mdkg 0.3.9 → 0.4.1

package/dist/command-contract.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "tool": "mdkg",
-  "package_version": "0.3.9",
+  "package_version": "0.4.1",
   "source": {
     "help_targets": "scripts/cli_help_targets.js",
     "command_matrix": "CLI_COMMAND_MATRIX.md"
@@ -5230,12 +5230,24 @@
           "required": false,
           "description": "--parent --prev --next --relates --blocked-by --blocks"
         },
+        {
+          "name": "--contract-profile",
+          "value": "<name>",
+          "required": false,
+          "description": "--contract-profile <name>  Optional MANIFEST/WORK/WORK_ORDER/RECEIPT validation profile metadata"
+        },
         {
           "name": "--epic",
           "value": "<id>",
           "required": false,
           "description": "--epic <id>                Epic id"
         },
+        {
+          "name": "--evidence-policy-ref",
+          "value": "<ref>",
+          "required": false,
+          "description": "--evidence-policy-ref <ref> Optional MANIFEST/WORK_ORDER/RECEIPT evidence policy ref"
+        },
         {
           "name": "--help",
           "value": null,
@@ -5278,6 +5290,18 @@
           "required": false,
           "description": "--priority <0..9>          Work item priority"
         },
+        {
+          "name": "--receipt-kind",
+          "value": "<kind>",
+          "required": false,
+          "description": "--receipt-kind <kind>      Optional RECEIPT kind metadata"
+        },
+        {
+          "name": "--redaction-class",
+          "value": "<class>",
+          "required": false,
+          "description": "--redaction-class <class>  Optional RECEIPT redaction class metadata"
+        },
         {
           "name": "--refs",
           "value": null,
@@ -5326,6 +5350,12 @@
           "required": false,
           "description": "--template <set>           Template set"
         },
+        {
+          "name": "--validation-policy-ref",
+          "value": "<ref>",
+          "required": false,
+          "description": "--validation-policy-ref <ref> Optional MANIFEST/WORK_ORDER/RECEIPT validation policy ref"
+        },
         {
           "name": "--version",
           "value": null,
@@ -8242,7 +8272,7 @@
       "visibility": "public",
       "summary": "mdkg validate command",
       "usage": [
-        "  mdkg validate [--out <path>] [--json-out <path>] [--quiet] [--changed-only] [--summary] [--limit <n>] [--json]"
+        "  mdkg validate [--out <path>] [--json-out <path>] [--quiet] [--changed-only] [--summary] [--limit <n>] [--profile <name>] [--json]"
       ],
       "args": [],
       "flags": [
@@ -8276,6 +8306,12 @@
           "required": false,
           "description": "--out writes the compatibility text report; --json-out writes a clean full JSON receipt."
         },
+        {
+          "name": "--profile",
+          "value": "omni-room",
+          "required": false,
+          "description": "--profile omni-room applies explicit contract-profile validation after generic validation; this is separate from mdkg pack --profile."
+        },
         {
           "name": "--root",
           "value": null,
@@ -8326,7 +8362,7 @@
         }
       ],
       "examples": [
-        "  mdkg validate [--out <path>] [--json-out <path>] [--quiet] [--changed-only] [--summary] [--limit <n>] [--json]"
+        "  mdkg validate [--out <path>] [--json-out <path>] [--quiet] [--changed-only] [--summary] [--limit <n>] [--profile <name>] [--json]"
       ],
       "docs": {
         "help_target": "mdkg help validate",
@@ -8348,7 +8384,7 @@
         "  mdkg work order new|status|update ...",
         "  mdkg work receipt new|verify|update ...",
         "  mdkg work artifact add ...",
-        "  mdkg work validate [<id-or-qid>] [--type <workflow-type>] [--json]"
+        "  mdkg work validate [<id-or-qid>] [--type <workflow-type>] [--profile <name>] [--json]"
       ],
       "args": [
         {
@@ -8528,7 +8564,7 @@
       "visibility": "public",
       "summary": "mdkg work contract command",
       "usage": [
-        "  mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+        "  mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
       ],
       "args": [
         {
@@ -8542,7 +8578,7 @@
           "name": "--agent-id",
           "value": "<agent.id>",
           "required": false,
-          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
         },
         {
           "name": "--help",
@@ -8554,25 +8590,25 @@
           "name": "--id",
           "value": "<work.id>",
           "required": false,
-          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
         },
         {
           "name": "--inputs",
           "value": "<...>",
           "required": false,
-          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
         },
         {
           "name": "--kind",
           "value": "<kind>",
           "required": false,
-          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
         },
         {
           "name": "--outputs",
           "value": "<...>",
           "required": false,
-          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
         },
         {
           "name": "--root",
@@ -8623,7 +8659,7 @@
         }
       ],
       "examples": [
-        "  mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+        "  mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
       ],
       "docs": {
         "help_target": "mdkg help work contract",
@@ -8641,7 +8677,7 @@
       "visibility": "public",
       "summary": "mdkg work order command",
       "usage": [
-        "  mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]",
+        "  mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--contract-profile <name>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]",
         "  mdkg work order status <id-or-qid> [--json]",
         "  mdkg work order update <id-or-qid> [--status <status>] [--add-input-refs <...>] [--add-queue-refs <...>] [--add-artifacts <...>] [--json]"
       ],
@@ -8668,13 +8704,13 @@
           "name": "--id",
           "value": "<order.id>",
           "required": false,
-          "description": "mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]"
+          "description": "mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--contract-profile <name>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]"
         },
         {
           "name": "--requester",
           "value": "<ref>",
           "required": false,
-          "description": "mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]"
+          "description": "mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--contract-profile <name>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]"
         },
         {
           "name": "--root",
@@ -8692,7 +8728,7 @@
           "name": "--work-id",
           "value": "<work.id>",
           "required": false,
-          "description": "mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]"
+          "description": "mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--contract-profile <name>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]"
         }
       ],
       "output_formats": [
@@ -8726,7 +8762,7 @@
         }
       ],
       "examples": [
-        "  mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]",
+        "  mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--contract-profile <name>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]",
         "  mdkg work order status <id-or-qid> [--json]",
         "  mdkg work order update <id-or-qid> [--status <status>] [--add-input-refs <...>] [--add-queue-refs <...>] [--add-artifacts <...>] [--json]"
       ],
@@ -8746,7 +8782,7 @@
       "visibility": "public",
       "summary": "mdkg work receipt command",
       "usage": [
-        "  mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--evidence-hashes <sha256:...>] [--json]",
+        "  mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--contract-profile <name>] [--receipt-kind <kind>] [--redaction-class <class>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--evidence-hashes <sha256:...>] [--json]",
         "  mdkg work receipt verify <id-or-qid> [--json]",
         "  mdkg work receipt update <id-or-qid> [--receipt-status <status>] [--add-artifacts <...>] [--add-proof-refs <...>] [--add-attestation-refs <...>] [--add-evidence-hashes <sha256:...>] [--json]"
       ],
@@ -8773,13 +8809,13 @@
           "name": "--id",
           "value": "<receipt.id>",
           "required": false,
-          "description": "mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--evidence-hashes <sha256:...>] [--json]"
+          "description": "mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--contract-profile <name>] [--receipt-kind <kind>] [--redaction-class <class>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--evidence-hashes <sha256:...>] [--json]"
         },
         {
           "name": "--outcome",
           "value": "success|partial|failure",
           "required": false,
-          "description": "mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--evidence-hashes <sha256:...>] [--json]"
+          "description": "mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--contract-profile <name>] [--receipt-kind <kind>] [--redaction-class <class>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--evidence-hashes <sha256:...>] [--json]"
         },
         {
           "name": "--root",
@@ -8797,7 +8833,7 @@
           "name": "--work-order-id",
           "value": "<order.id>",
           "required": false,
-          "description": "mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--evidence-hashes <sha256:...>] [--json]"
+          "description": "mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--contract-profile <name>] [--receipt-kind <kind>] [--redaction-class <class>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--evidence-hashes <sha256:...>] [--json]"
         }
       ],
       "output_formats": [
@@ -8837,7 +8873,7 @@
         }
       ],
       "examples": [
-        "  mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--evidence-hashes <sha256:...>] [--json]",
+        "  mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--contract-profile <name>] [--receipt-kind <kind>] [--redaction-class <class>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--evidence-hashes <sha256:...>] [--json]",
         "  mdkg work receipt update <id-or-qid> [--receipt-status <status>] [--add-artifacts <...>] [--add-proof-refs <...>] [--add-attestation-refs <...>] [--add-evidence-hashes <sha256:...>] [--json]",
         "  mdkg work receipt verify <id-or-qid> [--json]"
       ],
@@ -8964,7 +9000,7 @@
       "visibility": "public",
       "summary": "mdkg work validate command",
       "usage": [
-        "  mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] [--json]"
+        "  mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] [--profile <name>] [--json]"
       ],
       "args": [
         {
@@ -8980,6 +9016,12 @@
           "required": false,
           "description": "--help, -h          Show help"
         },
+        {
+          "name": "--profile",
+          "value": "omni-room",
+          "required": false,
+          "description": "--profile omni-room applies explicit contract-profile validation after generic mirror validation; this is separate from mdkg pack --profile."
+        },
         {
           "name": "--root",
           "value": null,
@@ -9026,7 +9068,7 @@
         }
       ],
       "examples": [
-        "  mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] [--json]"
+        "  mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] [--profile <name>] [--json]"
       ],
       "docs": {
         "help_target": "mdkg help work validate",
@@ -9128,5 +9170,5 @@
       }
     }
   ],
-  "contract_hash": "3c13c572c740f1e40db33fa5867fa227a8347df0750ef3beb0696d5931761a6c"
+  "contract_hash": "65408d40dd065dfadcaa9bfe3626df5703dce2fe08ce1dd500e371899a8c4f7a"
 }

package/dist/commands/new.js

@@ -12,6 +12,7 @@ const node_1 = require("../graph/node");
 const agent_file_types_1 = require("../graph/agent_file_types");
 const indexer_1 = require("../graph/indexer");
 const loader_1 = require("../templates/loader");
+const frontmatter_1 = require("../graph/frontmatter");
 const date_1 = require("../util/date");
 const errors_1 = require("../util/errors");
 const qid_1 = require("../util/qid");
@@ -25,6 +26,7 @@ const event_support_1 = require("./event_support");
 const DEC_ID_RE = /^dec-[0-9]+$/;
 const DEC_STATUS = new Set(["proposed", "accepted", "rejected", "superseded"]);
 const SKILL_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const CONTRACT_METADATA_RE = /^[a-z][a-z0-9_]*(?:-[a-z0-9_]+)*$/;
 const CORE_TYPES = new Set(["rule"]);
 const DESIGN_TYPES = new Set(["prd", "edd", "dec", "prop"]);
 const LEGACY_NEW_SPEC_WARNING = "warning: mdkg new spec is legacy; use mdkg new manifest. This alias creates MANIFEST.md with type: manifest during the compatibility release.";
@@ -77,6 +79,16 @@ function normalizeRef(value, key) {
 function normalizeRefList(raw, key) {
     return parseCsvList(raw).map((value) => normalizeRef(value, key));
 }
+function normalizeContractMetadataToken(raw, key) {
+    if (raw === undefined) {
+        return undefined;
+    }
+    const normalized = raw.toLowerCase();
+    if (!CONTRACT_METADATA_RE.test(normalized)) {
+        throw new errors_1.UsageError(`${key} must be lowercase snake/kebab style`);
+    }
+    return normalized;
+}
 function normalizeIdRefList(raw, key) {
     return parseCsvList(raw).map((value) => normalizeIdRef(value, key));
 }
@@ -176,6 +188,18 @@ function ensureExists(index, value, ws, label) {
         throw new errors_1.UsageError(`${label} cannot target read-only subgraph node ${node.qid}`);
     }
 }
+function mergeRenderedFrontmatter(content, filePath, additions) {
+    const entries = Object.entries(additions).filter((entry) => entry[1] !== undefined);
+    if (entries.length === 0) {
+        return content;
+    }
+    const { frontmatter, body } = (0, frontmatter_1.parseFrontmatter)(content, filePath);
+    for (const [key, value] of entries) {
+        frontmatter[key] = value;
+    }
+    const lines = ["---", ...(0, frontmatter_1.formatFrontmatter)(frontmatter), "---", body.trimStart()];
+    return lines.join("\n").endsWith("\n") ? lines.join("\n") : `${lines.join("\n")}\n`;
+}
 function runNewCommandLocked(options) {
     const title = options.title.trim();
     if (!title) {
@@ -274,6 +298,24 @@ function runNewCommandLocked(options) {
     if (options.cases && type !== "test") {
         throw new errors_1.UsageError("--cases is only valid for test nodes");
     }
+    const contractProfile = normalizeContractMetadataToken(options.contractProfile, "--contract-profile");
+    const validationPolicyRef = options.validationPolicyRef
+        ? normalizeRef(options.validationPolicyRef, "--validation-policy-ref")
+        : undefined;
+    const evidencePolicyRef = options.evidencePolicyRef
+        ? normalizeRef(options.evidencePolicyRef, "--evidence-policy-ref")
+        : undefined;
+    const receiptKind = normalizeContractMetadataToken(options.receiptKind, "--receipt-kind");
+    const redactionClass = normalizeContractMetadataToken(options.redactionClass, "--redaction-class");
+    if (contractProfile && !["manifest", "work", "work_order", "receipt"].includes(type)) {
+        throw new errors_1.UsageError("--contract-profile is only valid for manifest, work, work_order, and receipt");
+    }
+    if ((validationPolicyRef || evidencePolicyRef) && !["manifest", "work_order", "receipt"].includes(type)) {
+        throw new errors_1.UsageError("--validation-policy-ref and --evidence-policy-ref are only valid for manifest, work_order, and receipt");
+    }
+    if ((receiptKind || redactionClass) && type !== "receipt") {
+        throw new errors_1.UsageError("--receipt-kind and --redaction-class are only valid for receipt");
+    }
     const epic = options.epic ? normalizeIdRef(options.epic, "--epic") : undefined;
     const parent = options.parent ? normalizeIdRef(options.parent, "--parent") : undefined;
     const prev = options.prev ? normalizeIdRef(options.prev, "--prev") : undefined;
@@ -331,7 +373,7 @@ function runNewCommandLocked(options) {
     if (template.source === "bundled") {
         console.error(`warning: using bundled template fallback for ${type}; run \`mdkg upgrade --apply\` to vendor missing local templates`);
     }
-    const content = (0, loader_1.renderTemplate)(template, {
+    const renderedContent = (0, loader_1.renderTemplate)(template, {
         id,
         type,
         title,
@@ -360,6 +402,13 @@ function runNewCommandLocked(options) {
         created: today,
         updated: today,
     });
+    const content = mergeRenderedFrontmatter(renderedContent, filePath, {
+        contract_profile: contractProfile,
+        validation_policy_ref: validationPolicyRef,
+        evidence_policy_ref: evidencePolicyRef,
+        receipt_kind: receiptKind,
+        redaction_class: redactionClass,
+    });
     try {
         (0, atomic_1.writeFileExclusive)(filePath, content);
     }

package/dist/commands/validate.js

@@ -21,6 +21,7 @@ const visibility_1 = require("../graph/visibility");
 const sqlite_index_1 = require("../graph/sqlite_index");
 const errors_1 = require("../util/errors");
 const skill_mirror_1 = require("./skill_mirror");
+const VALIDATION_PROFILES = new Set(["omni-room"]);
 exports.RECOMMENDED_HEADINGS = {
     task: [
         "Overview",
@@ -143,6 +144,69 @@ function collectManifestCompatibilityWarnings(qid, filePath, node) {
     }
     return [];
 }
+function collectContractProfileWarnings(qid, node) {
+    if (!(0, agent_file_types_1.isAgentFileType)(node.type)) {
+        return [];
+    }
+    const warnings = [];
+    if (node.frontmatter.profile !== undefined) {
+        warnings.push(`${qid}: contract-profile.ambiguous-field warning: profile is ambiguous and is not a supported alias; use contract_profile for mdkg contract surfaces`);
+    }
+    const contractProfile = node.frontmatter.contract_profile;
+    if (typeof contractProfile === "string" && !agent_file_types_1.KNOWN_CONTRACT_PROFILES.has(contractProfile)) {
+        warnings.push(`${qid}: contract-profile.unknown warning: unknown contract_profile ${contractProfile}; generic validation accepts well-shaped values, but explicit profile validation may reject it`);
+    }
+    if (node.type === "receipt") {
+        const receiptKind = node.frontmatter.receipt_kind;
+        if (typeof receiptKind === "string" && !agent_file_types_1.KNOWN_RECEIPT_KINDS.has(receiptKind)) {
+            warnings.push(`${qid}: receipt-kind.unknown warning: unknown receipt_kind ${receiptKind}; generic validation accepts well-shaped values, but explicit profile validation may reject it`);
+        }
+        const redactionClass = node.frontmatter.redaction_class;
+        if (typeof redactionClass === "string" && !agent_file_types_1.KNOWN_REDACTION_CLASSES.has(redactionClass)) {
+            warnings.push(`${qid}: redaction-class.unknown warning: unknown redaction_class ${redactionClass}; generic validation accepts well-shaped values, but explicit profile validation may reject it`);
+        }
+        if (typeof redactionClass === "string" && node.frontmatter.redaction_policy === undefined) {
+            warnings.push(`${qid}: redaction-class.missing-policy warning: redaction_class should be paired with redaction_policy so receipt handling and sensitivity are both explicit`);
+        }
+    }
+    return warnings;
+}
+function normalizeValidationProfile(profile) {
+    if (profile === undefined) {
+        return undefined;
+    }
+    if (!VALIDATION_PROFILES.has(profile)) {
+        throw new errors_1.UsageError("--profile must be one of omni-room");
+    }
+    return profile;
+}
+function collectContractProfileErrors(qid, node, profile) {
+    if (!(0, agent_file_types_1.isAgentFileType)(node.type)) {
+        return [];
+    }
+    const errors = [];
+    if (node.frontmatter.profile !== undefined) {
+        errors.push(`${qid}: contract-profile.ambiguous-field error: profile is ambiguous and is not a supported alias; use contract_profile for ${profile} validation`);
+    }
+    const contractProfile = node.frontmatter.contract_profile;
+    if (typeof contractProfile === "string" && contractProfile !== profile) {
+        errors.push(`${qid}: contract-profile.incompatible error: contract_profile ${contractProfile} is incompatible with validation profile ${profile}`);
+    }
+    if (node.type === "receipt") {
+        const receiptKind = node.frontmatter.receipt_kind;
+        if (typeof receiptKind === "string" && !agent_file_types_1.KNOWN_RECEIPT_KINDS.has(receiptKind)) {
+            errors.push(`${qid}: receipt-kind.incompatible error: receipt_kind ${receiptKind} is incompatible with validation profile ${profile}`);
+        }
+        const redactionClass = node.frontmatter.redaction_class;
+        if (typeof redactionClass === "string" && !agent_file_types_1.KNOWN_REDACTION_CLASSES.has(redactionClass)) {
+            errors.push(`${qid}: redaction-class.incompatible error: redaction_class ${redactionClass} is incompatible with validation profile ${profile}`);
+        }
+        if (typeof redactionClass === "string" && node.frontmatter.redaction_policy === undefined) {
+            errors.push(`${qid}: redaction-class.missing-policy error: redaction_class requires redaction_policy for validation profile ${profile}`);
+        }
+    }
+    return errors;
+}
 function collectChangedPaths(root) {
     const result = (0, child_process_1.spawnSync)("git", ["-C", root, "status", "--porcelain", "--", ".mdkg"], {
         encoding: "utf8",
@@ -234,6 +298,20 @@ function warningDiagnostic(message, nodes) {
             remediation: "Rename legacy SPEC.md files to MANIFEST.md and update transitional type: spec frontmatter to type: manifest before the compatibility release closes.",
         };
     }
+    const contractProfileMatch = /(contract-profile|receipt-kind|redaction-class)\.([a-z-]+)/.exec(message);
+    if (contractProfileMatch) {
+        return {
+            id: `${contractProfileMatch[1]}.${contractProfileMatch[2]}`,
+            category: "contract-profile",
+            severity: "warning",
+            message,
+            qid,
+            node_type: nodeType,
+            path: pathValue,
+            ref: qid,
+            remediation: "Use contract_profile and explicit policy/kind/class fields only when they are intentional generic mdkg contract metadata.",
+        };
+    }
     if (message.includes("sqlite") || message.includes("index")) {
         return {
             id: "cache.index",
@@ -485,6 +563,7 @@ function validateEventsJsonl(root, config, errors) {
     }
 }
 function collectValidateReceipt(options) {
+    const validationProfile = normalizeValidationProfile(options.profile);
     const config = (0, config_1.loadConfig)(options.root);
     const templateSchemaInfo = (0, template_schema_1.loadTemplateSchemasWithInfo)(options.root, config, node_1.ALLOWED_TYPES);
     const templateSchemas = templateSchemaInfo.schemas;
@@ -543,6 +622,10 @@ function collectValidateReceipt(options) {
                 }
                 warnings.push(...collectRawContentWarnings(qid, node));
                 warnings.push(...collectManifestCompatibilityWarnings(qid, filePath, node));
+                warnings.push(...collectContractProfileWarnings(qid, node));
+                if (validationProfile) {
+                    errors.push(...collectContractProfileErrors(qid, node, validationProfile));
+                }
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : "unknown error";
@@ -641,6 +724,7 @@ function collectValidateReceipt(options) {
         warning_diagnostics: filteredWarningDiagnostics,
         warning_summary: buildWarningSummary(filteredWarningDiagnostics),
         errors: uniqueErrors,
+        ...(validationProfile ? { validation_profile: validationProfile } : {}),
         ...(outPath ? { report_path: outPath } : {}),
         ...(options.changedOnly
             ? { warning_filter: { mode: "changed-only", changed_paths: Array.from(changedPaths).sort() } }

package/dist/commands/work.js

@@ -44,6 +44,7 @@ const RECEIPT_STATUSES = new Set(["recorded", "verified", "rejected", "supersede
 const OUTCOMES = new Set(["success", "partial", "failure"]);
 const REDACTION_POLICIES = new Set(["refs_and_hashes_only", "redacted_summary", "external_private"]);
 const WORKFLOW_VALIDATE_TYPES = new Set(agent_file_types_1.AGENT_FILE_TYPES);
+const CONTRACT_METADATA_RE = /^[a-z][a-z0-9_]*(?:-[a-z0-9_]+)*$/;
 function parseCsvList(raw) {
     if (!raw) {
         return [];
@@ -84,6 +85,16 @@ function normalizeEnum(value, flag, allowed) {
     }
     return normalized;
 }
+function normalizeContractMetadataToken(value, flag) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const normalized = value.toLowerCase();
+    if (!CONTRACT_METADATA_RE.test(normalized)) {
+        throw new errors_1.UsageError(`${flag} must be lowercase snake/kebab style`);
+    }
+    return normalized;
+}
 function normalizeSha256Ref(value, flag) {
     if (value === undefined) {
         return undefined;
@@ -251,6 +262,10 @@ function workflowDiagnosticCode(message) {
     if (manifestCompatMatch) {
         return `manifest.compat.${manifestCompatMatch[1]}`;
     }
+    const contractProfileMatch = /(contract-profile|receipt-kind|redaction-class)\.([a-z-]+)/.exec(message);
+    if (contractProfileMatch) {
+        return `${contractProfileMatch[1]}.${contractProfileMatch[2]}`;
+    }
     if (message.includes("references missing") || message.includes("references missing node")) {
         return "reference.missing";
     }
@@ -325,7 +340,7 @@ function buildWorkValidateReceipt(options) {
             .sort((a, b) => a.qid.localeCompare(b.qid));
     }
     const candidatePaths = workflowCandidatePaths({ root: options.root, config, ws, type, target });
-    const validation = (0, validate_1.collectValidateReceipt)({ root: options.root });
+    const validation = (0, validate_1.collectValidateReceipt)({ root: options.root, profile: options.profile });
     const warnings = filterWorkflowMessages(validation.warnings, targets, candidatePaths);
     const errors = filterWorkflowMessages(validation.errors, targets, candidatePaths);
     const diagnostics = [
@@ -346,6 +361,7 @@ function buildWorkValidateReceipt(options) {
         action: "work.validate",
         ok: errors.length === 0,
         type: type ?? "all",
+        ...(options.profile ? { validation_profile: options.profile } : {}),
         ...(target ? { target: (0, query_output_1.toNodeSummaryJson)(target) } : {}),
         checked_count: target ? 1 : candidatePaths.filter((value) => !path_1.default.isAbsolute(value)).length,
         nodes: targets.map((node) => (0, query_output_1.toNodeSummaryJson)(node)),
@@ -625,6 +641,19 @@ function writeFrontmatterFile(filePath, frontmatter, body) {
     const content = ["---", ...lines, "---", body.trimStart()].join("\n");
     (0, atomic_1.atomicWriteFile)(filePath, content.endsWith("\n") ? content : `${content}\n`);
 }
+function mergeRenderedFrontmatter(content, filePath, additions) {
+    const entries = Object.entries(additions).filter((entry) => entry[1] !== undefined);
+    if (entries.length === 0) {
+        return content;
+    }
+    const { frontmatter, body } = (0, frontmatter_1.parseFrontmatter)(content, filePath);
+    for (const [key, value] of entries) {
+        frontmatter[key] = value;
+    }
+    const lines = ["---", ...(0, frontmatter_1.formatFrontmatter)(frontmatter, frontmatter_1.DEFAULT_FRONTMATTER_KEY_ORDER), "---", body.trimStart()];
+    const merged = lines.join("\n");
+    return merged.endsWith("\n") ? merged : `${merged}\n`;
+}
 function createAgentWorkflowNode(options) {
     const config = (0, config_1.loadConfig)(options.root);
     const ws = normalizeWorkspace(options.ws);
@@ -641,7 +670,7 @@ function createAgentWorkflowNode(options) {
     const slug = slugifyTitle(options.title);
     const filePath = path_1.default.resolve(options.root, workspace.path, workspace.mdkg_dir, "work", `${id}-${slug}`, agent_file_types_1.AGENT_FILE_BASENAMES[options.type]);
     const template = (0, loader_1.loadTemplate)(options.root, config, options.type);
-    const content = (0, loader_1.renderTemplate)(template, {
+    const renderedContent = (0, loader_1.renderTemplate)(template, {
         id,
         type: options.type,
         title: options.title,
@@ -649,6 +678,7 @@ function createAgentWorkflowNode(options) {
         updated: today,
         ...options.overrides,
     });
+    const content = mergeRenderedFrontmatter(renderedContent, filePath, options.overrides);
     try {
         (0, atomic_1.writeFileExclusive)(filePath, content);
     }
@@ -745,6 +775,9 @@ function createWorkOrderForWork(options) {
             request_ref: requestRef,
             trigger_ref: triggerRef,
             payload_hash: payloadHash,
+            contract_profile: normalizeContractMetadataToken(options.contractProfile, "--contract-profile"),
+            validation_policy_ref: options.validationPolicyRef,
+            evidence_policy_ref: options.evidencePolicyRef,
             input_refs: inputRefs,
             queue_refs: queueRefs,
             requested_outputs: requestedOutputs,
@@ -766,6 +799,7 @@ function runWorkContractNewCommandLocked(options) {
         ? [agentId]
         : [];
     const requiredCapabilities = parseCsvList(options.requiredCapabilities);
+    const contractProfile = normalizeContractMetadataToken(options.contractProfile, "--contract-profile");
     const receipt = createAgentWorkflowNode({
         root: options.root,
         ws,
@@ -776,6 +810,7 @@ function runWorkContractNewCommandLocked(options) {
         overrides: {
             agent_id: agentId,
             kind,
+            contract_profile: contractProfile,
             pricing_model: normalizeEnum(options.pricingModel ?? "quoted", "--pricing-model", PRICING_MODELS),
             required_capabilities: requiredCapabilities.length > 0 ? requiredCapabilities : [kind],
             inputs: parseCsvList(options.inputs),
@@ -807,6 +842,9 @@ function runWorkOrderNewCommandLocked(options) {
         queueRefs: options.queueRefs,
         requestedOutputs: options.requestedOutputs,
         constraintRefs: options.constraintRefs,
+        contractProfile: options.contractProfile,
+        validationPolicyRef: options.validationPolicyRef,
+        evidencePolicyRef: options.evidencePolicyRef,
         now: options.now,
     });
     printReceipt("order created", created.receipt, options.json);
@@ -979,6 +1017,11 @@ function runWorkReceiptNewCommandLocked(options) {
             outcome: normalizeEnum(options.outcome, "--outcome", OUTCOMES),
             cost_ref: options.costRef ?? "cost.redacted",
             redaction_policy: normalizeEnum(options.redactionPolicy ?? "refs_and_hashes_only", "--redaction-policy", REDACTION_POLICIES),
+            contract_profile: normalizeContractMetadataToken(options.contractProfile, "--contract-profile"),
+            receipt_kind: normalizeContractMetadataToken(options.receiptKind, "--receipt-kind"),
+            redaction_class: normalizeContractMetadataToken(options.redactionClass, "--redaction-class"),
+            validation_policy_ref: options.validationPolicyRef,
+            evidence_policy_ref: options.evidencePolicyRef,
             artifacts: parseCsvList(options.artifacts),
             proof_refs: parseCsvList(options.proofRefs),
             attestation_refs: parseCsvList(options.attestationRefs),