spawnfile 0.1.13 → 0.1.14

package/dist/ledger/emitters.js

@@ -0,0 +1,188 @@
+import { spawn } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseCausalJsonl } from "@noopolis/stele";
+/** run_id every emitter is invoked with. Sourced from NOOPOLIS_RUN_ID, never model output. */
+export const EMITTER_RUN_ID = "b92-conformance";
+/** Per-emitter kill timeout. `go run` pays a compile cost on a cold module cache. */
+const EMITTER_TIMEOUT_MS = 120_000;
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+// src/ledger -> src -> <repo root>
+const ROOT_DIR = path.resolve(__dirname, "..", "..");
+const ecosystemPath = (name) => path.resolve(ROOT_DIR, "ecosystem", name);
+/**
+ * The four real sibling fixture emitters, invoked by path (never `npm run`).
+ * See B92 packet §1-§2 and each sibling's own runtime/observability AGENTS.md
+ * for what each emitter does.
+ */
+export const EMITTER_SPECS = [
+    {
+        command: ["node_modules/.bin/tsx", "src/runtime/emit-causal-fixture.ts"],
+        cwd: ecosystemPath("simfile"),
+        name: "simfile",
+        output: "stdout-jsonl"
+    },
+    {
+        command: ["node_modules/.bin/tsx", "scripts/emit-causal-fixture.ts"],
+        cwd: ecosystemPath("mneme"),
+        name: "mneme",
+        output: "stdout-jsonl"
+    },
+    {
+        command: ["node_modules/.bin/tsx", "src/observability/emitCausalFixture.ts"],
+        cwd: ecosystemPath("daimon"),
+        name: "daimon",
+        output: "path-line"
+    },
+    {
+        command: ["go", "run", "./cmd/emit-causal-fixture"],
+        cwd: ecosystemPath("moltnet"),
+        name: "moltnet",
+        output: "stdout-jsonl"
+    }
+];
+/**
+ * Builds the adversarial "spoof mode" variant of an `EmitterSpec` (B62
+ * enforcement point #4): the sibling fixture emitter is asked to embed a
+ * forged/claimed identity in its fixture's input or output content, while
+ * still stamping `principal_id` as its own authenticated identity — never
+ * the claimed one. `--spoof` is the flag convention daimon's own fixture
+ * emitter already understands (`npm run emit-causal-fixture:spoof`, see
+ * `ecosystem/daimon/src/observability/emitCausalFixture.ts`); this helper
+ * applies the same convention uniformly across all four `EmitterSpec`s so a
+ * future caller does not need one-off spoof plumbing per sibling.
+ *
+ * `EMITTER_SPOOF_SPECS` is deliberately NOT part of the default real-mode
+ * `EMITTER_SPECS` list `causalConformanceCli.ts` invokes: today only
+ * daimon's real fixture script understands `--spoof` (simfile/mneme/moltnet
+ * have not yet added a spoof-capable fixture variant), so spawning the
+ * other three with an unrecognized flag would break the hermetic real-mode
+ * run. `EMITTER_SPOOF_SPECS` exists for callers — and this file's own
+ * injected-exec tests — that want to exercise spoof-mode collection
+ * explicitly, and is the shape every sibling's real spoof script should
+ * match once added.
+ */
+export const toSpoofEmitterSpec = (spec) => ({
+    ...spec,
+    command: [...spec.command, "--spoof"],
+    name: `${spec.name}-spoof`
+});
+/** The adversarial "spoof mode" counterpart to `EMITTER_SPECS` — see `toSpoofEmitterSpec`. */
+export const EMITTER_SPOOF_SPECS = EMITTER_SPECS.map(toSpoofEmitterSpec);
+/**
+ * Spawns `spec.command` directly (no shell) in `spec.cwd`, with stdout and
+ * stderr captured separately so stderr noise (npm banners, SQLite
+ * ExperimentalWarning, etc.) never corrupts stdout-jsonl parsing. Kills the
+ * child on `EMITTER_TIMEOUT_MS` expiry.
+ */
+export const realExec = (spec) => new Promise((resolve) => {
+    const [command, ...args] = spec.command;
+    if (!command) {
+        resolve({ exitCode: null, spawnError: new Error("empty command"), stderr: "", stdout: "", timedOut: false });
+        return;
+    }
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let settled = false;
+    const child = spawn(command, args, {
+        cwd: spec.cwd,
+        env: { ...process.env, NOOPOLIS_RUN_ID: EMITTER_RUN_ID }
+    });
+    const timer = setTimeout(() => {
+        timedOut = true;
+        child.kill("SIGKILL");
+    }, EMITTER_TIMEOUT_MS);
+    child.stdout?.on("data", (chunk) => {
+        stdout += chunk.toString("utf8");
+    });
+    child.stderr?.on("data", (chunk) => {
+        stderr += chunk.toString("utf8");
+    });
+    child.on("error", (error) => {
+        if (settled) {
+            return;
+        }
+        settled = true;
+        clearTimeout(timer);
+        resolve({ exitCode: null, spawnError: error, stderr, stdout, timedOut });
+    });
+    child.on("close", (code) => {
+        if (settled) {
+            return;
+        }
+        settled = true;
+        clearTimeout(timer);
+        resolve({ exitCode: code, stderr, stdout, timedOut });
+    });
+});
+const lastNonEmptyLine = (text) => {
+    const lines = text.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+    return lines[lines.length - 1];
+};
+/**
+ * Runs every emitter spec sequentially (daimon reuses a fixed on-disk
+ * directory across runs, so concurrent invocation is unsafe) and turns each
+ * result into either a conformance fixture source or a reported issue.
+ * Never silently skips an emitter: spawn error, timeout, nonzero exit, zero
+ * parsed records, and an unreadable daimon path-line are all reported as a
+ * `ConformanceIssue{source}` rather than dropped.
+ */
+export const collectEmitterFixtures = async (specs = EMITTER_SPECS, exec = realExec) => {
+    const sources = [];
+    const issues = [];
+    for (const spec of specs) {
+        const result = await exec(spec);
+        if (result.spawnError) {
+            issues.push({ message: `spawn error: ${result.spawnError.message}`, source: spec.name });
+            continue;
+        }
+        if (result.timedOut) {
+            issues.push({ message: `timed out after ${EMITTER_TIMEOUT_MS}ms`, source: spec.name });
+            continue;
+        }
+        if (result.exitCode !== 0) {
+            const stderrDetail = result.stderr.trim();
+            issues.push({
+                message: `exited with code ${String(result.exitCode)}${stderrDetail ? `: ${stderrDetail}` : ""}`,
+                source: spec.name
+            });
+            continue;
+        }
+        let jsonl;
+        if (spec.output === "path-line") {
+            const pathLine = lastNonEmptyLine(result.stdout);
+            if (!pathLine) {
+                issues.push({ message: "path-line emitter produced no output path on stdout", source: spec.name });
+                continue;
+            }
+            try {
+                jsonl = await readFile(pathLine, "utf8");
+            }
+            catch (error) {
+                issues.push({
+                    message: `unreadable path ${pathLine}: ${error instanceof Error ? error.message : String(error)}`,
+                    source: spec.name
+                });
+                continue;
+            }
+        }
+        else {
+            jsonl = result.stdout;
+        }
+        const { errors, events } = parseCausalJsonl(jsonl);
+        if (errors.length > 0) {
+            for (const error of errors) {
+                issues.push({ line: error.line, message: error.message, source: spec.name });
+            }
+            continue;
+        }
+        if (events.length === 0) {
+            issues.push({ message: "emitter produced zero parsed records", source: spec.name });
+            continue;
+        }
+        sources.push({ jsonl, name: spec.name });
+    }
+    return { issues, sources };
+};

package/dist/ledger/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./causeNamespace.js";
+export * from "./conformance.js";
+export * from "./emitters.js";
+export * from "@noopolis/stele";

package/dist/ledger/index.js

@@ -0,0 +1,4 @@
+export * from "./causeNamespace.js";
+export * from "./conformance.js";
+export * from "./emitters.js";
+export * from "@noopolis/stele";

package/dist/ledger/principal.d.ts

@@ -0,0 +1,96 @@
+import type { CausalEvent } from "@noopolis/stele";
+import { PRINCIPAL_GRAMMAR_SOURCE } from "@noopolis/stele";
+/**
+ * Principal grammar (specs/CAUSAL.md §3, `specs/causal-event.v1.schema.json`
+ * `principal_id.pattern`): `agent:<agentId>` | `operator:<credentialKey|name>`
+ * | `system:<system>[.<component>]`. A principal is minted only by a
+ * trusted layer (root's container env, a per-agent harness config, an
+ * authn claim) — never derived from `request.From`, tool arguments, or
+ * model output. This module owns parsing/validating that grammar on the
+ * root side, plus the per-event conformance checks conformance.ts layers
+ * on top of it; it has no I/O and no knowledge of any specific authority's
+ * transport.
+ *
+ * The grammar itself (`PRINCIPAL_GRAMMAR_SOURCE`) is defined once in
+ * `envelope.ts` — the same regex `causalEventSchema` enforces on the wire —
+ * and re-exported from here so existing callers of this module keep working;
+ * this file never hardcodes a second copy of the pattern.
+ */
+export type PrincipalKind = "agent" | "operator" | "system";
+export interface Principal {
+    id: string;
+    kind: PrincipalKind;
+}
+export interface PrincipalParseError {
+    message: string;
+}
+export { PRINCIPAL_GRAMMAR_SOURCE };
+/**
+ * `system:moltnet.anonymous` is moltnet's stamped principal for the
+ * unauthenticated dev-mode case (no authn claims on the request context at
+ * all) — see `ecosystem/moltnet/internal/rooms/causal.go`. It is grammar-
+ * valid (a real `system:` principal) but conformance treats it as
+ * unauthenticated on purpose: it is a placeholder for "no principal",
+ * never a credential to attribute causal events to.
+ */
+export declare const ANONYMOUS_SYSTEM_PRINCIPAL = "system:moltnet.anonymous";
+/**
+ * Parses a `principal_id` string against the grammar. Returns a
+ * `PrincipalParseError` (never throws) for anything that does not match
+ * `^(agent|operator|system):.+` — a bare id with no prefix, an unknown
+ * prefix, or an empty string all land here.
+ */
+export declare const parsePrincipal: (value: string) => Principal | PrincipalParseError;
+export declare const isPrincipalParseError: (value: Principal | PrincipalParseError) => value is PrincipalParseError;
+/**
+ * True only for a principal that is both grammar-valid and represents a
+ * real authenticated identity: grammar mismatches, a bare id, an empty
+ * trailing id, the literal `anonymous`, and `system:moltnet.anonymous`
+ * (moltnet's unauthenticated dev-mode placeholder) are all rejected.
+ * Conformance (`conformance.ts`) uses this as its per-event grammar check.
+ */
+export declare const isAuthenticatedPrincipal: (value: string) => boolean;
+/**
+ * Lightweight structural sibling of `conformance.ts`'s `ConformanceIssue`
+ * (message + source; no line number — these are per-event, not per-line
+ * fixture checks). Kept local to this module to avoid a circular import
+ * with `conformance.ts`, which imports `PRINCIPAL_DISCIPLINE_CHECKS` from
+ * here; every field here is a subset of `ConformanceIssue`'s, so these
+ * values are usable anywhere a `ConformanceIssue` is expected.
+ */
+export interface PrincipalConformanceIssue {
+    message: string;
+    source: string;
+}
+export type PrincipalEventCheck = (event: CausalEvent, sourceName: string) => PrincipalConformanceIssue[];
+/**
+ * Principal-grammar check (specs/CAUSAL.md §3, B62 enforcement point #4a):
+ * every event's `principal_id` must be an authenticated `agent:`/`operator:`/
+ * `system:` principal — never a bare id, the literal `anonymous`, or
+ * moltnet's `system:moltnet.anonymous` unauthenticated placeholder.
+ */
+export declare const checkPrincipalGrammar: PrincipalEventCheck;
+/**
+ * Stream/principal consistency check (B62 enforcement point #4b): for
+ * daimon's turn events, `principal_id` must exactly equal `emitter.stream_id`
+ * — the agent whose stream this is must be the agent this event is
+ * attributed to. This deliberately does NOT apply to daimon's control-wake
+ * events (`control.wake.accepted`/`control.wake.denied`), whose stream is
+ * the *target* agent being woken but whose principal is the *operator* who
+ * requested the wake — an intentional mismatch, not a violation.
+ */
+export declare const checkStreamPrincipalConsistency: PrincipalEventCheck;
+/**
+ * Per-event checks `conformance.ts`'s `runSyntheticConformance` AND (as of
+ * the B62 fix) `runRealConformance` both layer on top of schema parsing +
+ * payload minimums, via `validateConformanceSources`'s `extraChecks`
+ * parameter. Wiring this into `runRealConformance` is what gives the real
+ * `npm run test:causal-conformance` path teeth: without it, a real sibling
+ * emitter stamping a non-grammar `principal_id` would pass conformance
+ * silently (the schema-level `PRINCIPAL_GRAMMAR_SOURCE` regex in
+ * `envelope.ts` already rejects most malformed principals at parse time, but
+ * `checkStreamPrincipalConsistency` in particular is conformance-only — it
+ * has no envelope-schema equivalent). `realConformance.test.ts`'s hand-
+ * authored fixtures are kept grammar-compliant for exactly this reason.
+ */
+export declare const PRINCIPAL_DISCIPLINE_CHECKS: PrincipalEventCheck[];

package/dist/ledger/principal.js

@@ -0,0 +1,121 @@
+import { PRINCIPAL_GRAMMAR_SOURCE } from "@noopolis/stele";
+export { PRINCIPAL_GRAMMAR_SOURCE };
+/** Boolean grammar test built from the single source of truth, `PRINCIPAL_GRAMMAR_SOURCE`. */
+const PRINCIPAL_PATTERN = new RegExp(PRINCIPAL_GRAMMAR_SOURCE, "u");
+/**
+ * `system:moltnet.anonymous` is moltnet's stamped principal for the
+ * unauthenticated dev-mode case (no authn claims on the request context at
+ * all) — see `ecosystem/moltnet/internal/rooms/causal.go`. It is grammar-
+ * valid (a real `system:` principal) but conformance treats it as
+ * unauthenticated on purpose: it is a placeholder for "no principal",
+ * never a credential to attribute causal events to.
+ */
+export const ANONYMOUS_SYSTEM_PRINCIPAL = "system:moltnet.anonymous";
+/** The literal bare string some legacy/dev paths might stamp instead of a real principal. */
+const ANONYMOUS_LITERAL = "anonymous";
+/**
+ * Parses a `principal_id` string against the grammar. Returns a
+ * `PrincipalParseError` (never throws) for anything that does not match
+ * `^(agent|operator|system):.+` — a bare id with no prefix, an unknown
+ * prefix, or an empty string all land here.
+ */
+export const parsePrincipal = (value) => {
+    if (typeof value !== "string" || value.length === 0) {
+        return { message: "principal_id must be a non-empty string" };
+    }
+    if (!PRINCIPAL_PATTERN.test(value)) {
+        return {
+            message: `principal_id "${value}" does not match the <agent|operator|system>:<id> grammar (specs/CAUSAL.md §3)`
+        };
+    }
+    // PRINCIPAL_PATTERN already guarantees a `<kind>:<rest>` shape with a
+    // known kind prefix, so a plain split on the first colon is safe and
+    // avoids maintaining a second, capturing copy of the same pattern.
+    const separatorIndex = value.indexOf(":");
+    const kind = value.slice(0, separatorIndex);
+    const id = value.slice(separatorIndex + 1);
+    return { id, kind };
+};
+export const isPrincipalParseError = (value) => "message" in value;
+/**
+ * True only for a principal that is both grammar-valid and represents a
+ * real authenticated identity: grammar mismatches, a bare id, an empty
+ * trailing id, the literal `anonymous`, and `system:moltnet.anonymous`
+ * (moltnet's unauthenticated dev-mode placeholder) are all rejected.
+ * Conformance (`conformance.ts`) uses this as its per-event grammar check.
+ */
+export const isAuthenticatedPrincipal = (value) => {
+    if (typeof value !== "string") {
+        return false;
+    }
+    const trimmed = value.trim();
+    if (trimmed.length === 0 || trimmed === ANONYMOUS_LITERAL || trimmed === ANONYMOUS_SYSTEM_PRINCIPAL) {
+        return false;
+    }
+    const parsed = parsePrincipal(trimmed);
+    if (isPrincipalParseError(parsed)) {
+        return false;
+    }
+    return parsed.id.trim().length > 0;
+};
+/** `type`s whose `principal_id` must exactly equal `emitter.stream_id` (a daimon `agent:<id>` stream). */
+const AGENT_STREAM_TURN_EVENT_TYPES = new Set(["turn.input.submitted", "turn.output.completed"]);
+/**
+ * Principal-grammar check (specs/CAUSAL.md §3, B62 enforcement point #4a):
+ * every event's `principal_id` must be an authenticated `agent:`/`operator:`/
+ * `system:` principal — never a bare id, the literal `anonymous`, or
+ * moltnet's `system:moltnet.anonymous` unauthenticated placeholder.
+ */
+export const checkPrincipalGrammar = (event, sourceName) => {
+    if (isAuthenticatedPrincipal(event.principal_id)) {
+        return [];
+    }
+    return [
+        {
+            message: `event ${event.event_id} has principal_id "${event.principal_id}", which is not an authenticated ` +
+                `agent:/operator:/system: principal (specs/CAUSAL.md §3)`,
+            source: sourceName
+        }
+    ];
+};
+/**
+ * Stream/principal consistency check (B62 enforcement point #4b): for
+ * daimon's turn events, `principal_id` must exactly equal `emitter.stream_id`
+ * — the agent whose stream this is must be the agent this event is
+ * attributed to. This deliberately does NOT apply to daimon's control-wake
+ * events (`control.wake.accepted`/`control.wake.denied`), whose stream is
+ * the *target* agent being woken but whose principal is the *operator* who
+ * requested the wake — an intentional mismatch, not a violation.
+ */
+export const checkStreamPrincipalConsistency = (event, sourceName) => {
+    if (event.emitter.system !== "daimon" || !AGENT_STREAM_TURN_EVENT_TYPES.has(event.type)) {
+        return [];
+    }
+    if (!event.emitter.stream_id.startsWith("agent:") || event.principal_id === event.emitter.stream_id) {
+        return [];
+    }
+    return [
+        {
+            message: `event ${event.event_id} is on stream ${event.emitter.stream_id} but has principal_id ` +
+                `"${event.principal_id}" — daimon turn events must be attributed to the agent that owns their stream`,
+            source: sourceName
+        }
+    ];
+};
+/**
+ * Per-event checks `conformance.ts`'s `runSyntheticConformance` AND (as of
+ * the B62 fix) `runRealConformance` both layer on top of schema parsing +
+ * payload minimums, via `validateConformanceSources`'s `extraChecks`
+ * parameter. Wiring this into `runRealConformance` is what gives the real
+ * `npm run test:causal-conformance` path teeth: without it, a real sibling
+ * emitter stamping a non-grammar `principal_id` would pass conformance
+ * silently (the schema-level `PRINCIPAL_GRAMMAR_SOURCE` regex in
+ * `envelope.ts` already rejects most malformed principals at parse time, but
+ * `checkStreamPrincipalConsistency` in particular is conformance-only — it
+ * has no envelope-schema equivalent). `realConformance.test.ts`'s hand-
+ * authored fixtures are kept grammar-compliant for exactly this reason.
+ */
+export const PRINCIPAL_DISCIPLINE_CHECKS = [
+    checkPrincipalGrammar,
+    checkStreamPrincipalConsistency
+];

package/dist/manifest/externalParticipantSchemas.d.ts

@@ -0,0 +1,18 @@
+import { z } from "zod";
+export declare const externalParticipantServiceSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodLiteral<"service">;
+    surfaces: z.ZodObject<{
+        moltnet: z.ZodArray<z.ZodObject<{
+            network: z.ZodString;
+            auth: z.ZodObject<{
+                token_id: z.ZodString;
+            }, z.core.$strict>;
+            dms: z.ZodObject<{
+                enabled: z.ZodLiteral<true>;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ExternalParticipantService = z.infer<typeof externalParticipantServiceSchema>;
+export type ExternalParticipantMoltnetAttachment = ExternalParticipantService["surfaces"]["moltnet"][number];

package/dist/manifest/externalParticipantSchemas.js

@@ -0,0 +1,17 @@
+import { z } from "zod";
+const segment = z.string().regex(/^[a-z][a-z0-9-]{0,62}$/u);
+const attachmentSchema = z.object({
+    network: segment,
+    auth: z.object({ token_id: segment }).strict(),
+    dms: z.object({ enabled: z.literal(true) }).strict()
+}).strict();
+export const externalParticipantServiceSchema = z.object({
+    id: segment,
+    kind: z.literal("service"),
+    surfaces: z.object({ moltnet: z.array(attachmentSchema).min(1).max(16) }).strict()
+}).strict().superRefine((value, context) => {
+    const networks = value.surfaces.moltnet.map((entry) => entry.network);
+    if (new Set(networks).size !== networks.length) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "external participant networks must be unique" });
+    }
+});

package/dist/manifest/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./inlineAgentMember.js";
 export * from "./loadManifest.js";
 export * from "./renderSpawnfile.js";
 export * from "./scaffold.js";

package/dist/manifest/index.js

@@ -1,3 +1,4 @@
+export * from "./inlineAgentMember.js";
 export * from "./loadManifest.js";
 export * from "./renderSpawnfile.js";
 export * from "./scaffold.js";

package/dist/manifest/inlineAgentMember.d.ts

@@ -0,0 +1,2 @@
+import type { AgentManifest, InlineAgentMember, TeamManifest } from "./schemas.js";
+export declare const materializeInlineAgentManifest: (team: TeamManifest, member: InlineAgentMember) => AgentManifest;

package/dist/manifest/inlineAgentMember.js

@@ -0,0 +1,9 @@
+export const materializeInlineAgentManifest = (team, member) => {
+    const { id, ...agentFields } = member;
+    return {
+        spawnfile_version: team.spawnfile_version,
+        kind: "agent",
+        name: id,
+        ...agentFields
+    };
+};

package/dist/manifest/loadManifest.js

@@ -3,7 +3,7 @@ import { parse as parseYaml } from "yaml";
 import { z } from "zod";
 import { fileExists, isSymlink, readUtf8File, resolveProjectPath } from "../filesystem/index.js";
 import { SpawnfileError } from "../shared/index.js";
-import { isAgentManifest, isTeamManifest, manifestSchema } from "./schemas.js";
+import { isAgentManifest, isInlineAgentMember, isReferencedMember, isTeamManifest, manifestSchema } from "./schemas.js";
 import { parseSkillFrontmatter } from "./skillFrontmatter.js";
 const ensureUniqueNames = (names, label) => {
     const seen = new Set();
@@ -84,16 +84,19 @@ const validateSkills = async (manifestPath, skills) => {
         parseSkillFrontmatter(await readUtf8File(skillFilePath));
     }));
 };
-const validateLocalAgentManifest = async (manifestPath, manifest) => {
-    const agentWorkspaceSkills = manifest.workspace?.skills;
-    const agentEnvironment = manifest.environment;
+const validateLocalAgentConfiguration = async (manifestPath, agent) => {
+    const agentWorkspaceSkills = agent.workspace?.skills;
+    const agentEnvironment = agent.environment;
     ensureUniqueNames((agentEnvironment?.mcp_servers ?? []).map((server) => server.name), "MCP server");
-    ensureUniqueNames((manifest.subagents ?? []).map((subagent) => subagent.id), "subagent id");
-    await validateDocFiles(manifestPath, manifest.workspace?.docs);
+    await validateDocFiles(manifestPath, agent.workspace?.docs);
     await validateSkills(manifestPath, agentWorkspaceSkills);
-    await validateManifestRefs(manifestPath, manifest.subagents?.map((subagent) => subagent.ref), "Subagent");
     validateSkillRequirements(agentWorkspaceSkills, getMcpNames(agentEnvironment?.mcp_servers));
 };
+const validateLocalAgentManifest = async (manifestPath, manifest) => {
+    ensureUniqueNames((manifest.subagents ?? []).map((subagent) => subagent.id), "subagent id");
+    await validateLocalAgentConfiguration(manifestPath, manifest);
+    await validateManifestRefs(manifestPath, manifest.subagents?.map((subagent) => subagent.ref), "Subagent");
+};
 const getSharedMcpNames = (shared) => getMcpNames(shared?.environment?.mcp_servers);
 const validateLocalTeamManifest = async (manifestPath, manifest) => {
     const sharedWorkspace = manifest.shared?.workspace;
@@ -102,7 +105,10 @@ const validateLocalTeamManifest = async (manifestPath, manifest) => {
     ensureUniqueNames(manifest.members.map((member) => member.id), "member id");
     await validateDocFiles(manifestPath, sharedWorkspace?.docs);
     await validateSkills(manifestPath, sharedWorkspace?.skills);
-    await validateManifestRefs(manifestPath, manifest.members.map((member) => member.ref), "Member");
+    await validateManifestRefs(manifestPath, manifest.members.filter(isReferencedMember).map((member) => member.ref), "Member");
+    await Promise.all(manifest.members
+        .filter(isInlineAgentMember)
+        .map((member) => validateLocalAgentConfiguration(manifestPath, member)));
     validateSkillRequirements(sharedWorkspace?.skills, getSharedMcpNames(manifest.shared));
     const memberIds = new Set(manifest.members.map((member) => member.id));
     if (manifest.lead && !memberIds.has(manifest.lead)) {

package/dist/manifest/mcpSchemas.d.ts

@@ -0,0 +1,17 @@
+import { z } from "zod";
+export declare const mcpServerSchema: z.ZodObject<{
+    args: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    auth: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodLiteral<"bearer">>;
+        secret: z.ZodString;
+    }, z.core.$strict>>;
+    command: z.ZodOptional<z.ZodString>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    name: z.ZodString;
+    transport: z.ZodEnum<{
+        sse: "sse";
+        stdio: "stdio";
+        streamable_http: "streamable_http";
+    }>;
+    url: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;

package/dist/manifest/mcpSchemas.js

@@ -0,0 +1,41 @@
+import { z } from "zod";
+const mcpAuthSchema = z
+    .object({
+    mode: z.literal("bearer").optional(),
+    secret: z.string()
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.mode === "bearer" && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(value.secret)) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["secret"],
+            message: "bearer auth.secret must be a valid shell environment-variable name"
+        });
+    }
+});
+export const mcpServerSchema = z
+    .object({
+    args: z.array(z.string()).optional(),
+    auth: mcpAuthSchema.optional(),
+    command: z.string().optional(),
+    env: z.record(z.string(), z.string()).optional(),
+    name: z.string().min(1),
+    transport: z.enum(["sse", "stdio", "streamable_http"]),
+    url: z.string().optional()
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.name.startsWith("spawnfile.") || value.name.startsWith("mneme-")) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "MCP server name is reserved for compiler-owned generated services" });
+    }
+    if (value.transport === "stdio" && !value.command) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "stdio MCP servers must declare command" });
+    }
+    if (value.transport === "stdio" && value.auth?.mode === "bearer") {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "stdio MCP servers do not support bearer auth" });
+    }
+    if (value.transport !== "stdio" && !value.url) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: `${value.transport} MCP servers must declare url` });
+    }
+});