Fix case-sensitive canonical documentation import

.github/workflows/pages.yml

@@ -42,8 +42,6 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
-          cache: pnpm
-          cache-dependency-path: site/pnpm-lock.yaml
 
       - name: Install pinned Rust and pnpm
         run: |

public/meta/agentctl-source.json

@@ -2,7 +2,7 @@
   "product": "agentctl",
   "version": "0.2.0",
   "workflowApi": "agentctl.dev/v1alpha1",
-  "commit": "0ae1e381b87ea815f0d4ca66689db10bb1129e4a",
+  "commit": "a1ebcadcc2557136cb82633862c50854223981fa",
   "dirty": false,
   "sourceRepository": "https://github.com/opensourceops/agentctl",
   "importedFiles": 56

scripts/content-manifest.mjs

@@ -1,9 +1,9 @@
 export const contentManifest = [
   ['docs/PRODUCT.md', '_generated/concepts/product.md', 'Product definition', 'What agentctl does, who it serves, and where its boundary ends.'],
   ['docs/DSL.md', '_generated/concepts/workflow-model.md', 'Workflow model', 'Strict YAML, tasks, templates, actions, agents, and validation.'],
-  ['docs/POLICIES.md', '_generated/concepts/policies.md', 'Policies and approvals', 'Keep authority outside the model with explicit grants and durable decisions.'],
+  ['docs/policies.md', '_generated/concepts/policies.md', 'Policies and approvals', 'Keep authority outside the model with explicit grants and durable decisions.'],
   ['docs/TOOLS.md', '_generated/concepts/tools.md', 'Tools and effects', 'Tool contracts, effect classes, idempotency, and deterministic checks.'],
-  ['docs/MEMORY.md', '_generated/concepts/memory.md', 'State and memory', 'Separate runtime state, working memory, long-term memory, and prompt cache.'],
+  ['docs/memory.md', '_generated/concepts/memory.md', 'State and memory', 'Separate runtime state, working memory, long-term memory, and prompt cache.'],
   ['docs/PACKS.md', '_generated/concepts/packs.md', 'Reusable packs', 'Use versioned local content with integrity verification.'],
   ['docs/guides/INSTALLATION.md', '_generated/getting-started/installation.md', 'Installation', 'Build or install the current v1alpha1 candidate from reviewed source.'],
   ['docs/guides/GETTING_STARTED.md', '_generated/getting-started/index.md', 'Getting started', 'Run and inspect a credential-free deterministic workflow.'],

scripts/sync-agentctl.mjs

@@ -44,6 +44,20 @@ if (!agentctlRoot) {
   );
 }
 
+const trackedPaths = new Set(
+  execFileSync('git', ['ls-files'], {
+    cwd: agentctlRoot,
+    encoding: 'utf8',
+  })
+    .trim()
+    .split('\n'),
+);
+for (const [source] of contentManifest) {
+  if (!trackedPaths.has(source)) {
+    throw new Error(`Canonical source path must exactly match Git: ${source}`);
+  }
+}
+
 const sourceMap = new Map();
 for (const [source, target] of contentManifest) {
   const slug = target

src/content/docs/_generated/architecture/decisions/0001.md

@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 The graph, policy, state machine, persistence decisions, and recorded replay remain model-independent. Provider, tool, filesystem, process, MCP, A2A, internal-state mutation, clock, and ID behavior cross injected interfaces and receive durable effect identity when externally observable.
 
 This keeps models replaceable and tests credential-free. It requires more records and conservative uncertain states, but avoids hidden calls during replay. Dynamic model-owned orchestration is rejected.
-> Canonical source: [`docs/adr/0001-deterministic-core-explicit-effects.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0001-deterministic-core-explicit-effects.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0001-deterministic-core-explicit-effects.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0001-deterministic-core-explicit-effects.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/architecture/decisions/0002.md

@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 Workflows use `apiVersion`, `kind`, `metadata`, and `spec`. The envelope is adopted because identity/version and evolution need unambiguous locations, not because another system uses it. All typed objects deny unknown fields and a generated JSON Schema is checked in.
 
 A narrow legacy translator provides actionable migration. General aliases and silent coercion are rejected because they make security review and durable reproduction ambiguous.
-> Canonical source: [`docs/adr/0002-versioned-strict-workflow-envelope.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0002-versioned-strict-workflow-envelope.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0002-versioned-strict-workflow-envelope.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0002-versioned-strict-workflow-envelope.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/architecture/decisions/0003.md

@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 One versioned SQLite database is the local correctness store. Transactional task transitions/checkpoints/audits and a request-before-start effect ledger support resume and no-effect replay. Confirmed results are reused; started unconfirmed work becomes uncertain.
 
 No exactly-once claim is made. Automatic retry of ambiguous external effects is rejected. Fork is the explicit operation for fresh effects. Distributed history services are outside this release.
-> Canonical source: [`docs/adr/0003-sqlite-history-and-conservative-recovery.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0003-sqlite-history-and-conservative-recovery.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0003-sqlite-history-and-conservative-recovery.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0003-sqlite-history-and-conservative-recovery.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/architecture/decisions/0004.md

@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 OpenAI Responses, Azure OpenAI Responses, Anthropic Messages, Google Gemini generateContent, and a scripted fake implement one provider-neutral internal interface. Capabilities are negotiated before execution; provider SDK/HTTP shapes never enter durable core state.
 
 “OpenAI-compatible” shims are rejected as a support claim because they hide native tool, continuation, reasoning, error, and usage differences. Every provider requires mock protocol coverage; live credentials are optional evidence only.
-> Canonical source: [`docs/adr/0004-native-provider-adapters.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0004-native-provider-adapters.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0004-native-provider-adapters.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0004-native-provider-adapters.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/architecture/decisions/0005.md

@@ -8,4 +8,4 @@ Status: accepted, 2026-07-22.
 V1alpha1 schedules a sequential DAG in declaration order and integrates typed actions/tools, local packs, MCP 2025-11-25, and A2A 1.0. `maxConcurrency` greater than one is rejected.
 
 Parallel groups, loops, routing, sub-workflows, teams/handoffs, automatic reconnection/resubmission, executable plugin ABIs, and registries are deferred. Each needs deterministic merge, cancellation, policy, version, and recovery semantics before it can enter the stable contract.
-> Canonical source: [`docs/adr/0005-narrow-v1-scheduling-and-extensions.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0005-narrow-v1-scheduling-and-extensions.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0005-narrow-v1-scheduling-and-extensions.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0005-narrow-v1-scheduling-and-extensions.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/architecture/decisions/0006.md

@@ -16,4 +16,4 @@ Machine output is one `agentctl.dev/cli/v1` final envelope. Inputs come from JSO
 ## Consequences
 
 Cron, systemd, Kubernetes, and CI can use normal process semantics without hidden terminal waits. The product avoids an eventing/distributed-control-plane surface. A future schedule-run key may improve deduplication, but it cannot replace external overlap controls or effect idempotency.
-> Canonical source: [`docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0006-schedulable-runtime-and-noninteractive-contract.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/architecture/decisions/0007.md

@@ -14,4 +14,4 @@ The image entrypoint is `agentctl`. Callers supply ordinary CLI arguments and on
 ## Consequences
 
 No vendor-specific plugin API is required. Platforms without direct entrypoint/argument support can invoke `docker run` from their normal shell step. Distroless reduces runtime surface but deliberately has no shell; debugging uses the public CLI or a separate diagnostic image, not mutation of production images.
-> Canonical source: [`docs/adr/0007-generic-oci-step-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0007-generic-oci-step-contract.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/adr/0007-generic-oci-step-contract.md`](https://github.com/opensourceops/agentctl/blob/main/docs/adr/0007-generic-oci-step-contract.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/architecture/diagrams.md

@@ -291,4 +291,4 @@ flowchart TD
 ```
 
 `agentctl-core` has no dependency on HTTP, SQLite, CLI parsing, or concrete executor types. `xtask` drives the built CLI for generation and acceptance.
-> Canonical source: [`docs/architecture/DIAGRAMS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/architecture/DIAGRAMS.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/architecture/DIAGRAMS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/architecture/DIAGRAMS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/architecture/index.md

@@ -37,4 +37,4 @@ The workspace uses Rust edition 2024, pins Rust 1.88 as the MSRV, forbids unsafe
 The OCI build is multi-stage: only the optimized Rust binary enters a maintained distroless runtime with CA roots and a non-root identity. `/config` is workflow configuration, `/workspace` is the read-only working tree, `/state` holds SQLite, and `/artifacts` receives declared outputs. State must be mounted again for inspect/resume/replay. The root filesystem may be read-only. See [Container contract](/agentctl/guides/container/) and ADR 0007.
 
 See the [architecture diagrams](/agentctl/architecture/diagrams/), [ADRs](https://github.com/opensourceops/agentctl/blob/main/docs/adr/), and [Durable execution](/agentctl/durable-execution/) for failure semantics.
-> Canonical source: [`docs/ARCHITECTURE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/ARCHITECTURE.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/ARCHITECTURE.md`](https://github.com/opensourceops/agentctl/blob/main/docs/ARCHITECTURE.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/concepts/memory.md

@@ -1,7 +1,7 @@
 ---
 title: "State and memory"
 description: "Separate runtime state, working memory, long-term memory, and prompt cache."
-editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/MEMORY.md"
+editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/memory.md"
 ---
 Four mechanisms remain intentionally separate:
 
@@ -11,4 +11,4 @@ Four mechanisms remain intentionally separate:
 - Provider prompt cache is an optional performance optimization. Cache keys/options and usage counts are provider metadata, never correctness or memory.
 
 Long-term retrieval is exact namespace/key lookup in this release. Vector search and automatic promotion are not implemented. A workflow promotes a value explicitly by reading long-term memory and then writing working memory. Retention is applied by expiration/GC, not by replay.
-> Canonical source: [`docs/MEMORY.md`](https://github.com/opensourceops/agentctl/blob/main/docs/MEMORY.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/memory.md`](https://github.com/opensourceops/agentctl/blob/main/docs/memory.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/concepts/packs.md

@@ -8,4 +8,4 @@ A pack is reviewed reusable YAML content, not executable plugin code. Its manife
 `agentctl packs inspect` strictly parses the manifest, validates the API version, name, versions, and compatibility with the running binary. `agentctl packs verify` compares a `sha256:` integrity digest for a local manifest or archive. Workflow pack references carry name, version, local path, and integrity. The CLI verifies a referenced manifest, keeps it beneath the workflow directory, and loads actions, agents, and tools as `<pack-name>.<item-name>` before compilation.
 
 Dependency resolution, transitive lockfile generation, Git fetching, reusable sub-workflows, policy-default merging, a hosted registry, native dynamic libraries, and pack processes are not implemented. A checked-in pack reference is therefore an integrity/provenance contract for local content, not a package manager. Manifest policy defaults are inspectable metadata and never weaken the invoking workflow’s policy.
-> Canonical source: [`docs/PACKS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PACKS.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/PACKS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PACKS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/concepts/policies.md

@@ -1,7 +1,7 @@
 ---
 title: "Policies and approvals"
 description: "Keep authority outside the model with explicit grants and durable decisions."
-editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/POLICIES.md"
+editUrl: "https://github.com/opensourceops/agentctl/edit/main/docs/policies.md"
 ---
 Policy is evaluated by the runtime, never by a model. A policy defines a canonical workspace root, writable roots, allowed environment names, network host patterns, process basenames, providers, tool allow/deny lists, approval mode, and non-interactive behavior.
 
@@ -12,4 +12,4 @@ Tool visibility, tool/capability authorization, resource checks, effect risk, an
 An approval stores the run/trace/task/agent, tool, capability, risk, redacted input, expected effect, reason, and resolution actor/reason. The associated task waits durably. Use `approvals list`, `approve`, or `reject`, then `resume`. Resolution and effect status are auditable.
 
 Provider, MCP, A2A, filesystem, process, and environment allowlists are necessary controls, not a containment boundary. Run untrusted executors inside an external OS/container sandbox.
-> Canonical source: [`docs/POLICIES.md`](https://github.com/opensourceops/agentctl/blob/main/docs/POLICIES.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/policies.md`](https://github.com/opensourceops/agentctl/blob/main/docs/policies.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/concepts/product.md

@@ -37,4 +37,4 @@ Version 0.2 is a production-oriented alpha with executable evidence for the stat
 This is not a chat-agent or multi-agent conversation framework: workflows, not conversations, own control flow. It is not CI/CD: it can run inside CI but does not manage runners or deployment environments. It borrows idempotence and check/diff vocabulary from Ansible without becoming configuration management. It borrows plan/effect separation from Terraform without owning infrastructure state. It is not a hosted orchestrator or general scripting language: one local process, SQLite, constrained templates, typed actions, and explicit remote effects are intentional boundaries.
 
 The differentiator is the combination of deterministic compilation, honest predictability, durable effect identity, recorded no-effect replay, native provider portability, and policy decisions made outside the model.
-> Canonical source: [`docs/PRODUCT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PRODUCT.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/PRODUCT.md`](https://github.com/opensourceops/agentctl/blob/main/docs/PRODUCT.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/concepts/tools.md

@@ -12,4 +12,4 @@ Built-in model-callable tools are workspace read, workspace write, and echo. The
 Built-in actions are assign, assert, file read/write, direct process execution, run working-memory read/write, SQLite long-term-memory read/write, MCP call, and A2A delegation. File writes use a temporary file plus rename and return before/after/diff. Shell execution uses a direct executable and argv, never an implicit shell, clears inherited environment, applies allowlisted variables, and is not an OS sandbox.
 
 Check mode executes pure/internal simulation and observation needed for dataflow but never filesystem, process, remote, or model mutation. Results say fully predictable, partially predictable, or requires execution; unknown external work is never reported as predicted.
-> Canonical source: [`docs/TOOLS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/TOOLS.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/TOOLS.md`](https://github.com/opensourceops/agentctl/blob/main/docs/TOOLS.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/concepts/workflow-model.md

@@ -18,4 +18,4 @@ The compiler validates missing references, duplicate tasks, cycles, task-aware t
 The parser translates a limited unversioned `playbook:` document and emits a migration warning. Use `agentctl migrate old.yaml --write new.yaml`. Legacy pack-backed, MCP, A2A, provider-specific, and broad module configurations need manual migration; see [Migrating from TypeScript](/agentctl/reference/migration/).
 
 Not implemented in v1alpha1: `foreach`, matrix expansion, parallel groups, routers, loops, sub-workflows, `finally`, handlers, event triggers, or compensation execution. They remain excluded until their deterministic state, merge, and recovery semantics are specified.
-> Canonical source: [`docs/DSL.md`](https://github.com/opensourceops/agentctl/blob/main/docs/DSL.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/DSL.md`](https://github.com/opensourceops/agentctl/blob/main/docs/DSL.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.

src/content/docs/_generated/contributing/add-action.md

@@ -42,4 +42,4 @@ cargo xtask generate
 cargo xtask docs-verify
 cargo xtask verify
 ```
-> Canonical source: [`docs/development/ADD_ACTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_ACTION.md). Verified against agentctl commit `0ae1e381b87ea815f0d4ca66689db10bb1129e4a`.
+> Canonical source: [`docs/development/ADD_ACTION.md`](https://github.com/opensourceops/agentctl/blob/main/docs/development/ADD_ACTION.md). Verified against agentctl commit `a1ebcadcc2557136cb82633862c50854223981fa`.