mdkg 0.3.6 → 0.3.8

package/dist/commands/validate.js

@@ -3,13 +3,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECOMMENDED_HEADINGS = void 0;
 exports.collectValidateReceipt = collectValidateReceipt;
 exports.runValidateCommand = runValidateCommand;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
 const config_1 = require("../core/config");
 const template_schema_1 = require("../graph/template_schema");
 const node_1 = require("../graph/node");
+const agent_file_types_1 = require("../graph/agent_file_types");
 const skills_indexer_1 = require("../graph/skills_indexer");
 const workspace_files_1 = require("../graph/workspace_files");
 const validate_graph_1 = require("../graph/validate_graph");
@@ -18,7 +21,7 @@ const visibility_1 = require("../graph/visibility");
 const sqlite_index_1 = require("../graph/sqlite_index");
 const errors_1 = require("../util/errors");
 const skill_mirror_1 = require("./skill_mirror");
-const RECOMMENDED_HEADINGS = {
+exports.RECOMMENDED_HEADINGS = {
     task: [
         "Overview",
         "Acceptance Criteria",
@@ -103,6 +106,234 @@ function extractHeadings(body) {
     }
     return headings;
 }
+const RAW_CONTENT_MARKERS = [
+    { id: "raw_prompt", pattern: /\bRAW_PROMPT_MARKER\b/i, description: "raw prompt marker" },
+    { id: "raw_payload", pattern: /\bRAW_PAYLOAD_MARKER\b/i, description: "raw payload marker" },
+    { id: "raw_secret", pattern: /\bRAW_SECRET_MARKER\b|BEGIN [A-Z ]*PRIVATE KEY|secret\s*=/i, description: "raw secret marker" },
+];
+function shouldCheckRawContentWarnings(node) {
+    if ((0, agent_file_types_1.isAgentFileType)(node.type)) {
+        return true;
+    }
+    return node.type === "checkpoint" && typeof node.frontmatter.checkpoint_kind === "string";
+}
+function collectRawContentWarnings(qid, node) {
+    if (!shouldCheckRawContentWarnings(node)) {
+        return [];
+    }
+    const warnings = [];
+    for (const marker of RAW_CONTENT_MARKERS) {
+        if (marker.pattern.test(node.body)) {
+            warnings.push(`${qid}: raw-content.${marker.id} warning: ${marker.description} detected; use refs, hashes, summaries, or artifact links instead of raw secrets/prompts/payloads`);
+        }
+    }
+    return warnings;
+}
+function collectManifestCompatibilityWarnings(qid, filePath, node) {
+    const basename = path_1.default.basename(filePath);
+    if (basename === agent_file_types_1.LEGACY_SPEC_BASENAME && node.type === "spec") {
+        return [
+            `${qid}: manifest.compat.spec_legacy warning: SPEC.md is legacy; MANIFEST.md is the canonical manifest filename. Rename this file before the compatibility release closes.`,
+        ];
+    }
+    if (basename === agent_file_types_1.CANONICAL_MANIFEST_BASENAME && node.type === "spec") {
+        return [
+            `${qid}: manifest.compat.type_spec warning: MANIFEST.md uses legacy type: spec; use type: manifest before the compatibility release closes.`,
+        ];
+    }
+    return [];
+}
+function collectChangedPaths(root) {
+    const result = (0, child_process_1.spawnSync)("git", ["-C", root, "status", "--porcelain", "--", ".mdkg"], {
+        encoding: "utf8",
+    });
+    if (result.status !== 0) {
+        return new Set();
+    }
+    const changed = new Set();
+    for (const line of result.stdout.split(/\r?\n/)) {
+        if (!line.trim()) {
+            continue;
+        }
+        const rawPath = line.slice(3).trim();
+        const filePath = rawPath.includes(" -> ") ? rawPath.split(" -> ").pop() ?? rawPath : rawPath;
+        changed.add(filePath.replace(/\\/g, "/"));
+    }
+    return changed;
+}
+function qidFromWarning(message) {
+    const match = /^([a-z0-9_-]+:[^\s:]+):/.exec(message);
+    return match?.[1];
+}
+function warningPath(message, nodes) {
+    const qid = qidFromWarning(message);
+    if (qid && nodes[qid]) {
+        return nodes[qid].path;
+    }
+    for (const node of Object.values(nodes)) {
+        if (message.includes(node.path)) {
+            return node.path;
+        }
+    }
+    const match = /([.]mdkg\/[^\s:]+\.md|[.]mdkg\/[^\s:]+\/SKILLS?\.md)/.exec(message);
+    return match?.[1];
+}
+function warningDiagnostic(message, nodes) {
+    const qid = qidFromWarning(message);
+    const nodeType = qid && nodes[qid] ? nodes[qid].type : undefined;
+    const pathValue = warningPath(message, nodes);
+    const rawMatch = /raw-content\.([a-z_]+)/.exec(message);
+    if (rawMatch) {
+        return {
+            id: `raw-content.${rawMatch[1]}`,
+            category: "raw-content",
+            severity: "warning",
+            message,
+            qid,
+            node_type: nodeType,
+            path: pathValue,
+            ref: qid,
+            remediation: "Replace raw secrets, prompts, tokens, or payloads with refs, hashes, redacted summaries, or archive/artifact links.",
+        };
+    }
+    if (message.includes("missing recommended heading")) {
+        return {
+            id: "heading.missing",
+            category: "headings",
+            severity: "warning",
+            message,
+            qid,
+            node_type: nodeType,
+            path: pathValue,
+            ref: qid,
+            remediation: "Run mdkg format --headings --dry-run to review missing heading additions, then --apply if acceptable.",
+        };
+    }
+    if (message.includes("bundled template schema fallback")) {
+        return {
+            id: "template_schema.fallback",
+            category: "templates",
+            severity: "warning",
+            message,
+            node_type: nodeType,
+            path: pathValue,
+            remediation: "Run mdkg upgrade --apply to vendor missing built-in template schemas when the managed asset update is safe.",
+        };
+    }
+    const manifestCompatMatch = /manifest\.compat\.([a-z_]+)/.exec(message);
+    if (manifestCompatMatch) {
+        return {
+            id: `manifest.compat.${manifestCompatMatch[1]}`,
+            category: "manifest-compatibility",
+            severity: "warning",
+            message,
+            qid,
+            node_type: nodeType,
+            path: pathValue,
+            ref: qid,
+            remediation: "Rename legacy SPEC.md files to MANIFEST.md and update transitional type: spec frontmatter to type: manifest before the compatibility release closes.",
+        };
+    }
+    if (message.includes("sqlite") || message.includes("index")) {
+        return {
+            id: "cache.index",
+            category: "cache",
+            severity: "warning",
+            message,
+            node_type: nodeType,
+            path: pathValue,
+            remediation: "Run mdkg index or mdkg db index rebuild when generated cache state should be refreshed.",
+        };
+    }
+    if (message.includes("skill") || message.includes("mirror")) {
+        return {
+            id: "skill_mirror.warning",
+            category: "skills",
+            severity: "warning",
+            message,
+            node_type: nodeType,
+            path: pathValue,
+            remediation: "Run mdkg skill sync after reviewing managed skill mirror drift.",
+        };
+    }
+    if (message.includes("subgraph")) {
+        return {
+            id: "subgraph.warning",
+            category: "subgraph",
+            severity: "warning",
+            message,
+            node_type: nodeType,
+            path: pathValue,
+            remediation: "Run mdkg subgraph verify or refresh the source bundle after reviewing child graph freshness.",
+        };
+    }
+    return {
+        id: "warning.generic",
+        category: "general",
+        severity: "warning",
+        message,
+        qid,
+        node_type: nodeType,
+        path: pathValue,
+        ref: qid,
+        remediation: "Review the warning and apply the focused mdkg command suggested by the message when appropriate.",
+    };
+}
+function countBuckets(values) {
+    const counts = new Map();
+    for (const value of values) {
+        if (!value) {
+            continue;
+        }
+        counts.set(value, (counts.get(value) ?? 0) + 1);
+    }
+    return Array.from(counts.entries())
+        .map(([key, count]) => ({ key, count }))
+        .sort((a, b) => b.count - a.count || a.key.localeCompare(b.key));
+}
+function normalizeLimit(limit) {
+    if (limit === undefined) {
+        return 50;
+    }
+    if (!Number.isInteger(limit) || limit < 0) {
+        throw new errors_1.ValidationError("--limit must be a non-negative integer");
+    }
+    return limit;
+}
+function buildWarningSummary(diagnostics, limit) {
+    const effectiveLimit = limit === null || limit === undefined ? diagnostics.length : limit;
+    const emitted = Math.min(diagnostics.length, effectiveLimit);
+    const truncated = emitted < diagnostics.length;
+    return {
+        total: diagnostics.length,
+        emitted,
+        truncated,
+        omitted_count: diagnostics.length - emitted,
+        limit: limit === undefined ? null : limit,
+        affected_file_count: new Set(diagnostics.map((diagnostic) => diagnostic.path).filter(Boolean)).size,
+        by_id: countBuckets(diagnostics.map((diagnostic) => diagnostic.id)),
+        by_category: countBuckets(diagnostics.map((diagnostic) => diagnostic.category)),
+        by_node_type: countBuckets(diagnostics.map((diagnostic) => diagnostic.node_type)),
+        top_qids: countBuckets(diagnostics.map((diagnostic) => diagnostic.qid)).slice(0, 25),
+        top_paths: countBuckets(diagnostics.map((diagnostic) => diagnostic.path)).slice(0, 25),
+    };
+}
+function shapeValidateReceiptForSummary(receipt, limit) {
+    const effectiveLimit = normalizeLimit(limit);
+    const warningDiagnostics = receipt.warning_diagnostics.slice(0, effectiveLimit);
+    return {
+        ...receipt,
+        warnings: warningDiagnostics.map((warning) => warning.message),
+        warning_diagnostics: warningDiagnostics,
+        warning_summary: buildWarningSummary(receipt.warning_diagnostics, effectiveLimit),
+    };
+}
+function writeJsonReceipt(root, jsonOut, receipt) {
+    const outPath = path_1.default.resolve(root, jsonOut);
+    fs_1.default.mkdirSync(path_1.default.dirname(outPath), { recursive: true });
+    fs_1.default.writeFileSync(outPath, `${JSON.stringify(receipt, null, 2)}\n`, "utf8");
+    return outPath;
+}
 function isCoreListFile(filePath) {
     return path_1.default.basename(filePath) === "core.md" && path_1.default.basename(path_1.default.dirname(filePath)) === "core";
 }
@@ -121,6 +352,8 @@ function normalizeEdges(edges, ws) {
         relates: edges.relates.map((value) => normalizeEdgeTarget(value, ws)),
         blocked_by: edges.blocked_by.map((value) => normalizeEdgeTarget(value, ws)),
         blocks: edges.blocks.map((value) => normalizeEdgeTarget(value, ws)),
+        context_refs: (edges.context_refs ?? []).map((value) => normalizeEdgeTarget(value, ws)),
+        evidence_refs: (edges.evidence_refs ?? []).map((value) => normalizeEdgeTarget(value, ws)),
     };
 }
 function buildIndexNode(root, ws, filePath, node) {
@@ -178,6 +411,12 @@ function buildReverseEdges(nodes) {
         for (const target of node.edges.blocks) {
             addReverseEdge(reverse, "blocks", target, qid);
         }
+        for (const target of node.edges.context_refs ?? []) {
+            addReverseEdge(reverse, "context_refs", target, qid);
+        }
+        for (const target of node.edges.evidence_refs ?? []) {
+            addReverseEdge(reverse, "evidence_refs", target, qid);
+        }
     }
     for (const targets of Object.values(reverse)) {
         for (const sources of Object.values(targets)) {
@@ -264,6 +503,7 @@ function collectValidateReceipt(options) {
     const idsByWorkspace = {};
     for (const [alias, files] of Object.entries(filesByAlias)) {
         idsByWorkspace[alias] = new Map();
+        errors.push(...(0, agent_file_types_1.collectManifestSiblingConflicts)(files, (dirPath) => path_1.default.relative(options.root, dirPath).split(path_1.default.sep).join("/") || "."));
         for (const filePath of files) {
             if (isCoreListFile(filePath)) {
                 continue;
@@ -292,7 +532,7 @@ function collectValidateReceipt(options) {
                 idsByWorkspace[alias].set(node.id, filePath);
                 const qid = `${alias}:${node.id}`;
                 nodes[qid] = buildIndexNode(options.root, alias, filePath, node);
-                const recommended = RECOMMENDED_HEADINGS[node.type];
+                const recommended = exports.RECOMMENDED_HEADINGS[node.type];
                 if (recommended) {
                     const headings = extractHeadings(node.body);
                     for (const heading of recommended) {
@@ -301,6 +541,8 @@ function collectValidateReceipt(options) {
                         }
                     }
                 }
+                warnings.push(...collectRawContentWarnings(qid, node));
+                warnings.push(...collectManifestCompatibilityWarnings(qid, filePath, node));
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : "unknown error";
@@ -372,7 +614,13 @@ function collectValidateReceipt(options) {
     }
     warnings.push(...(0, skill_mirror_1.auditSkillMirrors)(options.root, config));
     validateEventsJsonl(options.root, config, errors);
-    const uniqueWarnings = Array.from(new Set(warnings));
+    const allUniqueWarnings = Array.from(new Set(warnings));
+    const allWarningDiagnostics = allUniqueWarnings.map((warning) => warningDiagnostic(warning, nodes));
+    const changedPaths = options.changedOnly ? collectChangedPaths(options.root) : new Set();
+    const filteredWarningDiagnostics = options.changedOnly
+        ? allWarningDiagnostics.filter((warning) => warning.path !== undefined && changedPaths.has(warning.path))
+        : allWarningDiagnostics;
+    const uniqueWarnings = filteredWarningDiagnostics.map((warning) => warning.message);
     const uniqueErrors = Array.from(new Set(errors));
     const reportLines = [
         ...uniqueWarnings.map((warning) => `warning: ${warning}`),
@@ -390,24 +638,38 @@ function collectValidateReceipt(options) {
         warning_count: uniqueWarnings.length,
         error_count: uniqueErrors.length,
         warnings: uniqueWarnings,
+        warning_diagnostics: filteredWarningDiagnostics,
+        warning_summary: buildWarningSummary(filteredWarningDiagnostics),
         errors: uniqueErrors,
         ...(outPath ? { report_path: outPath } : {}),
+        ...(options.changedOnly
+            ? { warning_filter: { mode: "changed-only", changed_paths: Array.from(changedPaths).sort() } }
+            : {}),
     };
     return receipt;
 }
 function runValidateCommand(options) {
-    const receipt = collectValidateReceipt(options);
+    let receipt = collectValidateReceipt(options);
+    if (options.jsonOut) {
+        const jsonOutPath = path_1.default.resolve(options.root, options.jsonOut);
+        receipt = { ...receipt, json_receipt_path: jsonOutPath };
+        writeJsonReceipt(options.root, options.jsonOut, receipt);
+    }
+    const displayReceipt = options.summary ? shapeValidateReceiptForSummary(receipt, options.limit) : receipt;
     if (options.json) {
-        console.log(JSON.stringify(receipt, null, 2));
+        console.log(JSON.stringify(displayReceipt, null, 2));
         if (receipt.error_count > 0) {
             throw new errors_1.ValidationError(`validation failed with ${receipt.error_count} error(s)`);
         }
         return;
     }
     if (!options.quiet) {
-        for (const warning of receipt.warnings) {
+        for (const warning of displayReceipt.warnings) {
             console.error(`warning: ${warning}`);
         }
+        if (displayReceipt.warning_summary.truncated) {
+            console.error(`warning summary: omitted ${displayReceipt.warning_summary.omitted_count} warning(s); rerun without --summary or use --json-out <path> for full diagnostics`);
+        }
     }
     if (receipt.error_count > 0) {
         if (receipt.report_path) {

package/dist/commands/work.js

@@ -11,6 +11,7 @@ exports.runWorkTriggerCommand = runWorkTriggerCommand;
 exports.runWorkReceiptNewCommand = runWorkReceiptNewCommand;
 exports.runWorkReceiptUpdateCommand = runWorkReceiptUpdateCommand;
 exports.runWorkReceiptVerifyCommand = runWorkReceiptVerifyCommand;
+exports.runWorkValidateCommand = runWorkValidateCommand;
 exports.runWorkArtifactAddCommand = runWorkArtifactAddCommand;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
@@ -34,11 +35,15 @@ const archive_1 = require("./archive");
 const project_db_1 = require("../core/project_db");
 const project_db_migrations_1 = require("../core/project_db_migrations");
 const project_db_queue_1 = require("../core/project_db_queue");
+const validate_1 = require("./validate");
+const query_output_1 = require("./query_output");
+const workspace_files_1 = require("../graph/workspace_files");
 const PRICING_MODELS = new Set(["free", "included", "quoted", "fixed", "metered", "subscription"]);
 const ORDER_STATUSES = new Set(["submitted", "accepted", "running", "completed", "cancelled", "failed"]);
 const RECEIPT_STATUSES = new Set(["recorded", "verified", "rejected", "superseded"]);
 const OUTCOMES = new Set(["success", "partial", "failure"]);
 const REDACTION_POLICIES = new Set(["refs_and_hashes_only", "redacted_summary", "external_private"]);
+const WORKFLOW_VALIDATE_TYPES = new Set(agent_file_types_1.AGENT_FILE_TYPES);
 function parseCsvList(raw) {
     if (!raw) {
         return [];
@@ -210,6 +215,166 @@ function resolveReadableWorkNode(index, idOrQid, ws, type, label) {
     }
     return node;
 }
+function normalizeWorkflowValidateType(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const normalized = value.toLowerCase();
+    if (!WORKFLOW_VALIDATE_TYPES.has(normalized)) {
+        throw new errors_1.UsageError(`--type must be one of ${agent_file_types_1.AGENT_FILE_TYPES.join(", ")}`);
+    }
+    return normalized;
+}
+function isWorkflowNode(node) {
+    return WORKFLOW_VALIDATE_TYPES.has(node.type);
+}
+function resolveWorkflowTarget(index, idOrQid, ws) {
+    const resolved = (0, qid_1.resolveQid)(index, idOrQid, ws);
+    if (resolved.status !== "ok") {
+        throw new errors_1.NotFoundError((0, qid_1.formatResolveError)("workflow record", idOrQid, resolved, ws));
+    }
+    const node = index.nodes[resolved.qid];
+    if (!node || !isWorkflowNode(node)) {
+        throw new errors_1.NotFoundError(`workflow record not found: ${idOrQid}`);
+    }
+    return node;
+}
+function workflowDiagnosticCode(message) {
+    const rawMatch = /raw-content\.([a-z_]+)/.exec(message);
+    if (rawMatch) {
+        return `raw-content.${rawMatch[1]}`;
+    }
+    if (message.includes("missing recommended heading")) {
+        return "heading.missing";
+    }
+    const manifestCompatMatch = /manifest\.compat\.([a-z_]+)/.exec(message);
+    if (manifestCompatMatch) {
+        return `manifest.compat.${manifestCompatMatch[1]}`;
+    }
+    if (message.includes("references missing") || message.includes("references missing node")) {
+        return "reference.missing";
+    }
+    if (message.includes("must be named")) {
+        return "schema.basename";
+    }
+    if (message.includes("must be") || message.includes("is required")) {
+        return "schema.invalid";
+    }
+    if (message.includes("visibility:")) {
+        return "visibility.policy";
+    }
+    return "validation.message";
+}
+function workflowDiagnosticQid(message, nodes) {
+    for (const node of nodes) {
+        if (message.includes(node.qid) || message.includes(node.path)) {
+            return node.qid;
+        }
+    }
+    return undefined;
+}
+function workflowCandidatePaths(options) {
+    const values = new Set();
+    if (options.target) {
+        values.add(options.target.path);
+        values.add(path_1.default.resolve(options.root, options.target.path));
+        return Array.from(values);
+    }
+    const basenames = options.type
+        ? new Set([agent_file_types_1.AGENT_FILE_BASENAMES[options.type]])
+        : new Set(Object.values(agent_file_types_1.AGENT_FILE_BASENAMES));
+    const filesByAlias = (0, workspace_files_1.listWorkspaceDocFilesByAlias)(options.root, options.config);
+    for (const [alias, files] of Object.entries(filesByAlias)) {
+        if (options.ws !== "root" && alias !== options.ws) {
+            continue;
+        }
+        for (const filePath of files) {
+            if (!basenames.has(path_1.default.basename(filePath))) {
+                continue;
+            }
+            values.add(filePath);
+            values.add(path_1.default.relative(options.root, filePath).split(path_1.default.sep).join("/"));
+        }
+    }
+    return Array.from(values);
+}
+function filterWorkflowMessages(messages, nodes, candidatePaths) {
+    if (nodes.length === 0 && candidatePaths.length === 0) {
+        return [];
+    }
+    return messages.filter((message) => nodes.some((node) => message.includes(node.qid) || message.includes(node.path)) ||
+        candidatePaths.some((filePath) => message.includes(filePath)));
+}
+function buildWorkValidateReceipt(options) {
+    const config = (0, config_1.loadConfig)(options.root);
+    const ws = normalizeWorkspace(options.ws);
+    const { index } = (0, index_cache_1.loadIndex)({ root: options.root, config, tolerant: true });
+    const type = normalizeWorkflowValidateType(options.type);
+    let targets;
+    let target;
+    if (options.id) {
+        target = resolveWorkflowTarget(index, options.id, ws);
+        if (type && target.type !== type) {
+            throw new errors_1.UsageError(`workflow record ${target.qid} is ${target.type}, not ${type}`);
+        }
+        targets = [target];
+    }
+    else {
+        targets = Object.values(index.nodes)
+            .filter((node) => isWorkflowNode(node) && (!type || node.type === type))
+            .sort((a, b) => a.qid.localeCompare(b.qid));
+    }
+    const candidatePaths = workflowCandidatePaths({ root: options.root, config, ws, type, target });
+    const validation = (0, validate_1.collectValidateReceipt)({ root: options.root });
+    const warnings = filterWorkflowMessages(validation.warnings, targets, candidatePaths);
+    const errors = filterWorkflowMessages(validation.errors, targets, candidatePaths);
+    const diagnostics = [
+        ...warnings.map((message) => ({
+            severity: "warning",
+            code: workflowDiagnosticCode(message),
+            message,
+            qid: workflowDiagnosticQid(message, targets),
+        })),
+        ...errors.map((message) => ({
+            severity: "error",
+            code: workflowDiagnosticCode(message),
+            message,
+            qid: workflowDiagnosticQid(message, targets),
+        })),
+    ];
+    return {
+        action: "work.validate",
+        ok: errors.length === 0,
+        type: type ?? "all",
+        ...(target ? { target: (0, query_output_1.toNodeSummaryJson)(target) } : {}),
+        checked_count: target ? 1 : candidatePaths.filter((value) => !path_1.default.isAbsolute(value)).length,
+        nodes: targets.map((node) => (0, query_output_1.toNodeSummaryJson)(node)),
+        warning_count: warnings.length,
+        error_count: errors.length,
+        warnings,
+        errors,
+        diagnostics,
+    };
+}
+function printWorkValidateReceipt(receipt, json) {
+    if (json) {
+        (0, query_output_1.writeJson)(receipt);
+        if (!receipt.ok) {
+            throw new errors_1.ValidationError(`workflow validation failed with ${receipt.error_count} error(s)`);
+        }
+        return;
+    }
+    for (const warning of receipt.warnings) {
+        console.error(`warning: ${warning}`);
+    }
+    if (!receipt.ok) {
+        for (const error of receipt.errors) {
+            console.error(error);
+        }
+        throw new errors_1.ValidationError(`workflow validation failed with ${receipt.error_count} error(s)`);
+    }
+    console.log(`workflow validation ok: ${receipt.checked_count} file(s)`);
+}
 function resolveTriggerWorkNode(index, ws, refRaw) {
     const ref = normalizePortableIdRef(refRaw, "<work-or-capability-ref>");
     const resolved = (0, qid_1.resolveQid)(index, ref, ws);
@@ -223,8 +388,8 @@ function resolveTriggerWorkNode(index, ws, refRaw) {
     if (node.type === "work") {
         return { workNode: node };
     }
-    if (node.type !== "spec") {
-        throw new errors_1.UsageError(`work trigger requires a WORK.md or SPEC.md ref, got ${node.type}: ${node.qid}`);
+    if (!(0, agent_file_types_1.isManifestSemanticType)(node.type)) {
+        throw new errors_1.UsageError(`work trigger requires a WORK.md or MANIFEST.md/SPEC.md ref, got ${node.type}: ${node.qid}`);
     }
     const candidates = new Map();
     const specDir = path_1.default.posix.dirname(node.path);
@@ -250,11 +415,12 @@ function resolveTriggerWorkNode(index, ws, refRaw) {
         }
     }
     const workNodes = Array.from(candidates.values()).sort((a, b) => a.qid.localeCompare(b.qid));
+    const manifestLabel = node.type === "spec" ? "legacy SPEC.md" : "MANIFEST.md";
     if (workNodes.length === 0) {
-        throw new errors_1.NotFoundError(`SPEC.md ${node.qid} has no resolvable WORK.md contract`);
+        throw new errors_1.NotFoundError(`${manifestLabel} ${node.qid} has no resolvable WORK.md contract`);
     }
     if (workNodes.length > 1) {
-        throw new errors_1.UsageError(`SPEC.md ${node.qid} has multiple work contracts; trigger one explicitly: ${workNodes
+        throw new errors_1.UsageError(`${manifestLabel} ${node.qid} has multiple work contracts; trigger one explicitly: ${workNodes
             .map((workNode) => workNode.qid)
             .join(", ")}`);
     }
@@ -596,7 +762,9 @@ function runWorkContractNewCommandLocked(options) {
     const agentId = normalizePortableIdRef(options.agentId, "--agent-id");
     const kind = options.kind.toLowerCase();
     const resolvedAgent = (0, qid_1.resolveQid)(index, agentId, ws);
-    const relates = resolvedAgent.status === "ok" && index.nodes[resolvedAgent.qid]?.type === "spec" ? [agentId] : [];
+    const relates = resolvedAgent.status === "ok" && (0, agent_file_types_1.isManifestSemanticType)(index.nodes[resolvedAgent.qid]?.type ?? "")
+        ? [agentId]
+        : [];
     const requiredCapabilities = parseCsvList(options.requiredCapabilities);
     const receipt = createAgentWorkflowNode({
         root: options.root,
@@ -943,6 +1111,9 @@ function runWorkReceiptUpdateCommand(options) {
 function runWorkReceiptVerifyCommand(options) {
     return runWorkReceiptVerifyCommandLocked(options);
 }
+function runWorkValidateCommand(options) {
+    return printWorkValidateReceipt(buildWorkValidateReceipt(options), options.json);
+}
 function runWorkArtifactAddCommand(options) {
     return withWorkLock(options.root, () => runWorkArtifactAddCommandLocked(options));
 }