teamcast 0.9.3 → 1.0.0

package/dist/validator/checks/manifest-registry.js

@@ -0,0 +1,68 @@
+import { isCapabilityTraitName } from '../../registry/traits.js';
+import { isPolicyFragmentId } from '../../registry/policy-fragments.js';
+import { isInstructionFragmentId } from '../../registry/instruction-fragments.js';
+import { isEnvironmentId } from '../../registry/types.js';
+import { getManifestTargetEntries } from '../../manifest/targets.js';
+/**
+ * Pre-normalization manifest-level registry checks.
+ * Validates that all referenced registry items (traits, fragments, environments) exist.
+ */
+export function checkManifestRegistry(manifest) {
+    const results = [];
+    for (const { name: targetName, config: targetConfig } of getManifestTargetEntries(manifest)) {
+        // UNKNOWN_CAPABILITY_TRAIT — check each agent's capability_traits
+        for (const [agentId, agent] of Object.entries(targetConfig.agents)) {
+            for (const trait of agent.capability_traits ?? []) {
+                if (!isCapabilityTraitName(trait)) {
+                    results.push({
+                        severity: 'error',
+                        category: 'Registry',
+                        message: `Agent "${agentId}" uses unknown capability trait "${trait}"`,
+                        agent: agentId,
+                        phase: 'registry',
+                        code: 'UNKNOWN_CAPABILITY_TRAIT',
+                    });
+                }
+            }
+            // UNKNOWN_INSTRUCTION_FRAGMENT — check each agent's instruction_fragments
+            for (const fragment of agent.instruction_fragments ?? []) {
+                if (!isInstructionFragmentId(fragment)) {
+                    results.push({
+                        severity: 'error',
+                        category: 'Registry',
+                        message: `Agent "${agentId}" uses unknown instruction fragment "${fragment}"`,
+                        agent: agentId,
+                        phase: 'registry',
+                        code: 'UNKNOWN_INSTRUCTION_FRAGMENT',
+                    });
+                }
+            }
+        }
+        // UNKNOWN_POLICY_FRAGMENT — check target-level policy fragments
+        for (const fragment of targetConfig.policies?.fragments ?? []) {
+            if (!isPolicyFragmentId(fragment)) {
+                results.push({
+                    severity: 'error',
+                    category: 'Registry',
+                    message: `Unknown policy fragment "${fragment}" in ${targetName} policies`,
+                    phase: 'registry',
+                    code: 'UNKNOWN_POLICY_FRAGMENT',
+                });
+            }
+        }
+    }
+    // UNKNOWN_ENVIRONMENT — check project.environments
+    for (const envId of manifest.project.environments ?? []) {
+        if (!isEnvironmentId(envId)) {
+            results.push({
+                severity: 'error',
+                category: 'Registry',
+                message: `Unknown environment "${envId}" in project.environments`,
+                phase: 'registry',
+                code: 'UNKNOWN_ENVIRONMENT',
+            });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=manifest-registry.js.map

package/dist/validator/checks/manifest-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-registry.js","sourceRoot":"","sources":["../../../src/validator/checks/manifest-registry.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA0B;IAC9D,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,KAAK,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5F,kEAAkE;QAClE,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;gBAClD,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClC,OAAO,CAAC,IAAI,CAAC;wBACX,QAAQ,EAAE,OAAO;wBACjB,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,UAAU,OAAO,oCAAoC,KAAK,GAAG;wBACtE,KAAK,EAAE,OAAO;wBACd,KAAK,EAAE,UAAU;wBACjB,IAAI,EAAE,0BAA0B;qBACjC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,0EAA0E;YAC1E,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC;gBACzD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvC,OAAO,CAAC,IAAI,CAAC;wBACX,QAAQ,EAAE,OAAO;wBACjB,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,UAAU,OAAO,wCAAwC,QAAQ,GAAG;wBAC7E,KAAK,EAAE,OAAO;wBACd,KAAK,EAAE,UAAU;wBACjB,IAAI,EAAE,8BAA8B;qBACrC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;YAC9D,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,UAAU;oBACpB,OAAO,EAAE,4BAA4B,QAAQ,QAAQ,UAAU,WAAW;oBAC1E,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,yBAAyB;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACxD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,wBAAwB,KAAK,2BAA2B;gBACjE,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,qBAAqB;aAC5B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/validator/checks/mcp.d.ts

@@ -0,0 +1,4 @@
+import type { CoreTeam } from '../../core/types.js';
+import type { ValidationResult } from '../types.js';
+export declare function checkMcpServers(team: CoreTeam, targetName: string): ValidationResult[];
+//# sourceMappingURL=mcp.d.ts.map

package/dist/validator/checks/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../../src/validator/checks/mcp.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAMpD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,QAAQ,EACd,UAAU,EAAE,MAAM,GACjB,gBAAgB,EAAE,CA4EpB"}

package/dist/validator/checks/mcp.js

@@ -0,0 +1,73 @@
+// Phase 10: MCP server configuration validation.
+import { defaultRegistry } from '../../registry/index.js';
+/** Targets that support MCP server configuration. */
+const MCP_SUPPORTED_TARGETS = new Set(['claude', 'codex']);
+export function checkMcpServers(team, targetName) {
+    const results = [];
+    let teamHasMcp = false;
+    for (const [agentId, agent] of Object.entries(team.agents)) {
+        const servers = agent.runtime.mcpServers ?? [];
+        if (servers.length === 0)
+            continue;
+        teamHasMcp = true;
+        // Collect MCP servers required by this agent's skills
+        const requiredBySkills = new Set();
+        for (const skillId of agent.runtime.skillDocs ?? []) {
+            const skill = defaultRegistry.getSkill(skillId);
+            for (const srv of skill?.required_mcp_servers ?? []) {
+                requiredBySkills.add(srv);
+            }
+        }
+        const seenNames = new Set();
+        for (const server of servers) {
+            const name = String(server.name ?? '');
+            // 1. MCP_MISSING_CONFIG — needs url or command
+            if (!server.url && !server.command) {
+                results.push({
+                    severity: 'error',
+                    category: 'MCP',
+                    code: 'MCP_MISSING_CONFIG',
+                    phase: 'mcp',
+                    message: `Agent "${agentId}": MCP server "${name}": missing required field "url" or "command"`,
+                    agent: agentId,
+                });
+            }
+            // 2. MCP_DUPLICATE — same name listed twice on the same agent
+            if (name && seenNames.has(name)) {
+                results.push({
+                    severity: 'warning',
+                    category: 'MCP',
+                    code: 'MCP_DUPLICATE',
+                    phase: 'mcp',
+                    message: `Agent "${agentId}": duplicate MCP server name "${name}"`,
+                    agent: agentId,
+                });
+            }
+            if (name)
+                seenNames.add(name);
+            // 3. MCP_UNUSED — MCP server configured but no skill requires it
+            if (name && !requiredBySkills.has(name)) {
+                results.push({
+                    severity: 'info',
+                    category: 'MCP',
+                    code: 'MCP_UNUSED',
+                    phase: 'mcp',
+                    message: `Agent "${agentId}": MCP server "${name}" is configured but no skill requires it`,
+                    agent: agentId,
+                });
+            }
+        }
+    }
+    // 4. MCP_TARGET_UNSUPPORTED — team-level check
+    if (teamHasMcp && !MCP_SUPPORTED_TARGETS.has(targetName)) {
+        results.push({
+            severity: 'warning',
+            category: 'MCP',
+            code: 'MCP_TARGET_UNSUPPORTED',
+            phase: 'mcp',
+            message: `MCP servers configured but target "${targetName}" does not support MCP — servers will be ignored`,
+        });
+    }
+    return results;
+}
+//# sourceMappingURL=mcp.js.map

package/dist/validator/checks/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../src/validator/checks/mcp.ts"],"names":[],"mappings":"AAAA,iDAAiD;AAIjD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,qDAAqD;AACrD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3D,MAAM,UAAU,eAAe,CAC7B,IAAc,EACd,UAAkB;IAElB,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEnC,UAAU,GAAG,IAAI,CAAC;QAElB,sDAAsD;QACtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC3C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;gBACpD,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QAEpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAEvC,+CAA+C;YAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,oBAAoB;oBAC1B,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,UAAU,OAAO,kBAAkB,IAAI,8CAA8C;oBAC9F,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;YAED,8DAA8D;YAC9D,IAAI,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,UAAU,OAAO,iCAAiC,IAAI,GAAG;oBAClE,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;YACD,IAAI,IAAI;gBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAE9B,iEAAiE;YACjE,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,UAAU,OAAO,kBAAkB,IAAI,0CAA0C;oBAC1F,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,IAAI,UAAU,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,wBAAwB;YAC9B,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,sCAAsC,UAAU,kDAAkD;SAC5G,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/validator/checks/policy-coherence.d.ts

@@ -0,0 +1,4 @@
+import type { CoreTeam } from '../../core/types.js';
+import type { ValidationResult } from '../types.js';
+export declare function checkPolicyCoherence(team: CoreTeam): ValidationResult[];
+//# sourceMappingURL=policy-coherence.d.ts.map

package/dist/validator/checks/policy-coherence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-coherence.d.ts","sourceRoot":"","sources":["../../../src/validator/checks/policy-coherence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,EAAE,CA4EvE"}

package/dist/validator/checks/policy-coherence.js

@@ -0,0 +1,69 @@
+export function checkPolicyCoherence(team) {
+    const results = [];
+    const permissions = team.policies?.permissions;
+    const rules = permissions?.rules;
+    const allow = rules?.allow ?? [];
+    const ask = rules?.ask ?? [];
+    const deny = rules?.deny ?? [];
+    // SANDBOX_CONTRADICTION — sandbox explicitly false but Bash allow rules exist
+    if (team.policies?.sandbox?.enabled === false) {
+        const hasBashAllowRules = allow.some((pattern) => pattern.startsWith('Bash('));
+        if (hasBashAllowRules) {
+            results.push({
+                severity: 'warning',
+                category: 'Policy coherence',
+                code: 'SANDBOX_CONTRADICTION',
+                phase: 'policies',
+                message: 'Sandbox is disabled but Bash allow rules are defined — the rules will have no effect without sandbox',
+            });
+        }
+    }
+    // EMPTY_DENY_RULES — allow rules defined but no deny rules
+    if (allow.length > 0 && deny.length === 0) {
+        results.push({
+            severity: 'info',
+            category: 'Policy coherence',
+            code: 'EMPTY_DENY_RULES',
+            phase: 'policies',
+            message: 'Policies define allow rules but no deny rules — consider adding deny patterns for dangerous operations',
+        });
+    }
+    // POLICY_ALLOW_DENY_CONFLICT — pattern appears in both allow and deny
+    if (allow.length > 0 && deny.length > 0) {
+        const denySet = new Set(deny);
+        for (const pattern of allow) {
+            if (denySet.has(pattern)) {
+                results.push({
+                    severity: 'warning',
+                    category: 'Policy coherence',
+                    code: 'POLICY_ALLOW_DENY_CONFLICT',
+                    phase: 'policies',
+                    message: `Policy pattern "${pattern}" appears in both allow and deny lists`,
+                });
+            }
+        }
+    }
+    // DUPLICATE_POLICY_PATTERN — same pattern appears multiple times within the same list
+    function checkDuplicates(list, listName) {
+        const seen = new Set();
+        const reported = new Set();
+        for (const pattern of list) {
+            if (seen.has(pattern) && !reported.has(pattern)) {
+                reported.add(pattern);
+                results.push({
+                    severity: 'info',
+                    category: 'Policy coherence',
+                    code: 'DUPLICATE_POLICY_PATTERN',
+                    phase: 'policies',
+                    message: `Duplicate policy pattern "${pattern}" in ${listName} list`,
+                });
+            }
+            seen.add(pattern);
+        }
+    }
+    checkDuplicates(allow, 'allow');
+    checkDuplicates(ask, 'ask');
+    checkDuplicates(deny, 'deny');
+    return results;
+}
+//# sourceMappingURL=policy-coherence.js.map

package/dist/validator/checks/policy-coherence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-coherence.js","sourceRoot":"","sources":["../../../src/validator/checks/policy-coherence.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,oBAAoB,CAAC,IAAc;IACjD,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/C,MAAM,KAAK,GAAG,WAAW,EAAE,KAAK,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IAE/B,8EAA8E;IAC9E,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QAC9C,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,kBAAkB;gBAC5B,IAAI,EAAE,uBAAuB;gBAC7B,KAAK,EAAE,UAAU;gBACjB,OAAO,EACL,sGAAsG;aACzG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,kBAAkB;YAC5B,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,UAAU;YACjB,OAAO,EACL,wGAAwG;SAC3G,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE,4BAA4B;oBAClC,KAAK,EAAE,UAAU;oBACjB,OAAO,EAAE,mBAAmB,OAAO,wCAAwC;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,SAAS,eAAe,CAAC,IAAc,EAAE,QAAgB;QACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE,0BAA0B;oBAChC,KAAK,EAAE,UAAU;oBACjB,OAAO,EAAE,6BAA6B,OAAO,QAAQ,QAAQ,OAAO;iBACrE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE9B,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/validator/checks/registry.d.ts

@@ -0,0 +1,8 @@
+import type { CoreTeam } from '../../core/types.js';
+import type { ValidationResult } from '../types.js';
+/**
+ * Phase 1 (post-normalization): checks that registry references on CoreTeam are valid.
+ * Currently validates that agent runtime models exist in the MODEL_CATALOG.
+ */
+export declare function checkRegistryReferences(team: CoreTeam): ValidationResult[];
+//# sourceMappingURL=registry.d.ts.map

package/dist/validator/checks/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/validator/checks/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,EAAE,CAkB1E"}

package/dist/validator/checks/registry.js

@@ -0,0 +1,23 @@
+import { MODEL_CATALOG } from '../../registry/models.js';
+/**
+ * Phase 1 (post-normalization): checks that registry references on CoreTeam are valid.
+ * Currently validates that agent runtime models exist in the MODEL_CATALOG.
+ */
+export function checkRegistryReferences(team) {
+    const results = [];
+    const knownModelIds = new Set(Object.keys(MODEL_CATALOG));
+    for (const [agentId, agent] of Object.entries(team.agents)) {
+        if (agent.runtime.model && !knownModelIds.has(agent.runtime.model)) {
+            results.push({
+                severity: 'warning',
+                category: 'Registry',
+                message: `Agent "${agentId}" uses unknown model "${agent.runtime.model}" — verify it exists for the target`,
+                agent: agentId,
+                phase: 'registry',
+                code: 'UNKNOWN_MODEL',
+            });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=registry.js.map

package/dist/validator/checks/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/validator/checks/registry.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAc;IACpD,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAE1D,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,UAAU,OAAO,yBAAyB,KAAK,CAAC,OAAO,CAAC,KAAK,qCAAqC;gBAC3G,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,eAAe;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/validator/checks/role-warnings.d.ts

@@ -1,5 +1,5 @@
-import { type SkillToolMap } from '../../core/skill-resolver.js';
+import type { CapabilityToolMap } from '../../registry/types.js';
 import type { CoreTeam } from '../../core/types.js';
 import type { ValidationResult } from '../types.js';
-export declare function checkRoleWarnings(team: CoreTeam, skillMap: SkillToolMap): ValidationResult[];
+export declare function checkRoleWarnings(team: CoreTeam, skillMap: CapabilityToolMap): ValidationResult[];
 //# sourceMappingURL=role-warnings.d.ts.map

package/dist/validator/checks/role-warnings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-warnings.d.ts","sourceRoot":"","sources":["../../../src/validator/checks/role-warnings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,YAAY,GACrB,gBAAgB,EAAE,CAqDpB"}
+{"version":3,"file":"role-warnings.d.ts","sourceRoot":"","sources":["../../../src/validator/checks/role-warnings.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,iBAAiB,GAC1B,gBAAgB,EAAE,CAqDpB"}

package/dist/validator/checks/role-warnings.js

@@ -1,11 +1,11 @@
-import { agentHasSkill } from '../../core/skill-resolver.js';
+import { agentHasCapability } from '../../core/capability-resolver.js';
 export function checkRoleWarnings(team, skillMap) {
     const results = [];
     for (const [agentId, agent] of Object.entries(team.agents)) {
         const tools = agent.runtime.tools ?? [];
         const id = agentId.toLowerCase();
         if (id === 'orchestrator' || id.includes('coordinator')) {
-            if (agentHasSkill(tools, 'write_files', skillMap)) {
+            if (agentHasCapability(tools, 'write_files', skillMap)) {
                 results.push({
                     severity: 'warning',
                     category: 'Role separation',
@@ -15,7 +15,7 @@ export function checkRoleWarnings(team, skillMap) {
             }
         }
         if (id === 'developer' || id.includes('coder') || id.includes('implementer')) {
-            if (agentHasSkill(tools, 'web', skillMap)) {
+            if (agentHasCapability(tools, 'web', skillMap)) {
                 results.push({
                     severity: 'warning',
                     category: 'Role separation',
@@ -25,7 +25,7 @@ export function checkRoleWarnings(team, skillMap) {
             }
         }
         if (id === 'reviewer' || id.includes('review') || id.includes('auditor')) {
-            if (agentHasSkill(tools, 'write_files', skillMap)) {
+            if (agentHasCapability(tools, 'write_files', skillMap)) {
                 results.push({
                     severity: 'warning',
                     category: 'Role separation',
@@ -35,7 +35,7 @@ export function checkRoleWarnings(team, skillMap) {
             }
         }
         if (id === 'planner' || id === 'analyzer') {
-            if (agentHasSkill(tools, 'execute', skillMap)) {
+            if (agentHasCapability(tools, 'execute', skillMap)) {
                 results.push({
                     severity: 'warning',
                     category: 'Role separation',

package/dist/validator/checks/role-warnings.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-warnings.js","sourceRoot":"","sources":["../../../src/validator/checks/role-warnings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAqB,MAAM,8BAA8B,CAAC;AAIhF,MAAM,UAAU,iBAAiB,CAC/B,IAAc,EACd,QAAsB;IAEtB,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAEjC,IAAI,EAAE,KAAK,cAAc,IAAI,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,IAAI,aAAa,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAClD,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,UAAU,OAAO,0FAA0F;oBACpH,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,EAAE,KAAK,WAAW,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC7E,IAAI,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,UAAU,OAAO,wGAAwG;oBAClI,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,EAAE,KAAK,UAAU,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACzE,IAAI,aAAa,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAClD,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,UAAU,OAAO,qFAAqF;oBAC/G,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;YAC1C,IAAI,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,UAAU,OAAO,iFAAiF;oBAC3G,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"role-warnings.js","sourceRoot":"","sources":["../../../src/validator/checks/role-warnings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAKvE,MAAM,UAAU,iBAAiB,CAC/B,IAAc,EACd,QAA2B;IAE3B,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAEjC,IAAI,EAAE,KAAK,cAAc,IAAI,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,IAAI,kBAAkB,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACvD,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,UAAU,OAAO,0FAA0F;oBACpH,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,EAAE,KAAK,WAAW,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC7E,IAAI,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,UAAU,OAAO,wGAAwG;oBAClI,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,EAAE,KAAK,UAAU,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACzE,IAAI,kBAAkB,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACvD,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,UAAU,OAAO,qFAAqF;oBAC/G,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;YAC1C,IAAI,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,iBAAiB;oBAC3B,OAAO,EAAE,UAAU,OAAO,iFAAiF;oBAC3G,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/validator/checks/runtime-models.d.ts

@@ -0,0 +1,4 @@
+import type { CoreTeam } from '../../core/types.js';
+import type { ValidationResult } from '../types.js';
+export declare function checkRuntimeModelWarnings(team: CoreTeam, targetName: string): ValidationResult[];
+//# sourceMappingURL=runtime-models.d.ts.map

package/dist/validator/checks/runtime-models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-models.d.ts","sourceRoot":"","sources":["../../../src/validator/checks/runtime-models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,QAAQ,EACd,UAAU,EAAE,MAAM,GACjB,gBAAgB,EAAE,CAapB"}

package/dist/validator/checks/runtime-models.js

@@ -0,0 +1,14 @@
+export function checkRuntimeModelWarnings(team, targetName) {
+    if (targetName !== 'codex') {
+        return [];
+    }
+    return Object.entries(team.agents)
+        .filter(([, agent]) => !agent.runtime.model)
+        .map(([agentId]) => ({
+        severity: 'warning',
+        category: 'Runtime defaults',
+        message: `Agent "${agentId}" does not declare a Codex model - set codex.agents.${agentId}.model to avoid unspecified runtime behavior`,
+        agent: agentId,
+    }));
+}
+//# sourceMappingURL=runtime-models.js.map

package/dist/validator/checks/runtime-models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-models.js","sourceRoot":"","sources":["../../../src/validator/checks/runtime-models.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,yBAAyB,CACvC,IAAc,EACd,UAAkB;IAElB,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,QAAQ,EAAE,SAAkB;QAC5B,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,UAAU,OAAO,uDAAuD,OAAO,8CAA8C;QACtI,KAAK,EAAE,OAAO;KACf,CAAC,CAAC,CAAC;AACR,CAAC"}

package/dist/validator/checks/skill-requirements.d.ts

@@ -0,0 +1,5 @@
+import type { CoreTeam } from '../../core/types.js';
+import type { CapabilityToolMap } from '../../registry/types.js';
+import type { ValidationResult } from '../types.js';
+export declare function checkSkillRequirements(team: CoreTeam, skillMap: CapabilityToolMap, targetName: string): ValidationResult[];
+//# sourceMappingURL=skill-requirements.d.ts.map

package/dist/validator/checks/skill-requirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-requirements.d.ts","sourceRoot":"","sources":["../../../src/validator/checks/skill-requirements.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,iBAAiB,EAC3B,UAAU,EAAE,MAAM,GACjB,gBAAgB,EAAE,CA0JpB"}

package/dist/validator/checks/skill-requirements.js

@@ -0,0 +1,143 @@
+// Phase 6: Skill validation — checks for skill requirements, conflicts, and compatibility.
+import { defaultRegistry } from '../../registry/index.js';
+import { agentHasCapability } from '../../core/capability-resolver.js';
+export function checkSkillRequirements(team, skillMap, targetName) {
+    const results = [];
+    const denyPatterns = team.policies?.permissions?.rules?.deny ?? [];
+    for (const [agentId, agent] of Object.entries(team.agents)) {
+        const skillIds = agent.runtime.skillDocs ?? [];
+        const seen = new Set();
+        for (const skillId of skillIds) {
+            // SKILL_DUPLICATE — same skill listed twice
+            if (seen.has(skillId)) {
+                results.push({
+                    severity: 'info',
+                    category: 'Skills',
+                    code: 'SKILL_DUPLICATE',
+                    phase: 'skills',
+                    message: `Agent "${agentId}": skill "${skillId}" is listed twice`,
+                    agent: agentId,
+                });
+                continue;
+            }
+            seen.add(skillId);
+            const skill = defaultRegistry.getSkill(skillId);
+            // 1. UNKNOWN_SKILL — skill not in registry
+            if (!skill) {
+                results.push({
+                    severity: 'warning',
+                    category: 'Skills',
+                    code: 'UNKNOWN_SKILL',
+                    phase: 'skills',
+                    message: `Agent "${agentId}": skill "${skillId}" not found in registry — a stub SKILL.md will be generated`,
+                    agent: agentId,
+                });
+                continue;
+            }
+            const agentTools = agent.runtime.tools ?? [];
+            const agentDisallowed = new Set(agent.runtime.disallowedTools ?? []);
+            // 2. SKILL_MISSING_CAPABILITY — skill requires capability agent doesn't have
+            // Only check if the target actually maps this capability to concrete tools.
+            for (const cap of skill.required_capabilities ?? []) {
+                const capTools = skillMap[cap] ?? [];
+                if (capTools.length > 0 && !agentHasCapability(agentTools, cap, skillMap)) {
+                    results.push({
+                        severity: 'error',
+                        category: 'Skills',
+                        code: 'SKILL_MISSING_CAPABILITY',
+                        phase: 'skills',
+                        message: `Agent "${agentId}": skill "${skillId}" requires capability "${cap}" but agent lacks it`,
+                        agent: agentId,
+                    });
+                }
+            }
+            // 3. SKILL_CAPABILITY_DENIED_BY_TRAIT — skill requires capability explicitly denied
+            for (const cap of skill.required_capabilities ?? []) {
+                const capTools = skillMap[cap] ?? [];
+                const allDenied = capTools.length > 0 && capTools.every((t) => agentDisallowed.has(t));
+                if (allDenied) {
+                    results.push({
+                        severity: 'error',
+                        category: 'Skills',
+                        code: 'SKILL_CAPABILITY_DENIED_BY_TRAIT',
+                        phase: 'skills',
+                        message: `Agent "${agentId}": skill "${skillId}" requires "${cap}" which is denied by trait`,
+                        agent: agentId,
+                    });
+                }
+            }
+            // 4. SKILL_TOOL_FULLY_DENIED / SKILL_TOOL_PARTIALLY_DENIED
+            const skillTools = skill.allowed_tools ?? [];
+            if (skillTools.length > 0) {
+                const deniedTools = skillTools.filter((tool) => agentDisallowed.has(tool) || denyPatterns.some((p) => p === tool));
+                if (deniedTools.length === skillTools.length) {
+                    results.push({
+                        severity: 'error',
+                        category: 'Skills',
+                        code: 'SKILL_TOOL_FULLY_DENIED',
+                        phase: 'skills',
+                        message: `Agent "${agentId}": skill "${skillId}" — all allowed tools are denied by policy`,
+                        agent: agentId,
+                    });
+                }
+                else if (deniedTools.length > 0) {
+                    results.push({
+                        severity: 'warning',
+                        category: 'Skills',
+                        code: 'SKILL_TOOL_PARTIALLY_DENIED',
+                        phase: 'skills',
+                        message: `Agent "${agentId}": skill "${skillId}" — tools [${deniedTools.join(', ')}] are denied, skill may partially fail`,
+                        agent: agentId,
+                    });
+                }
+            }
+            // 5. SKILL_MISSING_MCP — required MCP servers not configured
+            const agentMcpNames = new Set((agent.runtime.mcpServers ?? []).map((s) => s.name));
+            const globalMcpNames = new Set(); // team-level MCP could be added later
+            const allMcp = new Set([...agentMcpNames, ...globalMcpNames]);
+            for (const server of skill.required_mcp_servers ?? []) {
+                if (!allMcp.has(server)) {
+                    results.push({
+                        severity: 'error',
+                        category: 'Skills',
+                        code: 'SKILL_MISSING_MCP',
+                        phase: 'skills',
+                        message: `Agent "${agentId}": skill "${skillId}" requires MCP server "${server}" which is not configured`,
+                        agent: agentId,
+                    });
+                }
+            }
+            // 6. SKILL_TARGET_INCOMPATIBLE — skill not compatible with current target
+            if (skill.compatibility?.targets?.length && !skill.compatibility.targets.includes(targetName)) {
+                results.push({
+                    severity: 'warning',
+                    category: 'Skills',
+                    code: 'SKILL_TARGET_INCOMPATIBLE',
+                    phase: 'skills',
+                    message: `Agent "${agentId}": skill "${skillId}" is not compatible with target "${targetName}"`,
+                    agent: agentId,
+                });
+            }
+            // 7. SKILL_MCP_TARGET_INCOMPATIBLE — skill needs MCP but target may not support it
+            // Currently both Claude and Codex support MCP, so this is future-proofing.
+            // Skip for now since all supported targets have MCP.
+            // 8. SKILL_INSTRUCTION_CONFLICT — skill conflicts with another skill on the agent
+            if (skill.conflicts_with?.length) {
+                for (const conflictId of skill.conflicts_with) {
+                    if (seen.has(conflictId)) {
+                        results.push({
+                            severity: 'warning',
+                            category: 'Skills',
+                            code: 'SKILL_INSTRUCTION_CONFLICT',
+                            phase: 'skills',
+                            message: `Agent "${agentId}": skill "${skillId}" conflicts with "${conflictId}"`,
+                            agent: agentId,
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=skill-requirements.js.map

package/dist/validator/checks/skill-requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-requirements.js","sourceRoot":"","sources":["../../../src/validator/checks/skill-requirements.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAK3F,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAEvE,MAAM,UAAU,sBAAsB,CACpC,IAAc,EACd,QAA2B,EAC3B,UAAkB;IAElB,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;IAEnE,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAE/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,4CAA4C;YAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,iBAAiB;oBACvB,KAAK,EAAE,QAAQ;oBACf,OAAO,EAAE,UAAU,OAAO,aAAa,OAAO,mBAAmB;oBACjE,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAElB,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAEhD,2CAA2C;YAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,QAAQ;oBACf,OAAO,EAAE,UAAU,OAAO,aAAa,OAAO,6DAA6D;oBAC3G,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;YAErE,6EAA6E;YAC7E,4EAA4E;YAC5E,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC;gBACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACrC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAC1E,OAAO,CAAC,IAAI,CAAC;wBACX,QAAQ,EAAE,OAAO;wBACjB,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,0BAA0B;wBAChC,KAAK,EAAE,QAAQ;wBACf,OAAO,EAAE,UAAU,OAAO,aAAa,OAAO,0BAA0B,GAAG,sBAAsB;wBACjG,KAAK,EAAE,OAAO;qBACf,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,oFAAoF;YACpF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,qBAAqB,IAAI,EAAE,EAAE,CAAC;gBACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvF,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,CAAC,IAAI,CAAC;wBACX,QAAQ,EAAE,OAAO;wBACjB,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,kCAAkC;wBACxC,KAAK,EAAE,QAAQ;wBACf,OAAO,EAAE,UAAU,OAAO,aAAa,OAAO,eAAe,GAAG,4BAA4B;wBAC5F,KAAK,EAAE,OAAO;qBACf,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,2DAA2D;YAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;YAC7C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAC5E,CAAC;gBACF,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;oBAC7C,OAAO,CAAC,IAAI,CAAC;wBACX,QAAQ,EAAE,OAAO;wBACjB,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,yBAAyB;wBAC/B,KAAK,EAAE,QAAQ;wBACf,OAAO,EAAE,UAAU,OAAO,aAAa,OAAO,4CAA4C;wBAC1F,KAAK,EAAE,OAAO;qBACf,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,OAAO,CAAC,IAAI,CAAC;wBACX,QAAQ,EAAE,SAAS;wBACnB,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,6BAA6B;wBACnC,KAAK,EAAE,QAAQ;wBACf,OAAO,EAAE,UAAU,OAAO,aAAa,OAAO,cAAc,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;wBAC1H,KAAK,EAAE,OAAO;qBACf,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,6DAA6D;YAC7D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACnF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,sCAAsC;YAChF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;YAE9D,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;gBACtD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxB,OAAO,CAAC,IAAI,CAAC;wBACX,QAAQ,EAAE,OAAO;wBACjB,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,mBAAmB;wBACzB,KAAK,EAAE,QAAQ;wBACf,OAAO,EAAE,UAAU,OAAO,aAAa,OAAO,0BAA0B,MAAM,2BAA2B;wBACzG,KAAK,EAAE,OAAO;qBACf,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,0EAA0E;YAC1E,IAAI,KAAK,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9F,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,QAAQ;oBACf,OAAO,EAAE,UAAU,OAAO,aAAa,OAAO,oCAAoC,UAAU,GAAG;oBAC/F,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;YAED,mFAAmF;YACnF,2EAA2E;YAC3E,qDAAqD;YAErD,kFAAkF;YAClF,IAAI,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;gBACjC,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;oBAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;wBACzB,OAAO,CAAC,IAAI,CAAC;4BACX,QAAQ,EAAE,SAAS;4BACnB,QAAQ,EAAE,QAAQ;4BAClB,IAAI,EAAE,4BAA4B;4BAClC,KAAK,EAAE,QAAQ;4BACf,OAAO,EAAE,UAAU,OAAO,aAAa,OAAO,qBAAqB,UAAU,GAAG;4BAChF,KAAK,EAAE,OAAO;yBACf,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/validator/checks/team-graph-enhanced.d.ts

@@ -0,0 +1,4 @@
+import type { CoreTeam } from '../../core/types.js';
+import type { ValidationResult } from '../types.js';
+export declare function checkTeamGraphEnhanced(team: CoreTeam): ValidationResult[];
+//# sourceMappingURL=team-graph-enhanced.d.ts.map

package/dist/validator/checks/team-graph-enhanced.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-graph-enhanced.d.ts","sourceRoot":"","sources":["../../../src/validator/checks/team-graph-enhanced.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,GAAG,gBAAgB,EAAE,CAgFzE"}