owlrunkit 0.21.0 → 0.22.1

package/scripts/runkit-contract/onboarding-doctor.mjs

@@ -563,6 +563,75 @@ function ignoreFileCoversRuntime(root, ignoreFile) {
   return ignored;
 }
 
+const ESLINT_FLAT_CONFIG_FILES = Object.freeze([
+  "eslint.config.js",
+  "eslint.config.mjs",
+  "eslint.config.cjs",
+  "eslint.config.ts",
+  "eslint.config.mts",
+  "eslint.config.cts",
+]);
+
+function eslintIgnoreListCoversRuntime(listText) {
+  let ignored = false;
+  for (const match of listText.matchAll(/(["'])([^"']*)\1/gu)) {
+    const negated = match[2].startsWith("!");
+    const pattern = (negated ? match[2].slice(1) : match[2])
+      .replace(/^\.\//u, "")
+      .replace(/^\*\*\//u, "");
+    if (new Set([
+      ".owlcoda/",
+      ".owlcoda/**",
+      ".owlcoda/runkit/",
+      ".owlcoda/runkit/**",
+    ]).has(pattern)) {
+      ignored = !negated;
+    } else if (negated && pattern.startsWith(".owlcoda/runkit/")) {
+      ignored = false;
+    }
+  }
+  return ignored;
+}
+
+function eslintFlatConfigCoversRuntime(text) {
+  const importsGlobalHelper = /(?:import\s*\{[^}]*\bglobalIgnores\b[^}]*\}\s*from|(?:const|let|var)\s*\{[^}]*\bglobalIgnores\b[^}]*\}\s*=\s*require\s*\()\s*["'](?:eslint\/config|@eslint\/config-helpers)["']/su.test(text);
+  if (importsGlobalHelper) {
+    for (const match of text.matchAll(/\bglobalIgnores\s*\(\s*\[([^\]]*)\]/gsu)) {
+      if (eslintIgnoreListCoversRuntime(match[1])) return true;
+    }
+  }
+  for (const match of text.matchAll(/\{([^{}]*)\}/gsu)) {
+    const body = match[1];
+    const withoutOptionalName = body.replace(
+      /(?:^|,)\s*name\s*:\s*(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*')\s*(?=,|$)/su,
+      "",
+    );
+    const ignores = /^\s*,?\s*ignores\s*:\s*\[([^\]]*)\]\s*,?\s*$/su.exec(
+      withoutOptionalName,
+    );
+    if (ignores === null) continue;
+    if (eslintIgnoreListCoversRuntime(ignores[1])) return true;
+  }
+  return false;
+}
+
+function eslintFlatConfig(root) {
+  for (const relative of ESLINT_FLAT_CONFIG_FILES) {
+    if (!existsSync(path.join(root, relative))) continue;
+    let text;
+    try {
+      text = readWorkspaceFileBounded(root, relative);
+    } catch {
+      return { relative, coversRuntime: false };
+    }
+    return {
+      relative,
+      coversRuntime: eslintFlatConfigCoversRuntime(text),
+    };
+  }
+  return null;
+}
+
 const BROAD_COLLECTION_TOOLS = Object.freeze([
   {
     tool: "biome",
@@ -629,14 +698,18 @@ function runtimeIsolationCheck(root) {
     if (typeof value !== "string" || !hasBroadDotTarget(value)) continue;
     for (const descriptor of BROAD_COLLECTION_TOOLS) {
       if (!descriptor.command.test(value)) continue;
+      const flatConfig = descriptor.tool === "eslint" ? eslintFlatConfig(root) : null;
+      if (flatConfig?.coversRuntime) continue;
       if (
+        flatConfig === null
+        &&
         descriptor.ignoreFileSupported
         && ignoreFileCoversRuntime(root, descriptor.ignoreFile)
       ) {
         continue;
       }
       affectedScripts.push({
-        ignoreFile: descriptor.ignoreFile,
+        ignoreFile: flatConfig?.relative ?? descriptor.ignoreFile,
         script,
         tool: descriptor.tool,
       });
@@ -653,6 +726,21 @@ export function inspectRuntimeIsolationV1({ workspaceRoot } = {}) {
   return runtimeIsolationCheck(resolveBoundedWorkspaceRoot(workspaceRoot));
 }
 
+export function inspectLocalMaintenanceV1({
+  workspaceRoot,
+  packageRoot,
+  sharedSkillRoot,
+} = {}) {
+  const root = resolveBoundedWorkspaceRoot(workspaceRoot);
+  return {
+    schemaVersion: "OwlCodaRunKitLocalMaintenanceV1",
+    profileLaunchers: readProfileLauncherReadiness({ workspaceRoot: root }),
+    runtimeIsolation: runtimeIsolationCheck(root),
+    skill: inspectDoctorSkillStateV1({ packageRoot, sharedSkillRoot }),
+    authorizationGranted: false,
+  };
+}
+
 function configCheck(root) {
   try {
     const config = readWorkspaceJsonBounded(
@@ -850,8 +938,12 @@ async function buildDoctorReport({
         issues: [error instanceof Error ? error.message : String(error)],
       };
     }
-    let activationBlockedReason = null;
-    if (inspectedSkill.status !== "valid") {
+    let activationBlockedReason = new Set(["unmanaged", "drifted"]).has(
+      inspectedSkill.status,
+    )
+      ? `shared_skill_integrity_invalid:${inspectedSkill.status}`
+      : null;
+    if (inspectedSkill.status !== "valid" && activationBlockedReason === null) {
       try {
         await skillFleetInspector();
       } catch (error) {
@@ -1000,6 +1092,77 @@ export async function runDoctorV2(options = {}) {
   return buildDoctorReport({ ...options, includeSharedSkill: true });
 }
 
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", `'"'"'`)}'`;
+}
+
+function doctorRuntimeIsolationGuidance(runtimeIsolation) {
+  return runtimeIsolation.affectedScripts.map((affected) => ({
+    configurationFile: affected.ignoreFile,
+    configurationStyle: affected.tool === "eslint"
+      && affected.ignoreFile.startsWith("eslint.config.")
+      ? "flat_config_global_ignores"
+      : "ignore_file",
+    recommendedPattern: affected.tool === "eslint"
+      && affected.ignoreFile.startsWith("eslint.config.")
+      ? ".owlcoda/runkit/**"
+      : ".owlcoda/runkit/",
+    script: affected.script,
+    tool: affected.tool,
+  }));
+}
+
+export async function runDoctorV3(options = {}) {
+  const report = await buildDoctorReport({ ...options, includeSharedSkill: true });
+  const skillRoot = options.skillRoot
+    ?? path.join(userInfo().homedir, ".agents", "skills", "owlcoda-runkit");
+  const archiveRoot = path.join(
+    userInfo().homedir,
+    ".agents",
+    "skill-archives",
+    "owlcoda-runkit",
+  );
+  const sharedSkill = report.checks.sharedSkill;
+  const activation = sharedSkill.status === "valid"
+    ? {
+        status: "not_evaluated",
+        reason: "shared_skill_already_current",
+      }
+    : sharedSkill.activationBlockedReason
+      ? {
+          status: "blocked",
+          reason: sharedSkill.activationBlockedReason,
+        }
+      : {
+          status: "eligible",
+          reason: "fleet_check_passed",
+        };
+  return {
+    ...report,
+    schemaVersion: "OwlCodaRunKitDoctorReportV3",
+    checks: {
+      ...report.checks,
+      runtimeIsolation: {
+        ...report.checks.runtimeIsolation,
+        guidance: doctorRuntimeIsolationGuidance(report.checks.runtimeIsolation),
+      },
+      sharedSkill: {
+        ...sharedSkill,
+        activation: {
+          ...activation,
+          checkCommand: `npx --no-install owlrunkit fleet skill-plan --skill-root ${shellQuote(skillRoot)} --archive-root ${shellQuote(archiveRoot)}`,
+        },
+      },
+    },
+    profileLauncherWarnings: {
+      ...report.profileLauncherWarnings,
+      diagnosticCommand: report.profileLauncherWarnings.count > 0
+        ? "npx --no-install owlrunkit profiles reconcile --workspace . --dry-run"
+        : null,
+    },
+  };
+}
+
 export function formatDoctorHuman(report) {
   const otherWarnings = report.warningCodes.filter(
     (code) => code !== "profile_launcher_warnings",
@@ -1023,12 +1186,24 @@ export function formatDoctorHuman(report) {
       ? [`Shared Skill: ${report.checks.sharedSkill.status} (${report.checks.sharedSkill.sharedSkillVersion ?? "missing"}; project Core ${report.checks.sharedSkill.projectCoreVersion})`]
       : []),
     ...(report.checks.sharedSkill?.activationBlockedReason
+      && !report.checks.sharedSkill?.activation
       ? [`Shared Skill activation: ${report.checks.sharedSkill.activationBlockedReason}`]
       : []),
+    ...(report.checks.sharedSkill?.activation
+      ? [
+          `Shared Skill activation: ${report.checks.sharedSkill.activation.status} (${report.checks.sharedSkill.activation.reason})`,
+          `Fleet-safe check: ${report.checks.sharedSkill.activation.checkCommand}`,
+        ]
+      : []),
     `Lifecycle: ${report.checks.lifecycle.status}`,
     ...(report.issueCodes.length > 0 ? [`Issues: ${report.issueCodes.join(", ")}`] : []),
     ...(report.profileLauncherWarnings.count > 0
-      ? [`Profile launcher warnings: ${report.profileLauncherWarnings.count} (non-blocking)`]
+      ? [
+          `Profile launcher warnings: ${report.profileLauncherWarnings.count} (non-blocking)`,
+          ...(report.profileLauncherWarnings.diagnosticCommand
+            ? [`Profile launcher diagnostic: ${report.profileLauncherWarnings.diagnosticCommand}`]
+            : []),
+        ]
       : []),
     ...(otherWarnings.length > 0 ? [`Warnings: ${otherWarnings.join(", ")}`] : []),
     `Next: ${report.nextAllowedAction === "adopt_current_release"

package/scripts/runkit-contract/project-cli-resolver.mjs

@@ -20,10 +20,22 @@ const SELF_NORMALIZED_QUICK_CORE_VERSIONS = new Set([
   "0.20.0",
   "0.20.1",
   "0.21.0",
+  "0.21.1",
+  "0.22.0",
+  "0.22.1",
 ]);
 const EXACT_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/;
 const SHA256_REF = /^sha256:[a-f0-9]{64}$/;
 const TRUSTED_PRIOR_CORE_IDENTITIES = new Map([
+  ["0.22.0", new Set([
+    "sha256:e79d2123d88ada0e2e31f62fabee83b1d661ca02e93a383691a502f721ae1e7e",
+  ])],
+  ["0.21.0", new Set([
+    "sha256:f85b9bf8c32705d5f5dfebdb653e83ac8d1ac0468214c17f230cbd2de04246fd",
+  ])],
+  ["0.20.1", new Set([
+    "sha256:8af2b9792731efa37f596255a7677dcec6e2fd3cc079dfdb0e6ff29e8017e784",
+  ])],
   ["0.20.0", new Set([
     "sha256:30098aa9344c17c1ed0b5ed45ef1c590b3214b824402f584029c1ecb38ca7a70",
   ])],

package/scripts/runkit-contract/registry-adoption.mjs

@@ -47,10 +47,10 @@ const POLICY = Object.freeze({
   ],
   rollbackRelease: {
     packageName: PACKAGE_NAME,
-    version: "0.20.0",
-    shasum: "b123f5ea33a4f500961a0df3226ed0ca409d111d",
-    integrity: "sha512-VcXUh+q8DwR6RoO9JDoUMEzFrpFRBpSvpqgHvIY15Z+Oo+A31Ij2kFO5wCFki80nd6Tl/YT70t7UV2aG0TZ0GQ==",
-    tarballUrl: "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.20.0.tgz",
+    version: "0.21.0",
+    shasum: "f9ecfa41ad2ba3140258234b49d98798675651f2",
+    integrity: "sha512-hopLyvN5vp0y3xu0H0jQbMI6DxaDSWcGYcn7tAbCa0m2OqW2G8n5kJvnr217jqPYlArQwJ2TDPRLNmp4vPEhVQ==",
+    tarballUrl: "https://registry.npmjs.org/owlrunkit/-/owlrunkit-0.21.0.tgz",
   },
   registryEvidenceMustBeExternal: true,
   registryEvidenceSchemaVersion: "OwlCodaRunKitRegistryReleaseEvidenceV1",

package/scripts/runkit-contract/runkit-bootstrap.mjs

@@ -15,6 +15,7 @@ const CURRENT_PACKAGE_COMMANDS = new Set([
   "bootstrap",
   "core-successor",
   "fleet",
+  "hook",
   "init",
 ]);
 

package/scripts/runkit-contract/runkit-cli.mjs

@@ -87,10 +87,11 @@ import {
   verifySourceCandidateV2,
 } from "./source-candidate.mjs";
 import {
-  buildInspectCompactV1,
+  buildInspectCompactV2,
   buildInspectSummary,
   formatInspectHuman,
 } from "./inspect-presentation.mjs";
+import { buildHookRecoveryV1 } from "./hook-recovery.mjs";
 import { attestQuickReceiptDetails } from "./quick-attest.mjs";
 import { readLocalQuickMetrics } from "./quick-metrics.mjs";
 import { runQuickEvidenceReuse } from "./quick-evidence-reuse.mjs";
@@ -163,9 +164,10 @@ import {
 } from "./core-successor.mjs";
 import {
   formatDoctorHuman,
+  inspectLocalMaintenanceV1,
   readAdoptionReadiness,
   readProfileLauncherReadiness,
-  runDoctorV2,
+  runDoctorV3,
 } from "./onboarding-doctor.mjs";
 import {
   applyOnboardingBootstrapV1,
@@ -180,7 +182,7 @@ import { OFFICIAL_NPM_REGISTRY } from "./registry-adoption-gate.mjs";
 import {
   appendTeamProjectEventV1,
   assignTeamProjectV1,
-  buildTeamProjectTakeoverV3,
+  buildTeamProjectTakeoverV4,
   checkpointTeamProjectV1,
   checkpointTeamProjectFromQuickReceiptV1,
   closeTeamProjectVerificationV1,
@@ -212,13 +214,11 @@ import {
   importExternalDeliveryV1,
 } from "./project-external-delivery.mjs";
 import {
-  formatTeamDeliveryRecommendationHumanV1,
-  formatTeamDeliveryStatusHumanV1,
-  formatTeamDeliveryStatusHumanV2,
+  formatTeamDeliveryRecommendationHumanV2,
+  formatTeamDeliveryStatusHumanV3,
   formatTeamPacketValidationHumanV1,
-  readTeamDeliveryStatusV1,
-  readTeamDeliveryStatusV2,
-  recommendTeamDeliveryV1,
+  readTeamDeliveryStatusV3,
+  recommendTeamDeliveryV2,
   validateTeamPacketFileV1,
 } from "./team-delivery.mjs";
 
@@ -256,12 +256,12 @@ Fleet and status
   npx --no-install owlrunkit fleet rollback-registry --receipt <file> --rollback-receipt <file>
   npx --no-install owlrunkit fleet skill-plan --skill-root <directory> --archive-root <directory>
   npx --no-install owlrunkit fleet discover; npx --no-install owlrunkit status --workspace .
+  npx --no-install owlrunkit hook recovery --workspace . --json
 Agent team projects
   npx --no-install owlrunkit project <init|assign|checkpoint|handoff|reject-and-return|reopen-upstream|transfer|work-item revise-scope|work-item require-evidence|reconcile|delivery record|decision|verification|capture|target-snapshot|import-delivery|status|takeover|successor> [options]
   npx --no-install owlrunkit team <recommend|status|packet validate> [options]
   Durable project truth plus read-only Team recommendation and packet validation. No Agent dispatch.
-Core successor
-  npx --no-install owlrunkit core-successor <plan|apply|resume> --workspace . [...]
+Core successor: npx --no-install owlrunkit core-successor <plan|apply|resume> --workspace . [...]
 Other onboarding commands:
   npx --no-install owlrunkit profiles validate --workspace .; npx --no-install owlrunkit profiles impact --workspace . --changed <path>
   npx --no-install owlrunkit inspect --workspace . --json
@@ -295,9 +295,31 @@ grants no Git, release, deployment, production, or business authority.
   npx --no-install owlrunkit inspect --workspace <directory> --run-id <id> [--verbose] [--json]
 
 --compact returns only current project truth, progress, dominant gap, owner,
-next action, warning summary, execution counts, and the authority boundary.
+separate lifecycle/project/maintenance actions, actionable warning groups,
+advisories, execution counts, and the authority boundary.
 It never grants Git, release, deployment, production, or business authority.
 `,
+  hook: `Usage:
+  npx --no-install owlrunkit hook recovery --workspace <directory> --json
+
+Returns a deterministic, read-only, strictly bounded recovery projection for
+SessionStart(source=compact). Project text remains escaped untrusted data.
+The consumer must compare its current Goal/Done-when with projectId and the
+objective digest/preview before considering nextAction. This command never
+changes project, execution, lease, assurance, Agent, Git, release, deployment,
+production, or business state.
+`,
+  "hook recovery": `Usage:
+  npx --no-install owlrunkit hook recovery --workspace <directory> --json
+
+Returns a deterministic, read-only, strictly bounded recovery projection for
+SessionStart(source=compact). Project text remains escaped untrusted data.
+The consumer must compare its current Goal/Done-when with projectId and the
+objective digest/preview before considering nextAction. This command never
+changes project, execution, lease, assurance, Agent, Git, release, deployment,
+production, or business state.
+`,
+
   doctor: `Usage:
   npx --no-install owlrunkit doctor --workspace <directory>
     [--registry <url>] [--timeout-ms <milliseconds>]
@@ -313,16 +335,6 @@ non-blocking; it never changes project authority.
 
 Verifies the exact registry release against the project-local install and writes
 project-owned adoption evidence. It grants no Git or release authority.
-`,
-  doctor: `Usage:
-  npx --no-install owlrunkit doctor --workspace <directory>
-    [--skill-root <shared-skill-directory>] [--registry <url>]
-    [--timeout-ms <milliseconds>] [--json]
-
-Diagnoses the project package, Core, registry, profiles, lifecycle, and the
-package-bound versus shared Skill version. A shared Skill mismatch is a visible
-non-blocking warning because the CLI cannot prove which Skill the active Agent
-session already loaded.
 `,
   assurance: `Usage:
   npx --no-install owlrunkit assurance route --workspace <directory> --request <risk-facts.json>
@@ -2159,6 +2171,13 @@ function inspect(options) {
   const projectDriver = pathEntryExists(projectDefinitionPath)
     ? readTeamProjectStatusV3({ workspaceRoot: root })
     : null;
+  const localMaintenance = options.compact === true
+    ? inspectLocalMaintenanceV1({
+        workspaceRoot: root,
+        packageRoot: path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../.."),
+        sharedSkillRoot: process.env.OWLCODA_RUNKIT_PROCESS_SKILL_ROOT,
+      })
+    : null;
   const summary = buildInspectSummary(result, {
     maintenanceNextAction: onboarding.maintenanceNextAction ?? null,
     projectDriver,
@@ -2178,9 +2197,10 @@ function inspect(options) {
     summary,
     view,
     onboarding,
+    ...(localMaintenance === null ? {} : { localMaintenance }),
     ...(projectDriver === null ? {} : { projectDriver }),
   };
-  return options.compact === true ? buildInspectCompactV1(inspected) : inspected;
+  return options.compact === true ? buildInspectCompactV2(inspected) : inspected;
 }
 
 function closeout(options) {
@@ -2444,6 +2464,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       "efficiency",
       "fleet",
       "formal",
+      "hook",
       "lease",
       "mode",
       "profiles",
@@ -2555,6 +2576,8 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           ? ["json"]
         : command === "team"
           ? ["json"]
+        : command === "hook"
+          ? ["json"]
         : command === "inspect"
         ? ["json", "compact", "verbose", "history"]
         : command === "init"
@@ -2637,7 +2660,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 25 || timeoutMs > 10_000) {
         throw new Error("--timeout-ms must be an integer from 25 to 10000.");
       }
-      const report = await runDoctorV2({
+      const report = await runDoctorV3({
         workspaceRoot: requireOption(options, "workspace"),
         sharedSkillRoot: options["skill-root"],
         discoverSharedSkill: true,
@@ -2772,20 +2795,20 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       const root = workspace(options);
       if (action === "recommend") {
         assertOnlyOptions(options, ["workspace", "json"]);
-        const recommendation = recommendTeamDeliveryV1({ workspaceRoot: root });
+        const recommendation = recommendTeamDeliveryV2({ workspaceRoot: root });
         return options.json === true
           ? recommendation
           : withHumanOutput(
               recommendation,
-              formatTeamDeliveryRecommendationHumanV1(recommendation),
+              formatTeamDeliveryRecommendationHumanV2(recommendation),
             );
       }
       if (action === "status") {
         assertOnlyOptions(options, ["workspace", "json"]);
-        const status = readTeamDeliveryStatusV2({ workspaceRoot: root });
+        const status = readTeamDeliveryStatusV3({ workspaceRoot: root });
         return options.json === true
           ? status
-          : withHumanOutput(status, formatTeamDeliveryStatusHumanV2(status));
+          : withHumanOutput(status, formatTeamDeliveryStatusHumanV3(status));
       }
       if (action === "packet validate") {
         assertOnlyOptions(options, ["workspace", "packet", "json"]);
@@ -3598,6 +3621,15 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       const root = workspace(options);
       return withControlTransaction(root, () => plan(options));
     }
+    if (command === "hook") {
+      if (action !== "recovery") {
+        throw new Error("Usage: npx --no-install owlrunkit hook recovery --workspace <directory> --json");
+      }
+      assertOnlyOptions(options, ["workspace", "json"]);
+      return buildHookRecoveryV1({
+        workspaceRoot: requireOption(options, "workspace"),
+      });
+    }
     if (command === "inspect") return inspect(options);
     if (command === "status") {
       const inspected = inspect({ ...options, json: true });
@@ -4335,7 +4367,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
           : withHumanOutput(status, formatTeamProjectStatusHumanV2(status));
       }
       if (action === "takeover") {
-        const takeover = buildTeamProjectTakeoverV3({
+        const takeover = buildTeamProjectTakeoverV4({
           workspaceRoot: root,
           agentId: requireOption(options, "agent"),
         });
@@ -4600,7 +4632,7 @@ export async function runCli(argv = process.argv.slice(2), runtimeHooks = {}) {
       return withControlTransaction(root, () => closeout(options));
     }
     if (command === "finish") return finishExecution(options);
-    throw new Error("Usage: npx --no-install owlrunkit <bootstrap|init|doctor|adopt|mode|team|assurance|fleet|profiles|project|status|formal|candidate|deployment|core-successor|start|verify|repair|offline-export|offline-import|quick-verify|quick-reuse|quick-runtime-verify|quick-attest|quick-metrics|efficiency|finish|plan|inspect|lease|delivery|coverage-adopt|resume|verify-plan|resource-preflight|snapshot|visual-smoke|finalize|ready-for-commit|closeout> [options]");
+    throw new Error("Usage: npx --no-install owlrunkit <bootstrap|init|doctor|adopt|mode|team|hook|assurance|fleet|profiles|project|status|formal|candidate|deployment|core-successor|start|verify|repair|offline-export|offline-import|quick-verify|quick-reuse|quick-runtime-verify|quick-attest|quick-metrics|efficiency|finish|plan|inspect|lease|delivery|coverage-adopt|resume|verify-plan|resource-preflight|snapshot|visual-smoke|finalize|ready-for-commit|closeout> [options]");
   } catch (error) {
     return {
       status: "invalid_input",

package/scripts/runkit-contract/schemas/fleet-skill-upgrade-plan-v1.schema.json

@@ -42,7 +42,20 @@
             "source": { "type": "string", "minLength": 1 },
             "complete": { "type": "boolean" },
             "workspaceCount": { "type": "integer", "minimum": 0 },
-            "unreachableRoots": { "$ref": "#/$defs/strings" }
+            "unreachableRoots": { "$ref": "#/$defs/strings" },
+            "issues": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["code", "path", "coverageRoot"],
+                "properties": {
+                  "code": { "type": "string", "minLength": 1 },
+                  "path": { "type": "string", "minLength": 1 },
+                  "coverageRoot": { "type": "string", "minLength": 1 }
+                }
+              }
+            }
           }
         }
       ]
@@ -102,7 +115,7 @@
       "status": "blocked",
       "expectedCore": {
         "contractVersion": "0.2",
-        "coreVersion": "0.21.0",
+        "coreVersion": "0.22.1",
         "coreManifestSha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
         "coreSourceRef": "artifact:sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
       },
@@ -113,7 +126,7 @@
         "installedConfigCoreVersion": "0.20.0",
         "issues": ["installed_skill_core_version_mismatch"]
       },
-      "discovery": { "source": "fleet_registry", "complete": true, "workspaceCount": 1, "unreachableRoots": [] },
+      "discovery": { "source": "fleet_registry", "complete": true, "workspaceCount": 1, "unreachableRoots": [], "issues": [] },
       "affectedProjects": [
         {
           "workspaceRoot": "/projects/example",