sdd-agent-platform 0.4.0 → 0.4.2

package/node_modules/@sdd-agent-platform/core/src/router/routing.ts

@@ -11,11 +11,16 @@ import { buildAgentSkillRuntimeRegistry } from './runtime-registry.js';
 import { buildTeamModePolicy, resolveTeamModeActivation } from './team-mode.js';
 import { matchRoutingRules } from './routing-rules.js';
 import { chooseRecommendedProfile, deriveAllowedProfiles, toAgentProfileId } from './profile-resolution.js';
-import { adapterMappingForProfile, buildRejectedProfiles, buildToolPermissionSpec, modelPolicyForProfile, quarantineWarningsForSources, routeCategory, routeRegistrySources, selectRequiredSkillCapabilities } from './route-projection.js';
-import { lifecycleAutonomyCeilingFromDecision, ensureLifecycleRiskDecision } from '../orchestration/runtime.js';
+import { adapterMappingForProfile, buildAgentCapabilityRouteDecision, buildRejectedProfiles, buildToolPermissionSpec, modelPolicyForProfile, quarantineWarningsForSources, routeCategory, routeRegistrySources, selectRequiredSkillCapabilities } from './route-projection.js';
+import { lifecycleAutonomyCeilingFromDecision, resolveStageLocalLifecycleRiskDecision } from '../orchestration/runtime.js';
 import { taskAutonomyCeiling } from './risk-policy.js';
 import { evaluateTaskWorkflowGate } from '../risk.js';
+import { bindStageRouteForModel, recordStageRouteBindingProjection, type StageRouteBinding } from './stage-route-binding.js';
 import { nextDependencyTaskId, resolveTaskDependencyReadiness } from '../workflow-state/dependencies.js';
+import { selectLatestEligibleRunsByTask, type LatestEligibleRunSelection } from '../workflow-state/latest-eligible-run.js';
+import { readAllRunStates } from '../run-state/run-state.js';
+import type { RunState, RunStateTaskRuntime } from '../run-state/model.js';
+import { inspectAgentCapabilityCatalog } from '../registries/agent-capability-catalog.js';
 import type {
   AgentRouterDecision,
   TeamModePolicy
@@ -46,50 +51,65 @@ export async function routeSddTask(projectRoot: string, options: { taskId: strin
   const routeStart = Date.now();
   const routeStartedAt = new Date(routeStart).toISOString();
   const registry = await buildAgentSkillRuntimeRegistry(projectRoot);
+  const capabilityCatalog = await inspectAgentCapabilityCatalog(projectRoot);
   profileSpans.push(runtimeProfileSpan('agent_runtime_registry', routeStart));
   const branchStart = Date.now();
-  const branch = options.branch ?? (await resolveSddContext(projectRoot)).branch;
+  const context = await resolveSddContext(projectRoot, { branch: options.branch, branchSource: options.branch ? 'cli_option' : undefined });
+  const branch = context.partition;
   const model = await parseSddBranch(projectRoot, branch);
+  const binding = await bindStageRouteForModel(projectRoot, { branch, model, entry: 'sdd:do', userText: options.taskId });
+  await recordStageRouteBindingProjection(projectRoot, binding);
+  const routedTaskId = binding.status === 'bound' && binding.targetId ? binding.targetId : options.taskId;
+  const states = await readAllRunStates(projectRoot);
+  const runtimeByTask = latestRuntimeTaskStates(selectLatestEligibleRunsByTask({ states, model, partition: branch, currentGitBranch: context.currentGitBranch }), states);
   profileSpans.push(runtimeProfileSpan('document_parse', branchStart));
-  const cacheKey = routeCacheKey({ taskId: options.taskId, branch, agent: options.agent ?? null, teamModeActivation: resolveTeamModeActivation(options, 'auto'), approved: options.approved, documents: model.documents });
+  const cacheKey = routeCacheKey({ taskId: routedTaskId, branch, agent: options.agent ?? null, teamModeActivation: resolveTeamModeActivation(options, 'auto'), approved: options.approved, documents: model.documents });
   const cachedDecision = options.cache ? await readRouteCache<AgentRouterDecision>(projectRoot, cacheKey) : null;
   if (cachedDecision) {
     return {
       ...cachedDecision,
+      taskId: routedTaskId,
+      stageRouteBinding: binding,
       cache: { contract: ROUTE_CACHE_CONTRACT_VERSION, key: cacheKey, status: 'hit', source: 'content_addressed_derived_route', authoritative: false },
       profile: options.profile ? [...(cachedDecision.profile ?? []), runtimeProfileSpan('route_total', routeStart, routeStartedAt)] : undefined
     };
   }
   const computeStart = Date.now();
-  const inspected = inspectSddTask(model, options.taskId);
+  const inspected = inspectSddTask(model, routedTaskId);
   const task = inspected.task;
   const blockingGap = inspected.gaps.find((gap) => gap.severity === 'blocking');
   const matchedRules = task && !blockingGap ? matchRoutingRules(task, registry) : [];
   const profileSelection = task && !blockingGap ? deriveAllowedProfiles(task, registry, matchedRules) : { profiles: [], resolvedAliases: [] };
   const delegatedProfile = task && !blockingGap && options.agent ? toAgentProfileId(options.agent, registry) : null;
   const allowedProfiles = delegatedProfile && !profileSelection.profiles.includes(delegatedProfile) ? [...profileSelection.profiles, delegatedProfile] : profileSelection.profiles;
-  const riskDecision = task ? await ensureLifecycleRiskDecision(projectRoot, model, { branch, task }) : null;
-  const workflowGate = evaluateTaskWorkflowGate({ task, taskId: options.taskId, riskDecision, approved: options.approved });
-  const lifecycleBlockedReason = workflowGate.blocksRoute
-    ? workflowGate.primaryReason
-    : null;
-  const dependencyReadiness = task ? resolveTaskDependencyReadiness(model, options.taskId) : null;
+  const lifecycle = task && binding.status === 'bound' ? await resolveStageLocalLifecycleRiskDecision(projectRoot, model, { branch }) : null;
+  const riskDecision = lifecycle?.decision ?? null;
+  const gateRiskDecision = lifecycle && lifecycle.status !== 'fresh' ? lifecycle.decision : null;
+  const workflowGate = evaluateTaskWorkflowGate({ task, taskId: routedTaskId, riskDecision: gateRiskDecision, approved: options.approved });
+  const lifecycleBlockedReason = lifecycle && lifecycle.status !== 'fresh'
+    ? lifecycle.reasons[0] ?? workflowGate.primaryReason
+    : workflowGate.blocksRoute
+      ? workflowGate.primaryReason
+      : null;
+  const bindingBlockedReason = binding.status === 'bound' ? null : binding.reasons[0] ?? 'Stage route binding did not resolve to an executable target.';
+  const dependencyReadiness = task ? resolveTaskDependencyReadiness(model, routedTaskId, { runtimeByTask }) : null;
   const dependencyBlockedReason = dependencyReadiness?.blockingReasons[0] ?? null;
-  const dependencyTaskId = task ? nextDependencyTaskId(model, options.taskId) : null;
+  const dependencyTaskId = task ? nextDependencyTaskId(model, routedTaskId, { runtimeByTask }) : null;
   const taskRecommendedProfile = task && !blockingGap && !dependencyBlockedReason && !lifecycleBlockedReason ? chooseRecommendedProfile(task, allowedProfiles, registry, matchedRules) : null;
   const recommendedProfile = dependencyBlockedReason || lifecycleBlockedReason ? null : delegatedProfile ?? taskRecommendedProfile;
   const category = task ? routeCategory(task, blockingGap, allowedProfiles, matchedRules) : 'blocked';
-  const autonomyCeiling = riskDecision ? lifecycleAutonomyCeilingFromDecision(riskDecision) : task ? taskAutonomyCeiling(task) : 'research_before_implementation';
+  const autonomyCeiling = gateRiskDecision ? lifecycleAutonomyCeilingFromDecision(gateRiskDecision) : task ? taskAutonomyCeiling(task) : 'research_before_implementation';
   const requiredCapabilities = task && recommendedProfile ? selectRequiredSkillCapabilities(task, recommendedProfile, registry, matchedRules) : [];
   const sourceCapability = requiredCapabilities[0] ?? null;
   const sourceCapabilityContract = sourceCapability ? registry.skillCapabilities.find((capability) => capability.id === sourceCapability) ?? null : null;
-  const blockedReason = !task ? `Task ${options.taskId} was not found.` : blockingGap?.message ?? dependencyBlockedReason ?? lifecycleBlockedReason;
+  const blockedReason = bindingBlockedReason ?? (!task ? `Task ${routedTaskId} was not found.` : blockingGap?.message ?? dependencyBlockedReason ?? lifecycleBlockedReason);
   const routedCategory = blockedReason ? 'blocked' : category;
   const registrySources = routeRegistrySources(registry, recommendedProfile, requiredCapabilities);
   const adapterMapping = recommendedProfile ? adapterMappingForProfile(registry, recommendedProfile) : null;
+  const capabilityDecision = buildAgentCapabilityRouteDecision(task ?? null, routedCategory, autonomyCeiling, registry, capabilityCatalog);
   const decision: AgentRouterDecision = {
     version: AGENT_ROUTER_CONTRACT_VERSION,
-    taskId: options.taskId,
+    taskId: routedTaskId,
     branch,
     category: routedCategory,
     recommendedProfile,
@@ -116,7 +136,9 @@ export async function routeSddTask(projectRoot: string, options: { taskId: strin
     primaryReason: workflowGate.primaryReason,
     requiredArtifacts: task?.requiredArtifacts ?? [],
     blockedReason,
-    nextAction: routeNextAction({ taskId: options.taskId, taskExists: Boolean(task), hasBlockingGap: Boolean(blockingGap), dependencyTaskId, workflowGateNextAction: workflowGate.nextAction, recommendedProfile, requiredCapabilities }),
+    nextAction: routeNextAction({ taskId: routedTaskId, taskExists: Boolean(task), bindingNextAction: stageBindingNextAction(binding), hasBlockingGap: Boolean(blockingGap), dependencyTaskId, blockedReason, workflowGateNextAction: workflowGate.nextAction, recommendedProfile, requiredCapabilities }),
+    stageRouteBinding: binding,
+    capabilityDecision,
     registrySources,
     resolvedAliases: profileSelection.resolvedAliases,
     routingRuleHits: matchedRules.map((rule) => rule.id),
@@ -135,15 +157,36 @@ export async function routeSddTask(projectRoot: string, options: { taskId: strin
   return decision;
 }
 
+function latestRuntimeTaskStates(selections: LatestEligibleRunSelection[], states: RunState[]): Map<string, RunStateTaskRuntime> {
+  const stateByRunId = new Map(states.map((state) => [state.runId, state]));
+  const result = new Map<string, RunStateTaskRuntime>();
+  for (const selection of selections) {
+    const selected = selection.selected;
+    if (!selected) {
+      continue;
+    }
+    const taskState = stateByRunId.get(selected.runId)?.tasks[selected.taskId];
+    if (taskState) {
+      result.set(selected.taskId, taskState);
+    }
+  }
+  return result;
+}
+
 function routeNextAction(input: {
   taskId: string;
   taskExists: boolean;
+  bindingNextAction: string | null;
   hasBlockingGap: boolean;
   dependencyTaskId: string | null;
+  blockedReason: string | null;
   workflowGateNextAction: string;
   recommendedProfile: string | null;
   requiredCapabilities: string[];
 }): string {
+  if (input.bindingNextAction) {
+    return input.bindingNextAction;
+  }
   if (!input.taskExists) {
     return `Create or restore task ${input.taskId} before routing.`;
   }
@@ -151,7 +194,9 @@ function routeNextAction(input: {
     return `Fix task gaps before routing ${input.taskId}.`;
   }
   if (input.dependencyTaskId) {
-    return `Complete and sync-back ${input.dependencyTaskId} before routing ${input.taskId}.`;
+    return input.blockedReason?.includes('has not passed required verification')
+      ? `Run sdd test task-${input.dependencyTaskId} before routing ${input.taskId}.`
+      : `Run sdd do task ${input.dependencyTaskId} before routing ${input.taskId}.`;
   }
   if (input.workflowGateNextAction) {
     return input.workflowGateNextAction;
@@ -160,4 +205,20 @@ function routeNextAction(input: {
     return `Use ${input.recommendedProfile} with ${input.requiredCapabilities.join(',') || 'no extra capability'} and preserve required artifacts before verify.`;
   }
   return `Declare a routable profile before routing ${input.taskId}.`;
+}
+
+function stageBindingNextAction(binding: StageRouteBinding): string | null {
+  if (binding.status === 'bound') {
+    return null;
+  }
+  if (binding.nextAction === 'route_to_lifecycle_decision') {
+    return 'Run /sdd or /sdd:spec to create or refresh the lifecycle decision, then return to /sdd:do.';
+  }
+  if (binding.nextAction === 'ask_clarification') {
+    return binding.reasons[0] ?? 'Clarify the target task id or task title before running /sdd:do.';
+  }
+  if (binding.nextAction === 'runtime_repair_required') {
+    return binding.reasons[0] ?? 'Repair stale upstream runtime state before running /sdd:do.';
+  }
+  return binding.reasons[0] ?? 'Stage route binding blocked this local entry.';
 }

package/node_modules/@sdd-agent-platform/core/src/router/runtime-import.ts

@@ -0,0 +1,453 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { getProjectConfigPath } from '../runtime-paths.js';
+import { AGENT_SKILL_TEAM_RUNTIME_CONTRACT_VERSION, CAPABILITY_SOURCE_CATALOG_VERSION } from '../contracts.js';
+import { parseAgentRuntimeConfig } from './agent-runtime-config.js';
+import { buildAgentSkillRuntimeRegistry, mergeAgentSkillRuntimeRegistry } from './runtime-registry.js';
+import type {
+  AgentRuntimeAdapterMapping,
+  AgentRuntimeRoutingRule,
+  CapabilitySourceAllowedEvidenceType,
+  CapabilitySourceCatalogEntry,
+  CapabilitySourceKind,
+  CapabilitySourceQuarantineStatus,
+  ProjectAgentRuntimeConfig,
+  SkillCapabilityContract,
+  SkillCapabilityEvidenceType,
+  SkillCapabilitySource
+} from './agent-runtime.js';
+
+export type RuntimeSkillImportSource = 'project' | 'user_global' | 'external';
+export type RuntimeSkillImportStatus = 'created' | 'updated' | 'unchanged' | 'blocked' | 'dry_run';
+
+export interface RuntimeSkillImportRequest {
+  capabilityId: string;
+  source: RuntimeSkillImportSource;
+  sourceRef: string;
+  sourceId?: string;
+  name?: string;
+  domains: string[];
+  stages: string[];
+  attribution?: string;
+  allowedEvidenceTypes?: CapabilitySourceAllowedEvidenceType[];
+  dryRun?: boolean;
+  force?: boolean;
+}
+
+export interface RuntimeSkillImportResult {
+  status: RuntimeSkillImportStatus;
+  configPath: string;
+  capabilityId: string;
+  sourceId: string;
+  source: RuntimeSkillImportSource;
+  written: boolean;
+  issues: string[];
+  preview: string | null;
+  nextCommands: string[];
+}
+
+const FORBIDDEN_AUTHORITY = [
+  'lifecycle gate authority',
+  'stage completion decision',
+  'truth-alignment approval',
+  'ship readiness pass',
+  'permission escalation'
+];
+
+export async function importRuntimeSkillCapability(projectRoot: string, request: RuntimeSkillImportRequest): Promise<RuntimeSkillImportResult> {
+  const normalized = normalizeRequest(request);
+  const configPath = getProjectConfigPath(projectRoot);
+  const inputIssues = validateNormalizedRequest(normalized);
+  if (inputIssues.length > 0) {
+    return blockedResult(configPath, normalized, inputIssues);
+  }
+  const currentRegistry = await buildAgentSkillRuntimeRegistry(projectRoot);
+  const builtInConflict = currentRegistry.registrySources.find((source) => (source.kind === 'skill_capability' && source.id === normalized.capabilityId) || (source.kind === 'capability_source' && source.id === normalized.sourceId));
+  if (builtInConflict && builtInConflict.origin !== 'project_config') {
+    return blockedResult(configPath, normalized, [`${builtInConflict.kind} ${builtInConflict.id} is ${builtInConflict.origin} and cannot be overwritten.`]);
+  }
+  const raw = await readFile(configPath, 'utf8');
+  const existing = parseAgentRuntimeConfig(raw) ?? emptyRuntimeConfig();
+  const source = buildImportedCapabilitySource(normalized);
+  const capability = buildImportedSkillCapability(normalized);
+  const merged = mergeImportedRuntimeConfig(existing, source, capability, normalized.force ?? false);
+  if (merged.issues.length > 0) {
+    return blockedResult(configPath, normalized, merged.issues);
+  }
+  const registry = mergeAgentSkillRuntimeRegistry(merged.config);
+  if (registry.issues.length > 0) {
+    return blockedResult(configPath, normalized, registry.issues.map((issue) => `${issue.field}: ${issue.message}`));
+  }
+  const renderedSection = renderAgentRuntimeSection(merged.config);
+  const nextRaw = upsertAgentRuntimeSection(raw, renderedSection);
+  if (nextRaw === raw) {
+    return result(configPath, normalized, 'unchanged', false, [], null);
+  }
+  if (normalized.dryRun) {
+    return result(configPath, normalized, 'dry_run', false, [], renderedSection);
+  }
+  await writeFile(configPath, nextRaw, 'utf8');
+  return result(configPath, normalized, merged.status, true, [], null);
+}
+
+interface NormalizedImportRequest extends RuntimeSkillImportRequest {
+  capabilityId: string;
+  source: RuntimeSkillImportSource;
+  sourceRef: string;
+  sourceId: string;
+  name: string;
+  domains: string[];
+  stages: string[];
+  attribution: string;
+  allowedEvidenceTypes: CapabilitySourceAllowedEvidenceType[];
+}
+
+function normalizeRequest(request: RuntimeSkillImportRequest): NormalizedImportRequest {
+  const capabilityId = request.capabilityId.trim();
+  const sourceRef = request.sourceRef.trim();
+  const sourceId = (request.sourceId?.trim() || `${sanitizeId(capabilityId)}_source`);
+  const name = request.name?.trim() || capabilityId;
+  const domains = uniqueNonEmpty(request.domains);
+  const stages = uniqueNonEmpty(request.stages);
+  const allowedEvidenceTypes = request.allowedEvidenceTypes && request.allowedEvidenceTypes.length > 0 ? request.allowedEvidenceTypes : defaultAllowedEvidenceTypes(request.source);
+  return {
+    ...request,
+    capabilityId,
+    sourceRef,
+    sourceId,
+    name,
+    domains,
+    stages,
+    attribution: request.attribution?.trim() || `${request.source} skill import`,
+    allowedEvidenceTypes
+  };
+}
+
+function validateNormalizedRequest(request: NormalizedImportRequest): string[] {
+  const issues: string[] = [];
+  if (!request.capabilityId) {
+    issues.push('capability_id is required.');
+  }
+  if (!request.sourceRef) {
+    issues.push('--source-ref is required.');
+  }
+  if (!request.sourceId) {
+    issues.push('--source-id or derived source id is required.');
+  }
+  if (request.domains.length === 0) {
+    issues.push('At least one --domain value is required.');
+  }
+  if (request.stages.length === 0) {
+    issues.push('At least one --stage value is required.');
+  }
+  if (request.allowedEvidenceTypes.length === 0) {
+    issues.push('At least one allowed evidence type is required.');
+  }
+  return issues;
+}
+
+function buildImportedCapabilitySource(request: NormalizedImportRequest): CapabilitySourceCatalogEntry {
+  const quarantineRequired = request.source !== 'project';
+  return {
+    version: CAPABILITY_SOURCE_CATALOG_VERSION,
+    id: request.sourceId,
+    name: `${request.name} source`,
+    kind: sourceKind(request.source),
+    sourceRef: request.sourceRef,
+    reuseDecision: 'adapt_via_host_adapter',
+    quarantineRequired,
+    quarantineStatus: quarantineRequired ? 'required' : 'not_required',
+    permissionModel: permissionModel(request.source),
+    provenanceRequirements: provenanceRequirements(request.source),
+    hostCompatibility: ['claude-code:supported'],
+    allowedEvidenceTypes: request.allowedEvidenceTypes,
+    forbiddenAuthority: FORBIDDEN_AUTHORITY,
+    allowedUse: 'declarative capability metadata and advisory evidence only',
+    attribution: request.attribution,
+    rationale: `${request.source} skill imported into SDD runtime registry as non-authoritative capability metadata.`
+  };
+}
+
+function buildImportedSkillCapability(request: NormalizedImportRequest): SkillCapabilityContract {
+  return {
+    version: AGENT_SKILL_TEAM_RUNTIME_CONTRACT_VERSION,
+    id: request.capabilityId,
+    name: request.name,
+    kind: request.source === 'external' ? 'external_pattern' : 'skill',
+    source: skillSource(request.source),
+    sourceRef: request.sourceId,
+    capabilityDomain: request.domains,
+    allowedStages: request.stages,
+    requiredRiskCeiling: 'research_before_implementation',
+    evidenceType: evidenceType(request.source),
+    reuseDecision: 'adapt_via_host_adapter',
+    buildExceptionReason: null
+  };
+}
+
+function mergeImportedRuntimeConfig(existing: ProjectAgentRuntimeConfig, source: CapabilitySourceCatalogEntry, capability: SkillCapabilityContract, force: boolean): { config: ProjectAgentRuntimeConfig; status: 'created' | 'updated'; issues: string[] } {
+  const issues: string[] = [];
+  const sourceIndex = existing.capabilitySources.findIndex((entry) => entry.id === source.id);
+  const capabilityIndex = existing.skillCapabilities.findIndex((entry) => entry.id === capability.id);
+  if (sourceIndex >= 0 && !sameObject(existing.capabilitySources[sourceIndex], source) && !force) {
+    issues.push(`Capability source ${source.id} already exists; use --force to update project-config entries.`);
+  }
+  if (capabilityIndex >= 0 && !sameObject(existing.skillCapabilities[capabilityIndex], capability) && !force) {
+    issues.push(`Skill capability ${capability.id} already exists; use --force to update project-config entries.`);
+  }
+  if (issues.length > 0) {
+    return { config: existing, status: 'created', issues };
+  }
+  const capabilitySources = [...existing.capabilitySources];
+  const skillCapabilities = [...existing.skillCapabilities];
+  const status = sourceIndex >= 0 || capabilityIndex >= 0 ? 'updated' : 'created';
+  if (sourceIndex >= 0) {
+    capabilitySources[sourceIndex] = source;
+  } else {
+    capabilitySources.push(source);
+  }
+  if (capabilityIndex >= 0) {
+    skillCapabilities[capabilityIndex] = capability;
+  } else {
+    skillCapabilities.push(capability);
+  }
+  return {
+    config: {
+      profiles: [...existing.profiles],
+      skillCapabilities,
+      capabilitySources,
+      aliases: { ...existing.aliases },
+      routingRules: [...existing.routingRules],
+      adapterMappings: [...existing.adapterMappings]
+    },
+    status,
+    issues: []
+  };
+}
+
+function renderAgentRuntimeSection(config: ProjectAgentRuntimeConfig): string {
+  const lines = ['agent_runtime:'];
+  renderProfiles(lines, config.profiles);
+  renderCapabilitySources(lines, config.capabilitySources);
+  renderSkillCapabilities(lines, config.skillCapabilities);
+  renderAliases(lines, config.aliases);
+  renderRoutingRules(lines, config.routingRules);
+  renderAdapterMappings(lines, config.adapterMappings);
+  return `${lines.join('\n')}\n`;
+}
+
+function renderProfiles(lines: string[], profiles: ProjectAgentRuntimeConfig['profiles']): void {
+  lines.push('  profiles:');
+  for (const profile of profiles) {
+    lines.push(`    - id: ${yamlScalar(profile.id)}`);
+    renderList(lines, 'stage_scope', profile.stageScope, 6);
+    lines.push(`      risk_ceiling: ${profile.riskCeiling}`);
+    lines.push(`      default_autonomy: ${profile.defaultAutonomy}`);
+    renderList(lines, 'required_artifacts', profile.requiredArtifacts, 6);
+    renderList(lines, 'tool_scope', profile.toolScope, 6);
+    lines.push(`      model_policy_id: ${yamlScalar(profile.modelPolicyId)}`);
+    renderList(lines, 'host_capability_requirements', profile.hostCapabilityRequirements, 6);
+    renderList(lines, 'boundaries', profile.boundaries, 6);
+  }
+}
+
+function renderCapabilitySources(lines: string[], sources: CapabilitySourceCatalogEntry[]): void {
+  lines.push('  capability_sources:');
+  for (const source of sources) {
+    lines.push(`    - id: ${yamlScalar(source.id)}`);
+    lines.push(`      name: ${yamlScalar(source.name)}`);
+    lines.push(`      kind: ${source.kind}`);
+    lines.push(`      source_ref: ${yamlScalar(source.sourceRef)}`);
+    lines.push(`      reuse_decision: ${source.reuseDecision}`);
+    lines.push(`      quarantine_required: ${source.quarantineRequired}`);
+    lines.push(`      quarantine_status: ${source.quarantineStatus}`);
+    renderList(lines, 'permission_model', source.permissionModel, 6);
+    renderList(lines, 'provenance_requirements', source.provenanceRequirements, 6);
+    renderList(lines, 'host_compatibility', source.hostCompatibility, 6);
+    renderList(lines, 'allowed_evidence_types', source.allowedEvidenceTypes, 6);
+    renderList(lines, 'forbidden_authority', source.forbiddenAuthority, 6);
+    lines.push(`      allowed_use: ${yamlScalar(source.allowedUse)}`);
+    lines.push(`      attribution: ${yamlScalar(source.attribution)}`);
+    lines.push(`      rationale: ${yamlScalar(source.rationale)}`);
+  }
+}
+
+function renderSkillCapabilities(lines: string[], capabilities: SkillCapabilityContract[]): void {
+  lines.push('  skill_capabilities:');
+  for (const capability of capabilities) {
+    lines.push(`    - id: ${yamlScalar(capability.id)}`);
+    lines.push(`      name: ${yamlScalar(capability.name)}`);
+    lines.push(`      kind: ${capability.kind}`);
+    lines.push(`      source: ${capability.source}`);
+    lines.push(`      source_ref: ${yamlScalar(capability.sourceRef)}`);
+    renderList(lines, 'capability_domain', capability.capabilityDomain, 6);
+    renderList(lines, 'allowed_stages', capability.allowedStages, 6);
+    lines.push(`      required_risk_ceiling: ${capability.requiredRiskCeiling}`);
+    lines.push(`      evidence_type: ${capability.evidenceType}`);
+    lines.push(`      reuse_decision: ${capability.reuseDecision}`);
+    if (capability.buildExceptionReason) {
+      lines.push(`      build_exception_reason: ${yamlScalar(capability.buildExceptionReason)}`);
+    }
+  }
+}
+
+function renderAliases(lines: string[], aliases: Record<string, string>): void {
+  lines.push('  aliases:');
+  for (const [alias, target] of Object.entries(aliases)) {
+    lines.push(`    ${yamlScalar(alias)}: ${yamlScalar(target)}`);
+  }
+}
+
+function renderRoutingRules(lines: string[], rules: AgentRuntimeRoutingRule[]): void {
+  lines.push('  routing_rules:');
+  for (const rule of rules) {
+    lines.push(`    - id: ${yamlScalar(rule.id)}`);
+    lines.push('      when:');
+    renderList(lines, 'keywords', rule.when.keywords, 8);
+    renderList(lines, 'affected_file_globs', rule.when.affectedFileGlobs, 8);
+    lines.push(`      prefer_profile: ${yamlScalar(rule.preferProfile)}`);
+    renderList(lines, 'require_capabilities', rule.requireCapabilities, 6);
+    if (rule.category) {
+      lines.push(`      category: ${rule.category}`);
+    }
+  }
+}
+
+function renderAdapterMappings(lines: string[], mappings: AgentRuntimeAdapterMapping[]): void {
+  lines.push('  adapter_mappings:');
+  for (const mapping of mappings) {
+    lines.push(`    - profile: ${yamlScalar(mapping.profile)}`);
+    lines.push(`      host_adapter: ${yamlScalar(mapping.hostAdapter)}`);
+    lines.push(`      projection: ${yamlScalar(mapping.projection)}`);
+    lines.push(`      permission_policy: ${yamlScalar(mapping.permissionPolicy)}`);
+  }
+}
+
+function renderList(lines: string[], key: string, values: string[], indent: number): void {
+  const prefix = ' '.repeat(indent);
+  lines.push(`${prefix}${key}:`);
+  for (const value of values) {
+    lines.push(`${prefix}  - ${yamlScalar(value)}`);
+  }
+}
+
+function upsertAgentRuntimeSection(raw: string, renderedSection: string): string {
+  const lines = raw.split(/\r?\n/);
+  const sectionIndex = lines.findIndex((line) => line.trim() === 'agent_runtime:' && countIndent(line) === 0);
+  if (sectionIndex < 0) {
+    return `${raw.trimEnd()}\n${renderedSection}`;
+  }
+  let endIndex = lines.length;
+  for (let index = sectionIndex + 1; index < lines.length; index += 1) {
+    if (lines[index].trim() && countIndent(lines[index]) === 0) {
+      endIndex = index;
+      break;
+    }
+  }
+  const before = lines.slice(0, sectionIndex).join('\n').trimEnd();
+  const after = lines.slice(endIndex).join('\n').trimStart();
+  return `${before}\n${renderedSection}${after ? `${after}\n` : ''}`;
+}
+
+function emptyRuntimeConfig(): ProjectAgentRuntimeConfig {
+  return {
+    profiles: [],
+    skillCapabilities: [],
+    capabilitySources: [],
+    aliases: {},
+    routingRules: [],
+    adapterMappings: []
+  };
+}
+
+function result(configPath: string, request: NormalizedImportRequest, status: RuntimeSkillImportStatus, written: boolean, issues: string[], preview: string | null): RuntimeSkillImportResult {
+  return {
+    status,
+    configPath,
+    capabilityId: request.capabilityId,
+    sourceId: request.sourceId,
+    source: request.source,
+    written,
+    issues,
+    preview,
+    nextCommands: [
+      `sdd skill-capabilities inspect ${request.capabilityId}`,
+      `sdd capability-sources inspect ${request.sourceId}`,
+      'sdd agent-runtime validate'
+    ]
+  };
+}
+
+function blockedResult(configPath: string, request: NormalizedImportRequest, issues: string[]): RuntimeSkillImportResult {
+  return result(configPath, request, 'blocked', false, issues, null);
+}
+
+function sourceKind(source: RuntimeSkillImportSource): CapabilitySourceKind {
+  if (source === 'project') {
+    return 'project_material';
+  }
+  if (source === 'user_global') {
+    return 'user_global_material';
+  }
+  return 'open_source_material';
+}
+
+function skillSource(source: RuntimeSkillImportSource): SkillCapabilitySource {
+  if (source === 'project') {
+    return 'project';
+  }
+  if (source === 'user_global') {
+    return 'user_global';
+  }
+  return 'open_source';
+}
+
+function evidenceType(source: RuntimeSkillImportSource): SkillCapabilityEvidenceType {
+  return source === 'project' ? 'artifact' : 'external_source';
+}
+
+function defaultAllowedEvidenceTypes(source: RuntimeSkillImportSource): CapabilitySourceAllowedEvidenceType[] {
+  return source === 'project' ? ['candidate_evidence'] : ['candidate_evidence', 'external_reference'];
+}
+
+function permissionModel(source: RuntimeSkillImportSource): string[] {
+  if (source === 'project') {
+    return ['project-scoped material', 'no direct workflow authority'];
+  }
+  if (source === 'user_global') {
+    return ['user-global material', 'no direct prompt import', 'no write authority'];
+  }
+  return ['external material quarantine', 'metadata extraction only before approval', 'no direct execution'];
+}
+
+function provenanceRequirements(source: RuntimeSkillImportSource): string[] {
+  if (source === 'project') {
+    return ['repository path', 'commit tracked source'];
+  }
+  if (source === 'user_global') {
+    return ['local user-global skill path', 'source attribution', 'quarantine review'];
+  }
+  return ['source repository or path', 'license/source attribution', 'quarantine review'];
+}
+
+function sanitizeId(value: string): string {
+  return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '') || 'imported_skill';
+}
+
+function uniqueNonEmpty(values: string[]): string[] {
+  return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
+}
+
+function sameObject(left: unknown, right: unknown): boolean {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+function yamlScalar(value: string): string {
+  if (/^[A-Za-z0-9_./@-]+$/.test(value)) {
+    return value;
+  }
+  return `'${value.replace(/'/g, "''")}'`;
+}
+
+function countIndent(value: string): number {
+  return value.length - value.trimStart().length;
+}

package/node_modules/@sdd-agent-platform/core/src/router/runtime-inspection.ts

@@ -80,13 +80,17 @@ export async function inspectExternalAgentPackImport(projectRoot: string, source
       reason: 'Unknown external source cannot be routed.'
     };
   }
-  if (source.reuseDecision === 'avoid') {
+  if (source.reuseDecision === 'avoid' || source.quarantineStatus === 'denied') {
     return {
       version: EXTERNAL_AGENT_PACK_IMPORT_POLICY_VERSION,
       sourceId,
       status: 'denied',
-      checks: [{ check: 'reuse_decision', status: 'fail', evidence: `${source.id} is marked avoid for Phase 6 core runtime.` }],
-      mappingResult: 'future adapter only',
+      checks: [
+        { check: 'reuse_decision', status: source.reuseDecision === 'avoid' ? 'fail' : 'warn', evidence: `${source.id} reuse=${source.reuseDecision}.` },
+        { check: 'quarantine_status', status: source.quarantineStatus === 'denied' ? 'fail' : 'warn', evidence: `${source.id} quarantine_status=${source.quarantineStatus}.` },
+        { check: 'host_compatibility', status: source.hostCompatibility.some((item) => item.includes('unsupported')) ? 'fail' : 'warn', evidence: source.hostCompatibility.join(',') || 'not declared' }
+      ],
+      mappingResult: 'future adapter or unsupported source only',
       allowedProfiles: [],
       riskCeiling: 'research_before_implementation',
       reason: source.rationale
@@ -98,11 +102,14 @@ export async function inspectExternalAgentPackImport(projectRoot: string, source
       { check: 'hidden_unicode_scan', status: 'not_run', evidence: 'External material has not been scanned for hidden Unicode.' },
       { check: 'secret_scan', status: 'not_run', evidence: 'External material has not been scanned for secrets.' },
       { check: 'dangerous_command_scan', status: 'not_run', evidence: 'External material has not been scanned for dangerous commands.' },
+      { check: 'permission_model', status: source.permissionModel.length > 0 ? 'pass' : 'fail', evidence: source.permissionModel.join(',') || 'No permission model declared.' },
+      { check: 'provenance_requirements', status: source.provenanceRequirements.length > 0 ? 'pass' : 'fail', evidence: source.provenanceRequirements.join(',') || 'No provenance requirements declared.' },
       { check: 'sdd_frontmatter_mapping', status: 'not_run', evidence: 'External material has not been mapped to SDD capability/profile fields.' }
     ]
     : [
       { check: 'source_catalog', status: 'pass', evidence: `${source.id} is cataloged as ${source.reuseDecision}.` },
-      { check: 'quarantine_required', status: 'pass', evidence: 'This source is a native capability or mechanism reference, not an imported prompt pack.' }
+      { check: 'quarantine_required', status: 'pass', evidence: 'This source is a native capability or mechanism reference, not an imported prompt pack.' },
+      { check: 'provenance_requirements', status: source.provenanceRequirements.length > 0 ? 'pass' : 'fail', evidence: source.provenanceRequirements.join(',') || 'No provenance requirements declared.' }
     ];
   return {
     version: EXTERNAL_AGENT_PACK_IMPORT_POLICY_VERSION,