agent-wiki-cli 2.3.0__tar.gz → 2.3.1__tar.gz

{agent_wiki_cli-2.3.0/src/agent_wiki_cli.egg-info → agent_wiki_cli-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-wiki-cli
-Version: 2.3.0
+Version: 2.3.1
 Summary: CLI tool to maintain hybrid LLM Wikis for multi-language projects.
 Author-email: Denis Sivagin <denissvgn@gmail.com>
 License-Expression: MIT

{agent_wiki_cli-2.3.0 → agent_wiki_cli-2.3.1}/pyproject.toml

@@ -5,7 +5,7 @@ backend-path = ["."]
 
 [project]
 name = "agent-wiki-cli"
-version = "2.3.0"
+version = "2.3.1"
 description = "CLI tool to maintain hybrid LLM Wikis for multi-language projects."
 readme = "README.md"
 license = "MIT"

{agent_wiki_cli-2.3.0 → agent_wiki_cli-2.3.1/src/agent_wiki_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-wiki-cli
-Version: 2.3.0
+Version: 2.3.1
 Summary: CLI tool to maintain hybrid LLM Wikis for multi-language projects.
 Author-email: Denis Sivagin <denissvgn@gmail.com>
 License-Expression: MIT

{agent_wiki_cli-2.3.0 → agent_wiki_cli-2.3.1}/src/agent_wiki_cli.egg-info/SOURCES.txt

@@ -349,10 +349,12 @@ tests/test_core_check_performance.py
 tests/test_core_shard_runner.py
 tests/test_core_shard_workflow.py
 tests/test_core_shards.py
+tests/test_credential_named_knowledge.py
 tests/test_data_flow.py
 tests/test_dep_vuln_triage_skill.py
 tests/test_dependencies.py
 tests/test_dependencies_external.py
+tests/test_dependency_audit.py
 tests/test_dependency_downloads.py
 tests/test_dependency_setup_probe.py
 tests/test_dependency_setup_workflow.py

{agent_wiki_cli-2.3.0 → agent_wiki_cli-2.3.1}/src/llm_wiki_cli/services/concept_identity.py

@@ -1,4 +1,4 @@
-"""Pure stable-identity primitives for governed knowledge concepts.
+"""Pure stable-identity primitives for knowledge concepts.
 
 The records in this module deliberately contain no filesystem behavior.  They
 validate the small identity vocabulary used by a governance ledger, derive an
@@ -20,6 +20,7 @@ from enum import Enum
 from typing import TypeVar, cast
 from urllib.parse import quote, unquote, urlsplit
 
+from .validation import require_repository_relative_path
 from .wiki_surface import (
     WikiSurfaceError,
     canonical_path,
@@ -315,6 +316,35 @@ def validate_concept_kind(value: object) -> str:
     return text
 
 
+def natural_key_for(concept_kind: str, canonical_path: str) -> str:
+    """Build a natural key from safe coordinates, independent of governance.
+
+    Credential-related words are ordinary identifier text. Coordinate grammar
+    rejects unsafe paths and credential-bearing authorities; it does not apply
+    the separate policy for credential-like governance metadata fields.
+    """
+
+    kind = validate_concept_kind(concept_kind)
+    path = require_repository_relative_path(
+        canonical_path,
+        text_error=ConceptIdentityError(
+            "canonical_path", "must be a repository-relative POSIX path"
+        ),
+        posix_error=ConceptIdentityError(
+            "canonical_path", "must be a repository-relative POSIX path"
+        ),
+        normalized_error=ConceptIdentityError(
+            "canonical_path", "must be a normalized relative path"
+        ),
+        control_error=ConceptIdentityError(
+            "canonical_path", "must not contain control characters"
+        ),
+        reject_delete_character=True,
+        control_after_normalization=True,
+    )
+    return validate_natural_key(f"{kind}:{path}")
+
+
 def validate_natural_key(value: object) -> str:
     """Validate one normalized, non-prose concept natural key.
 

{agent_wiki_cli-2.3.0 → agent_wiki_cli-2.3.1}/src/llm_wiki_cli/services/knowledge_governance.py

@@ -41,10 +41,12 @@ from .concept_identity import (
     ConceptIdentityError,
     derive_concept_uid as _derive_identity_uid,
     identity_coordinate_key,
+    natural_key_for as _identity_natural_key_for,
     validate_alias_value,
     validate_bundle_id,
     validate_concept_kind,
     validate_concept_uid,
+    validate_locator,
     validate_natural_key,
 )
 from .knowledge_evidence import (
@@ -68,7 +70,6 @@ from .validation import (
     require_mapping,
     require_no_control_characters,
     require_nonnegative_int,
-    require_repository_relative_path,
     require_sha256,
 )
 from .wiki_media import contains_uri_authority_userinfo
@@ -389,11 +390,12 @@ def natural_key_for(
     concept_kind: str,
     canonical_path: str,
 ) -> str:
-    """Build the initial natural key without using an absolute checkout path."""
+    """Build a shared natural key with governance-compatible diagnostics."""
 
-    kind = _concept_kind(concept_kind, "concept_kind")
-    path = _relative_path(canonical_path, "canonical_path")
-    return _natural_key(f"{kind}:{path}", "natural_key")
+    try:
+        return _identity_natural_key_for(concept_kind, canonical_path)
+    except ConceptIdentityError as exc:
+        raise GovernanceError(exc.field, exc.message) from exc
 
 
 def derive_concept_uid(
@@ -3307,28 +3309,6 @@ def _identity_ownership_key(alias_type: str, value: str) -> str:
         raise GovernanceError("identity", exc.message) from exc
 
 
-def _relative_path(value: object, path: str) -> str:
-    result = require_repository_relative_path(
-        value,
-        text_error=GovernanceError(
-            path, "must be a repository-relative POSIX path"
-        ),
-        posix_error=GovernanceError(
-            path, "must be a repository-relative POSIX path"
-        ),
-        normalized_error=GovernanceError(
-            path, "must be a normalized relative path"
-        ),
-        control_error=GovernanceError(
-            path, "must not contain control characters"
-        ),
-        reject_delete_character=True,
-        control_after_normalization=True,
-    )
-    _safe_text(result, path)
-    return result
-
-
 def _section_locator(value: object, path: str) -> str:
     if (
         not isinstance(value, str)
@@ -3341,7 +3321,22 @@ def _section_locator(value: object, path: str) -> str:
             path,
             "must be an exact llm-wiki section locator",
         )
-    _safe_text(value, path)
+    page_locator, _, section_path = value.partition("#section/")
+    if not section_path:
+        raise GovernanceError(path, "must contain a section coordinate")
+    try:
+        validate_locator(page_locator)
+    except ConceptIdentityError as exc:
+        raise GovernanceError(path, exc.message) from exc
+    # Page identifiers and heading text may legitimately discuss credentials.
+    # Validate coordinates independently of actor/method metadata safeguards.
+    require_no_control_characters(
+        value,
+        error=GovernanceError(path, "must not contain control characters"),
+        reject_delete_character=True,
+    )
+    if contains_uri_authority_userinfo(value):
+        raise GovernanceError(path, "must not contain URI credentials")
     return value
 
 

{agent_wiki_cli-2.3.0 → agent_wiki_cli-2.3.1}/src/llm_wiki_cli/services/knowledge_storage.py

@@ -160,9 +160,25 @@ def _node_aliases(node: Any) -> set[str]:
 
 
 def _concept_aliases(concept: Mapping[str, Any]) -> set[str]:
-    from .knowledge_governance import natural_key_for
+    from .concept_identity import ConceptIdentityError, natural_key_for, validate_locator
+
+    path = concept["document"]["canonical_path"]
+    try:
+        natural_key = natural_key_for(concept["concept_kind"], path)
+    except ConceptIdentityError as exc:
+        # Include only a validated page coordinate; unsafe values (including
+        # URI credentials) must never be reflected in storage diagnostics.
+        try:
+            coordinate = repr(validate_locator(path))
+        except ConceptIdentityError:
+            coordinate = "a concept (invalid canonical path omitted)"
+        raise KnowledgeStorageError(
+            f"concepts.aliases.{exc.field}",
+            f"cannot build lookup identity for {coordinate}: {exc.message}",
+            code="storage-identity-invalid",
+        ) from exc
     aliases = {"concept:" + concept["locator"], "page:" + concept["document"]["canonical_path"],
-               "concept:" + natural_key_for(concept["concept_kind"], concept["document"]["canonical_path"]),
+               "concept:" + natural_key,
                _owner(concept), *("term:" + term for term in re.findall(r"\w+", concept["title"].casefold())[:64])}
     from .contracts import GOVERNANCE_EXTENSION_KEY
     governance = concept.get("extensions", {}).get(GOVERNANCE_EXTENSION_KEY)

{agent_wiki_cli-2.3.0 → agent_wiki_cli-2.3.1}/src/llm_wiki_cli/services/knowledge_storage_access.py

@@ -8,9 +8,10 @@ import json
 from pathlib import Path
 from typing import Any
 
+from .concept_identity import natural_key_for
 from .knowledge_envelope import EvaluatedEnvelope
 from .knowledge_governance import (
-    GOVERNANCE_FILENAME, parse_governance_ledger, lifecycle_state_by_uid, natural_key_for,
+    GOVERNANCE_FILENAME, parse_governance_ledger, lifecycle_state_by_uid,
 )
 from .contracts import GOVERNANCE_EXTENSION_KEY
 from .knowledge_model import _parse_bundle

{agent_wiki_cli-2.3.0 → agent_wiki_cli-2.3.1}/tests/test_architecture_layers.py

@@ -41,6 +41,7 @@ _VALIDATION_DUPLICATE_EXEMPT_NAMES = frozenset(
 )
 REQUIRED_SHARED_VALIDATION_ADAPTERS_BY_FAMILY = {
     "bootstrap_runtime": frozenset({"_path_text", "_safe_page_component"}),
+    "concept_identity": frozenset({"natural_key_for"}),
     "context_service": frozenset({"_nonnegative_count"}),
     "data_flow": frozenset({"_positive_source_line"}),
     "dependencies": frozenset(
@@ -197,7 +198,6 @@ REQUIRED_SHARED_VALIDATION_ADAPTERS_BY_FAMILY = {
             "_hash",
             "_nonnegative_int",
             "_object",
-            "_relative_path",
         }
     ),
     "knowledge_graph": frozenset(

{agent_wiki_cli-2.3.0 → agent_wiki_cli-2.3.1}/tests/test_concept_identity.py

@@ -22,6 +22,7 @@ from llm_wiki_cli.services.concept_identity import (
     find_identity_collisions,
     identity_coordinate_key,
     move_allocation,
+    natural_key_for,
     validate_alias_value,
     validate_bundle_id,
     validate_concept_kind,
@@ -195,6 +196,50 @@ def test_natural_key_accepts_occurrence_fragments_and_canonical_utf8_escapes():
     )
 
 
+@pytest.mark.parametrize("name", [
+    "RuntimeSecretField", "SecretMaterialError", "ResetPasswordForm",
+    "PasswdEntry", "ApiKeySettings", "AccessTokenProvider", "PrivateKeyStore",
+])
+def test_natural_key_construction_accepts_credential_related_identifiers(name):
+    from llm_wiki_cli.services import knowledge_governance
+
+    path = f"entities/{name}.md"
+    expected = f"code-entity:{path}"
+    assert natural_key_for("code-entity", path) == expected
+    assert knowledge_governance.natural_key_for("code-entity", path) == expected
+    assert validate_locator(f"llm-wiki://entities/{name}") == f"llm-wiki://entities/{name}"
+
+
+def test_natural_key_construction_preserves_existing_identity_bytes():
+    key = natural_key_for("source-module", "modules/core.md")
+    assert key == "source-module:modules/core.md"
+    assert derive_concept_uid("bundle:project-1", "source-module", key) == (
+        "lw:module:27b9ae241cad1427564442436cbc22a2"
+    )
+
+
+@pytest.mark.parametrize("path", [
+    "", None, "/tmp/entities/core.md", "C:/wiki/entities/core.md", "C:core.md",
+    r"entities\core.md", "entities/../core.md", "entities/./core.md",
+    "entities//core.md", "entities/core.md/", "entities/CON.md",
+    "entities/core.md ", "entities/core\x00.md", "entities/core\x7f.md",
+    "entities/core\u200b.md", "entities/%2E%2E/core.md", "entities/%GG.md",
+    "https://user:CREDENTIAL_SENTINEL@example.test/core.md",
+    "user:CREDENTIAL_SENTINEL@example.test/core.md",
+    "git@example.test/core.md",
+])
+def test_natural_key_construction_keeps_path_and_credential_safeguards(path):
+    from llm_wiki_cli.services import knowledge_governance
+
+    with pytest.raises(ConceptIdentityError) as identity_error:
+        natural_key_for("code-entity", path)
+    with pytest.raises(knowledge_governance.GovernanceError) as governance_error:
+        knowledge_governance.natural_key_for("code-entity", path)
+    assert identity_error.value.field in {"canonical_path", "natural_key"}
+    assert str(identity_error.value) == str(governance_error.value)
+    assert "CREDENTIAL_SENTINEL" not in str(identity_error.value)
+
+
 @pytest.mark.parametrize(
     "value",
     [

{agent_wiki_cli-2.3.0 → agent_wiki_cli-2.3.1}/tests/test_core_check_performance.py

@@ -249,6 +249,7 @@ def test_extracted_input_changes_are_rejected(frozen, tmp_path):
         ("python_peak_bytes", 100),
         ("input_tree_sha256", {}),
         ("policy_sha256", "b" * 64),
+        ("adapter_inventory_sha256", "b" * 64),
     ],
 )
 def test_observation_results_are_bound_and_finite(field, value):
@@ -261,6 +262,7 @@ def test_observation_results_are_bound_and_finite(field, value):
         "python_peak_bytes": None,
         "input_tree_sha256": "c" * 64,
         "policy_sha256": "a" * 64,
+        "adapter_inventory_sha256": None,
     }
     changed = deepcopy(row)
     changed[field] = value
@@ -399,3 +401,153 @@ def test_failed_windows_tree_cleanup_is_reported_and_root_is_reaped(
             ["owned"], cwd=tmp_path, env={}, log=io.BytesIO(), platform_name="nt"
         )
     assert process.killed and process.waits == 2
+
+
+def _inventory_work(tmp_path):
+    work = tmp_path / "work"
+    for role, inventory in (
+        ("baseline", "{'knowledge_governance': frozenset({'_relative_path'})}"),
+        ("candidate", "{'concept_identity': frozenset({'natural_key_for'})}"),
+    ):
+        policy = work / role / "tests/test_architecture_layers.py"
+        policy.parent.mkdir(parents=True)
+        policy.write_text(
+            "import ast\nfrom pathlib import Path\n"
+            f"{performance.ADAPTER_INVENTORY} = {inventory}\n"
+            "def test_shared_validation_adapters_remain_thin():\n"
+            "    root = Path(__file__).parents[1] / 'src/llm_wiki_cli/services'\n"
+            f"    for family, names in {performance.ADAPTER_INVENTORY}.items():\n"
+            "        tree = ast.parse((root / (family + '.py')).read_text())\n"
+            "        defined = {n.name for n in ast.walk(tree) if isinstance(n, ast.FunctionDef)}\n"
+            "        assert names <= defined\n",
+            encoding="utf-8",
+        )
+    services = work / "candidate/src/llm_wiki_cli/services"
+    services.mkdir(parents=True)
+    (services / "concept_identity.py").write_text("def natural_key_for(value):\n    return value\n")
+    return work
+
+
+@pytest.fixture
+def policy_imports():
+    previous_path = sys.path[:]
+    previous_modules = {name: module for name, module in sys.modules.items()
+                        if name == "tests" or name.startswith("tests.")}
+    try:
+        yield
+    finally:
+        sys.path[:] = previous_path
+        for name in list(sys.modules):
+            if name == "tests" or name.startswith("tests."):
+                del sys.modules[name]
+        sys.modules.update(previous_modules)
+
+
+def test_moved_adapter_inventory_is_identical_input_for_both_policy_workers(tmp_path):
+    work = _inventory_work(tmp_path)
+    inventory = performance.comparison_inventory(work)
+    assert inventory["removed"] == [["knowledge_governance", "_relative_path"]]
+    assert inventory["added"] == [["concept_identity", "natural_key_for"]]
+    assert inventory["baseline_sha256"] != inventory["candidate_sha256"]
+    before = performance.tree_identity(work)
+    for role in ("baseline", "candidate"):
+        output = tmp_path / f"{role}.json"
+        result = subprocess.run(
+            [sys.executable, "-I", "-B", performance.__file__, "worker", "--work", str(work),
+             "--inputs", str(tmp_path), "--role", role, "--target", "adapters", "--output", str(output)],
+            stdin=subprocess.DEVNULL, capture_output=True, text=True, timeout=30,
+        )
+        assert result.returncode == 0, result.stderr
+        row = json.loads(output.read_text())
+        performance.validate_observation(
+            row, target="adapters", role=role, coverage=False, memory=False,
+            policy_sha256=performance.digest(work / role / "tests/test_architecture_layers.py"),
+            adapter_inventory_sha256=inventory["candidate_sha256"],
+        )
+        with pytest.raises(ValueError, match="identity"):
+            performance.validate_observation(
+                row, target="adapters", role=role, coverage=False, memory=False,
+                policy_sha256=row["policy_sha256"], adapter_inventory_sha256=inventory["baseline_sha256"],
+            )
+    assert performance.tree_identity(work) == before
+
+
+@pytest.mark.parametrize("role", ["baseline", "candidate"])
+def test_worker_retains_failed_assertion_traceback_with_current_inventory(tmp_path, role):
+    work = _inventory_work(tmp_path)
+    (work / "candidate/src/llm_wiki_cli/services/concept_identity.py").write_text("")
+    output = tmp_path / "observation.json"
+    result = subprocess.run(
+        [sys.executable, "-I", "-B", performance.__file__, "worker", "--work", str(work),
+         "--inputs", str(tmp_path), "--role", role, "--target", "adapters", "--output", str(output)],
+        stdin=subprocess.DEVNULL, capture_output=True, text=True, timeout=30,
+    )
+    assert result.returncode == 1
+    assert "test_shared_validation_adapters_remain_thin" in result.stderr
+    assert "AssertionError" in result.stderr
+    assert not output.exists()
+
+
+@pytest.mark.parametrize("relative", ["knowledge_governance.py", "knowledge_governance/nested.py"])
+def test_comparison_cannot_drop_requirements_for_remaining_definitions(tmp_path, relative):
+    work = _inventory_work(tmp_path)
+    path = work / "candidate/src/llm_wiki_cli/services" / relative
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text("class Adapter:\n    def _relative_path(self, value):\n        return value\n")
+    with pytest.raises(ValueError, match="required adapter that still exists"):
+        performance.comparison_inventory(work)
+
+
+@pytest.mark.parametrize("declaration", [
+    "get_inventory()", "{'../escape': frozenset({'validate'})}",
+    "{'owner': frozenset({123})}", "{'owner': frozenset(build_names())}",
+    "{'owner': frozenset({'one'}), 'owner': frozenset({'two'})}",
+])
+def test_adapter_inventory_rejects_nonliteral_or_ambiguous_data(tmp_path, declaration):
+    policy = tmp_path / "tests/test_architecture_layers.py"
+    policy.parent.mkdir()
+    policy.write_text(f"{performance.ADAPTER_INVENTORY} = {declaration}\n")
+    with pytest.raises(ValueError):
+        performance.adapter_inventory(tmp_path)
+
+
+def test_adapter_inventory_accepts_an_empty_literal_frozenset(tmp_path):
+    policy = tmp_path / "tests/test_architecture_layers.py"
+    policy.parent.mkdir()
+    policy.write_text(f"{performance.ADAPTER_INVENTORY} = {{'owner': frozenset()}}\n")
+    assert performance.adapter_inventory(tmp_path) == {"owner": []}
+
+
+def test_mixed_missing_inventory_is_not_silently_accepted(tmp_path):
+    work = _inventory_work(tmp_path)
+    (work / "baseline/tests/test_architecture_layers.py").write_text("pass\n")
+    with pytest.raises(ValueError, match="both policies"):
+        performance.comparison_inventory(work)
+
+
+def test_runtime_inventory_must_match_its_frozen_declaration(tmp_path, policy_imports):
+    work = _inventory_work(tmp_path)
+    policy = work / "baseline/tests/test_architecture_layers.py"
+    policy.write_text(policy.read_text() + f"\n{performance.ADAPTER_INVENTORY}.clear()\n")
+    inventory = performance.adapter_inventory(work / "baseline")
+    module = performance.load_policy(work / "baseline", work / "candidate", policy.name, "baseline")
+    with pytest.raises(ValueError, match="changed its declared adapter inventory"):
+        performance.bind_inventory(module, inventory, performance.adapter_inventory(work / "candidate"))
+
+
+def test_complete_adapter_controls_detect_a_weakened_candidate_assertion(tmp_path, policy_imports):
+    work = tmp_path / "work"
+    tests = Path(__file__).parent
+    for role in ("baseline", "candidate"):
+        target = work / role / "tests"
+        target.mkdir(parents=True)
+        (target / "__init__.py").write_text("")
+        for name in ("test_architecture_layers.py", "python_source_inventory.py"):
+            shutil.copyfile(tests / name, target / name)
+    args = argparse.Namespace(work=work)
+    results = performance.adapter_control_parity(args)
+    assert [r["expected_pass"] for r in results] == [True, False, False, False, False]
+    policy = work / "candidate/tests/test_architecture_layers.py"
+    policy.write_text(policy.read_text() + "\ndef test_shared_validation_adapters_remain_thin():\n    pass\n")
+    with pytest.raises(ValueError, match="adapter control outcome differs: missing/candidate"):
+        performance.adapter_control_parity(args)

agent_wiki_cli-2.3.1/tests/test_credential_named_knowledge.py

@@ -0,0 +1,172 @@
+"""Credential-related identifiers survive storage and governance operations."""
+
+import hashlib
+import sys
+
+import pytest
+
+from llm_wiki_cli import api
+from llm_wiki_cli.cli import main
+from llm_wiki_cli.services.io import read_md, write_md
+from llm_wiki_cli.services.knowledge_governance import (
+    GOVERNANCE_FILENAME, load_governance,
+)
+from llm_wiki_cli.services.knowledge_loader import load_knowledge_state
+from llm_wiki_cli.services.knowledge_storage import KnowledgeStorageError
+from llm_wiki_cli.services.knowledge_storage_access import capture_knowledge_slice
+from llm_wiki_cli.services.knowledge_storage_diagnostics import storage_report
+from llm_wiki_cli.services.knowledge_storage_lifecycle import (
+    export_knowledge_v1, migrate_knowledge_storage, recover_knowledge_storage,
+)
+from llm_wiki_cli.services.section_ownership import observe_page_sections
+from llm_wiki_cli.services.wiki_surface import PageKind
+from tests.test_knowledge_storage_lifecycle import snapshot
+
+
+NAMES = (
+    "RuntimeSecretField", "SecretMaterialError", "ResetPasswordForm",
+    "PasswdEntry", "ApiKeySettings", "AccessTokenProvider", "PrivateKeyStore",
+)
+
+
+@pytest.fixture(params=[False, True], ids=["ungoverned", "governed"])
+def credential_named_wiki(tmp_path, monkeypatch, capsys, request):
+    monkeypatch.chdir(tmp_path)
+    # Do not discover the caller's Git repository under a custom pytest base.
+    (tmp_path / ".git").write_text("gitdir: absent\n", encoding="utf-8")
+    source = tmp_path / "source"
+    source.mkdir()
+    (source / "models.py").write_text(
+        "\n\n".join(f'class {name}:\n    """A documented field type."""\n    pass' for name in NAMES),
+        encoding="utf-8",
+    )
+    root = tmp_path / "wiki"
+    api.bootstrap_wiki(str(source), str(root), skip_workflows=True,
+                       skip_flows=True, skip_dependencies=True)
+
+    def command(*args):
+        monkeypatch.setattr(sys, "argv", ["llm-wiki", *args])
+        main()
+        return capsys.readouterr()
+
+    page = root / "entities" / "RuntimeSecretField.md"
+    content = read_md(page)
+    assert "## Description" in content
+    authored = content.replace("## Description", "## Description\n\nPreserve this authored explanation.", 1)
+    # Exercise Windows-style input on every host. The owning writer emits the
+    # canonical UTF-8/LF bytes required by storage and task receipt commitments.
+    write_md(page, authored.replace("\n", "\r\n"))
+    assert page.read_bytes() == authored.encode("utf-8")
+    command("sync", "--src-dir", "source", "--wiki-dir", "wiki", "--jobs", "1",
+            "--no-plugins", "--progress", "never")
+    selectors = [f"code-entity:entities/{name}.md" for name in NAMES]
+    if request.param:
+        command("knowledge", "init", "--wiki-dir", "wiki")
+        ledger = load_governance(root).ledger
+        assert ledger is not None
+        allocation = next(a for a in ledger.concepts.values()
+                          if a.locator == "llm-wiki://entities/RuntimeSecretField")
+        historical = "llm-wiki://entities/PreviousSecretField"
+        command("knowledge", "alias", "--wiki-dir", "wiki", "--uid", allocation.uid,
+                "--type", "locator", "--value", historical)
+        observed = observe_page_sections(page.read_text(encoding="utf-8"), allocation.locator, PageKind.ENTITIES)
+        section = next(s for s in observed.sections if s.title == "Description" and s.semantic_hash is not None)
+        command("knowledge", "review", "--wiki-dir", "wiki", "--uid", allocation.uid,
+                "--section", section.locator, "--reviewer-kind", "human", "--reviewer-id", "reviewer-1",
+                "--method", "manual-review", "--method-version", "1", "--authored-at", "2026-09-28T12:00:00Z")
+        selectors.extend([allocation.uid, historical])
+    else:
+        assert not (root / GOVERNANCE_FILENAME).exists()
+    knowledge = load_knowledge_state(root).knowledge
+    assert knowledge is not None
+    for concept in knowledge.concepts:
+        raw = (root / concept.document.canonical_path).read_bytes()
+        assert concept.facets.semantics.page_hash == "sha256:" + hashlib.sha256(raw).hexdigest()
+    return root, selectors, command
+
+
+@pytest.mark.parametrize("format_name", [
+    "sharded-v2", "packed-v3", "packed-v3-deflate", "packed-v4", "packed-v4-deflate",
+])
+def test_migration_preserves_named_concepts_authority_aliases_and_recovery(
+    credential_named_wiki, tmp_path, format_name,
+):
+    root, selectors, _command = credential_named_wiki
+    before = snapshot(root)
+    logical = load_knowledge_state(root).knowledge
+    recovery = tmp_path / "recovery"
+    preview = migrate_knowledge_storage(root, to=format_name, dry_run=True, recovery_dir=recovery)
+    assert preview["changed"]
+    assert snapshot(root) == before
+    assert not recovery.exists()
+
+    applied = migrate_knowledge_storage(root, to=format_name, recovery_dir=recovery)
+    assert applied["root_hash"] == preview["root_hash"]
+    assert load_knowledge_state(root).knowledge == logical
+    for name, raw in before.items():
+        if name.endswith(".md") or name == GOVERNANCE_FILENAME:
+            assert (root / name).read_bytes() == raw
+    after = snapshot(root)
+    assert not migrate_knowledge_storage(root, to=format_name)["changed"]
+    assert snapshot(root) == after
+
+    # Both manifest encodings must support lookup validation with these names.
+    for indexed_manifest in (False, True):
+        if indexed_manifest:
+            migrate_knowledge_storage(root, to="indexed-v6", recovery_dir=tmp_path / "manifest-recovery")
+        assert load_knowledge_state(root).knowledge == logical
+        assert storage_report(root, full=True)["integrity"] == "valid-committed-snapshot"
+        for selector in selectors:
+            capture = capture_knowledge_slice(root, ["concept:" + selector], collections=("concepts",))
+            selected = capture.slice.to_payload()
+            assert selected["lookup_complete"]
+            assert len(selected["records"]["concepts"]) == 1, selector
+            assert selected["records"]["concepts"][0]["value"]["title"] in NAMES
+            capture.finish()
+        task = {
+            "schema_version": "llm-wiki-task-request/v2",
+            "options": {"read_scope": "snapshot", "knowledge_mode": "required"},
+            "requirements": [{"id": "field", "facet": "concept", "selector": selectors[-1]}],
+        }
+        answer = api.build_task_context(task, wiki_dir=str(root))
+        assert api.validate_task_context(answer.rendered, task)["state"] == "covered"
+
+    export_knowledge_v1(root, tmp_path / "export.json")
+    assert (tmp_path / "export.json").read_bytes() == before[".llm-wiki-knowledge.json"]
+    recover_knowledge_storage(root, tmp_path / "manifest-recovery")
+    recover_knowledge_storage(root, recovery)
+    for name, raw in before.items():
+        assert (root / name).read_bytes() == raw
+    assert load_knowledge_state(root).knowledge == logical
+
+
+def test_sync_preserves_named_concepts_and_governance_after_migration(credential_named_wiki, tmp_path):
+    root, _selectors, command = credential_named_wiki
+    before = snapshot(root)
+    migrate_knowledge_storage(root, to="packed-v4-deflate", recovery_dir=tmp_path / "recovery")
+    command("sync", "--src-dir", "source", "--wiki-dir", "wiki", "--jobs", "1",
+            "--no-plugins", "--progress", "never")
+    assert "Preserve this authored explanation." in (root / "entities" / "RuntimeSecretField.md").read_text(encoding="utf-8")
+    if GOVERNANCE_FILENAME in before:
+        assert (root / GOVERNANCE_FILENAME).read_bytes() == before[GOVERNANCE_FILENAME]
+    report = storage_report(root, full=True)
+    assert report["ok"] and report["format"] == "packed-v4-deflate"
+    first_sync = snapshot(root)
+    command("sync", "--src-dir", "source", "--wiki-dir", "wiki", "--jobs", "1",
+            "--no-plugins", "--progress", "never")
+    assert snapshot(root) == first_sync
+
+
+def test_migration_rejects_newline_changes_after_commit(credential_named_wiki, tmp_path):
+    root, _selectors, _command = credential_named_wiki
+    page = root / "entities" / "RuntimeSecretField.md"
+    raw = page.read_bytes()
+    assert b"\r" not in raw and b"\n" in raw
+    page.write_bytes(raw.replace(b"\n", b"\r\n"))
+    before = snapshot(root)
+    recovery = tmp_path / "recovery"
+    with pytest.raises(KnowledgeStorageError, match="authored input changed") as raised:
+        migrate_knowledge_storage(root, to="packed-v4-deflate", dry_run=True, recovery_dir=recovery)
+    assert raised.value.code == "storage-mutation"
+    assert snapshot(root) == before
+    assert not recovery.exists()