jorgex-stack 1.6.0 → 1.7.0

package/dist/cli.js

@@ -26,6 +26,7 @@ import * as p from "@clack/prompts";
 // src/adapters/opencode.ts
 import path6 from "path";
 import fs3 from "fs";
+import { isDeepStrictEqual } from "util";
 import { pathToFileURL } from "url";
 
 // src/lib/canonical.ts
@@ -300,15 +301,19 @@ function detectEngram() {
 function markers(name) {
   return { open: `<!-- jorgex:${name} -->`, close: `<!-- /jorgex:${name} -->` };
 }
+function hasHealthyManagedMarkdownMarkers(existing, name) {
+  const { open, close } = markers(name);
+  const count = (marker) => existing.split(marker).length - 1;
+  const onOwnLine = (marker) => existing.split("\n").some((line) => line.trim() === marker);
+  return count(open) === 1 && count(close) === 1 && existing.indexOf(close) > existing.indexOf(open) && onOwnLine(open) && onOwnLine(close);
+}
 function repairOrphanMarkers(existing, name) {
   const { open, close } = markers(name);
   const count = (marker) => existing.split(marker).length - 1;
   const opens = count(open);
   const closes = count(close);
   if (opens === 0 && closes === 0) return existing;
-  const onOwnLine = (marker) => existing.split("\n").some((line) => line.trim() === marker);
-  const healthy = opens === 1 && closes === 1 && existing.indexOf(close) > existing.indexOf(open) && onOwnLine(open) && onOwnLine(close);
-  if (healthy) return existing;
+  if (hasHealthyManagedMarkdownMarkers(existing, name)) return existing;
   return existing.split("\n").map((line) => line.trim() === open || line.trim() === close ? null : line.split(open).join("").split(close).join("")).filter((line) => line !== null).join("\n");
 }
 function upsertMarkdownSection(existing, name, content) {
@@ -540,6 +545,79 @@ var DESTRUCTIVE_GIT_DENY = [
 ];
 var GIT_GUARD_SCRIPT = "block-destructive-git.cjs";
 
+// src/lib/quality-capabilities.ts
+var QUALITY_CAPABILITY_NAMESPACE = "jorgex.quality.capabilities";
+var QUALITY_CAPABILITY_VERSION = 1;
+var QUALITY_CAPABILITY_IDS = [
+  "policy-guidance",
+  "tool-approval",
+  "external-verification"
+];
+var UNAVAILABLE_REASON = "No reviewed local declaration is available";
+var EXTERNAL_VERIFICATION_REASON = "External verification is available only through the external verifier";
+function hasText(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function isRuntime(value) {
+  return value === "claude-code" || value === "codex" || value === "opencode" || value === "pi";
+}
+function hasValidEvidence(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const evidence = value;
+  return hasText(evidence.source) && hasText(evidence.version);
+}
+function unavailableCapability(id, reason = UNAVAILABLE_REASON) {
+  return { id, state: "unavailable", reason };
+}
+function declarationFor(id, declarations, runtime) {
+  if (runtime === "unknown") {
+    return unavailableCapability(id, "Runtime is unknown; local capability cannot be established");
+  }
+  if (id === "external-verification") {
+    return unavailableCapability(id, EXTERNAL_VERIFICATION_REASON);
+  }
+  const matches = declarations.filter((declaration2) => declaration2?.id === id);
+  if (matches.length === 0) return unavailableCapability(id);
+  if (matches.length !== 1) return unavailableCapability(id, "Duplicate capability declarations are ambiguous");
+  const declaration = matches[0];
+  const state = declaration.state;
+  const reason = hasText(declaration.reason) ? declaration.reason.trim() : void 0;
+  if (!reason) return unavailableCapability(id, "Capability declaration has no reason");
+  if (state !== "prompt-only" && state !== "manual" && state !== "unavailable") {
+    return unavailableCapability(id, "Capability state is not a supported local state");
+  }
+  if (state === "unavailable") return { id, state, reason };
+  if (!hasValidEvidence(declaration.evidence)) {
+    return unavailableCapability(id, "Capability declaration lacks reviewed source/version evidence");
+  }
+  const evidence = declaration.evidence;
+  return {
+    id,
+    state,
+    reason,
+    evidence: {
+      source: evidence.source.trim(),
+      version: evidence.version.trim()
+    }
+  };
+}
+function hasManagedMarkdownSection(content, name) {
+  return content !== null && hasHealthyManagedMarkdownMarkers(content, name);
+}
+function createLocalCapabilityReport(runtime, declarations) {
+  const normalizedRuntime = isRuntime(runtime) ? runtime : "unknown";
+  return {
+    namespace: QUALITY_CAPABILITY_NAMESPACE,
+    version: QUALITY_CAPABILITY_VERSION,
+    runtime: normalizedRuntime,
+    capabilities: QUALITY_CAPABILITY_IDS.map((id) => declarationFor(id, declarations, normalizedRuntime))
+  };
+}
+function localQualityStatus(profile, status) {
+  if ((profile === "high" || profile === "release") && status === "pass") return "incomplete";
+  return status;
+}
+
 // src/adapters/opencode.ts
 function yamlString(value) {
   return JSON.stringify(value);
@@ -580,10 +658,39 @@ function pruneEmpty(parent, key) {
   const value = objectValue(parent[key]);
   if (value !== null && Object.keys(value).length === 0) delete parent[key];
 }
+function hasOpenCodeManualApproval(configDir) {
+  const content = readTextIfExists(path6.join(configDir, "opencode.json"));
+  if (content === null) return false;
+  try {
+    const root = JSON.parse(content);
+    const permission = objectValue(objectValue(root)?.permission);
+    const expected = loadCanonicalDefaults(stackRoot())["opencode"]?.["permission"];
+    return permission !== null && expected !== void 0 && isDeepStrictEqual(permission, expected);
+  } catch {
+    return false;
+  }
+}
 var opencodeAdapter = {
   id: "opencode",
   name: "OpenCode",
   detect: detectOpenCode,
+  reportCapabilities(configDir) {
+    const prompt = readTextIfExists(path6.join(configDir, "AGENTS.md"));
+    return createLocalCapabilityReport("opencode", [
+      ...hasManagedMarkdownSection(prompt, "system-prompt") ? [{
+        id: "policy-guidance",
+        state: "prompt-only",
+        reason: "The managed policy prompt is advisory and cannot enforce the policy",
+        evidence: { source: "jorgex-stack-system-prompt", version: "1" }
+      }] : [],
+      ...hasOpenCodeManualApproval(configDir) ? [{
+        id: "tool-approval",
+        state: "manual",
+        reason: "Canonical approval declarations require a human decision; runtime activation is not certified",
+        evidence: { source: "jorgex-stack-opencode-approval-policy", version: "1" }
+      }] : []
+    ]);
+  },
   injectEngramProtocol() {
     return false;
   },
@@ -914,6 +1021,7 @@ ${agent.body}`,
 // src/adapters/claude-code.ts
 import path7 from "path";
 import fs4 from "fs";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 function yamlString2(value) {
   return JSON.stringify(value);
 }
@@ -924,6 +1032,21 @@ var ENGRAM_AGENT_TOOLS = [
   "Skill",
   ...memoryTools(["mem_context", "mem_search", "mem_get_observation", "mem_timeline", "mem_current_project"])
 ];
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function hasClaudeManualApproval(configDir) {
+  const content = readTextIfExists(path7.join(configDir, "settings.json"));
+  if (content === null) return false;
+  try {
+    const root = JSON.parse(content);
+    const permissions = isRecord(root) ? root.permissions : void 0;
+    const expected = loadCanonicalDefaults(stackRoot())["claude-code"]?.["permissions"];
+    return isRecord(permissions) && expected !== void 0 && isDeepStrictEqual2(permissions, expected);
+  } catch {
+    return false;
+  }
+}
 function toolsFor(agent) {
   if (agent.name === "engram") return ENGRAM_AGENT_TOOLS.join(", ");
   if (!agent.readonly) return null;
@@ -956,6 +1079,23 @@ var claudeCodeAdapter = {
   id: "claude-code",
   name: "Claude Code",
   detect: detectClaudeCode,
+  reportCapabilities(configDir) {
+    const prompt = readTextIfExists(path7.join(configDir, "CLAUDE.md"));
+    return createLocalCapabilityReport("claude-code", [
+      ...hasManagedMarkdownSection(prompt, "system-prompt") ? [{
+        id: "policy-guidance",
+        state: "prompt-only",
+        reason: "The managed policy prompt is advisory and cannot enforce the policy",
+        evidence: { source: "jorgex-stack-system-prompt", version: "1" }
+      }] : [],
+      ...hasClaudeManualApproval(configDir) ? [{
+        id: "tool-approval",
+        state: "manual",
+        reason: "Canonical approval declarations require a human decision; runtime activation is not certified",
+        evidence: { source: "jorgex-stack-claude-approval-policy", version: "1" }
+      }] : []
+    ]);
+  },
   injectEngramProtocol(ctx) {
     return !hasEngramPlugin(ctx.configDir);
   },
@@ -1172,10 +1312,167 @@ function hasEngramProtocol(configDir) {
   const config = readTextIfExists(path8.join(configDir, "config.toml"));
   return config !== null && /engram-instructions\.md/.test(config);
 }
+var CODEX_JSON_STRING = String.raw`"(?:\\.|[^"\\\r\n])*"`;
+var CODEX_JSON_VALUE = String.raw`(?:${CODEX_JSON_STRING}|-?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?|true|false)`;
+var CODEX_JSON_STRING_ARRAY = String.raw`\[(?:\s*${CODEX_JSON_STRING}(?:\s*,\s*${CODEX_JSON_STRING})*\s*)?\]`;
+var CODEX_KEY = String.raw`(?:[A-Za-z0-9_-]+|${CODEX_JSON_STRING})`;
+var CODEX_ASSIGNMENT = new RegExp(String.raw`^\s*(${CODEX_KEY})\s*=\s*(${CODEX_JSON_STRING_ARRAY}|${CODEX_JSON_VALUE})\s*(?:#.*)?$`);
+var CODEX_HEADER = new RegExp(String.raw`^\[\s*(${CODEX_KEY}(?:\s*\.\s*${CODEX_KEY})*)\s*\]\s*(?:#.*)?$`);
+var CODEX_PERMISSION_HEADERS = {
+  base: "permissions.jorgex-read-anywhere",
+  filesystem: "permissions.jorgex-read-anywhere.filesystem",
+  workspaceRoots: 'permissions.jorgex-read-anywhere.filesystem.":workspace_roots"'
+};
+var CODEX_PERMISSION_PROFILE = {
+  base: [["extends", ":workspace"]],
+  filesystem: [
+    [":root", "read"],
+    ["*.env", "deny"],
+    ["*.env.*", "deny"],
+    ["~/.ssh/**", "deny"],
+    ["~/.aws/credentials", "deny"],
+    ["~/.npmrc", "deny"],
+    ["~/.git-credentials", "deny"],
+    ["**/id_rsa", "deny"],
+    ["**/id_ed25519", "deny"],
+    ["**/*.pem", "deny"],
+    ["**/*.key", "deny"]
+  ],
+  workspaceRoots: [
+    [".", "write"],
+    ["*.env", "deny"],
+    ["*.env.*", "deny"],
+    [".ssh/**", "deny"],
+    [".aws/credentials", "deny"],
+    [".npmrc", "deny"],
+    [".git-credentials", "deny"],
+    ["**/id_rsa", "deny"],
+    ["**/id_ed25519", "deny"],
+    ["**/*.pem", "deny"],
+    ["**/*.key", "deny"]
+  ]
+};
+var CODEX_PERMISSION_SECTIONS = [
+  { header: CODEX_PERMISSION_HEADERS.base, entries: CODEX_PERMISSION_PROFILE.base, quoteKeys: false },
+  { header: CODEX_PERMISSION_HEADERS.filesystem, entries: CODEX_PERMISSION_PROFILE.filesystem, quoteKeys: true },
+  { header: CODEX_PERMISSION_HEADERS.workspaceRoots, entries: CODEX_PERMISSION_PROFILE.workspaceRoots, quoteKeys: true }
+];
+function renderCodexPermissionEntries(entries, quoteKeys) {
+  return entries.map(([key, value]) => `${quoteKeys ? JSON.stringify(key) : key} = ${JSON.stringify(value)}`).join("\n");
+}
+function parseCodexKey(raw) {
+  if (!raw.startsWith('"')) return raw;
+  try {
+    const value = JSON.parse(raw);
+    return typeof value === "string" ? value : null;
+  } catch {
+    return null;
+  }
+}
+function parseCodexValue(raw) {
+  try {
+    const value = JSON.parse(raw);
+    return Array.isArray(value) && value.every((item) => typeof item === "string") || !Array.isArray(value) && (value === null || typeof value !== "object") ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function parseCodexHeader(line) {
+  const match = CODEX_HEADER.exec(line.trim());
+  if (match === null) return null;
+  for (const quoted of match[1].match(/"(?:\\.|[^"\\\r\n])*"/g) ?? []) {
+    if (parseCodexKey(quoted) === null) return null;
+  }
+  return match[1].replace(/\s*\.\s*/g, ".");
+}
+function scanCodexToml(config) {
+  if (config.includes("'''") || config.includes('"""')) return null;
+  const root = /* @__PURE__ */ new Map();
+  const sections = /* @__PURE__ */ new Map();
+  const headers = /* @__PURE__ */ new Set();
+  const keys = /* @__PURE__ */ new Set();
+  let section = null;
+  for (const line of config.replace(/\r\n/g, "\n").split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    if (trimmed.startsWith("[")) {
+      const header = parseCodexHeader(trimmed);
+      if (header === null || headers.has(header)) return null;
+      headers.add(header);
+      if (header.startsWith(`${CODEX_PERMISSION_HEADERS.base}.`) && !CODEX_PERMISSION_SECTIONS.some((entry) => entry.header === header)) {
+        return null;
+      }
+      section = header;
+      if (CODEX_PERMISSION_SECTIONS.some((entry) => entry.header === header)) sections.set(header, /* @__PURE__ */ new Map());
+      continue;
+    }
+    const relevant = section === null || CODEX_PERMISSION_SECTIONS.some((entry) => entry.header === section);
+    const match = CODEX_ASSIGNMENT.exec(trimmed);
+    if (!relevant && match === null) continue;
+    if (match === null) return null;
+    const key = parseCodexKey(match[1]);
+    const value = parseCodexValue(match[2]);
+    if (key === null || value === void 0) return null;
+    if (section === null && (key === "profile" || key === "sandbox_mode")) return null;
+    const scope = section ?? "<root>";
+    const declaration = `${scope}\0${key}`;
+    if (keys.has(declaration)) return null;
+    keys.add(declaration);
+    if (section === null) root.set(key, value);
+    else if (sections.has(section)) sections.get(section).set(key, value);
+  }
+  return { root, sections };
+}
+function hasCanonicalCodexPermissionProfile(scan) {
+  for (const { header, entries } of CODEX_PERMISSION_SECTIONS) {
+    const actual = scan.sections.get(header);
+    if (actual === void 0 || actual.size !== entries.length) return false;
+    for (const [key, expected] of entries) {
+      if (actual.get(key) !== expected) return false;
+    }
+  }
+  return true;
+}
+function hasCodexManualApproval(configDir) {
+  const config = readTextIfExists(path8.join(configDir, "config.toml"));
+  if (config === null) return false;
+  const scan = scanCodexToml(config);
+  if (scan === null) return false;
+  try {
+    const defaults = loadCanonicalDefaults(stackRoot())["codex"];
+    const expectedApproval = defaults?.["approval_policy"];
+    const expectedPermissions = defaults?.["default_permissions"];
+    return typeof expectedApproval === "string" && typeof expectedPermissions === "string" && scan.root.get("approval_policy") === expectedApproval && scan.root.get("default_permissions") === expectedPermissions && hasCanonicalCodexPermissionProfile(scan);
+  } catch {
+    return false;
+  }
+}
 var codexAdapter = {
   id: "codex",
   name: "Codex CLI",
   detect: detectCodex,
+  reportCapabilities(configDir) {
+    const prompt = readTextIfExists(path8.join(configDir, "AGENTS.md"));
+    return createLocalCapabilityReport("codex", [
+      ...hasManagedMarkdownSection(prompt, "system-prompt") ? [{
+        id: "policy-guidance",
+        state: "prompt-only",
+        reason: "The managed policy prompt is advisory and cannot enforce the policy",
+        evidence: { source: "jorgex-stack-system-prompt", version: "1" }
+      }] : [],
+      ...hasCodexManualApproval(configDir) ? [{
+        id: "tool-approval",
+        state: "manual",
+        reason: "Canonical approval declarations require a human decision; runtime activation is not certified",
+        evidence: { source: "jorgex-stack-codex-approval-policy", version: "1" }
+      }] : [],
+      {
+        id: "external-verification",
+        state: "unavailable",
+        reason: "External verification is available only through the external verifier"
+      }
+    ]);
+  },
   injectEngramProtocol(ctx) {
     return !hasEngramProtocol(ctx.configDir);
   },
@@ -1275,37 +1572,20 @@ ${body}`
       ctx.warnings.push(
         "Codex: fresh config enables read-anywhere via the jorgex-read-anywhere permission profile; broad local reads can expose secrets not covered by deny rules."
       );
-      content = upsertTomlSection(content, "permissions.jorgex-read-anywhere", 'extends = ":workspace"');
       content = upsertTomlSection(
         content,
-        "permissions.jorgex-read-anywhere.filesystem",
-        [
-          '":root" = "read"',
-          '"*.env" = "deny"',
-          '"*.env.*" = "deny"',
-          '"~/.ssh/**" = "deny"',
-          '"~/.aws/credentials" = "deny"',
-          '"~/.npmrc" = "deny"',
-          '"~/.git-credentials" = "deny"',
-          '"**/id_rsa" = "deny"',
-          '"**/id_ed25519" = "deny"',
-          '"**/*.pem" = "deny"',
-          '"**/*.key" = "deny"'
-        ].join("\n")
+        CODEX_PERMISSION_HEADERS.base,
+        renderCodexPermissionEntries(CODEX_PERMISSION_PROFILE.base, false)
+      );
+      content = upsertTomlSection(
+        content,
+        CODEX_PERMISSION_HEADERS.filesystem,
+        renderCodexPermissionEntries(CODEX_PERMISSION_PROFILE.filesystem, true)
       );
       content += [
-        '\n[permissions.jorgex-read-anywhere.filesystem.":workspace_roots"]',
-        '"." = "write"',
-        '"*.env" = "deny"',
-        '"*.env.*" = "deny"',
-        '".ssh/**" = "deny"',
-        '".aws/credentials" = "deny"',
-        '".npmrc" = "deny"',
-        '".git-credentials" = "deny"',
-        '"**/id_rsa" = "deny"',
-        '"**/id_ed25519" = "deny"',
-        '"**/*.pem" = "deny"',
-        '"**/*.key" = "deny"',
+        `
+[${CODEX_PERMISSION_HEADERS.workspaceRoots}]`,
+        renderCodexPermissionEntries(CODEX_PERMISSION_PROFILE.workspaceRoots, true),
         ""
       ].join("\n");
     }
@@ -1959,7 +2239,7 @@ function devtoolsMcpPreferenceFile(stateDir = dataDir()) {
 function primaryModelOwnershipFile(stateDir = dataDir()) {
   return path19.join(stateDir, "primary-model.json");
 }
-function isRecord(value) {
+function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function isRuntimeId(value) {
@@ -1968,7 +2248,7 @@ function isRuntimeId(value) {
 function parseDevtoolsMcpState(raw) {
   try {
     const value = JSON.parse(raw);
-    if (!isRecord(value) || value.version !== DEVTOOLS_MCP_PREFERENCE_VERSION || !isRecord(value.enabled) || !isRecord(value.owned)) return null;
+    if (!isRecord2(value) || value.version !== DEVTOOLS_MCP_PREFERENCE_VERSION || !isRecord2(value.enabled) || !isRecord2(value.owned)) return null;
     const enabled = {};
     for (const [runtime, selected] of Object.entries(value.enabled)) {
       if (!isRuntimeId(runtime) || typeof selected !== "boolean") return null;
@@ -1976,7 +2256,7 @@ function parseDevtoolsMcpState(raw) {
     }
     const owned = {};
     for (const [runtime, servers] of Object.entries(value.owned)) {
-      if (!isRuntimeId(runtime) || !isRecord(servers)) return null;
+      if (!isRuntimeId(runtime) || !isRecord2(servers)) return null;
       const managed = {};
       for (const [server, marked] of Object.entries(servers)) {
         if (marked !== true) return null;
@@ -2032,13 +2312,13 @@ function saveDevtoolsMcpOwnership(file, runtime, server, owned) {
 function parsePrimaryModelOwnership(raw) {
   try {
     const value = JSON.parse(raw);
-    if (!isRecord(value) || value.version !== PRIMARY_MODEL_OWNERSHIP_VERSION || !isRecord(value.owned)) return null;
+    if (!isRecord2(value) || value.version !== PRIMARY_MODEL_OWNERSHIP_VERSION || !isRecord2(value.owned)) return null;
     const owned = {};
     for (const [runtime, configs] of Object.entries(value.owned)) {
-      if (!isRuntimeId(runtime) || !isRecord(configs)) return null;
+      if (!isRuntimeId(runtime) || !isRecord2(configs)) return null;
       const markedConfigs = {};
       for (const [configDir, fields] of Object.entries(configs)) {
-        if (configDir === "" || !isRecord(fields)) return null;
+        if (configDir === "" || !isRecord2(fields)) return null;
         const markedFields = {};
         for (const [field, state] of Object.entries(fields)) {
           if (field === "" || state !== true) return null;
@@ -3522,6 +3802,9 @@ async function runDoctor() {
       p3.log.warn(`${adapter.name}: no instalado en esta m\xE1quina.`);
       continue;
     }
+    const capabilityReport = adapter.reportCapabilities(detection.configDir);
+    const capabilitySummary = capabilityReport.capabilities.map((capability) => `${capability.id}=${capability.state}`).join(", ");
+    p3.log.info(`${adapter.name}: capabilities diagnostic (${capabilitySummary}); no certifica enforcement local.`);
     const ctx = makeContext(adapter, detection.configDir, modePreference);
     if (!ctx) continue;
     let pending;
@@ -5453,10 +5736,10 @@ function normalizeTimeout(value) {
   return timeoutMs;
 }
 var COMMIT_SHA_PATTERN = /^[0-9a-f]{40}$/i;
-function isRecord2(value) {
+function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function hasText(value) {
+function hasText2(value) {
   return typeof value === "string" && value.trim() !== "";
 }
 function isDenseStringArray(value) {
@@ -5473,14 +5756,14 @@ function isQualityProfile(value) {
   return typeof value === "string" && QUALITY_PROFILES.includes(value);
 }
 function assertValidEnvironment(value, label) {
-  if (!isRecord2(value)) throw new Error(`Invalid ${label}`);
+  if (!isRecord3(value)) throw new Error(`Invalid ${label}`);
   for (const [key, entry] of Object.entries(value)) {
     if (typeof entry !== "string") throw new Error(`Invalid ${label}.${key}`);
   }
 }
 function assertQualityPlanInput(value) {
-  if (!isRecord2(value)) throw new Error("Invalid quality plan");
-  if (!isRecord2(value.identity)) throw new Error("Invalid quality plan identity");
+  if (!isRecord3(value)) throw new Error("Invalid quality plan");
+  if (!isRecord3(value.identity)) throw new Error("Invalid quality plan identity");
   if (typeof value.identity.baseSha !== "string" || !COMMIT_SHA_PATTERN.test(value.identity.baseSha)) {
     throw new Error("Invalid quality plan identity.baseSha");
   }
@@ -5492,7 +5775,7 @@ function assertQualityPlanInput(value) {
   const controlIds = /* @__PURE__ */ new Set();
   for (let index = 0; index < value.controls.length; index += 1) {
     const control = value.controls[index];
-    if (!isRecord2(control) || !hasText(control.id) || control.requirement !== "required" && control.requirement !== "optional") {
+    if (!isRecord3(control) || !hasText2(control.id) || control.requirement !== "required" && control.requirement !== "optional") {
       throw new Error(`Invalid quality plan controls[${index}]`);
     }
     if (controlIds.has(control.id)) {
@@ -5508,9 +5791,9 @@ function assertQualityPlanInput(value) {
   const commandControlIds = /* @__PURE__ */ new Set();
   for (let index = 0; index < value.commands.length; index += 1) {
     const command = value.commands[index];
-    if (!isRecord2(command)) throw new Error(`Invalid quality plan commands[${index}]`);
+    if (!isRecord3(command)) throw new Error(`Invalid quality plan commands[${index}]`);
     const timeoutMs = command.timeoutMs;
-    if (!hasText(command.controlId) || !hasText(command.commandId) || !hasText(command.executable) || !isDenseStringArray(command.argv) || !isNonNegativeSafeInteger(timeoutMs)) {
+    if (!hasText2(command.controlId) || !hasText2(command.commandId) || !hasText2(command.executable) || !isDenseStringArray(command.argv) || !isNonNegativeSafeInteger(timeoutMs)) {
       throw new Error(`Invalid quality plan commands[${index}]`);
     }
     if (timeoutMs > MAX_NODE_TIMEOUT_MS) {
@@ -5753,7 +6036,7 @@ function missingRequiredResults(controls, commands) {
   const commandControlIds = new Set(commands.map((command) => command.controlId));
   const missing = /* @__PURE__ */ new Set();
   for (const control of controls) {
-    if (control.requirement !== "required" || !hasText(control.id) || commandControlIds.has(control.id)) continue;
+    if (control.requirement !== "required" || !hasText2(control.id) || commandControlIds.has(control.id)) continue;
     missing.add(control.id);
   }
   return [...missing].map((controlId) => ({
@@ -5791,11 +6074,15 @@ async function runQualityPlan(input) {
     results.push(receiptResultFor(command.controlId, result));
   }
   results.push(...missingRequiredResults(input.controls, input.commands));
-  const evaluation = evaluateQualityPolicy({
+  const policyEvaluation = evaluateQualityPolicy({
     profile: input.profile,
     controls: input.controls,
     results
   });
+  const evaluation = {
+    ...policyEvaluation,
+    status: localQualityStatus(input.profile, policyEvaluation.status)
+  };
   const receipt = createQualityReceipt({
     authority: "local",
     identity,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI, OpenCode y Pi",
   "type": "module",
   "license": "MIT",

package/stack/contracts/quality-capabilities.v1.schema.json

@@ -0,0 +1,117 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://jorgex.dev/contracts/quality-capabilities.v1.schema.json",
+  "title": "JorgeX local quality capabilities v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["namespace", "version", "runtime", "capabilities"],
+  "properties": {
+    "namespace": {
+      "type": "string",
+      "const": "jorgex.quality.capabilities"
+    },
+    "version": {
+      "type": "integer",
+      "const": 1
+    },
+    "runtime": {
+      "type": "string",
+      "enum": ["claude-code", "codex", "opencode", "pi", "unknown"]
+    },
+    "capabilities": {
+      "type": "array",
+      "minItems": 3,
+      "maxItems": 3,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "state", "reason"],
+        "properties": {
+          "id": {
+            "type": "string",
+            "enum": ["policy-guidance", "tool-approval", "external-verification"]
+          },
+          "state": {
+            "$ref": "#/$defs/localCapabilityState"
+          },
+          "reason": {
+            "type": "string",
+            "pattern": "\\S"
+          },
+          "evidence": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["source", "version"],
+            "properties": {
+              "source": {
+                "type": "string",
+                "pattern": "\\S"
+              },
+              "version": {
+                "type": "string",
+                "pattern": "\\S"
+              }
+            }
+          }
+        },
+        "allOf": [
+          {
+            "if": {
+              "properties": {"id": {"const": "external-verification"}},
+              "required": ["id"]
+            },
+            "then": {
+              "properties": {"state": {"const": "unavailable"}}
+            }
+          },
+          {
+            "if": {
+              "properties": {"state": {"enum": ["prompt-only", "manual"]}},
+              "required": ["state"]
+            },
+            "then": {
+              "required": ["evidence"]
+            }
+          }
+        ]
+      },
+      "allOf": [
+        {
+          "contains": {
+            "type": "object",
+            "properties": {"id": {"const": "policy-guidance"}},
+            "required": ["id"]
+          }
+        },
+        {
+          "contains": {
+            "type": "object",
+            "properties": {"id": {"const": "tool-approval"}},
+            "required": ["id"]
+          }
+        },
+        {
+          "contains": {
+            "type": "object",
+            "properties": {"id": {"const": "external-verification"}},
+            "required": ["id"]
+          }
+        }
+      ]
+    }
+  },
+  "$defs": {
+    "capabilityState": {
+      "type": "string",
+      "enum": ["enforced", "prompt-only", "manual", "unavailable"]
+    },
+    "localCapabilityState": {
+      "type": "string",
+      "enum": ["prompt-only", "manual", "unavailable"]
+    },
+    "strictProfile": {
+      "type": "string",
+      "enum": ["high", "release"]
+    }
+  }
+}