mdkg 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -8,6 +8,32 @@ mdkg is pre-v1 public alpha software. Command, graph, cache, bundle, and DAL con
 
 ## Unreleased
 
+## 0.4.1 - 2026-07-04
+
+### Added
+
+- Added generic contract-profile metadata for MANIFEST, WORK, WORK_ORDER, and
+  RECEIPT semantic mirrors, including `contract_profile`, policy refs,
+  `receipt_kind`, and `redaction_class` validation.
+- Added explicit profile validation through `mdkg validate --profile
+  omni-room` and `mdkg work validate --profile omni-room`, while keeping Omni
+  Room execution semantics runtime-owned.
+- Added scaffold and helper flags for contract-profile metadata across
+  `mdkg new manifest|work|work_order|receipt` and `mdkg work
+  contract|order|receipt new`.
+
+### Changed
+
+- Updated default templates, init assets, seeded skills, and generated command
+  references to demonstrate generic contract-profile fields without adding
+  runtime-only queue, provider, billing, ledger, or final-receipt state.
+- Documented the distinction between `contract_profile`, MANIFEST
+  `resource_profile`, WORK `kind`, WORK_ORDER `artifact_policy`, RECEIPT
+  `redaction_policy`, `receipt_kind`, `redaction_class`, and pack/bundle
+  `--profile` flags.
+- Expanded release-readiness documentation and checks for `0.4.1` so the
+  implementation can hand off to a separate approval-gated publish goal.
+
 ## 0.4.0 - 2026-06-27
 
 ### Added

package/CLI_COMMAND_MATRIX.md

@@ -1,7 +1,7 @@
 # CLI Command Matrix
 
-as_of: 2026-06-27
-package_version_in_source: 0.4.0
+as_of: 2026-07-03
+package_version_in_source: 0.4.1
 source: live help from `src/cli.ts`, runtime command handlers, and `dec-15`..`dec-18`
 status: canonical single-source command and flag reference for mdkg
 
@@ -213,6 +213,11 @@ Primary flags:
 - `--skills <slug,slug,...>`
 - `--template <set>`
 - `--run-id <id>`
+- `--contract-profile <name>` for MANIFEST, WORK, WORK_ORDER, and RECEIPT
+- `--validation-policy-ref <ref>` for MANIFEST, WORK_ORDER, and RECEIPT
+- `--evidence-policy-ref <ref>` for MANIFEST, WORK_ORDER, and RECEIPT
+- `--receipt-kind <kind>` for RECEIPT
+- `--redaction-class <class>` for RECEIPT
 - `--json`
 
 Advanced metadata flags:
@@ -819,17 +824,17 @@ Usage:
 - `mdkg work order new|status|update ...`
 - `mdkg work receipt new|verify|update ...`
 - `mdkg work artifact add ...`
-- `mdkg work contract new "<title>" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]`
+- `mdkg work contract new "<title>" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]`
 - `mdkg work trigger <work-or-capability-ref> [--id <order.id>] [--title "<title>"] [--requester <ref>] [--enqueue <queue>] [--json]`
-- `mdkg work order new "<title>" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]`
+- `mdkg work order new "<title>" --id <order.id> --work-id <work.id> --requester <ref> [--contract-profile <name>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]`
 - `mdkg work order status <id-or-qid> [--json]`
 - `mdkg work order update <id-or-qid> [--status <status>] [--add-input-refs <...>] [--add-queue-refs <...>] [--add-artifacts <...>] [--json]`
-- `mdkg work receipt new "<title>" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--evidence-hashes <sha256:...>] [--json]`
+- `mdkg work receipt new "<title>" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--contract-profile <name>] [--receipt-kind <kind>] [--redaction-class <class>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--evidence-hashes <sha256:...>] [--json]`
 - `mdkg work receipt verify <id-or-qid> [--json]`
 - `mdkg work receipt update <id-or-qid> [--receipt-status <status>] [--add-artifacts <...>] [--add-proof-refs <...>] [--add-attestation-refs <...>] [--add-evidence-hashes <sha256:...>] [--json]`
 - `mdkg work artifact add <order-or-receipt-id-or-qid> <file> [--id <archive.id>] [--kind source|artifact] [--json]`
-- `mdkg work validate [<id-or-qid>] [--type <workflow-type>] [--json]`
-- `mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] [--json]`
+- `mdkg work validate [<id-or-qid>] [--type <workflow-type>] [--profile <name>] [--json]`
+- `mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] [--profile <name>] [--json]`
 
 Notes:
 - work commands mutate semantic mirror files only
@@ -840,10 +845,13 @@ Notes:
 - example: `mdkg work trigger work.example --id order.example-1 --requester user://example --json`
 - `work trigger --enqueue <queue>` requires a valid project DB plus an explicitly created active queue, creates a submitted order mirror, and enqueues a local delivery message without executing work
 - `work order new` accepts URI-style requester/request/trigger refs, archive input refs, optional queue refs, and stable payload hashes
+- `work order new` accepts optional contract-profile and validation/evidence policy refs without executing work
 - `work order status` is read-only and reports deterministic order state plus linked receipts
 - `work receipt new` accepts URI-style cost/proof/attestation refs, explicit redaction policy, and SHA-256 evidence/input/output hash refs
+- `work receipt new` accepts optional contract-profile, receipt-kind, redaction-class, and validation/evidence policy refs without becoming canonical runtime receipt state
 - `work receipt verify` is read-only and reports linkage, evidence, archive ref, hash, outcome, and redaction-policy checks; invalid receipts print JSON before exiting nonzero
 - `work validate` is read-only and reports typed diagnostics for MANIFEST.md, legacy SPEC.md, WORK.md, WORK_ORDER.md, RECEIPT.md, FEEDBACK.md, DISPUTE.md, and PROPOSAL.md mirrors; obvious raw secret, prompt, token, or payload markers are warnings, not hard failures
+- `work validate --profile omni-room` applies explicit contract-profile validation after generic mirror validation; it is separate from `mdkg pack --profile`
 - `work artifact add` calls `mdkg archive add`, then attaches the resulting `archive://...` ref to the target order or receipt
 - `work order update`, `work receipt update`, and `work artifact add` accept local ids or local qids; subgraph qids are read-only and must be changed in their source workspace
 
@@ -990,10 +998,11 @@ When to use:
 - run the repo trust gate before calling work done
 
 Usage:
-- `mdkg validate [--out <path>] [--json-out <path>] [--quiet] [--changed-only] [--summary] [--limit <n>] [--json]`
+- `mdkg validate [--out <path>] [--json-out <path>] [--quiet] [--changed-only] [--summary] [--limit <n>] [--profile <name>] [--json]`
 - `--changed-only` filters warning presentation to changed `.mdkg` files while full graph errors still run
 - `--summary` emits bounded warning samples for agent/CI logs; `--limit <n>` controls the sample size
 - `--out <path>` writes the compatibility text report; `--json-out <path>` writes a clean full JSON receipt
+- `--profile omni-room` applies explicit contract-profile validation after generic validation; it is separate from `mdkg pack --profile`
 - JSON receipts include `warning_summary` and `warning_diagnostics` with warning ids, categories, severity, paths, refs, and remediation text
 
 Flags:
@@ -1003,10 +1012,11 @@ Flags:
 - `--changed-only`
 - `--summary`
 - `--limit <n>`
+- `--profile <name>`
 - `--json`
 
 JSON receipt:
-- `{ action: "validated", ok, warning_count, error_count, warnings, warning_diagnostics, warning_summary, errors, report_path?, json_receipt_path? }`
+- `{ action: "validated", ok, warning_count, error_count, warnings, warning_diagnostics, warning_summary, errors, validation_profile?, report_path?, json_receipt_path? }`
 - `report_path` is included only when `--out` is used.
 - `json_receipt_path` is included only when `--json-out` is used.
 

package/README.md

@@ -14,7 +14,7 @@ mdkg stays deliberately boring:
 - first-class rebuildable SQLite cache through built-in `node:sqlite`
 - no daemon, hosted index, or vector DB
 
-Current package version in source: `0.4.0`
+Current package version in source: `0.4.1`
 
 mdkg is still pre-v1 public alpha software. The public package is usable, but graph, cache, bundle, and DAL contracts may continue to change quickly while the project converges on a stable v1 surface.
 
@@ -600,7 +600,11 @@ Use `mdkg new manifest|work|work_order|receipt|feedback|dispute|proposal "<title
 
 Relational templates contain editable placeholder refs. `manifest` and `work` scaffold as validation-clean standalone docs; `work_order`, `receipt`, `feedback`, `dispute`, and `proposal` need real refs before strict `mdkg validate` passes.
 
-For executable or purchasable capability mirrors, prefer the lifecycle helpers under `mdkg work ...`. They create and update `WORK.md`, `WORK_ORDER.md`, and `RECEIPT.md` semantic mirror files only. `mdkg work trigger` creates a deterministic submitted `WORK_ORDER.md` from a WORK contract or a MANIFEST with exactly one resolvable work contract; legacy SPEC refs remain supported during the compatibility bridge. `mdkg work order status` and `mdkg work receipt verify` are read-only review helpers for deterministic closeout. `mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] --json` is a read-only focused validator for agent workflow mirrors; it returns typed diagnostics and warns on obvious raw secret, prompt, token, or payload markers. `mdkg work trigger --enqueue <queue>` optionally writes a local project DB queue delivery message after the queue has been explicitly created and is active; it still does not execute work. Production order state, receipt state, feedback, disputes, payments, ledgers, marketplace inventory, fulfillment records, and execution state remain canonical outside mdkg, such as in Postgres or another application database. Do not store raw secrets, credentials, live payment state, ledger mutations, canonical marketplace state, or bulky raw payloads in these mirrors.
+For executable or purchasable capability mirrors, prefer the lifecycle helpers under `mdkg work ...`. They create and update `WORK.md`, `WORK_ORDER.md`, and `RECEIPT.md` semantic mirror files only. `mdkg work trigger` creates a deterministic submitted `WORK_ORDER.md` from a WORK contract or a MANIFEST with exactly one resolvable work contract; legacy SPEC refs remain supported during the compatibility bridge. `mdkg work order status` and `mdkg work receipt verify` are read-only review helpers for deterministic closeout. `mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] [--profile omni-room] --json` is a read-only focused validator for agent workflow mirrors; it returns typed diagnostics and warns on obvious raw secret, prompt, token, or payload markers. `mdkg validate --profile omni-room` and `mdkg work validate --profile omni-room` apply explicit profile checks after generic validation.
+
+Optional contract-profile fields are generic semantic mirrors, not runtime execution state. `contract_profile` is accepted on MANIFEST, WORK, WORK_ORDER, and RECEIPT surfaces; `validation_policy_ref` and `evidence_policy_ref` are accepted on MANIFEST, WORK_ORDER, and RECEIPT; `receipt_kind` and `redaction_class` are RECEIPT-only. These fields are separate from MANIFEST `resource_profile`, WORK `kind`, WORK_ORDER `artifact_policy`, RECEIPT `redaction_policy`, and pack/bundle `--profile` flags. Generic validation accepts well-shaped custom profile, kind, and class values with warnings; explicit `--profile omni-room` validation escalates unknown or incompatible values. Bare `profile` is intentionally ambiguous and is diagnosed rather than treated as an alias.
+
+`mdkg work trigger --enqueue <queue>` optionally writes a local project DB queue delivery message after the queue has been explicitly created and is active; it still does not execute work. Production order state, receipt state, feedback, disputes, payments, ledgers, marketplace inventory, fulfillment records, and execution state remain canonical outside mdkg, such as in Postgres or another application database. Omni Room and other downstream runtimes own runtime policy, queue execution, final receipt normalization, and downstream adoption. Do not store raw secrets, credentials, live payment state, ledger mutations, canonical marketplace state, or bulky raw payloads in these mirrors.
 
 ## Archive sidecars
 

package/dist/cli.js

@@ -160,6 +160,11 @@ function printNewHelp(log) {
     log("  --skills <slug,slug,...>   Skill slugs for work items");
     log("  --template <set>           Template set");
     log("  --run-id <id>              Optional event run id when event logging is enabled");
+    log("  --contract-profile <name>  Optional MANIFEST/WORK/WORK_ORDER/RECEIPT validation profile metadata");
+    log("  --validation-policy-ref <ref> Optional MANIFEST/WORK_ORDER/RECEIPT validation policy ref");
+    log("  --evidence-policy-ref <ref> Optional MANIFEST/WORK_ORDER/RECEIPT evidence policy ref");
+    log("  --receipt-kind <kind>      Optional RECEIPT kind metadata");
+    log("  --redaction-class <class>  Optional RECEIPT redaction class metadata");
     log("\nAdvanced metadata flags:");
     log("  --parent --prev --next --relates --blocked-by --blocks");
     log("  --links --artifacts --refs --aliases --owners --cases --supersedes");
@@ -733,7 +738,7 @@ function printWorkHelp(log, subcommand) {
     switch ((subcommand ?? "").toLowerCase()) {
         case "contract":
             log("Usage:");
-            log('  mdkg work contract new "<title>" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]');
+            log('  mdkg work contract new "<title>" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]');
             break;
         case "trigger":
             log("Usage:");
@@ -747,7 +752,7 @@ function printWorkHelp(log, subcommand) {
             break;
         case "order":
             log("Usage:");
-            log('  mdkg work order new "<title>" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]');
+            log('  mdkg work order new "<title>" --id <order.id> --work-id <work.id> --requester <ref> [--contract-profile <name>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]');
             log("  mdkg work order status <id-or-qid> [--json]");
             log("  mdkg work order update <id-or-qid> [--status <status>] [--add-input-refs <...>] [--add-queue-refs <...>] [--add-artifacts <...>] [--json]");
             log("\nNotes:");
@@ -755,7 +760,7 @@ function printWorkHelp(log, subcommand) {
             break;
         case "receipt":
             log("Usage:");
-            log('  mdkg work receipt new "<title>" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--evidence-hashes <sha256:...>] [--json]');
+            log('  mdkg work receipt new "<title>" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--contract-profile <name>] [--receipt-kind <kind>] [--redaction-class <class>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--evidence-hashes <sha256:...>] [--json]');
             log("  mdkg work receipt verify <id-or-qid> [--json]");
             log("  mdkg work receipt update <id-or-qid> [--receipt-status <status>] [--add-artifacts <...>] [--add-proof-refs <...>] [--add-attestation-refs <...>] [--add-evidence-hashes <sha256:...>] [--json]");
             log("\nNotes:");
@@ -767,10 +772,11 @@ function printWorkHelp(log, subcommand) {
             break;
         case "validate":
             log("Usage:");
-            log("  mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] [--json]");
+            log("  mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] [--profile <name>] [--json]");
             log("\nNotes:");
             log("  Read-only focused validation for agent workflow mirrors.");
             log("  Reports typed diagnostics for MANIFEST.md, legacy SPEC.md, WORK.md, WORK_ORDER.md, RECEIPT.md, FEEDBACK.md, DISPUTE.md, and PROPOSAL.md files.");
+            log("  --profile omni-room applies explicit contract-profile validation after generic mirror validation; this is separate from mdkg pack --profile.");
             log("  Obvious raw secret, prompt, token, or payload markers are warnings so humans and agents can review boundaries.");
             break;
         default:
@@ -780,7 +786,7 @@ function printWorkHelp(log, subcommand) {
             log("  mdkg work order new|status|update ...");
             log("  mdkg work receipt new|verify|update ...");
             log("  mdkg work artifact add ...");
-            log("  mdkg work validate [<id-or-qid>] [--type <workflow-type>] [--json]");
+            log("  mdkg work validate [<id-or-qid>] [--type <workflow-type>] [--profile <name>] [--json]");
             log("\nNotes:");
             log("  - work commands mutate semantic mirror files only");
             log("  - work validate is read-only and reports typed workflow diagnostics");
@@ -972,10 +978,11 @@ function printCheckpointHelp(log) {
 }
 function printValidateHelp(log) {
     log("Usage:");
-    log("  mdkg validate [--out <path>] [--json-out <path>] [--quiet] [--changed-only] [--summary] [--limit <n>] [--json]");
+    log("  mdkg validate [--out <path>] [--json-out <path>] [--quiet] [--changed-only] [--summary] [--limit <n>] [--profile <name>] [--json]");
     log("\nNotes:");
     log("  Validates frontmatter schemas, graph references, visibility, skills, and events.");
     log("  --changed-only filters warning presentation to changed .mdkg files while full graph errors still run.");
+    log("  --profile omni-room applies explicit contract-profile validation after generic validation; this is separate from mdkg pack --profile.");
     log("  JSON output includes warning_summary plus warning_diagnostics with warning ids, categories, severity, paths, refs, and remediation text.");
     log("  --summary emits bounded warning samples for agent/CI logs; --limit controls the sample size.");
     log("  --out writes the compatibility text report; --json-out writes a clean full JSON receipt.");
@@ -2063,7 +2070,8 @@ function runWorkSubcommand(parsed, root) {
             throw new errors_1.UsageError("work validate accepts at most one workflow reference");
         }
         const type = requireFlagValue("--type", parsed.flags["--type"]);
-        (0, work_1.runWorkValidateCommand)({ root, ws, id, type, json });
+        const profile = requireFlagValue("--profile", parsed.flags["--pack-profile"]);
+        (0, work_1.runWorkValidateCommand)({ root, ws, id, type, profile, json });
         return 0;
     }
     if (domain === "contract" && action === "new") {
@@ -2078,6 +2086,7 @@ function runWorkSubcommand(parsed, root) {
         }
         const requiredCapabilities = requireFlagValue("--required-capabilities", parsed.flags["--required-capabilities"]);
         const pricingModel = requireFlagValue("--pricing-model", parsed.flags["--pricing-model"]);
+        const contractProfile = requireFlagValue("--contract-profile", parsed.flags["--contract-profile"]);
         (0, work_1.runWorkContractNewCommand)({
             root,
             ws,
@@ -2089,6 +2098,7 @@ function runWorkSubcommand(parsed, root) {
             outputs,
             requiredCapabilities,
             pricingModel,
+            contractProfile,
             json,
         });
         return 0;
@@ -2108,6 +2118,9 @@ function runWorkSubcommand(parsed, root) {
         const queueRefs = requireFlagValue("--queue-refs", parsed.flags["--queue-refs"]);
         const requestedOutputs = requireFlagValue("--requested-outputs", parsed.flags["--requested-outputs"]);
         const constraintRefs = requireFlagValue("--constraint-refs", parsed.flags["--constraint-refs"]);
+        const contractProfile = requireFlagValue("--contract-profile", parsed.flags["--contract-profile"]);
+        const validationPolicyRef = requireFlagValue("--validation-policy-ref", parsed.flags["--validation-policy-ref"]);
+        const evidencePolicyRef = requireFlagValue("--evidence-policy-ref", parsed.flags["--evidence-policy-ref"]);
         (0, work_1.runWorkOrderNewCommand)({
             root,
             ws,
@@ -2122,6 +2135,9 @@ function runWorkSubcommand(parsed, root) {
             queueRefs,
             requestedOutputs,
             constraintRefs,
+            contractProfile,
+            validationPolicyRef,
+            evidencePolicyRef,
             json,
         });
         return 0;
@@ -2163,6 +2179,11 @@ function runWorkSubcommand(parsed, root) {
         const evidenceHashes = requireFlagValue("--evidence-hashes", parsed.flags["--evidence-hashes"]);
         const inputHashes = requireFlagValue("--input-hashes", parsed.flags["--input-hashes"]);
         const outputHashes = requireFlagValue("--output-hashes", parsed.flags["--output-hashes"]);
+        const contractProfile = requireFlagValue("--contract-profile", parsed.flags["--contract-profile"]);
+        const receiptKind = requireFlagValue("--receipt-kind", parsed.flags["--receipt-kind"]);
+        const redactionClass = requireFlagValue("--redaction-class", parsed.flags["--redaction-class"]);
+        const validationPolicyRef = requireFlagValue("--validation-policy-ref", parsed.flags["--validation-policy-ref"]);
+        const evidencePolicyRef = requireFlagValue("--evidence-policy-ref", parsed.flags["--evidence-policy-ref"]);
         (0, work_1.runWorkReceiptNewCommand)({
             root,
             ws,
@@ -2173,6 +2194,11 @@ function runWorkSubcommand(parsed, root) {
             receiptStatus,
             costRef,
             redactionPolicy,
+            contractProfile,
+            receiptKind,
+            redactionClass,
+            validationPolicyRef,
+            evidencePolicyRef,
             artifacts,
             proofRefs,
             attestationRefs,
@@ -2657,6 +2683,11 @@ function runCommand(parsed, root, runtime) {
             const owners = requireFlagValue("--owners", parsed.flags["--owners"]);
             const supersedes = requireFlagValue("--supersedes", parsed.flags["--supersedes"]);
             const template = requireFlagValue("--template", parsed.flags["--template"]);
+            const contractProfile = requireFlagValue("--contract-profile", parsed.flags["--contract-profile"]);
+            const validationPolicyRef = requireFlagValue("--validation-policy-ref", parsed.flags["--validation-policy-ref"]);
+            const evidencePolicyRef = requireFlagValue("--evidence-policy-ref", parsed.flags["--evidence-policy-ref"]);
+            const receiptKind = requireFlagValue("--receipt-kind", parsed.flags["--receipt-kind"]);
+            const redactionClass = requireFlagValue("--redaction-class", parsed.flags["--redaction-class"]);
             const noCache = parseBooleanFlag("--no-cache", parsed.flags["--no-cache"]);
             const noReindex = parseBooleanFlag("--no-reindex", parsed.flags["--no-reindex"]);
             const runId = requireFlagValue("--run-id", parsed.flags["--run-id"]);
@@ -2686,6 +2717,11 @@ function runCommand(parsed, root, runtime) {
                 owners,
                 supersedes,
                 template,
+                contractProfile,
+                validationPolicyRef,
+                evidencePolicyRef,
+                receiptKind,
+                redactionClass,
                 noCache,
                 noReindex,
                 runId,
@@ -2951,8 +2987,9 @@ function runCommand(parsed, root, runtime) {
             const changedOnly = parseBooleanFlag("--changed-only", parsed.flags["--changed-only"]);
             const summary = parseBooleanFlag("--summary", parsed.flags["--summary"]);
             const limit = parseNumberFlag("--limit", parsed.flags["--limit"]);
+            const profile = requireFlagValue("--profile", parsed.flags["--pack-profile"]);
             const json = parseBooleanFlag("--json", parsed.flags["--json"]);
-            (0, validate_1.runValidateCommand)({ root, out, jsonOut, quiet, json, changedOnly, summary, limit });
+            (0, validate_1.runValidateCommand)({ root, out, jsonOut, quiet, json, changedOnly, summary, limit, profile });
             return 0;
         }
         case "status": {

package/dist/command-contract.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "tool": "mdkg",
-  "package_version": "0.4.0",
+  "package_version": "0.4.1",
   "source": {
     "help_targets": "scripts/cli_help_targets.js",
     "command_matrix": "CLI_COMMAND_MATRIX.md"
@@ -5230,12 +5230,24 @@
           "required": false,
           "description": "--parent --prev --next --relates --blocked-by --blocks"
         },
+        {
+          "name": "--contract-profile",
+          "value": "<name>",
+          "required": false,
+          "description": "--contract-profile <name>  Optional MANIFEST/WORK/WORK_ORDER/RECEIPT validation profile metadata"
+        },
         {
           "name": "--epic",
           "value": "<id>",
           "required": false,
           "description": "--epic <id>                Epic id"
         },
+        {
+          "name": "--evidence-policy-ref",
+          "value": "<ref>",
+          "required": false,
+          "description": "--evidence-policy-ref <ref> Optional MANIFEST/WORK_ORDER/RECEIPT evidence policy ref"
+        },
         {
           "name": "--help",
           "value": null,
@@ -5278,6 +5290,18 @@
           "required": false,
           "description": "--priority <0..9>          Work item priority"
         },
+        {
+          "name": "--receipt-kind",
+          "value": "<kind>",
+          "required": false,
+          "description": "--receipt-kind <kind>      Optional RECEIPT kind metadata"
+        },
+        {
+          "name": "--redaction-class",
+          "value": "<class>",
+          "required": false,
+          "description": "--redaction-class <class>  Optional RECEIPT redaction class metadata"
+        },
         {
           "name": "--refs",
           "value": null,
@@ -5326,6 +5350,12 @@
           "required": false,
           "description": "--template <set>           Template set"
         },
+        {
+          "name": "--validation-policy-ref",
+          "value": "<ref>",
+          "required": false,
+          "description": "--validation-policy-ref <ref> Optional MANIFEST/WORK_ORDER/RECEIPT validation policy ref"
+        },
         {
           "name": "--version",
           "value": null,
@@ -8242,7 +8272,7 @@
       "visibility": "public",
       "summary": "mdkg validate command",
       "usage": [
-        "  mdkg validate [--out <path>] [--json-out <path>] [--quiet] [--changed-only] [--summary] [--limit <n>] [--json]"
+        "  mdkg validate [--out <path>] [--json-out <path>] [--quiet] [--changed-only] [--summary] [--limit <n>] [--profile <name>] [--json]"
       ],
       "args": [],
       "flags": [
@@ -8276,6 +8306,12 @@
           "required": false,
           "description": "--out writes the compatibility text report; --json-out writes a clean full JSON receipt."
         },
+        {
+          "name": "--profile",
+          "value": "omni-room",
+          "required": false,
+          "description": "--profile omni-room applies explicit contract-profile validation after generic validation; this is separate from mdkg pack --profile."
+        },
         {
           "name": "--root",
           "value": null,
@@ -8326,7 +8362,7 @@
         }
       ],
       "examples": [
-        "  mdkg validate [--out <path>] [--json-out <path>] [--quiet] [--changed-only] [--summary] [--limit <n>] [--json]"
+        "  mdkg validate [--out <path>] [--json-out <path>] [--quiet] [--changed-only] [--summary] [--limit <n>] [--profile <name>] [--json]"
       ],
       "docs": {
         "help_target": "mdkg help validate",
@@ -8348,7 +8384,7 @@
         "  mdkg work order new|status|update ...",
         "  mdkg work receipt new|verify|update ...",
         "  mdkg work artifact add ...",
-        "  mdkg work validate [<id-or-qid>] [--type <workflow-type>] [--json]"
+        "  mdkg work validate [<id-or-qid>] [--type <workflow-type>] [--profile <name>] [--json]"
       ],
       "args": [
         {
@@ -8528,7 +8564,7 @@
       "visibility": "public",
       "summary": "mdkg work contract command",
       "usage": [
-        "  mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+        "  mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
       ],
       "args": [
         {
@@ -8542,7 +8578,7 @@
           "name": "--agent-id",
           "value": "<agent.id>",
           "required": false,
-          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
         },
         {
           "name": "--help",
@@ -8554,25 +8590,25 @@
           "name": "--id",
           "value": "<work.id>",
           "required": false,
-          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
         },
         {
           "name": "--inputs",
           "value": "<...>",
           "required": false,
-          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
         },
         {
           "name": "--kind",
           "value": "<kind>",
           "required": false,
-          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
         },
         {
           "name": "--outputs",
           "value": "<...>",
           "required": false,
-          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+          "description": "mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
         },
         {
           "name": "--root",
@@ -8623,7 +8659,7 @@
         }
       ],
       "examples": [
-        "  mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--required-capabilities <...>] [--pricing-model <...>] [--json]"
+        "  mdkg work contract new \"<title>\" --id <work.id> --agent-id <agent.id> --kind <kind> --inputs <...> --outputs <...> [--contract-profile <name>] [--required-capabilities <...>] [--pricing-model <...>] [--json]"
       ],
       "docs": {
         "help_target": "mdkg help work contract",
@@ -8641,7 +8677,7 @@
       "visibility": "public",
       "summary": "mdkg work order command",
       "usage": [
-        "  mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]",
+        "  mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--contract-profile <name>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]",
         "  mdkg work order status <id-or-qid> [--json]",
         "  mdkg work order update <id-or-qid> [--status <status>] [--add-input-refs <...>] [--add-queue-refs <...>] [--add-artifacts <...>] [--json]"
       ],
@@ -8668,13 +8704,13 @@
           "name": "--id",
           "value": "<order.id>",
           "required": false,
-          "description": "mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]"
+          "description": "mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--contract-profile <name>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]"
         },
         {
           "name": "--requester",
           "value": "<ref>",
           "required": false,
-          "description": "mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]"
+          "description": "mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--contract-profile <name>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]"
         },
         {
           "name": "--root",
@@ -8692,7 +8728,7 @@
           "name": "--work-id",
           "value": "<work.id>",
           "required": false,
-          "description": "mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]"
+          "description": "mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--contract-profile <name>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]"
         }
       ],
       "output_formats": [
@@ -8726,7 +8762,7 @@
         }
       ],
       "examples": [
-        "  mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]",
+        "  mdkg work order new \"<title>\" --id <order.id> --work-id <work.id> --requester <ref> [--contract-profile <name>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--request-ref <ref>] [--trigger-ref <ref>] [--payload-hash <sha256:...>] [--input-refs <...>] [--queue-refs <...>] [--requested-outputs <...>] [--json]",
         "  mdkg work order status <id-or-qid> [--json]",
         "  mdkg work order update <id-or-qid> [--status <status>] [--add-input-refs <...>] [--add-queue-refs <...>] [--add-artifacts <...>] [--json]"
       ],
@@ -8746,7 +8782,7 @@
       "visibility": "public",
       "summary": "mdkg work receipt command",
       "usage": [
-        "  mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--evidence-hashes <sha256:...>] [--json]",
+        "  mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--contract-profile <name>] [--receipt-kind <kind>] [--redaction-class <class>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--evidence-hashes <sha256:...>] [--json]",
         "  mdkg work receipt verify <id-or-qid> [--json]",
         "  mdkg work receipt update <id-or-qid> [--receipt-status <status>] [--add-artifacts <...>] [--add-proof-refs <...>] [--add-attestation-refs <...>] [--add-evidence-hashes <sha256:...>] [--json]"
       ],
@@ -8773,13 +8809,13 @@
           "name": "--id",
           "value": "<receipt.id>",
           "required": false,
-          "description": "mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--evidence-hashes <sha256:...>] [--json]"
+          "description": "mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--contract-profile <name>] [--receipt-kind <kind>] [--redaction-class <class>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--evidence-hashes <sha256:...>] [--json]"
         },
         {
           "name": "--outcome",
           "value": "success|partial|failure",
           "required": false,
-          "description": "mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--evidence-hashes <sha256:...>] [--json]"
+          "description": "mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--contract-profile <name>] [--receipt-kind <kind>] [--redaction-class <class>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--evidence-hashes <sha256:...>] [--json]"
         },
         {
           "name": "--root",
@@ -8797,7 +8833,7 @@
           "name": "--work-order-id",
           "value": "<order.id>",
           "required": false,
-          "description": "mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--evidence-hashes <sha256:...>] [--json]"
+          "description": "mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--contract-profile <name>] [--receipt-kind <kind>] [--redaction-class <class>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--evidence-hashes <sha256:...>] [--json]"
         }
       ],
       "output_formats": [
@@ -8837,7 +8873,7 @@
         }
       ],
       "examples": [
-        "  mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--evidence-hashes <sha256:...>] [--json]",
+        "  mdkg work receipt new \"<title>\" --id <receipt.id> --work-order-id <order.id> --outcome success|partial|failure [--receipt-status recorded|verified|rejected|superseded] [--redaction-policy refs_and_hashes_only|redacted_summary|external_private] [--contract-profile <name>] [--receipt-kind <kind>] [--redaction-class <class>] [--validation-policy-ref <ref>] [--evidence-policy-ref <ref>] [--evidence-hashes <sha256:...>] [--json]",
         "  mdkg work receipt update <id-or-qid> [--receipt-status <status>] [--add-artifacts <...>] [--add-proof-refs <...>] [--add-attestation-refs <...>] [--add-evidence-hashes <sha256:...>] [--json]",
         "  mdkg work receipt verify <id-or-qid> [--json]"
       ],
@@ -8964,7 +9000,7 @@
       "visibility": "public",
       "summary": "mdkg work validate command",
       "usage": [
-        "  mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] [--json]"
+        "  mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] [--profile <name>] [--json]"
       ],
       "args": [
         {
@@ -8980,6 +9016,12 @@
           "required": false,
           "description": "--help, -h          Show help"
         },
+        {
+          "name": "--profile",
+          "value": "omni-room",
+          "required": false,
+          "description": "--profile omni-room applies explicit contract-profile validation after generic mirror validation; this is separate from mdkg pack --profile."
+        },
         {
           "name": "--root",
           "value": null,
@@ -9026,7 +9068,7 @@
         }
       ],
       "examples": [
-        "  mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] [--json]"
+        "  mdkg work validate [<id-or-qid>] [--type manifest|spec|work|work_order|receipt|feedback|dispute|proposal] [--profile <name>] [--json]"
       ],
       "docs": {
         "help_target": "mdkg help work validate",
@@ -9128,5 +9170,5 @@
       }
     }
   ],
-  "contract_hash": "35018c8d8e9827545d061882bc55ea42d3bdbfff1224ab6414aa8e53a443e4a0"
+  "contract_hash": "65408d40dd065dfadcaa9bfe3626df5703dce2fe08ce1dd500e371899a8c4f7a"
 }