workspai 0.56.0 → 0.57.0

package/docs/doctor-command.md

@@ -39,6 +39,10 @@ Checks:
 
 > Compatibility note: `npx workspai doctor --workspace` still works, but `doctor workspace` is the canonical form.
 
+Both workspace forms use the canonical project-to-workspace resolver. After a
+project is adopted, imported, or relinked, they can be launched from that
+project directory and resolve its validated machine-local workspace binding.
+
 ### 3) Project Check (Canonical)
 
 ```bash
@@ -111,6 +115,9 @@ npx workspai doctor
 # Full check inside a workspace
 npx workspai doctor workspace
 
+# Expand every probe and lifecycle capability (default output is summary-first)
+npx workspai doctor workspace --verbose
+
 # Focus only on current project
 npx workspai doctor project
 
@@ -120,6 +127,9 @@ npx workspai doctor workspace --json
 # Compact agent/CI projection; full evidence is still written
 npx workspai doctor workspace --fresh --json=summary
 
+# Review the governed plan before mutation
+npx workspai doctor workspace --plan
+
 # Attempt safe fixes (interactive)
 npx workspai doctor workspace --fix
 
@@ -145,7 +155,7 @@ CI, and agents: it distinguishes blocking causes, advisory findings, unknowns, d
 subjects, vulnerability findings, not-applicable checks, and the next safe action. The complete
 probe and diagnosis evidence remains in `doctor-last-run.json` or `doctor-project-last-run.json`.
 
-## One verdict, backed by every probe
+## One verdict, multi-axis accounting
 
 Doctor calculates one verdict from the host and every project probe:
 
@@ -153,12 +163,26 @@ Doctor calculates one verdict from the host and every project probe:
 - **Needs attention** means the current profile found advisory work.
 - **Blocked** means at least one error-level probe failed.
 
-The score and verdict use the same counts. A failed security, coverage, or
-runtime probe cannot be hidden behind a high percentage or a healthy host. New
-evidence includes the host/project score components and per-project probe
-summary; semantic validation rejects contradictory artifacts before they are
-written. Older v1 evidence remains readable so existing workspaces and IDEs do
-not break during migration.
+The verdict is authoritative. Human output presents blocking, advisory,
+unknown, contradictory, and not-applicable counts separately; it never calls a
+single percentage “health.” The additive `healthScore.presentation` contract
+labels its percentage as a diagnostic pass rate for accounting only. A failed
+security, coverage, or runtime probe therefore cannot be hidden behind a high
+percentage or a healthy host. Existing score fields remain readable for older
+IDEs, while updated consumers prefer the multi-axis projection.
+
+Doctor also publishes `projectArchetype` independently from `projectKind`.
+`projectKind` describes the technical surface (backend, frontend, extension,
+and so on); the archetype describes the product role (service, application,
+library, SDK, platform, plugin, or monorepo). Service-only checks such as a
+runtime health endpoint, database migrations, or an executable boot entrypoint
+are retained as explicit `not-applicable` evidence for non-deployable
+archetypes instead of becoming false warnings.
+
+The default terminal view is summary-first and uses portable boundaries such
+as `$WORKSPACE`, `$PROJECT`, and `external/<project>`. `--verbose` expands all
+probes and lifecycle capabilities. JSON continues to retain canonical absolute
+paths because local machine consumers need them for governed operations.
 
 ## Universal diagnosis core
 
@@ -192,10 +216,10 @@ The same diagnosis contract is used for Node, Python, Go, JVM, Rust, .NET, PHP,
 Clojure, Deno, Bun, Scala, Kotlin, C, C++, and unknown/custom projects. Runtime adapters gather
 different evidence; the diagnosis, causality, safety, and verification vocabulary stays the same.
 Composite projects publish every detected family under `project.runtimeFamilies`; Doctor keeps a
-primary runtime for compatibility and explicitly warns when secondary runtimes need their own
-project boundary or custom adapter instead of silently claiming full coverage. Every unevaluated
-secondary runtime is also published as a diagnosis unknown and proportionally lowers diagnosis
-completeness; a primary-only polyglot scan can never report 100%.
+primary runtime for compatibility. A detected cross-language platform is evaluated through primary
+and portable evidence, and asks for explicit custom adapters only for runtime-specific checks the
+portable contract cannot represent. Every unevaluated secondary runtime remains a diagnosis unknown
+and proportionally lowers completeness; a primary-only polyglot scan can never report 100%.
 
 Workspace project boundaries come from the canonical workspace contract/registry when available.
 A nested solution, test project, or manifest inside a registered project is treated as evidence for

package/docs/from-code-to-shared-understanding.md

@@ -5,26 +5,28 @@ you to replace your frameworks or move existing source code.
 
 ```mermaid
 flowchart TB
-    Code["Your projects and repositories"]
+    Sources["Projects · APIs · packages<br/>infrastructure · docs · CI"]
 
-    Routes["Create a project<br/>Adopt it in place<br/>or Import a repository"]
+    Connect["Create · Adopt in place · Import"]
 
-    Workspace["Workspai builds one model of<br/>projects, dependencies, rules, and commands"]
+    Model["Canonical Workspace Model<br/>identity · inventory · boundaries"]
 
-    Change["What changed?<br/>What is affected?<br/>Is the evidence ready?"]
+    Graph["Derived Knowledge Graph<br/>relationships · facts · canonical proof"]
 
-    Outputs["Context, impact, verification,<br/>explanations, and release evidence"]
+    Decide["Diff · Impact · Evidence gates<br/>Readiness · Verify"]
 
-    Code --> Routes
-    Routes --> Workspace
-    Workspace --> Change
-    Change --> Outputs
+    Ground["Reports · bounded context<br/>Agent sync · Explain"]
 
-    Outputs --> Developers["Developers"]
-    Outputs --> CI["CI and releases"]
-    Outputs --> IDEs["IDEs"]
-    Outputs --> Agents["AI agents"]
-    Outputs --> MCP["MCP clients"]
+    Sources --> Connect
+    Connect --> Model
+    Model -->|derives, revision-bound| Graph
+    Model --> Decide
+    Graph --> Decide
+    Decide --> Ground
+
+    Ground --> Humans["Developers"]
+    Ground --> Automation["CI · releases"]
+    Ground --> Tools["IDEs · MCP · AI agents"]
 ```
 
 ## What This Means
@@ -40,8 +42,8 @@ flowchart TB
    the evidence needed for a safe decision.
 4. **Share the result.** Developers, CI, IDEs, AI agents, and MCP clients consume
    the same workspace truth instead of building separate assumptions. The
-   current CLI exposes a read-mostly `workspace mcp serve` bridge; a dedicated
-   `packages/mcp` boundary is planned.
+   current CLI exposes the governed evidence through its reports, agent context,
+   graph queries, and read-mostly `workspace mcp serve` bridge.
 
 This is the user-facing view. The implementation uses a versioned chain of
 model, change, evidence, verification, context, grounding, and explanation
@@ -57,7 +59,10 @@ baseline lifecycle, exit codes, and failure propagation are specified in
 [Unified Workspace Intelligence Runner](./workspace-intelligence-runner.md).
 
 The npm README uses a PNG rendering because npm package pages do not reliably
-render Mermaid. When this source changes, regenerate
+render Mermaid. npm also does not provide a dependable embedded-video player
+for package READMEs. Keep the full MP4 outside the published package. For inline
+motion, use a bounded, silent GIF hosted as a public asset; retain a linked MP4
+for full-resolution playback and audio. When this source changes, regenerate
 `From Code to Shared Understanding.png` before publishing.
 
 ## Execute the Contract

package/docs/real-world-qualification.md

@@ -0,0 +1,73 @@
+# Real-world qualification
+
+Workspai's deterministic unit, contract, integration, and adversarial suites
+remain the release gates. Real-world qualification complements them by running
+the installed CLI against explicitly selected, linked reference repositories
+without installing dependencies or executing project lifecycle commands.
+
+## Isolated and cumulative layouts
+
+Use one isolated workspace per repository when diagnosing detection, adoption,
+Doctor, model, graph, context, contract, and readiness behavior:
+
+```bash
+REFERENCE_ROOT=/path/to/reference-repositories
+QUALIFICATION_ROOT=/path/to/qualification-output
+npm run test:real-world -- \
+  --reference-root "$REFERENCE_ROOT" \
+  --run-root "$QUALIFICATION_ROOT" \
+  --projects vscode,grpc,deno \
+  --report "$QUALIFICATION_ROOT/isolated.json"
+```
+
+Use `--shared-workspace` to adopt the repositories cumulatively into one fresh
+workspace. Every addition reruns the canonical chain, so transition and scale
+failures are observable rather than hidden behind the final state:
+
+```bash
+REFERENCE_ROOT=/path/to/reference-repositories
+QUALIFICATION_ROOT=/path/to/qualification-output
+npm run test:real-world -- \
+  --reference-root "$REFERENCE_ROOT" \
+  --run-root "$QUALIFICATION_ROOT" \
+  --shared-workspace enterprise-polyglot \
+  --projects vscode,grpc,deno,copilot-sdk \
+  --report "$QUALIFICATION_ROOT/shared.json"
+```
+
+After the shared workspace qualifies, exercise bounded queries, full graph
+exports, diff/impact/verify/trace, agent dry runs, portable archives, snapshots,
+and destructive-operation dry runs:
+
+```bash
+QUALIFICATION_ROOT=/path/to/qualification-output
+npm run test:real-world:enterprise -- \
+  --workspace "$QUALIFICATION_ROOT/enterprise-polyglot" \
+  --report "$QUALIFICATION_ROOT/enterprise-command-surface.json"
+```
+
+## Safety and interpretation
+
+- Reference repositories are linked; source is never moved or copied.
+- `--reference-root` is mandatory. The harness has no developer-machine default.
+- Qualification reports are publication-safe by construction: project names are
+  anonymized, absolute paths and command arguments are omitted, and raw command
+  output is never retained. Report writing fails closed if a local path or a
+  forbidden raw-output field reaches the payload.
+- Enterprise command artifacts (graphs, archives, exports, and snapshots) are
+  operational test material and remain local-only. Publish only the sanitized
+  qualification JSON report, never its adjacent artifact directory.
+- Dependency installation, project build/test/start/init, infrastructure
+  mutation, publication, and model network calls are not permitted.
+- Agent customization and destructive project operations are dry-run only.
+- Exit codes `1` and `2` may be valid domain outcomes when their documented JSON
+  contracts parse successfully; unexpected process, timeout, buffer, or schema
+  failures fail qualification.
+- A real repository warning remains evidence, not a CLI defect. Fix the CLI only
+  when detection, classification, contract, portability, or command semantics
+  are wrong.
+- Full graphs belong in `--output` artifacts. Agents and IDEs consume bounded
+  `search`, `entities`, `evidence`, and `path` results.
+
+These suites are explicit and opt-in because they require local reference
+repositories. They do not replace cross-platform CI fixtures or release gates.

package/docs/workspace-knowledge-graph.md

@@ -102,6 +102,20 @@ they are in the current graph. Exact labels and identities still win. This keeps
 a common word such as `check` from outranking a rarer term such as `user` merely
 because it appears in more files. No embedding service or model call is involved.
 
+For multi-term questions, a generic kind intent such as `service` or `api`
+cannot qualify an otherwise unrelated entity by itself. The result must cover
+the query's meaningful terms, except for deliberate broad architecture queries
+whose purpose is to return a diversified set of languages, bindings,
+dependencies, ownership, CI, deployment, documentation, and contracts.
+
+Source-structure extraction is also deliberately sampled. Local import
+resolution uses the larger bounded fingerprint inventory, so a sampled source
+file can still link to a valid target outside the extraction window. A target
+outside the sample receives a lightweight proof-backed file entity; its full
+symbols are not implied to have been extracted. The graph diagnostic reports
+the sampled and indexed candidate counts and must not be read as exhaustive
+symbol coverage.
+
 ### Fast reads without stale answers
 
 The read-oriented `search`, `entities`, `evidence`, `path`, and `benchmark`
@@ -142,11 +156,18 @@ files beyond that declared limit.
 | Why does Workspai believe an item exists?            | `workspace graph evidence <entity-or-relation> --json`  |
 | How are two things connected?                        | `workspace graph path <from> <to> --json`               |
 | What changed between graph revisions?                | `workspace graph overlay --from <graph.json> --json`    |
-| What is the full portable graph?                     | `workspace graph emit --json`                           |
-| How do I render the project topology?                | `workspace graph dot\|mermaid [--output <file>]`       |
+| What is the full portable graph?                     | `workspace graph emit --output graph.json --json`       |
+| How do I render the project topology?                | `workspace graph dot\|mermaid [--output <file>]`        |
 | How do I export to semantic or graph-analysis tools? | `workspace graph jsonld\|graphml\|gexf --output <file>` |
 | How much retrieval payload did one query avoid?      | `workspace graph benchmark <query> --limit <n> --json`  |
-| How should an MCP-compatible agent retrieve context? | `workspace mcp serve` → `searchWorkspaceGraph`          |
+
+`graph emit --json` writes the complete dependency and Knowledge Graph to
+stdout and can be very large. Automation, IDEs, and agents should pass
+`--output`; stdout then contains only a bounded
+`workspai-cli-operation-result-v1` receipt. Use `search`, `entities`,
+`evidence`, or `path` for bounded retrieval rather than loading the full
+export.
+| How should an MCP-compatible agent retrieve context? | `workspace mcp serve` → `searchWorkspaceGraph` |
 
 ## What it models
 

package/docs/workspace-operations.md

@@ -55,8 +55,12 @@ npx workspai workspace import team.workspai-archive.zip --output ./team --json
 - Registry and contract sync include adopted projects for `workspace model`, `workspace context`, Dashboard, and agents.
 - Managed grounding writes a portable project lens, project grounding, and a
   bounded managed section in `AGENTS.md`. User-authored `AGENTS.md` content is
-  preserved.
-- `--dry-run --json` previews detection without writing metadata.
+  preserved, and an authored tracked deletion of that file is never resurrected.
+- `--dry-run --json` previews detection without writing metadata. Its versioned
+  `adoptedProject.effects` record also declares project metadata files,
+  conditional `.gitignore`/`AGENTS.md` reconciliation, and the registration,
+  contract, model, graph, and agent-grounding operations that a real run would
+  perform.
 
 ### Existing workspace behavior
 
@@ -103,6 +107,7 @@ entry point into its canonical workspace:
 ```bash
 cd /absolute/path/to/project
 npx workspai project workspace status --json
+npx workspai doctor workspace --json=summary
 npx workspai doctor project --json
 npx workspai workspace graph search "authentication endpoint" --limit 12 --json
 npx workspai workspace intelligence run --for-agent generic --strict --json
@@ -208,6 +213,7 @@ npx workspai workspace contract init
 npx workspai workspace contract inspect
 npx workspai workspace contract verify --strict
 npx workspai workspace contract graph
+npx workspai workspace contract graph --output ./contract-graph.json --json
 ```
 
 Contract file: `.workspai/workspace.contract.json`. Verification checks schema, duplicate slugs, port collisions, and unknown dependencies.
@@ -222,6 +228,12 @@ public environment-template keys, command capabilities, key manifests,
 entrypoints, API specifications, infrastructure, documentation, and an
 operational verification profile. Environment values are never emitted.
 
+The full contract graph can be large because it includes the Knowledge Graph.
+For automation, IDEs, and agents, pass `--output`; the complete portable graph
+is written to that file and stdout remains a bounded
+`workspai-cli-operation-result-v1` receipt. Without `--output`, the existing
+full JSON response remains backward compatible.
+
 The same response also exposes `knowledgeGraph` under the public
 `workspace-knowledge-graph.v1` contract. It is a provider-neutral,
 proof-carrying view spanning source structure, packages, service and API

package/docs/workspace-run.md

@@ -35,6 +35,13 @@ family. Vendored trees, build outputs, fixtures, and nested test fixture package
 manifests are excluded from lifecycle discovery so orchestration does not turn
 sample inputs into install targets.
 
+Planning and `init` do not require Doctor or release-readiness evidence. Real
+`test`, `build`, and `start` runs enforce the `doctor-workspace` and `readiness`
+gates by default. A failed gate prevents project commands from starting and is
+recorded as `gates.blocked` in the result. `--strict` converts a failing or
+warning gate into a non-zero process exit; without it, the structured gate
+result remains available without turning advisory policy into a process error.
+
 The authoritative scaffold/import/lifecycle tiers are in
 [contracts/RUNTIME_SUPPORT_MATRIX.md](./contracts/RUNTIME_SUPPORT_MATRIX.md).
 Inspect one project's effective surface with
@@ -98,15 +105,20 @@ both command context and the final root cause without copying the full log.
 Consumers should render these fields rather than reconstructing a diagnosis
 from arbitrary stdout lines.
 
+The canonical report is `.workspai/reports/workspace-run-last.json`. Workspace
+verification binds a finding to its exact producer through `sourceCommand` and
+`sourceArtifact`; consumers should run the cited producer and read that artifact
+instead of guessing which command can refresh the evidence.
+
 ## Command semantics
 
 Workspai has two workspace-level execution surfaces and three equivalent full-init aliases at workspace root:
 
-| Command | Intent | Scope |
-| --- | --- | --- |
+| Command                                                            | Intent                                             | Scope             |
+| ------------------------------------------------------------------ | -------------------------------------------------- | ----------------- |
 | `init`, `workspace init`, `workspace run init` (at workspace root) | Mirrored full-init (workspace deps + project init) | Workspace + fleet |
-| `workspace run <test\|build\|start>` | Fleet stage execution | Selected projects |
-| `init`, `test`, `build`, `start`, `dev` (inside project dir) | Project primitive | Single project |
+| `workspace run <test\|build\|start>`                               | Fleet stage execution                              | Selected projects |
+| `init`, `test`, `build`, `start`, `dev` (inside project dir)       | Project primitive                                  | Single project    |
 
 At workspace root, `npx workspai init`, `npx workspai workspace init`, and `npx workspai workspace run init` are equivalent aliases.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workspai",
-  "version": "0.56.0",
+  "version": "0.57.0",
   "type": "module",
   "description": "Open-source workspace intelligence CLI for software systems: create, adopt, govern, verify, and align polyglot workspaces for humans, CI, IDEs, and AI agents.",
   "keywords": [
@@ -53,6 +53,8 @@
     "dist",
     "contracts",
     "docs",
+    "!docs/*.mp4",
+    "!docs/*.gif",
     "templates",
     "workspai.config.example.cjs",
     "rapidkit.config.example.cjs",
@@ -115,6 +117,8 @@
     "test:runtime-matrix": "node scripts/runtime-acceptance-matrix.mjs",
     "test:runtime-contract": "node scripts/runtime-acceptance-matrix.mjs --contract-only",
     "test:runtime-matrix:full": "node scripts/runtime-acceptance-matrix.mjs --full",
+    "test:real-world": "node scripts/real-world-qualification.mjs",
+    "test:real-world:enterprise": "node scripts/enterprise-workspace-qualification.mjs",
     "lint": "eslint src --ext .ts",
     "lint:fix": "eslint src --ext .ts --fix",
     "format": "prettier --write \"src/**/*.ts\"",

package/dist/autopilot-release-CH57CGET.js

@@ -1 +0,0 @@
-export{b as AUTOPILOT_RELEASE_ALIAS_FILENAME,a as AUTOPILOT_RELEASE_LAST_RUN_FILENAME,c as runAutopilotRelease}from'./chunk-6HCAGHCY.js';

package/dist/capabilities-command-WEOGFCWF.js

@@ -1 +0,0 @@
-export{b as runDoctorCapabilities}from'./chunk-KS4FB5W7.js';

package/dist/chunk-664GXRLD.js

@@ -1 +0,0 @@
-import {b,c as c$2}from'./chunk-OX53L237.js';import {a as a$1}from'./chunk-YM77FQB3.js';import {r as r$1}from'./chunk-QRWWYL52.js';import {a as a$2}from'./chunk-7PNARN6S.js';import {g}from'./chunk-SV2SP22H.js';import {j as j$1,e as e$2}from'./chunk-GBMCHFOV.js';import {j,l as l$2}from'./chunk-QAF26ZQX.js';import {c as c$1,d}from'./chunk-WOTTSPSF.js';import {a}from'./chunk-UQEQ6CXU.js';import {f as f$1,g as g$1,h as h$2}from'./chunk-XH7PDHBF.js';import {k,l as l$1,h as h$1,m as m$1,n,p as p$2,q}from'./chunk-5BGPGNRQ.js';import {m,p as p$1,s}from'./chunk-5ZA4JYOP.js';import {l,o as o$1,p as p$3}from'./chunk-DOIZANFA.js';import {c,e as e$1}from'./chunk-ADL3CK44.js';import {b as b$1}from'./chunk-LYVDRRDO.js';import {e,f,o,p,n as n$1,m as m$2}from'./chunk-5EPPPMAS.js';import {d as d$1}from'./chunk-VRW6KXNK.js';import ue from'path';import de from'fs-extra';function r(t,s){if(!t)throw new Error(`Workspace Intelligence run semantic violation: ${s}`)}function ce(t,s){return t.length===s.length&&t.every((g,u)=>g===s[u])}function le(t){b$1(e.intelligenceRun,t,"Workspace Intelligence run report"),r(t.chainSchemaVersion===a,`chainSchemaVersion must be ${a}`),r(t.artifactPath===e.intelligenceRun,`artifactPath must be ${e.intelligenceRun}`),r(t.preflight.length===n$1.length,`preflight must contain exactly ${n$1.length} entries`);for(let[c,i]of n$1.entries()){let a=t.preflight[c];r(a?.id===i,`preflight[${c}].id must be ${i}`),r(ce(a.artifacts,o[i]),`${i} preflight artifacts must match the runtime registry`),i==="sync"?r(a.status==="passed"&&a.result==="synchronized"||a.status==="failed"&&a.result==="failed","sync preflight status and result are incoherent"):r(a.status==="passed"&&(a.result==="created"||a.result==="reused")||a.status==="failed"&&a.result==="failed"||a.status==="skipped"&&a.result==="skipped","baseline preflight status and result are incoherent");}let s=t.preflight[1];r(t.baselineCreated===(s?.result==="created"),"baselineCreated must match the baseline preflight result"),r(t.stages.length===m$2.length,`stages must contain exactly ${m$2.length} canonical steps`);let g=t.preflight[0],u=g?.status==="failed";for(let[c,i]of m$2.entries()){let a=t.stages[c];r(a?.id===i,`stages[${c}].id must be ${i}`),r(ce(a.artifacts,p[i].produces),`${i} artifacts must match the runtime registry`),u&&r(a.status==="skipped",`${i} must be skipped after a hard failure`),a.status==="passed"?r(a.exitCode===0,`${i} passed stage must have exitCode 0`):a.status==="blocked"?r(a.exitCode!==0,`${i} blocked stage must have a non-zero exitCode`):a.status==="failed"?(r(a.exitCode===1,`${i} failed stage must have exitCode 1`),u=true):(r(a.exitCode===0,`${i} skipped stage must have exitCode 0`),r(a.durationMs===0,`${i} skipped stage must have durationMs 0`)),c===0&&((g?.status==="failed"||a.status==="failed")&&r(s?.status==="skipped","baseline must be skipped when sync or model fails"),s?.status==="skipped"&&r(g?.status==="failed"||a.status==="failed"||a.status==="skipped","baseline may be skipped only after an upstream failure"),s?.status!=="passed"&&(u=true));}let m=t.preflight.some(c=>c.status==="failed")||t.stages.some(c=>c.status==="failed"),y=t.stages.some(c=>c.status==="blocked"),o$1=m?"failed":y?"blocked":"passed",f=o$1==="failed"?1:o$1==="blocked"?2:0;r(t.status===o$1,`status must be ${o$1}`),r(t.exitCode===f,`exitCode must be ${f}`);}var he=e.intelligenceRun,Ie=f.intelligenceRun,x=he;function h(t){d$1({action:"intelligence",status:t.status==="started"?"started":t.status==="passed"?"succeeded":t.status==="failed"?"failed":"warn",message:t.message,metadata:{phase:`workspace.intelligence.${t.kind}.${t.id}`,intelligenceMilestoneId:t.id,intelligenceMilestoneKind:t.kind,intelligenceMilestoneStatus:t.status}});}async function ze(t){let s=ue.resolve(t.workspacePath);return c(s,x,()=>Ee({...t,workspacePath:s}),{timeoutMs:15*6e4,staleAfterMs:3e4})}async function Ee(t){let s$1=t.workspacePath,g$2=[],u=[],m$2=false,y=async(e,n)=>{let d=[...o[e]];if(m$2){h({id:e,kind:"preflight",status:"skipped",message:`${e} prerequisite skipped after an upstream failure`}),g$2.push({id:e,status:"skipped",result:"skipped",durationMs:0,artifacts:d,message:"skipped because a required upstream operation failed"});return}let I=Date.now();h({id:e,kind:"preflight",status:"started",message:`${e} prerequisite started`});try{let l=await n();h({id:e,kind:"preflight",status:"passed",message:l.message}),g$2.push({id:e,status:"passed",result:l.result,durationMs:Date.now()-I,artifacts:d,message:l.message});}catch(l){m$2=true;let k=l instanceof Error?l.message:String(l);h({id:e,kind:"preflight",status:"failed",message:k}),g$2.push({id:e,status:"failed",result:"failed",durationMs:Date.now()-I,artifacts:d,message:k});}},o$2=async(e,n)=>{let d=[...p[e].produces];if(m$2){h({id:e,kind:"stage",status:"skipped",message:`${e} skipped after an upstream failure`}),u.push({id:e,status:"skipped",durationMs:0,artifacts:d,exitCode:0,message:"skipped because a required upstream stage failed"});return}let I=Date.now();h({id:e,kind:"stage",status:"started",message:`${e} started`});try{let l=await n(),k=l.exitCode??0,_=l.blocked||k!==0?"blocked":"passed";h({id:e,kind:"stage",status:_,message:l.message}),u.push({id:e,status:_,durationMs:Date.now()-I,artifacts:d,exitCode:k,message:l.message});}catch(l){m$2=true;let k=l instanceof Error?l.message:String(l);h({id:e,kind:"stage",status:"failed",message:k}),u.push({id:e,status:"failed",durationMs:Date.now()-I,artifacts:d,exitCode:1,message:k});}};await y("sync",async()=>{let e=await g(s$1,true),n=await l({workspacePath:s$1});return {result:"synchronized",message:`registry ${e.added.length} added/${e.skipped} existing; contract ${n.contract.projects.length} projects`}});let f,c=()=>{if(!f)throw new Error("canonical workspace model is unavailable");return f};await o$2("model",async()=>(f={...await p$1({workspacePath:s$1,includeEvidence:true}),build:m({mode:"full",engineStatus:"disabled"})},await s(f,s$1),{message:`${f.summary.projectCount} projects modeled`}));let i=ue.join(s$1,e.snapshot),a$3=false;await y("baseline",async()=>{if(!await de.pathExists(i)){let d=await k({workspacePath:s$1,model:c()});return await l$1(d,s$1),a$3=true,{result:"created",message:"initial structural baseline created"}}let e=await de.readJson(i),n=h$1(e);return n?(await l$1(n,s$1),{result:"reused",message:"legacy structural baseline migrated and reused"}):{result:"reused",message:"existing structural baseline reused"}}),await o$2("diff",async()=>{let e$1=await m$1({workspacePath:s$1,fromPath:e.snapshot,model:c()});return await n(e$1,s$1),{message:e$1.summary.changed?"workspace changes detected":"no workspace changes"}}),await o$2("impact",async()=>{let e$1=await p$2({workspacePath:s$1,fromPath:e.diff});return await q(e$1,s$1),{message:`${e$1.summary.risk} risk; ${e$1.summary.affectedProjects} affected`}}),await o$2("doctor-evidence",async()=>{let e=await r$1({workspace:s$1,json:true,quiet:true,profile:t.strict===true?"enterprise-strict":"local"});return {exitCode:e,blocked:e!==0,message:`doctor exit ${e}`}}),await o$2("contract-evidence",async()=>{let e=await o$1({workspacePath:s$1,strict:true});return await p$3({workspacePath:s$1,result:e}),{exitCode:e.status==="passed"?0:1,blocked:e.status!=="passed",message:`contract ${e.status}`}}),await o$2("analyze-evidence",async()=>{let e=await a$1({workspacePath:s$1,json:true,strict:t.strict===true});return {blocked:e.summary.verdict==="blocked"||t.strict===true&&e.summary.verdict==="needs-attention",exitCode:e.summary.verdict==="blocked"||t.strict===true&&e.summary.verdict==="needs-attention"?1:0,message:`analyze ${e.summary.verdict} (${e.summary.score}/100)`}}),await o$2("readiness-evidence",async()=>{let e=await a$2({startPath:s$1,writeReport:true,skipVerify:true});return {blocked:e.overallStatus==="fail"||t.strict===true&&e.overallStatus==="warn",exitCode:e.overallStatus==="fail"||t.strict===true&&e.overallStatus==="warn"?1:0,message:`pre-verify readiness ${e.overallStatus}`}}),await o$2("verify",async()=>{let e$1=await f$1({workspacePath:s$1,fromImpactPath:e.impact});await g$1(e$1,s$1);let n=h$2(e$1,{strict:t.strict===true});return await j$1(s$1,e$2(e$1,n.passed)),{blocked:!n.passed,exitCode:n.exitCode,message:`${e$1.summary.verdict}; gate ${n.passed?"passed":"blocked"}`}}),await o$2("context",async()=>{let e=await c$1({workspacePath:s$1,model:c(),agent:t.agent??"generic",includeEvidence:true});return await d(e,s$1),{message:`context grounded for ${e.agent}`}}),await o$2("agent-sync",async()=>{let e=await l$2({workspacePath:s$1,agent:t.agent??"generic",write:true,refreshContext:false,strict:t.strict===true,preset:"enterprise"}),n=e.strictViolations??[],d=t.strict===true&&n.length>0;return {blocked:d,exitCode:d?2:0,message:d?`${e.writtenFiles.length} grounding files written; ${n.length} strict grounding violation(s): ${n.join("; ")}`:`${e.writtenFiles.length} grounding files written`}}),await o$2("explain",async()=>{let e=await b({workspacePath:s$1,target:{kind:"release-blocked"}});return await c$2(e,s$1),{message:e.summary}});let pe=u.some(e=>e.status==="blocked"),A=m$2?"failed":pe?"blocked":"passed",ge=m$2?1:A==="blocked"?2:0,R={schemaVersion:Ie,chainSchemaVersion:a,generatedAt:new Date().toISOString(),workspacePath:s$1,baselineCreated:a$3,preflight:g$2,status:A,exitCode:ge,stages:u,artifactPath:x};le(R),await e$1(s$1,x,R);let me=await j({workspacePath:s$1});return await e$1(s$1,e.agentIndex,me),R}export{he as a,Ie as b,ze as c};