workspai 0.43.1 → 0.44.0

package/docs/contracts/ARTIFACT_CATALOG.md

@@ -9,13 +9,17 @@ Canonical map of **on-disk artifacts** produced by Workspai CLI commands. Dashbo
 | Workspace manifest | `.workspai/workspace.json`             | `create workspace`, `foundation ensure`, `bootstrap` (profile) | Profile, engine, bootstrap metadata — **not** project list |
 | Workspace contract | `.workspai/workspace.contract.json`    | `workspace sync`, `workspace contract *`, import/adopt         | Operational project registry (ports, contracts)            |
 | Registry summary   | `.workspai/workspace-registry.v1.json` | `workspace sync`, contract sync, `registry status --refresh`   | **Canonical** project count + authority for UI/CI          |
-| Workspace marker   | `.workspai-workspace`                  | `create workspace`, `foundation ensure`                        | Root detection                                             |
+| Workspace marker   | `.workspai-workspace`                  | `create workspace`, `foundation ensure`                        | Portable root detection; commit with the workspace         |
 
 Legacy `.rapidkit-workspace` and `.rapidkit/*` paths are read as fallback for
 older workspaces. New Workspai CLI writes target `.workspai-workspace` and
 `.workspai/*`. Workspace archive hydrate also normalizes legacy archive entries
 to canonical Workspai paths on restore.
 
+The canonical `.workspai-workspace` marker must remain trackable. Generated
+workspace `.gitignore` files exclude legacy/local engine state but do not
+exclude the canonical marker.
+
 ## Naming conventions
 
 | Pattern           | Meaning                                | Examples                                                     |
@@ -26,23 +30,23 @@ to canonical Workspai paths on restore.
 
 ## Governance evidence loop
 
-| Command                  | Primary artifact                                          | Schema version                  | JSON Schema                                                  |
-| ------------------------ | --------------------------------------------------------- | ------------------------------- | ------------------------------------------------------------ |
-| `doctor workspace`       | `.workspai/reports/doctor-last-run.json`                  | `doctor-workspace-evidence-v1`  | `contracts/doctor-workspace-evidence.v1.json`                |
-| `doctor project`         | `.workspai/reports/doctor-project-last-run.json`          | `doctor-project-evidence-v1`    | `contracts/doctor-project-evidence.v1.json`                  |
-| `doctor * --plan`        | `.workspai/reports/doctor-remediation-plan-last-run.json` | `doctor-remediation-plan-v2`    | `contracts/doctor-remediation-plan.v1.json`                  |
-| `doctor * --fix/--apply` | `.workspai/reports/doctor-fix-result-last-run.json`       | `rapidkit-doctor-fix-result-v1` | `contracts/workspace-intelligence/doctor-fix-result.v1.json` |
-| `workspace remediation-plan --write` | `.workspai/reports/artifact-remediation-plan-last-run.json` | `artifact-remediation-plan-v1` | `contracts/artifact-remediation-plan.v1.json` |
-| `analyze`                | `.workspai/reports/analyze-last-run.json`                 | `rapidkit-analyze-v1`           | `contracts/analyze-last-run.v1.json`                         |
-| `readiness`              | `.workspai/reports/release-readiness-last-run.json`       | `release-readiness-v1`          | `contracts/release-readiness.v1.json`                        |
-| `pipeline`               | `.workspai/reports/pipeline-last-run.json`                | `rapidkit-pipeline-v1`          | `contracts/pipeline-last-run.v1.json`                        |
-| `autopilot release`      | `.workspai/reports/autopilot-release-last-run.json`       | `autopilot-release-v1`          | —                                                            |
-|                          | `.workspai/reports/autopilot-release.json`                | (alias, same payload)           | —                                                            |
+| Command                              | Primary artifact                                            | Schema version                  | JSON Schema                                                  |
+| ------------------------------------ | ----------------------------------------------------------- | ------------------------------- | ------------------------------------------------------------ |
+| `doctor workspace`                   | `.workspai/reports/doctor-last-run.json`                    | `doctor-workspace-evidence-v1`  | `contracts/doctor-workspace-evidence.v1.json`                |
+| `doctor project`                     | `.workspai/reports/doctor-project-last-run.json`            | `doctor-project-evidence-v1`    | `contracts/doctor-project-evidence.v1.json`                  |
+| `doctor * --plan`                    | `.workspai/reports/doctor-remediation-plan-last-run.json`   | `doctor-remediation-plan-v2`    | `contracts/doctor-remediation-plan.v2.json`                  |
+| `doctor * --fix/--apply`             | `.workspai/reports/doctor-fix-result-last-run.json`         | `rapidkit-doctor-fix-result-v1` | `contracts/workspace-intelligence/doctor-fix-result.v1.json` |
+| `workspace remediation-plan --write` | `.workspai/reports/artifact-remediation-plan-last-run.json` | `artifact-remediation-plan-v1`  | `contracts/artifact-remediation-plan.v1.json`                |
+| `analyze`                            | `.workspai/reports/analyze-last-run.json`                   | `rapidkit-analyze-v1`           | `contracts/analyze-last-run.v1.json`                         |
+| `readiness`                          | `.workspai/reports/release-readiness-last-run.json`         | `release-readiness-v1`          | `contracts/release-readiness.v1.json`                        |
+| `pipeline`                           | `.workspai/reports/pipeline-last-run.json`                  | `rapidkit-pipeline-v1`          | `contracts/pipeline-last-run.v1.json`                        |
+| `autopilot release`                  | `.workspai/reports/autopilot-release-last-run.json`         | `autopilot-release-v1`          | `contracts/autopilot-release.v1.json`                        |
+|                                      | `.workspai/reports/autopilot-release.json`                  | (alias, same payload)           | `contracts/autopilot-release.v1.json`                        |
 
 Side/cache (not gates): `.workspai/reports/doctor-workspace-cache.json` (`doctor-workspace-cache-v2`).
 
 Doctor Studio handoff:
-`doctor-remediation-plan-v2` (`contracts/doctor-remediation-plan.v1.json`) is emitted in JSON
+`doctor-remediation-plan-v2` (`contracts/doctor-remediation-plan.v2.json`) is emitted in JSON
 responses and persisted to `.workspai/reports/doctor-remediation-plan-last-run.json` by
 `doctor workspace|project --plan`, `--fix`, and `--apply` so IDEs can render approved commands,
 typed file edits, diff previews, ordered phases, step dependencies, rollback, and verification
@@ -71,16 +75,23 @@ the same evidence without losing the workspace source of truth.
 | Command                                        | Artifact                                                                                                                                                                                                                                                     | Schema                                 | Contract file                                                             |
 | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------- | ------------------------------------------------------------------------- |
 | `workspace model --write`                      | `workspace-model.json`                                                                                                                                                                                                                                       | `workspace-model.v1`                   | `contracts/workspace-intelligence/workspace-model.v1.json`                |
-| `workspace snapshot`                           | `workspace-model-snapshot.json`                                                                                                                                                                                                                              | `workspace-model-snapshot.v1`          | `workspace-model-snapshot.v1.json`                                        |
-| `workspace diff`                               | `workspace-model-diff-last-run.json`                                                                                                                                                                                                                         | `workspace-model-diff.v1`              | `workspace-model-diff.v1.json`                                            |
-| `workspace impact --from <diff>`               | `workspace-impact-last-run.json`                                                                                                                                                                                                                             | `workspace-impact.v1`                  | `workspace-impact.v1.json`                                                |
-| `workspace verify`                             | `workspace-verify-last-run.json`                                                                                                                                                                                                                             | `workspace-verify.v1`                  | `workspace-verify.v1.json`                                                |
-| `workspace context --write`                    | `workspace-context-agent.json`                                                                                                                                                                                                                               | `workspace-context.v1`                 | `workspace-context.v1.json`                                               |
-| `workspace agent-sync --write`                 | `reports/INDEX.json`, `reports/agent-customization-pack.json`, `reports/workspai-mcp-design.json`, `reports/workspace-skills-index.json`, `.workspai/skills/*.md`, `.workspai/AGENT-GROUNDING.md`, `AGENTS.md`, Copilot/Cursor/Claude/VS Code agent surfaces | `rapidkit-agent-customization-pack.v1` | `contracts/agent-customization-pack.v1.json`                              |
+| `workspace snapshot`                           | `workspace-model-snapshot.json`                                                                                                                                                                                                                              | `workspace-model-snapshot.v1`          | `contracts/workspace-intelligence/workspace-model-snapshot.v1.json`       |
+| `workspace diff`                               | `workspace-model-diff-last-run.json`                                                                                                                                                                                                                         | `workspace-model-diff.v1`              | `contracts/workspace-intelligence/workspace-model-diff.v1.json`           |
+| `workspace impact --from <diff>`               | `workspace-impact-last-run.json`                                                                                                                                                                                                                             | `workspace-impact.v1`                  | `contracts/workspace-intelligence/workspace-impact.v1.json`               |
+| `analyze --json`                               | `analyze-last-run.json`                                                                                                                                                                                                                                      | `rapidkit-analyze-v1`                  | `contracts/analyze-last-run.v1.json`                                      |
+| `workspace verify`                             | `workspace-verify-last-run.json`                                                                                                                                                                                                                             | `workspace-verify.v1`                  | `contracts/workspace-intelligence/workspace-verify.v1.json`               |
+| `workspace context --write`                    | `workspace-context-agent.json`                                                                                                                                                                                                                               | `workspace-context.v1`                 | `contracts/workspace-intelligence/workspace-context.v1.json`              |
+| `workspace agent-sync --write`                 | `reports/agent-customization-pack.json`                                                                                                                                                                                                                       | `rapidkit-agent-customization-pack.v1` | `contracts/workspace-intelligence/agent-customization-pack-report.v1.json` |
+| `workspace agent-sync --write`                 | `reports/INDEX.json`                                                                                                                                                                                                                                          | `rapidkit-agent-reports-index.v1`      | `contracts/workspace-intelligence/agent-reports-index.v1.json`            |
+| `workspace agent-sync --write`                 | `reports/workspace-skills-index.json`                                                                                                                                                                                                                          | `workspace-skills-index.v1`            | `contracts/workspace-intelligence/workspace-skills-index.v1.json`         |
+| `workspace agent-sync --write`                 | `reports/workspai-mcp-design.json`, `.workspai/skills/*.md`, `.workspai/AGENT-GROUNDING.md`, `AGENTS.md`, IDE agent surfaces                                                                                                                                 | Mixed generated surfaces               | See customization pack output inventory                                  |
 | `workspace explain --write`                    | `workspace-explain-last-run.json`                                                                                                                                                                                                                            | `workspace-explain.v1`                 | `contracts/workspace-intelligence/workspace-explain.v1.json`              |
 | `workspace feedback record` / `doctor * --fix` | `workspace-intelligence-history.json` (`kind: agent-action`, `doctor-fix`)                                                                                                                                                                                   | `workspace-intelligence-history.v1`    | `contracts/workspace-intelligence/workspace-intelligence-history.v1.json` |
 
 **CLI semantics:** `workspace diff --from` expects a **model or snapshot** baseline. `workspace impact --from` expects a **diff report**.
+Persisted artifacts retain their artifact schema. JSON command projections that add operation metadata
+such as `outputPath`, `status`, or structured errors use
+`contracts/cli-operation-result.v1.json`; the canonical artifact is nested under `artifact`.
 
 ### Dependency graph (`workspace-dependency-graph.v1`)
 
@@ -240,25 +251,33 @@ Canonical source: `src/observability/run-correlation.ts` (`attachRunCorrelation`
 
 ## Operational / platform
 
-| Command                          | Artifact                                                               | Notes                                                                                        |
-| -------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | -------------------------------------- |
-| `workspace run`                  | `workspace-run-last.json`                                              | `workspace-run-v1` (multi-stage: `stages.test`, `stages.build`, …)                           | `contracts/workspace-run-last.v1.json` |
-| `autopilot release` (run stages) | same `workspace-run-last.json`                                         | Autopilot publishes test/build into aggregate (no separate `autopilot-workspace-run-*.json`) | —                                      |
-| `bootstrap`                      | `bootstrap-compliance-{ts}.json`, `bootstrap-compliance.latest.json`   |                                                                                              |
-| `mirror status`                  | `mirror-ops-{ts}.json`, `mirror-ops.latest.json`                       |                                                                                              |
-| `mirror` (transparency)          | `transparency-evidence-{ts}.json`, `transparency-evidence.latest.json` |                                                                                              |
-| `infra plan`                     | `infra-plan.json`                                                      | `rapidkit.infra-plan.v1`                                                                     |
-| `workspace archive`              | `archive-manifest.json`                                                | Root `.workspai/`, handoff                                                                   |
-| `workspace share`                | `reports/share-bundle.json` (default)                                  | Aggregation bundle                                                                           |
-| `import` / `adopt`               | `{project}/.workspai/import-readiness.json`                            | Per project                                                                                  |
-| `workspace contract verify`      | `workspace-contract-verify-last-run.json`                              | CLI verify cache                                                                             |
+| Command                          | Artifact                                                               | Notes                                                                                        | Contract                                                             |
+| -------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- |
+| `workspace run`                  | `workspace-run-last.json`                                              | `workspace-run-v1` (multi-stage: `stages.test`, `stages.build`, …)                           | `contracts/workspace-run-last.v1.json`                               |
+| `autopilot release` (run stages) | same `workspace-run-last.json`                                         | Autopilot publishes test/build into aggregate (no separate `autopilot-workspace-run-*.json`) | —                                                                    |
+| `bootstrap`                      | `bootstrap-compliance-{ts}.json`, `bootstrap-compliance.latest.json`   |                                                                                              | —                                                                    |
+| `mirror status`                  | `mirror-ops-{ts}.json`, `mirror-ops.latest.json`                       |                                                                                              | —                                                                    |
+| `mirror` (transparency)          | `transparency-evidence-{ts}.json`, `transparency-evidence.latest.json` |                                                                                              | —                                                                    |
+| `infra plan`                     | `infra-plan.json`                                                      | `rapidkit.infra-plan.v1`                                                                     | —                                                                    |
+| `workspace archive`              | `.workspai/archive-manifest.json` inside ZIP/ZIP64                     | Streaming handoff; workspace payload is unlimited by default and safety budgets are opt-in   | `contracts/workspace-archive-manifest.v1.json`                       |
+| `workspace share`                | `reports/share-bundle.json` (default)                                  | Aggregation bundle                                                                           | —                                                                    |
+| `import` / `adopt`               | `{project}/.workspai/import-readiness.json`                            | Per project                                                                                  | —                                                                    |
+| `workspace contract verify`      | `workspace-contract-verify-last-run.json`                              | CLI verify cache                                                                             | `contracts/workspace-intelligence/workspace-contract-verify.v1.json` |
 
 ## Static capability contracts
 
-| Contract                                        | Schema version                            | Consumer purpose                                                                                 |
-| ----------------------------------------------- | ----------------------------------------- | ------------------------------------------------------------------------------------------------ |
-| `contracts/runtime-command-surface.v1.json`     | `rapidkit-runtime-command-surface-v1`     | Runtime commands, scaffold kits, and create planner summary                                      |
-| `contracts/create-planner-capabilities.v1.json` | `rapidkit-create-planner-capabilities-v1` | Native create, external-create-adopt, and adopt-only lanes for CLI, CI, VS Code, and AI planners |
+| Contract                                               | Schema version                                   | Consumer purpose                                                                   |
+| ------------------------------------------------------ | ------------------------------------------------ | ---------------------------------------------------------------------------------- |
+| `contracts/runtime-command-surface.v1.json`            | `rapidkit-runtime-command-surface-v1`            | Runtime commands, scaffold kits, and create planner summary                        |
+| `contracts/cli-operation-result.v1.json`               | `workspai-cli-operation-result-v1`               | Stable success/error envelope for JSON command projections                         |
+| `contracts/command-capabilities.v1.json`               | `rapidkit-command-capabilities-v1`               | Effective command ownership and workspace command discovery                        |
+| `contracts/version.v1.json`                            | `rapidkit-version-v1`                            | Version and published-contract discovery response                                  |
+| `contracts/published-contract-catalog.v1.json`         | `workspai-published-contract-catalog-v1`         | Schema versions plus resolvable contract paths                                     |
+| `contracts/project-entry-capability.v1.json`           | `workspai-project-entry-capability-v1`           | Open-ended adopt/import capability boundaries for readable projects                |
+| `contracts/create-planner-capabilities.v1.json`        | `rapidkit-create-planner-capabilities-v1`        | Native create, official, and existing lanes for CLI, CI, VS Code, and AI planners  |
+| `contracts/workspace-archive-capabilities.v1.json`     | `workspai-workspace-archive-capabilities-v1`     | ZIP64, streaming, compression, limits, commands, flags, and linked archive schemas |
+| `contracts/workspace-archive-manifest.v1.json`         | `workspai-workspace-archive-manifest-v1`         | Runtime-validated archive manifest, file inventory, checksums, and security policy |
+| `contracts/workspace-archive-operation-result.v1.json` | `workspai-workspace-archive-operation-result-v1` | Stable JSON results for export, inspect, verify, doctor, hydrate, and failures     |
 
 ## Observability stream (not on-disk)
 
@@ -280,6 +299,11 @@ events go to stderr (`--log-format json`). The two never mix.
 | `workspace sync [--json]`                        | Updates contract + `workspace-registry.v1.json`; JSON includes `registrySummary` |
 | `workspace registry status [--refresh] [--json]` | Reads or publishes registry summary                                              |
 
+`workspace-registry.v1.json`, adoption records, and verification reports can
+contain machine-local absolute paths. Regenerate them after cloning; do not use
+them as portable repository contracts. The portable source is
+`.workspai/workspace.contract.json` plus canonical workspace/project metadata.
+
 ## Project-scoped reports
 
 Under `{project}/.workspai/reports/` when commands run at project scope (e.g. project doctor). Workspace-level reports stay under `{workspace}/.workspai/reports/`.

package/docs/contracts/README.md

@@ -36,11 +36,12 @@ Published under `../../contracts/` (not duplicated in this folder):
 - `release-readiness.v1.json` — release readiness gate evidence
 - `workspace-run-last.v1.json` — multi-stage workspace run evidence
 - `doctor-workspace-evidence.v1.json` / `doctor-project-evidence.v1.json` — doctor evidence
-- `doctor-remediation-plan.v1.json` — persisted Doctor fix/plan Studio handoff contract
+- `doctor-remediation-plan.v2.json` — canonical persisted Doctor fix/plan Studio handoff contract (`v1` path is a deprecated compatibility alias)
 - `artifact-remediation-plan.v1.json` — cross-artifact Studio handoff for Bootstrap, Analyze, Readiness, Pipeline, Workspace Run, Workspace Verify, and Doctor plan bridging
 - `analyze-last-run.v1.json` — analyze evidence
 - `pipeline-last-run.v1.json` — governance pipeline orchestration
-- `create-planner-capabilities.v1.json` — native-create, external-create-adopt, and adopt-only capability lanes
+- `project-entry-capability.v1.json` — open-ended adopt/import contract for readable projects
+- `create-planner-capabilities.v1.json` — native, official, and existing capability lanes
 - `agent-customization-pack.v1.json` — generated instructions, prompts, skills, agents, optional hooks, MCP-ready design metadata, target matrix, and drift state for AI agent surfaces
 
 Workspace intelligence (`../../contracts/workspace-intelligence/`):

package/docs/create-planner-capabilities.md

@@ -6,31 +6,40 @@ CI, and AI agents share the same expectations.
 
 ## Lanes
 
-| Lane                    | Status    | Meaning                                                                                             |
-| ----------------------- | --------- | --------------------------------------------------------------------------------------------------- |
-| `native-create`         | Available | Workspai owns the scaffold contract, marker, registry, doctor, bootstrap, and workspace model path. |
-| `external-create-adopt` | Planned   | A stable ecosystem generator exists, but Workspai does not yet own the full post-create contract.   |
-| `adopt-only`            | Available | The project enters Workspace Intelligence through import/adopt, not native create.                  |
+| Lane       | Status    | Meaning                                                                                                                                       |
+| ---------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
+| `native`   | Available | Workspai owns the scaffold contract, marker, registry, doctor, bootstrap, and workspace model path.                                           |
+| `official` | Available | A stable ecosystem generator exists. Available entries run the official generator and register the project; planned entries fall back to adopt. |
+| `existing` | Available | The project enters Workspace Intelligence through import/adopt, not native create.                                                            |
 
 ## Native create
 
-Native create is reserved for kits with deterministic Workspai contracts:
+Native create is reserved for Workspai-owned kits with deterministic contracts:
 
 - FastAPI
 - NestJS
 - Go Fiber and Go Gin
 - Spring Boot
 - ASP.NET Core Web API
-- Frontend kits (`frontend.nextjs`, `frontend.vite-react`, `frontend.angular`, and related frontend generators)
 
 These kits can be exposed through `workspai create project` because Workspai can
 create the project and immediately produce the expected `.workspai` metadata,
 workspace registry entries, doctor evidence, and workspace model data.
 
-## External create, then adopt
+## Official generators
 
-Some ecosystems have stable external commands but are not RapidKit-native create
-targets yet:
+Some ecosystems have stable official generators. Available entries are invoked
+by Workspai and then registered in Workspace Intelligence:
+
+- Next.js: `npx create-next-app@latest <name>`
+- React Router: `npx create-react-router@latest <name>`
+- React, Vue, Svelte, Solid, and Vite: `npm create vite@latest <name> ...`
+- Nuxt: `npx create-nuxt@latest <name> ...`
+- Angular: `npx @angular/cli@19 new <name>`
+- Astro: `npm create astro@4 <name>`
+- SvelteKit: `npx sv@latest create <name>`
+
+Other ecosystems are planned official handoffs but are not automated yet:
 
 - WordPress site: `wp core download`, `wp config create`, `wp db create`, `wp core install`
 - WordPress block/plugin: `npx @wordpress/create-block@latest <slug>`
@@ -38,14 +47,19 @@ targets yet:
 - Symfony: `composer create-project symfony/skeleton <name>`
 - Rails: `rails new <name>`
 
-These are `external-create-adopt` candidates, not active native kits. Until the
+These are `official` candidates, not active native kits. Until each planned
 post-create contract is implemented end to end, Workspai should guide users to
 create externally and then adopt/import the project.
 
 ## Adopt only
 
 If a project already exists, or if the requested runtime has no Workspai-owned
-create contract, the correct lane is `adopt-only`.
+create contract, the correct lane is `existing`.
+
+The runtime names in the create planner are detection signals, not an allowlist.
+Adopt/import is intentionally open-ended for readable projects that can be
+registered and modeled. A project does not need to be PHP, Ruby, Rust, Elixir,
+Clojure, Scala, or Kotlin to enter Workspace Intelligence.
 
 Adoption still gives the project Workspace Intelligence:
 
@@ -61,19 +75,23 @@ Do not convert an unsupported or ambiguous stack request into a different native
 kit. For example, a PHP, WordPress, Laravel, Symfony, or Rails request must not
 be translated into FastAPI, NestJS, Go, Java, .NET, or a frontend kit.
 
-If native create is unavailable, the planner should explain the supported lane
-and guide the user to `adopt-only` or a future `external-create-adopt` flow.
+If executable create is unavailable, the planner should explain the supported
+lane and guide the user to `existing` or a future `official` flow.
 
 ## CLI guard
 
 `workspai create project <kit> <name>` must check the capability lane before
-running any native generator or delegating to the Core engine.
+running any native kit, official generator, or Core engine handoff.
+
+If the request resolves to an available `official` generator, the CLI may run
+that ecosystem generator and then register the project in Workspace
+Intelligence.
 
-If the request resolves to `external-create-adopt` or an explicit `adopt-only`
-runtime, the CLI must stop early and explain:
+If the request resolves to a planned `official` handoff or an explicit
+`existing` runtime signal, the CLI must stop early and explain:
 
 - native create is not available yet for the requested stack
-- whether the future lane is `external-create-adopt` or current `adopt-only`
+- whether the future lane is `official` or current `existing`
 - which external generator commands are relevant, when known
 - how to run `npx workspai adopt <project-path>` after the project exists
 

package/docs/workspace-operations.md

@@ -94,6 +94,13 @@ Contract file: `.workspai/workspace.contract.json`. Verification checks schema,
 
 Workspai keeps the contract alive during `create project` and `workspace sync` without overwriting manual API/event/owner declarations.
 
+On a freshly cloned or moved workspace, `workspace sync` also repairs the
+machine-local global registry entry before discovering projects. The command is
+therefore safe to use as the first reconciliation step after clone. For a
+legacy workspace, run `workspace foundation ensure` once to add canonical
+`.workspai-workspace` and `.workspai/*` foundation files while retaining legacy
+metadata as read compatibility input.
+
 ## Portable workspace archives
 
 ```bash
@@ -106,6 +113,24 @@ npx workspai workspace hydrate team-workspace.workspai-archive.zip --output ./te
 
 Export excludes dependency folders, build output, git history, logs, `.env`, and private keys by default. Use `--include-env` only for trusted internal handoffs. Hydrate accepts legacy `.rapidkit-workspace` and `.rapidkit/*` archive entries, but restores them as canonical `.workspai-workspace` and `.workspai/*` paths.
 
+Archive export, verification, and hydrate stream file payloads instead of loading the workspace into memory. Exports use ZIP64, so multi-gigabyte workspaces and archives with more than 65,535 files are supported. Stored ZIP entries are the default; use `--archive-compression deflate` when transfer size matters more than export CPU time.
+
+Workspace size is unrestricted by default. For untrusted remote archives, optional operational budgets can be set without imposing a product-wide workspace limit:
+
+```bash
+npx workspai workspace hydrate https://example.test/team.zip \
+  --output ./team-workspace \
+  --max-download-size 100gb \
+  --max-expanded-size 500gb \
+  --download-timeout-ms 21600000
+```
+
+IDE, CI, and AI consumers can discover archive behavior from
+`contracts/workspace-archive-capabilities.v1.json`. The embedded manifest and every successful
+`--json` operation result are runtime-validated against
+`contracts/workspace-archive-manifest.v1.json` and
+`contracts/workspace-archive-operation-result.v1.json`.
+
 ## Workspace infrastructure (sidecar)
 
 Discovery sources: Core module slugs, project `.env.example`, workspace contract env, and `.workspai/infra/overrides.json`.

package/package.json

@@ -1,20 +1,29 @@
 {
   "name": "workspai",
-  "version": "0.43.1",
+  "version": "0.44.0",
   "type": "module",
   "description": "Open-source workspace intelligence CLI for software systems: create, adopt, govern, verify, and align polyglot workspaces for humans, CI, IDEs, and AI agents.",
   "keywords": [
-    "rapidkit",
     "workspai",
+    "rapidkit",
     "wspai",
     "ai",
     "cli",
+    "agents",
     "create",
     "workspace",
     "workspace-intelligence",
+    "workspace-ai",
+    "skills",
+    "model",
+    "graph",
+    "knowledge",
     "governance",
+    "AI-agents",
     "backend",
     "frontend",
+    "microservices",
+    "api",
     "fastapi",
     "nestjs",
     "nextjs",
@@ -23,8 +32,6 @@
     "spring",
     "gofiber",
     "gogin",
-    "microservices",
-    "api",
     "generator",
     "scaffold"
   ],
@@ -87,6 +94,9 @@
     "test:prepare-embeddings": "node scripts/prepare-mock-embeddings.mjs",
     "generate-embeddings": "npx tsx src/ai/generate-embeddings.ts",
     "verify:package-cli": "node scripts/verify-package-cli.mjs",
+    "check:workspace-intelligence-runtime": "node scripts/check-workspace-intelligence-runtime-conformance.mjs",
+    "check:workspace-intelligence-adversarial": "node scripts/check-workspace-intelligence-adversarial.mjs",
+    "check:windows-registry": "node scripts/check-windows-registry-invariants.mjs",
     "smoke:enterprise-package": "node scripts/enterprise-package-smoke.mjs",
     "prepack": "node scripts/prepack-enterprise.mjs",
     "test:e2e": "vitest run src/__tests__/e2e.test.ts",
@@ -101,8 +111,8 @@
     "format:check": "prettier --check \"src/**/*.ts\"",
     "typecheck": "tsc --noEmit",
     "validate": "corepack npm run typecheck && corepack npm run lint && corepack npm run format:check && corepack npm test",
-    "security": "npm audit --audit-level=moderate",
-    "security:fix": "npm audit fix",
+    "security": "corepack npm audit --audit-level=moderate",
+    "security:fix": "corepack npm audit fix",
     "metrics": "npx tsx scripts/metrics.ts",
     "validate:docs-examples": "node scripts/validate-doc-examples.mjs",
     "check:markdown-links": "node scripts/check-markdown-links.mjs",
@@ -117,23 +127,25 @@
     "analyze": "corepack npm run build && node scripts/analyze-dist.mjs",
     "size-check": "corepack npm run build && size-limit",
     "bench": "npx tsx scripts/benchmarks.ts",
-    "quality": "corepack npm run typecheck && corepack npm run lint && corepack npm run format:check && corepack npm test && corepack npm run size-check && corepack npm run security && corepack npm run validate:docs && corepack npm run smoke:frontend-generators && corepack npm run check:contracts && corepack npm run check:shared-contracts && corepack npm run check:parity-snapshot && corepack npm run check:agent-customization-drift",
+    "quality": "corepack npm run typecheck && corepack npm run lint && corepack npm run format:check && corepack npm test && corepack npm run size-check && corepack npm run check:workspace-intelligence-runtime && corepack npm run check:workspace-intelligence-adversarial && corepack npm run security && corepack npm run validate:docs && corepack npm run smoke:frontend-generators && corepack npm run check:contracts && corepack npm run check:shared-contracts && corepack npm run check:parity-snapshot && corepack npm run check:agent-customization-drift",
     "act-matrix": "act -P ubuntu-latest=ghcr.io/catthehacker/ubuntu:act-22.04 -P macos-latest=ghcr.io/catthehacker/ubuntu:act-22.04 -P windows-latest=ghcr.io/catthehacker/ubuntu:act-22.04 --pull=false -j build-test-matrix",
     "release:dry": "bash scripts/release.sh --no-publish --yes --allow-dirty",
     "release:patch": "bash scripts/release.sh patch",
     "release:minor": "bash scripts/release.sh minor",
     "release:major": "bash scripts/release.sh major",
-    "check": "corepack npm run typecheck && corepack npm run lint && corepack npm run format:check",
+    "check": "corepack npm run check:windows-registry && corepack npm run typecheck && corepack npm run lint && corepack npm run format:check",
     "ci": "corepack npm run quality",
     "contracts:sync": "corepack npm run sync:contracts && corepack npm run sync:shared-contracts",
     "contracts:check": "corepack npm run check:contracts && corepack npm run check:shared-contracts && corepack npm run check:parity-snapshot && corepack npm run check:generated-contracts && corepack npm run check:agent-customization-drift",
-    "contracts:validate": "corepack npm run contracts:check && corepack npm run validate:contracts",
+    "contracts:validate": "corepack npm run contracts:check && corepack npm run validate:contracts && corepack npm run build && corepack npm run check:workspace-intelligence-runtime && corepack npm run check:workspace-intelligence-adversarial",
     "docs:validate": "corepack npm run validate:docs",
     "smoke": "corepack npm run smoke:enterprise-package && corepack npm run smoke:readme && corepack npm run smoke:frontend-generators",
     "fix": "corepack npm run lint:fix && corepack npm run format && corepack npm run sync:contracts && corepack npm run sync:shared-contracts && corepack npm run sync-kits"
   },
   "dependencies": {
     "@clack/prompts": "^0.9.1",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
     "chalk": "^5.3.0",
     "cli-progress": "^3.12.0",
     "commander": "^12.1.0",
@@ -143,7 +155,9 @@
     "nunjucks": "^3.2.4",
     "openai": "^6.22.0",
     "ora": "^8.0.1",
-    "validate-npm-package-name": "^5.0.1"
+    "validate-npm-package-name": "^5.0.1",
+    "yauzl": "^3.4.0",
+    "yazl": "^3.3.1"
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.3.3",
@@ -154,6 +168,8 @@
     "@types/node": "^20.14.0",
     "@types/nunjucks": "^3.2.6",
     "@types/validate-npm-package-name": "^4.0.2",
+    "@types/yauzl": "^2.10.3",
+    "@types/yazl": "^3.3.1",
     "@typescript-eslint/eslint-plugin": "^8.46.2",
     "@typescript-eslint/parser": "^8.46.2",
     "@vitest/coverage-v8": "^4.0.15",
@@ -181,9 +197,5 @@
       "prettier --write"
     ]
   },
-  "overrides": {
-    "minimatch": "^10.2.1",
-    "esbuild": "^0.28.1"
-  },
   "packageManager": "npm@10.8.2"
 }

package/scripts/enterprise-package-smoke.mjs

@@ -182,6 +182,13 @@ function parseTrailingJsonArray(stdout) {
 const REQUIRED_PACKAGE_FILES = [
   'dist/index.js',
   'contracts/runtime-command-surface.v1.json',
+  'contracts/workspace-archive-capabilities.v1.json',
+  'contracts/workspace-archive-manifest.v1.json',
+  'contracts/workspace-archive-operation-result.v1.json',
+  'contracts/create-planner-capabilities.v1.json',
+  'contracts/project-entry-capability.v1.json',
+  'contracts/workspace-intelligence-architecture.v1.json',
+  'contracts/workspace-intelligence-chain.v1.json',
   'contracts/extension-cli-compatibility.v1.json',
   'data/modules-embeddings.json',
   'templates/kits/fastapi-standard/README.md.j2',
@@ -193,10 +200,7 @@ const REQUIRED_PACKAGE_FILES = [
   'scripts/enforce-package-manager.cjs',
 ];
 
-const FORBIDDEN_PACKAGE_FILES = [
-  'workspai.config.example.js',
-  'rapidkit.config.example.js',
-];
+const FORBIDDEN_PACKAGE_FILES = ['workspai.config.example.js', 'rapidkit.config.example.js'];
 
 function isPublishedByFilesPolicy(packageJson, assetPath) {
   const files = packageJson.files ?? [];
@@ -223,7 +227,10 @@ function assertPackageFilesPolicy(requiredFiles) {
     assertFile(required);
   }
   for (const forbidden of FORBIDDEN_PACKAGE_FILES) {
-    if (isPublishedByFilesPolicy(packageJson, forbidden) || fs.existsSync(path.join(repoRoot, forbidden))) {
+    if (
+      isPublishedByFilesPolicy(packageJson, forbidden) ||
+      fs.existsSync(path.join(repoRoot, forbidden))
+    ) {
       fail(`forbidden legacy package file is still present or published: ${forbidden}`);
     }
   }
@@ -294,7 +301,15 @@ function assertCliContracts() {
       fail(`commands surface is missing top-level command: ${topLevel}`);
     }
   }
-  for (const subcommand of ['model', 'snapshot', 'diff', 'impact', 'verify', 'context', 'explain']) {
+  for (const subcommand of [
+    'model',
+    'snapshot',
+    'diff',
+    'impact',
+    'verify',
+    'context',
+    'explain',
+  ]) {
     if (!commands.workspace?.intelligenceSubcommands?.includes(subcommand)) {
       fail(`workspace intelligence surface is missing subcommand: ${subcommand}`);
     }
@@ -331,13 +346,23 @@ function smokeCreateNpmBackedKits() {
       kit: 'springboot.standard',
       name: 'enterprise-spring',
       extraArgs: ['--java-version', '21'],
-      expectedFiles: ['pom.xml', 'src/main/resources/application.yml', '.workspai/project.json', 'rapidkit'],
+      expectedFiles: [
+        'pom.xml',
+        'src/main/resources/application.yml',
+        '.workspai/project.json',
+        'rapidkit',
+      ],
     },
     {
       kit: 'dotnet.webapi.clean',
       name: 'enterprise-dotnet',
       extraArgs: ['--target-framework', 'net8.0'],
-      expectedFiles: ['src/Program.cs', 'src/enterprise-dotnet.csproj', '.workspai/project.json', 'rapidkit'],
+      expectedFiles: [
+        'src/Program.cs',
+        'src/enterprise-dotnet.csproj',
+        '.workspai/project.json',
+        'rapidkit',
+      ],
     },
   ];
 
@@ -449,6 +474,13 @@ for (const relativePath of [
   'package.json',
   'dist/index.js',
   'contracts/runtime-command-surface.v1.json',
+  'contracts/workspace-archive-capabilities.v1.json',
+  'contracts/workspace-archive-manifest.v1.json',
+  'contracts/workspace-archive-operation-result.v1.json',
+  'contracts/create-planner-capabilities.v1.json',
+  'contracts/project-entry-capability.v1.json',
+  'contracts/workspace-intelligence-architecture.v1.json',
+  'contracts/workspace-intelligence-chain.v1.json',
   'contracts/extension-cli-compatibility.v1.json',
   'data/modules-embeddings.json',
 ]) {

package/scripts/prepack-enterprise.mjs

@@ -36,6 +36,14 @@ if (!fs.existsSync(tsupCli)) {
 runNode([tsupCli], 'building dist');
 runNode(['scripts/prepare-mock-embeddings.mjs'], 'preparing packaged embeddings');
 runNode(['scripts/verify-package-cli.mjs'], 'verifying bundled CLI command ownership');
+runNode(
+  ['scripts/check-workspace-intelligence-runtime-conformance.mjs'],
+  'validating Workspace Intelligence runtime artifacts against canonical schemas'
+);
+runNode(
+  ['scripts/check-workspace-intelligence-adversarial.mjs'],
+  'running Workspace Intelligence adversarial scenarios'
+);
 runNode(['scripts/enterprise-package-smoke.mjs'], 'running enterprise package smoke', {
   RAPIDKIT_ENTERPRISE_PREPACK: '1',
 });

package/dist/analyze-5BU4QIPK.js

@@ -1 +0,0 @@
-export{b as printAnalyzeReport,a as runAnalyze}from'./chunk-OL64GWQC.js';

package/dist/autopilot-release-45YVOBQO.js

@@ -1 +0,0 @@
-export{b as AUTOPILOT_RELEASE_ALIAS_FILENAME,a as AUTOPILOT_RELEASE_LAST_RUN_FILENAME,c as runAutopilotRelease}from'./chunk-LTWYYP6E.js';