spawnfile 0.1.13 → 0.1.17

package/dist/compiler/agentNodeMerge.js

@@ -0,0 +1,79 @@
+import path from "node:path";
+import { SpawnfileError } from "../shared/index.js";
+import { stableStringify } from "./helpers.js";
+import { mergeWorkspaceResources } from "./workspaceResources.js";
+const assertSame = (field, existing, next, nodeName) => {
+    if (stableStringify(existing) === stableStringify(next)) {
+        return;
+    }
+    throw new SpawnfileError("compile_error", `Agent ${nodeName} resolves with incompatible ${field} across team imports`);
+};
+const mergeEnvStrict = (existing, next, nodeName) => {
+    const merged = { ...existing };
+    for (const [key, value] of Object.entries(next)) {
+        if (merged[key] !== undefined && merged[key] !== value) {
+            throw new SpawnfileError("validation_error", `Agent ${nodeName} receives conflicting environment variable ${key} across team imports`);
+        }
+        merged[key] = value;
+    }
+    return merged;
+};
+const mergeByKeyStrict = (existing, next, getKey, label, nodeName) => {
+    const merged = new Map();
+    for (const value of existing ?? []) {
+        merged.set(getKey(value), value);
+    }
+    for (const value of next ?? []) {
+        const key = getKey(value);
+        const previous = merged.get(key);
+        if (previous && stableStringify(previous) !== stableStringify(value)) {
+            throw new SpawnfileError("validation_error", `Agent ${nodeName} receives conflicting ${label} ${key} across team imports`);
+        }
+        merged.set(key, value);
+    }
+    return merged.size > 0 ? [...merged.values()] : undefined;
+};
+const mergeDocuments = (existing, next, agentSourcePath) => {
+    const agentDirectory = path.dirname(agentSourcePath);
+    const isAgentLocalDoc = (doc) => {
+        const sourcePath = path.resolve(doc.sourcePath);
+        return sourcePath === agentDirectory || sourcePath.startsWith(`${agentDirectory}${path.sep}`);
+    };
+    const merged = new Map(existing.filter(isAgentLocalDoc).map((doc) => [doc.role, doc]));
+    for (const doc of next.filter(isAgentLocalDoc)) {
+        if (!merged.has(doc.role)) {
+            merged.set(doc.role, doc);
+        }
+    }
+    return [...merged.values()];
+};
+const packageKey = (pkg) => `${pkg.manager}::${pkg.name}`;
+const skillKey = (skill) => skill.ref;
+export const mergeCompatibleAgentNode = (existing, next) => {
+    assertSame("description", existing.description, next.description, existing.name);
+    assertSame("execution", existing.execution, next.execution, existing.name);
+    assertSame("expose", existing.expose, next.expose, existing.name);
+    assertSame("memory", existing.memory, next.memory, existing.name);
+    assertSame("name", existing.name, next.name, existing.name);
+    assertSame("policy mode", existing.policyMode, next.policyMode, existing.name);
+    assertSame("policy on_degrade", existing.policyOnDegrade, next.policyOnDegrade, existing.name);
+    assertSame("runtime", existing.runtime, next.runtime, existing.name);
+    assertSame("schedule", existing.schedule, next.schedule, existing.name);
+    assertSame("source", existing.source, next.source, existing.name);
+    assertSame("source path", existing.sourcePath, next.sourcePath, existing.name);
+    assertSame("surfaces", existing.surfaces, next.surfaces, existing.name);
+    existing.docs = mergeDocuments(existing.docs, next.docs, existing.sourcePath ?? existing.source);
+    existing.env = mergeEnvStrict(existing.env, next.env, existing.name);
+    existing.mcpServers = mergeByKeyStrict(existing.mcpServers, next.mcpServers, (server) => server.name, "MCP server", existing.name) ?? [];
+    existing.packages = mergeByKeyStrict(existing.packages, next.packages, packageKey, "package", existing.name);
+    existing.secrets = mergeByKeyStrict(existing.secrets, next.secrets, (secret) => secret.name, "secret", existing.name) ?? [];
+    existing.skills = mergeByKeyStrict(existing.skills, next.skills, skillKey, "skill", existing.name) ?? [];
+    existing.workspaceResources = mergeWorkspaceResources([
+        ...(existing.workspaceResources ?? []),
+        ...(next.workspaceResources ?? [])
+    ], [], existing.name, {
+        kind: "agent",
+        key: existing.source,
+        name: existing.name
+    });
+};

package/dist/compiler/agentSurfaces.js

@@ -23,11 +23,21 @@ export const resolveAgentSurfaces = (surfaces) => {
     }
     if (surfaces.moltnet) {
         resolved.moltnet = surfaces.moltnet.map((attachment) => ({
+            ...(attachment.auth
+                ? {
+                    auth: {
+                        tokenId: attachment.auth.token_id
+                    }
+                }
+                : {}),
             ...(attachment.dms
                 ? {
                     dms: {
                         enabled: attachment.dms.enabled,
-                        ...(attachment.dms.wake ? { wake: attachment.dms.wake } : {})
+                        ...(attachment.dms.wake ? { wake: attachment.dms.wake } : {}),
+                        ...(attachment.dms.allowed_wake_senders !== undefined
+                            ? { allowedWakeSenders: [...attachment.dms.allowed_wake_senders] }
+                            : {})
                     }
                 }
                 : {}),

package/dist/compiler/buildCompilePlan.js

@@ -2,9 +2,12 @@ import { getCanonicalManifestPath, getManifestPath } from "../filesystem/index.j
 import { loadManifest, isAgentManifest } from "../manifest/index.js";
 import { assignStableNodeIds } from "./helpers.js";
 import { resolvePlanMoltnetAttachments } from "./moltnetResolution.js";
+import { resolvePlanMemoryAccess } from "./memoryResolution.js";
 import { resolveMoltnetRoomMemberships } from "./moltnetRoomMemberships.js";
 import { createRuntimeGroups } from "./buildCompilePlanRuntime.js";
+import { validateAllowedWakeSenders } from "./moltnetAllowedWakeSendersValidation.js";
 import { createCompilePlanTraversal } from "./buildCompilePlanTraversal.js";
+import { resolveMoltnetExternalParticipantIntents, resolveOrganizationIdentity, validateB31MoltnetAuth } from "./organizationIdentity.js";
 export const buildCompilePlan = async (inputPath) => {
     const rootManifestPath = getCanonicalManifestPath(getManifestPath(inputPath));
     const loadCache = new Map();
@@ -60,7 +63,21 @@ export const buildCompilePlan = async (inputPath) => {
         root: rootManifestPath,
         runtimes: createRuntimeGroups(compilePlanNodes)
     };
+    const organizationIdentity = resolveOrganizationIdentity(compilePlan);
+    if (organizationIdentity)
+        compilePlan.organizationIdentity = organizationIdentity;
+    // Reject duplicate or invalid authored actor selections before attachment
+    // synthesis can merge them into a single canonical attachment.
+    validateB31MoltnetAuth(compilePlan);
+    const externalParticipantIntents = resolveMoltnetExternalParticipantIntents(compilePlan);
+    if (organizationIdentity)
+        compilePlan.moltnetExternalParticipantIntents = externalParticipantIntents;
     compilePlan.moltnetRoomMemberships = resolveMoltnetRoomMemberships(compilePlan);
+    resolvePlanMemoryAccess(compilePlan);
     resolvePlanMoltnetAttachments(compilePlan);
+    // Recheck the actual canonical attachments emitted after representative
+    // synthesis and duplicate merging.
+    validateB31MoltnetAuth(compilePlan);
+    validateAllowedWakeSenders(compilePlan);
     return compilePlan;
 };

package/dist/compiler/buildCompilePlanAgent.d.ts

@@ -0,0 +1,11 @@
+import { type AgentManifest } from "../manifest/index.js";
+import type { AgentVisitContext } from "./buildCompilePlanRuntime.js";
+import type { ResolvedAgentNode } from "./types.js";
+interface ResolveAgentNodeOptions {
+    context: AgentVisitContext;
+    manifest: AgentManifest;
+    manifestPath: string;
+    source: string;
+}
+export declare const resolveAgentNode: ({ context, manifest, manifestPath, source }: ResolveAgentNodeOptions) => Promise<ResolvedAgentNode>;
+export {};

package/dist/compiler/buildCompilePlanAgent.js

@@ -0,0 +1,56 @@
+import { mergeExecution } from "../manifest/index.js";
+import { resolveAgentSurfaces } from "./agentSurfaces.js";
+import { resolveDescription, resolveRuntime } from "./buildCompilePlanRuntime.js";
+import { DEFAULT_POLICY_MODE, DEFAULT_POLICY_ON_DEGRADE, mergeResolvedDocuments, resolveEffectiveEnvironment } from "./buildCompilePlanTraversalHelpers.js";
+import { getMcpNames, validateEffectiveSkillRequirements } from "./compilePlanHelpers.js";
+import { applyExecutionDefaults } from "./executionDefaults.js";
+import { resolveDeclaredMemoryBanks } from "./memoryResolution.js";
+import { assertRuntimeSupportsExecutionModelAuth } from "./modelAuth.js";
+import { loadResolvedSkills, mergeResolvedSkills } from "./surfaces.js";
+import { assertRuntimeSupportsAgentSurfaces } from "./surfaceSupport.js";
+import { mergeWorkspaceResources } from "./workspaceResources.js";
+export const resolveAgentNode = async ({ context, manifest, manifestPath, source }) => {
+    const runtime = await resolveRuntime(manifest, context);
+    const execution = applyExecutionDefaults(context.isSubagent
+        ? mergeExecution(context.inheritedExecution, manifest.execution)
+        : manifest.execution);
+    assertRuntimeSupportsExecutionModelAuth(runtime.name, execution, manifest.name);
+    const environment = resolveEffectiveEnvironment(context.inheritedShared?.surface?.environment, manifest.environment);
+    const inheritedSkills = context.inheritedShared
+        ? await loadResolvedSkills(context.inheritedShared.manifestPath, context.inheritedShared.surface?.workspace?.skills)
+        : [];
+    const localSkills = await loadResolvedSkills(manifestPath, manifest.workspace?.skills);
+    const skills = mergeResolvedSkills(inheritedSkills, localSkills);
+    validateEffectiveSkillRequirements(manifest.name, getMcpNames(environment.mcpServers), skills);
+    const docs = await mergeResolvedDocuments(manifestPath, manifest.workspace?.docs, context.inheritedShared?.manifestPath, context.inheritedShared?.surface?.workspace?.docs);
+    const workspaceResources = mergeWorkspaceResources(context.inheritedResources, manifest.workspace?.resources, manifest.name, {
+        kind: "agent",
+        key: source,
+        name: manifest.name
+    });
+    const candidate = {
+        description: resolveDescription(manifest.description, docs),
+        docs,
+        env: environment.env,
+        execution,
+        expose: manifest.expose ?? false,
+        kind: "agent",
+        mcpServers: environment.mcpServers,
+        name: manifest.name,
+        policyMode: manifest.policy?.mode ?? DEFAULT_POLICY_MODE,
+        policyOnDegrade: manifest.policy?.on_degrade ?? DEFAULT_POLICY_ON_DEGRADE,
+        runtime,
+        memory: resolveDeclaredMemoryBanks(manifest.memory, source, "agent", manifest.name),
+        schedule: manifest.schedule,
+        secrets: environment.secrets,
+        packages: environment.packages,
+        skills,
+        source,
+        ...(source === manifestPath ? {} : { sourcePath: manifestPath }),
+        surfaces: resolveAgentSurfaces(manifest.surfaces),
+        subagents: [],
+        workspaceResources
+    };
+    assertRuntimeSupportsAgentSurfaces(runtime.name, candidate.surfaces, manifest.name);
+    return candidate;
+};

package/dist/compiler/buildCompilePlanTeams.d.ts

@@ -1,5 +1,6 @@
-import type { TeamManifest } from "../manifest/index.js";
+import { type TeamManifest } from "../manifest/index.js";
 import type { ResolvedTeamNetwork, ResolvedTeamNode } from "./types.js";
 export declare const resolveTeamExternalIds: (manifest: TeamManifest) => string[];
 export declare const resolveTeamNetworks: (manifest: TeamManifest) => ResolvedTeamNetwork[];
+export declare const isAttachedExternalRoomMember: (teamNode: ResolvedTeamNode, networkId: string, memberId: string) => boolean;
 export declare const validateTeamNetworkRooms: (teamNode: ResolvedTeamNode) => void;

package/dist/compiler/buildCompilePlanTeams.js

@@ -1,3 +1,4 @@
+import { isDeclaredPairedRemoteRoomMember } from "../manifest/index.js";
 import { SpawnfileError } from "../shared/index.js";
 export const resolveTeamExternalIds = (manifest) => {
     const memberIds = manifest.members.map((member) => member.id);
@@ -20,6 +21,9 @@ export const resolveTeamNetworks = (manifest) => (manifest.networks ?? []).map((
         name: network.name ?? network.id,
         provider: network.provider,
         rooms: network.rooms.map((room) => ({
+            ...(room.federation
+                ? { federation: Array.isArray(room.federation) ? [...room.federation].sort() : room.federation }
+                : {}),
             id: room.id,
             members: [...room.members],
             ...(room.name ? { name: room.name } : {}),
@@ -32,12 +36,16 @@ export const resolveTeamNetworks = (manifest) => (manifest.networks ?? []).map((
     }
     return resolved;
 });
+export const isAttachedExternalRoomMember = (teamNode, networkId, memberId) => teamNode.externalParticipants?.some((participant) => participant.id === memberId
+    && participant.surfaces.moltnet.some((attachment) => attachment.network === networkId)) === true;
 export const validateTeamNetworkRooms = (teamNode) => {
     for (const network of teamNode.networks ?? []) {
         for (const room of network.rooms) {
             for (const roomMemberId of room.members) {
                 const resolvedMember = teamNode.members.find((member) => member.id === roomMemberId);
-                if (!resolvedMember) {
+                if (!resolvedMember
+                    && !isAttachedExternalRoomMember(teamNode, network.id, roomMemberId)
+                    && !isDeclaredPairedRemoteRoomMember(network, room, roomMemberId)) {
                     throw new SpawnfileError("validation_error", `Team ${teamNode.name} Moltnet room ${room.id} references unknown member ${roomMemberId}`);
                 }
             }

package/dist/compiler/buildCompilePlanTraversal.js

@@ -1,89 +1,62 @@
 import { getCanonicalManifestPath, getManifestPath, resolveProjectPath } from "../filesystem/index.js";
-import { isAgentManifest, isTeamManifest, mergeExecution } from "../manifest/index.js";
+import { isAgentManifest, isReferencedMember, isTeamManifest, materializeInlineAgentManifest } from "../manifest/index.js";
 import { SpawnfileError } from "../shared/index.js";
 import { getAgentFingerprint, getMcpNames, getTeamFingerprint, validateEffectiveSkillRequirements } from "./compilePlanHelpers.js";
-import { resolveAgentSurfaces } from "./agentSurfaces.js";
-import { mergeResolvedSkills, loadResolvedSkills } from "./surfaces.js";
-import { assertRuntimeSupportsExecutionModelAuth } from "./modelAuth.js";
-import { assertRuntimeSupportsAgentSurfaces } from "./surfaceSupport.js";
-import { applyExecutionDefaults } from "./executionDefaults.js";
-import { normalizeDescription, resolveDescription, resolveRuntime } from "./buildCompilePlanRuntime.js";
+import { loadResolvedSkills } from "./surfaces.js";
+import { mergeCompatibleAgentNode } from "./agentNodeMerge.js";
+import { normalizeDescription } from "./buildCompilePlanRuntime.js";
 import { resolveTeamExternalIds, resolveTeamNetworks, validateTeamNetworkRooms } from "./buildCompilePlanTeams.js";
+import { resolveDeclaredMemoryBanks } from "./memoryResolution.js";
 import { mergeWorkspaceResources } from "./workspaceResources.js";
-import { DEFAULT_POLICY_MODE, DEFAULT_POLICY_ON_DEGRADE, mergeResolvedDocuments, resolveEffectiveEnvironment } from "./buildCompilePlanTraversalHelpers.js";
+import { DEFAULT_POLICY_MODE, DEFAULT_POLICY_ON_DEGRADE, mergeResolvedDocuments, } from "./buildCompilePlanTraversalHelpers.js";
+import { resolveAgentNode } from "./buildCompilePlanAgent.js";
+import { createInlineAgentSource } from "./projectManifestGraph.js";
 export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, fingerprintCache, edges, memberships }) => {
     const visitStack = [];
-    const visitAgent = async (manifestPath, context) => {
-        const canonicalPath = getCanonicalManifestPath(manifestPath);
-        if (visitStack.includes(canonicalPath)) {
-            throw new SpawnfileError("compile_error", `Cycle detected while visiting ${canonicalPath}`);
-        }
-        const loadedManifest = await getLoadedManifest(canonicalPath);
-        if (!isAgentManifest(loadedManifest.manifest)) {
-            throw new SpawnfileError("compile_error", `Expected agent manifest, got ${loadedManifest.manifest.kind} at ${canonicalPath}`);
-        }
-        const runtime = await resolveRuntime(loadedManifest.manifest, context);
-        const execution = applyExecutionDefaults(context.isSubagent
-            ? mergeExecution(context.inheritedExecution, loadedManifest.manifest.execution)
-            : loadedManifest.manifest.execution);
-        assertRuntimeSupportsExecutionModelAuth(runtime.name, execution, loadedManifest.manifest.name);
-        const environment = resolveEffectiveEnvironment(context.inheritedShared?.surface?.environment, loadedManifest.manifest.environment);
-        const inheritedSkills = context.inheritedShared
-            ? await loadResolvedSkills(context.inheritedShared.manifestPath, context.inheritedShared.surface?.workspace?.skills)
-            : [];
-        const localSkills = await loadResolvedSkills(canonicalPath, loadedManifest.manifest.workspace?.skills);
-        const skills = mergeResolvedSkills(inheritedSkills, localSkills);
-        validateEffectiveSkillRequirements(loadedManifest.manifest.name, getMcpNames(environment.mcpServers), skills);
-        const docs = await mergeResolvedDocuments(canonicalPath, loadedManifest.manifest.workspace?.docs, context.inheritedShared?.manifestPath, context.inheritedShared?.surface?.workspace?.docs);
-        const workspaceResources = mergeWorkspaceResources(context.inheritedResources, loadedManifest.manifest.workspace?.resources, loadedManifest.manifest.name, {
-            kind: "agent",
-            key: canonicalPath,
-            name: loadedManifest.manifest.name
+    const recordAgentMembership = (teamSource, teamName, memberId, agent) => {
+        memberships.set(`${teamSource}::${memberId}::${agent.source}`, {
+            agentSource: agent.source,
+            memberId,
+            teamName,
+            teamSource
         });
-        const candidate = {
-            description: resolveDescription(loadedManifest.manifest.description, docs),
-            docs,
-            env: environment.env,
-            execution,
-            expose: loadedManifest.manifest.expose ?? false,
+        return {
+            id: memberId,
             kind: "agent",
-            mcpServers: environment.mcpServers,
-            name: loadedManifest.manifest.name,
-            policyMode: loadedManifest.manifest.policy?.mode ?? DEFAULT_POLICY_MODE,
-            policyOnDegrade: loadedManifest.manifest.policy?.on_degrade ?? DEFAULT_POLICY_ON_DEGRADE,
-            runtime,
-            schedule: loadedManifest.manifest.schedule,
-            secrets: environment.secrets,
-            packages: environment.packages,
-            skills,
-            source: canonicalPath,
-            surfaces: resolveAgentSurfaces(loadedManifest.manifest.surfaces),
-            subagents: [],
-            workspaceResources
+            nodeSource: agent.source,
+            runtimeName: agent.runtime.name
         };
-        assertRuntimeSupportsAgentSurfaces(runtime.name, candidate.surfaces, loadedManifest.manifest.name);
-        const fingerprint = getAgentFingerprint(candidate);
-        const existingFingerprint = fingerprintCache.get(canonicalPath);
-        if (existingFingerprint && existingFingerprint !== fingerprint) {
-            throw new SpawnfileError("compile_error", `Manifest ${canonicalPath} resolves differently across compile contexts`);
+    };
+    const visitAgentManifest = async (manifest, source, manifestPath, context) => {
+        if (visitStack.includes(source)) {
+            throw new SpawnfileError("compile_error", `Cycle detected while visiting ${source}`);
         }
-        const cachedNode = nodeCache.get(canonicalPath);
+        const candidate = await resolveAgentNode({ context, manifest, manifestPath, source });
+        const cachedNode = nodeCache.get(source);
         if (cachedNode) {
-            return cachedNode.value;
+            const cachedAgent = cachedNode.value;
+            mergeCompatibleAgentNode(cachedAgent, candidate);
+            fingerprintCache.set(source, getAgentFingerprint(cachedAgent));
+            return cachedAgent;
         }
-        fingerprintCache.set(canonicalPath, fingerprint);
-        nodeCache.set(canonicalPath, {
-            runtimeName: runtime.name,
-            source: canonicalPath,
+        const fingerprint = getAgentFingerprint(candidate);
+        const existingFingerprint = fingerprintCache.get(source);
+        if (existingFingerprint && existingFingerprint !== fingerprint) {
+            throw new SpawnfileError("compile_error", `Agent ${source} resolves differently across compile contexts`);
+        }
+        fingerprintCache.set(source, fingerprint);
+        nodeCache.set(source, {
+            runtimeName: candidate.runtime.name,
+            source,
             value: candidate
         });
-        visitStack.push(canonicalPath);
-        for (const subagent of loadedManifest.manifest.subagents ?? []) {
-            const childManifestPath = getManifestPath(resolveProjectPath(canonicalPath, subagent.ref));
+        visitStack.push(source);
+        for (const subagent of manifest.subagents ?? []) {
+            const childManifestPath = getManifestPath(resolveProjectPath(manifestPath, subagent.ref));
             const resolvedSubagent = await visitAgent(childManifestPath, {
-                inheritedExecution: execution,
+                inheritedExecution: candidate.execution,
                 inheritedResources: candidate.workspaceResources,
-                inheritedRuntime: runtime,
+                inheritedRuntime: candidate.runtime,
                 isSubagent: true
             });
             candidate.subagents.push({
@@ -91,7 +64,7 @@ export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, finge
                 nodeSource: resolvedSubagent.source
             });
             edges.push({
-                from: canonicalPath,
+                from: source,
                 kind: "subagent",
                 label: subagent.id,
                 to: resolvedSubagent.source
@@ -100,6 +73,14 @@ export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, finge
         visitStack.pop();
         return candidate;
     };
+    const visitAgent = async (manifestPath, context) => {
+        const canonicalPath = getCanonicalManifestPath(manifestPath);
+        const loadedManifest = await getLoadedManifest(canonicalPath);
+        if (!isAgentManifest(loadedManifest.manifest)) {
+            throw new SpawnfileError("compile_error", `Expected agent manifest, got ${loadedManifest.manifest.kind} at ${canonicalPath}`);
+        }
+        return visitAgentManifest(loadedManifest.manifest, canonicalPath, canonicalPath, context);
+    };
     const visitTeam = async (manifestPath, inheritedResources = []) => {
         const canonicalPath = getCanonicalManifestPath(manifestPath);
         if (visitStack.includes(canonicalPath)) {
@@ -126,11 +107,15 @@ export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, finge
             docs,
             external: resolvedExternal,
             externalExplicit: manifest.external !== undefined,
+            ...(manifest.external_participants
+                ? { externalParticipants: manifest.external_participants }
+                : {}),
             kind: "team",
             lead: manifest.lead ?? null,
             members: [],
             mode: manifest.mode,
             name: manifest.name,
+            memory: resolveDeclaredMemoryBanks(manifest.memory, canonicalPath, "team", manifest.name),
             networks: resolveTeamNetworks(manifest),
             policyMode: manifest.policy?.mode ?? DEFAULT_POLICY_MODE,
             policyOnDegrade: manifest.policy?.on_degrade ?? DEFAULT_POLICY_ON_DEGRADE,
@@ -161,6 +146,25 @@ export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, finge
         });
         visitStack.push(canonicalPath);
         for (const member of loadedManifest.manifest.members) {
+            if (!isReferencedMember(member)) {
+                const resolvedAgent = await visitAgentManifest(materializeInlineAgentManifest(manifest, member), createInlineAgentSource(canonicalPath, member.id), canonicalPath, {
+                    inheritedShared: {
+                        manifestPath: canonicalPath,
+                        surface: manifest.shared
+                    },
+                    inheritedResources: candidate.workspaceResources,
+                    isSubagent: false
+                });
+                const resolvedMember = recordAgentMembership(canonicalPath, candidate.name, member.id, resolvedAgent);
+                candidate.members.push(resolvedMember);
+                edges.push({
+                    from: canonicalPath,
+                    kind: "team_member",
+                    label: member.id,
+                    to: resolvedMember.nodeSource
+                });
+                continue;
+            }
             const childManifestPath = getManifestPath(resolveProjectPath(canonicalPath, member.ref));
             const childManifest = await getLoadedManifest(childManifestPath);
             let resolvedMember;
@@ -173,18 +177,7 @@ export const createCompilePlanTraversal = ({ getLoadedManifest, nodeCache, finge
                     inheritedResources: candidate.workspaceResources,
                     isSubagent: false
                 });
-                resolvedMember = {
-                    id: member.id,
-                    kind: "agent",
-                    nodeSource: resolvedAgent.source,
-                    runtimeName: resolvedAgent.runtime.name
-                };
-                memberships.set(`${canonicalPath}::${member.id}::${resolvedAgent.source}`, {
-                    agentSource: resolvedAgent.source,
-                    memberId: member.id,
-                    teamName: candidate.name,
-                    teamSource: canonicalPath
-                });
+                resolvedMember = recordAgentMembership(canonicalPath, candidate.name, member.id, resolvedAgent);
             }
             else {
                 const resolvedTeam = await visitTeam(childManifestPath, candidate.workspaceResources);

package/dist/compiler/buildProject.d.ts

@@ -1,4 +1,5 @@
 import { type CompileProjectOptions, type CompileProjectResult } from "./compileProject.js";
+import { type DockerImageInspector } from "./dockerBuildSkip.js";
 import type { MoltnetTargetArchitecture } from "./moltnetBinaries.js";
 export interface DockerBuildInvocation {
     args: string[];
@@ -12,9 +13,19 @@ export interface BuildProjectOptions extends CompileProjectOptions {
     buildRunner?: DockerBuildRunner;
     dockerCommand?: string;
     dockerContext?: string;
+    imageInspector?: DockerImageInspector;
     imageTag?: string;
 }
 export interface BuildProjectResult extends CompileProjectResult {
+    imageBuild?: {
+        buildMs: number | null;
+        contextBytes: number;
+        contextDigest: string;
+        contextDigestMs: number;
+        contextFileCount: number;
+        probeMs: number;
+        skipped: boolean;
+    };
     imageTag: string;
 }
 export declare const createDefaultImageTag: (projectRoot: string) => string;

package/dist/compiler/buildProject.js

@@ -1,8 +1,12 @@
 import path from "node:path";
 import { execFile as execFileCallback, spawn } from "node:child_process";
+import { performance } from "node:perf_hooks";
 import { promisify } from "node:util";
+import { BUILD_IMAGE_CACHE_VERSION, readBuildImageCacheEntry, writeBuildImageCacheEntry } from "../deployment/buildImageCacheStore.js";
 import { SpawnfileError } from "../shared/index.js";
 import { compileProject } from "./compileProject.js";
+import { createDockerBuildContextDigest, listDockerBuildContextFiles } from "./dockerBuildContext.js";
+import { inspectDockerImage, shouldSkipDockerBuild } from "./dockerBuildSkip.js";
 import { slugify } from "./helpers.js";
 const execFile = promisify(execFileCallback);
 export const createDefaultImageTag = (projectRoot) => {
@@ -76,16 +80,87 @@ export const buildProject = async (inputPath, options = {}) => {
     const compileResult = await compileProject(inputPath, {
         clean: options.clean,
         containerArchitecture: targetArchitecture,
-        outputDirectory: options.outputDirectory
+        outputDirectory: options.outputDirectory,
+        runtimePackageOverrides: options.runtimePackageOverrides,
+        ...(options.worldBindingsPath !== undefined
+            ? { worldBindingsPath: options.worldBindingsPath }
+            : {})
     });
     const imageTag = options.imageTag ?? createDefaultImageTag(resolveImageTagRoot(inputPath));
     const invocation = createDockerBuildInvocation(compileResult.outputDirectory, imageTag, {
         dockerCommand: options.dockerCommand,
         dockerContext: options.dockerContext
     });
-    await (options.buildRunner ?? runDockerBuild)(invocation);
+    const compileFingerprint = compileResult.report.compile_fingerprint ?? "";
+    const projectRoot = compileResult.report.root;
+    const contextDigestStartedAt = performance.now();
+    const [contextFiles, contextDigest] = await Promise.all([
+        listDockerBuildContextFiles(compileResult.outputDirectory),
+        createDockerBuildContextDigest(compileResult.outputDirectory)
+    ]);
+    const contextDigestMs = performance.now() - contextDigestStartedAt;
+    let probeMs = 0;
+    let skipped = false;
+    if (!options.buildRunner) {
+        const probeStartedAt = performance.now();
+        const cacheEntry = await readBuildImageCacheEntry({
+            dockerContext: options.dockerContext,
+            imageTag,
+            projectRoot
+        });
+        skipped = await shouldSkipDockerBuild({
+            cacheEntry,
+            compileFingerprint,
+            contextDigest,
+            dockerCommand: options.dockerCommand,
+            dockerContext: options.dockerContext,
+            imageInspector: options.imageInspector,
+            imageTag
+        });
+        probeMs = performance.now() - probeStartedAt;
+    }
+    let buildMs = null;
+    if (!skipped) {
+        const buildStartedAt = performance.now();
+        await (options.buildRunner ?? runDockerBuild)(invocation);
+        buildMs = performance.now() - buildStartedAt;
+        if (!options.buildRunner) {
+            try {
+                const inspection = await (options.imageInspector ?? inspectDockerImage)({
+                    dockerCommand: options.dockerCommand,
+                    dockerContext: options.dockerContext,
+                    imageTag
+                });
+                if (inspection
+                    && inspection.labels["com.spawnfile.compile_fingerprint"] === compileFingerprint) {
+                    await writeBuildImageCacheEntry({
+                        compileFingerprint,
+                        contextDigest,
+                        dockerContext: options.dockerContext ?? null,
+                        imageId: inspection.id,
+                        imageTag,
+                        projectRoot,
+                        version: BUILD_IMAGE_CACHE_VERSION,
+                        writtenAt: new Date().toISOString()
+                    });
+                }
+            }
+            catch {
+                // A post-build cache probe is best-effort and never changes build success.
+            }
+        }
+    }
     return {
         ...compileResult,
+        imageBuild: {
+            buildMs,
+            contextBytes: contextFiles.reduce((total, file) => total + file.size, 0),
+            contextDigest,
+            contextDigestMs,
+            contextFileCount: contextFiles.length,
+            probeMs,
+            skipped
+        },
         imageTag
     };
 };

package/dist/compiler/compilePlanHelpers.js

@@ -14,6 +14,7 @@ export const validateEffectiveSkillRequirements = (nodeName, mcpNames, skills) =
 export const getAgentFingerprint = (node) => stableStringify({
     env: node.env,
     execution: node.execution,
+    memory: node.memory,
     mcpServers: node.mcpServers,
     runtime: node.runtime,
     schedule: node.schedule,
@@ -30,6 +31,7 @@ export const getAgentFingerprint = (node) => stableStringify({
 export const getTeamFingerprint = (node) => stableStringify({
     members: node.members,
     mode: node.mode,
+    memory: node.memory,
     lead: node.lead,
     external: node.external,
     networks: node.networks ?? [],
@@ -53,6 +55,9 @@ const collectMoltnetSecretNames = (server, secretNames) => {
     if (server.mode === "managed") {
         for (const pairing of server.pairings ?? []) {
             secretNames.add(pairing.token_secret);
+            if (pairing.relay) {
+                secretNames.add(pairing.relay.token_secret);
+            }
         }
         if (server.store.kind === "postgres") {
             secretNames.add(server.store.dsn_secret);

package/dist/compiler/compileProject.d.ts

@@ -1,11 +1,26 @@
 import { CompileReport } from "../report/index.js";
+import { type RuntimePackageOverrideRequest } from "./containerPackageOverrides.js";
 import { type MoltnetTargetArchitecture } from "./moltnetBinaries.js";
+import { type OrganizationReadinessEvidence } from "./organizationReadyEvidence.js";
+export { createOrganizationReadinessEvidence, ORGANIZATION_READINESS_EVIDENCE_VERSION } from "./organizationReadyEvidence.js";
+export type { CreateOrganizationReadinessEvidenceInput, OrganizationReadinessEvidence } from "./organizationReadyEvidence.js";
 export interface CompileProjectOptions {
     clean?: boolean;
     containerArchitecture?: MoltnetTargetArchitecture;
+    /** Stable deployment identity for exclusive credential-realm reattachment. */
+    deploymentLineage?: string;
     outputDirectory?: string;
+    /** Compile-time-only local overrides for runtime install npm packages
+     * (see src/compiler/containerPackageOverrides.ts). Only opt-in
+     * local/E2E callers set this; a standard compile leaves it undefined and
+     * every runtime install package resolves to its pinned registry
+     * version, unchanged. */
+    runtimePackageOverrides?: RuntimePackageOverrideRequest;
+    /** Runner-owned path to a bounded, secret-free simfile.world-bindings.v1 artifact. */
+    worldBindingsPath?: string;
 }
 export interface CompileProjectResult {
+    organizationReadinessEvidence: OrganizationReadinessEvidence;
     outputDirectory: string;
     report: CompileReport;
     reportPath: string;