@@ -0,0 +1,16 @@
+---
+'@objectstack/cli': patch
+---
+
+feat(cli): `os validate --target ./restriction-profile.json` judges the stack against a target environment's restriction profile
+
+Clause-②: yes
+Metadata-protocol: none
+
+A hosted environment differs from a local one only by the restriction profile it publishes (`RestrictionProfileSchema`, `@objectstack/spec/system`). `os validate --target ./restriction-profile.json` reads that profile, parses it with the spec's schema (an invalid profile is refused, naming the schema issue), and refuses every item of the stack the profile forbids — one row per item, each naming the item and the one profile dimension that refuses it:
+
+- `allowCode: false` refuses each object lifecycle hook, each named handler function, each code plugin and the other keys the spec classifies as code, a `script` flow node, and a flow node whose type is not in the spec's built-in node registry (`FlowNodeAction`), which `allowedFlowNodeTypes` cannot name;
+- `allowScheduledAutomation: false` refuses each flow of `type: 'schedule'` and each background job;
+- `allowedFlowNodeTypes` refuses each flow node, at any region depth, whose built-in type is not listed; `start` and `end` are always allowed.
+
+When the project's `@objectstack/spec` or `@objectstack/skills` is not the version the target runs, the command warns (`--json`: an entry in `warnings` with `package`, `local` and `target`); it does not refuse, and `--strict` does not gate it. Without `--target` the command is unchanged. Only a profile file is accepted: a URL is refused, because no environment publishes its profile at a defined address yet.
@@ -91,6 +91,15 @@ import { findFlowCycleRefusals } from '../utils/flow-undeclared-cycle.js';
 // reported when the declaring package depends on packages outside the stack.
 // Walked the way the load path registers, like the refusal above.
 import { judgePicklistReferences, picklistRefusalHeading, printPicklistReferenceNotices } from '../utils/picklist-references.js';
+// `--target`: a target environment's restriction profile (`RestrictionProfileSchema`,
+// `@objectstack/spec/system`) — what that environment refuses, and the versions it runs.
+import {
+  loadRestrictionProfile,
+  judgeRestrictionProfile,
+  restrictionProfileVersionDrift,
+  type ParsedRestrictionProfile,
+  type RestrictionVersionDrift,
+} from '../utils/restriction-profile.js';
 
 export default class Validate extends Command {
   static override description =
@@ -103,6 +112,11 @@ export default class Validate extends Command {
   static override flags = {
     strict: Flags.boolean({ description: 'Treat warnings as errors' }),
     json: Flags.boolean({ description: 'Output results as JSON' }),
+    target: Flags.string({
+      description:
+        'Also judge the stack against a target environment\'s restriction profile (a JSON file): refuse what '
+        + 'it forbids, warn when the local @objectstack/spec / @objectstack/skills version differs from the target\'s',
+    }),
   };
 
   async run(): Promise<void> {
@@ -206,6 +220,13 @@ export default class Validate extends Command {
     // permission-set lists: reports, never refuses, NOT in `--strict`'s list,
     // and `os compile` computes the identical records.
     let dependencyRangeWarnings: DependencyRangeDiagnostic[] = [];
+    // `--target` only (step 1c): the local `@objectstack/spec` / `@objectstack/skills`
+    // versions that are not the ones the target's restriction profile says it
+    // runs. Same class as the list above — reports, never refuses, and is NOT in
+    // the `warnings` list `--strict` reads: the target's version is the
+    // environment's, not something this stack can fix, the reason the protocol
+    // drift advisory is never gated by `--strict` either. Empty without `--target`.
+    let targetVersionWarnings: RestrictionVersionDrift[] = [];
     const warningsSoFar = () => [
       ...ruleAdvisories,
       ...docWarnings,
@@ -228,6 +249,8 @@ export default class Validate extends Command {
       ...picklistReferenceNotices,
       // APPENDED for the same reason, one member later again.
       ...dependencyRangeWarnings,
+      // APPENDED for the same reason, one member later again.
+      ...targetVersionWarnings,
     ];
     // [commit 79cf692b0] The ADR-0087 D2 conversion notices, hoisted for the SAME reason
     // and under the SAME ruling as the five lists above — one field over. The
@@ -264,6 +287,19 @@ export default class Validate extends Command {
     const conversionNotices: ConversionNotice[] = [];
 
     try {
+      // 0. `--target`: read the target environment's restriction profile FIRST,
+      //    before the stack — an unreadable or invalid profile is refused
+      //    (thrown into the catch-all: `--json` gets `error`, exit 1) whatever
+      //    the stack holds, so no run ever judges against half a profile. No
+      //    `--target`, no profile: nothing below that reads it runs, and the
+      //    command is exactly what it was.
+      let targetProfile: ParsedRestrictionProfile | undefined;
+      if (flags.target !== undefined) {
+        const loadedProfile = loadRestrictionProfile(flags.target);
+        targetProfile = loadedProfile.profile;
+        if (!flags.json) printKV('Target profile', loadedProfile.file);
+      }
+
       // 1. Load configuration
       if (!flags.json) printStep('Loading configuration...');
       const loaded = await loadConfig(args.config);
@@ -291,6 +327,18 @@ export default class Validate extends Command {
         printKV('Load time', `${duration}ms`);
       }
 
+      // 1c. `--target`: the version drift between this project and the target.
+      //     Warns, never refuses (see `targetVersionWarnings` above). Resolved
+      //     from the config's directory — the project being validated.
+      if (targetProfile) {
+        targetVersionWarnings = restrictionProfileVersionDrift(targetProfile, dirname(absolutePath));
+        if (targetVersionWarnings.length > 0 && !flags.json) {
+          console.log('');
+          printWarning(`Version drift from the target environment (${targetVersionWarnings.length})`);
+          printBulletList(targetVersionWarnings.map((w) => w.message), { noun: 'version drift warning' });
+        }
+      }
+
       // 2. Normalize map-formatted stack definition and validate against schema.
       //    The ADR-0087 D2 conversion layer runs here (inside normalizeStackInput);
       //    surface each applied conversion as a non-blocking deprecation notice so
@@ -1054,6 +1102,37 @@ export default class Validate extends Command {
         printBulletList(dependencyRangeWarnings.map(formatDependencyRangeDiagnostic), { noun: 'dependency-range diagnostic' });
       }
 
+      // 3f. `--target`: what the target environment's restriction profile
+      //     forbids. LAST of the refusals on purpose: every gate above asks
+      //     whether ANY runtime accepts the stack, this one asks whether THIS
+      //     target does, and the first question is the one worth answering
+      //     first. One row per refused item, each naming the item and the one
+      //     profile dimension that refuses it (`utils/restriction-profile.ts`
+      //     holds the reader rules).
+      if (targetProfile) {
+        const restrictionRefusals = judgeRestrictionProfile(result.data as Record<string, unknown>, targetProfile);
+        if (restrictionRefusals.length > 0) {
+          if (flags.json) {
+            await emitJson({
+              valid: false,
+              errors: restrictionRefusals,
+              warnings: warningsSoFar(),
+              conversions: conversionNotices,
+              duration: timer.elapsed(),
+            });
+            this.exit(1);
+          }
+          const n = restrictionRefusals.length;
+          console.log('');
+          printError(`The target environment's restriction profile refuses this stack (${n} item${n > 1 ? 's' : ''})`);
+          printBulletList(
+            restrictionRefusals.map((r) => `[${r.rule}] ${r.where}: ${r.message}`),
+            { noun: 'restriction refusal(s)', remedy: JSON_FULL_LIST_REMEDY },
+          );
+          this.exit(1);
+        }
+      }
+
       // 4. Collect and display stats
       const stats = collectMetadataStats(config);
 
 
@@ -0,0 +1,232 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The reader of a target environment's restriction profile
+ * (`restriction-profile.ts`): one refusal per profile dimension, the three
+ * reader rules, the version drift warning, and an invalid profile refused.
+ * `test/validate-target-restriction-profile.test.ts` holds the command's door.
+ */
+
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { FLOW_BUILTIN_NODE_TYPES } from '@objectstack/spec/automation';
+
+import {
+  judgeRestrictionProfile,
+  loadRestrictionProfile,
+  restrictionProfileVersionDrift,
+  type ParsedRestrictionProfile,
+} from './restriction-profile.js';
+
+/** Everything on: every built-in node type listed, code and schedules allowed. */
+const OPEN: ParsedRestrictionProfile = {
+  allowCode: true,
+  allowScheduledAutomation: true,
+  allowedFlowNodeTypes: [...FLOW_BUILTIN_NODE_TYPES] as ParsedRestrictionProfile['allowedFlowNodeTypes'],
+  versions: { spec: '18.4.0', skills: '18.4.0' },
+};
+const profile = (patch: Partial<ParsedRestrictionProfile>): ParsedRestrictionProfile => ({ ...OPEN, ...patch });
+
+const node = (id: string, type: string, extra: Record<string, unknown> = {}) => ({ id, type, label: id, ...extra });
+const flow = (name: string, nodes: unknown[], extra: Record<string, unknown> = {}) => ({
+  name, label: name, type: 'autolaunched', nodes, edges: [], ...extra,
+});
+
+/** One item per dimension, plus the reader-rule cases. */
+const STACK = {
+  manifest: { id: 'com.example.rp', namespace: 'rp', version: '1.0.0', name: 'Rp', type: 'app' },
+  hooks: [{ name: 'rp_audit', object: 'rp_doc', events: ['beforeInsert'], handler: 'rp_audit_fn' }],
+  functions: { rp_audit_fn: 'rp_audit_fn', rp_calc: 'rp_calc' },
+  plugins: ['@acme/rp-plugin'],
+  jobs: [{ name: 'rp_sweep', schedule: { type: 'interval', intervalMs: 60_000 }, handler: 'rp_calc' }],
+  flows: [
+    flow('rp_nightly', [node('start', 'start'), node('end', 'end')], { type: 'schedule' }),
+    flow('rp_route', [
+      node('start', 'start'),
+      node('fetch', 'get_record'),
+      node('call', 'http'),
+      node('calc', 'script', { config: { function: 'rp_calc' } }),
+      node('ok', 'approval'),
+      node('end', 'end'),
+    ]),
+  ],
+};
+
+const rowsOf = (p: ParsedRestrictionProfile, stack: Record<string, unknown> = STACK) =>
+  judgeRestrictionProfile(stack, p).map(({ rule, where, path }) => ({ rule, where, path }));
+
+describe('judgeRestrictionProfile — one refusal per dimension', () => {
+  it('CONTROL: a profile that allows everything refuses nothing', () => {
+    expect(rowsOf(OPEN)).toEqual([]);
+  });
+
+  it('allowCode: false refuses each hook, each function and each plugin — every row naming allowCode', () => {
+    const rows = rowsOf(profile({ allowCode: false }));
+    expect(rows).toEqual([
+      { rule: 'allowCode', where: "hook 'rp_audit'", path: 'hooks[0]' },
+      { rule: 'allowCode', where: "function 'rp_audit_fn'", path: 'functions.rp_audit_fn' },
+      { rule: 'allowCode', where: "function 'rp_calc'", path: 'functions.rp_calc' },
+      { rule: 'allowCode', where: "plugin '@acme/rp-plugin'", path: 'plugins[0]' },
+      { rule: 'allowCode', where: "flow 'rp_route' › node 'calc' (script)", path: 'flows[1].nodes[3]' },
+      { rule: 'allowCode', where: "flow 'rp_route' › node 'ok' (approval)", path: 'flows[1].nodes[4]' },
+    ]);
+  });
+
+  it('allowCode: false — an empty code key carries nothing and refuses nothing', () => {
+    const stack = { manifest: STACK.manifest, functions: {}, plugins: [] };
+    expect(rowsOf(profile({ allowCode: false }), stack)).toEqual([]);
+  });
+
+  it('allowCode: false — a code key on the manifest is refused under its manifest path', () => {
+    const stack = { manifest: { ...STACK.manifest, main: 'dist/index.mjs' } };
+    expect(rowsOf(profile({ allowCode: false }), stack)).toEqual([
+      { rule: 'allowCode', where: '`main`', path: 'manifest.main' },
+    ]);
+  });
+
+  it('allowScheduledAutomation: false refuses the scheduled flow and the job, naming that rule', () => {
+    expect(rowsOf(profile({ allowScheduledAutomation: false }))).toEqual([
+      { rule: 'allowScheduledAutomation', where: "job 'rp_sweep'", path: 'jobs[0]' },
+      { rule: 'allowScheduledAutomation', where: "flow 'rp_nightly'", path: 'flows[0]' },
+    ]);
+  });
+
+  it('allowedFlowNodeTypes refuses each node whose built-in type is not listed', () => {
+    const rows = rowsOf(profile({ allowedFlowNodeTypes: ['get_record', 'script'] }));
+    expect(rows).toEqual([
+      { rule: 'allowedFlowNodeTypes', where: "flow 'rp_route' › node 'call' (http)", path: 'flows[1].nodes[2]' },
+    ]);
+  });
+
+  it('allowedFlowNodeTypes reaches a node inside a region, at its region path', () => {
+    const stack = {
+      manifest: STACK.manifest,
+      flows: [flow('rp_deep', [
+        node('start', 'start'),
+        node('each', 'loop', { config: { body: { nodes: [node('send', 'notify')], edges: [] } } }),
+        node('end', 'end'),
+      ])],
+    };
+    expect(rowsOf(profile({ allowedFlowNodeTypes: ['loop'] }), stack)).toEqual([
+      { rule: 'allowedFlowNodeTypes', where: "flow 'rp_deep' › loop 'each' body › node 'send' (notify)", path: 'flows[0].nodes[1].config.body.nodes[0]' },
+    ]);
+  });
+
+  it('walks each packages[] entry of an assembled artifact, at that entry\'s path', () => {
+    const stack = {
+      manifest: STACK.manifest,
+      packages: [
+        { manifest: { id: 'com.example.rp', name: 'Rp', hooks: [] } },
+        { manifest: { id: 'com.example.rp.ops', name: 'Ops', hooks: STACK.hooks, jobs: STACK.jobs } },
+      ],
+    };
+    expect(rowsOf(profile({ allowCode: false, allowScheduledAutomation: false }), stack)).toEqual([
+      { rule: 'allowCode', where: "hook 'rp_audit'", path: 'packages[1].manifest.hooks[0]' },
+      { rule: 'allowScheduledAutomation', where: "job 'rp_sweep'", path: 'packages[1].manifest.jobs[0]' },
+    ]);
+  });
+});
+
+describe('judgeRestrictionProfile — the reader rules', () => {
+  it('start / end are always allowed, even by a profile that lists no node type', () => {
+    const stack = { manifest: STACK.manifest, flows: [flow('rp_bare', [node('start', 'start'), node('end', 'end')])] };
+    expect(rowsOf(profile({ allowedFlowNodeTypes: [] }), stack)).toEqual([]);
+  });
+
+  it('a type outside FlowNodeAction is governed by allowCode: refused naming allowCode when it is false', () => {
+    const rows = judgeRestrictionProfile(STACK, profile({ allowCode: false })).filter((r) => r.where.includes('(approval)'));
+    expect(rows.map((r) => r.rule)).toEqual(['allowCode']);
+    expect(rows[0]!.message).toContain('allowedFlowNodeTypes` cannot name it');
+  });
+
+  it('a type outside FlowNodeAction is allowed when allowCode is true, whatever allowedFlowNodeTypes lists', () => {
+    const rows = rowsOf(profile({ allowedFlowNodeTypes: ['get_record', 'http', 'script'] }));
+    expect(rows.filter((r) => r.where.includes('(approval)'))).toEqual([]);
+  });
+
+  it('a script node under allowCode: false is refused naming ONE rule, also when allowedFlowNodeTypes omits it', () => {
+    const rows = rowsOf(profile({ allowCode: false, allowedFlowNodeTypes: ['get_record', 'http'] }));
+    expect(rows.filter((r) => r.where.includes('(script)'))).toEqual([
+      { rule: 'allowCode', where: "flow 'rp_route' › node 'calc' (script)", path: 'flows[1].nodes[3]' },
+    ]);
+  });
+
+  it('a script node under allowCode: true is judged by allowedFlowNodeTypes', () => {
+    const rows = rowsOf(profile({ allowedFlowNodeTypes: ['get_record', 'http'] }));
+    expect(rows).toEqual([
+      { rule: 'allowedFlowNodeTypes', where: "flow 'rp_route' › node 'calc' (script)", path: 'flows[1].nodes[3]' },
+    ]);
+  });
+});
+
+describe('loadRestrictionProfile', () => {
+  let dir = '';
+  beforeAll(() => {
+    dir = mkdtempSync(join(tmpdir(), 'os-restriction-profile-'));
+  });
+  afterAll(() => {
+    if (dir) rmSync(dir, { recursive: true, force: true });
+  });
+
+  it('parses a valid profile file with the spec schema', () => {
+    writeFileSync(join(dir, 'ok.json'), JSON.stringify(OPEN));
+    expect(loadRestrictionProfile('ok.json', dir).profile).toEqual(OPEN);
+  });
+
+  it('refuses an invalid profile, naming the schema issue', () => {
+    writeFileSync(join(dir, 'bad.json'), JSON.stringify({ ...OPEN, allowedFlowNodeTypes: ['approval'] }));
+    expect(() => loadRestrictionProfile('bad.json', dir)).toThrow(/not a valid restriction profile.*allowedFlowNodeTypes\.0/);
+  });
+
+  it('refuses {} — an absent dimension is not "no restriction"', () => {
+    writeFileSync(join(dir, 'empty.json'), '{}');
+    expect(() => loadRestrictionProfile('empty.json', dir)).toThrow(/allowCode/);
+  });
+
+  it('refuses a file that is not JSON, and a missing file', () => {
+    writeFileSync(join(dir, 'garbled.json'), 'allowCode: false');
+    expect(() => loadRestrictionProfile('garbled.json', dir)).toThrow(/is not JSON/);
+    expect(() => loadRestrictionProfile('missing.json', dir)).toThrow(/no restriction profile file/);
+  });
+
+  it('refuses a URL rather than fetching from a guessed route', () => {
+    expect(() => loadRestrictionProfile('https://env.example.com', dir)).toThrow(/does not publish its restriction profile at a defined/);
+  });
+});
+
+describe('restrictionProfileVersionDrift', () => {
+  let dir = '';
+  const install = (name: string, version: string) => {
+    const at = join(dir, 'node_modules', ...name.split('/'));
+    mkdirSync(at, { recursive: true });
+    writeFileSync(join(at, 'package.json'), JSON.stringify({ name, version }));
+  };
+  beforeAll(() => {
+    dir = mkdtempSync(join(tmpdir(), 'os-restriction-versions-'));
+    writeFileSync(join(dir, 'package.json'), JSON.stringify({ name: 'rp-app', private: true }));
+    install('@objectstack/spec', '18.4.0');
+    install('@objectstack/skills', '18.4.0');
+  });
+  afterAll(() => {
+    if (dir) rmSync(dir, { recursive: true, force: true });
+  });
+
+  it('CONTROL: no warning when both local versions are the target\'s', () => {
+    expect(restrictionProfileVersionDrift(OPEN, dir)).toEqual([]);
+  });
+
+  it('warns — one entry per package that differs, local and target named', () => {
+    const drift = restrictionProfileVersionDrift(profile({ versions: { spec: '18.5.0', skills: '18.4.0' } }), dir);
+    expect(drift.map(({ package: name, local, target }) => ({ name, local, target }))).toEqual([
+      { name: '@objectstack/spec', local: '18.4.0', target: '18.5.0' },
+    ]);
+  });
+
+  it('warns when the project does not install @objectstack/skills at all', () => {
+    rmSync(join(dir, 'node_modules', '@objectstack', 'skills'), { recursive: true, force: true });
+    const drift = restrictionProfileVersionDrift(OPEN, dir);
+    expect(drift.map(({ package: name, local }) => ({ name, local }))).toEqual([{ name: '@objectstack/skills', local: null }]);
+  });
+});