spawnfile 0.1.13 → 0.1.14

package/dist/compiler/buildCompilePlanTraversal.js

@@ -1,89 +1,62 @@
 import { getCanonicalManifestPath, getManifestPath, resolveProjectPath } from "../filesystem/index.js";
-import { isAgentManifest, isTeamManifest, mergeExecution } from "../manifest/index.js";
+import { isAgentManifest, isReferencedMember, isTeamManifest, materializeInlineAgentManifest } from "../manifest/index.js";
 import { SpawnfileError } from "../shared/index.js";
 import { getAgentFingerprint, getMcpNames, getTeamFingerprint, validateEffectiveSkillRequirements } from "./compilePlanHelpers.js";
-import { resolveAgentSurfaces } from "./agentSurfaces.js";
-import { mergeResolvedSkills, loadResolvedSkills } from "./surfaces.js";
-import { assertRuntimeSupportsExecutionModelAuth } from "./modelAuth.js";
-import { assertRuntimeSupportsAgentSurfaces } from "./surfaceSupport.js";
-import { applyExecutionDefaults } from "./executionDefaults.js";
-import { normalizeDescription, resolveDescription, resolveRuntime } from "./buildCompilePlanRuntime.js";
+import { loadResolvedSkills } from "./surfaces.js";
+import { mergeCompatibleAgentNode } from "./agentNodeMerge.js";
+import { normalizeDescription } from "./buildCompilePlanRuntime.js";
 import { resolveTeamExternalIds, resolveTeamNetworks, validateTeamNetworkRooms } from "./buildCompilePlanTeams.js";
+import { resolveDeclaredMemoryBanks } from "./memoryResolution.js";
 import { mergeWorkspaceResources } from "./workspaceResources.js";
-import { DEFAULT_POLICY_MODE, DEFAULT_POLICY_ON_DEGRADE, mergeResolvedDocuments, resolveEffectiveEnvironment } from "./buildCompilePlanTraversalHelpers.js";
+import { DEFAULT_POLICY_MODE, DEFAULT_POLICY_ON_DEGRADE, mergeResolvedDocuments, } from "./buildCompilePlanTraversalHelpers.js";
+import { resolveAgentNode } from "./buildCompilePlanAgent.js";
+import { createInlineAgentSource } from "./projectManifestGraph.js";
 export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, fingerprintCache, edges, memberships }) => {
     const visitStack = [];
-    const visitAgent = async (manifestPath, context) => {
-        const canonicalPath = getCanonicalManifestPath(manifestPath);
-        if (visitStack.includes(canonicalPath)) {
-            throw new SpawnfileError("compile_error", `Cycle detected while visiting ${canonicalPath}`);
-        }
-        const loadedManifest = await getLoadedManifest(canonicalPath);
-        if (!isAgentManifest(loadedManifest.manifest)) {
-            throw new SpawnfileError("compile_error", `Expected agent manifest, got ${loadedManifest.manifest.kind} at ${canonicalPath}`);
-        }
-        const runtime = await resolveRuntime(loadedManifest.manifest, context);
-        const execution = applyExecutionDefaults(context.isSubagent
-            ? mergeExecution(context.inheritedExecution, loadedManifest.manifest.execution)
-            : loadedManifest.manifest.execution);
-        assertRuntimeSupportsExecutionModelAuth(runtime.name, execution, loadedManifest.manifest.name);
-        const environment = resolveEffectiveEnvironment(context.inheritedShared?.surface?.environment, loadedManifest.manifest.environment);
-        const inheritedSkills = context.inheritedShared
-            ? await loadResolvedSkills(context.inheritedShared.manifestPath, context.inheritedShared.surface?.workspace?.skills)
-            : [];
-        const localSkills = await loadResolvedSkills(canonicalPath, loadedManifest.manifest.workspace?.skills);
-        const skills = mergeResolvedSkills(inheritedSkills, localSkills);
-        validateEffectiveSkillRequirements(loadedManifest.manifest.name, getMcpNames(environment.mcpServers), skills);
-        const docs = await mergeResolvedDocuments(canonicalPath, loadedManifest.manifest.workspace?.docs, context.inheritedShared?.manifestPath, context.inheritedShared?.surface?.workspace?.docs);
-        const workspaceResources = mergeWorkspaceResources(context.inheritedResources, loadedManifest.manifest.workspace?.resources, loadedManifest.manifest.name, {
-            kind: "agent",
-            key: canonicalPath,
-            name: loadedManifest.manifest.name
+    const recordAgentMembership = (teamSource, teamName, memberId, agent) => {
+        memberships.set(`${teamSource}::${memberId}::${agent.source}`, {
+            agentSource: agent.source,
+            memberId,
+            teamName,
+            teamSource
         });
-        const candidate = {
-            description: resolveDescription(loadedManifest.manifest.description, docs),
-            docs,
-            env: environment.env,
-            execution,
-            expose: loadedManifest.manifest.expose ?? false,
+        return {
+            id: memberId,
             kind: "agent",
-            mcpServers: environment.mcpServers,
-            name: loadedManifest.manifest.name,
-            policyMode: loadedManifest.manifest.policy?.mode ?? DEFAULT_POLICY_MODE,
-            policyOnDegrade: loadedManifest.manifest.policy?.on_degrade ?? DEFAULT_POLICY_ON_DEGRADE,
-            runtime,
-            schedule: loadedManifest.manifest.schedule,
-            secrets: environment.secrets,
-            packages: environment.packages,
-            skills,
-            source: canonicalPath,
-            surfaces: resolveAgentSurfaces(loadedManifest.manifest.surfaces),
-            subagents: [],
-            workspaceResources
+            nodeSource: agent.source,
+            runtimeName: agent.runtime.name
         };
-        assertRuntimeSupportsAgentSurfaces(runtime.name, candidate.surfaces, loadedManifest.manifest.name);
-        const fingerprint = getAgentFingerprint(candidate);
-        const existingFingerprint = fingerprintCache.get(canonicalPath);
-        if (existingFingerprint && existingFingerprint !== fingerprint) {
-            throw new SpawnfileError("compile_error", `Manifest ${canonicalPath} resolves differently across compile contexts`);
+    };
+    const visitAgentManifest = async (manifest, source, manifestPath, context) => {
+        if (visitStack.includes(source)) {
+            throw new SpawnfileError("compile_error", `Cycle detected while visiting ${source}`);
         }
-        const cachedNode = nodeCache.get(canonicalPath);
+        const candidate = await resolveAgentNode({ context, manifest, manifestPath, source });
+        const cachedNode = nodeCache.get(source);
         if (cachedNode) {
-            return cachedNode.value;
+            const cachedAgent = cachedNode.value;
+            mergeCompatibleAgentNode(cachedAgent, candidate);
+            fingerprintCache.set(source, getAgentFingerprint(cachedAgent));
+            return cachedAgent;
         }
-        fingerprintCache.set(canonicalPath, fingerprint);
-        nodeCache.set(canonicalPath, {
-            runtimeName: runtime.name,
-            source: canonicalPath,
+        const fingerprint = getAgentFingerprint(candidate);
+        const existingFingerprint = fingerprintCache.get(source);
+        if (existingFingerprint && existingFingerprint !== fingerprint) {
+            throw new SpawnfileError("compile_error", `Agent ${source} resolves differently across compile contexts`);
+        }
+        fingerprintCache.set(source, fingerprint);
+        nodeCache.set(source, {
+            runtimeName: candidate.runtime.name,
+            source,
             value: candidate
         });
-        visitStack.push(canonicalPath);
-        for (const subagent of loadedManifest.manifest.subagents ?? []) {
-            const childManifestPath = getManifestPath(resolveProjectPath(canonicalPath, subagent.ref));
+        visitStack.push(source);
+        for (const subagent of manifest.subagents ?? []) {
+            const childManifestPath = getManifestPath(resolveProjectPath(manifestPath, subagent.ref));
             const resolvedSubagent = await visitAgent(childManifestPath, {
-                inheritedExecution: execution,
+                inheritedExecution: candidate.execution,
                 inheritedResources: candidate.workspaceResources,
-                inheritedRuntime: runtime,
+                inheritedRuntime: candidate.runtime,
                 isSubagent: true
             });
             candidate.subagents.push({
@@ -91,7 +64,7 @@ export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, finge
                 nodeSource: resolvedSubagent.source
             });
             edges.push({
-                from: canonicalPath,
+                from: source,
                 kind: "subagent",
                 label: subagent.id,
                 to: resolvedSubagent.source
@@ -100,6 +73,14 @@ export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, finge
         visitStack.pop();
         return candidate;
     };
+    const visitAgent = async (manifestPath, context) => {
+        const canonicalPath = getCanonicalManifestPath(manifestPath);
+        const loadedManifest = await getLoadedManifest(canonicalPath);
+        if (!isAgentManifest(loadedManifest.manifest)) {
+            throw new SpawnfileError("compile_error", `Expected agent manifest, got ${loadedManifest.manifest.kind} at ${canonicalPath}`);
+        }
+        return visitAgentManifest(loadedManifest.manifest, canonicalPath, canonicalPath, context);
+    };
     const visitTeam = async (manifestPath, inheritedResources = []) => {
         const canonicalPath = getCanonicalManifestPath(manifestPath);
         if (visitStack.includes(canonicalPath)) {
@@ -126,11 +107,15 @@ export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, finge
             docs,
             external: resolvedExternal,
             externalExplicit: manifest.external !== undefined,
+            ...(manifest.external_participants
+                ? { externalParticipants: manifest.external_participants }
+                : {}),
             kind: "team",
             lead: manifest.lead ?? null,
             members: [],
             mode: manifest.mode,
             name: manifest.name,
+            memory: resolveDeclaredMemoryBanks(manifest.memory, canonicalPath, "team", manifest.name),
             networks: resolveTeamNetworks(manifest),
             policyMode: manifest.policy?.mode ?? DEFAULT_POLICY_MODE,
             policyOnDegrade: manifest.policy?.on_degrade ?? DEFAULT_POLICY_ON_DEGRADE,
@@ -161,6 +146,25 @@ export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, finge
         });
         visitStack.push(canonicalPath);
         for (const member of loadedManifest.manifest.members) {
+            if (!isReferencedMember(member)) {
+                const resolvedAgent = await visitAgentManifest(materializeInlineAgentManifest(manifest, member), createInlineAgentSource(canonicalPath, member.id), canonicalPath, {
+                    inheritedShared: {
+                        manifestPath: canonicalPath,
+                        surface: manifest.shared
+                    },
+                    inheritedResources: candidate.workspaceResources,
+                    isSubagent: false
+                });
+                const resolvedMember = recordAgentMembership(canonicalPath, candidate.name, member.id, resolvedAgent);
+                candidate.members.push(resolvedMember);
+                edges.push({
+                    from: canonicalPath,
+                    kind: "team_member",
+                    label: member.id,
+                    to: resolvedMember.nodeSource
+                });
+                continue;
+            }
             const childManifestPath = getManifestPath(resolveProjectPath(canonicalPath, member.ref));
             const childManifest = await getLoadedManifest(childManifestPath);
             let resolvedMember;
@@ -173,18 +177,7 @@ export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, finge
                     inheritedResources: candidate.workspaceResources,
                     isSubagent: false
                 });
-                resolvedMember = {
-                    id: member.id,
-                    kind: "agent",
-                    nodeSource: resolvedAgent.source,
-                    runtimeName: resolvedAgent.runtime.name
-                };
-                memberships.set(`${canonicalPath}::${member.id}::${resolvedAgent.source}`, {
-                    agentSource: resolvedAgent.source,
-                    memberId: member.id,
-                    teamName: candidate.name,
-                    teamSource: canonicalPath
-                });
+                resolvedMember = recordAgentMembership(canonicalPath, candidate.name, member.id, resolvedAgent);
             }
             else {
                 const resolvedTeam = await visitTeam(childManifestPath, candidate.workspaceResources);

package/dist/compiler/buildProject.d.ts

@@ -1,4 +1,5 @@
 import { type CompileProjectOptions, type CompileProjectResult } from "./compileProject.js";
+import { type DockerImageInspector } from "./dockerBuildSkip.js";
 import type { MoltnetTargetArchitecture } from "./moltnetBinaries.js";
 export interface DockerBuildInvocation {
     args: string[];
@@ -12,9 +13,19 @@ export interface BuildProjectOptions extends CompileProjectOptions {
     buildRunner?: DockerBuildRunner;
     dockerCommand?: string;
     dockerContext?: string;
+    imageInspector?: DockerImageInspector;
     imageTag?: string;
 }
 export interface BuildProjectResult extends CompileProjectResult {
+    imageBuild?: {
+        buildMs: number | null;
+        contextBytes: number;
+        contextDigest: string;
+        contextDigestMs: number;
+        contextFileCount: number;
+        probeMs: number;
+        skipped: boolean;
+    };
     imageTag: string;
 }
 export declare const createDefaultImageTag: (projectRoot: string) => string;

package/dist/compiler/buildProject.js

@@ -1,8 +1,12 @@
 import path from "node:path";
 import { execFile as execFileCallback, spawn } from "node:child_process";
+import { performance } from "node:perf_hooks";
 import { promisify } from "node:util";
+import { BUILD_IMAGE_CACHE_VERSION, readBuildImageCacheEntry, writeBuildImageCacheEntry } from "../deployment/buildImageCacheStore.js";
 import { SpawnfileError } from "../shared/index.js";
 import { compileProject } from "./compileProject.js";
+import { createDockerBuildContextDigest, listDockerBuildContextFiles } from "./dockerBuildContext.js";
+import { inspectDockerImage, shouldSkipDockerBuild } from "./dockerBuildSkip.js";
 import { slugify } from "./helpers.js";
 const execFile = promisify(execFileCallback);
 export const createDefaultImageTag = (projectRoot) => {
@@ -76,16 +80,87 @@ export const buildProject = async (inputPath, options = {}) => {
     const compileResult = await compileProject(inputPath, {
         clean: options.clean,
         containerArchitecture: targetArchitecture,
-        outputDirectory: options.outputDirectory
+        outputDirectory: options.outputDirectory,
+        runtimePackageOverrides: options.runtimePackageOverrides,
+        ...(options.worldBindingsPath !== undefined
+            ? { worldBindingsPath: options.worldBindingsPath }
+            : {})
     });
     const imageTag = options.imageTag ?? createDefaultImageTag(resolveImageTagRoot(inputPath));
     const invocation = createDockerBuildInvocation(compileResult.outputDirectory, imageTag, {
         dockerCommand: options.dockerCommand,
         dockerContext: options.dockerContext
     });
-    await (options.buildRunner ?? runDockerBuild)(invocation);
+    const compileFingerprint = compileResult.report.compile_fingerprint ?? "";
+    const projectRoot = compileResult.report.root;
+    const contextDigestStartedAt = performance.now();
+    const [contextFiles, contextDigest] = await Promise.all([
+        listDockerBuildContextFiles(compileResult.outputDirectory),
+        createDockerBuildContextDigest(compileResult.outputDirectory)
+    ]);
+    const contextDigestMs = performance.now() - contextDigestStartedAt;
+    let probeMs = 0;
+    let skipped = false;
+    if (!options.buildRunner) {
+        const probeStartedAt = performance.now();
+        const cacheEntry = await readBuildImageCacheEntry({
+            dockerContext: options.dockerContext,
+            imageTag,
+            projectRoot
+        });
+        skipped = await shouldSkipDockerBuild({
+            cacheEntry,
+            compileFingerprint,
+            contextDigest,
+            dockerCommand: options.dockerCommand,
+            dockerContext: options.dockerContext,
+            imageInspector: options.imageInspector,
+            imageTag
+        });
+        probeMs = performance.now() - probeStartedAt;
+    }
+    let buildMs = null;
+    if (!skipped) {
+        const buildStartedAt = performance.now();
+        await (options.buildRunner ?? runDockerBuild)(invocation);
+        buildMs = performance.now() - buildStartedAt;
+        if (!options.buildRunner) {
+            try {
+                const inspection = await (options.imageInspector ?? inspectDockerImage)({
+                    dockerCommand: options.dockerCommand,
+                    dockerContext: options.dockerContext,
+                    imageTag
+                });
+                if (inspection
+                    && inspection.labels["com.spawnfile.compile_fingerprint"] === compileFingerprint) {
+                    await writeBuildImageCacheEntry({
+                        compileFingerprint,
+                        contextDigest,
+                        dockerContext: options.dockerContext ?? null,
+                        imageId: inspection.id,
+                        imageTag,
+                        projectRoot,
+                        version: BUILD_IMAGE_CACHE_VERSION,
+                        writtenAt: new Date().toISOString()
+                    });
+                }
+            }
+            catch {
+                // A post-build cache probe is best-effort and never changes build success.
+            }
+        }
+    }
     return {
         ...compileResult,
+        imageBuild: {
+            buildMs,
+            contextBytes: contextFiles.reduce((total, file) => total + file.size, 0),
+            contextDigest,
+            contextDigestMs,
+            contextFileCount: contextFiles.length,
+            probeMs,
+            skipped
+        },
         imageTag
     };
 };

package/dist/compiler/compilePlanHelpers.js

@@ -14,6 +14,7 @@ export const validateEffectiveSkillRequirements = (nodeName, mcpNames, skills) =
 export const getAgentFingerprint = (node) => stableStringify({
     env: node.env,
     execution: node.execution,
+    memory: node.memory,
     mcpServers: node.mcpServers,
     runtime: node.runtime,
     schedule: node.schedule,
@@ -30,6 +31,7 @@ export const getAgentFingerprint = (node) => stableStringify({
 export const getTeamFingerprint = (node) => stableStringify({
     members: node.members,
     mode: node.mode,
+    memory: node.memory,
     lead: node.lead,
     external: node.external,
     networks: node.networks ?? [],

package/dist/compiler/compileProject.d.ts

@@ -1,11 +1,24 @@
 import { CompileReport } from "../report/index.js";
+import { type RuntimePackageOverrideRequest } from "./containerPackageOverrides.js";
 import { type MoltnetTargetArchitecture } from "./moltnetBinaries.js";
+import { type OrganizationReadinessEvidence } from "./organizationReadyEvidence.js";
+export { createOrganizationReadinessEvidence, ORGANIZATION_READINESS_EVIDENCE_VERSION } from "./organizationReadyEvidence.js";
+export type { CreateOrganizationReadinessEvidenceInput, OrganizationReadinessEvidence } from "./organizationReadyEvidence.js";
 export interface CompileProjectOptions {
     clean?: boolean;
     containerArchitecture?: MoltnetTargetArchitecture;
     outputDirectory?: string;
+    /** Compile-time-only local overrides for runtime install npm packages
+     * (see src/compiler/containerPackageOverrides.ts). Only opt-in
+     * local/E2E callers set this; a standard compile leaves it undefined and
+     * every runtime install package resolves to its pinned registry
+     * version, unchanged. */
+    runtimePackageOverrides?: RuntimePackageOverrideRequest;
+    /** Runner-owned path to a bounded, secret-free simfile.world-bindings.v1 artifact. */
+    worldBindingsPath?: string;
 }
 export interface CompileProjectResult {
+    organizationReadinessEvidence: OrganizationReadinessEvidence;
     outputDirectory: string;
     report: CompileReport;
     reportPath: string;

package/dist/compiler/compileProject.js

@@ -3,12 +3,18 @@ import { chmod } from "node:fs/promises";
 import { ensureDirectory, removeDirectory } from "../filesystem/index.js";
 import { createCompileReport, createDiagnostic, writeCompileReport } from "../report/index.js";
 import { DEFAULT_OUTPUT_DIRECTORY } from "../shared/index.js";
-import { assertRuntimeCanCompile, createRuntimeLifecycleDiagnostics, getRuntimeAdapter } from "../runtime/index.js";
+import { assertRuntimeCanCompile, createRuntimeLifecycleDiagnostics, getRuntimeAdapter, resolveNoopolisRunId } from "../runtime/index.js";
 import { buildCompilePlan } from "./buildCompilePlan.js";
 import { createContainerArtifacts } from "./containerArtifacts.js";
+import { stageRuntimePackageOverrides } from "./containerPackageOverrides.js";
+import { augmentNodeReports } from "./compileProjectReports.js";
+import { enforcePolicy } from "./compileProjectPolicy.js";
 import { injectMoltnetWorkspaceFiles, injectTeamCompileSupportFiles, prepareTeamCompileSupport, writeEmittedFiles } from "./compileProjectSupport.js";
 import { generateMoltnetArtifacts } from "./moltnetArtifacts.js";
 import { stageMoltnetBinaries } from "./moltnetBinaries.js";
+import { loadWorldBindingsForCompile } from "./worldBindingsFile.js";
+import { createOrganizationReadinessEvidence } from "./organizationReadyEvidence.js";
+export { createOrganizationReadinessEvidence, ORGANIZATION_READINESS_EVIDENCE_VERSION } from "./organizationReadyEvidence.js";
 const createTeamCapabilities = (outcome, message) => [
     { key: "team.members", message, outcome },
     { key: "team.mode", message, outcome },
@@ -132,76 +138,11 @@ const compileTeamNode = async (baseDirectory, node) => {
         value: node.value
     };
 };
-const enforcePolicy = (nodeReport, policyMode, onDegrade) => {
-    for (const capability of nodeReport.capabilities) {
-        if (capability.outcome === "unsupported") {
-            if (policyMode === "strict") {
-                throw new Error(`Policy violation: ${capability.key} is unsupported for ${nodeReport.id} (strict mode)${capability.message ? `: ${capability.message}` : ""}`);
-            }
-            if (policyMode === "warn") {
-                nodeReport.diagnostics.push(createDiagnostic("warn", `Policy warning: ${capability.key} is unsupported for ${nodeReport.id}${capability.message ? `: ${capability.message}` : ""}`));
-            }
-        }
-        if (capability.outcome === "degraded") {
-            if (onDegrade === "error") {
-                throw new Error(`Policy violation: ${capability.key} is degraded for ${nodeReport.id} (on_degrade: error)${capability.message ? `: ${capability.message}` : ""}`);
-            }
-            if (onDegrade === "warn") {
-                nodeReport.diagnostics.push(createDiagnostic("warn", `Policy warning: ${capability.key} is degraded for ${nodeReport.id}${capability.message ? `: ${capability.message}` : ""}`));
-            }
-        }
-    }
-};
-const createIdentityCapabilities = (node) => [
-    ...(node.surfaces?.slack?.identity
-        ? [{
-                key: "surfaces.slack.identity",
-                message: "Declared Slack identity was preserved for roster output",
-                outcome: "supported"
-            }]
-        : []),
-    ...(node.surfaces?.discord?.identity
-        ? [{
-                key: "surfaces.discord.identity",
-                message: "Declared Discord identity was preserved for roster output",
-                outcome: "supported"
-            }]
-        : []),
-    ...(node.surfaces?.telegram?.identity
-        ? [{
-                key: "surfaces.telegram.identity",
-                message: "Declared Telegram identity was preserved for roster output",
-                outcome: "supported"
-            }]
-        : []),
-    ...(node.surfaces?.whatsapp?.identity
-        ? [{
-                key: "surfaces.whatsapp.identity",
-                message: "Declared WhatsApp identity was preserved for roster output",
-                outcome: "supported"
-            }]
-        : [])
-];
-const createWorkspaceResourceCapabilities = (node) => (node.workspaceResources?.length ?? 0) > 0
-    ? [{
-            key: "workspace.resources",
-            message: `${node.workspaceResources?.length ?? 0} workspace resource(s) will be prepared at startup`,
-            outcome: "supported"
-        }]
-    : [];
-const augmentNodeReports = (compiledNodes, support) => {
-    for (const compiled of compiledNodes) {
-        compiled.report.capabilities.push(...createWorkspaceResourceCapabilities(compiled.value));
-        if (compiled.value.kind === "team") {
-            compiled.report.capabilities.push(...(support.capabilitiesByTeamSource.get(compiled.value.source) ?? []));
-            compiled.report.diagnostics.push(...(support.diagnosticsByTeamSource.get(compiled.value.source) ?? []));
-            continue;
-        }
-        compiled.report.capabilities.push(...createIdentityCapabilities(compiled.value));
-    }
-};
 export const compileProject = async (inputPath, options = {}) => {
     const plan = await buildCompilePlan(inputPath);
+    const worldBindings = options.worldBindingsPath === undefined
+        ? undefined
+        : await loadWorldBindingsForCompile(plan, options.worldBindingsPath, resolveNoopolisRunId(process.env));
     // The default output directory lives under the resolved project root, not the
     // process working directory, so `spawnfile compile ./org` writes ./org/.spawn.
     const outputDirectory = options.outputDirectory
@@ -231,17 +172,21 @@ export const compileProject = async (inputPath, options = {}) => {
         enforcePolicy(compiled.report, compiled.value.policyMode, compiled.value.policyOnDegrade);
     }
     const moltnetArtifacts = await generateMoltnetArtifacts(plan);
-    const hasStagedMoltnetBinaries = moltnetArtifacts
+    const moltnetRelease = moltnetArtifacts
         ? await stageMoltnetBinaries(outputDirectory, {
             architecture: options.containerArchitecture
         })
-        : false;
+        : undefined;
     await injectMoltnetWorkspaceFiles(outputDirectory, compiledNodes, moltnetArtifacts);
+    const resolvedRuntimePackageOverrides = await stageRuntimePackageOverrides(outputDirectory, options.runtimePackageOverrides);
     const generatedAt = new Date().toISOString();
     const containerArtifacts = await createContainerArtifacts(plan, compiledNodes, {
         generatedAt,
-        hasStagedMoltnetBinaries,
-        moltnet: moltnetArtifacts
+        hasStagedMoltnetBinaries: Boolean(moltnetRelease),
+        moltnet: moltnetArtifacts,
+        moltnetRelease,
+        runtimePackageOverrides: resolvedRuntimePackageOverrides,
+        ...(worldBindings ? { worldBindings } : {})
     });
     await writeEmittedFiles(outputDirectory, containerArtifacts.files);
     await Promise.all(containerArtifacts.executablePaths.map((filePath) => chmod(path.join(outputDirectory, filePath), 0o755)));
@@ -252,5 +197,12 @@ export const compileProject = async (inputPath, options = {}) => {
         projectName: containerArtifacts.distribution.report.organization.project
     });
     const reportPath = await writeCompileReport(outputDirectory, report);
-    return { outputDirectory, report, reportPath };
+    const organizationReadinessEvidence = createOrganizationReadinessEvidence({
+        compileVersion: report.spawnfile_version,
+        containerArtifacts,
+        moltnetArtifacts,
+        plan,
+        ...(worldBindings ? { worldBindings } : {})
+    });
+    return { organizationReadinessEvidence, outputDirectory, report, reportPath };
 };

package/dist/compiler/compileProjectPolicy.d.ts

@@ -0,0 +1,5 @@
+import type { Manifest } from "../manifest/index.js";
+import { type NodeReport } from "../report/index.js";
+export type PolicyMode = NonNullable<Manifest["policy"]>["mode"];
+export type OnDegrade = NonNullable<Manifest["policy"]>["on_degrade"];
+export declare const enforcePolicy: (nodeReport: NodeReport, policyMode: PolicyMode | null, onDegrade: OnDegrade | null) => void;

package/dist/compiler/compileProjectPolicy.js

@@ -0,0 +1,21 @@
+import { createDiagnostic } from "../report/index.js";
+export const enforcePolicy = (nodeReport, policyMode, onDegrade) => {
+    for (const capability of nodeReport.capabilities) {
+        if (capability.outcome === "unsupported") {
+            if (policyMode === "strict") {
+                throw new Error(`Policy violation: ${capability.key} is unsupported for ${nodeReport.id} (strict mode)${capability.message ? `: ${capability.message}` : ""}`);
+            }
+            if (policyMode === "warn") {
+                nodeReport.diagnostics.push(createDiagnostic("warn", `Policy warning: ${capability.key} is unsupported for ${nodeReport.id}${capability.message ? `: ${capability.message}` : ""}`));
+            }
+        }
+        if (capability.outcome === "degraded") {
+            if (onDegrade === "error") {
+                throw new Error(`Policy violation: ${capability.key} is degraded for ${nodeReport.id} (on_degrade: error)${capability.message ? `: ${capability.message}` : ""}`);
+            }
+            if (onDegrade === "warn") {
+                nodeReport.diagnostics.push(createDiagnostic("warn", `Policy warning: ${capability.key} is degraded for ${nodeReport.id}${capability.message ? `: ${capability.message}` : ""}`));
+            }
+        }
+    }
+};

package/dist/compiler/compileProjectReports.d.ts

@@ -0,0 +1,9 @@
+import type { NodeReport } from "../report/index.js";
+import type { TeamCompileSupport } from "./compileProjectSupport.js";
+import type { ResolvedAgentNode, ResolvedTeamNode } from "./types.js";
+interface ReportTarget {
+    report: NodeReport;
+    value: ResolvedAgentNode | ResolvedTeamNode;
+}
+export declare const augmentNodeReports: (compiledNodes: ReportTarget[], support: TeamCompileSupport) => void;
+export {};

package/dist/compiler/compileProjectReports.js

@@ -0,0 +1,52 @@
+const createIdentityCapabilities = (node) => [
+    ...(node.surfaces?.slack?.identity
+        ? [{
+                key: "surfaces.slack.identity",
+                message: "Declared Slack identity was preserved for roster output",
+                outcome: "supported"
+            }]
+        : []),
+    ...(node.surfaces?.discord?.identity
+        ? [{
+                key: "surfaces.discord.identity",
+                message: "Declared Discord identity was preserved for roster output",
+                outcome: "supported"
+            }]
+        : []),
+    ...(node.surfaces?.telegram?.identity
+        ? [{
+                key: "surfaces.telegram.identity",
+                message: "Declared Telegram identity was preserved for roster output",
+                outcome: "supported"
+            }]
+        : []),
+    ...(node.surfaces?.whatsapp?.identity
+        ? [{
+                key: "surfaces.whatsapp.identity",
+                message: "Declared WhatsApp identity was preserved for roster output",
+                outcome: "supported"
+            }]
+        : [])
+];
+const createWorkspaceResourceCapabilities = (node) => (node.workspaceResources?.length ?? 0) > 0
+    ? [{
+            key: "workspace.resources",
+            message: `${node.workspaceResources?.length ?? 0} workspace resource(s) will be prepared at startup`,
+            outcome: "supported"
+        }]
+    : [];
+export const augmentNodeReports = (compiledNodes, support) => {
+    for (const compiled of compiledNodes) {
+        compiled.report.capabilities.push(...createWorkspaceResourceCapabilities(compiled.value));
+        if (compiled.value.kind === "team") {
+            compiled.report.capabilities.push(...(support.capabilitiesByTeamSource.get(compiled.value.source) ?? []));
+            compiled.report.diagnostics.push(...(support.diagnosticsByTeamSource.get(compiled.value.source) ?? []));
+            continue;
+        }
+        const activeEnvironments = support.activeEnvironmentsByAgentSource.get(compiled.value.source);
+        if (activeEnvironments) {
+            compiled.report.active_environments = activeEnvironments;
+        }
+        compiled.report.capabilities.push(...createIdentityCapabilities(compiled.value));
+    }
+};

package/dist/compiler/containerArtifactSummaries.d.ts

@@ -0,0 +1,7 @@
+import type { DistributionOrganizationSummary } from "../distribution/index.js";
+import type { MoltnetArtifacts } from "./moltnetArtifacts.js";
+import type { MoltnetReleaseIdentity } from "./moltnetBinaries.js";
+import type { CompiledNodeArtifact, GeneratedContainerArtifacts } from "./containerArtifactsTypes.js";
+import type { CompilePlan } from "./types.js";
+export declare const createOrganizationSummary: (plan: CompilePlan, compiledNodes: CompiledNodeArtifact[]) => DistributionOrganizationSummary;
+export declare const createMoltnetSummary: (moltnet: MoltnetArtifacts | undefined | null, release: MoltnetReleaseIdentity | undefined) => GeneratedContainerArtifacts["report"]["moltnet"] | undefined;