sdd-agent-platform 0.4.2 → 0.5.0

package/node_modules/@sdd-agent-platform/core/src/router/runtime-inspection.ts

@@ -1,124 +1,124 @@
-import {
-  AGENT_SKILL_TEAM_RUNTIME_CONTRACT_VERSION,
-  CAPABILITY_SOURCE_CATALOG_VERSION,
-  EXTERNAL_AGENT_PACK_IMPORT_POLICY_VERSION
-} from '../contracts.js';
-import {
-  BUILT_IN_EVIDENCE_INGESTION_CONTRACT,
-  BUILT_IN_HOST_ADAPTER_CONTRACT,
-  buildAgentSkillRuntimeRegistry
-} from './runtime-registry.js';
-import { buildTeamModePolicy } from './team-mode.js';
-import type {
-  AgentSkillTeamRuntimeInspection,
-  CapabilitySourceCatalog,
-  CapabilitySourceCatalogEntry,
-  ExternalAgentPackImportCheck,
-  ExternalAgentPackImportInspection,
-  SkillCapabilityContract,
-  SkillCapabilityRegistry
-} from './agent-runtime.js';
-
-export async function inspectAgentSkillTeamRuntime(projectRoot: string): Promise<AgentSkillTeamRuntimeInspection> {
-  const registry = await buildAgentSkillRuntimeRegistry(projectRoot);
-  return {
-    version: AGENT_SKILL_TEAM_RUNTIME_CONTRACT_VERSION,
-    profiles: registry.profiles,
-    skillCapabilities: registry.skillCapabilities,
-    capabilitySources: registry.capabilitySources,
-    hostAdapter: BUILT_IN_HOST_ADAPTER_CONTRACT,
-    evidenceIngestion: BUILT_IN_EVIDENCE_INGESTION_CONTRACT,
-    teamMode: buildTeamModePolicy({ activation: 'off' }),
-    reusePolicy: 'reuse_direct native host/MCP capabilities first; external prompt packs are quarantined material sources and projected only as structured metadata.',
-    registrySources: registry.registrySources,
-    aliases: registry.aliases,
-    routingRules: registry.routingRules,
-    adapterMappings: registry.adapterMappings
-  };
-}
-
-export async function listSkillCapabilities(projectRoot: string): Promise<SkillCapabilityRegistry> {
-  const registry = await buildAgentSkillRuntimeRegistry(projectRoot);
-  return {
-    version: AGENT_SKILL_TEAM_RUNTIME_CONTRACT_VERSION,
-    capabilities: registry.skillCapabilities,
-    registrySources: registry.registrySources.filter((source) => source.kind === 'skill_capability')
-  };
-}
-
-export async function inspectSkillCapability(projectRoot: string, capabilityId: string): Promise<SkillCapabilityContract | null> {
-  const registry = await listSkillCapabilities(projectRoot);
-  return registry.capabilities.find((capability) => capability.id === capabilityId) ?? null;
-}
-
-export async function listCapabilitySources(projectRoot: string): Promise<CapabilitySourceCatalog> {
-  const registry = await buildAgentSkillRuntimeRegistry(projectRoot);
-  return {
-    version: CAPABILITY_SOURCE_CATALOG_VERSION,
-    sources: registry.capabilitySources,
-    registrySources: registry.registrySources.filter((source) => source.kind === 'capability_source')
-  };
-}
-
-export async function inspectCapabilitySource(projectRoot: string, sourceId: string): Promise<CapabilitySourceCatalogEntry | null> {
-  const catalog = await listCapabilitySources(projectRoot);
-  return catalog.sources.find((source) => source.id === sourceId) ?? null;
-}
-
-export async function inspectExternalAgentPackImport(projectRoot: string, sourceId: string): Promise<ExternalAgentPackImportInspection> {
-  const registry = await buildAgentSkillRuntimeRegistry(projectRoot);
-  const source = registry.capabilitySources.find((entry) => entry.id === sourceId);
-  if (!source) {
-    return {
-      version: EXTERNAL_AGENT_PACK_IMPORT_POLICY_VERSION,
-      sourceId,
-      status: 'denied',
-      checks: [{ check: 'source_catalog', status: 'fail', evidence: 'Source id is not present in CapabilitySourceCatalog.' }],
-      mappingResult: 'no SDD mapping available',
-      allowedProfiles: [],
-      riskCeiling: 'research_before_implementation',
-      reason: 'Unknown external source cannot be routed.'
-    };
-  }
-  if (source.reuseDecision === 'avoid' || source.quarantineStatus === 'denied') {
-    return {
-      version: EXTERNAL_AGENT_PACK_IMPORT_POLICY_VERSION,
-      sourceId,
-      status: 'denied',
-      checks: [
-        { check: 'reuse_decision', status: source.reuseDecision === 'avoid' ? 'fail' : 'warn', evidence: `${source.id} reuse=${source.reuseDecision}.` },
-        { check: 'quarantine_status', status: source.quarantineStatus === 'denied' ? 'fail' : 'warn', evidence: `${source.id} quarantine_status=${source.quarantineStatus}.` },
-        { check: 'host_compatibility', status: source.hostCompatibility.some((item) => item.includes('unsupported')) ? 'fail' : 'warn', evidence: source.hostCompatibility.join(',') || 'not declared' }
-      ],
-      mappingResult: 'future adapter or unsupported source only',
-      allowedProfiles: [],
-      riskCeiling: 'research_before_implementation',
-      reason: source.rationale
-    };
-  }
-  const checks: ExternalAgentPackImportCheck[] = source.quarantineRequired
-    ? [
-      { check: 'license_source_attribution', status: 'not_run', evidence: 'Quarantine inspection must verify source and license before import.' },
-      { check: 'hidden_unicode_scan', status: 'not_run', evidence: 'External material has not been scanned for hidden Unicode.' },
-      { check: 'secret_scan', status: 'not_run', evidence: 'External material has not been scanned for secrets.' },
-      { check: 'dangerous_command_scan', status: 'not_run', evidence: 'External material has not been scanned for dangerous commands.' },
-      { check: 'permission_model', status: source.permissionModel.length > 0 ? 'pass' : 'fail', evidence: source.permissionModel.join(',') || 'No permission model declared.' },
-      { check: 'provenance_requirements', status: source.provenanceRequirements.length > 0 ? 'pass' : 'fail', evidence: source.provenanceRequirements.join(',') || 'No provenance requirements declared.' },
-      { check: 'sdd_frontmatter_mapping', status: 'not_run', evidence: 'External material has not been mapped to SDD capability/profile fields.' }
-    ]
-    : [
-      { check: 'source_catalog', status: 'pass', evidence: `${source.id} is cataloged as ${source.reuseDecision}.` },
-      { check: 'quarantine_required', status: 'pass', evidence: 'This source is a native capability or mechanism reference, not an imported prompt pack.' },
-      { check: 'provenance_requirements', status: source.provenanceRequirements.length > 0 ? 'pass' : 'fail', evidence: source.provenanceRequirements.join(',') || 'No provenance requirements declared.' }
-    ];
-  return {
-    version: EXTERNAL_AGENT_PACK_IMPORT_POLICY_VERSION,
-    sourceId,
-    status: source.quarantineRequired ? 'quarantined' : 'approved',
-    checks,
-    mappingResult: source.quarantineRequired ? 'pending structured metadata mapping' : 'available through host adapter or mechanism reference',
-    allowedProfiles: source.quarantineRequired ? ['domain_expert', 'researcher'] : ['researcher', 'architect', 'orchestrator'],
-    riskCeiling: source.quarantineRequired ? 'research_before_implementation' : 'compact_boundary_only',
-    reason: source.quarantineRequired ? 'External material is not routable until quarantine checks pass.' : source.rationale
-  };
-}
+import {
+  AGENT_SKILL_TEAM_RUNTIME_CONTRACT_VERSION,
+  CAPABILITY_SOURCE_CATALOG_VERSION,
+  EXTERNAL_AGENT_PACK_IMPORT_POLICY_VERSION
+} from '../contracts.js';
+import {
+  BUILT_IN_EVIDENCE_INGESTION_CONTRACT,
+  BUILT_IN_HOST_ADAPTER_CONTRACT,
+  buildAgentSkillRuntimeRegistry
+} from './runtime-registry.js';
+import { buildTeamModePolicy } from './team-mode.js';
+import type {
+  AgentSkillTeamRuntimeInspection,
+  CapabilitySourceCatalog,
+  CapabilitySourceCatalogEntry,
+  ExternalAgentPackImportCheck,
+  ExternalAgentPackImportInspection,
+  SkillCapabilityContract,
+  SkillCapabilityRegistry
+} from './agent-runtime.js';
+
+export async function inspectAgentSkillTeamRuntime(projectRoot: string): Promise<AgentSkillTeamRuntimeInspection> {
+  const registry = await buildAgentSkillRuntimeRegistry(projectRoot);
+  return {
+    version: AGENT_SKILL_TEAM_RUNTIME_CONTRACT_VERSION,
+    profiles: registry.profiles,
+    skillCapabilities: registry.skillCapabilities,
+    capabilitySources: registry.capabilitySources,
+    hostAdapter: BUILT_IN_HOST_ADAPTER_CONTRACT,
+    evidenceIngestion: BUILT_IN_EVIDENCE_INGESTION_CONTRACT,
+    teamMode: buildTeamModePolicy({ activation: 'off' }),
+    reusePolicy: 'reuse_direct native host/MCP capabilities first; external prompt packs are quarantined material sources and projected only as structured metadata.',
+    registrySources: registry.registrySources,
+    aliases: registry.aliases,
+    routingRules: registry.routingRules,
+    adapterMappings: registry.adapterMappings
+  };
+}
+
+export async function listSkillCapabilities(projectRoot: string): Promise<SkillCapabilityRegistry> {
+  const registry = await buildAgentSkillRuntimeRegistry(projectRoot);
+  return {
+    version: AGENT_SKILL_TEAM_RUNTIME_CONTRACT_VERSION,
+    capabilities: registry.skillCapabilities,
+    registrySources: registry.registrySources.filter((source) => source.kind === 'skill_capability')
+  };
+}
+
+export async function inspectSkillCapability(projectRoot: string, capabilityId: string): Promise<SkillCapabilityContract | null> {
+  const registry = await listSkillCapabilities(projectRoot);
+  return registry.capabilities.find((capability) => capability.id === capabilityId) ?? null;
+}
+
+export async function listCapabilitySources(projectRoot: string): Promise<CapabilitySourceCatalog> {
+  const registry = await buildAgentSkillRuntimeRegistry(projectRoot);
+  return {
+    version: CAPABILITY_SOURCE_CATALOG_VERSION,
+    sources: registry.capabilitySources,
+    registrySources: registry.registrySources.filter((source) => source.kind === 'capability_source')
+  };
+}
+
+export async function inspectCapabilitySource(projectRoot: string, sourceId: string): Promise<CapabilitySourceCatalogEntry | null> {
+  const catalog = await listCapabilitySources(projectRoot);
+  return catalog.sources.find((source) => source.id === sourceId) ?? null;
+}
+
+export async function inspectExternalAgentPackImport(projectRoot: string, sourceId: string): Promise<ExternalAgentPackImportInspection> {
+  const registry = await buildAgentSkillRuntimeRegistry(projectRoot);
+  const source = registry.capabilitySources.find((entry) => entry.id === sourceId);
+  if (!source) {
+    return {
+      version: EXTERNAL_AGENT_PACK_IMPORT_POLICY_VERSION,
+      sourceId,
+      status: 'denied',
+      checks: [{ check: 'source_catalog', status: 'fail', evidence: 'Source id is not present in CapabilitySourceCatalog.' }],
+      mappingResult: 'no SDD mapping available',
+      allowedProfiles: [],
+      riskCeiling: 'research_before_implementation',
+      reason: 'Unknown external source cannot be routed.'
+    };
+  }
+  if (source.reuseDecision === 'avoid' || source.quarantineStatus === 'denied') {
+    return {
+      version: EXTERNAL_AGENT_PACK_IMPORT_POLICY_VERSION,
+      sourceId,
+      status: 'denied',
+      checks: [
+        { check: 'reuse_decision', status: source.reuseDecision === 'avoid' ? 'fail' : 'warn', evidence: `${source.id} reuse=${source.reuseDecision}.` },
+        { check: 'quarantine_status', status: source.quarantineStatus === 'denied' ? 'fail' : 'warn', evidence: `${source.id} quarantine_status=${source.quarantineStatus}.` },
+        { check: 'host_compatibility', status: source.hostCompatibility.some((item) => item.includes('unsupported')) ? 'fail' : 'warn', evidence: source.hostCompatibility.join(',') || 'not declared' }
+      ],
+      mappingResult: 'future adapter or unsupported source only',
+      allowedProfiles: [],
+      riskCeiling: 'research_before_implementation',
+      reason: source.rationale
+    };
+  }
+  const checks: ExternalAgentPackImportCheck[] = source.quarantineRequired
+    ? [
+      { check: 'license_source_attribution', status: 'not_run', evidence: 'Quarantine inspection must verify source and license before import.' },
+      { check: 'hidden_unicode_scan', status: 'not_run', evidence: 'External material has not been scanned for hidden Unicode.' },
+      { check: 'secret_scan', status: 'not_run', evidence: 'External material has not been scanned for secrets.' },
+      { check: 'dangerous_command_scan', status: 'not_run', evidence: 'External material has not been scanned for dangerous commands.' },
+      { check: 'permission_model', status: source.permissionModel.length > 0 ? 'pass' : 'fail', evidence: source.permissionModel.join(',') || 'No permission model declared.' },
+      { check: 'provenance_requirements', status: source.provenanceRequirements.length > 0 ? 'pass' : 'fail', evidence: source.provenanceRequirements.join(',') || 'No provenance requirements declared.' },
+      { check: 'sdd_frontmatter_mapping', status: 'not_run', evidence: 'External material has not been mapped to SDD capability/profile fields.' }
+    ]
+    : [
+      { check: 'source_catalog', status: 'pass', evidence: `${source.id} is cataloged as ${source.reuseDecision}.` },
+      { check: 'quarantine_required', status: 'pass', evidence: 'This source is a native capability or mechanism reference, not an imported prompt pack.' },
+      { check: 'provenance_requirements', status: source.provenanceRequirements.length > 0 ? 'pass' : 'fail', evidence: source.provenanceRequirements.join(',') || 'No provenance requirements declared.' }
+    ];
+  return {
+    version: EXTERNAL_AGENT_PACK_IMPORT_POLICY_VERSION,
+    sourceId,
+    status: source.quarantineRequired ? 'quarantined' : 'approved',
+    checks,
+    mappingResult: source.quarantineRequired ? 'pending structured metadata mapping' : 'available through host adapter or mechanism reference',
+    allowedProfiles: source.quarantineRequired ? ['domain_expert', 'researcher'] : ['researcher', 'architect', 'orchestrator'],
+    riskCeiling: source.quarantineRequired ? 'research_before_implementation' : 'compact_boundary_only',
+    reason: source.quarantineRequired ? 'External material is not routable until quarantine checks pass.' : source.rationale
+  };
+}

package/node_modules/@sdd-agent-platform/core/src/router/runtime-registry.ts

@@ -1,123 +1,123 @@
-import { contractIssue, type ContractValidationIssue } from '../contracts/issues.js';
-import { readProjectConfig as readProjectConfigFile } from '../config/project-config.js';
-import { BUILT_IN_CAPABILITY_SOURCES } from '../registries/capability-sources.js';
-import { BUILT_IN_SKILL_CAPABILITIES } from '../registries/skill-capabilities.js';
-import {
-  BUILT_IN_AGENT_PROFILES,
-  BUILT_IN_DELEGATION_WAVES,
-  BUILT_IN_EVIDENCE_INGESTION_CONTRACT,
-  BUILT_IN_HOST_ADAPTER_CONTRACT,
-  BUILT_IN_MODEL_POLICIES
-} from '../registries/agent-runtime-static.js';
-import { parseAgentRuntimeConfig } from './agent-runtime-config.js';
-import type {
-  AgentProfileContract,
-  AgentRuntimeAdapterMapping,
-  AgentRuntimeRoutingRule,
-  CapabilitySourceCatalogEntry,
-  ProjectAgentRuntimeConfig,
-  RuntimeRegistryEntrySource,
-  SkillCapabilityContract
-} from './agent-runtime.js';
-
-export {
-  BUILT_IN_AGENT_PROFILES,
-  BUILT_IN_DELEGATION_WAVES,
-  BUILT_IN_EVIDENCE_INGESTION_CONTRACT,
-  BUILT_IN_HOST_ADAPTER_CONTRACT,
-  BUILT_IN_MODEL_POLICIES
-};
-
-export interface AgentSkillRuntimeRegistry {
-  profiles: AgentProfileContract[];
-  skillCapabilities: SkillCapabilityContract[];
-  capabilitySources: CapabilitySourceCatalogEntry[];
-  registrySources: RuntimeRegistryEntrySource[];
-  aliases: Record<string, string>;
-  routingRules: AgentRuntimeRoutingRule[];
-  adapterMappings: AgentRuntimeAdapterMapping[];
-  issues: ContractValidationIssue[];
-}
-
-function emptyAgentRuntimeConfig(): ProjectAgentRuntimeConfig {
-  return {
-    profiles: [],
-    skillCapabilities: [],
-    capabilitySources: [],
-    aliases: {},
-    routingRules: [],
-    adapterMappings: []
-  };
-}
-
-export async function buildAgentSkillRuntimeRegistry(projectRoot: string): Promise<AgentSkillRuntimeRegistry> {
-  const config = await readProjectConfigFile<ProjectAgentRuntimeConfig>(projectRoot, parseAgentRuntimeConfig);
-  return mergeAgentSkillRuntimeRegistry(config.agentRuntime ?? emptyAgentRuntimeConfig());
-}
-
-export function mergeAgentSkillRuntimeRegistry(projectRuntime: ProjectAgentRuntimeConfig): AgentSkillRuntimeRegistry {
-  const issues: ContractValidationIssue[] = [];
-  const profiles = new Map<string, AgentProfileContract>();
-  const skillCapabilities = new Map<string, SkillCapabilityContract>();
-  const capabilitySources = new Map<string, CapabilitySourceCatalogEntry>();
-  const registrySources: RuntimeRegistryEntrySource[] = [];
-
-  for (const profile of BUILT_IN_AGENT_PROFILES) {
-    profiles.set(profile.id, profile);
-    registrySources.push({ id: profile.id, kind: 'profile', origin: 'built_in', sourceId: null, quarantineRequired: false });
-  }
-  for (const capability of BUILT_IN_SKILL_CAPABILITIES) {
-    skillCapabilities.set(capability.id, capability);
-    registrySources.push({ id: capability.id, kind: 'skill_capability', origin: 'built_in', sourceId: null, quarantineRequired: false });
-  }
-  for (const source of BUILT_IN_CAPABILITY_SOURCES) {
-    capabilitySources.set(source.id, source);
-    registrySources.push({ id: source.id, kind: 'capability_source', origin: 'built_in', sourceId: source.id, quarantineRequired: source.quarantineRequired });
-  }
-
-  for (const source of projectRuntime.capabilitySources) {
-    if (capabilitySources.has(source.id)) {
-      issues.push(contractIssue(`agent_runtime.capability_sources.${source.id}`, 'Capability source id duplicates an existing source.', 'Use a project-specific id; Phase 6.3 does not allow overriding built-ins.'));
-      continue;
-    }
-    capabilitySources.set(source.id, source);
-    registrySources.push({ id: source.id, kind: 'capability_source', origin: 'project_config', sourceId: source.id, quarantineRequired: source.quarantineRequired });
-  }
-
-  for (const capability of projectRuntime.skillCapabilities) {
-    if (skillCapabilities.has(capability.id)) {
-      issues.push(contractIssue(`agent_runtime.skill_capabilities.${capability.id}`, 'Skill capability id duplicates an existing capability.', 'Use a project-specific id; Phase 6.3 does not allow overriding built-ins.'));
-      continue;
-    }
-    skillCapabilities.set(capability.id, capability);
-    const source = capabilitySources.get(capability.sourceRef);
-    if (!source) {
-      issues.push(contractIssue(`agent_runtime.skill_capabilities.${capability.id}.source_ref`, `Skill capability references unknown source ${capability.sourceRef || '<empty>'}.`, 'Declare capability_sources entry first, or point source_ref at an existing capability source id.'));
-    }
-    registrySources.push({ id: capability.id, kind: 'skill_capability', origin: 'project_config', sourceId: source?.id ?? (capability.sourceRef || null), quarantineRequired: source?.quarantineRequired ?? false });
-  }
-
-  for (const profile of projectRuntime.profiles) {
-    if (profiles.has(profile.id)) {
-      issues.push(contractIssue(`agent_runtime.profiles.${profile.id}`, 'Agent profile id duplicates an existing profile.', 'Use a project-specific id; Phase 6.3 does not allow overriding built-ins.'));
-      continue;
-    }
-    profiles.set(profile.id, profile);
-    registrySources.push({ id: profile.id, kind: 'profile', origin: 'project_config', sourceId: null, quarantineRequired: false });
-  }
-
-  return {
-    profiles: [...profiles.values()].sort((left, right) => left.id.localeCompare(right.id)),
-    skillCapabilities: [...skillCapabilities.values()].sort((left, right) => left.id.localeCompare(right.id)),
-    capabilitySources: [...capabilitySources.values()].sort((left, right) => left.id.localeCompare(right.id)),
-    registrySources: [...registrySources].sort((left, right) => `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`)),
-    aliases: { ...projectRuntime.aliases },
-    routingRules: [...projectRuntime.routingRules],
-    adapterMappings: [...projectRuntime.adapterMappings],
-    issues
-  };
-}
-
-export function registrySourceFor(registry: AgentSkillRuntimeRegistry, kind: RuntimeRegistryEntrySource['kind'], id: string): RuntimeRegistryEntrySource | null {
-  return registry.registrySources.find((source) => source.kind === kind && source.id === id) ?? null;
-}
+import { contractIssue, type ContractValidationIssue } from '../contracts/issues.js';
+import { readProjectConfig as readProjectConfigFile } from '../config/project-config.js';
+import { BUILT_IN_CAPABILITY_SOURCES } from '../registries/capability-sources.js';
+import { BUILT_IN_SKILL_CAPABILITIES } from '../registries/skill-capabilities.js';
+import {
+  BUILT_IN_AGENT_PROFILES,
+  BUILT_IN_DELEGATION_WAVES,
+  BUILT_IN_EVIDENCE_INGESTION_CONTRACT,
+  BUILT_IN_HOST_ADAPTER_CONTRACT,
+  BUILT_IN_MODEL_POLICIES
+} from '../registries/agent-runtime-static.js';
+import { parseAgentRuntimeConfig } from './agent-runtime-config.js';
+import type {
+  AgentProfileContract,
+  AgentRuntimeAdapterMapping,
+  AgentRuntimeRoutingRule,
+  CapabilitySourceCatalogEntry,
+  ProjectAgentRuntimeConfig,
+  RuntimeRegistryEntrySource,
+  SkillCapabilityContract
+} from './agent-runtime.js';
+
+export {
+  BUILT_IN_AGENT_PROFILES,
+  BUILT_IN_DELEGATION_WAVES,
+  BUILT_IN_EVIDENCE_INGESTION_CONTRACT,
+  BUILT_IN_HOST_ADAPTER_CONTRACT,
+  BUILT_IN_MODEL_POLICIES
+};
+
+export interface AgentSkillRuntimeRegistry {
+  profiles: AgentProfileContract[];
+  skillCapabilities: SkillCapabilityContract[];
+  capabilitySources: CapabilitySourceCatalogEntry[];
+  registrySources: RuntimeRegistryEntrySource[];
+  aliases: Record<string, string>;
+  routingRules: AgentRuntimeRoutingRule[];
+  adapterMappings: AgentRuntimeAdapterMapping[];
+  issues: ContractValidationIssue[];
+}
+
+function emptyAgentRuntimeConfig(): ProjectAgentRuntimeConfig {
+  return {
+    profiles: [],
+    skillCapabilities: [],
+    capabilitySources: [],
+    aliases: {},
+    routingRules: [],
+    adapterMappings: []
+  };
+}
+
+export async function buildAgentSkillRuntimeRegistry(projectRoot: string): Promise<AgentSkillRuntimeRegistry> {
+  const config = await readProjectConfigFile<ProjectAgentRuntimeConfig>(projectRoot, parseAgentRuntimeConfig);
+  return mergeAgentSkillRuntimeRegistry(config.agentRuntime ?? emptyAgentRuntimeConfig());
+}
+
+export function mergeAgentSkillRuntimeRegistry(projectRuntime: ProjectAgentRuntimeConfig): AgentSkillRuntimeRegistry {
+  const issues: ContractValidationIssue[] = [];
+  const profiles = new Map<string, AgentProfileContract>();
+  const skillCapabilities = new Map<string, SkillCapabilityContract>();
+  const capabilitySources = new Map<string, CapabilitySourceCatalogEntry>();
+  const registrySources: RuntimeRegistryEntrySource[] = [];
+
+  for (const profile of BUILT_IN_AGENT_PROFILES) {
+    profiles.set(profile.id, profile);
+    registrySources.push({ id: profile.id, kind: 'profile', origin: 'built_in', sourceId: null, quarantineRequired: false });
+  }
+  for (const capability of BUILT_IN_SKILL_CAPABILITIES) {
+    skillCapabilities.set(capability.id, capability);
+    registrySources.push({ id: capability.id, kind: 'skill_capability', origin: 'built_in', sourceId: null, quarantineRequired: false });
+  }
+  for (const source of BUILT_IN_CAPABILITY_SOURCES) {
+    capabilitySources.set(source.id, source);
+    registrySources.push({ id: source.id, kind: 'capability_source', origin: 'built_in', sourceId: source.id, quarantineRequired: source.quarantineRequired });
+  }
+
+  for (const source of projectRuntime.capabilitySources) {
+    if (capabilitySources.has(source.id)) {
+      issues.push(contractIssue(`agent_runtime.capability_sources.${source.id}`, 'Capability source id duplicates an existing source.', 'Use a project-specific id; Phase 6.3 does not allow overriding built-ins.'));
+      continue;
+    }
+    capabilitySources.set(source.id, source);
+    registrySources.push({ id: source.id, kind: 'capability_source', origin: 'project_config', sourceId: source.id, quarantineRequired: source.quarantineRequired });
+  }
+
+  for (const capability of projectRuntime.skillCapabilities) {
+    if (skillCapabilities.has(capability.id)) {
+      issues.push(contractIssue(`agent_runtime.skill_capabilities.${capability.id}`, 'Skill capability id duplicates an existing capability.', 'Use a project-specific id; Phase 6.3 does not allow overriding built-ins.'));
+      continue;
+    }
+    skillCapabilities.set(capability.id, capability);
+    const source = capabilitySources.get(capability.sourceRef);
+    if (!source) {
+      issues.push(contractIssue(`agent_runtime.skill_capabilities.${capability.id}.source_ref`, `Skill capability references unknown source ${capability.sourceRef || '<empty>'}.`, 'Declare capability_sources entry first, or point source_ref at an existing capability source id.'));
+    }
+    registrySources.push({ id: capability.id, kind: 'skill_capability', origin: 'project_config', sourceId: source?.id ?? (capability.sourceRef || null), quarantineRequired: source?.quarantineRequired ?? false });
+  }
+
+  for (const profile of projectRuntime.profiles) {
+    if (profiles.has(profile.id)) {
+      issues.push(contractIssue(`agent_runtime.profiles.${profile.id}`, 'Agent profile id duplicates an existing profile.', 'Use a project-specific id; Phase 6.3 does not allow overriding built-ins.'));
+      continue;
+    }
+    profiles.set(profile.id, profile);
+    registrySources.push({ id: profile.id, kind: 'profile', origin: 'project_config', sourceId: null, quarantineRequired: false });
+  }
+
+  return {
+    profiles: [...profiles.values()].sort((left, right) => left.id.localeCompare(right.id)),
+    skillCapabilities: [...skillCapabilities.values()].sort((left, right) => left.id.localeCompare(right.id)),
+    capabilitySources: [...capabilitySources.values()].sort((left, right) => left.id.localeCompare(right.id)),
+    registrySources: [...registrySources].sort((left, right) => `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`)),
+    aliases: { ...projectRuntime.aliases },
+    routingRules: [...projectRuntime.routingRules],
+    adapterMappings: [...projectRuntime.adapterMappings],
+    issues
+  };
+}
+
+export function registrySourceFor(registry: AgentSkillRuntimeRegistry, kind: RuntimeRegistryEntrySource['kind'], id: string): RuntimeRegistryEntrySource | null {
+  return registry.registrySources.find((source) => source.kind === kind && source.id === id) ?? null;
+}