onto-mcp 0.4.11 → 0.4.13

package/dist/core-runtime/onboard/register.js

@@ -1,5 +1,6 @@
 import { ALL_HOST_IDS, } from "./types.js";
 import { getDefaultHostTargets } from "./host-target.js";
+import { discoverClaudeProfiles } from "./claude-profile-scan.js";
 import { promptMultiSelect, promptYesNo } from "./prompt.js";
 const USAGE = [
     "Usage: onto register [options]",
@@ -20,6 +21,9 @@ const USAGE = [
     "  --command <cmd>    Executable the host launches (default: onto)",
     "  --claude-config-dir <path>  Target a Claude Code profile (sets",
     "                     CLAUDE_CONFIG_DIR; default: ambient env or ~/.claude)",
+    "  --all-claude-profiles  Auto-discover every Claude Code config dir under",
+    "                     home (~/.claude and ~/.claude-*) and register each",
+    "                     (mutually exclusive with --claude-config-dir)",
     "  --help, -h         Show this help",
 ].join("\n");
 export function parseRegisterArgs(argv) {
@@ -33,6 +37,7 @@ export function parseRegisterArgs(argv) {
         name: "onto",
         command: "onto",
         claudeConfigDir: undefined,
+        allClaudeProfiles: false,
         unknownFlags: [],
         invalidHosts: [],
     };
@@ -82,6 +87,9 @@ export function parseRegisterArgs(argv) {
             case "--claude-config-dir":
                 parsed.claudeConfigDir = argv[++i] ?? parsed.claudeConfigDir;
                 break;
+            case "--all-claude-profiles":
+                parsed.allClaudeProfiles = true;
+                break;
             default:
                 parsed.unknownFlags.push(arg);
                 break;
@@ -89,12 +97,20 @@ export function parseRegisterArgs(argv) {
     }
     return parsed;
 }
-function resolveSelection(parsed, targets) {
+/** Unique selection identity for a target (host *instance*, not just kind). */
+function targetKey(target) {
+    return target.key ?? target.id;
+}
+/**
+ * Flag-driven selection by host *kind* (`id`). `--hosts claude-code` therefore
+ * selects every Claude Code profile target when several are expanded.
+ */
+function resolveSelectedTargets(parsed, targets) {
     if (parsed.hosts === "all")
-        return targets.map((t) => t.id);
+        return targets;
     if (Array.isArray(parsed.hosts)) {
         const requested = new Set(parsed.hosts);
-        return targets.map((t) => t.id).filter((id) => requested.has(id));
+        return targets.filter((t) => requested.has(t.id));
     }
     return [];
 }
@@ -123,6 +139,29 @@ function printResults(results) {
         console.log(`  • ${result.displayName}: ${result.outcome} — ${result.detail}`);
     }
 }
+/**
+ * Build the default host targets honoring profile flags. When
+ * `--all-claude-profiles` is set, discover every Claude Code config dir under
+ * home and expand Claude Code into one target per profile; if none are found,
+ * fall back to the single default target with a note.
+ */
+function buildDefaultTargets(parsed, deps) {
+    if (parsed.allClaudeProfiles) {
+        const discover = deps.discoverClaudeProfiles ??
+            (() => {
+                const env = process.env.CLAUDE_CONFIG_DIR;
+                return discoverClaudeProfiles(env ? { configDirEnv: env } : {});
+            });
+        const profiles = discover();
+        if (profiles.length > 0) {
+            return getDefaultHostTargets({ claudeProfiles: profiles });
+        }
+        console.error("[onto register] --all-claude-profiles: no Claude Code config dirs found " +
+            "under home; falling back to the default profile.");
+        return getDefaultHostTargets({});
+    }
+    return getDefaultHostTargets(parsed.claudeConfigDir ? { claudeConfigDir: parsed.claudeConfigDir } : {});
+}
 export async function runRegister(argv, deps = {}) {
     const parsed = parseRegisterArgs(argv);
     if (parsed.help) {
@@ -139,8 +178,12 @@ export async function runRegister(argv, deps = {}) {
             `Valid: ${ALL_HOST_IDS.join(", ")}`);
         return 1;
     }
-    const targets = deps.targets ??
-        getDefaultHostTargets(parsed.claudeConfigDir ? { claudeConfigDir: parsed.claudeConfigDir } : {});
+    if (parsed.allClaudeProfiles && parsed.claudeConfigDir) {
+        console.error("[onto register] Use either --all-claude-profiles or --claude-config-dir, " +
+            "not both.");
+        return 1;
+    }
+    const targets = deps.targets ?? buildDefaultTargets(parsed, deps);
     const isTty = deps.isTty ?? Boolean(process.stdin.isTTY);
     if (parsed.list) {
         console.log("Host detection:");
@@ -155,7 +198,7 @@ export async function runRegister(argv, deps = {}) {
         args: ["mcp"],
     };
     // Determine which hosts to register.
-    let selected = resolveSelection(parsed, targets);
+    let selectedTargets = resolveSelectedTargets(parsed, targets);
     const selectionGivenByFlag = parsed.hosts !== undefined;
     if (!selectionGivenByFlag) {
         if (!isTty) {
@@ -163,19 +206,18 @@ export async function runRegister(argv, deps = {}) {
                 "(interactive selection requires a terminal).");
             return 1;
         }
-        const defaults = targets.filter((t) => t.detect() !== "absent").map((t) => t.id);
+        const defaults = targets.filter((t) => t.detect() !== "absent").map(targetKey);
         const chosen = await promptMultiSelect("Select hosts to register onto with:", targets.map((t) => ({
-            id: t.id,
+            id: targetKey(t),
             label: t.displayName,
             detail: detectionLabel(t.detect()),
-        })), defaults.length > 0 ? defaults : targets.map((t) => t.id));
-        selected = targets.map((t) => t.id).filter((id) => chosen.includes(id));
+        })), defaults.length > 0 ? defaults : targets.map(targetKey));
+        selectedTargets = targets.filter((t) => chosen.includes(targetKey(t)));
     }
-    if (selected.length === 0) {
+    if (selectedTargets.length === 0) {
         console.error("[onto register] No hosts selected. Nothing to do.");
         return 1;
     }
-    const selectedTargets = targets.filter((t) => selected.includes(t.id));
     const options = { force: parsed.force, dryRun: parsed.dryRun };
     const plans = selectedTargets.map((t) => t.plan(entry, options));
     printPlans(plans);

package/dist/core-runtime/pipeline-execution-ledger.js

@@ -41,6 +41,16 @@ export function isTrustedLedgerUnit(unit) {
         unit.trustStatus === "trusted" &&
         hasAllRequiredOutputHashes(unit));
 }
+/**
+ * Trusted output OR terminally resolved (demoted complete-with-failure):
+ * either way the unit owes no further dispatch. Frontier and convergence
+ * consumers use this predicate; artifact-preservation consumers keep using
+ * {@link isTrustedLedgerUnit} — a resolved unit has no trusted output to
+ * preserve or to consume downstream.
+ */
+export function isResolvedLedgerUnit(unit) {
+    return unit.resolution === "demoted" || isTrustedLedgerUnit(unit);
+}
 export function firstUntrustedRequiredUnit(ledger) {
     return ledger.units.find((unit) => !isTrustedLedgerUnit(unit)) ?? null;
 }

package/dist/core-runtime/reconstruct/artifact-types.js

@@ -29,6 +29,16 @@ export const RECONSTRUCT_STAGE_IDS = [
     "source_observation_reentry_validation",
     "source_observation_lineage_index",
     "source_observation_lineage_index_validation",
+    // P1-C2 leaf-read: the first LLM-touch (capture over structure-incomplete spreadsheet regions).
+    // Owns its own telemetry unit so a leaf-read total-failure is recorded, not silently degraded
+    // (the defect this stage id fixes: "leaf-read" had no telemetry unit → callLlmRecorded threw
+    // before the LLM call → R9 swallowed it → zero capture, forever). Runs after the lineage index
+    // exists and before purpose-candidate authoring.
+    "leaf_read",
+    // Layer-2 semantic_map stage (wiring design 20260702 §7-W3): default-off; runs right after
+    // leaf_read; its always-written census is the step's artifact ref (skipped when the author lacks
+    // the synthesizeSemanticMapNode/verifySemanticMapBoundary capability pair).
+    "semantic_map",
     "source_purpose_candidates",
     "source_purpose_candidates_validation",
     "purpose_confirmation",
@@ -39,6 +49,7 @@ export const RECONSTRUCT_STAGE_IDS = [
     "candidate_disposition_validation",
     "seed_authoring_readiness",
     "seed_authoring_readiness_validation",
+    "seed_stage_prompt_source_observations",
     "ontology_seed",
     "ontology_seed_validation",
     "material_admission_validation",
@@ -62,6 +73,14 @@ export const RECONSTRUCT_STAGE_IDS = [
     "maturation_baseline_validation",
     "baseline_actionability_matrix",
     "baseline_actionability_matrix_validation",
+    // Maturation value-read cut: the LLM-touch stage that reads authorized runtime-target
+    // cell values to discharge value-dependent limitations on baseline matrix rows. A single
+    // stage id (leaf_read precedent) — discharge validation is an embedded self-validation
+    // step, so terminal run-manifest validation needs exactly one matching manifest step
+    // (design §13.5 F3). Runs after the baseline matrix is produced and before the question
+    // frontier, so its value-grounded discharge reaches the actionability matrix directly
+    // without waking the empty frontier path.
+    "maturation_value_read",
     "maturation_question_frontier",
     "maturation_question_frontier_validation",
     "maturation_closure_frontier",
@@ -70,6 +89,8 @@ export const RECONSTRUCT_STAGE_IDS = [
     "maturation_authority_response_validation",
     "answer_support_ledger",
     "answer_support_ledger_validation",
+    "answer_support_judgment",
+    "answer_support_judgment_validation",
     "maturation_answer_claims",
     "maturation_answer_claims_validation",
     "ontology_expansion",
@@ -98,3 +119,19 @@ export const RECONSTRUCT_STAGE_IDS = [
     "record_assembly",
     "post_publication_run_manifest_validation",
 ];
+/**
+ * The conditional stages that can legitimately run-but-produce-nothing yet leave no
+ * artifact-ref witness of their own (unlike leaf_read / maturation_value_read, which always
+ * write a census when they run). Canonical single source shared by the graceful-terminal
+ * manifest builder (createRunManifest) and the reachability validator (validateReconstructRunManifest):
+ * on a graceful-terminal manifest these are the only stages permitted `skip_kind:
+ * "legit_conditional"`, and only when the reachability witness (ReconstructSourceObservationLineageCensus)
+ * confirms they ran and legitimately produced nothing. See reachability-manifest design v2 §2–§4.
+ */
+export const WITNESS_LESS_CONDITIONAL_STAGE_IDS = [
+    "source_observation_delta",
+    "source_observation_delta_validation",
+    "source_observation_reentry_validation",
+    "source_observation_lineage_index",
+    "source_observation_lineage_index_validation",
+];

package/dist/core-runtime/reconstruct/benchmark-evidence.js

@@ -20,6 +20,22 @@ export const BENCHMARK_DECISION_GRADE_STATUS = "decision-grade";
 export function requestedEffortForRealization(realization, effort) {
     return realization === "live" ? (effort ?? null) : null;
 }
+/**
+ * Realization-scoped record of the opt-in answer-support judge override that
+ * was REQUESTED for a benchmark run (symmetric to {@link
+ * requestedEffortForRealization}). Live-only — the mock route never applies the
+ * override — and null when neither lever was requested, so a record always
+ * self-describes whether a judge override was in play (reproducibility). The
+ * REALIZED judge model/effort remains recoverable from the answer_support_judgment
+ * unit telemetry; this captures the operator's intent.
+ */
+export function requestedJudgeOverrideForRealization(realization, judgeEffort, judgeModel) {
+    if (realization !== "live")
+        return null;
+    if (!judgeEffort && !judgeModel)
+        return null;
+    return { effort: judgeEffort ?? null, model: judgeModel ?? null };
+}
 export function gradeBenchmarkEvidence(input) {
     const performanceEvidenceMet = input.repetitions >= 3 &&
         input.fixtureCount >= 2 &&

package/dist/core-runtime/reconstruct/claim-projection-validation.js

@@ -1,6 +1,8 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { parse as parseYaml } from "yaml";
+import { atomicWriteYamlDocument as writeYamlDocument } from "../artifact-io.js";
+import { assertObligation } from "./obligation-assertion.js";
 const PROJECTION_SURFACES = [
     "status",
     "result",
@@ -49,10 +51,6 @@ function isoNow() {
 async function readYamlDocument(filePath) {
     return parseYaml(await fs.readFile(filePath, "utf8"));
 }
-async function writeYamlDocument(filePath, value) {
-    await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, stringifyYaml(value), "utf8");
-}
 function statusOf(validation) {
     return validation?.validation_status ?? "not_available";
 }
@@ -392,6 +390,21 @@ function sameJson(left, right) {
 }
 export function validateClaimProjection(args) {
     const violations = [];
+    // G(a) slice 23 — record the obligations this validator FULLY enforces with a complete unconditional
+    // check (RECORD 2/9). claim-projection's other unconditional checks are only PARTIAL — its strong
+    // enforcement is the gated `expectedClaimProjection` derived-match — so 7 stay parked (see obligation-
+    // coverage-ledger.yaml notes): governance-bounding is PARTIAL (rollback_quota_incident_governance
+    // unchecked); two material-kind-support lineage obligations are GATED on optional targetMaterialProfile
+    // +validation args (slice-18/22); and codex R1 parked four more as partial — blocked-recovery keys only
+    // on claim_level==blocked (misses material_kind_support machine_status==blocked), cite-validation-refs
+    // is presence-only without the optional expectedRequiredValidationRefs, surfaces-present is presence-only
+    // (contract design ~1172 wants ONE row per surface), and claim/decision/actionability alignment is
+    // one-directional (a continue+ready row passes). The two RECORDED checks fully enforce their named scope
+    // whenever a material_kind_support row is present (the required surface). Stamped before any per-row
+    // guard so the recorder fires on zero-row input.
+    const assertedObligationIds = [];
+    assertObligation(assertedObligationIds, "reject_unwired_material_kind_support_levels_above_profile_supported");
+    assertObligation(assertedObligationIds, "validate_material_kind_support_row_uses_capability_claim_not_actionability_claim");
     const seenIds = new Set();
     const surfaces = new Set();
     const decisionStateCounts = Object.fromEntries(DECISION_STATES.map((state) => [state, 0]));
@@ -728,6 +741,7 @@ export function validateClaimProjection(args) {
         validation_results: violations.length === 0
             ? ["claim_projection_valid"]
             : ["claim_projection_invalid"],
+        asserted_obligation_ids: assertedObligationIds,
         violations,
     };
 }

package/dist/core-runtime/reconstruct/competency-projection-contract.js

@@ -0,0 +1,63 @@
+/**
+ * Single source of truth for the competency-question assessment prompt-projection
+ * contract: the field set + budget constants that define the host-LLM assessment
+ * prompt surface. The reconstruct runtime (run.ts) imports the contract fn + budgets
+ * from here, and the G(b) parity guard (scripts/check-prompt-projection-parity.ts)
+ * asserts the registry node `prompt_projection_contracts.competency_question_assessment`
+ * declares exactly this surface — so a field/budget change cannot silently drift from
+ * its registry declaration (INV-SCHEMA-1). Side-effect-free.
+ */
+export const COMPETENCY_QUESTION_ASSESSMENT_PROJECTION_CONTRACT_VERSION = 
+// v3 added the cited source-evidence bodies surface (source_evidence); v4 bounded it to a
+// deterministic per-payload SERIALIZED-SIZE budget; v5 (M2) derives that evidence reserve
+// from the WHOLE prompt budget per batch (= prompt_char_limit − measured non-evidence
+// payload − margin) instead of a static budget, so the evidence uses the room actually
+// left under the 50K cap. v6 scopes the claim_realization_map projection to each batch's
+// linked claims (questions' linked_claim_ids) instead of embedding the WHOLE map in every
+// batch — the whole-map fixed overhead grew unbounded with claim count and overflowed the
+// 50K cap before M3 (a claim-count-dependent pre-dispatch hard stop). Each version +
+// contract change rotates the reuse-match hash so resume mode cannot reuse an assessment
+// authored under a different (or content-blind, pre-v3) evidence projection of the same
+// sources — in particular a v5 assessment authored under the unscoped whole-map projection.
+"competency_question_assessment_compact_projection:v6";
+export const COMPETENCY_QUESTION_ASSESSMENT_PROMPT_CHAR_LIMIT = 50_000;
+// Per-observation excerpt budget for the cited source-evidence bodies projected
+// into the assessment prompt, so answer_status is judged on evidence content
+// rather than observation-id labels alone.
+// Per-observation excerpt budget on each cited evidence body, kept as a real pre-cap so one
+// huge observation (e.g. a streaming spreadsheet) cannot eat the whole evidence reserve.
+export const COMPETENCY_QUESTION_ASSESSMENT_EVIDENCE_EXCERPT_LIMIT = 4_000;
+// Margin held back from the prompt cap when deriving the per-batch evidence reserve and when
+// building batches, so the projection metadata that grows as evidence is added still fits.
+export const COMPETENCY_QUESTION_ASSESSMENT_BATCH_BUILD_BUDGET_RESERVE_CHARS = 1000;
+export function competencyQuestionAssessmentProjectionContract() {
+    return {
+        projection_kind: "competency_question_assessment_compact_projection",
+        projection_contract_version: COMPETENCY_QUESTION_ASSESSMENT_PROJECTION_CONTRACT_VERSION,
+        semantic_authority: "host_llm_assesses_answer_status_and_explanation_fields",
+        prompt_char_limit: COMPETENCY_QUESTION_ASSESSMENT_PROMPT_CHAR_LIMIT,
+        question_projection: "full question text is included without truncation; runtime keeps the full artifact authority",
+        evidence_projection: "evidence_observation_ids and evidence_source_basenames are prompt-visible; full evidence_refs remain runtime authority",
+        source_evidence_projection: "cited evidence observation bodies (from linked claim realizations, question evidence_refs, and domain competency semantic assessment evidence_refs) are projected as source_evidence, bounded greedily by serialized payload size to the per-batch evidence reserve, so answer_status is judged on content not id labels alone",
+        // The per-observation excerpt budget and the evidence-reserve derivation are part of the
+        // contract: tuning either changes the assessment prompt surface, so they rotate the
+        // reuse-match sha.
+        source_evidence_excerpt_char_limit: COMPETENCY_QUESTION_ASSESSMENT_EVIDENCE_EXCERPT_LIMIT,
+        source_evidence_reserve_derivation: "per batch = prompt_char_limit − measured non-evidence payload (system prompt + questions + claim map + validation + policy, empty evidence) − build budget reserve, clamped >= 0; a budget stub (evidence_body_omitted_for_budget) carries no body and is counted as omitted",
+        validation_projection: "validation status, counts, required evidence scope count, validation results, and invalid prompt-visible violations are prompt-visible",
+        claim_realization_projection: "claim_id, stance, evidence observation ids, evidence source basenames, and compact rationale are prompt-visible, SCOPED to the batch's linked claims (union of the batch questions' linked_claim_ids); claim_realization_count retains the full map count and scoped_claim_realization_count surfaces the in-batch count, so a batch of zero-link (domain-competency) questions honestly shows an empty scoped list against the full count",
+        runtime_derivations: [
+            "required_seed_refs",
+            "linked_claim_ids",
+            "evidence_refs",
+            "downstream_effect",
+        ],
+        batching_policy: {
+            mode: "deterministic_prompt_budget",
+            order: "canonical_competency_question_order",
+            build_budget_reserve_chars: COMPETENCY_QUESTION_ASSESSMENT_BATCH_BUILD_BUDGET_RESERVE_CHARS,
+            single_question_overflow: "fail_loud_before_dispatch",
+        },
+        fail_loud_policy: "runtime fails before provider dispatch when any final batch exceeds prompt_char_limit",
+    };
+}