[LinuxDevil]

What changed

computeRequirements(spec, deps) — the readiness list of a spec v2: provider key, models in the catalog, named secrets and env vars its { secret }/{ env } refs resolve to, MCP servers, builtin/registry tools and local files, each ok, missing or unknown with a fix where one exists. It never throws (an internal error logs one line and returns []) and never blocks a save. Labels name things, never secret values.

• shared/wireTypes.ts: Requirement interface next to the existing RequirementKind; AgentRecord.requirements?: Requirement[] added. Re-exported from shared/authorWire.ts.
• server/author/requirements.ts (new): RequirementDeps, computeRequirements (providerRows, modelRows, secretRefRows with a deep walk that skips instructions, mcpRows, toolRows, fileRows; sorted missing → unknown → ok then by id, deduped by id) and requirementDeps(root, secrets) — the production deps, built per call so fileExists resolves under the request's workspace root and reports missing for traversal/absolute paths without stat-ing outside it.
• GET /agents/:id/requirements → Requirement[] (404 { error: 'Agent not found.' }), and GET /agents/:id now embeds record.requirements.
• Named-secret check uses the store's merged getSecret(name) (the ticket's hasNamed); provider keys via getKey + PROVIDER_KEY_ENV, openrouter/google via their env vars, ollama/mock keyless, anything else unknown.

How tested

• npm run typecheck:server — clean
• npm run test:server — 74 files / 997 tests pass (28 new: one case per rules-table row, dedupe, ordering, throw path, path escape; route 200/404)
• Studio npm run typecheck, npm test -- --run (946), npm run lint --workspace apps/agent-forge (0 errors)
• Root npx tsc --noEmit, npm run lint, npm run test:coverage (7163 pass; needed npm run build -w create-lousho in the fresh worktree for its dist-dependent tests), npm run fallow (0 issues, 0 above threshold), npm run docs:ratchet, npm run api:check, npm run docs:llms:check, npm run size-check — all pass

Pre-existing/environmental notes: on this Windows checkout, templates/*/README.md are smudged to CRLF by core.autocrlf, which made 6 src/spec/v2/templates.test.ts assertions fail on the first coverage run (unrelated to this change; passes with LF bytes). The known runRegistry flake did not reproduce.

Acceptance criteria

• Spec with model: anthropic/…, no stored key, no env → one provider:anthropic missing row with the settings fix
• { secret: 'GITHUB_TOKEN' } nested inside mcpServers.gh.env is found once even if referenced twice
• A file ref ../../etc/passwd is reported missing and never stat-ed outside baseDir
• An exception inside a helper returns [], not a throw
• Order: missing rows first

Generated with Devin