fraim 2.0.360-next.0 → 2.0.360-next.2

package/dist/registry/scripts/learning/run-publication.js

@@ -76,7 +76,7 @@ function verifySharedProjectPublication(projectPath, file, expectedHash, publica
     return { published: true, reference: pr.url };
 }
 /** Existing publishers run in a bounded process. Cloud confirmation reads the actual pack without syncing it. */
-function publishRunFile(projectPath, file, home, operationKey, expectedHash, runtimeModulePath, entryProof) {
+function publishRunFile(projectPath, file, home, operationKey, expectedHash, runtimeModulePath, entryProof, verifyOnly = false) {
     const relative = home.level === 'Project' && node_path_1.default.resolve(file) === node_path_1.default.join(home.root, 'config.json')
         ? 'config.json' : node_path_1.default.relative(home.contentRoot, file).replace(/\\/g, '/');
     if ((0, owner_identity_1.ownerArtifactPath)(home, relative) !== node_path_1.default.resolve(file))
@@ -95,6 +95,13 @@ function publishRunFile(projectPath, file, home, operationKey, expectedHash, run
         throw new Error('project-publisher-unavailable');
     const branchSuffix = `sleep-${operationKey}`;
     if (home.backend === 'git' && home.gitUrl) {
+        if (verifyOnly) {
+            const head = fetchRemoteHead(home.root);
+            const relative = node_path_1.default.relative(home.root, file).replace(/\\/g, '/');
+            const delivered = head && (0, node_child_process_1.spawnSync)('git', ['show', `${head}:${relative}`], { cwd: home.root, encoding: 'utf8', timeout: 30000, windowsHide: true });
+            return { published: Boolean(delivered && delivered.status === 0 && sameDeliveryText(delivered.stdout, node_fs_1.default.readFileSync(file, 'utf8'))
+                    && (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(file, 'utf8')) === expectedHash), reference: home.gitUrl };
+        }
         const branch = `fraim-${layer}-update-${branchSuffix}`;
         const found = (0, node_child_process_1.spawnSync)('gh', ['pr', 'view', branch, '--repo', home.gitUrl, '--json', 'state,url,mergeCommit'], { encoding: 'utf8', timeout: 30000, windowsHide: true });
         if (found.status === 0) {
@@ -125,7 +132,7 @@ function publishRunFile(projectPath, file, home, operationKey, expectedHash, run
 const fs=require('node:fs');
 const crypto=require('node:crypto');
 const hash=value=>crypto.createHash('sha256').update(value).digest('hex');
-const [publisherPath,userConfigPath,file,relative,layer,branchSuffix,expectedHash,backend,entryProofJson,entryFormatPath]=process.argv.slice(1);
+const [publisherPath,userConfigPath,file,relative,layer,branchSuffix,expectedHash,backend,entryProofJson,entryFormatPath,verifyOnly]=process.argv.slice(1);
 const entryProof=JSON.parse(entryProofJson);
 const {learningEntryBlocks}=require(entryFormatPath);
 const matchesLearningPublication=${matchesLearningPublication.toString()};
@@ -146,14 +153,16 @@ async function confirmedCloud(){
   if(backend==='fraim-cloud'){
     const existing=await confirmedCloud();
     if(existing.published){console.log('FRAIM_PUBLISH_RESULT='+JSON.stringify(existing));return;}
+    if(verifyOnly==='true'){console.log('FRAIM_PUBLISH_RESULT='+JSON.stringify(existing));return;}
   }
+  if(verifyOnly==='true'){console.log('FRAIM_PUBLISH_RESULT='+JSON.stringify({published:false,reference:file}));return;}
   const publish=layer==='manager'?publisher.publishManagerArtifacts:publisher.publishOrgArtifacts;
   const result=await publish([{relativePath:relative,content:fs.readFileSync(file,'utf8')}],{branchSuffix});
   const confirmed=backend==='fraim-cloud'?await confirmedCloud():{published:false,reference:result.prUrl||result.branch||file};
   if(hash(fs.readFileSync(file,'utf8'))!==expectedHash)throw Error('publication-content-conflict');
   console.log('FRAIM_PUBLISH_RESULT='+JSON.stringify(confirmed));
 })().catch(()=>{process.exitCode=1;});`;
-    const result = (0, node_child_process_1.spawnSync)(process.execPath, [...process.execArgv, '-e', script, publisherPath, userConfigPath, file, relative, layer, branchSuffix, expectedHash, home.backend, JSON.stringify(entryProof || null), require.resolve('./entry-format')], { cwd: projectPath, encoding: 'utf8', timeout: 120000, windowsHide: true });
+    const result = (0, node_child_process_1.spawnSync)(process.execPath, [...process.execArgv, '-e', script, publisherPath, userConfigPath, file, relative, layer, branchSuffix, expectedHash, home.backend, JSON.stringify(entryProof || null), require.resolve('./entry-format'), String(verifyOnly)], { cwd: projectPath, encoding: 'utf8', timeout: 120000, windowsHide: true });
     const encoded = String(result.stdout || '').match(/^FRAIM_PUBLISH_RESULT=(.+)$/m)?.[1];
     if (result.status !== 0 || !encoded)
         throw new Error('publication-pending: delivery or read-back has not been confirmed');
@@ -279,14 +288,55 @@ async function verifyCapabilityDelivery(action, input, options) {
     const { resolvePackHome } = load('cli/utils/pack-home');
     const manager = resolvePackHome('manager', { migrateLegacy: false });
     const org = resolvePackHome('org', { migrateLegacy: false });
+    const consumedLocalFiles = new Set();
     const resolver = new LocalRegistryResolver({ workspaceRoot: options.projectPath,
         managerLocalRoot: manager.contentRoot, managerCacheRoot: manager.contentRoot, orgCacheRoot: org.contentRoot,
         remoteContentResolver: async () => { throw new Error('capability-not-available-locally'); },
+        onLocalDependency: (file, kind, content) => {
+            if (kind === 'directory')
+                snapshotDirectory(file);
+            else {
+                snapshot(file, content);
+                // A content-bearing callback records an actual read; existence
+                // probes and absent overlays must not become publication inputs.
+                if (content !== undefined)
+                    consumedLocalFiles.add(node_path_1.default.resolve(file));
+            }
+        },
     });
     const originalResolve = resolver.resolveFile.bind(resolver);
     const snapshots = new Map();
+    const snapshotDirectory = (file) => {
+        const absolute = node_path_1.default.resolve(file);
+        let realPath = null;
+        try {
+            if (!node_fs_1.default.statSync(absolute).isDirectory())
+                throw new Error('capability-local-content-changed');
+            realPath = node_fs_1.default.realpathSync(absolute);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        const prior = snapshots.get(absolute);
+        if (prior && (prior.kind !== 'directory' || prior.realPath !== realPath))
+            throw new Error('capability-local-content-changed');
+        snapshots.set(absolute, { file: absolute, realPath, sha256: null, kind: 'directory' });
+    };
     const snapshot = (file, expectedContent) => {
         const absolute = node_path_1.default.resolve(file);
+        try {
+            node_fs_1.default.lstatSync(absolute);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT' || expectedContent !== undefined)
+                throw error;
+            const prior = snapshots.get(absolute);
+            if (prior?.sha256)
+                throw new Error('capability-local-content-changed');
+            snapshots.set(absolute, { file: absolute, realPath: null, sha256: null });
+            return;
+        }
         const body = node_fs_1.default.readFileSync(absolute, 'utf8');
         if (expectedContent !== undefined && !sameDeliveryText(body, expectedContent))
             throw new Error('capability-local-content-changed');
@@ -296,12 +346,23 @@ async function verifyCapabilityDelivery(action, input, options) {
             throw new Error('capability-local-content-changed');
         snapshots.set(absolute, current);
     };
+    const snapshotRuleOverlays = (relative) => {
+        const normalized = relative.replace(/\\/g, '/');
+        if (node_path_1.default.isAbsolute(normalized) || normalized.split('/').some(part => !part || part === '..' || part === '.'))
+            throw new Error('invalid-capability-include');
+        // A new wrapper/fragment override can change delivery without touching
+        // the selected source. Bind absent overlay paths as well as its bytes.
+        if (normalized.startsWith('rules/')) {
+            for (const root of [node_path_1.default.join(options.projectPath, 'fraim/personalized-employee'), manager.contentRoot, org.contentRoot]) {
+                snapshot(node_path_1.default.join(root, normalized));
+            }
+        }
+    };
     const snapshotResolvedInclude = (relative, resolved) => {
         if (resolved.source !== 'local')
             return;
+        snapshotRuleOverlays(relative);
         const normalized = relative.replace(/\\/g, '/');
-        if (node_path_1.default.isAbsolute(normalized) || normalized.split('/').some(part => !part || part === '..' || part === '.'))
-            throw new Error('invalid-capability-include');
         let candidates;
         if (resolved.scope === 'manager')
             candidates = [node_path_1.default.join(manager.contentRoot, normalized)];
@@ -309,17 +370,40 @@ async function verifyCapabilityDelivery(action, input, options) {
             candidates = [node_path_1.default.join(org.contentRoot, normalized)];
         else if (resolved.scope === 'project')
             candidates = [node_path_1.default.join(options.projectPath, 'fraim/personalized-employee', normalized)];
-        else {
-            const parts = normalized.split('/');
-            const rolePath = ['jobs', 'workflows'].includes(parts[0]) && ['ai-employee', 'ai-manager'].includes(parts[1])
-                ? node_path_1.default.join(parts[1], parts[0], ...parts.slice(2)) : undefined;
-            candidates = [...(rolePath ? [node_path_1.default.join(options.projectPath, 'fraim', rolePath)] : []),
-                node_path_1.default.join(options.projectPath, 'fraim/ai-employee', normalized), node_path_1.default.join(options.projectPath, 'fraim/ai-manager', normalized),
-                node_path_1.default.join(options.projectPath, 'fraim', normalized), node_path_1.default.join(options.projectPath, 'registry', normalized)];
-        }
-        const source = candidates.find(file => node_fs_1.default.existsSync(file) && node_fs_1.default.statSync(file).isFile() && sameDeliveryText(node_fs_1.default.readFileSync(file, 'utf8'), resolved.content));
+        else
+            candidates = resolved.localPath ? [resolved.localPath] : [];
+        const matchingSource = candidates.find(file => node_fs_1.default.existsSync(file) && node_fs_1.default.statSync(file).isFile() && sameDeliveryText(node_fs_1.default.readFileSync(file, 'utf8'), resolved.content));
+        // Inherited overrides have expanded bodies. Their scoped raw source was
+        // snapshotted before resolution; imported children are traced separately.
+        const inheritedSource = normalized.startsWith('rules/') && resolved.scope && resolved.inherited ? candidates[0] : undefined;
+        const source = matchingSource ?? inheritedSource;
         if (source)
-            snapshot(source, resolved.content);
+            snapshot(source, matchingSource ? resolved.content : undefined);
+        if (normalized.startsWith('rules/') && resolved.scope && source && node_path_1.default.resolve(source) !== node_path_1.default.resolve(target)) {
+            if (resolved.scope === 'project' && shared) {
+                sharedCallers.push({ file: source, expectedHash: snapshots.get(node_path_1.default.resolve(source)).sha256 });
+            }
+            else if (resolved.scope === 'manager' || resolved.scope === 'org') {
+                const level = resolved.scope === 'manager' ? 'Manager' : 'Org';
+                const sourceHome = (0, owner_identity_1.resolveOwnerHome)(options.projectPath, level, { runtimeModule: options.runtimeModule });
+                if (sourceHome.requiresPublish)
+                    supportingPublications.set(source, sourceHome);
+            }
+        }
+        if (shared && normalized.startsWith('rules/') && resolved.scope === undefined) {
+            // Shared delivery depends on the composition that actually shipped,
+            // not a local wrapper edit (or a stale installed copy). Verification
+            // checks these files at both merged and current HEAD; it never
+            // publishes supporting edits under the target rule's approval.
+            const registryFile = node_path_1.default.join(options.projectPath, 'registry', normalized);
+            if (!node_fs_1.default.existsSync(registryFile) || !sameDeliveryText(node_fs_1.default.readFileSync(registryFile, 'utf8'), resolved.content)) {
+                sharedCatalogAvailable = false;
+            }
+            else {
+                snapshot(registryFile, resolved.content);
+                sharedCallers.push({ file: registryFile, expectedHash: (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(registryFile, 'utf8')) });
+            }
+        }
     };
     snapshot(target, targetContent);
     if (snapshots.get(node_path_1.default.resolve(target))?.sha256 !== localHash)
@@ -332,6 +416,45 @@ async function verifyCapabilityDelivery(action, input, options) {
         return { published: false, reference: target, contentHash, reachable: false };
     let reachable = true;
     const sharedCallers = [];
+    const supportingPublications = new Map();
+    let sharedCatalogAvailable = true;
+    const captureRuleSelection = (callerPath) => {
+        const paths = load('core/utils/project-fraim-paths');
+        const workspace = paths.getWorkspaceFraimPath(options.projectPath);
+        const user = paths.getUserFraimDirPath();
+        snapshot(node_path_1.default.join(workspace, 'config.json'));
+        snapshot(node_path_1.default.join(user, 'config.json'));
+        const machineCatalog = node_path_1.default.join(user, 'domains.json');
+        const workspaceCatalog = node_path_1.default.join(workspace, 'domains.json');
+        const registryCatalog = node_path_1.default.join(options.projectPath, 'registry/domains.json');
+        const syncedCatalog = node_fs_1.default.existsSync(machineCatalog) ? machineCatalog : workspaceCatalog;
+        const baselineCatalog = node_fs_1.default.existsSync(syncedCatalog) ? syncedCatalog : registryCatalog;
+        for (const file of [machineCatalog, workspaceCatalog, registryCatalog])
+            snapshot(file);
+        for (const [level, root] of [['Project', node_path_1.default.join(workspace, 'personalized-employee')], ['Manager', manager.contentRoot], ['Org', org.contentRoot]]) {
+            const file = node_path_1.default.join(root, 'domains.json');
+            snapshot(file);
+            if (node_fs_1.default.existsSync(file)) {
+                const sourceHome = (0, owner_identity_1.resolveOwnerHome)(options.projectPath, level, { runtimeModule: options.runtimeModule });
+                if (sourceHome.requiresPublish)
+                    supportingPublications.set(file, sourceHome);
+                if (shared && level === 'Project')
+                    sharedCallers.push({ file, expectedHash: snapshots.get(node_path_1.default.resolve(file)).sha256 });
+            }
+            // An override created after verification must invalidate the proof.
+            snapshot(node_path_1.default.join(root, targetPath));
+            snapshot(node_path_1.default.join(root, callerPath));
+        }
+        if (shared) {
+            // An installed catalog alone cannot prove that the shared selection
+            // shipped in the reviewed repository revision and current remote HEAD.
+            if (!node_fs_1.default.existsSync(registryCatalog) || !node_fs_1.default.existsSync(baselineCatalog)
+                || !sameDeliveryText(node_fs_1.default.readFileSync(registryCatalog, 'utf8'), node_fs_1.default.readFileSync(baselineCatalog, 'utf8')))
+                sharedCatalogAvailable = false;
+            else
+                sharedCallers.push({ file: registryCatalog, expectedHash: snapshots.get(node_path_1.default.resolve(registryCatalog)).sha256 });
+        }
+    };
     for (const caller of input.callers) {
         const callerHome = options.resolveHome(caller.owner);
         (0, owner_identity_1.assertSameOwner)(caller.owner, callerHome.owner);
@@ -349,6 +472,7 @@ async function verifyCapabilityDelivery(action, input, options) {
             sharedCallers.push({ file: callerFile, expectedHash: (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(callerFile, 'utf8')) });
         let traversed = false;
         resolver.resolveFile = async (relative, resolveOptions) => {
+            snapshotRuleOverlays(relative);
             const resolved = await originalResolve(relative, resolveOptions);
             snapshotResolvedInclude(relative, resolved);
             if (relative === targetPath && resolved.scope === targetScope && sameDeliveryText(resolved.content, targetContent))
@@ -356,20 +480,72 @@ async function verifyCapabilityDelivery(action, input, options) {
             return resolved;
         };
         const hydrated = await resolver.resolveIncludes(loadedCaller.content);
+        if (!traversed && callerPath.startsWith('jobs/') && targetPath.startsWith('rules/')) {
+            captureRuleSelection(callerPath);
+            const { assembleDomainRules } = load('core/utils/domain-rule-assembler');
+            const assembly = await assembleDomainRules({ jobPath: callerPath,
+                resolveFile: (relative) => resolver.resolveFile(relative, { includeMetadata: false, stripMcpHeader: true }) });
+            // Source traversal binds the approved raw bytes; assembly metadata
+            // proves this exact owner/path survived effective composition.
+            traversed = traversed && assembly.metadata.complete && assembly.metadata.selection === 'mapped'
+                && [...assembly.metadata.artifacts, ...(assembly.metadata.includedArtifacts || [])]
+                    .some((artifact) => artifact.path === targetPath && artifact.scope === targetScope);
+        }
         if (!traversed || /\{\{include:[^}]+\}\}/.test(hydrated)) {
             reachable = false;
             break;
         }
     }
     resolver.resolveFile = originalResolve;
+    if (shared) {
+        // Inheritance resolves raw parents internally, bypassing the public
+        // resolveFile interceptor. Include the Project rule bytes it consumed
+        // in both merged-commit and current-remote publication verification.
+        const projectRules = node_path_1.default.join(options.projectPath, 'fraim/personalized-employee/rules');
+        for (const file of consumedLocalFiles) {
+            const relative = node_path_1.default.relative(projectRules, file);
+            if (!relative || relative === '..' || relative.startsWith('..' + node_path_1.default.sep) || node_path_1.default.isAbsolute(relative))
+                continue;
+            sharedCallers.push({ file, expectedHash: snapshots.get(file).sha256 });
+        }
+    }
     if (!reachable || (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(target, 'utf8')) !== localHash)
         return { published: false, reference: target, contentHash, reachable: false };
     const localFiles = [...snapshots.values()].sort((a, b) => a.file.localeCompare(b.file));
     const verifySnapshots = () => {
-        for (const item of localFiles)
+        for (const item of localFiles) {
+            if (item.kind === 'directory' && item.realPath !== null) {
+                if (!node_fs_1.default.existsSync(item.file) || !node_fs_1.default.statSync(item.file).isDirectory() || node_fs_1.default.realpathSync(item.file) !== item.realPath)
+                    throw new Error('capability-local-content-changed');
+                continue;
+            }
+            if (item.sha256 === null) {
+                try {
+                    node_fs_1.default.lstatSync(item.file);
+                }
+                catch (error) {
+                    if (error.code === 'ENOENT')
+                        continue;
+                    throw error;
+                }
+                throw new Error('capability-local-content-changed');
+            }
             if (node_fs_1.default.realpathSync(item.file) !== item.realPath || (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(item.file, 'utf8')) !== item.sha256)
                 throw new Error('capability-local-content-changed');
+        }
     };
+    verifySnapshots();
+    if (!sharedCatalogAvailable)
+        return { published: false, reference: target, contentHash, reachable, localFiles, ...reviewEvidence };
+    for (const [file, sourceHome] of supportingPublications) {
+        if (!options.runtimeModulePath)
+            throw new Error('capability-publication-required');
+        // Rule approval never authorizes publishing supporting catalog or rule edits.
+        const supporting = publishRunFile(options.projectPath, file, sourceHome, input.operationKey || 'catalog-delivery-check', snapshots.get(node_path_1.default.resolve(file)).sha256, options.runtimeModulePath, undefined, true);
+        verifySnapshots();
+        if (!supporting.published)
+            return { ...supporting, contentHash, reachable, localFiles, ...reviewEvidence };
+    }
     if (shared) {
         const publication = verifySharedProjectPublication(options.projectPath, target, localHash, input.publicationRef, sharedCallers);
         verifySnapshots();

package/dist/registry/scripts/learning-usage/local-runtime.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WORKSPACE_FRAIM_DIRNAME = exports.LEARNING_DOMAINS = void 0;
+exports.WORKSPACE_FRAIM_DIRNAME = void 0;
 exports.getWorkspaceFraimDir = getWorkspaceFraimDir;
 exports.getWorkspaceConfigPath = getWorkspaceConfigPath;
 exports.getWorkspaceFraimPath = getWorkspaceFraimPath;
@@ -21,8 +21,6 @@ exports.isPathInsideOrEqual = isPathInsideOrEqual;
 const fs_1 = require("fs");
 const os_1 = __importDefault(require("os"));
 const path_1 = require("path");
-/** Share domain data with the MCP runtime and proposal authoring helpers. */
-exports.LEARNING_DOMAINS = Object.freeze(JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(__dirname, '../learning/learning-domains.json'), 'utf8')).domains);
 exports.WORKSPACE_FRAIM_DIRNAME = 'fraim';
 function getWorkspaceFraimDir(projectRoot = process.cwd()) {
     return (0, path_1.join)(projectRoot, exports.WORKSPACE_FRAIM_DIRNAME);

package/dist/src/cli/learning/runtime.js

@@ -44,6 +44,7 @@ const projectFraimPaths = __importStar(require("../../core/utils/project-fraim-p
 const packHome = __importStar(require("../utils/pack-home"));
 const userConfig = __importStar(require("../utils/user-config"));
 const localRegistryResolver = __importStar(require("../../core/utils/local-registry-resolver"));
+const domainRuleAssembler = __importStar(require("../../core/utils/domain-rule-assembler"));
 const learningContextBuilder = __importStar(require("../../local-mcp-server/learning-context-builder"));
 const learningUsageStore = __importStar(require("../../local-mcp-server/learning-usage-store"));
 const MODULE_MAP = {
@@ -51,6 +52,7 @@ const MODULE_MAP = {
     'cli/utils/pack-home': packHome,
     'cli/utils/user-config': userConfig,
     'core/utils/local-registry-resolver': localRegistryResolver,
+    'core/utils/domain-rule-assembler': domainRuleAssembler,
     'local-mcp-server/learning-context-builder': learningContextBuilder,
     'local-mcp-server/learning-usage-store': learningUsageStore,
 };

package/dist/src/cli/utils/remote-sync.js

@@ -228,6 +228,13 @@ async function syncTypedFilesToUserDir(files, type, subdir, label) {
  * Extracted from syncFromRemote so it can run without a project root.
  */
 async function syncScriptsToUserDir(files) {
+    const catalog = files.find(file => file.type === 'config' && file.path === 'domains.json');
+    if (catalog) {
+        // Only this known root artifact is accepted; never clean the user root.
+        JSON.parse(catalog.content);
+        (0, fs_1.mkdirSync)((0, script_sync_utils_1.getUserFraimDir)(), { recursive: true });
+        (0, fs_1.writeFileSync)((0, path_1.join)((0, script_sync_utils_1.getUserFraimDir)(), 'domains.json'), catalog.content, 'utf8');
+    }
     return syncTypedFilesToUserDir(files, 'script', 'scripts', 'script');
 }
 /**

package/dist/src/cli/utils/script-sync-utils.js

@@ -105,6 +105,10 @@ function copyScriptToUserDirectory(sourcePath, registryScriptsPath) {
  */
 function syncScriptsToUserDirectory(registryPath) {
     ensureUserFraimDirectories();
+    const domainCatalog = path_1.default.join(registryPath, 'domains.json');
+    if (fs_1.default.existsSync(domainCatalog)) {
+        fs_1.default.copyFileSync(domainCatalog, path_1.default.join(getUserFraimDir(), 'domains.json'));
+    }
     const registryScriptsPath = path_1.default.join(registryPath, 'scripts');
     const allScripts = getRegistryScripts(registryPath);
     let syncedCount = 0;

package/dist/src/config/learning-domains.js

@@ -1,119 +1,35 @@
 "use strict";
-/**
- * Learning domains (issue #806).
- *
- * A learning's DOMAIN is the fourth axis of the learning system, alongside:
- *   - tier   (L0 raw / L1 personal / L2 org),
- *   - category (mistake-patterns / preferences / validated-patterns / manager-coaching),
- *   - scope  (machine-global `~/.fraim` vs repo-local `fraim/`).
- *
- * A learning is either `global` (applies to every job) or scoped to exactly one
- * coarse job-domain. At `get_fraim_job`, the loader injects global learnings plus
- * the current job's-domain learnings only, so a marketing job no longer loads
- * engineering learnings.
- *
- * The shared registry/scripts/learning/learning-domains.json owns the domain list, the
- * registry-category -> domain map, and the per-domain authoring voice (R3).
- * This module provides the pure resolver used at the injection sites, following the
- * config-module convention of `src/config/portfolio-slug-overrides.ts`.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DOMAIN_VOICE = exports.GLOBAL_JOB_CATEGORIES = exports.JOB_DOMAIN_MAP = exports.LEARNING_DOMAINS = exports.LEARNING_DOMAIN_MAP_VERSION = void 0;
+exports.jobCategoryFromRegistryPath = exports.STORED_LEARNING_DOMAINS = exports.HISTORICAL_LEARNING_DOMAINS = exports.LEARNING_DOMAINS = exports.LEARNING_DOMAIN_MAP_VERSION = void 0;
 exports.isLearningDomain = isLearningDomain;
-exports.jobCategoryFromRegistryPath = jobCategoryFromRegistryPath;
 exports.resolveJobDomain = resolveJobDomain;
-exports.domainFromJobFrontmatter = domainFromJobFrontmatter;
 exports.resolveDomainForJob = resolveDomainForJob;
-const learningDomainData = require('../../registry/scripts/learning/learning-domains.json');
-exports.LEARNING_DOMAIN_MAP_VERSION = learningDomainData.mapVersion;
-exports.LEARNING_DOMAINS = Object.freeze(learningDomainData.domains);
-exports.JOB_DOMAIN_MAP = Object.freeze(learningDomainData.jobDomainMap);
-exports.GLOBAL_JOB_CATEGORIES = new Set(learningDomainData.globalJobCategories);
-exports.DOMAIN_VOICE = Object.freeze(learningDomainData.domainVoice);
+/** Learning domains use the same folder authority as rule delivery. */
+const catalog_1 = require("../../registry/scripts/domains/catalog");
+let catalog = { schemaVersion: 2, mapVersion: 0, domains: {} };
+try {
+    const candidate = require('../../registry/domains.json');
+    if (candidate?.schemaVersion !== 2 || !candidate.domains || typeof candidate.domains !== 'object' || Array.isArray(candidate.domains))
+        throw new Error('Invalid domain catalog');
+    catalog = candidate;
+}
+catch {
+    console.warn('Learning domains unavailable: restore or sync registry/domains.json, then refresh instructions. Global learning files remain available.');
+}
+exports.LEARNING_DOMAIN_MAP_VERSION = catalog.mapVersion;
+exports.LEARNING_DOMAINS = Object.freeze(Object.keys(catalog.domains).filter(domain => domain !== 'global'));
+/** Retired storage names remain readable/editable; never use these as current job domains. */
+exports.HISTORICAL_LEARNING_DOMAINS = Object.freeze(['compliance', 'company-building', 'operations']);
+exports.STORED_LEARNING_DOMAINS = Object.freeze([...exports.LEARNING_DOMAINS, ...exports.HISTORICAL_LEARNING_DOMAINS]);
 function isLearningDomain(value) {
     return typeof value === 'string' && exports.LEARNING_DOMAINS.includes(value);
 }
-/**
- * Extract the registry job category from a job's registry path.
- *
- * Handles both `jobs/ai-employee/<category>/<name>.md` (and `ai-manager`,
- * `personalized-employee`) and the flatter `jobs/<category>/<name>.md`, with or
- * without a leading `registry/` prefix and with either slash style. Returns null
- * when the input is not a job path (for example a bare job name with no directory).
- *
- * Mirrors the jobs branch of `UsageCollector.parseComponentName` so both derive
- * the category the same way.
- */
-function jobCategoryFromRegistryPath(registryPath) {
-    if (!registryPath || typeof registryPath !== 'string')
-        return null;
-    let clean = registryPath.replace(/\\/g, '/').replace(/^registry\//, '');
-    if (clean.startsWith('/'))
-        clean = clean.slice(1);
-    const parts = clean.split('/');
-    if (parts[0] !== 'jobs')
-        return null;
-    if (parts[1] === 'ai-employee' || parts[1] === 'ai-manager' || parts[1] === 'personalized-employee') {
-        return parts.length > 3 ? parts[2] : null; // jobs/ai-employee/<category>/<name>.md
-    }
-    return parts.length > 2 ? parts[1] : null; // jobs/<category>/<name>.md
-}
-/**
- * Resolve the learning domain for a job from its registry path.
- *
- * Returns a `LearningDomain` for domain-scoped categories, or `null` for
- * cross-cutting categories, unmapped categories, and unparseable inputs. `null`
- * means "load global learnings only" at the injection site: global is never
- * hidden and an unknown category never guesses a wrong domain. The completeness
- * test is what distinguishes an intentional global from a missing mapping.
- */
+exports.jobCategoryFromRegistryPath = catalog_1.jobDomainFromRegistryPath;
 function resolveJobDomain(registryPath) {
-    const category = jobCategoryFromRegistryPath(registryPath);
-    if (!category)
-        return null;
-    return exports.JOB_DOMAIN_MAP[category] ?? null;
-}
-/**
- * Read an explicit learning domain a job declares in its own frontmatter, if any.
- *
- * This is the extensibility hook (issue #806 review): a job can self-declare
- * `domain` so a newly-taught job with a new category is handled without editing
- * `JOB_DOMAIN_MAP`. Supports the JSON frontmatter block FRAIM jobs use
- * (`---\n{ ..., "domain": "people-ops" }\n---`) and a plain `domain: <value>`
- * line. Returns null when there is no frontmatter, no `domain`, or an unknown
- * domain - callers then fall back to the category map.
- */
-function domainFromJobFrontmatter(jobFileContent) {
-    if (!jobFileContent || typeof jobFileContent !== 'string')
-        return null;
-    const fm = jobFileContent.match(/^?---\r?\n([\s\S]*?)\r?\n---/);
-    if (!fm)
-        return null;
-    const block = fm[1];
-    const trimmed = block.trim();
-    if (trimmed.startsWith('{')) {
-        try {
-            const parsed = JSON.parse(trimmed);
-            return isLearningDomain(parsed?.domain) ? parsed.domain : null;
-        }
-        catch {
-            // fall through to line parsing
-        }
-    }
-    const line = block.match(/^\s*domain:\s*["']?([a-z][a-z-]*)["']?\s*$/m);
-    return line && isLearningDomain(line[1]) ? line[1] : null;
+    const selected = (0, catalog_1.selectCatalogDomain)(catalog, registryPath);
+    return selected.selection === 'mapped' && isLearningDomain(selected.domain) ? selected.domain : null;
 }
-/**
- * Resolve the learning domain for a job from its registry path and (optional)
- * file content. A domain the job self-declares in frontmatter overrides the
- * category map; otherwise the map applies; a null/unparseable path yields null
- * (load global only). Pure and side-effect-free: callers do the I/O (reading the
- * registry path and job file) and pass the results here, which keeps this
- * decision logic directly testable with mocked inputs.
- */
-function resolveDomainForJob(registryPath, jobFileContent) {
-    if (!registryPath)
-        return null;
-    const declared = jobFileContent ? domainFromJobFrontmatter(jobFileContent) : null;
-    return declared ?? resolveJobDomain(registryPath);
+/** Job declarations are deliberately ignored, including personalized overrides. */
+function resolveDomainForJob(registryPath, _jobFileContent) {
+    return registryPath ? resolveJobDomain(registryPath) : null;
 }

package/dist/src/core/ai-mentor.js

@@ -55,6 +55,13 @@ class AIMentor {
         }
         return null;
     }
+    /** Delivery identity and first entry come from the executable job, never request categories. */
+    async getRuleDeliveryContext(jobName) {
+        const job = await this.getOrLoadJob(jobName);
+        if (!job?.path)
+            return null;
+        return { jobPath: job.path.replace(/\\/g, '/').replace(/^.*\/registry\//, ''), initialPhase: job.metadata.initialPhase || Object.keys(job.metadata.phases || {})[0] || Array.from(job.phases.keys())[0] || 'starting' };
+    }
     async resolveIncludes(content, basePath) {
         return (0, include_resolver_1.resolveIncludes)(content, this.resolver, basePath, this.skillDedup);
     }