export function resolvePluginHostEnvironment(env = process.env, { defaultSurface = "plugin" } = {}) {
+  const fallbackSurface = PLUGIN_HOST_SURFACES.has(defaultSurface) ? defaultSurface : "plugin";
+  const requestedSurface = env.AGDF_SURFACE
+    || (env.COPILOT_PLUGIN_DATA ? "copilot"
+      : env.PLUGIN_ROOT ? "codex"
+        : env.CLAUDE_PLUGIN_ROOT ? "claude" : fallbackSurface);
+  const surface = PLUGIN_HOST_SURFACES.has(requestedSurface) ? requestedSurface : fallbackSurface;
+  const expectedPluginRoot = surface === "claude"
+    ? env.CLAUDE_PLUGIN_ROOT || env.PLUGIN_ROOT || undefined
+    : ["codex", "copilot", "plugin"].includes(surface)
+      ? env.PLUGIN_ROOT || (surface === "codex" ? env.CLAUDE_PLUGIN_ROOT : undefined) || undefined
+      : undefined;
+  return Object.freeze({ surface, expectedPluginRoot });
+}
+
 function envelope(machineValidation, options, evidence = {}) {
   return {
     schema_version: "1",
@@ -204,7 +223,13 @@ export function resolveLocalValidator(options) {
     if (!isAbsolute(configuredPath) || !existsSync(configuredPath)) {
       return { envelope: envelope("unavailable", options, { source: "configured_path", reason: "invalid_absolute_path" }) };
     }
-    const versionProbe = spawnSync(configuredPath, ["--version", "--json"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    let command;
+    try {
+      command = resolveHostCommand(configuredPath);
+    } catch {
+      return { envelope: envelope("unavailable", options, { source: "configured_path", reason: "unsupported_command_shim" }) };
+    }
+    const versionProbe = spawnSync(command.executable, [...command.prefixArgs, "--version", "--json"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
     let observedVersion = null;
     try { observedVersion = JSON.parse(versionProbe.stdout)?.version ?? null; } catch {}
     if (versionProbe.status !== 0 || observedVersion !== options.expectedVersion) {
@@ -212,8 +237,8 @@ export function resolveLocalValidator(options) {
     }
     return {
       envelope: envelope("configured_version_matched", options, { observedVersion, source: "configured_path" }),
-      executable: configuredPath,
-      prefixArgs: [],
+      executable: command.executable,
+      prefixArgs: command.prefixArgs,
     };
   }
 
@@ -221,6 +246,7 @@ export function resolveLocalValidator(options) {
 }
 
 export function runLocalValidator(options, args, io = console) {
+  const wrapperStart = process.hrtime.bigint().toString();
   const resolved = resolveLocalValidator(options);
   if (args[0] === "--resolve-only") {
     io.log(JSON.stringify(resolved.envelope, null, args.includes("--json") ? 2 : 0));
@@ -232,7 +258,15 @@ export function runLocalValidator(options, args, io = console) {
   }
   const child = spawnSync(resolved.executable, [...resolved.prefixArgs, ...args], {
     cwd: options.cwd ?? process.cwd(),
-    env: { ...process.env, AGDF_MACHINE_VALIDATION: resolved.envelope.machine_validation },
+    env: {
+      ...process.env,
+      ...(resolved.executable === process.execPath ? runtimeEnvironment() : {}),
+      AGDF_MACHINE_VALIDATION: resolved.envelope.machine_validation,
+      AGDF_DISPATCH_WRAPPER_START_NS: wrapperStart,
+      AGDF_DISPATCH_PLUGIN_ROOT: resolved.envelope.plugin_root ?? "",
+      AGDF_DISPATCH_RUNTIME_DIGEST: resolved.envelope.runtime_digest ?? "",
+      AGDF_DISPATCH_PROVENANCE_STATUS: resolved.envelope.provenance_status ?? "",
+    },
     stdio: "inherit",
   });
   return child.status ?? 2;

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/runtime/plugin-provenance.js

@@ -1,298 +1 @@
-import { createHash } from "node:crypto";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { isAbsolute, join, relative, resolve, sep } from "node:path";
-
-export const INSTALLATION_PROVENANCE_FILE = ".agdf-installation.json";
-export const LEGACY_LOCAL_INSTALL_FILE = ".agdf-local-install.json";
-export const COPILOT_PAYLOAD_INVENTORY_FILE = ".agdf-payload-inventory.json";
-
-const EXPECTED_PROFILES = Object.freeze({
-  "source-development": Object.freeze({ runtime: "absent", installable: false, machineValidation: "unavailable" }),
-  "runtime-plugin": Object.freeze({ runtime: "required", installable: true, machineValidation: "local_exact_version_digest" }),
-  "copilot-runtime-plugin": Object.freeze({ runtime: "required", installable: true, machineValidation: "local_exact_version_digest_inventory" }),
-  "opencode-config-local": Object.freeze({ runtime: "config_local_package", installable: true, machineValidation: "local_exact_version" }),
-  "portable-skills": Object.freeze({ runtime: "absent", installable: true, machineValidation: "unavailable_or_external_required" }),
-});
-
-function readJson(path) {
-  try {
-    return JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    return null;
-  }
-}
-
-export function digestDirectory(root) {
-  const files = [];
-  function visit(directory) {
-    for (const name of readdirSync(directory).sort()) {
-      const path = join(directory, name);
-      const stats = statSync(path);
-      if (stats.isDirectory()) visit(path);
-      else if (stats.isFile()) files.push(path);
-    }
-  }
-  visit(root);
-  const hash = createHash("sha256");
-  for (const path of files) {
-    hash.update(relative(root, path).replaceAll("\\", "/"));
-    hash.update("\0");
-    hash.update(readFileSync(path));
-    hash.update("\0");
-  }
-  return hash.digest("hex");
-}
-
-export function digestFile(path) {
-  return createHash("sha256").update(readFileSync(path)).digest("hex");
-}
-
-export function inspectCopilotPayloadInventory(pluginRoot, expectedVersion) {
-  const inventoryPath = join(pluginRoot, COPILOT_PAYLOAD_INVENTORY_FILE);
-  const inventory = readJson(inventoryPath);
-  if (!inventory || inventory.schema_version !== 1 || inventory.profile_id !== "copilot-runtime-plugin"
-      || inventory.version !== expectedVersion || !Array.isArray(inventory.entries)) {
-    return { status: "invalid", reason: "copilot_payload_inventory_invalid" };
-  }
-  const destinations = inventory.entries.map((entry) => entry.destination);
-  if (new Set(destinations).size !== destinations.length) {
-    return { status: "invalid", reason: "copilot_payload_inventory_duplicate" };
-  }
-  const actual = [];
-  function visit(directory) {
-    for (const name of readdirSync(directory).sort()) {
-      const path = join(directory, name);
-      const stats = statSync(path);
-      if (stats.isDirectory()) visit(path);
-      else if (stats.isFile()) {
-        const normalized = relative(pluginRoot, path).replaceAll("\\", "/");
-        if (![COPILOT_PAYLOAD_INVENTORY_FILE, INSTALLATION_PROVENANCE_FILE, LEGACY_LOCAL_INSTALL_FILE].includes(normalized)) actual.push(normalized);
-      }
-    }
-  }
-  try { visit(pluginRoot); } catch { return { status: "invalid", reason: "copilot_payload_incomplete" }; }
-  if (JSON.stringify(actual.sort()) !== JSON.stringify([...destinations].sort())) {
-    return { status: "invalid", reason: "copilot_payload_inventory_mismatch" };
-  }
-  for (const entry of inventory.entries) {
-    const path = join(pluginRoot, entry.destination);
-    if (!existsSync(path) || digestFile(path) !== entry.digest || statSync(path).size !== entry.bytes) {
-      return { status: "invalid", reason: "copilot_payload_digest_mismatch", entry: entry.destination };
-    }
-  }
-  const excluded = actual.some((path) => path.startsWith("skills/") || path.startsWith(".codex-plugin/")
-    || path.startsWith(".claude-plugin/") || path.startsWith("submission/")
-    || path === "hooks/hooks.json" || path === "hooks/session-start.sh");
-  if (excluded) return { status: "invalid", reason: "copilot_payload_excluded_surface" };
-  return { status: "matched", inventory, inventoryDigest: digestFile(inventoryPath) };
-}
-
-export function digestNormalizedPluginSource(root, canonicalVersion) {
-  const files = [];
-  function visit(directory) {
-    for (const name of readdirSync(directory).sort()) {
-      const path = join(directory, name);
-      const stats = statSync(path);
-      if (stats.isDirectory()) visit(path);
-      else if (stats.isFile()) files.push(path);
-    }
-  }
-  visit(root);
-  const hash = createHash("sha256");
-  for (const path of files) {
-    const normalizedPath = relative(root, path).replaceAll("\\", "/");
-    if ([INSTALLATION_PROVENANCE_FILE, LEGACY_LOCAL_INSTALL_FILE].includes(normalizedPath)) continue;
-    let content = readFileSync(path);
-    if (normalizedPath === ".codex-plugin/plugin.json") {
-      const manifest = readJson(path);
-      if (!manifest) throw new Error(`Invalid Codex plugin manifest: ${path}`);
-      content = `${JSON.stringify({ ...manifest, version: canonicalVersion }, null, 2)}\n`;
-    }
-    hash.update(normalizedPath);
-    hash.update("\0");
-    hash.update(content);
-    hash.update("\0");
-  }
-  return hash.digest("hex");
-}
-
-export function validateDistributionProfiles(definition) {
-  const contract = definition?.distributionProfiles;
-  if (contract?.schemaVersion !== 1) return { status: "invalid", reason: "profile_invalid" };
-  if (contract.marketplaceIdentities?.durable !== "agdf"
-      || contract.marketplaceIdentities?.generatedRepository !== "agdf-repo") {
-    return { status: "invalid", reason: "profile_invalid" };
-  }
-  for (const [profileId, expected] of Object.entries(EXPECTED_PROFILES)) {
-    const observed = contract.profiles?.[profileId];
-    if (!observed
-        || Object.keys(observed).length !== Object.keys(expected).length
-        || Object.keys(expected).some((key) => observed[key] !== expected[key])) {
-      return { status: "invalid", reason: "profile_invalid" };
-    }
-  }
-  if (Object.keys(contract.profiles ?? {}).length !== Object.keys(EXPECTED_PROFILES).length) {
-    return { status: "invalid", reason: "profile_invalid" };
-  }
-  return { status: "matched", contract };
-}
-
-function classifyInstalledHistoricalProfile(catalogue, definition, classifyHistoricalProfile) {
-  if (typeof classifyHistoricalProfile !== "function") {
-    return { status: "invalid", reason: "profile_history_invalid" };
-  }
-  const result = classifyHistoricalProfile({
-    catalogue,
-    version: definition?.version,
-    distributionProfiles: definition?.distributionProfiles,
-  });
-  if (result.status !== "matched") return result;
-  return {
-    ...result,
-    contract: catalogue.contracts[result.contract_id].distribution_profiles,
-  };
-}
-
-export function inspectGeneratedRepositoryMarketplace(targetDir) {
-  const marketplacePath = join(targetDir, ".agents", "plugins", "marketplace.json");
-  if (!existsSync(marketplacePath)) return { status: "absent", marketplacePath };
-  const marketplace = readJson(marketplacePath);
-  const plugin = marketplace?.plugins?.length === 1 ? marketplace.plugins[0] : null;
-  const pluginPath = plugin?.source?.source === "local" ? plugin.source.path : null;
-  if (marketplace?.name !== "agdf-repo" || plugin?.name !== "agdf" || pluginPath !== "./plugins/agdf") {
-    return { status: "invalid", reason: "repository_marketplace_invalid", marketplacePath };
-  }
-  const pluginRoot = resolve(targetDir, pluginPath);
-  const rel = relative(resolve(targetDir), pluginRoot);
-  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
-    return { status: "invalid", reason: "repository_marketplace_path_escape", marketplacePath };
-  }
-  const definition = readJson(join(pluginRoot, "meta", "agdf-plugin.definition.json"));
-  const runtimeManifest = readJson(join(pluginRoot, "runtime", "runtime-manifest.json"));
-  const codexManifest = readJson(join(pluginRoot, ".codex-plugin", "plugin.json"));
-  const claudeManifest = readJson(join(pluginRoot, ".claude-plugin", "plugin.json"));
-  const runtimeRoot = join(pluginRoot, "runtime");
-  const runtimePackageRoot = join(pluginRoot, "runtime", "create-agdf");
-  const runtimeEntrypoint = resolve(runtimeRoot, runtimeManifest?.entrypoint ?? "");
-  const runtimeEntrypointRel = relative(runtimeRoot, runtimeEntrypoint);
-  if (validateDistributionProfiles(definition).status !== "matched"
-      || definition?.version !== runtimeManifest?.version
-      || codexManifest?.version !== definition?.version
-      || claudeManifest?.version !== definition?.version
-      || !/^[a-f0-9]{64}$/.test(runtimeManifest?.digest ?? "")
-      || !existsSync(join(runtimeRoot, "agdf-local.js"))
-      || !runtimeManifest?.entrypoint
-      || runtimeEntrypointRel === ".."
-      || runtimeEntrypointRel.startsWith(`..${sep}`)
-      || isAbsolute(runtimeEntrypointRel)
-      || !existsSync(runtimeEntrypoint)
-      || !existsSync(runtimePackageRoot)) {
-    return { status: "invalid", reason: "repository_runtime_incomplete", marketplacePath, pluginRoot };
-  }
-  let runtimeDigest;
-  try { runtimeDigest = digestDirectory(runtimePackageRoot); } catch {
-    return { status: "invalid", reason: "repository_runtime_incomplete", marketplacePath, pluginRoot };
-  }
-  if (runtimeDigest !== runtimeManifest.digest) {
-    return { status: "invalid", reason: "runtime_digest_mismatch", marketplacePath, pluginRoot };
-  }
-  return {
-    status: "matched",
-    marketplacePath,
-    pluginRoot,
-    selector: `${plugin.name}@${marketplace.name}`,
-    runtimeDigest,
-  };
-}
-
-export function inspectInstallationProvenance(pluginRoot, {
-  definition,
-  runtimeManifest,
-  pluginVersion,
-  allowLegacy = false,
-  profileId = "runtime-plugin",
-  inventoryDigest = null,
-  allowHistoricalProfilesForMigration = false,
-  distributionProfileHistory = null,
-  classifyHistoricalProfile = null,
-} = {}) {
-  const markerPath = join(pluginRoot, INSTALLATION_PROVENANCE_FILE);
-  const legacyPath = join(pluginRoot, LEGACY_LOCAL_INSTALL_FILE);
-  if (!existsSync(markerPath)) {
-    if (allowLegacy && existsSync(legacyPath)) {
-      const currentProfile = validateDistributionProfiles(definition);
-      if (Object.hasOwn(definition ?? {}, "distributionProfiles")
-          && currentProfile.status !== "matched") {
-        return allowHistoricalProfilesForMigration
-          ? classifyInstalledHistoricalProfile(distributionProfileHistory, definition, classifyHistoricalProfile).status === "matched"
-            ? { status: "invalid", reason: "installation_provenance_invalid" }
-            : classifyInstalledHistoricalProfile(distributionProfileHistory, definition, classifyHistoricalProfile)
-          : currentProfile;
-      }
-      const marker = readJson(legacyPath);
-      if (!marker
-          || marker.schema_version !== 1
-          || marker.owner !== "create-agdf"
-          || marker.kind !== "codex_local_development_projection"
-          || marker.canonical_version !== definition.version
-          || marker.codex_install_version !== pluginVersion
-          || !/^[a-f0-9]{64}$/.test(marker.source_digest ?? "")) {
-        return { status: "invalid", reason: "installation_provenance_invalid", marker };
-      }
-      let observedSourceDigest;
-      try { observedSourceDigest = digestNormalizedPluginSource(pluginRoot, definition.version); } catch {
-        return { status: "invalid", reason: "source_digest_mismatch", marker };
-      }
-      return observedSourceDigest === marker.source_digest
-        ? { status: "legacy", marker, observedSourceDigest, reason: "legacy_installation_provenance" }
-        : { status: "invalid", reason: "source_digest_mismatch", marker, observedSourceDigest };
-    }
-    const profile = validateDistributionProfiles(definition);
-    if (profile.status !== "matched") return profile;
-    return { status: "missing", reason: "installation_provenance_missing" };
-  }
-  const currentProfile = validateDistributionProfiles(definition);
-  const historicalProfile = currentProfile.status !== "matched" && allowHistoricalProfilesForMigration
-    ? classifyInstalledHistoricalProfile(distributionProfileHistory, definition, classifyHistoricalProfile)
-    : null;
-  if (currentProfile.status !== "matched" && historicalProfile?.status !== "matched") {
-    return historicalProfile ?? currentProfile;
-  }
-  const profile = currentProfile.status === "matched" ? currentProfile : historicalProfile;
-  const marker = readJson(markerPath);
-  if (!marker
-      || marker.schema_version !== 1
-      || marker.owner !== "create-agdf"
-      || marker.profile_id !== profileId
-      || marker.marketplace_id !== profile.contract.marketplaceIdentities.durable
-      || marker.canonical_version !== definition.version
-      || marker.codex_install_version !== pluginVersion
-      || marker.runtime_digest !== runtimeManifest?.digest
-      || (profileId === "copilot-runtime-plugin" && marker.inventory_digest !== inventoryDigest)
-      || !/^[a-f0-9]{64}$/.test(marker.source_digest ?? "")) {
-    return { status: "invalid", reason: "installation_provenance_invalid", marker };
-  }
-  let observedSourceDigest;
-  try {
-    observedSourceDigest = digestNormalizedPluginSource(pluginRoot, definition.version);
-  } catch {
-    return { status: "invalid", reason: "source_digest_mismatch", marker };
-  }
-  if (observedSourceDigest !== marker.source_digest) {
-    return { status: "invalid", reason: "source_digest_mismatch", marker, observedSourceDigest };
-  }
-  return {
-    status: "matched",
-    marker,
-    observedSourceDigest,
-    profileClassification: historicalProfile ? "supported_historical" : "current",
-    historicalReleaseVersion: historicalProfile?.release_version ?? null,
-    historicalContractId: historicalProfile?.contract_id ?? null,
-    historicalContractDigest: historicalProfile?.contract_digest ?? null,
-    historicalEntryDigest: historicalProfile?.entry_digest ?? null,
-  };
-}
-
-export const distributionProfileContract = Object.freeze({
-  expectedProfiles: EXPECTED_PROFILES,
-});
+export * from "#agdf-core/runtime/plugin-provenance.js";

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/runtime/runtime-probe.js

@@ -0,0 +1,61 @@
+import { spawnSync } from "node:child_process";
+import { statSync } from "node:fs";
+import { dirname, isAbsolute } from "node:path";
+import process from "node:process";
+const PROBE = 'process.stdout.write("AGDF_RUNTIME_OK:"+process.versions.node)';
+const RUNTIME_PROBE_TIMEOUT_MS = 5_000;
+const text = value => typeof value === "string" && value.length > 0 && value.length <= 4096 && !/[\r\n\0]/u.test(value);
+const absolute = value => text(value) && isAbsolute(value);
+export function runtimeEnvironment(versions = process.versions) {
+  if (!text(versions.node)) throw new Error("unsupported_runtime");
+  return Object.freeze(versions.electron ? { ELECTRON_RUN_AS_NODE: "1" } : {});
+}
+
+function fileIdentity(path, stat) {
+  if (!absolute(path)) throw new Error("runtime_unavailable");
+  try {
+    const s = stat(path);
+    if (!s.isFile()) throw new Error();
+    return [s.dev, s.ino, s.size, s.mtimeMs, s.ctimeMs];
+  } catch { throw new Error("runtime_unavailable"); }
+}
+
+export function createRuntimeProbe({ spawn = spawnSync, stat = statSync } = {}) {
+  let cached;
+  return ({ executable = process.execPath, versions = process.versions } = {}) => {
+    const environment = runtimeEnvironment(versions);
+    // Bootstrap options can execute preload modules before the fixed probe. Never probe
+    // an inherited module-loading configuration or silently change the advertised tuple.
+    if (process.env.NODE_OPTIONS || process.env.NODE_PATH) {
+      cached = null;
+      throw new Error("runtime_bootstrap_environment_unsupported");
+    }
+    const identity = JSON.stringify([executable, fileIdentity(executable, stat), versions.node,
+      versions.electron ?? null, versions.bun ?? null, environment,
+      process.env.NODE_OPTIONS ?? null, process.env.NODE_PATH ?? null]);
+    if (cached?.identity === identity) return cached.launch;
+    cached = null;
+    const child = spawn(executable, ["-e", PROBE], {
+      cwd: dirname(executable), env: { ...process.env, ...environment },
+      encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], shell: false,
+      timeout: RUNTIME_PROBE_TIMEOUT_MS, maxBuffer: 4096, windowsHide: true,
+    });
+    // Electron may emit OS diagnostics on stderr despite a successful exact probe.
+    // Nonzero exit, signal, timeout, output overflow and unexpected stdout still fail.
+    if (child.error || child.status !== 0 || child.signal
+        || child.stdout !== `AGDF_RUNTIME_OK:${versions.node}`) {
+      throw new Error("runtime_probe_failed");
+    }
+    // Do not cache a tuple whose executable was replaced during the probe.
+    const after = JSON.stringify([executable, fileIdentity(executable, stat), versions.node,
+      versions.electron ?? null, versions.bun ?? null, environment,
+      process.env.NODE_OPTIONS ?? null, process.env.NODE_PATH ?? null]);
+    if (after !== identity) throw new Error("runtime_identity_changed");
+    const launch = Object.freeze({ executable, environment });
+    cached = { identity, launch };
+    return launch;
+  };
+}
+
+const probeRuntime = createRuntimeProbe();
+

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/runtime/validator-application.js

@@ -1,10 +1,10 @@
 import process from "node:process";
 import { createValidationHandlers } from "../cli/validation-handlers.js";
-import { validateCommandOptions } from "../cli/command-registry.js";
+import { validateCommandOptions, commandGroupRoutes } from "../cli/command-registry.js";
 import { CliUsageError, parseArgs } from "../cli/parse-args.js";
 import { pluginDefinition } from "../cli/runtime-context.js";
 
-const validatorCommands = new Set(["doctor", "gate-check", "delivery-map", "delivery-path-search"]);
+const validatorCommands = new Set(["target-check", "skill-dispatch", "doctor", "gate-check", "delivery-map", "delivery-path-search", "contract", "control-maintenance", "run-create", "run-present", "run-update", "run-revise", "run-step", "run-approve", ...Object.keys(commandGroupRoutes)]);
 
 export async function runValidatorCli(argv = process.argv.slice(2), adapters = {}) {
   const io = adapters.io ?? console;
@@ -22,7 +22,7 @@ export async function runValidatorCli(argv = process.argv.slice(2), adapters = {
     return error.exitCode;
   }
   if (parsed.kind === "help") {
-    io.log("AGDF surface-local validator: doctor | gate-check | delivery-map | delivery-path-search");
+    io.log("AGDF surface-local validator: target-check | skill-dispatch | doctor | gate-check | delivery-map | delivery-path-search | contract | control-maintenance | run-create | run-present | run-update | run-revise | run-step | run-approve");
     return 0;
   }
   let options;

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/runtime-check-consent/contract.js

@@ -1,3 +1,7 @@
+import { sessionCommand as codexSessionCommand } from "../host-adapters/codex/session-command.js";
+import { sessionCommand as claudeSessionCommand } from "../host-adapters/claude/session-command.js";
+import { sessionCommand as copilotSessionCommand } from "../host-adapters/copilot/session-command.js";
+import { sessionCommand as openCodeSessionCommand } from "../host-adapters/opencode/session-command.js";
 import { createHash } from "node:crypto";
 
 const OPERATIONS = Object.freeze([
@@ -31,7 +35,7 @@ export function validateRuntimeCheckCapability(capability) {
     throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: read-only constraints required");
   }
   const surfaces = capability.surfaces ?? {};
-  if (surfaces.codex !== "native-hook-review" || surfaces.claude !== "exact-command-rule"
+  if (surfaces.codex !== "native-hook-review" || surfaces.claude !== "plugin-enablement"
       || surfaces.copilot !== "plugin-hook-review"
       || surfaces.opencode !== "plugin-internal"
       || surfaces["portable-skills"] !== "manual-external-required") {
@@ -59,13 +63,10 @@ export function runtimeCheckCapabilityIdentity({ capability, surface, runtimeDig
 }
 
 export function fixedRuntimeCheckCommand(surface, pluginRoot, platform = process.platform) {
-  if (surface === "opencode") return "plugin:agdf:automatic-runtime-checks";
-  if (surface === "copilot") return 'node "${PLUGIN_ROOT}/runtime/agdf-session-check.js"';
-  if (surface === "codex" || surface === "claude") {
-    return platform === "win32"
-      ? "node \"$([Environment]::GetEnvironmentVariable('PLUGIN_ROOT') + [Environment]::GetEnvironmentVariable('CLAUDE_PLUGIN_ROOT'))\\runtime\\agdf-session-check.js\""
-      : "node \"${PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT}}/runtime/agdf-session-check.js\"";
-  }
+  if (surface === "opencode") return openCodeSessionCommand(pluginRoot, platform);
+  if (surface === "copilot") return copilotSessionCommand(pluginRoot, platform);
+  if (surface === "codex") return codexSessionCommand(pluginRoot, platform);
+  if (surface === "claude") return claudeSessionCommand(pluginRoot, platform);
   const normalizedRoot = platform === "win32" ? pluginRoot.replaceAll("/", "\\") : pluginRoot;
   return `node \"${normalizedRoot}${platform === "win32" ? "\\" : "/"}runtime${platform === "win32" ? "\\" : "/"}agdf-session-check.js\"`;
 }

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/skill-dispatch/binding.js

@@ -0,0 +1,9 @@
+import process from "node:process";
+import { createDispatchBinding as buildBinding } from "#agdf-core/skill-dispatch/binding.js";
+import { createRuntimeProbe } from "../runtime/runtime-probe.js";
+export { createRuntimeProbe, runtimeEnvironment } from "../runtime/runtime-probe.js";
+export { validateDispatchBinding, unavailableDispatchContext } from "#agdf-core/skill-dispatch/binding.js";
+const probeRuntime = createRuntimeProbe();
+export function createDispatchBinding(options, dependencies = {}) {
+  return buildBinding({ executable: process.execPath, versions: process.versions, ...options }, { probe: probeRuntime, ...dependencies });
+}

package/generated/plugins/copilot/agdf/runtime/create-agdf/package.json

@@ -1,6 +1,10 @@
 {
   "name": "@agdf/local-validator-runtime",
-  "version": "0.14.5",
+  "version": "0.20.1",
   "private": true,
-  "type": "module"
+  "type": "module",
+  "imports": {
+    "#agdf-core": "./runtime/core/lib/index.js",
+    "#agdf-core/*": "./runtime/core/lib/*"
+  }
 }

package/generated/plugins/copilot/agdf/runtime/create-agdf/runtime/core/lib/control-evaluation/acceptance-criteria.js

@@ -0,0 +1,61 @@
+import { section } from "./markdown-table.js";
+const CRITERION_ID = /^[A-Z][A-Z0-9]*(?:-[A-Z0-9]+)*$/u;
+
+export const ACCEPTANCE_CRITERIA_FORMAT = Object.freeze({
+  section: "Acceptance Criteria", declaration: "criterion_id: <stable id>",
+  fields: "semicolon-separated inline fields or following bullet key: value lines",
+  id_pattern: CRITERION_ID.source,
+  examples: Object.freeze([
+    "## Acceptance Criteria\n- criterion_id: AC-001; observable_success: Saved choice remains selected",
+    "## Acceptance Criteria\n- criterion_id: AC-001\n  - observable_success: Saved choice remains selected",
+  ]),
+});
+
+// Shared readiness/presentation grammar, retaining legacy inline declarations.
+// Diagnostics refer to the original file and line, not a rewritten normal form.
+export function readAcceptanceCriteria(markdown, { source = "PRD" } = {}) {
+  const normalized = String(markdown).replace(/\r\n?/gu, "\n");
+  const body = section(normalized, "Acceptance Criteria");
+  const entries = [], diagnostics = [], openItems = [];
+  const report = (code, line, field, message) => {
+    diagnostics.push({ code, source, line, field, message }); openItems.push(message);
+  };
+  if (body === null) {
+    report("criteria_section_missing", 1, "Acceptance Criteria", "PRD Acceptance Criteria section is missing");
+    return { ids: [], entries, diagnostics, openItems };
+  }
+  const startLine = normalized.slice(0, normalized.indexOf(body)).split("\n").length;
+  let current = null;
+  const field = (clause, line) => {
+    const match = clause.trim().replace(/^[-*]\s*/u, "").match(/^([a-z][a-z0-9_-]*(?:\s+[a-z][a-z0-9_-]*)*)\s*:\s*(.*)$/iu);
+    if (!match) return;
+    const name = match[1].replace(/\s+/gu, "_").toLowerCase();
+    if (Object.hasOwn(current.fields, name)) {
+      report("criterion_field_duplicate", line, name, `Duplicate PRD criterion field ${name}: ${current.id}`); return;
+    }
+    current.fields[name] = match[2].trim(); current.field_lines[name] = line;
+  };
+  for (const [index, line] of body.split("\n").entries()) {
+    const lineNumber = startLine + index;
+    if (/criterion_id\s*:/iu.test(line)) {
+      const match = line.match(/criterion_id\s*:\s*([A-Za-z][A-Za-z0-9_-]*)\b(.*)$/iu);
+      const id = match?.[1]?.toUpperCase();
+      if (!id || !CRITERION_ID.test(id)) {
+        report("criterion_id_invalid", lineNumber, "criterion_id", "Every PRD acceptance criterion needs a stable criterion_id");
+        current = null; continue;
+      }
+      current = { id, fields: {}, source, line: lineNumber, field_lines: {} }; entries.push(current);
+      const tail = match[2].trim();
+      if (tail && !tail.startsWith(";")) report("criterion_fields_ambiguous", lineNumber, "criterion_id", `Ambiguous PRD criterion fields: ${id}`);
+      else for (const clause of tail.replace(/^;/u, "").split(/;\s*/u)) field(clause, lineNumber);
+    } else if (/^#{1,6}\s/u.test(line)) current = null;
+    else if (current && /^\s*[-*]\s*[^:]+:/u.test(line)) field(line, lineNumber);
+  }
+  if (!entries.length) report("criteria_missing", startLine, "criterion_id", "Add at least one stable criterion_id to PRD acceptance criteria");
+  const seen = new Set();
+  for (const entry of entries) {
+    if (seen.has(entry.id)) report("criterion_id_duplicate", entry.line, "criterion_id", `Duplicate PRD criterion_id: ${entry.id}`);
+    seen.add(entry.id);
+  }
+  return { ids: entries.map(entry => entry.id), entries, diagnostics, openItems: [...new Set(openItems)] };
+}

package/generated/plugins/copilot/agdf/runtime/create-agdf/runtime/core/lib/control-evaluation/backlog-vocabulary.d.ts

@@ -0,0 +1,3 @@
+export const SUMMARY_KINDS: readonly string[];
+export const SUMMARY_LABELS: Readonly<Record<string, readonly string[]>>;
+export function summaryLabel(kind: string, language?: string): string;

package/generated/plugins/copilot/agdf/runtime/create-agdf/runtime/core/lib/control-evaluation/backlog-vocabulary.js

@@ -0,0 +1,15 @@
+// Descriptive saved labels only. Gate policy and QA remain the decision owners.
+export const SUMMARY_KINDS = Object.freeze(['work_pending', 'approval_pending', 'qa_report_pending',
+  'qa_evidence_open', 'qa_correction_open', 'qa_source_decision', 'qa_blocked', 'source_unconfirmed',
+  'closeout_pending', 'completed', 'unconfirmed']);
+export const SUMMARY_LABELS = Object.freeze({
+  work_pending: ['Work pending', 'Arbeit offen'], approval_pending: ['Approval pending', 'Freigabe ausstehend'],
+  qa_report_pending: ['QA report pending', 'QA-Bericht ausstehend'],
+  qa_evidence_open: ['QA evidence open', 'QA-Nachweis offen'],
+  qa_correction_open: ['QA correction open', 'QA-Korrektur offen'],
+  qa_source_decision: ['QA source decision required', 'QA: vorgelagerte Entscheidung erforderlich'],
+  qa_blocked: ['QA blocked', 'QA blockiert'], source_unconfirmed: ['Source unconfirmed', 'Quelle nicht bestätigt'],
+  closeout_pending: ['Closeout pending', 'Abschluss offen'], completed: ['Completed', 'Abgeschlossen'],
+  unconfirmed: ['Unconfirmed', 'Nicht bestätigt'],
+});
+export const summaryLabel = (kind, language = 'en') => SUMMARY_LABELS[kind]?.[language === 'de' ? 1 : 0] ?? SUMMARY_LABELS.unconfirmed[language === 'de' ? 1 : 0];