youmd 0.13.5 → 0.13.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "youmd",
-  "version": "0.13.5",
+  "version": "0.13.7",
   "description": "Identity context protocol for the agent internet — an MCP where the context is you. CLI for the You.md platform.",
   "bin": {
     "you": "dist/you.js",
@@ -27,6 +27,7 @@
     "test:brain-content": "vitest run src/__tests__/brain-content.test.ts src/__tests__/brain-safe-open-native.test.ts",
     "pretest:brain-content:abi": "npm run build:native",
     "test:brain-content:abi": "node scripts/smoke-safe-open-node.cjs",
+    "test:living-vision-artifact": "node --test scripts/validate-living-vision-artifact.test.mjs",
     "test:watch": "vitest",
     "prepack": "npm run build:native && npm run build",
     "prepublishOnly": "node scripts/check-version-exists.mjs && npm run build:native && npm run build",

package/scripts/validate-living-vision-artifact.mjs

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { execFileSync } from "node:child_process";
+
+const require = createRequire(import.meta.url);
+const Ajv2020 = require("ajv/dist/2020").default;
+const addFormats = require("ajv-formats").default;
+const [jsonPath] = process.argv.slice(2);
+if (!jsonPath) throw new Error("usage: validate-living-vision-artifact.mjs path/to/VISION_ARTIFACT.json");
+const jsonFile = path.resolve(jsonPath);
+function repositoryRoot(start) {
+  let current = fs.realpathSync(start);
+  for (let depth = 0; depth < 12; depth += 1) {
+    if (fs.existsSync(path.join(current, ".git"))) return current;
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  throw new Error("could not find a Git repository from manifest path");
+}
+function safeRepositoryFile(root, relative) {
+  if (typeof relative !== "string" || relative.includes("\\") || path.isAbsolute(relative)
+    || relative.split("/").includes("..")) throw new Error(`unsafe artifact path: ${relative}`);
+  const target = path.resolve(root, relative);
+  if (!target.startsWith(`${root}${path.sep}`)) throw new Error(`artifact path escapes repository: ${relative}`);
+  if (!fs.existsSync(target)) throw new Error(`missing artifact projection ${relative}`);
+  const real = fs.realpathSync(target);
+  if (!real.startsWith(`${root}${path.sep}`)) throw new Error(`artifact projection resolves outside repository: ${relative}`);
+  return real;
+}
+const root = repositoryRoot(path.dirname(jsonFile));
+const manifest = JSON.parse(fs.readFileSync(jsonFile, "utf8"));
+const repositorySchema = path.join(root, "contracts/project-brain/vision-artifacts.schema.json");
+const packagedSchema = path.resolve(import.meta.dirname, "../skills/templates/living-vision-artifact/vision-artifacts.schema.json");
+const schemaPath = fs.existsSync(repositorySchema) ? repositorySchema : packagedSchema;
+if (!fs.existsSync(schemaPath)) throw new Error("Vision Artifact schema is unavailable in both the repository and installed You.md runtime");
+const schema = JSON.parse(fs.readFileSync(schemaPath, "utf8"));
+const ajv = new Ajv2020({ allErrors: true, strict: true });
+addFormats(ajv);
+const validate = ajv.compile(schema);
+if (!validate(manifest)) throw new Error(`invalid Vision Artifact JSON: ${ajv.errorsText(validate.errors)}`);
+for (const artifact of manifest.artifacts) {
+  if (!artifact.candidateRevision) throw new Error(`${artifact.id}: candidateRevision is required for a new Living Vision Artifact`);
+  if (artifact.status === "accepted" && !artifact.lineage.acceptanceRef) throw new Error(`${artifact.id}: accepted artifacts require an attributable acceptanceRef`);
+  if (artifact.status !== "accepted" && artifact.lineage.acceptanceRef) throw new Error(`${artifact.id}: agents must not pre-populate acceptanceRef`);
+  for (const [format, relative] of Object.entries(artifact.formats)) {
+    try { safeRepositoryFile(root, relative); }
+    catch (error) { throw new Error(`${artifact.id}: ${error.message}`); }
+  }
+  try { execFileSync("git", ["rev-parse", "--verify", `${artifact.candidateRevision.slice(4)}^{commit}`], { cwd: root, stdio: "ignore" }); }
+  catch { throw new Error(`${artifact.id}: candidateRevision does not resolve to a local Git commit`); }
+  const markdown = fs.readFileSync(safeRepositoryFile(root, artifact.formats.markdown), "utf8");
+  const html = fs.readFileSync(safeRepositoryFile(root, artifact.formats.html), "utf8");
+  if (!markdown.includes(`Candidate revision:** \`${artifact.candidateRevision}\``)) throw new Error(`${artifact.id}: Markdown is not bound to candidateRevision`);
+  if (/<script\b/i.test(html) || !html.includes(artifact.candidateRevision)) throw new Error(`${artifact.id}: HTML must be script-free and revision-bound`);
+}
+console.log(`validated ${manifest.artifacts.length} Living Vision Artifact(s)`);

package/scripts/validate-living-vision-artifact.test.mjs

@@ -0,0 +1,40 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+const repo = path.resolve(import.meta.dirname, "../..");
+const validator = path.join(repo, "cli/scripts/validate-living-vision-artifact.mjs");
+test("keeps the packaged validator schema identical to the canonical contract", () => {
+  const canonical = JSON.parse(fs.readFileSync(path.join(repo, "contracts/project-brain/vision-artifacts.schema.json"), "utf8"));
+  const packaged = JSON.parse(fs.readFileSync(path.join(repo, "cli/skills/templates/living-vision-artifact/vision-artifacts.schema.json"), "utf8"));
+  assert.deepEqual(packaged, canonical);
+});
+function makeRepo() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "vision-artifact-"));
+  fs.mkdirSync(path.join(root, "contracts/project-brain"), { recursive: true });
+  fs.mkdirSync(path.join(root, "project-context"));
+  fs.copyFileSync(path.join(repo, "contracts/project-brain/vision-artifacts.schema.json"), path.join(root, "contracts/project-brain/vision-artifacts.schema.json"));
+  execFileSync("git", ["init", "-q"], { cwd: root });
+  execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root });
+  execFileSync("git", ["config", "user.name", "Test"], { cwd: root });
+  fs.writeFileSync(path.join(root, "seed.txt"), "seed\n");
+  execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-qm", "seed"], { cwd: root });
+  const sha = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
+  return { root, sha };
+}
+function manifest(sha, status = "proposed") { return {
+  $schema: "https://you.md/schemas/project-vision-artifacts/v1", schemaVersion: "you-md/project-vision-artifacts/v1", kind: "project-vision-artifacts", projectRef: "project:fixture",
+  northStar: { statement: "North star", invariants: ["Invariant"], evidenceRefs: ["project-context/source.md"] },
+  positioning: { youmd: "You", bamfAi: "AI", bamfOs: "OS" },
+  horizons: Object.fromEntries(["year", "quarter", "month", "week"].map((key) => [key, { period: "2026", objective: "Objective", outcomes: ["Outcome"], focusRefs: ["project:fixture"], status: "planned", reviewAt: "2026-12-01T00:00:00.000Z" }])),
+  lanes: [{ id: "vision", name: "Vision", kind: "product", ownerAgentRef: "agent:fixture", scopeRefs: ["project:fixture"], claimMode: "propose", status: "planned", dependsOn: [], reviewAt: "2026-12-01T00:00:00.000Z" }],
+  artifacts: [{ id: "fixture-vision", title: "Fixture Vision", family: "vision", scopeRefs: ["project:fixture"], horizon: "week", version: 1, candidateRevision: `git:${sha}`, status, trustDomain: "owner-private", createdAt: "2026-08-13T00:00:00.000Z", reviewAt: "2026-08-20T00:00:00.000Z", formats: { markdown: "project-context/VISION.md", json: "project-context/VISION_ARTIFACTS.json", html: "project-context/VISION.html" }, lineage: { relation: "main", parentVersionId: null, main: true }, provenance: ["project-context/source.md"] }], updatedAt: "2026-08-13T00:00:00.000Z",
+}; }
+function writeValid(root, sha) { const value = manifest(sha); fs.writeFileSync(path.join(root, "project-context/source.md"), "source\n"); fs.writeFileSync(path.join(root, "project-context/VISION.md"), `# Vision\n\n**Candidate revision:** \`git:${sha}\`\n`); fs.writeFileSync(path.join(root, "project-context/VISION.html"), `<p>git:${sha}</p>`); fs.writeFileSync(path.join(root, "project-context/VISION_ARTIFACTS.json"), JSON.stringify(value)); return value; }
+function run(root) { try { return execFileSync("node", [validator, "project-context/VISION_ARTIFACTS.json"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }); } catch (error) { throw new Error(String(error.stderr || error.message)); } }
+test("validates a nested project-context manifest from its repository root", () => { const { root, sha } = makeRepo(); try { writeValid(root, sha); assert.match(run(root), /validated 1/); } finally { fs.rmSync(root, { recursive: true, force: true }); } });
+test("uses the packaged schema in an arbitrary Git project", () => { const { root, sha } = makeRepo(); try { writeValid(root, sha); fs.rmSync(path.join(root, "contracts"), { recursive: true, force: true }); assert.match(run(root), /validated 1/); } finally { fs.rmSync(root, { recursive: true, force: true }); } });
+test("rejects traversal, missing projections, and unaccepted acceptance receipts", () => { const { root, sha } = makeRepo(); try { const value = writeValid(root, sha); value.artifacts[0].formats.markdown = "../escape.md"; fs.writeFileSync(path.join(root, "project-context/VISION_ARTIFACTS.json"), JSON.stringify(value)); assert.throws(() => run(root), /invalid Vision Artifact JSON/); value.artifacts[0].formats.markdown = "project-context/missing.md"; fs.writeFileSync(path.join(root, "project-context/VISION_ARTIFACTS.json"), JSON.stringify(value)); assert.throws(() => run(root), /missing artifact projection/); value.artifacts[0].formats.markdown = "project-context/VISION.md"; value.artifacts[0].lineage.acceptanceRef = "review:fake"; fs.writeFileSync(path.join(root, "project-context/VISION_ARTIFACTS.json"), JSON.stringify(value)); assert.throws(() => run(root), /must not pre-populate acceptanceRef/); } finally { fs.rmSync(root, { recursive: true, force: true }); } });

package/skills/living-vision-artifact.md

@@ -0,0 +1,35 @@
+---
+name: living-vision-artifact
+version: 1.0.0
+scope: project
+description: "Create or propose a revision-bound Vision Artifact as Markdown, validated JSON, and branded HTML review projection"
+---
+
+# living-vision-artifact
+
+Use this You.md-owned skill for a project vision, strategy, roadmap, audit, plan, report, or brief that requires a durable human-review object. It is not a general document-template skill: it binds to the Project Brain contract at `contracts/project-brain/vision-artifacts.schema.json`.
+
+## Ownership and safety
+
+- Write only under the declared `project-context/` root; never scan or ingest repository-wide HTML.
+- Markdown is the authored, reviewable source. JSON is the manifest/index. HTML is a projection of the exact Markdown/JSON revision, never an independent authority.
+- Do not replace an accepted human vision. Material changes create a new `version`, preserve the prior file, set lineage to `supersedes`/`fork`/`remix`, and remain `proposed` until an attributable human acceptance receipt exists.
+- Never fabricate acceptance, evidence, metrics, Git revisions, lanes, or review dates. An agent may make a candidate only.
+
+## Create or update
+
+1. Read `project-context/VISION_ARTIFACTS.json`, the current accepted artifact, and cited evidence. Resolve the project slug from `.you-project` before writing.
+2. Capture the immutable candidate Git revision with `git rev-parse HEAD`, recorded exactly as `git:<sha>`. If the worktree is dirty, record that fact in the Markdown review note; do not claim the candidate is committed.
+3. Copy the three files in `cli/skills/templates/living-vision-artifact/` using one shared stem, e.g. `PROJECT_STRATEGY_2026-08-13.{md,json,html}`. Fill every placeholder from evidence only.
+4. In the JSON manifest, keep all four horizons and every lane explicit. Give the artifact `status: "proposed"`, `trustDomain`, paths for all three formats, exact provenance paths, a new monotonically increasing version, and lineage with the prior version id. `acceptanceRef` stays absent until human acceptance.
+5. Render the branded HTML from the Markdown/JSON facts: include the artifact id, candidate Git revision, status, horizon, lane ids, provenance, and review date in the visible metadata. Block scripts and external embeds.
+6. Validate with the repository script when present: `node cli/scripts/validate-living-vision-artifact.mjs project-context/VISION_ARTIFACTS.json`. In another project, use the installed runtime: `node ~/.you/npm-current/lib/node_modules/youmd/scripts/validate-living-vision-artifact.mjs project-context/VISION_ARTIFACTS.json`. It carries the contract schema and checks exact three-format paths, candidate revision bindings, no-script HTML, and acceptance discipline. Then verify every claimed Git ref resolves locally. In the You.md source repo, also run `npm run project-brain:contract-check`.
+7. Present the candidate and exact Git revision for human review. Only after a human supplies an attributable receipt may a separate proposal change it to `accepted` and set `lineage.acceptanceRef` to an immutable receipt/ref.
+
+## Required Markdown sections
+
+Use: `Decision status`, `Candidate revision`, `North Star`, `Positioning`, `Horizons`, `Lanes`, `Evidence and provenance`, `Lineage`, `Human review`. State the unresolved question or explicitly say none.
+
+## Update rule
+
+Cosmetic HTML repairs may retain a version only if Markdown and JSON semantics and their candidate revision are unchanged. Any change to North Star, positioning, horizon outcome, lane scope/status, trust domain, or provenance requires a new proposed version.

package/skills/templates/living-vision-artifact/VISION_ARTIFACT.html

@@ -0,0 +1 @@
+<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>{{title}}</title><style>body{margin:0;background:#0d0d0d;color:#e8e4df;font:16px/1.6 Inter,system-ui,sans-serif}main{max-width:900px;margin:auto;padding:64px 28px}code,.meta,h1,h2{font-family:"JetBrains Mono",monospace}h1{font-size:clamp(2.4rem,7vw,5rem);line-height:1.05}.meta{color:#c46a3a;border-block:1px solid #332d28;padding:14px 0}h2{margin-top:3rem}a{color:#c46a3a}</style></head><body><main><p class="meta">{{artifact_id}} · {{status}} · candidate git:{{git_sha}} · {{horizon}} · review {{review_at}}</p><h1>{{title}}</h1><section><h2>North Star</h2><p>{{north_star}}</p></section><section><h2>Lanes</h2><p>{{lane_summary}}</p></section><section><h2>Evidence</h2><p>{{provenance_summary}}</p></section><section><h2>Human review</h2><p>{{review_request}}</p></section></main></body></html>

package/skills/templates/living-vision-artifact/VISION_ARTIFACT.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://you.md/schemas/project-vision-artifacts/v1",
+  "schemaVersion": "you-md/project-vision-artifacts/v1",
+  "kind": "project-vision-artifacts",
+  "projectRef": "project:{{project_slug}}",
+  "northStar": { "statement": "{{north_star}}", "invariants": ["{{invariant}}"], "evidenceRefs": ["{{evidence_path}}"] },
+  "positioning": { "youmd": "{{youmd_positioning}}", "bamfAi": "{{bamf_ai_positioning}}", "bamfOs": "{{bamf_os_positioning}}" },
+  "horizons": {
+    "year": { "period": "{{year_period}}", "objective": "{{year_objective}}", "outcomes": ["{{year_outcome}}"], "focusRefs": ["{{focus_ref}}"], "status": "planned", "reviewAt": "{{year_review_at}}" },
+    "quarter": { "period": "{{quarter_period}}", "objective": "{{quarter_objective}}", "outcomes": ["{{quarter_outcome}}"], "focusRefs": ["{{focus_ref}}"], "status": "planned", "reviewAt": "{{quarter_review_at}}" },
+    "month": { "period": "{{month_period}}", "objective": "{{month_objective}}", "outcomes": ["{{month_outcome}}"], "focusRefs": ["{{focus_ref}}"], "status": "planned", "reviewAt": "{{month_review_at}}" },
+    "week": { "period": "{{week_period}}", "objective": "{{week_objective}}", "outcomes": ["{{week_outcome}}"], "focusRefs": ["{{focus_ref}}"], "status": "planned", "reviewAt": "{{week_review_at}}" }
+  },
+  "lanes": [{ "id": "{{lane_id}}", "name": "{{lane_name}}", "kind": "product", "ownerAgentRef": "agent:{{owner_agent}}", "scopeRefs": ["{{scope_ref}}"], "claimMode": "propose", "status": "planned", "dependsOn": [], "reviewAt": "{{lane_review_at}}" }],
+  "artifacts": [{ "id": "{{artifact_id}}", "title": "{{title}}", "family": "vision", "scopeRefs": ["{{scope_ref}}"], "horizon": "week", "version": 1, "candidateRevision": "git:{{git_sha}}", "status": "proposed", "trustDomain": "owner-private", "createdAt": "{{created_at}}", "reviewAt": "{{review_at}}", "formats": { "markdown": "{{markdown_path}}", "json": "{{json_path}}", "html": "{{html_path}}" }, "lineage": { "relation": "main", "parentVersionId": null, "main": true }, "provenance": ["{{evidence_path}}"] }],
+  "updatedAt": "{{created_at}}"
+}

package/skills/templates/living-vision-artifact/VISION_ARTIFACT.md

@@ -0,0 +1,39 @@
+# {{title}}
+
+**Decision status:** proposed — human review required  
+**Candidate revision:** `git:{{git_sha}}`  
+**Artifact id / version:** `{{artifact_id}}` / {{version}}  
+**Review at:** {{review_at}}
+
+## North Star
+
+{{north_star}}
+
+## Positioning
+
+{{positioning}}
+
+## Horizons
+
+| Horizon | Objective | Outcomes | Review |
+| --- | --- | --- | --- |
+| Year | {{year_objective}} | {{year_outcomes}} | {{year_review_at}} |
+| Quarter | {{quarter_objective}} | {{quarter_outcomes}} | {{quarter_review_at}} |
+| Month | {{month_objective}} | {{month_outcomes}} | {{month_review_at}} |
+| Week | {{week_objective}} | {{week_outcomes}} | {{week_review_at}} |
+
+## Lanes
+
+{{lanes}}
+
+## Evidence and provenance
+
+{{provenance}}
+
+## Lineage
+
+{{lineage}}
+
+## Human review
+
+{{review_request}}

package/skills/templates/living-vision-artifact/vision-artifacts.schema.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://you.md/schemas/project-vision-artifacts/v1",
+  "title": "You.md Project Vision Artifacts Index",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schemaVersion", "kind", "projectRef", "northStar", "positioning", "horizons", "lanes", "artifacts", "updatedAt"],
+  "properties": {
+    "$schema": { "const": "https://you.md/schemas/project-vision-artifacts/v1" },
+    "schemaVersion": { "const": "you-md/project-vision-artifacts/v1" },
+    "kind": { "const": "project-vision-artifacts" },
+    "projectRef": { "$ref": "#/$defs/projectRef" },
+    "northStar": { "type": "object", "additionalProperties": false, "required": ["statement", "invariants", "evidenceRefs"], "properties": {
+      "statement": { "type": "string", "minLength": 1, "maxLength": 1200 },
+      "invariants": { "type": "array", "minItems": 1, "maxItems": 32, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 1200 } },
+      "evidenceRefs": { "type": "array", "minItems": 1, "maxItems": 64, "uniqueItems": true, "items": { "$ref": "#/$defs/relativePath" } }
+    } },
+    "positioning": { "type": "object", "additionalProperties": false, "required": ["youmd", "bamfAi", "bamfOs"], "properties": {
+      "youmd": { "type": "string", "minLength": 1, "maxLength": 1200 },
+      "bamfAi": { "type": "string", "minLength": 1, "maxLength": 1200 },
+      "bamfOs": { "type": "string", "minLength": 1, "maxLength": 1200 }
+    } },
+    "horizons": { "type": "object", "additionalProperties": false, "required": ["year", "quarter", "month", "week"], "properties": {
+      "year": { "$ref": "#/$defs/horizon" }, "quarter": { "$ref": "#/$defs/horizon" }, "month": { "$ref": "#/$defs/horizon" }, "week": { "$ref": "#/$defs/horizon" }
+    } },
+    "lanes": { "type": "array", "maxItems": 64, "items": { "type": "object", "additionalProperties": false, "required": ["id", "name", "kind", "ownerAgentRef", "scopeRefs", "claimMode", "status", "dependsOn", "reviewAt"], "properties": {
+      "id": { "$ref": "#/$defs/id" }, "name": { "type": "string", "minLength": 1, "maxLength": 160 },
+      "kind": { "enum": ["product", "implementation", "qa", "companion"] },
+      "ownerAgentRef": { "type": "string", "pattern": "^agent:[A-Za-z0-9][A-Za-z0-9._:/-]{0,190}$" },
+      "scopeRefs": { "type": "array", "minItems": 1, "maxItems": 64, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 220 } },
+      "claimMode": { "enum": ["evidence-only", "propose", "managed-write"] }, "status": { "enum": ["planned", "active", "blocked", "review", "done"] },
+      "dependsOn": { "type": "array", "maxItems": 32, "uniqueItems": true, "items": { "$ref": "#/$defs/id" } },
+      "lastReceiptRef": { "type": "string", "minLength": 1, "maxLength": 220 }, "reviewAt": { "type": "string", "format": "date-time" }
+    } } },
+    "artifacts": { "type": "array", "maxItems": 512, "items": { "type": "object", "additionalProperties": false, "required": ["id", "title", "family", "scopeRefs", "version", "status", "trustDomain", "createdAt", "reviewAt", "formats", "lineage", "provenance"], "properties": {
+      "id": { "$ref": "#/$defs/id" }, "title": { "type": "string", "minLength": 1, "maxLength": 240 },
+      "family": { "enum": ["vision", "north-star", "strategy", "planning", "audit", "operations"] },
+      "scopeRefs": { "type": "array", "minItems": 1, "maxItems": 64, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 220 } },
+      "horizon": { "enum": ["year", "quarter", "month", "week"] }, "version": { "type": "integer", "minimum": 1 },
+      "candidateRevision": { "type": "string", "pattern": "^git:[a-f0-9]{7,64}$" },
+      "status": { "enum": ["draft", "proposed", "accepted", "superseded"] }, "trustDomain": { "enum": ["owner-private", "project-private", "shared", "public"] },
+      "createdAt": { "type": "string", "format": "date-time" }, "reviewAt": { "type": "string", "format": "date-time" },
+      "formats": { "type": "object", "additionalProperties": false, "minProperties": 1, "properties": {
+        "markdown": { "$ref": "#/$defs/relativePath" }, "html": { "$ref": "#/$defs/relativePath" }, "json": { "$ref": "#/$defs/relativePath" }
+      } },
+      "lineage": { "type": "object", "additionalProperties": false, "required": ["relation", "parentVersionId", "main"], "properties": {
+        "relation": { "enum": ["main", "fork", "remix", "supersedes"] }, "parentVersionId": { "type": ["string", "null"], "maxLength": 220 },
+        "main": { "type": "boolean" }, "acceptanceRef": { "type": "string", "minLength": 1, "maxLength": 220 }
+      } },
+      "provenance": { "type": "array", "minItems": 1, "maxItems": 64, "uniqueItems": true, "items": { "$ref": "#/$defs/relativePath" } }
+    } } },
+    "updatedAt": { "type": "string", "format": "date-time" }
+  },
+  "$defs": {
+    "projectRef": { "type": "string", "pattern": "^project:[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$" },
+    "id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,127}$" },
+    "relativePath": { "type": "string", "minLength": 1, "maxLength": 500, "pattern": "^(?!/)(?![A-Za-z]:)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)(?:\\.{1,2})(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$)[^/]+(?:/[^/]+)*$" },
+    "horizon": { "type": "object", "additionalProperties": false, "required": ["period", "objective", "outcomes", "focusRefs", "status", "reviewAt"], "properties": {
+      "period": { "type": "string", "minLength": 1, "maxLength": 40 }, "objective": { "type": "string", "minLength": 1, "maxLength": 1200 },
+      "outcomes": { "type": "array", "minItems": 1, "maxItems": 32, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 1200 } },
+      "focusRefs": { "type": "array", "maxItems": 64, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 220 } },
+      "status": { "enum": ["planned", "active", "review", "done"] }, "reviewAt": { "type": "string", "format": "date-time" }
+    } }
+  }
+}