create-agdf 0.20.2 → 0.31.0

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/cli/planned-command.js

@@ -0,0 +1,55 @@
+import { randomUUID } from 'node:crypto';
+import { resolve } from 'node:path';
+import { openSync, closeSync, fstatSync, lstatSync, readFileSync, constants } from 'node:fs';
+import { createRunCommandService } from '#agdf-core/control-state/run-command-service.js';
+import { createRunMaterialStore } from '#agdf-core/control-state/run-material.js';
+import { resolveControlCommandTarget } from '#agdf-core/control-state/approval-command-contract.js';
+import { planningId, inspectPlannedEntry, inspectPlannedOperation } from '#agdf-core/control-state/planned-entry.js';
+import { readPlannedInventory } from '#agdf-core/control-state/planned-inventory.js';
+import { pluginDefinition } from './runtime-context.js';
+
+function readUr(path) {
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 131072) throw Error('planned_source_invalid');
+  const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const actual = fstatSync(fd);
+    if (actual.ino !== stat.ino || actual.dev !== stat.dev || actual.size !== stat.size) throw Error('planned_source_changed');
+    const bytes = readFileSync(fd);
+    if (bytes.length > 131072) throw Error('planned_source_limit');
+    return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+  } finally { closeSync(fd); }
+}
+export function executePlannedCli(options, io = console) {
+  const store = createRunMaterialStore();
+  try {
+    const root = resolveControlCommandTarget(options.dir), action = options.recoveryAction;
+    const emit = value => { io.log(JSON.stringify(value, null, 2)); return ['rejected', 'effect_unknown', 'recovery_required'].includes(value.outcome) ? 2 : 0; };
+    if (options.target === 'planned' && action === 'list') return emit(readPlannedInventory(root.root));
+    if (options.target === 'planned' && action === 'inspect') return emit(inspectPlannedEntry(root.root, options.planId));
+    if (action === 'status') return emit(inspectPlannedOperation(root.root, options.planId, options.operationId));
+    const operation_id = options.operationId ?? randomUUID();
+    const base = { schema_version: '1', presentation_language: options.language?.chat_language ?? 'en', working_directory: root.root,
+      primary_target: root.root, target_source: 'explicit_target', target_id: root.target_id, operation_id, assurance: 'cooperative_local' };
+    const scope = { plan_id: action === 'create' ? planningId(operation_id) : options.planId, expected_digest: action === 'create' ? null : options.sourceDigest };
+    const bound = { ...base, planning: scope };
+    if (action === 'start') {
+      const entry = inspectPlannedEntry(root.root, scope.plan_id);
+      return emit(createRunCommandService({ packageVersion: pluginDefinition.version })('agdf_run', { ...bound, command: { kind: 'run.create_from_planned', payload: { title: entry.title } } }));
+    }
+    const content = readUr(resolve(options.workingDirectory, options.stepFields.evidence)), bytes = Buffer.from(content);
+    const stage = payload => store.stage({ ...bound, operation_id: randomUUID(), command: { kind: 'planned_material.stage', payload } });
+    const started = stage({ action: 'begin', files: [{ slot: 'UR', bytes: bytes.length }] });
+    if (started.outcome !== 'accepted') return emit(started);
+    const transfer_id = started.family_result.transfer_id;
+    for (let offset = 0; offset < bytes.length; offset += 16384) {
+      const chunk = stage({ action: 'append', transfer_id, file: 0, offset, data: bytes.subarray(offset, offset + 16384).toString('base64') });
+      if (chunk.outcome !== 'accepted') return emit(chunk);
+    }
+    const sealed = stage({ action: 'seal', transfer_id }); if (sealed.outcome !== 'accepted') return emit(sealed);
+    const input = { ...bound, command: { kind: `planned_ur.${action}`, payload: { source: sealed.family_result.files[0].reference,
+      ...(options.priority ? { priority: options.priority } : {}) } } };
+    return emit(createRunCommandService({ packageVersion: pluginDefinition.version, materialGrants: store.grants(input) })('agdf_record', input));
+  } catch (error) { io.error(error.code ?? error.message); return 1; }
+  finally { store.close(); }
+}

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/cli/project-read-command.js

@@ -0,0 +1,64 @@
+import { createCoreServices } from '#agdf-core';
+import { readRunView } from '#agdf-core/companion/run-view.js';
+import { resources, resolveConfiguredChatLanguage } from '../runtime/control-context.js';
+import { cliGitObservation } from '../control-evaluation/git-observation.js';
+import { RUN_ID_PATTERN } from '#agdf-core/control-state/run-identity.js';
+import { CliUsageError } from './parse-args.js';
+
+// An explicit --language wins; otherwise the configured chat language. A configuration that cannot be
+// resolved (unsupported layout, invalid value) must not hide the store diagnosis (PRD AC-002), so the
+// language is left to Core as executeProjectRead does: an unsupported store is reported in `store`,
+// an invalid configuration as the evaluation error of every evaluated run (CR finding CIR-05; both
+// cases are covered by run-view-command-test.js).
+const readLanguage = options => {
+  if (options.languageExplicit) return options.language?.chat_language;
+  try { return resolveConfiguredChatLanguage(options.dir); } catch { return undefined; }
+};
+
+// Read-only companion run view (SD SDD-001): the status card fields of every active or unreadable
+// run of one project root plus every run named with --run, versioned run-view/1. Writes nothing.
+// Exit 0 for a complete view, 2 when the store is unavailable or has no control folder.
+export function executeRunView(options, io = console) {
+  // A malformed run id is a usage error, never an evaluated run of its own (CR finding C3).
+  const invalid = (options.runIds ?? []).find(runId => !RUN_ID_PATTERN.test(runId));
+  if (invalid !== undefined) throw new CliUsageError(`run-view --run requires a run id (${RUN_ID_PATTERN}); got ${JSON.stringify(invalid)}.`);
+  const view = readRunView(options.dir, { language: readLanguage(options), runIds: options.runIds ?? [] });
+  if (options.json) io.log(JSON.stringify(view, null, 2));
+  else {
+    io.log(`AGDF run-view: ${view.store.status}${view.store.reason ? ` (${view.store.reason})` : ''}`);
+    for (const run of view.runs) io.log(`- ${run.run_id}: ${run.evaluated ? `${run.status} · ${run.current_gate} · ${run.next_step_text}` : run.lifecycle ?? 'unreadable'}`);
+  }
+  return view.store.status === 'ok' ? 0 : 2;
+}
+
+// CLI syntax only. Target confirmation, facts and original-operation semantics
+// stay with the same inspect owner used by MCP.
+export function executeProjectRead(options, io = console) {
+  let language = options.language?.chat_language;
+  if (!options.languageExplicit) {
+    try { language = resolveConfiguredChatLanguage(options.dir); }
+    catch { /* Core still reports the invalid configuration and original receipt facts. */ }
+  }
+  const result = createCoreServices({ resources, observers: { gitObservation: cliGitObservation } }).inspect({
+    operation: options.target, workingDirectory: options.dir, targetSource: 'explicit_target', primaryTarget: options.dir,
+    presentationLanguage: language,
+    expectedVersion: resources.pluginDefinition.version, interactionLocales: resources.interactionLocales,
+    ...(options.contractModule ? { contractModule: options.contractModule } : {}),
+  });
+  if (options.json) io.log(JSON.stringify(result, null, 2));
+  else {
+    const report = result.report;
+    io.log(`AGDF ${options.target}: ${report?.status ?? result.outcome}`);
+    if (report?.target_id) io.log(`Target: ${report.target_id}`);
+    if (report?.operation_id) io.log(`Operation: ${report.operation_id}`);
+    if (report?.current_setup) io.log(`Current setup: ${report.current_setup}`);
+    if (report?.plan) io.log(`Plan: ${report.plan.file_count} files; ${report.plan.plan_digest}`);
+    if (report?.receipt?.receipt_digest) io.log(`Receipt: ${report.receipt.receipt_digest}`);
+    if (report?.reason) io.log(`Reason: ${report.reason}`);
+    if (report?.recovery?.instruction) io.log(`Recovery: ${report.recovery.instruction}`);
+    if (report?.next_calls?.length) io.log(`Next: ${JSON.stringify(report.next_calls)}`);
+    if (result.host_action?.text) io.log(result.host_action.text);
+  }
+  return result.outcome === 'inspect_result' && result.report?.available === true
+    && !['blocked', 'unavailable', 'incomplete'].includes(result.report.status) ? 0 : 2;
+}

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/cli/run-command-aliases.js

@@ -0,0 +1,116 @@
+import { renderSourceRevision } from '#agdf-core/interaction-presentation.js';
+import { interactionLocales } from './runtime-context.js';
+import { resolveMcpInput } from '#agdf-core/mcp-input-resolution.js';
+import { withInputResolution } from '#agdf-core/control-state/input-resolution.js';
+import { commandGroupDefinition } from '#agdf-core/control-state/run-command-schema.js';
+import { inspectRunInputResolution } from '#agdf-core/control-state/run-input-resolution.js';
+import { randomUUID } from 'node:crypto';
+import { openSync, closeSync, constants, fstatSync, lstatSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { createCoreServices } from '#agdf-core';
+import { createRunMaterialStore } from '#agdf-core/control-state/run-material.js';
+import { resolveControlCommandTarget, digest } from '#agdf-core/control-state/approval-command-contract.js';
+import { canonicalRunText, artefactFileDigest } from '#agdf-core/control-state/run-seal.js';
+import { inspectRunOperation } from '#agdf-core/control-state/run-operation-status.js';
+import { inspectSourceRevision } from '#agdf-core/control-state/run-revision.js';
+import { runDocumentPath } from '#agdf-core/control-state/run-identity.js';
+import { resources } from '../runtime/control-context.js';
+import { cliGitObservation } from '../control-evaluation/git-observation.js';
+
+function sourceText(options, limit = 131072) {
+  const supplied = options.stepFields?.evidence;
+  if (!supplied) throw Error('A bounded source file is required: --evidence <path>.');
+  const path = resolve(options.workingDirectory, supplied), before = lstatSync(path);
+  if (!before.isFile() || before.isSymbolicLink() || before.size > limit) throw Error('source_invalid');
+  const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const stat = fstatSync(fd), bytes = readFileSync(fd);
+    if (stat.ino !== before.ino || stat.dev !== before.dev || stat.size !== before.size || bytes.length > limit) throw Error('source_changed');
+    return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+  } finally { closeSync(fd); }
+}
+function printResult(result, options, io, identity) {
+  if (options.target === 'run-revise' && !options.json) {
+    const shown = result.outcome === 'already_applied' ? { ...result, outcome: 'replayed' } : result.family_result ?? result;
+    io.log(renderSourceRevision(shown, interactionLocales, options.language.chat_language, identity).markdown);
+  } else io.log(JSON.stringify(result, null, 2));
+}
+export function executeRunAlias(options, io = console) {
+  const store = createRunMaterialStore();
+  try {
+    const target = resolveControlCommandTarget(options.dir), fields = options.stepFields ?? {};
+    const input = { working_directory: options.workingDirectory, primary_target: target.root,
+      target_source: options.dirExplicit ? 'explicit_target' : 'current_repository', target_id: target.target_id,
+      operation_id: options.operationId ?? randomUUID(), ...(options.assurance !== undefined ? { assurance: options.assurance } : {}), ...(options.languageExplicit ? { presentation_language: options.language.chat_language } : {}),
+      ...(options.runId ? { run_id: options.runId, expected_revision_id: options.revisionId } : {}) };
+    const services = grants => createCoreServices({ resources, observers: { gitObservation: cliGitObservation, materialGrants: grants } });
+    const normalize = (group, original, action) => {
+      const selected = resolveMcpInput(commandGroupDefinition(group), original, { defaults: resources.defaults, lookupOriginal: inspectRunInputResolution });
+      return withInputResolution(selected.resolution, () => action(selected.arguments), selected.original);
+    };
+    const emit = result => {
+      printResult(result, options, io, { target: target.root, runId: options.runId, operationId: input.operation_id, revisionId: options.revisionId });
+      return ['accepted', 'already_applied', 'preview', 'historical', 'recovered'].includes(result.outcome) ? 0 : 2;
+    };
+    const material = (slot, content) => {
+      // The Core digest binds canonical content, not an expiring transfer UUID.
+      // A recorded original operation needs no new transfer or stale admission;
+      // the Core still checks its exact logical request before acknowledging it.
+      const observed = options.runId ? inspectRunOperation(target.root, { runId: options.runId, operationId: input.operation_id, targetId: input.target_id }) : null;
+      if (observed?.status === 'recorded') return { material_id: randomUUID(), digest: digest(canonicalRunText(content)) };
+      const bytes = Buffer.from(content), stage = payload => normalize('agdf_record', { ...input,
+        operation_id: randomUUID(), command: { kind: 'material.stage', payload } }, value => store.stage(value));
+      const started = stage({ action: 'begin', files: [{ slot, bytes: bytes.length }] });
+      if (started.outcome !== 'accepted') throw Object.assign(Error(started.reason ?? 'material_unavailable'), { result: started });
+      const transfer_id = started.family_result.transfer_id;
+      for (let offset = 0; offset < bytes.length; offset += 16384) {
+        const part = stage({ action: 'append', transfer_id, file: 0, offset, data: bytes.subarray(offset, offset + 16384).toString('base64') });
+        if (part.outcome !== 'accepted') throw Object.assign(Error(part.reason ?? 'material_unavailable'), { result: part });
+      }
+      const sealed = stage({ action: 'seal', transfer_id });
+      if (sealed.outcome !== 'accepted') throw Object.assign(Error(sealed.reason ?? 'material_unavailable'), { result: sealed });
+      return sealed.family_result.files[0].reference;
+    };
+    let group, command;
+    if (options.target === 'run-create') { group = 'agdf_run'; command = { kind: 'run.create', payload: { title: fields.title } }; }
+    else if (options.target === 'run-present') { group = 'agdf_prepare'; command = { kind: 'presentation.prepare', payload: { gate: options.gate } }; }
+    else if (options.target === 'run-approve') { group = 'agdf_approve'; command = { kind: 'approval.record', payload: { gate: options.gate, presentation_id: options.presentationId, response: options.response } }; }
+    else if (options.target === 'run-step') {
+      const step = options.runStep, slot = step === 'artefact' ? options.gate : ({ ur: 'UR', route: 'Brownfield Review', review: 'CR', evidence: 'EVIDENCE', closeout: 'OR' })[step];
+      if (!slot) throw Error('step_invalid');
+      const source = material(slot, sourceText(options));
+      if (step === 'artefact') { group = 'agdf_record'; command = { kind: 'artefact.record', payload: { gate: options.gate, material: source,
+        reviewer: fields.reviewer, reviewed: fields.reviewed === 'true', update_draft: fields.updateDraft === 'true' } }; }
+      else if (step === 'closeout') { group = 'agdf_closeout'; command = { kind: 'closeout.record', payload: { or: source, confirmation: options.closureConfirmation } }; }
+      else { group = 'agdf_record'; command = { kind: 'step.record', payload: { step, source,
+        ...(step === 'ur' ? { title: fields.title } : step === 'route' ? { reason: fields.reason, route: fields.route }
+          : step === 'review' ? { decision: fields.decision } : { reason: fields.reason, covers: fields.covers }) } }; }
+    } else if (options.target === 'run-revise') {
+      group = 'agdf_revise';
+      if (options.revisionMode === 'inspect') return emit(inspectSourceRevision(target.root, { runId: options.runId, operationId: input.operation_id, revisionId: options.revisionId }));
+      if (options.revisionMode) command = { kind: `source_revision.${options.revisionMode}`, payload: {
+        source_gate: options.sourceGate, proposal: material('EVIDENCE', sourceText(options)),
+        ...(options.revisionMode === 'apply' ? { preview_digest: options.previewDigest, confirmation: options.closureConfirmation }
+          : options.revisionMode === 'recover' ? { recovery_revision_id: options.revisionId, pending_digest: options.pendingDigest } : {}) } };
+      else { const path = runDocumentPath(options.runId, 'PRD.md'); command = { kind: 'prd_revision.reopen', payload: {
+        prd: { path, digest: artefactFileDigest(target.root, path) }, confirmation: options.closureConfirmation } }; }
+    } else if (options.target === 'run-close') {
+      delete input.run_id; delete input.expected_revision_id;
+      group = 'agdf_closeout';
+      const entries = options.closureFile ? JSON.parse(sourceText({ ...options, stepFields: { evidence: options.closureFile } }, 65536)).entries
+        : [{ run_id: options.runId, outcome: options.closureOutcome, reason: fields.reason,
+          ...(options.successorRun ? { successor_run: options.successorRun } : options.successorReference ? { successor_reference: options.successorReference } : {}) }];
+      command = { kind: `closure.${options.recoveryAction}`, payload: options.recoveryAction === 'apply'
+        ? { preview_id: options.recoveryPreviewId, confirmation: options.closureConfirmation } : { entries } };
+    } else throw Error('command_unsupported');
+    const bound = { ...input, command };
+    return emit(normalize(group, bound, value => services(store.grants(value)).command(group, value)));
+  } catch (error) {
+    const identity = { target: options.dir, runId: options.runId, operationId: options.operationId, revisionId: options.revisionId };
+    if (error.result) printResult(error.result, options, io, identity);
+    else if (options.target === 'run-revise' && !options.json) printResult({ outcome: 'rejected', reason: error.code ?? error.message }, options, io, identity);
+    else io.error(error.code ?? error.message);
+    return 2;
+  }
+  finally { store.close(); }
+}

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/cli/runtime-context.js

@@ -1,60 +1,2 @@
-import process from "node:process";
-import {
-  canonicalizeLanguageTag,
-} from "#agdf-core/interaction-presentation.js";
-
-import { configuredLanguage, interactionLocales } from "../runtime/control-context.js";
 export { packageRoot, generatedRoot, pluginDefinition, interactionLocales, configuredLanguage, resolveConfiguredChatLanguage } from "../runtime/control-context.js";
-
-export function canonicalizeDetectedSystemLocale(value) {
-  if (typeof value !== "string") return "";
-  const candidate = value.trim().split(":", 1)[0];
-  if (!candidate || /^(?:C|POSIX)(?:\.|$)/iu.test(candidate)) return "";
-  const withoutModifier = candidate.split("@", 1)[0];
-  const withoutEncoding = withoutModifier.split(".", 1)[0];
-  return canonicalizeLanguageTag(withoutEncoding.replaceAll("_", "-"));
-}
-
-export function detectSystemLocale(env = process.env) {
-  const envLocale = env.LC_ALL || env.LC_MESSAGES || env.LANG || env.LANGUAGE || "";
-  if (envLocale) return envLocale;
-  try {
-    return Intl.DateTimeFormat().resolvedOptions().locale || "";
-  } catch {
-    return "";
-  }
-}
-
-export function resolveLanguagePreference(explicitLanguage, env = process.env) {
-  const explicit = configuredLanguage(explicitLanguage);
-  if (explicit) {
-    return {
-      artifact_language: explicit,
-      chat_language: explicit,
-      runtime_language: "en",
-      source: "parameter",
-      detected_locale: detectSystemLocale(env) || "unknown",
-    };
-  }
-
-  const detectedLocale = detectSystemLocale(env);
-  const detectedTag = canonicalizeDetectedSystemLocale(detectedLocale);
-  const detected = configuredLanguage(detectedTag) || "en";
-  return {
-    artifact_language: detected,
-    chat_language: detected,
-    runtime_language: "en",
-    source: detectedLocale ? "system_locale" : "default",
-    detected_locale: detectedLocale || "unknown",
-  };
-}
-
-export function languageConfigContent(languagePreference) {
-  return `${JSON.stringify({
-    artifact_language: languagePreference.artifact_language,
-    chat_language: languagePreference.chat_language,
-    runtime_language: languagePreference.runtime_language,
-    source: languagePreference.source,
-    detected_locale: languagePreference.detected_locale,
-  }, null, 2)}\n`;
-}
+export { canonicalizeDetectedSystemLocale, detectSystemLocale, resolveLanguagePreference, languageConfigContent } from "#agdf-core/resources/language-preference.js";

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/cli/validation-handlers.js

@@ -1,13 +1,11 @@
-import { recordGateApprovalCommand, resolveControlCommandTarget } from "../control-command.js";
-import { COOPERATIVE_ASSURANCE } from "#agdf-core/control-state/approval-command-contract.js";
+import { executeRunAlias } from './run-command-aliases.js';
+import { executeProjectRead, executeRunView } from './project-read-command.js';
+import { localePack } from '#agdf-core/interaction-presentation.js';
+import { renderCodexDocument } from './codex-document-command.js';
 import { readFileSync, lstatSync, openSync, fstatSync, closeSync, constants } from "node:fs";
 import { commandGroupRoutes } from './command-registry.js';
 import { RUN_COMMAND_LIMITS } from '#agdf-core/control-state/run-command-contract.js';
 import { executeControlMaintenance } from "./control-maintenance-command.js";
-import { createRun } from "#agdf-core/control-state/run-state-repository.js";
-import { extractField } from "#agdf-core/control-evaluation/verified-change.js";
-import { ARTEFACT_TEMPLATE_IDS, resolveArtefactTemplatePath } from "#agdf-core/resources/artefact-templates.js";
-import { prepareRunPresentation } from "#agdf-core/control-state/run-presentation.js";
 import {
   buildStatusCard,
   evaluateGateCheck,
@@ -19,19 +17,19 @@ import { evaluateDeliveryMap, printDeliveryMapReport } from "#agdf-core/control-
 import { evaluateDoctor, printDoctorReport } from "#agdf-core/control-evaluation/doctor.js";
 import { executeDeliveryPathSearch } from "./delivery-path-search-command.js";
 import { resolveTaskTarget } from "#agdf-core/task-target-resolution.js";
-import { renderSkillDispatchRecovery, renderTaskTargetOrientation, renderSourceRevision } from "#agdf-core/interaction-presentation.js";
+import { renderSkillDispatchRecovery, renderTaskTargetOrientation, renderSourceRevision, renderRunInventory } from "#agdf-core/interaction-presentation.js";
+import { readRunInventory } from "#agdf-core/control-state/run-inventory-reader.js";
+import { readWorkInventory } from '#agdf-core/control-state/planned-inventory.js';
+import { readControlLayout, CURRENT_LAYOUT } from '#agdf-core/control-state/control-layout.js';
+import { executePlannedCli } from './planned-command.js';
 import { interactionLocales, pluginDefinition } from "./runtime-context.js";
 import { serializeSkillDispatchResult } from "#agdf-core/skill-dispatch/contract.js";
 import { createCoreServices } from "#agdf-core";
 import { resources } from "../runtime/control-context.js";
-import { approveRunGate, recordRunRevision } from "#agdf-core/control-state/run-recording.js";
-import { reopenPrdRevision, previewSourceRevision, applySourceRevision, inspectSourceRevision, recoverSourceRevision } from "#agdf-core/control-state/run-revision.js";
 import { readRuntimeContract, readSkillRuntimeContracts } from "./contract-command.js";
-import { recordRunStep } from "#agdf-core/control-state/run-steps.js";
-import { policyForRunContent } from "#agdf-core/control-evaluation/run-step-policy.js";
 import { cliGitObservation } from "../control-evaluation/git-observation.js";
 import { resolveRepositoryContext } from "../repository-context.js";
-import { applyRunRecovery, inspectRunRecovery, previewRunRecovery } from "../control-state/run-recovery.js";
+import { resolveConfiguredChatLanguage } from "#agdf-core/resources/context.js";
 
 const evaluateDoctorWithCliGit = (target, selection) => evaluateDoctor(target, selection, cliGitObservation);
 const evaluateGateWithCliGit = (target, selection) => evaluateGateCheck(target, selection, cliGitObservation);
@@ -47,6 +45,10 @@ export function createValidationHandlers(io = console) {
     readSkillRuntimeContracts,
   } }).dispatch;
   return new Map([
+    ...['project-state', 'operation-status'].map(name => [name, options => executeProjectRead(options, io)]),
+    ['run-view', options => executeRunView(options, io)],
+    ['render-document', options => renderCodexDocument(options)],
+    ...['run-create', 'run-present', 'run-approve', 'run-step', 'run-revise', 'run-close'].map(name => [name, options => executeRunAlias(options, io)]),
     ...Object.entries(commandGroupRoutes).map(([route, group]) => [route, options => {
       let fd;
       try {
@@ -58,39 +60,14 @@ export function createValidationHandlers(io = console) {
         const bytes = readFileSync(fd);
         if (bytes.length > RUN_COMMAND_LIMITS.input_bytes) throw Error('command_file_invalid');
         const input = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
-        const result = createCoreServices({ resources }).command(group, input);
+        const result = createCoreServices({ resources, observers: { gitObservation: cliGitObservation } }).command(group, input);
         io.log(JSON.stringify(result));
         return ['accepted', 'already_applied'].includes(result.outcome) ? 0 : 2;
       } catch (error) { io.error(error.message); return 1; }
       finally { if (fd !== undefined) closeSync(fd); }
     }]),
     ["control-maintenance", (options) => executeControlMaintenance(options, io)],
-    ["run-create", (options) => {
-      try {
-        const path = createRun(options.dir, options.runId);
-        const revisionId = extractField(readFileSync(path, "utf8"), "revision_id");
-        io.log(path);
-        io.log(`revision_id: ${revisionId}`);
-        // The plugin-owned template is the only authoring source; repository scaffold copies are
-        // derived references. Run creation itself never fails on template availability.
-        let urTemplate = null;
-        try { urTemplate = resolveArtefactTemplatePath(ARTEFACT_TEMPLATE_IDS.UR); } catch {}
-        const templateSource = urTemplate
-          ? `the plugin-owned UR template at ${urTemplate}`
-          : "the plugin-owned UR template supplied as template_path by the bound ur-definition dispatch";
-        io.log(`Next: write .agdf/control/artefacts/${options.runId}/UR.md from ${templateSource}, then record it with run-step --run ${options.runId} --revision ${revisionId} --step ur --title "<short requirement title>".`);
-        return 0;
-      } catch (error) {
-        io.error(error instanceof Error ? error.message : String(error));
-        return 1;
-      }
-    }],
-    ["run-present", (options) => {
-      const result = prepareRunPresentation(options.dir, { runId: options.runId, gate: options.gate,
-        revisionId: options.revisionId, language: options.language?.chat_language }, { evaluateGateCheck: evaluateGateWithCliGit });
-      io.log(JSON.stringify(result, null, 2));
-      return result.outcome === "prepared" ? 0 : 2;
-    }],
+    ['planned', options => executePlannedCli(options, io)],
     ["target-check", (options) => {
       const report = resolveTaskTargetWithCliGit({
         targetSource: options.targetSource,
@@ -138,7 +115,13 @@ export function createValidationHandlers(io = console) {
     }],
     ["doctor", (options) => {
       const report = evaluateDoctorWithCliGit(options.dir, options);
-      printDoctorReport(report, options.json, io);
+      let emptyInventoryText;
+      if (report.empty_inventory && !options.json) {
+        const language = options.languageExplicit ? options.language.chat_language : resolveConfiguredChatLanguage(options.dir);
+        emptyInventoryText = localePack(interactionLocales, language).doctorEmptyInventory?.policyDescription
+          .replace('{policy}', String(report.empty_inventory.allow_no_active_runs));
+      }
+      printDoctorReport(report, options.json, io, { emptyInventoryText });
       return report.status === "block" ? 2 : 0;
     }],
     ["gate-check", (options) => {
@@ -154,6 +137,17 @@ export function createValidationHandlers(io = console) {
       if (presentationRendered === false) return 2;
       return report.status === "blocked" ? 2 : 0;
     }],
+    ["inventory", (options) => {
+      const language = options.languageExplicit ? options.language?.chat_language : resolveConfiguredChatLanguage(options.dir);
+      if (readControlLayout(options.dir).layout === CURRENT_LAYOUT) {
+        const inventory = readWorkInventory(options.dir, { language });
+        io.log(options.json ? JSON.stringify(inventory, null, 2) : inventory.entries.map(row => `${row.kind}: ${row.title} · ${row.coverage}`).join('\n'));
+        return inventory.state === 'unavailable' ? 2 : 0;
+      }
+      const inventory = readRunInventory(options.dir, { language });
+      io.log(options.json ? JSON.stringify(inventory, null, 2) : renderRunInventory(inventory, interactionLocales, language).markdown);
+      return 0;
+    }],
     ["delivery-map", (options) => {
       const report = evaluateDeliveryMap(options.dir, options, deliveryMapDependencies);
       printDeliveryMapReport(report, options.json, io);
@@ -168,69 +162,6 @@ export function createValidationHandlers(io = console) {
       io.log(options.json ? JSON.stringify({ module: result.module, content: result.content }) : result.content.replace(/\n$/u, ""));
       return 0;
     }],
-    ["run-update", (options) => {
-      const result = recordRunRevision(options.dir, { runId: options.runId, revisionId: options.revisionId });
-      io.log(JSON.stringify(result, null, 2));
-      return result.outcome === "rejected" ? 2 : 0;
-    }],
-    ["run-revise", (options) => {
-      const operation = { preview: previewSourceRevision, apply: applySourceRevision, inspect: inspectSourceRevision, recover: recoverSourceRevision }[options.revisionMode] ?? reopenPrdRevision;
-      const result = operation(options.dir, { runId: options.runId, revisionId: options.revisionId,
-        operationId: options.operationId, sourceGate: options.sourceGate, evidence: options.stepFields?.evidence, previewDigest: options.previewDigest });
-      io.log(options.revisionMode && !options.json ? renderSourceRevision(result, interactionLocales, options.language.chat_language,
-        { ...options, target: options.dir }).markdown : JSON.stringify(result, null, 2));
-      return ["rejected", "recovery_required"].includes(result.outcome) ? 2 : 0;
-    }],
-    ["run-step", (options) => {
-      const result = recordRunStep(options.dir, {
-        runId: options.runId,
-        revisionId: options.revisionId,
-        step: options.runStep,
-        ...(options.gate ? { gate: options.gate } : {}),
-        ...options.stepFields,
-      }, { policy: policyForRunContent });
-      io.log(JSON.stringify(result, null, 2));
-      return result.outcome === "rejected" ? 2 : 0;
-    }],
-    ["run-approve", (options) => {
-      let result;
-      if (options.assurance !== undefined && options.assurance !== "cooperative_local") {
-        result = { schema_version: "1", outcome: "rejected", run_id: options.runId,
-          reason: "unsupported_authority", assurance: COOPERATIVE_ASSURANCE };
-      } else if (options.operationId !== undefined) {
-        result = recordGateApprovalCommand(options.dir, {
-          schema_version: "1", action: "record_gate_approval",
-          target_id: resolveControlCommandTarget(options.dir).target_id, run_id: options.runId,
-          gate: options.gate, expected_revision_id: options.revisionId,
-          presentation_id: options.presentationId, response: options.response,
-          operation_id: options.operationId, assurance: options.assurance ?? "cooperative_local",
-        });
-      } else result = { ...approveRunGate(options.dir, {
-        runId: options.runId,
-        gate: options.gate,
-        revisionId: options.revisionId,
-        response: options.response,
-        presentationId: options.presentationId,
-      }, { evaluateGateCheck: evaluateGateWithCliGit }), assurance: COOPERATIVE_ASSURANCE };
-      io.log(JSON.stringify(result, null, 2));
-      return ["approved", "accepted", "already_applied"].includes(result.outcome) ? 0 : 2;
-    }],
-    ["run-recovery", (options) => {
-      try {
-        const result = options.recoveryAction === "inspect"
-          ? inspectRunRecovery(options.dir, options.runId)
-          : options.recoveryAction === "preview"
-            ? previewRunRecovery(options.dir, options.runId)
-            : applyRunRecovery(options.dir, { runId: options.runId,
-              previewId: options.recoveryPreviewId, confirmation: options.recoveryConfirmation });
-        io.log(JSON.stringify(result, null, 2));
-        return 0;
-      } catch (error) {
-        io.log(JSON.stringify({ schema_version: "1", outcome: "blocked", run_id: options.runId,
-          action: options.recoveryAction, reason: error instanceof Error ? error.message : String(error) }, null, 2));
-        return 2;
-      }
-    }],
     ["delivery-path-search", async (options) => {
       try {
         const result = await executeDeliveryPathSearch(options, io);

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/control-evaluation/git-observation.js

@@ -1,11 +1,12 @@
 import { execFileSync } from "node:child_process";
+const readOnlyOptions = ['--no-optional-locks', '-c', 'core.fsmonitor=false'];
 
 export function gitPathList(targetDir, args, exec = execFileSync) {
   try {
-    return exec("git", args, { cwd: targetDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] })
-      .split("\n")
-      .map((item) => item.trim())
-      .filter(Boolean);
+    if (![JSON.stringify(['diff', 'HEAD', '--name-only']), JSON.stringify(['ls-files', '--others', '--exclude-standard'])].includes(JSON.stringify(args))) return null;
+    const fixed = args[0] === 'diff' ? ['diff', '--no-ext-diff', '--no-textconv', ...args.slice(1)] : args;
+    const bytes = exec("git", [...readOnlyOptions, ...fixed, '-z'], { cwd: targetDir, encoding: 'buffer', stdio: ["ignore", "pipe", "ignore"], timeout: 3000, maxBuffer: 2 * 1024 * 1024 });
+    return new TextDecoder('utf-8', { fatal: true }).decode(bytes).split('\0').filter(item => item.length > 0);
   } catch {
     return null;
   }
@@ -13,7 +14,8 @@ export function gitPathList(targetDir, args, exec = execFileSync) {
 
 export function gitValue(targetDir, args, exec = execFileSync) {
   try {
-    return exec("git", args, { cwd: targetDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    if (![JSON.stringify(['rev-parse', 'HEAD']), JSON.stringify(['rev-parse', '--show-toplevel'])].includes(JSON.stringify(args))) return null;
+    return exec("git", [...readOnlyOptions, ...args], { cwd: targetDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 3000, maxBuffer: 2 * 1024 * 1024 }).trim();
   } catch {
     return null;
   }

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/control-maintenance/startup.js

@@ -20,6 +20,6 @@ export function inspectStartupCompatibility({ target, executable, validator, env
 }
 
 export function startupMaintenanceInvocation(facts, { executable, validator, language = "en" }) {
-  if (!["migration_required", "repair_required", "unavailable"].includes(facts.status)) return null;
-  return { executable, argv: [validator, "control-maintenance", "--dir", facts.target, "--guided", "--language", language], authorizes: false };
+  if (!["unsupported", "repair_required", "unavailable"].includes(facts.status)) return null;
+  return { executable, argv: [validator, "control-maintenance", "--dir", facts.target, "--language", language], authorizes: false };
 }

package/generated/plugins/copilot/agdf/runtime/create-agdf/lib/mcp-decision-protocol.js

@@ -0,0 +1,40 @@
+import { RUN_COMMAND_GROUPS, RUN_COMMAND_LIMITS } from '#agdf-core/control-state/run-command-schema.js';
+
+// Optional UI composition is deliberately outside the default headless import
+// closure. Full and thin UI fronts share this one structural contract.
+const unwrapped = () => { throw Object.assign(Error('generation_unavailable'), { code: 'generation_unavailable', dispatch: 'not_dispatched' }); };
+
+import { decisionActionDefinition, validateDecisionAction, DECISION_VIEW_DEFINITION, validateDecisionView } from '#agdf-core/control-state/decision-action-contract.js';
+import { COCKPIT_READ_DEFINITION, parseCockpitArguments } from '#agdf-core/control-inspect/cockpit-contract.js';
+
+export function composeMcpDecisionProtocol({ runtime, ui, prepared = unwrapped, open = unwrapped, read = unwrapped, action = unwrapped, close = () => {} } = {}) {
+  const groups = runtime.trustedContext.commandGroups;
+  const facade = decisionActionDefinition(groups);
+  const tools = [...runtime.tools];
+  if (groups.includes('agdf_prepare')) tools.push({ name: DECISION_VIEW_DEFINITION.name, definition: DECISION_VIEW_DEFINITION, requiresUi: true, parentOwned: true,
+    parse: input => { if (validateDecisionView(input).length) throw Error('decision_schema_invalid'); return input; },
+    execute: async (input, signal, host) => {
+      const remembered = prepared(input);
+      if (!remembered) return { schema_version: '1', outcome: 'rejected', reason: 'delivery_state_unavailable', authorizes: false };
+      const opened = await open(remembered.input, remembered.result, host);
+      return { schema_version: '1', outcome: opened._meta ? 'accepted' : 'rejected', reason: opened.app_reason ?? null,
+        app_capability: opened.app_capability, authorizes: false, ...(opened._meta ? { _meta: opened._meta } : {}) };
+    }, serialize: JSON.stringify });
+  tools.push({ name: COCKPIT_READ_DEFINITION.name, definition: COCKPIT_READ_DEFINITION, requiresUi: true, parentOwned: true,
+    parse: parseCockpitArguments, execute: (input, signal, host) => read(input, signal, host), serialize: value => JSON.stringify(value) });
+  if (facade) tools.push({ name: facade.name, definition: facade, requiresUi: true, parentOwned: true,
+    parse: input => { if (validateDecisionAction(input, facade.inputSchema.properties.action.enum).length) throw Error('decision_schema_invalid'); return input; },
+    execute: (input, signal, host) => action(input, host), serialize: value => JSON.stringify(value) });
+  const bytes = tools.filter(tool => Object.hasOwn(RUN_COMMAND_GROUPS, tool.name) || tool.name === facade?.name || tool.name === DECISION_VIEW_DEFINITION.name)
+    .reduce((sum, tool) => sum + Buffer.byteLength(JSON.stringify(tool.definition)), 0);
+  if (bytes > RUN_COMMAND_LIMITS.aggregate_definition_bytes) { void close(); throw Error('command_aggregate_definition_budget_exceeded'); }
+  return Object.freeze({ ...runtime, tools: Object.freeze(tools), ui, mode: 'decision',
+    tool: name => tools.find(tool => tool.name === name) ?? null,
+    failure(code, name, input, dispatch) {
+      return name === 'agdf_decision_action' ? { schema_version: '1', outcome: dispatch?.dispatch === 'not_dispatched' ? 'rejected' : 'effect_unknown',
+        reason: code, operation_id: input?.operation_id ?? null, authorizes: false, recovery: 'Inspect the original UUID; do not infer non-execution or submit another decision.' }
+        : ['agdf_cockpit_read', 'agdf_decision_view'].includes(name) ? { schema_version: '1', outcome: 'rejected', reason: code, authorizes: false } : runtime.failure(code, name, input, dispatch);
+    },
+  });
+}
+