oxe-cc 1.2.1 → 1.3.0

package/lib/runtime/gate/gate-manager.js

@@ -4,10 +4,22 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GateManager = void 0;
+exports.listPendingGates = listPendingGates;
+exports.resolveGate = resolveGate;
 const crypto_1 = __importDefault(require("crypto"));
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
 const bus_1 = require("../events/bus");
+function isStaleGate(gate, maxAgeHours) {
+    const cutoff = Date.now() - maxAgeHours * 60 * 60 * 1000;
+    const requested = Date.parse(gate.requested_at);
+    return Number.isFinite(requested) && requested <= cutoff;
+}
+function wasResolvedRecently(gate, maxAgeHours) {
+    const cutoff = Date.now() - maxAgeHours * 60 * 60 * 1000;
+    const resolved = Date.parse(gate.resolved_at || '');
+    return Number.isFinite(resolved) && resolved >= cutoff;
+}
 class GateManager {
     constructor(projectRoot, sessionId, runId) {
         this.projectRoot = projectRoot;
@@ -40,9 +52,13 @@ class GateManager {
         const token = {
             gate_id: `gate-${crypto_1.default.randomBytes(4).toString('hex')}`,
             scope,
+            run_id: ctx.run_id ?? this.runId,
+            work_item_id: ctx.work_item_id ?? null,
+            action: ctx.action ?? null,
             requested_at: new Date().toISOString(),
             context: ctx,
             status: 'pending',
+            resolution_history: [],
         };
         const gates = this.readGates();
         gates.push(token);
@@ -54,9 +70,12 @@ class GateManager {
             payload: {
                 gate_id: token.gate_id,
                 scope,
+                action: token.action,
                 description: ctx.description,
                 evidence_refs: ctx.evidence_refs,
                 risks: ctx.risks,
+                rationale: ctx.rationale ?? null,
+                policy_decision_id: ctx.policy_decision_id ?? null,
             },
         });
         return token;
@@ -66,13 +85,23 @@ class GateManager {
         const idx = gates.findIndex((g) => g.gate_id === token.gate_id);
         if (idx === -1)
             throw new Error(`Gate ${token.gate_id} not found`);
+        const resolvedAt = new Date().toISOString();
         const resolved = {
             ...gates[idx],
             status: 'resolved',
             decision: resolution.decision,
             actor: resolution.actor,
             reason: resolution.reason ?? undefined,
-            resolved_at: new Date().toISOString(),
+            resolved_at: resolvedAt,
+            resolution_history: [
+                ...(Array.isArray(gates[idx].resolution_history) ? gates[idx].resolution_history : []),
+                {
+                    decision: resolution.decision,
+                    actor: resolution.actor,
+                    reason: resolution.reason ?? undefined,
+                    resolved_at: resolvedAt,
+                },
+            ],
         };
         gates[idx] = resolved;
         this.writeGates(gates);
@@ -82,8 +111,10 @@ class GateManager {
             payload: {
                 gate_id: token.gate_id,
                 scope: token.scope,
+                action: token.action,
                 decision: resolution.decision,
                 actor: resolution.actor,
+                reason: resolution.reason ?? null,
             },
         });
         return resolved;
@@ -94,11 +125,87 @@ class GateManager {
     listPending() {
         return this.readGates().filter((g) => g.status === 'pending');
     }
+    listResolved() {
+        return this.readGates().filter((g) => g.status === 'resolved');
+    }
+    listPendingByRun(runId = this.runId) {
+        return this.readGates().filter((g) => g.status === 'pending' && g.run_id === runId);
+    }
+    listPendingForWorkItem(workItemId) {
+        return this.readGates().filter((g) => g.status === 'pending' && g.work_item_id === workItemId);
+    }
+    stalePending(maxAgeHours = 24) {
+        return this.listPending().filter((gate) => isStaleGate(gate, maxAgeHours));
+    }
+    listRecentResolved(maxAgeHours = 24) {
+        return this.listResolved().filter((gate) => wasResolvedRecently(gate, maxAgeHours));
+    }
     listAll() {
         return this.readGates();
     }
     get(gateId) {
         return this.readGates().find((g) => g.gate_id === gateId) ?? null;
     }
+    filter(query = {}) {
+        const all = this.readGates();
+        const sla = query.gate_sla_hours ?? 24;
+        return all.filter((gate) => {
+            if (query.run_id && gate.run_id !== query.run_id)
+                return false;
+            if (query.scope && gate.scope !== query.scope)
+                return false;
+            if (query.work_item_id && gate.work_item_id !== query.work_item_id)
+                return false;
+            if (query.action && gate.action !== query.action)
+                return false;
+            if (query.status && query.status !== 'all') {
+                if (query.status === 'stale') {
+                    if (!(gate.status === 'pending' && isStaleGate(gate, sla)))
+                        return false;
+                }
+                else if (gate.status !== query.status) {
+                    return false;
+                }
+            }
+            return true;
+        });
+    }
+    snapshot(maxAgeHours = 24, query = {}) {
+        const all = this.filter({ ...query, gate_sla_hours: maxAgeHours });
+        const pending = all.filter((gate) => gate.status === 'pending');
+        const stale_pending = pending.filter((gate) => isStaleGate(gate, maxAgeHours));
+        const resolved_recent = all.filter((gate) => gate.status === 'resolved' && wasResolvedRecently(gate, maxAgeHours));
+        const byRun = {};
+        const byScope = {};
+        for (const gate of all) {
+            const runKey = gate.run_id || 'unscoped';
+            const scopeKey = gate.scope || 'unknown';
+            byRun[runKey] = (byRun[runKey] || 0) + 1;
+            byScope[scopeKey] = (byScope[scopeKey] || 0) + 1;
+        }
+        return {
+            total: all.length,
+            gate_sla_hours: maxAgeHours,
+            pending,
+            stale_pending,
+            staleCount: stale_pending.length,
+            resolved_recent,
+            byRun,
+            byScope,
+            all,
+        };
+    }
 }
 exports.GateManager = GateManager;
+function listPendingGates(manager, runId, query = {}) {
+    return manager.snapshot(query.gate_sla_hours ?? 24, {
+        ...query,
+        run_id: runId ?? undefined,
+    });
+}
+async function resolveGate(manager, gateId, resolution) {
+    const token = manager.get(gateId);
+    if (!token)
+        throw new Error(`Gate ${gateId} not found`);
+    return manager.resolve(token, resolution);
+}

package/lib/runtime/index.d.ts

@@ -5,8 +5,8 @@ export * from './compiler/index';
 export * from './scheduler/index';
 export * from './workspace/index';
 export * from './evidence/index';
-export { compile as compileVerification, runCheck, runSuite, summarizeSuite, } from './verification/verification-compiler';
-export type { CheckType, AcceptanceCheck, AcceptanceCheckSuite, CheckResult, } from './verification/verification-compiler';
+export { compile as compileVerification, runCheck, runSuite, executeSuite, verifyRun, summarizeSuite, } from './verification/verification-compiler';
+export type { CheckType, AcceptanceCheck, AcceptanceCheckSuite, CheckResult, ExecutedVerificationSuite, VerifyRunResult, } from './verification/verification-compiler';
 export * from './verification/verification-manifest';
 export * from './policy/index';
 export * from './gate/index';

package/lib/runtime/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.summarizeSuite = exports.runSuite = exports.runCheck = exports.compileVerification = void 0;
+exports.summarizeSuite = exports.verifyRun = exports.executeSuite = exports.runSuite = exports.runCheck = exports.compileVerification = void 0;
 // R1 Public ABI — OXE Runtime Foundation
 __exportStar(require("./models/index"), exports);
 __exportStar(require("./events/index"), exports);
@@ -29,6 +29,8 @@ var verification_compiler_1 = require("./verification/verification-compiler");
 Object.defineProperty(exports, "compileVerification", { enumerable: true, get: function () { return verification_compiler_1.compile; } });
 Object.defineProperty(exports, "runCheck", { enumerable: true, get: function () { return verification_compiler_1.runCheck; } });
 Object.defineProperty(exports, "runSuite", { enumerable: true, get: function () { return verification_compiler_1.runSuite; } });
+Object.defineProperty(exports, "executeSuite", { enumerable: true, get: function () { return verification_compiler_1.executeSuite; } });
+Object.defineProperty(exports, "verifyRun", { enumerable: true, get: function () { return verification_compiler_1.verifyRun; } });
 Object.defineProperty(exports, "summarizeSuite", { enumerable: true, get: function () { return verification_compiler_1.summarizeSuite; } });
 __exportStar(require("./verification/verification-manifest"), exports);
 __exportStar(require("./policy/index"), exports);

package/lib/runtime/models/gate-decision.d.ts

@@ -1,8 +1,11 @@
 export type GateDecisionValue = 'approved' | 'rejected' | 'approved_with_caveats' | 'needs_more_evidence';
-export type GateScope = 'plan_approval' | 'critical_mutation' | 'security' | 'pr_promotion' | 'merge';
+export type GateScope = 'plan_approval' | 'critical_mutation' | 'security' | 'pr_promotion' | 'remote_promotion' | 'merge';
 export interface GateDecision {
     gate_id: string;
     scope: GateScope;
+    run_id?: string | null;
+    work_item_id?: string | null;
+    action?: string | null;
     decision: GateDecisionValue;
     actor: string;
     reason: string | null;

package/lib/runtime/models/workspace.d.ts

@@ -1,8 +1,10 @@
 export type WorkspaceStrategy = 'inplace' | 'git_worktree' | 'ephemeral_container';
 export type WorkspaceStatus = 'allocating' | 'ready' | 'dirty' | 'disposed' | 'error';
+export type WorkspaceIsolationLevel = 'shared' | 'isolated';
 export interface Workspace {
     workspace_id: string;
     strategy: WorkspaceStrategy;
+    isolation_level: WorkspaceIsolationLevel;
     base_commit: string | null;
     branch: string | null;
     container_ref: string | null;
@@ -12,6 +14,7 @@ export interface Workspace {
 export interface WorkspaceLease {
     workspace_id: string;
     strategy: WorkspaceStrategy;
+    isolation_level: WorkspaceIsolationLevel;
     branch: string | null;
     base_commit: string | null;
     root_path: string;

package/lib/runtime/plugins/capability-adapter.d.ts

@@ -0,0 +1,12 @@
+import type { OxePlugin } from './plugin-abi';
+interface CapabilityManifest {
+    id: string;
+    entrypoint: string | null;
+    sideEffects: string[];
+    evidenceOutputs: string[];
+    checkTypes: string[];
+    dir: string;
+}
+export declare function createCapabilityPlugin(projectRoot: string, manifest: CapabilityManifest): OxePlugin;
+export declare function loadCapabilityPlugins(projectRoot: string): OxePlugin[];
+export {};

package/lib/runtime/plugins/capability-adapter.js

@@ -0,0 +1,204 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCapabilityPlugin = createCapabilityPlugin;
+exports.loadCapabilityPlugins = loadCapabilityPlugins;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const plugin_manifest_1 = require("./plugin-manifest");
+function parseFrontmatter(text) {
+    const match = String(text || '').match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    if (!match)
+        return {};
+    const out = {};
+    for (const line of match[1].split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const idx = trimmed.indexOf(':');
+        if (idx === -1)
+            continue;
+        out[trimmed.slice(0, idx).trim()] = trimmed.slice(idx + 1).trim();
+    }
+    return out;
+}
+function parseArrayField(value) {
+    const raw = String(value || '').trim();
+    if (!raw || raw === '[]')
+        return [];
+    if (/^\[.*\]$/.test(raw)) {
+        return raw
+            .slice(1, -1)
+            .split(',')
+            .map((item) => item.trim().replace(/^['"`]|['"`]$/g, ''))
+            .filter(Boolean);
+    }
+    return raw.split(',').map((item) => item.trim()).filter(Boolean);
+}
+function loadCapabilityManifests(projectRoot) {
+    const capabilitiesDir = path_1.default.join(projectRoot, '.oxe', 'capabilities');
+    if (!fs_1.default.existsSync(capabilitiesDir))
+        return [];
+    return fs_1.default
+        .readdirSync(capabilitiesDir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => {
+        const dir = path_1.default.join(capabilitiesDir, entry.name);
+        const manifestPath = path_1.default.join(dir, 'CAPABILITY.md');
+        if (!fs_1.default.existsSync(manifestPath))
+            return null;
+        const raw = fs_1.default.readFileSync(manifestPath, 'utf8');
+        const fm = parseFrontmatter(raw);
+        const id = String(fm.id || '').trim();
+        if (!id)
+            return null;
+        return {
+            id,
+            entrypoint: String(fm.entrypoint || '').trim() || null,
+            sideEffects: parseArrayField(fm.side_effects),
+            evidenceOutputs: parseArrayField(fm.evidence_outputs),
+            checkTypes: parseArrayField(fm.check_types || fm.supports_checks),
+            dir,
+        };
+    })
+        .filter((item) => Boolean(item));
+}
+function resolveEntrypoint(projectRoot, manifest) {
+    if (!manifest.entrypoint)
+        return null;
+    if (path_1.default.isAbsolute(manifest.entrypoint))
+        return manifest.entrypoint;
+    const capabilityRelative = path_1.default.join(manifest.dir, manifest.entrypoint);
+    if (fs_1.default.existsSync(capabilityRelative))
+        return capabilityRelative;
+    const projectRelative = path_1.default.join(projectRoot, manifest.entrypoint);
+    if (fs_1.default.existsSync(projectRelative))
+        return projectRelative;
+    return capabilityRelative;
+}
+function resolveEvidencePaths(projectRoot, manifest) {
+    return manifest.evidenceOutputs
+        .map((entry) => {
+        const capabilityRelative = path_1.default.join(manifest.dir, entry);
+        if (fs_1.default.existsSync(capabilityRelative))
+            return path_1.default.relative(projectRoot, capabilityRelative);
+        const projectRelative = path_1.default.join(projectRoot, entry);
+        if (fs_1.default.existsSync(projectRelative))
+            return path_1.default.relative(projectRoot, projectRelative);
+        return path_1.default.relative(projectRoot, projectRelative);
+    })
+        .map((entry) => entry.replace(/\\/g, '/'));
+}
+function inferToolKind(sideEffects) {
+    if (sideEffects.some((effect) => /db|infra|network|external/i.test(effect)))
+        return 'external_operation';
+    if (sideEffects.some((effect) => /write|mutat|git/i.test(effect)))
+        return 'mutation';
+    if (sideEffects.some((effect) => /verify|test|evidence/i.test(effect)))
+        return 'verification';
+    if (sideEffects.some((effect) => /analysis|scan|read/i.test(effect)))
+        return 'analysis';
+    return 'read';
+}
+function buildToolProvider(projectRoot, manifest) {
+    return {
+        name: manifest.id,
+        kind: inferToolKind(manifest.sideEffects),
+        idempotent: !manifest.sideEffects.some((effect) => /write|mutat|git|db|infra/i.test(effect)),
+        supports(actionType) {
+            return actionType === manifest.id || actionType === `capability:${manifest.id}`;
+        },
+        async invoke(input) {
+            const entrypoint = resolveEntrypoint(projectRoot, manifest);
+            if (!entrypoint) {
+                return {
+                    success: false,
+                    output: '',
+                    evidence_paths: [],
+                    side_effects_applied: [],
+                    error: `Capability ${manifest.id} does not declare an entrypoint`,
+                };
+            }
+            const ext = path_1.default.extname(entrypoint).toLowerCase();
+            const env = {
+                ...process.env,
+                OXE_CAPABILITY_INPUT: JSON.stringify(input.params || {}),
+                OXE_CAPABILITY_RUN_ID: input.run_id,
+                OXE_CAPABILITY_WORK_ITEM_ID: input.work_item_id,
+                OXE_CAPABILITY_ATTEMPT_ID: input.attempt_id,
+                OXE_CAPABILITY_WORKSPACE_ROOT: input.workspace_root,
+            };
+            let program = entrypoint;
+            let args = [];
+            if (ext === '.js' || ext === '.cjs' || ext === '.mjs') {
+                program = process.execPath;
+                args = [entrypoint];
+            }
+            else if (ext === '.ps1') {
+                program = 'powershell';
+                args = ['-File', entrypoint];
+            }
+            const result = (0, child_process_1.spawnSync)(program, args, {
+                cwd: projectRoot,
+                encoding: 'utf8',
+                env,
+            });
+            return {
+                success: result.status === 0 && !result.error,
+                output: [result.stdout || '', result.stderr || ''].filter(Boolean).join('\n').trim(),
+                evidence_paths: resolveEvidencePaths(projectRoot, manifest),
+                side_effects_applied: manifest.sideEffects,
+                error: result.error ? String(result.error) : result.status === 0 ? undefined : (result.stderr || result.stdout || `Capability exited with status ${result.status}`),
+            };
+        },
+    };
+}
+function buildVerifierProvider(projectRoot, manifest) {
+    if (!manifest.checkTypes.length)
+        return null;
+    return {
+        name: `${manifest.id}-verifier`,
+        supports(checkType) {
+            return manifest.checkTypes.includes(checkType);
+        },
+        async execute(input) {
+            const tool = await buildToolProvider(projectRoot, manifest).invoke({
+                action_type: `verify:${input.check_type}`,
+                work_item_id: input.work_item_id,
+                run_id: input.work_item_id,
+                attempt_id: `${input.work_item_id}-verify`,
+                params: {
+                    check_id: input.check_id,
+                    check_type: input.check_type,
+                    command: input.command,
+                    evidence_dir: input.evidence_dir,
+                },
+                workspace_root: input.workspace_root,
+            });
+            return {
+                verification_id: `vr-${manifest.id}-${input.check_id}`,
+                work_item_id: input.work_item_id,
+                check_id: input.check_id,
+                status: tool.success ? 'pass' : 'fail',
+                evidence_refs: tool.evidence_paths,
+                summary: tool.error || tool.output || null,
+            };
+        },
+    };
+}
+function createCapabilityPlugin(projectRoot, manifest) {
+    const verifierProvider = buildVerifierProvider(projectRoot, manifest);
+    return {
+        name: `capability:${manifest.id}`,
+        version: '0.0.0',
+        abi_version: plugin_manifest_1.CURRENT_ABI_VERSION,
+        toolProviders: [buildToolProvider(projectRoot, manifest)],
+        verifierProviders: verifierProvider ? [verifierProvider] : [],
+    };
+}
+function loadCapabilityPlugins(projectRoot) {
+    return loadCapabilityManifests(projectRoot).map((manifest) => createCapabilityPlugin(projectRoot, manifest));
+}

package/lib/runtime/plugins/capability-matrix.d.ts

@@ -1,10 +1,15 @@
 import type { PluginRegistry } from './plugin-registry';
 export type ApiStability = 'stable' | 'experimental' | 'deprecated';
 export interface ProviderCapabilityEntry {
+    plugin: string;
     name: string;
+    capability: string;
     provider_type: 'tool' | 'workspace' | 'verifier' | 'context';
     stability: ApiStability;
+    abi_version: string;
     since_abi_version: string;
+    supported: string[];
+    fallback_available: boolean;
     deprecated_in?: string;
     replacement?: string;
 }

package/lib/runtime/plugins/capability-matrix.js

@@ -9,26 +9,57 @@ exports.addEntry = addEntry;
 const plugin_manifest_1 = require("./plugin-manifest");
 function buildMatrix(registry) {
     const entries = [];
-    for (const plugin of registry.list()) {
-        const providers = plugin.providers ?? [];
-        for (const prov of providers) {
-            let provider_type;
-            if (prov.startsWith('tool:'))
-                provider_type = 'tool';
-            else if (prov.startsWith('workspace:'))
-                provider_type = 'workspace';
-            else if (prov.startsWith('verifier:'))
-                provider_type = 'verifier';
-            else if (prov.startsWith('context:'))
-                provider_type = 'context';
-            else
-                continue;
-            const name = prov.slice(prov.indexOf(':') + 1);
+    for (const plugin of registry.snapshot()) {
+        for (const provider of plugin.toolProviders) {
             entries.push({
-                name,
-                provider_type,
+                plugin: plugin.name,
+                name: provider.name,
+                capability: provider.name,
+                provider_type: 'tool',
                 stability: 'stable',
+                abi_version: plugin.abi_version ?? plugin_manifest_1.CURRENT_ABI_VERSION,
                 since_abi_version: plugin_manifest_1.CURRENT_ABI_VERSION,
+                supported: ['read_code', 'generate_patch', 'run_tests', 'collect_evidence', 'custom'].filter((action) => registry.toolProviderFor(action)?.name === provider.name),
+                fallback_available: true,
+            });
+        }
+        for (const provider of plugin.workspaceProviders) {
+            entries.push({
+                plugin: plugin.name,
+                name: provider.name,
+                capability: provider.name,
+                provider_type: 'workspace',
+                stability: 'stable',
+                abi_version: plugin.abi_version ?? plugin_manifest_1.CURRENT_ABI_VERSION,
+                since_abi_version: plugin_manifest_1.CURRENT_ABI_VERSION,
+                supported: [provider.name],
+                fallback_available: true,
+            });
+        }
+        for (const provider of plugin.verifierProviders) {
+            entries.push({
+                plugin: plugin.name,
+                name: provider.name,
+                capability: provider.name,
+                provider_type: 'verifier',
+                stability: 'stable',
+                abi_version: plugin.abi_version ?? plugin_manifest_1.CURRENT_ABI_VERSION,
+                since_abi_version: plugin_manifest_1.CURRENT_ABI_VERSION,
+                supported: ['unit', 'integration', 'smoke', 'policy', 'security', 'custom'].filter((checkType) => registry.verifierProviderFor(checkType)?.name === provider.name),
+                fallback_available: true,
+            });
+        }
+        for (const provider of plugin.contextProviders) {
+            entries.push({
+                plugin: plugin.name,
+                name: provider.name,
+                capability: provider.name,
+                provider_type: 'context',
+                stability: 'stable',
+                abi_version: plugin.abi_version ?? plugin_manifest_1.CURRENT_ABI_VERSION,
+                since_abi_version: plugin_manifest_1.CURRENT_ABI_VERSION,
+                supported: [provider.name],
+                fallback_available: false,
             });
         }
     }

package/lib/runtime/plugins/index.d.ts

@@ -2,3 +2,4 @@ export * from './plugin-abi';
 export * from './plugin-registry';
 export * from './plugin-manifest';
 export * from './capability-matrix';
+export * from './capability-adapter';

package/lib/runtime/plugins/index.js

@@ -18,3 +18,4 @@ __exportStar(require("./plugin-abi"), exports);
 __exportStar(require("./plugin-registry"), exports);
 __exportStar(require("./plugin-manifest"), exports);
 __exportStar(require("./capability-matrix"), exports);
+__exportStar(require("./capability-adapter"), exports);

package/lib/runtime/plugins/plugin-abi.d.ts

@@ -24,6 +24,7 @@ export interface ToolProvider {
 }
 export interface WorkspaceProvider extends WorkspaceManager {
     readonly name: string;
+    readonly isolation_level: 'shared' | 'isolated';
     supportsStrategy(strategy: string): boolean;
 }
 export interface VerificationInput {
@@ -67,6 +68,7 @@ export interface ContextProvider {
 export interface OxePlugin {
     readonly name: string;
     readonly version?: string;
+    readonly abi_version?: string;
     toolProviders?: ToolProvider[];
     workspaceProviders?: WorkspaceProvider[];
     verifierProviders?: VerifierProvider[];

package/lib/runtime/plugins/plugin-manifest.d.ts

@@ -1,5 +1,5 @@
 import type { OxePlugin } from './plugin-abi';
-export declare const CURRENT_ABI_VERSION = "1.0.0";
+export declare const CURRENT_ABI_VERSION = "1";
 export interface PluginManifest {
     name: string;
     version: string;

package/lib/runtime/plugins/plugin-manifest.js

@@ -5,7 +5,7 @@ exports.extractManifest = extractManifest;
 exports.validatePlugin = validatePlugin;
 exports.isAbiCompatible = isAbiCompatible;
 exports.sandboxInvoke = sandboxInvoke;
-exports.CURRENT_ABI_VERSION = '1.0.0';
+exports.CURRENT_ABI_VERSION = '1';
 function extractManifest(plugin) {
     const capabilities = [];
     if (plugin.toolProviders?.length)
@@ -21,7 +21,7 @@ function extractManifest(plugin) {
     return {
         name: plugin.name,
         version: plugin.version ?? '0.0.0',
-        abi_version: exports.CURRENT_ABI_VERSION,
+        abi_version: plugin.abi_version ?? exports.CURRENT_ABI_VERSION,
         capabilities,
         tool_action_types: plugin.toolProviders?.flatMap((p) => ['read_code', 'generate_patch', 'run_tests', 'collect_evidence', 'custom'].filter((t) => p.supports(t))) ?? [],
         workspace_strategies: plugin.workspaceProviders?.map((p) => p.name) ?? [],
@@ -39,6 +39,10 @@ function validatePlugin(plugin) {
     if (plugin.version && !/^\d+\.\d+\.\d+/.test(plugin.version)) {
         warnings.push(`Plugin version "${plugin.version}" does not follow semver`);
     }
+    const abiVersion = plugin.abi_version ?? exports.CURRENT_ABI_VERSION;
+    if (!isAbiCompatible(abiVersion)) {
+        errors.push(`Plugin ABI "${abiVersion}" is incompatible with runtime ABI "${exports.CURRENT_ABI_VERSION}"`);
+    }
     if (!plugin.toolProviders?.length &&
         !plugin.workspaceProviders?.length &&
         !plugin.verifierProviders?.length &&

package/lib/runtime/plugins/plugin-registry.d.ts

@@ -1,6 +1,8 @@
 import type { OxePlugin, ToolProvider, WorkspaceProvider, VerifierProvider, ContextProvider } from './plugin-abi';
+import { type CapabilityMatrix } from './capability-matrix';
 export declare class PluginRegistry {
     private plugins;
+    private loadErrors;
     register(plugin: OxePlugin): void;
     unregister(name: string): void;
     loadFromDirectory(dir: string): string[];
@@ -16,6 +18,50 @@ export declare class PluginRegistry {
         version?: string;
         providers: string[];
     }>;
+    registerProjectCapabilities(projectRoot: string): string[];
+    loadErrorsSnapshot(): string[];
+    clearLoadErrors(): void;
+    snapshot(): Array<{
+        name: string;
+        version?: string;
+        abi_version?: string;
+        toolProviders: Array<{
+            name: string;
+            kind: string;
+            idempotent: boolean;
+        }>;
+        workspaceProviders: Array<{
+            name: string;
+        }>;
+        verifierProviders: Array<{
+            name: string;
+        }>;
+        contextProviders: Array<{
+            name: string;
+        }>;
+    }>;
+    summary(): {
+        total_plugins: number;
+        tool_providers: number;
+        workspace_providers: number;
+        verifier_providers: number;
+        context_providers: number;
+        load_errors: number;
+        pluginsCount: number;
+        toolProviders: number;
+        workspaceProviders: number;
+        verifierProviders: number;
+        contextProviders: number;
+        loadErrors: number;
+        plugins: Array<{
+            name: string;
+            version?: string;
+            providers: string[];
+        }>;
+    };
+    capabilityMatrix(): CapabilityMatrix;
 }
 export declare function globalRegistry(): PluginRegistry;
 export declare function resetGlobalRegistry(): void;
+export declare function registrySummary(registry: PluginRegistry): ReturnType<PluginRegistry['summary']>;
+export declare function resolveCapabilityMatrix(registry: PluginRegistry): CapabilityMatrix;