workspai 0.65.0 → 0.67.0

package/docs/workspace-knowledge-graph.md

@@ -56,6 +56,9 @@ Useful follow-up questions:
 # What APIs and endpoints exist?
 npx workspai workspace graph entities endpoint --json
 
+# Which languages are evidenced in one project? The flag form is equivalent.
+npx workspai workspace graph entities --kind language --scope project:billing --limit 100 --json
+
 # Why does Workspai believe this entity exists?
 npx workspai workspace graph evidence "GET /users" --json
 
@@ -116,6 +119,13 @@ symbols are not implied to have been extracted. The graph diagnostic reports
 the sampled and indexed candidate counts and must not be read as exhaustive
 symbol coverage.
 
+Language inventory is intentionally broader than source-structure parsing.
+The complete eligible-path inventory recognizes systems languages and compiler
+DSLs such as Assembly, CUDA, Fortran, HLSL, LLVM IR/MIR, MLIR, Objective-C,
+OpenCL, and TableGen even when Workspai has no safe generic symbol parser for
+that syntax. Language counts therefore remain project-wide inventory facts;
+symbols, imports, and calls remain bounded to parser-supported source inputs.
+
 Call binding follows the same proof boundary. Workspai binds a call only when
 its target is uniquely defined in the same file or in a locally imported file
 that the Graph already resolved. Overloads, dynamic dispatch, and ambiguous
@@ -140,13 +150,14 @@ only when all of the following remain true:
 - no proof is marked stale;
 - the graph fingerprint contains exactly one workspace scope and every
   canonical project scope with compatible scan limits;
-- a fresh bounded scan produces the same aggregate live-input hash.
+- a fresh complete eligible-path inventory produces the same aggregate
+  live-input hash.
 
 Git-backed scopes use `git-worktree-v2`, covering tracked tree state plus
-modified, deleted, renamed, untracked, and relevant ignored files. If Git cannot
+modified, deleted, renamed, and non-ignored untracked files. If Git cannot
 prove the scanned inventory safely—for example because a traversed initialized
 submodule or hidden index flag is present—Workspai falls back to
-`content-merkle-v1`, which hashes each bounded file by portable path and content.
+`content-merkle-v1`, which hashes each eligible file by portable path and content.
 The graph records the combined strategy as `hybrid-git-content-v2`.
 
 A miss rebuilds from live sources. Use `--refresh-graph` when the caller requires
@@ -156,9 +167,38 @@ an explicit rebuild even if the persisted snapshot is compatible:
 npx workspai workspace graph search "protobuf ownership" --refresh-graph --json
 ```
 
-The fingerprint proves compatibility of the exact bounded provider inventory;
-if a scope reports `truncated: true`, it must not be interpreted as proof about
-files beyond that declared limit.
+The fingerprint normally covers every eligible Git-tracked and non-ignored
+untracked file in each project scope. The default `500000`-file limit is an
+emergency safety boundary, not a semantic completeness target. A scope with
+`truncated: true` or `inventoryMode: emergency-bounded` must not be interpreted
+as proof about files beyond that boundary. Git inventories publish an exact
+`eligibleFileCount`; a non-Git fallback that reaches the boundary publishes
+`eligibleFileCountExact: false` instead of inventing a total.
+
+Path inventory and content-heavy extraction have separate budgets. Complete
+inventory feeds freshness, manifest discovery, language counts, architecture
+contracts, CI, ownership, infrastructure, and targeted providers. Semantic and
+deep providers receive deterministic adaptive selections distributed across
+component and language buckets. This prevents a large package, vendored tree,
+or alphabetically early directory from starving the rest of a polyglot
+monorepo. Every provider publishes `inputCoverage`; successful execution over a
+bounded selection is reported as `partial`, never as exhaustive coverage.
+
+Defaults scale with the eligible project population up to these safety
+ceilings:
+
+- complete inventory emergency bound: `500000` files per project;
+- adaptive semantic input: up to `100000` files per project;
+- adaptive deep-provider input: up to `25000` files per project;
+- source extraction: up to `20000` files per project.
+
+Use `--graph-inventory-limit`, `--graph-semantic-budget`,
+`--graph-deep-budget`, and `--graph-source-budget` on `workspace graph`, or the
+equivalent `WORKSPAI_GRAPH_INVENTORY_LIMIT`,
+`WORKSPAI_GRAPH_SEMANTIC_BUDGET`, `WORKSPAI_GRAPH_DEEP_BUDGET`, and
+`WORKSPAI_GRAPH_SOURCE_BUDGET` environment variables for non-interactive model,
+Adopt, and Intelligence runs. Increasing deep budgets affects cost, not the
+canonical per-project storage boundary.
 
 Workspai-generated agent entry projections are downstream consumers and are
 excluded from Graph inventory and Git diff hashing. Regenerating `AGENTS.md`,
@@ -167,17 +207,17 @@ Graph that produced them or become circular architecture evidence.
 
 ## Pick the command by question
 
-| You want to know…                                    | Use                                                     |
-| ---------------------------------------------------- | ------------------------------------------------------- |
-| What is relevant to a natural-language question?     | `workspace graph search <query> --limit <n> --json`     |
-| Which entities of one type exist?                    | `workspace graph entities <kind> --json`                |
-| Why does Workspai believe an item exists?            | `workspace graph evidence <entity-or-relation> --json`  |
-| How are two things connected?                        | `workspace graph path <from> <to> --json`               |
-| What changed between graph revisions?                | `workspace graph overlay --from <graph.json> --json`    |
-| What is the full portable graph?                     | `workspace graph emit --output graph.json --json`       |
-| How do I render the project topology?                | `workspace graph dot\|mermaid [--output <file>]`        |
-| How do I export to semantic or graph-analysis tools? | `workspace graph jsonld\|graphml\|gexf --output <file>` |
-| How much retrieval payload did one query avoid?      | `workspace graph benchmark <query> --limit <n> --json`  |
+| You want to know…                                    | Use                                                                           |
+| ---------------------------------------------------- | ----------------------------------------------------------------------------- |
+| What is relevant to a natural-language question?     | `workspace graph search <query> --limit <n> --json`                           |
+| Which entities of one type exist?                    | `workspace graph entities <kind> [--scope project:name] [--limit <n>] --json` |
+| Why does Workspai believe an item exists?            | `workspace graph evidence <entity-or-relation> --json`                        |
+| How are two things connected?                        | `workspace graph path <from> <to> --json`                                     |
+| What changed between graph revisions?                | `workspace graph overlay --from <graph.json> --json`                          |
+| What is the full portable graph?                     | `workspace graph emit --output graph.json --json`                             |
+| How do I render the project topology?                | `workspace graph dot\|mermaid [--output <file>]`                              |
+| How do I export to semantic or graph-analysis tools? | `workspace graph jsonld\|graphml\|gexf --output <file>`                       |
+| How much retrieval payload did one query avoid?      | `workspace graph benchmark <query> --limit <n> --json`                        |
 
 `graph emit --json` writes the complete dependency and Knowledge Graph to
 stdout and can be very large. Automation, IDEs, and agents should pass
@@ -293,9 +333,10 @@ in `project.runtimeCandidates` and aggregates them into
 monorepo's internal services, contracts, delivery surfaces, and proofs without
 pretending that the primary runtime describes the whole repository.
 
-The two artifacts are published under one workspace lock using a
-rollback-capable artifact transaction. Each file replacement is atomic; if any
-write fails, Workspai restores both preimages. `graph.source.kind` is fixed to
+The model, workspace aggregate, and all project graph artifacts are published
+under one workspace lock using a rollback-capable multi-root artifact
+transaction. Each file replacement is atomic; if any write fails, Workspai
+restores every preimage. `graph.source.kind` is fixed to
 `workspace-model`, `graph.source.artifact` is fixed to
 `.workspai/reports/workspace-model.json`, and `graph.source.hash` contains the
 stable structural hash of the persisted model. A current-state consumer must
@@ -375,14 +416,23 @@ into a false “complete” claim.
 
 ## Outputs and consumers
 
-`workspace model --write` publishes these two artifacts as one locked,
-rollback-capable artifact set:
+`workspace model --write` publishes the canonical model, one complete workspace
+aggregate, and one compact integrity-bound reference for every registered
+project as one locked, rollback-capable multi-root artifact set:
 
 ```text
-.workspai/reports/workspace-model.json
-.workspai/reports/workspace-knowledge-graph.json
+<workspace>/.workspai/reports/workspace-model.json
+<workspace>/.workspai/reports/workspace-knowledge-graph.json
+<project>/.workspai/reports/project-knowledge-graph-reference.json
 ```
 
+The workspace artifact preserves all registered projects and cross-project
+relations for Graph, Doctor, Context, Goal, and MCP consumers. Each project
+reference carries source and projection hashes, summary counts, a bounded query,
+and a portable canonical URI; it does not duplicate graph entities or proofs.
+Nested and external projects follow the same rule. Any publication failure
+restores the model, aggregate, and all project reference preimages together.
+
 The Knowledge Graph is consumed by:
 
 - `workspace graph search|entities|evidence|path|overlay`;
@@ -403,8 +453,12 @@ The Knowledge Graph is consumed by:
   topology, rich graph, and quality summary in one response.
 
 The complete graph is an interchange artifact, not a prompt. Agents should
-start with `INDEX.json`, use bounded search, then retrieve evidence or a path
-for the selected result.
+start with compact project context, use bounded search, then retrieve evidence
+or a path for the selected result. Generated `project-context-agent.json`,
+`agent-entry.v1.json`, and bootstrap receipts expose a small project graph
+reference separately from the `workspace:` aggregate. Bootstrap schema-validates
+the reference and compares its projection hash with a fresh projection of the
+aggregate before it allows architecture claims. The complete graph is stored once.
 
 ### Interchange and visualization
 
@@ -469,7 +523,11 @@ hashes. Query indexes are cached per immutable graph object; replacing the graph
 is the in-memory invalidation boundary. Across CLI processes, compatible
 persisted read queries validate the live Git/Merkle fingerprint before reuse.
 `workspace model --cache` and `--incremental` avoid unnecessary model/project
-work when inputs are unchanged.
+work when inputs are unchanged. Full, cached, and incremental builds use the
+same project-discovery contract, including adopted/imported projects and
+projects declared only through a workspace contract `externalPath`. Manifest
+or source changes under an external project therefore invalidate the same
+signatures as equivalent in-workspace projects.
 
 Use full graph export for interchange or offline analysis. Use bounded search
 for interactive agents. The latter keeps response size proportional to the
@@ -487,6 +545,16 @@ remains unknown until a method/path or operation-id binding is proven. Consumers
 can distinguish the two guarantees through `bindingCoverage.apiRuntimeRegistration`
 and `bindingCoverage.apiImplementation`.
 
+Runtime-registration eligibility is explicit. Network and event contracts such
+as OpenAPI, server-root GraphQL schemas, AsyncAPI, and authored workspace API
+contracts participate; command palettes, console scripts, chat participants,
+shared protocol identities, and client GraphQL operations do not. GraphQL query,
+mutation, subscription, and fragment documents are modeled as proof-backed
+symbols that consume the GraphQL protocol. Only an authored root `schema` or
+non-extension `Query`, `Mutation`, or `Subscription` type establishes a
+runtime-served GraphQL API. This prevents client-heavy repositories from
+inflating API registration unknowns while preserving their operation topology.
+
 ## Measuring retrieval payload reduction
 
 Workspai does not publish an unqualified “N× fewer tokens” claim. Such a claim

package/docs/workspace-live-activity.md

@@ -0,0 +1,209 @@
+# Workspai Live Activity
+
+`workspai live` renders the execution graph of Workspai commands running in
+other terminals for the same project or workspace.
+
+```bash
+# Terminal A
+workspai live
+
+# Terminal B
+workspai workspace intelligence run
+
+# Terminal C
+workspai doctor workspace
+```
+
+The monitor is observational. Closing it does not cancel commands, and a
+journal or renderer failure cannot change command success.
+
+## Commands
+
+```bash
+workspai live [target]
+workspai live --global
+workspai live --global --max-scopes 20 --max-runs 20
+workspai live --run <run-id>
+workspai live --once
+workspai live --once --json
+workspai live --once --json --projection board
+workspai live --refresh-ms 500 --max-runs 10
+workspai live --no-motion --no-color
+workspai live --ascii
+workspai live --accessible
+workspai live --classic
+workspai live --capture workspai-live.svg
+workspai live --capture launch.svg --capture-preset linkedin --capture-theme obsidian
+workspai live --capture internal.svg --no-capture-redact
+workspai live --replay <run-id> --replay-speed 4
+```
+
+`target` defaults to the current directory. `--once` is suitable for scripts,
+diagnostics and tests. Without a TTY, `--json` emits a new snapshot only when
+projected activity changes. `--global` discovers bounded machine-local activity
+channels and produces one fleet view across projects and workspaces; it cannot
+be combined with `target`.
+
+JSON defaults to the backward-compatible monitor projection. Use
+`--projection board` for the public `workspace-activity-board.v1` projection
+consumed by IDE, browser, dashboard and capture adapters. It contains bounded
+runs, nodes, edges, selection, counters and diagnostics; consumers must not
+infer verification success from activity state.
+
+`--capture` writes an atomic, deterministic SVG from the same Activity Board
+Model used by the terminal and exits. Captures are redacted by default: local
+scope, project, run and command-argument details are replaced while semantic
+stage and outcome data remain. Presets are `github` (1280×720), `linkedin`
+(1200×627), `x`/`wide` (1600×900) and `square` (1080×1080); themes are
+`obsidian`, `light` and `mono`. Use `--no-capture-redact` only for an explicitly
+internal artifact.
+
+`--replay <run-id>` reconstructs the selected run from immutable event prefixes
+instead of inventing UI state. Replay defaults to 4× speed, accepts
+`--replay-speed 0.25..64`, and is scoped to the target project or workspace.
+
+## Flow Board
+
+The default TTY renderer is a bounded full-screen Flow Board, not an appended
+log. Each command publishes a versioned execution blueprint containing stable
+block and edge IDs. The board then projects real transitions onto that graph:
+
+- a running block uses an active cyan border;
+- successful, warning/blocked and failed blocks become green, yellow and red;
+- a running handoff animates on the edge entering the next block;
+- full-board connections terminate in weight-matched ports on the card frame;
+  font-dependent triangle arrowheads are not mixed with box-drawing lines, and
+  direction is conveyed by an aligned moving wire segment plus the serpentine
+  flow layout;
+- cards reserve their frame for topology and their content row for a stable
+  `QUEUE/RUN/DONE/WARN/BLOCK/FAIL` status rail, attempt and progress metadata;
+- a block started again after a terminal outcome is a new durable attempt; its
+  card shows `↻2`, `↻3`, and so on, retains earlier attempt outcomes and
+  reactivates the incoming flow wire;
+- independent runs may have multiple active blocks at the same time;
+- phase rails are emitted by command blueprints, so grouping reflects command
+  architecture rather than a repository-specific UI assumption;
+- terminals at least 132 columns wide receive a factual Inspector for the
+  selected active/problem block: state, phase, attempt, progress, elapsed time,
+  touches, artifacts and warnings; `i` or `Tab` toggles it;
+- the selected run receives the full flow graph; other running commands are
+  reduced to one minimal `ALSO ACTIVE` dock in local mode; global mode uses a
+  Fleet Cockpit with location, command, active block, status and elapsed time
+  before the selected run graph;
+- journals left running by a process that no longer exists are projected as
+  orphaned/cancelled and never inflate the active counter or active-run dock;
+- narrow or short terminals automatically collapse to chips without losing
+  status or ordering.
+
+The renderer updates changed terminal rows only and uses the alternate screen,
+so monitoring does not produce an unbounded scrollback stream. Resize triggers
+a safe full redraw. Interactive controls are:
+
+| Key                  | Effect                                        |
+| -------------------- | --------------------------------------------- |
+| `↑` / `↓`, `j` / `k` | Select a run                                  |
+| `Enter`              | Focus/unfocus the selected run                |
+| `i`, `Tab`           | Toggle the adaptive Inspector                 |
+| `f`                  | Toggle active runs only                       |
+| `q`, `Ctrl+C`        | Close the monitor without cancelling commands |
+
+Replay controls are `Space` to play/pause, `←`/`→` (or `,`/`.`) to step one
+durable event backward/forward, and `q` to close. Reaching the last event pauses
+the replay instead of exiting, which keeps the terminal ready for inspection.
+
+`NO_COLOR`, `TERM=dumb`, `WORKSPAI_LIVE_ASCII=1` and
+`WORKSPAI_LIVE_REDUCED_MOTION=1` are honored. `--accessible` uses a stable,
+non-animated linear projection with no terminal control sequences for screen
+readers and captured output. `--classic` preserves the compatibility renderer.
+
+The implementation intentionally keeps this pipeline renderer-independent:
+
+```text
+workspace-activity-event.v1
+  -> deterministic monitor snapshot
+  -> workspace-activity-board.v1 (runs, nodes, edges, selection, counters)
+  -> terminal + deterministic SVG adapters today / web and IDE adapters later
+```
+
+No TUI framework is part of the Activity runtime. This prevents React/Yoga or
+terminal-widget lifecycle state from entering the future package boundary and
+keeps browser/IDE renderers able to consume the same Board Model.
+
+## Project and workspace behavior
+
+The command works before adoption and does not create metadata in an ordinary
+project. Activity journals are stored in machine-local state:
+
+- Linux: `$XDG_STATE_HOME/workspai/activity`, or `~/.local/state/workspai/activity`;
+- macOS: `~/Library/Application Support/Workspai/activity`;
+- Windows: `%LOCALAPPDATA%\Workspai\activity`.
+
+`WORKSPAI_ACTIVITY_STATE_DIR` overrides this location. Set
+`WORKSPAI_ACTIVITY_DISABLE=1` to disable journaling.
+
+An adopted or linked project keeps its stable physical project channel and
+mirrors the same event/run identities into its workspace channel. This allows a
+monitor opened before `adopt` to keep following the run while a monitor at the
+workspace root receives subsequent linked-project activity.
+
+`workspai live --global` scans the bounded local channel registry, deduplicates
+mirrored records by event identity, then groups runs by semantic scope. Every
+run also carries a machine-local origin identity, so two projects in one
+workspace remain distinguishable while sharing one workspace lane, and projects
+from different workspaces retain separate scope labels. The selected run owns
+the full graph; concurrent activity from other origins stays visible in the
+Fleet Cockpit without merging independent timelines.
+
+## Event contract
+
+Every NDJSON line conforms to:
+
+```text
+contracts/workspace-activity-event.v1.json
+contracts/workspace-activity-monitor-snapshot.v1.json
+contracts/workspace-activity-monitor-fleet.v1.json
+contracts/workspace-activity-board.v1.json
+```
+
+The stream contains run, block, attempt, origin, declared-edge, operation,
+touch, artifact and warning data. Blueprint edges are explicit `sequence`, `parallel`, `gate` or
+`handoff` relations; older journals without declared edges receive a
+deterministic sequential projection for compatibility.
+Stable semantic block IDs describe architecture stages rather than source line
+numbers or function names.
+
+Activity is not evidence or authorization:
+
+- progress does not prove a result;
+- an exit code does not verify an engineering outcome;
+- a planned touch is not an observed effect;
+- the Activity journal is not the Evidence or Decision Ledger.
+
+Canonical domain artifacts and receipts remain owned by Model, Graph, Doctor,
+Security, Decisions and their existing contracts.
+
+## Privacy and retention
+
+- sensitive command options and metadata keys are redacted before persistence;
+- absolute paths are converted to project-relative locators when possible;
+- external targets expose only an `<external>/<basename>` locator;
+- environment variables, file contents and raw subprocess output are not stored;
+- the runtime retains at most 200 journals and 14 days per channel by default,
+  even when no monitor is open;
+- replay applies bounded per-journal read windows, a 20,000-event scoped ceiling
+  and a 50,000-event global ceiling so corrupt or oversized history cannot grow
+  monitor memory without limit;
+- state directories and journals are created with user-only permissions where
+  the platform supports POSIX modes.
+
+## Current limitations
+
+- live transport uses bounded journal polling rather than an IPC broker;
+- the local web/SSE renderer is planned but not implemented;
+- arbitrary shell commands require a future explicit wrapper or SDK for
+  semantic block attribution;
+- full filesystem reconciliation and syscall-level deep tracing are not part of
+  the default profile.
+
+The future package boundary and extraction gates are documented in
+`Docs/npm/Packages/ACTIVITY_PLANE_EXTRACTION_PLAN.md`.

package/docs/workspace-operations.md

@@ -88,7 +88,7 @@ versioned archive operation result instead.
 
 Workspace creation publishes the initial contract, canonical model, Knowledge
 Graph, structural baseline, context, report index, profile-aware `README.md`,
-`AGENTS.md`, operational skills, and supported IDE/agent surfaces—even before
+`AGENTS.md`, applicable operational skills, and supported IDE/agent surfaces—even before
 the first project exists. The README's Workspai-managed section shows the
 current profile, project count, canonical intelligence loop, and consumer entry
 points while preserving user-authored content. Successful project creation,
@@ -97,6 +97,14 @@ projections in the background. The structural baseline is created once and
 preserved; current model, graph, diff, impact, context, README, and project
 grounding move forward with workspace membership.
 
+Operational Skill generation is evidence-driven. Release readiness remains
+available at workspace scope, while API, schema, dependency, contract, runtime,
+test, delivery, and polyglot playbooks are emitted only for matching projects.
+`.workspai/reports/workspace-skills-index.json` records both generated and
+suppressed candidates, including the signals behind each decision. This keeps
+agent discovery useful without claiming capabilities the repository does not
+have.
+
 Doctor, Analyze, Readiness, and Verify remain explicit checks because they may
 run project tools or enforce release policy. Use `workspace intelligence run`
 when you want that governed decision chain, rather than only lifecycle sync.
@@ -122,21 +130,30 @@ Workspai returns a specific error for an invalid explicit workspace, malformed
 or stale link, ambiguous registration, or an unlinked project. It never picks
 one workspace silently when ownership is ambiguous.
 
-The project receives four distinct surfaces:
+The project receives seven complementary surfaces. They are different views of
+one canonical workspace binding, not seven copies of the model or graph:
 
-| File                                           | Purpose                                                                        | Portable              |
-| ---------------------------------------------- | ------------------------------------------------------------------------------ | --------------------- |
-| `.workspai/workspace-link.local.json`          | Machine-local canonical workspace binding                                      | No; always gitignored |
-| `.workspai/agent-entry.v1.json`                | Versioned host coverage, read order, authority boundaries, and integrity proof | Yes                   |
-| `.workspai/reports/project-context-agent.json` | Bounded project view of model, graph, proofs, diagnostics, and safe commands   | Yes                   |
-| `.workspai/PROJECT-GROUNDING.md`               | Human- and agent-readable project entry guide                                  | Yes                   |
-| `AGENTS.md` and host adapters                  | Route supported hosts to the same canonical-first bootstrap                    | Yes                   |
+| File                                                       | Purpose                                                                        | Portable              |
+| ---------------------------------------------------------- | ------------------------------------------------------------------------------ | --------------------- |
+| `.workspai/workspace-link.local.json`                      | Machine-local canonical workspace binding                                      | No; always gitignored |
+| `.workspai/agent-entry.v1.json`                            | Versioned host coverage, read order, authority boundaries, and integrity proof | Yes                   |
+| `.workspai/reports/project-context-agent.json`             | Bounded project view of model, graph, proofs, diagnostics, and safe commands   | Yes                   |
+| `.workspai/reports/project-knowledge-graph-reference.json` | Integrity-bound locator for the canonical project graph projection             | Yes                   |
+| `.workspai/PROJECT-GROUNDING.md`                           | Human- and agent-readable project entry guide                                  | Yes                   |
+| `.agents/skills/workspai-*/SKILL.md`                       | Native project Skill wrappers for canonical workspace playbooks                | Yes                   |
+| `AGENTS.md` and host adapters                              | Route supported hosts to the same canonical-first bootstrap                    | Yes                   |
 
 The bounded context includes project identity and commands, dependencies and
 dependents, related API/deployment/test surfaces, current project findings,
 portable proof locators, and model/graph freshness. It deliberately references
 rather than duplicates workspace-wide evidence.
 
+Representative graph entities are selected with a stratified round-robin
+budget, so a large early-sorted kind cannot hide later architectural kinds.
+`intelligence.projection` records the entity and byte budgets, selected and
+omitted counts per kind, and the scoped graph-search command for retrieving
+anything outside the lens. Aggregate counts in the lens remain exhaustive.
+
 Use `--project-grounding managed` (default) to publish all portable surfaces,
 `local` to keep the project lens and grounding gitignored without managing
 `AGENTS.md`, or `off` to disable project grounding for that operation. The
@@ -417,6 +434,12 @@ Artifacts:
 | `workspace run`                                             | Workspace orchestrator | Fleet stage execution                              |
 | `infra`                                                     | Workspace sidecar      | Contract-driven local dependencies                 |
 
+The readiness `env` gate only treats runtimes represented in
+`.workspai/toolchain.lock` as pinned. A Workspai Node pin does not prove a
+native C/C++ compiler or another unrepresented project toolchain; those scopes
+remain `warn` until the project build contract or organization CI policy
+provides verifiable toolchain evidence.
+
 The unified intelligence runner keeps `sync` and baseline resolution in a
 separate two-entry execution envelope and emits exactly 11 canonical stages.
 Exit `2` means the evidence gate blocked readiness after successful execution;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workspai",
-  "version": "0.65.0",
+  "version": "0.67.0",
   "type": "module",
   "description": "Open-source workspace intelligence CLI for software systems: create, adopt, govern, verify, and align polyglot workspaces for humans, CI, IDEs, and AI agents.",
   "keywords": [
@@ -116,6 +116,7 @@
     "test:scenarios:docker": "bash scripts/scenario-matrix.sh",
     "test:runtime-matrix": "node scripts/runtime-acceptance-matrix.mjs",
     "test:runtime-contract": "node scripts/runtime-acceptance-matrix.mjs --contract-only",
+    "prepush:test:runtime-contract": "node scripts/run-cached-prepush-gate.mjs runtime-contract",
     "test:runtime-matrix:full": "node scripts/runtime-acceptance-matrix.mjs --full",
     "test:real-world": "node scripts/real-world-qualification.mjs",
     "test:real-world:enterprise": "node scripts/enterprise-workspace-qualification.mjs",
@@ -141,6 +142,7 @@
     "smoke:frontend-generators:network": "tsup && node scripts/smoke-frontend-generators.mjs --execute",
     "smoke:official-generators": "tsup && node scripts/smoke-official-generators.mjs",
     "smoke:official-generators:no-build": "node scripts/smoke-official-generators.mjs",
+    "prepush:smoke:official-generators": "node scripts/run-cached-prepush-gate.mjs official-generators-contract",
     "smoke:official-generators:network": "tsup && node scripts/smoke-official-generators.mjs --execute",
     "check:generator-smoke-coverage": "node scripts/check-generator-smoke-coverage.mjs",
     "sync:contracts": "node scripts/sync-contracts.mjs",
@@ -151,7 +153,7 @@
     "size-check:no-build": "size-limit",
     "bench": "npx tsx scripts/benchmarks.ts",
     "quality": "corepack npm run check:package-manager && corepack npm run typecheck && corepack npm run lint && corepack npm run format:check && corepack npm test && corepack npm run size-check && corepack npm run check:workspace-intelligence-runtime && corepack npm run check:workspace-intelligence-adversarial && corepack npm run check:doctor-capabilities && corepack npm run test:runtime-contract && corepack npm run security && corepack npm run validate:docs && corepack npm run check:generator-smoke-coverage && corepack npm run smoke:official-generators && corepack npm run check:contracts && corepack npm run check:shared-contracts && corepack npm run check:parity-snapshot && corepack npm run check:agent-customization-drift",
-    "quality:push": "corepack npm run check:package-manager && corepack npm run check:windows-registry && corepack npm run typecheck && corepack npm run lint && corepack npm run format:check && corepack npm run build && corepack npm run test:no-build && corepack npm run size-check:no-build && corepack npm run check:workspace-intelligence-runtime && corepack npm run check:workspace-intelligence-adversarial && corepack npm run check:doctor-capabilities && corepack npm run test:runtime-contract && corepack npm run validate:docs && corepack npm run check:generator-smoke-coverage && corepack npm run smoke:official-generators:no-build && corepack npm run contracts:check:local && corepack npm run validate:contracts:tests",
+    "quality:push": "corepack npm run check:package-manager && corepack npm run check:windows-registry && corepack npm run typecheck && corepack npm run lint && corepack npm run format:check && corepack npm run build && corepack npm run test:no-build && corepack npm run size-check:no-build && corepack npm run check:workspace-intelligence-runtime && corepack npm run check:workspace-intelligence-adversarial && corepack npm run check:doctor-capabilities && corepack npm run prepush:test:runtime-contract && corepack npm run validate:docs && corepack npm run check:generator-smoke-coverage && corepack npm run prepush:smoke:official-generators && corepack npm run contracts:check:local && corepack npm run validate:contracts:tests",
     "act-matrix": "act -P ubuntu-latest=ghcr.io/catthehacker/ubuntu:act-22.04 -P macos-latest=ghcr.io/catthehacker/ubuntu:act-22.04 -P windows-latest=ghcr.io/catthehacker/ubuntu:act-22.04 --pull=false -j build-test-matrix",
     "release:dry": "bash scripts/release.sh --no-publish --yes --allow-dirty",
     "release:patch": "bash scripts/release.sh patch",

package/dist/analyze-5PDVWECJ.js

@@ -1 +0,0 @@
-export{b as printAnalyzeReport,a as runAnalyze}from'./chunk-WPRLXKWC.js';

package/dist/autopilot-release-JVIJCTKX.js

@@ -1 +0,0 @@
-export{b as AUTOPILOT_RELEASE_ALIAS_FILENAME,a as AUTOPILOT_RELEASE_LAST_RUN_FILENAME,c as runAutopilotRelease}from'./chunk-HDNATYW7.js';

package/dist/capabilities-command-LHM3XIS6.js

@@ -1 +0,0 @@
-export{b as runDoctorCapabilities}from'./chunk-6TBTMWNA.js';

package/dist/chunk-2647BYBC.js

@@ -1 +0,0 @@
-import y from'fs';import u from'path';var b="polyglot-lifecycle-plan.v1",x=new Set([".git",".workspai",".rapidkit",".venv","bin","build","dist","node_modules","obj","target","third_party","vendor","fixture","fixtures","__fixtures__","testdata"]);function f(o,i){return u.relative(o,i).split(u.sep).join("/")||"."}function P(o,i){let t=[],s=(r,n)=>{if(n>i)return;let m=[];try{m=y.readdirSync(r,{withFileTypes:true});}catch{return}for(let d of m.sort((a,c)=>a.name.localeCompare(c.name))){let a=u.join(r,d.name);if(d.isDirectory()){x.has(d.name)||s(a,n+1);continue}d.isFile()&&(["package.json","pyproject.toml","go.mod","Cargo.toml","pom.xml","build.gradle","build.gradle.kts","CMakeLists.txt","meson.build"].includes(d.name)||/\.(?:cs|fs|vb)proj$/i.test(d.name))&&t.push(a);}};return s(o,0),t}function h(o,i){if(u.basename(i)!=="package.json")return  false;let t=f(o,i).toLowerCase().split("/"),s=t.findIndex(r=>["test","tests","spec","specs","e2e","integration","integration-tests"].includes(r));return s<0?false:t.length-s>2}function e(o,i,t="high"){return {stage:o,command:i,confidence:t,preflight:"executable-and-inputs"}}function S(o,i){let t={};try{let n=JSON.parse(i);n.scripts&&typeof n.scripts=="object"&&!Array.isArray(n.scripts)&&(t=n.scripts);}catch{}let s=y.existsSync(u.join(o,"pnpm-lock.yaml"))?"pnpm":y.existsSync(u.join(o,"yarn.lock"))?"yarn":"npm",r=n=>`${s} run ${n}`;return [e("init",s==="yarn"?"yarn install":`${s} install`),...typeof t.test=="string"?[e("test",r("test"))]:[],...typeof t.build=="string"?[e("build",r("build"))]:[],...typeof t.start=="string"?[e("start",r("start"))]:[]]}function j(o,i){let t=u.basename(i),s=u.dirname(i),r=f(o,s),n=f(o,i),m=n.toLowerCase().split("/"),d=m.some(l=>["example","examples","sample","samples","worked"].includes(l))?"example":m.some(l=>["test","tests","e2e","integration","integration-tests"].includes(l))?"test":m.some(l=>["script","scripts","tool","tools","tooling"].includes(l))?"tooling":"production",a="";try{a=y.readFileSync(i,"utf8");}catch{return null}let c,g,p;if(t==="package.json")c="node",g="npm",p=S(s,a);else if(t==="pyproject.toml")c="python",g="python",p=[e("init","python -m pip install -e ."),...y.existsSync(u.join(s,"tests"))||/\[tool\.pytest/i.test(a)?[e("test","python -m pytest")]:[],.../\[build-system\]/.test(a)?[e("build","python -m build","medium")]:[]];else if(t==="go.mod")c="go",g="go",p=[e("init","go mod download"),e("test","go test ./..."),e("build","go build ./...")];else if(t==="Cargo.toml")c="rust",g="cargo",p=[e("init","cargo fetch"),e("test","cargo test"),e("build","cargo build"),...y.existsSync(u.join(s,"src","main.rs"))?[e("start","cargo run")]:[]];else if(t==="pom.xml"){c="java",g="maven";let l=y.existsSync(u.join(s,"mvnw"))?"./mvnw":"mvn";p=[e("init",`${l} dependency:go-offline`),e("test",`${l} test`),e("build",`${l} package`)];}else if(t==="build.gradle"||t==="build.gradle.kts"){c="java",g="gradle";let l=y.existsSync(u.join(s,"gradlew"))?"./gradlew":"gradle";p=[e("init",`${l} dependencies`),e("test",`${l} test`),e("build",`${l} build`)];}else if(/\.(?:cs|fs|vb)proj$/i.test(t)){c="dotnet",g="nuget";let l=d==="test"||/<IsTestProject>\s*true\s*<\/IsTestProject>/i.test(a)||/PackageReference\s+Include=["']Microsoft\.NET\.Test\.Sdk["']/i.test(a);p=[e("init",`dotnet restore ${t}`),...l?[e("test",`dotnet test ${t}`)]:[],e("build",`dotnet build ${t}`)];}else if(t==="CMakeLists.txt")c=/(?:\bcxx\b|\bcplusplus\b|\bc\+\+\b)/iu.test(a)?"cpp":"c",g="cmake",p=[e("init","cmake -S . -B build"),e("test","ctest --test-dir build --output-on-failure","medium"),e("build","cmake --build build")];else if(t==="meson.build")c=/(?:cpp|c\+\+)/iu.test(a)?"cpp":"c",g="meson",p=[e("init","meson setup build"),e("test","meson test -C build","medium"),e("build","meson compile -C build")];else return null;return {id:`${c}:${r}:${n}`,runtime:c,ecosystem:g,role:d,root:r,manifest:n,stages:p}}function R(o,i={}){let t=u.resolve(o),s=P(t,Math.max(0,Math.min(i.maxDepth??4,12))).filter(n=>!h(t,n)).map(n=>j(t,n)).filter(n=>!!n).filter(n=>i.includeExamples===true||n.role!=="example").sort((n,m)=>n.runtime.localeCompare(m.runtime)||n.root.localeCompare(m.root)||n.manifest.localeCompare(m.manifest)),r=[...new Set(s.map(n=>n.runtime))].sort();return {schemaVersion:b,projectRoot:".",polyglot:r.length>1,runtimes:r,units:s}}export{R as a};

package/dist/chunk-27UR373Z.js

@@ -1 +0,0 @@
-import {a as a$1}from'./chunk-GR6442P7.js';import {j,a,b as b$1,t}from'./chunk-MOSXTVPU.js';import {promises}from'fs';import c from'path';var v=new Set(["node_modules","dist","build","target","coverage","htmlcov",".workspai",".rapidkit",".venv"]);function b(t,r){if(r.has(t)||a$1(t))return  true;let i=t.toLowerCase();return !!(i==="dist"||i.startsWith("dist-")||i.startsWith("dist_")||i==="build"||i.startsWith("build-")||i.startsWith("build_"))}async function D(t){try{return await promises.access(t),true}catch{return  false}}async function w(t$1){for(let r of t(t$1,"context.json"))if(await D(r))return  true;for(let r of t(t$1,"project.json"))if(await D(r))return  true;return  false}async function M(t,r){let i=[],o=[c.resolve(t)],u=new Set,P=r?.skipDirs??v,g=r?.includeHiddenDirs===true,y=r?.descendIntoMatchedProjects!==false,j$1=r?.isProjectDir??w,d=c.resolve(t);for(;o.length>0;){let e=o.shift();if(!e||u.has(e)||(u.add(e),e!==d&&j(e))||await j$1(e,d)&&(i.push(e),!y))continue;let s=[];try{s=await promises.readdir(e,{withFileTypes:true});}catch{continue}for(let n of s)n.isDirectory()&&(!g&&n.name.startsWith(".")||b(n.name,P)||n.name===a||n.name===b$1||o.push(c.join(e,n.name)));}return i.sort((e,s)=>e.localeCompare(s))}export{M as a};

package/dist/chunk-2C5ZBVBI.js

@@ -1,2 +0,0 @@
-import {b as b$1}from'./chunk-LNXIMF3O.js';import {b}from'./chunk-VXKWWX7S.js';import {n,f as f$1,g}from'./chunk-FY4IIAIF.js';import {d}from'./chunk-P5PSZQPB.js';import {e as e$1,d as d$1}from'./chunk-CCDGHPEJ.js';import {f,e}from'./chunk-NZ3WZYD5.js';import E from'path';import S from'fs-extra';var te=f.agentContext,se=e.agentContext;function ae(e){if(typeof e!="string"||!e.trim()||e==="true")return "generic";let r=e.trim().toLowerCase();return r==="codex"||r==="claude"||r==="cursor"||r==="gemini"||r==="qwen"||r==="kimi"||r==="grok"||r==="copilot"||r==="windsurf"||r==="amazon-q"||r==="orca"?r:"generic"}function L(e){return `npx --yes --package workspai workspai ${e}`.trim()}function j(e){return `npx workspai ${e}`.trim()}async function v(e,r,i){let s=E.join(e,r);if(!await S.pathExists(s))return null;try{let a=await S.readJson(s);return !a||a.schemaVersion!==i?null:a}catch{return null}}function p(e$1){return {id:e$1.id,scope:e$1.scope,display:j(e$1.args),execute:L(e$1.args),description:e$1.description,...e$1.project?{project:e$1.project}:{},freshness:f$1({id:`command.${e$1.id}`,label:`${e$1.id} command`,scope:"command",value:{display:j(e$1.args),execute:L(e$1.args)},...e$1.project?{project:e$1.project}:{},freshness:{kind:"derived",category:"structure",generatedAt:e$1.generatedAt,now:e$1.now,sourceArtifact:e.model,sourcePath:`safeCommands.${e$1.id}`,reason:"Safe command surfaces are derived from workspace model command capabilities."}}).freshness}}function D(e,r){return `workspace run ${r} --scope project:${e.name}`}function ne(e){return (e.startsWith("project:")?e.slice(8):e).trim().toLowerCase()}function oe(e){return [e.name,e.path,E.basename(e.path),e.absolutePath].filter(r=>typeof r=="string"&&r.trim().length>0).map(r=>r.trim().toLowerCase())}function ie(e,r,i){let s={generatedAt:e.generatedAt,now:i},a=[p({id:"workspace.model",scope:"workspace",args:"workspace model --json",description:"Read the canonical workspace intelligence model.",...s}),p({id:"workspace.graph.entities",scope:"workspace",args:"workspace graph entities --json",description:"Query proof-backed workspace entities without loading the full graph.",...s}),p({id:"workspace.graph.evidence",scope:"workspace",args:"workspace graph evidence <entity-or-relation> --json",description:"Resolve portable evidence for a graph entity or relation.",...s}),p({id:"workspace.graph.path",scope:"workspace",args:"workspace graph path <from> <to> --json",description:"Find a shortest proof-carrying path between workspace entities.",...s}),p({id:"workspace.doctor",scope:"workspace",args:"doctor workspace --json",description:"Check workspace health before claiming verification.",...s}),p({id:"workspace.pipeline",scope:"workspace",args:"pipeline --json",description:"Run the governed sync, doctor, analyze, readiness, and autopilot loop.",...s}),p({id:"workspace.contract.verify",scope:"workspace",args:"workspace contract verify --json",description:"Verify workspace contract and dependency edges.",...s}),p({id:"workspace.verify",scope:"workspace",args:"workspace verify --json",description:"Evaluate evidence freshness and verification gates before release decisions.",...s})],c=r?[r]:e.projects;for(let n of c)n.commands.fleetStages.includes("test")&&a.push(p({id:`project.${n.name}.test`,scope:"project",project:n.name,args:D(n,"test"),description:`Run tests for ${n.name} through workspace orchestration.`,...s})),n.commands.fleetStages.includes("build")&&a.push(p({id:`project.${n.name}.build`,scope:"project",project:n.name,args:D(n,"build"),description:`Build ${n.name} through workspace orchestration.`,...s}));return a}function ce(e){return e.commands.fleetStages.filter(r=>r==="test"||r==="build").map(r=>`workspace run ${r}`)}function de(e,r){if(!r?.startsWith("project:"))return;let i=ne(r);if(i)return e.projects.find(s=>oe(s).includes(i))}function me(e,r,i){let s=[...e.validation?.issues??[]];r?.startsWith("project:")&&!i&&s.push({severity:"error",code:"context.scope.project.missing",message:`Requested project scope was not found: ${r}`,target:r});let a=s.filter(n=>n.severity==="error").length,c=s.filter(n=>n.severity==="warning").length;return {status:a>0?"failed":c>0?"warning":"passed",errors:a,warnings:c,issues:s}}async function pe(e,r){let i=[],s=[];for(let[a,c]of Object.entries(e.evidence))c&&await d$1(r,c.path)!==null?i.push(`${a}: ${c.path}`):s.push(a);return {available:i.sort(),missing:s.sort()}}function le(e){let r=e.summary.projectCount,i=e.summary.runtimes.length?`${e.summary.runtimes.join(", ")} runtime coverage`:"no runtime coverage",s=e.identity.surfaces.length?e.identity.surfaces.join(", "):"no detected surfaces";return `${e.workspace.name} is a ${e.identity.workspaceType} with ${r} project${r===1?"":"s"}, ${i}, and ${s}.`}function ge(e){let r=["Do not claim a command passed unless a report or command output proves it.","Do not infer secrets or environment values from file names.","Do not change project scope without checking the selected project."];return e.contracts.exists||r.push("Workspace contract is missing; dependency and API edges may be incomplete."),e.summary.observedProjects>0&&r.push("Some projects are observed rather than first-class; command support may be partial."),r}async function xe(e$1){let r=e$1.model??await n({workspacePath:e$1.workspacePath,includeEvidence:e$1.includeEvidence===true,observableScanDepth:e$1.observableScanDepth,now:e$1.now}),i=ae(e$1.agent),s=de(r,e$1.scope),a=me(r,e$1.scope,s);if(e$1.strict===true&&a.status!=="passed"){let t=a.issues.map(g=>`${g.severity}:${g.code}:${g.target}`).join(", ");throw new Error(`Workspace context strict validation failed: ${t}`)}let c=e$1.now??new Date,n$1=r.facts??[],K=new Set((s?[s]:r.projects).map(t=>t.name)),F=n$1.filter(t=>t.project?K.has(t.project):true),H=(s?[s]:r.projects).map(t=>{let g=F.filter(d=>d.project===t.name);return {name:t.name,path:t.path,kind:t.kind,category:t.category,runtime:t.runtime,framework:t.frameworkDisplayName,...t.generator?{generator:t.generator}:{},createCapability:t.createCapability,supportTier:t.supportTier,...t.governance?{governance:t.governance}:{},safeCommands:ce(t),importantFiles:t.importantFiles,facts:g}}),A=await pe(r,e$1.workspacePath),R=E.join(e$1.workspacePath,e.knowledgeGraph),u=await S.pathExists(R)?await S.readJson(R).catch(()=>null):null,$=false;if(u?.schemaVersion===f.knowledgeGraph)try{b(u,r),$=true;}catch{}let M=le(r),I=ie(r,s,c),C=await v(e$1.workspacePath,e.impact,f.impact),l=await v(e$1.workspacePath,e.doctor,f.doctor),b$2=await v(e$1.workspacePath,e.analyze,f.analyze),k=await v(e$1.workspacePath,e.readiness,f.readiness),h=await v(e$1.workspacePath,e.verify,f.verify),w=await v(e$1.workspacePath,e.explain,f.explain),f$2=await v(e$1.workspacePath,e.diff,f.diff),B=C?.summary?{changed:C.summary.changed,risk:C.summary.risk,affectedProjects:C.summary.affectedProjects,blastRadius:C.summary.blastRadius,recommendedCommands:C.summary.recommendedCommands}:void 0,U=l?.summary?{verdict:l.summary.verdict,totalIssues:l.summary.totalIssues,advisoryFindings:l.summary.advisoryFindings,blockingFindings:l.summary.blockingFindings,unknownFindings:l.summary.unknownFindings,hasSystemErrors:l.summary.hasSystemErrors,topSignals:(()=>{let t=Array.isArray(l.projects)?l.projects:[],g=[];for(let d of t.slice(0,6)){let re=Array.isArray(d?.probes)?d.probes:[];for(let y of re.slice(0,10))(y?.status==="fail"||y?.severity==="error")&&g.push({label:y.label,scope:y.scope,issueClass:y.issueClass,status:y.status,severity:y.severity,recommendation:y.recommendation});}return g.slice(0,8)})()}:void 0,J=b$2?.summary?{score:b$2.summary.score,verdict:b$2.summary.verdict,findingCounts:b$2.summary.findings,topFindings:(Array.isArray(b$2.findings)?b$2.findings:[]).filter(d=>d?.severity==="fail"||d?.severity==="warn").slice(0,8).map(d=>({severity:d.severity,title:d.title,target:d.target,remediation:d.remediation}))}:void 0,X=k?{overallStatus:k.overallStatus,blocking:k.blocking,blockingReasons:k.blockingReasons,evidencePath:k.evidencePath,gates:Array.isArray(k.gates)?k.gates.slice(0,6).map(t=>({gate:t.gate,status:t.status,summary:t.summary})):void 0}:void 0,Q=h?.summary?{verdict:h.summary.verdict,exitCode:h.summary.exitCode,stepsFailed:h.summary.stepsFailed,stepsMissing:h.summary.stepsMissing,blockingReasons:h.blockingReasons,missingEvidence:h.missingEvidence}:void 0,Y=w?{summary:w.summary,blockingReasons:w.blockingReasons,releaseVerdict:w.releaseVerdict,evidenceFreshness:w.evidenceFreshness,sections:Array.isArray(w.sections)?w.sections.slice(0,4).map(t=>({id:t.id,title:t.title,body:t.body})):void 0}:void 0,Z=f$2?.summary?{changed:f$2.summary.changed,addedProjects:f$2.summary.addedProjects,removedProjects:f$2.summary.removedProjects,changedProjects:f$2.summary.changedProjects,workspaceChanges:f$2.summary.workspaceChanges,validationChanges:f$2.summary.validationChanges,gitChangedFiles:f$2.summary.gitChangedFiles}:void 0,ee=I.map(t=>f$1({id:`context.command.${t.id}`,label:`${t.id} safe command`,scope:"command",value:{display:t.display,execute:t.execute,scope:t.scope},...t.project?{project:t.project}:{},freshness:{kind:"derived",category:"structure",generatedAt:r.generatedAt,now:c,sourceArtifact:e.agentContext,sourcePath:`safeCommands.${t.id}`,reason:"Context safe commands are derived from workspace model command capabilities."}})),T=[...F,...ee],x=g({facts:T,generatedAt:c.toISOString(),now:c}),W=b$1();return {schemaVersion:te,generatedAt:c.toISOString(),agent:i,workspaceSummary:M,modelRef:e.model,knowledgeGraph:{artifact:e.knowledgeGraph,schemaVersion:f.knowledgeGraph,available:$,...typeof u?.quality?.entityCount=="number"?{entityCount:u.quality.entityCount}:{},...typeof u?.quality?.relationCount=="number"?{relationCount:u.quality.relationCount}:{},...typeof u?.quality?.proofCount=="number"?{proofCount:u.quality.proofCount}:{},queryCommands:[j("workspace graph search <query> --limit 12 --json"),j("workspace graph entities [kind] --json"),j("workspace graph evidence <entity-or-relation> --json"),j("workspace graph path <from> <to> --json")]},intelligenceChain:{schemaVersion:W.schemaVersion,contractPath:W.contractPath,currentStep:"context",canonicalReadOrder:[...W.consumers.agents.canonicalReadOrder]},workspace:{name:r.workspace.name,root:`workspace:${r.workspace.name}`,type:r.identity.workspaceType,...r.workspace.profile?{profile:r.workspace.profile}:{}},scope:{requested:e$1.scope??"workspace",...s?{activeProject:s.name}:{}},projects:H,safeCommands:I,facts:T,factFreshness:x,evidence:A,policies:{mode:r.policies.mode,source:r.policies.source},contracts:{exists:r.contracts.exists,path:r.contracts.workspaceContractPath},validation:a,agentInstructions:[`Read \`${e.agentIndex}\` first, then this context pack and linked evidence reports.`,"Use `workspace graph search <query> --limit 12 --json` for bounded, proof-backed retrieval before loading the full graph.",`Load \`${e.knowledgeGraph}\` only when a complete graph export is explicitly required.`,"Use this context as the workspace source of truth before inspecting random files.","Prefer workspace-level evidence over generic framework assumptions.","Use `display` commands when explaining steps to a human.","Use `execute` commands when launching commands from automation or tooling.","Treat `facts[].freshness.verifyBeforeUse` as a hard refresh requirement before using that fact in advice, fixes, or release decisions.","Do not carry extracted facts beyond their freshness contract; re-read or regenerate evidence when the contract says stale, unknown, live, or verify-before-use.","Keep project-scoped advice tied to the active project scope.","Regenerate stale grounding with `npx workspai workspace agent-sync --write --refresh-context`."],unsafeAssumptions:[...ge(r),...x.verifyBeforeUseFacts>0?[`${x.verifyBeforeUseFacts} fact(s) require verification before use; do not treat them as durable workspace structure.`]:[]],humanSummary:[M,`Evidence available: ${A.available.length}. Missing evidence groups: ${A.missing.join(", ")||"none"}.`,s?`Active project scope: ${s.name} (${s.frameworkDisplayName}).`:"Scope: whole workspace."].join(`
-`),impactSummary:B,doctorSummary:U,analyzeSummary:J,readinessSummary:X,verifySummary:Q,explainSummary:Y,diffSummary:Z}}async function We(e,r){return e$1(r,se,d(e))}export{te as a,se as b,xe as c,We as d};

package/dist/chunk-6JWNDWOA.js

@@ -1 +0,0 @@
-import e from'path';import N from'fs-extra';import F from'chalk';async function K(n,o={}){let t=e.resolve(n),{WORKSPACE_CONTRACT_PATH:i,syncWorkspaceContract:c,verifyWorkspaceContract:m,writeWorkspaceContractVerifyEvidence:k}=await import('./workspace-contract-7DXK4GF5.js'),p=await c({workspacePath:t,strict:true}),{syncWorkspaceReadme:f,WORKSPACE_README_PATH:d}=await import('./workspace-readme-G7TZ3V5T.js'),h=await f({workspacePath:t,workspaceName:p.contract.workspace.name,profile:p.contract.workspace.profile??"minimal",projectCount:p.contract.projects.length}),{buildWorkspaceModel:u,writeWorkspaceModel:g}=await import('./workspace-model-ZL6WCICX.js'),a=await u({workspacePath:t,includeEvidence:true}),P=await g(a,t),{buildWorkspaceImpact:W,buildWorkspaceModelSnapshot:C,diffWorkspaceModel:y,writeWorkspaceImpact:A,writeWorkspaceModelDiff:j,writeWorkspaceModelSnapshot:E}=await import('./workspace-intelligence-6FS26JOQ.js'),{WORKSPACE_INTELLIGENCE_ARTIFACTS:s}=await import('./workspace-intelligence-runtime-registry-IW6J53LO.js'),R=e.join(t,s.snapshot),l=false;if(!await N.pathExists(R)){let r=await C({workspacePath:t,model:a});await E(r,t),l=true;}let S=await y({workspacePath:t,fromPath:s.snapshot,model:a}),b=await j(S,t),v=await W({workspacePath:t,fromPath:s.diff}),O=await A(v,t),T=await m({workspacePath:t,strict:true}),_=await k({workspacePath:t,result:T}),{syncWorkspaceAgentGrounding:M}=await import('./workspace-agent-sync-GEN3KBAX.js'),w=await M({workspacePath:t,model:a,write:true,refreshContext:true,strict:false,preset:"enterprise",targets:["all"],projectGrounding:o.projectGrounding??"managed"}),x=[i,(await import('./workspace-registry-summary-LJN4WHIZ.js')).WORKSPACE_REGISTRY_SUMMARY_RELATIVE_PATH,e.relative(t,h).split(e.sep).join("/")||d,e.relative(t,P).split(e.sep).join("/"),s.knowledgeGraph,...l?[s.snapshot]:[],e.relative(t,b).split(e.sep).join("/"),e.relative(t,O).split(e.sep).join("/"),e.relative(t,_).split(e.sep).join("/"),...w.writtenFiles].filter((r,I,G)=>G.indexOf(r)===I);return o.silent||console.log(F.gray(`\u2713 Workspace Intelligence synced \xB7 ${a.summary.projectCount} project(s) \xB7 model + graph + agent grounding`)),{workspacePath:t,projectCount:a.summary.projectCount,baselineCreated:l,writtenFiles:x,warnings:w.projectLenses?.skipped.map(r=>`${r.name}: ${r.reason}`)??[]}}async function D(n,o={}){let t=e.resolve(n),i=o.workspaceName??e.basename(t),{registerWorkspaceStrict:c}=await import('./workspace-HGUZWNAB.js');return await c(t,i),K(t,{silent:o.silent})}export{K as a,D as b};

package/dist/chunk-CCDGHPEJ.js

@@ -1,2 +0,0 @@
-import {b as b$1}from'./chunk-D65FCQIO.js';import {v,w}from'./chunk-MOSXTVPU.js';import l from'path';import {randomUUID}from'crypto';import {open}from'fs/promises';import c from'fs-extra';function k(t,e){let n=l.resolve(t),r=e.trim();if(!r||l.isAbsolute(r))throw new Error(`Workspace artifact path must be non-empty and relative: ${e}`);let a=l.resolve(n,r),o=l.relative(n,a);if(o===".."||o.startsWith(`..${l.sep}`)||l.isAbsolute(o))throw new Error(`Workspace artifact path escapes workspace root: ${e}`);return a}function u(t,e){return k(t,v(e))}function N(t,e){return k(t,w(e))}async function S(t,e){let n=l.resolve(t);await c.ensureDir(n);let r=l.dirname(e);await c.ensureDir(r);let[a,o]=await Promise.all([c.realpath(n),c.realpath(r)]),i=l.relative(a,o);if(i===".."||i.startsWith(`..${l.sep}`)||l.isAbsolute(i))throw new Error(`Workspace artifact parent resolves outside workspace root: ${r}`)}async function _(t,e){let n=l.resolve(t),[r,a]=await Promise.all([c.realpath(n),c.realpath(e)]),o=l.relative(r,a);if(o===".."||o.startsWith(`..${l.sep}`)||l.isAbsolute(o))throw new Error(`Workspace artifact resolves outside workspace root: ${e}`)}function F(t){let e=t?.code;return process.platform==="win32"&&(e==="EPERM"||e==="EINVAL"||e==="ENOSYS")}function b(t,e=process.platform){if(e!=="win32")return  false;let n=t?.code;return n==="EPERM"||n==="EACCES"||n==="EBUSY"}async function p(t){let e=process.platform==="win32"?6:1,n;for(let r=0;r<e;r+=1)try{await c.remove(t);return}catch(a){if(n=a,!b(a)||r===e-1)throw a;await new Promise(o=>setTimeout(o,10*2**r));}throw n}var m=new Map;async function J(t,e){let n=m.get(t)??Promise.resolve(),r,a=new Promise(i=>{r=i;}),o=n.catch(()=>{}).then(()=>a);m.set(t,o),await n.catch(()=>{});try{return await e()}finally{r(),m.get(t)===o&&m.delete(t);}}async function I(t){try{await t.sync();}catch(e){if(!F(e))throw e}}async function h(t,e,n){await S(t,e);let r=l.dirname(e),a=`${l.basename(e)}.`,o=Date.now();for(let s of await c.readdir(r)){if(!s.startsWith(a)||!s.endsWith(".tmp"))continue;let w=l.join(r,s),f=await c.stat(w).catch(()=>null);f&&o-f.mtimeMs>3e4&&await c.remove(w).catch(()=>{});}let i=`${e}.${process.pid}.${randomUUID()}.tmp`;try{await n(i);let s=await open(i,"r");try{await I(s);}finally{await s.close();}let w=Number(process.env.WORKSPAI_TEST_ATOMIC_WRITE_DELAY_MS??0);Number.isFinite(w)&&w>0&&await new Promise(f=>setTimeout(f,Math.min(w,3e4)));try{await c.rename(i,e);}catch(f){let d=f.code;if(d!=="EEXIST"&&d!=="EPERM")throw f;await c.move(i,e,{overwrite:true});}}finally{await c.remove(i).catch(()=>{});}}async function D(t,e,n,r={}){let a=u(t,e);await S(t,a);let o=`${a}.lock`;return J(o,()=>L(o,e,n,r))}async function L(t,e,n,r){let a=r.timeoutMs??1e4,o=r.staleAfterMs??3e4,i=Date.now(),s;for(;!s;)try{s=await open(t,"wx"),await s.writeFile(`${JSON.stringify({pid:process.pid,createdAt:new Date().toISOString()})}
-`),await I(s);}catch(w){if(!(w.code==="EEXIST"||b(w)))throw s&&(await s.close().catch(()=>{}),s=void 0,await p(t).catch(()=>{})),w;s&&(await s.close().catch(()=>{}),s=void 0,await p(t).catch(()=>{}));let[P,M]=await Promise.all([c.stat(t).catch(()=>null),c.readJson(t).catch(()=>null)]),g=Number(M?.pid),E=Number.isInteger(g)&&g>0,A=false;if(E)try{process.kill(g,0),A=true;}catch(y){A=y.code==="EPERM";}let R=!E&&!!(P&&Date.now()-P.mtimeMs>o);if(E&&!A||R){await p(t).catch(()=>{});continue}if(Date.now()-i>=a)throw new Error(`Timed out waiting for workspace artifact lock: ${e}`);await new Promise(y=>setTimeout(y,20));}try{return await n()}finally{await s.close().catch(()=>{}),await p(t);}}async function K(t,e){let n=[u(t,e),N(t,e)];for(let r of n)if(await c.pathExists(r))return await _(t,r),r;return null}async function X(t,e,n){b$1(e,n);let r=u(t,e);return await h(t,r,a=>c.writeJson(a,n,{spaces:2})),r}async function V(t,e,n){if(n.length===0)return [];let r=n.map(o=>({...o,path:u(t,o.relativePath)})),a=r.find((o,i)=>r.findIndex(s=>s.path===o.path)!==i);if(a)throw new Error(`Duplicate workspace artifact transaction target: ${a.relativePath}`);for(let o of r)b$1(o.relativePath,o.payload);return D(t,e,async()=>{let o=await Promise.all(r.map(async i=>({path:i.path,exists:await c.pathExists(i.path),contents:await c.readFile(i.path).catch(()=>null)})));try{for(let i=0;i<r.length;i+=1){let s=r[i];await h(t,s.path,f=>c.writeJson(f,s.payload,{spaces:2}));let w=Number(process.env.WORKSPAI_TEST_FAIL_ARTIFACT_SET_AFTER??0);if(Number.isInteger(w)&&w===i+1)throw new Error(`Injected artifact-set failure after ${w} write(s).`)}return r.map(i=>i.path)}catch(i){let w=(await Promise.allSettled(o.map(async f=>{if(!f.exists||f.contents===null){await c.remove(f.path);return}await h(t,f.path,d=>c.writeFile(d,f.contents));}))).filter(f=>f.status==="rejected");throw w.length>0?new AggregateError([i,...w.map(f=>f.reason)],"Workspace artifact transaction failed and rollback was incomplete."):i}})}async function q(t,e,n){let r=u(t,e);return await h(t,r,a=>c.writeFile(a,n,"utf-8")),r}export{u as a,N as b,D as c,K as d,X as e,V as f,q as g};